@leavepulse/control-sdk 0.3.48 → 0.3.50

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@leavepulse/control-sdk",
-	"version": "0.3.48",
+	"version": "0.3.50",
 	"description": "Generated resource SDK (@leavepulse/control-sdk).",
 	"type": "module",
 	"module": "index.ts",

package/resources/ControlDcimComponentType.ts

@@ -35,6 +35,18 @@ export class ControlDcimComponentType extends Resource<Data> {
 		);
 	}
 
+	/** control.dcim.catalog.component_types.get */
+	async controlDcimCatalogComponentTypesGet(): Promise<models.ComponentTypeDTO> {
+		return fetchCachedOrThrow<models.ComponentTypeDTO>(
+			this.ctx.transport,
+			this.ctx.etagStore,
+			{
+				method: "GET",
+				path: `/v1/control/dcim/catalog/component-types/${this.id}`,
+			},
+		);
+	}
+
 	/** control.dcim.catalog.component_types.upsert */
 	async dcimCatalogComponentTypesUpsert(
 		body: models.UpsertComponentTypeRequest,

package/runtime/realtime-client.ts

@@ -60,6 +60,51 @@ interface PendingRequest {
 
 const DEFAULT_MIN_MS = 500;
 const DEFAULT_MAX_MS = 30_000;
+/**
+ * How long before a ws-token expires to fetch and send the next one.
+ *
+ * The gateway accepts an `auth` frame at any point in a session and rebinds the
+ * socket, but nothing was ever sending a second one: the token was presented
+ * once at connect and then left to rot. A ws-token lives two minutes, so every
+ * live subscription was torn down and rebuilt on that cycle — visible on the
+ * server as a matched pair of "connection closed" every 120s, and to an
+ * operator as live metrics that stall, because the agent's fast-sample tier is
+ * driven by subscriber count and dropped to idle in each gap.
+ *
+ * The margin has to cover fetching a fresh token (a round trip to auth-service)
+ * plus clock skew between the browser and the issuer.
+ */
+const AUTH_REFRESH_MARGIN_MS = 20_000;
+/** Never re-arm faster than this, however short-lived the token claims to be. */
+const AUTH_REFRESH_MIN_MS = 5_000;
+
+/**
+ * Milliseconds until a JWT's `exp`, or null if it carries no usable one.
+ *
+ * Deliberately does not verify the signature — the client cannot, and does not
+ * need to: this only decides WHEN to ask for the next token. A malformed or
+ * unsigned token yields null and refresh stays off, leaving the previous
+ * reconnect behaviour rather than a tight loop.
+ */
+function millisUntilExpiry(token: string): number | null {
+	// Destructured rather than indexed: consumers compile this file under their
+	// own tsconfig, and one with noUncheckedIndexedAccess types parts[1] as
+	// possibly undefined however the length was checked.
+	const [header, payload, signature] = token.split(".");
+	if (!header || !payload || !signature) return null;
+	try {
+		const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = base64.padEnd(
+			base64.length + ((4 - (base64.length % 4)) % 4),
+			"=",
+		);
+		const claims = JSON.parse(atob(padded)) as { exp?: unknown };
+		if (typeof claims.exp !== "number") return null;
+		return claims.exp * 1000 - Date.now();
+	} catch {
+		return null;
+	}
+}
 
 /** Decode a JSON payload carried in an Event/Reply `data` byte field. */
 function decodeJson(bytes: Uint8Array): unknown {
@@ -94,6 +139,9 @@ export class RealtimeClient {
 	// "Authentication required for private topic" and we needlessly reconnect).
 	private welcomed: Promise<void> | null = null;
 	private resolveWelcome: (() => void) | null = null;
+	// Pending re-auth for the CURRENT socket. Cleared on close so a timer from a
+	// dead socket cannot fire an auth frame into its replacement.
+	private authRefresh: ReturnType<typeof setTimeout> | null = null;
 
 	constructor(private readonly opts: RealtimeClientOptions) {}
 
@@ -148,6 +196,9 @@ export class RealtimeClient {
 
 	close(): void {
 		this.closedByUser = true;
+		// Explicit close bypasses onClose (we drop the socket ourselves), so the
+		// refresh timer has to be cancelled here too or it outlives the client.
+		this.clearAuthRefresh();
 		this.subscriptions.clear();
 		for (const p of this.pending.values())
 			p.reject(new Error("realtime client closed"));
@@ -220,6 +271,7 @@ export class RealtimeClient {
 					body: { case: "auth", value: { token } },
 				}),
 			);
+			this.scheduleAuthRefresh(token);
 		}
 		// Wait for the gateway's `welcome` (auth applied) before (re)subscribing,
 		// so private topics aren't requested on an un-bound socket. The gate is
@@ -231,7 +283,56 @@ export class RealtimeClient {
 		this.reconnectAttempts = 0;
 	}
 
+	/**
+	 * Send a fresh token over the OPEN socket shortly before this one expires.
+	 *
+	 * Re-authenticating in place is what keeps a long-lived subscription alive:
+	 * the alternative is letting the token lapse and being reconnected, which
+	 * drops every subscription for the duration and, for subscriber-driven
+	 * sources, stops the upstream feed entirely until it is re-established.
+	 */
+	private scheduleAuthRefresh(token: string): void {
+		this.clearAuthRefresh();
+		if (!this.opts.getToken) return;
+		const remaining = millisUntilExpiry(token);
+		if (remaining === null) return;
+		const delay = Math.max(
+			AUTH_REFRESH_MIN_MS,
+			remaining - AUTH_REFRESH_MARGIN_MS,
+		);
+		this.authRefresh = setTimeout(() => {
+			void this.refreshAuth();
+		}, delay);
+	}
+
+	private async refreshAuth(): Promise<void> {
+		const socket = this.socket;
+		if (!socket || !this.opts.getToken) return;
+		let next: string | null = null;
+		try {
+			next = await this.opts.getToken();
+		} catch {
+			next = null;
+		}
+		// Nothing to send, or the socket died while we were fetching: leave it to
+		// the reconnect path rather than authenticating a socket that is gone.
+		if (!next || this.socket !== socket) return;
+		this.sendFrame(
+			create(ClientFrameSchema, {
+				body: { case: "auth", value: { token: next } },
+			}),
+		);
+		this.scheduleAuthRefresh(next);
+	}
+
+	private clearAuthRefresh(): void {
+		if (this.authRefresh === null) return;
+		clearTimeout(this.authRefresh);
+		this.authRefresh = null;
+	}
+
 	private onClose(): void {
+		this.clearAuthRefresh();
 		this.socket = null;
 		this.connecting = null;
 		this.authenticated = false;

package/types.ts

@@ -498,7 +498,8 @@ export interface paths {
 			path?: never;
 			cookie?: never;
 		};
-		get?: never;
+		/** GetComponentType */
+		get: operations["control.dcim.catalog.component_types.get"];
 		put?: never;
 		post?: never;
 		/** DeleteComponentType */
@@ -1991,6 +1992,12 @@ export interface components {
 			manufacturer_name: string;
 			model: string;
 			notes: string;
+			/** @default  */
+			output_connector: string;
+			/** @default 0 */
+			output_ma: number;
+			/** @default 0 */
+			output_mv: number;
 			part_number: string;
 			power_w: number;
 			source: string;
@@ -3297,6 +3304,12 @@ export interface components {
 			/** @default  */
 			notes?: string;
 			/** @default  */
+			output_connector?: string;
+			/** @default 0 */
+			output_ma?: number;
+			/** @default 0 */
+			output_mv?: number;
+			/** @default  */
 			part_number?: string;
 			/** @default 0 */
 			power_w?: number;
@@ -5155,6 +5168,46 @@ export interface operations {
 			};
 		};
 	};
+	"control.dcim.catalog.component_types.get": {
+		parameters: {
+			query?: never;
+			header?: never;
+			path: {
+				component_type_id: string;
+			};
+			cookie?: never;
+		};
+		requestBody?: never;
+		responses: {
+			/** @description Request fulfilled, document follows */
+			200: {
+				headers: {
+					[name: string]: unknown;
+				};
+				content: {
+					"application/json": components["schemas"]["ComponentTypeDTO"];
+				};
+			};
+			/** @description Bad request syntax or unsupported method */
+			400: {
+				headers: {
+					[name: string]: unknown;
+				};
+				content: {
+					"application/json": {
+						detail: string;
+						extra?:
+							| null
+							| {
+									[key: string]: unknown;
+							  }
+							| unknown[];
+						status_code: number;
+					};
+				};
+			};
+		};
+	};
 	"control.dcim.catalog.component_types.delete": {
 		parameters: {
 			query?: never;