@nebulr-group/bridge-auth-core 0.4.0-beta.0 → 0.4.0-beta.10

package/dist/direct-auth.js

@@ -7,49 +7,49 @@ export class DirectAuthService {
         this.logger = logger;
     }
     async getCredentialsConfig(email) {
-        const url = `${this.config.authBaseUrl}/auth/credentialsConfig`;
+        const url = `${this.config.authBaseUrl}/credentialsConfig`;
         return httpFetch(url, {
             method: 'POST',
             body: { username: email, mode: 'sdk', appId: this.config.appId },
         }, this.logger);
     }
     async authenticate(email, password) {
-        const url = `${this.config.authBaseUrl}/auth/authenticate`;
+        const url = `${this.config.authBaseUrl}/authenticate`;
         return httpFetch(url, {
             method: 'POST',
             body: { username: email, password, mode: 'sdk', appId: this.config.appId },
         }, this.logger);
     }
     async commitMfaCode(mfaCode, session) {
-        const url = `${this.config.authBaseUrl}/auth/commitMfaCode`;
+        const url = `${this.config.authBaseUrl}/commitMfaCode`;
         return httpFetch(url, {
             method: 'POST',
             body: { mfaCode, session, mode: 'sdk', appId: this.config.appId },
         }, this.logger);
     }
     async resendMfaCode(session) {
-        const url = `${this.config.authBaseUrl}/auth/resendMfaCode`;
+        const url = `${this.config.authBaseUrl}/resendMfaCode`;
         return httpFetch(url, {
             method: 'POST',
             body: { session, mode: 'sdk', appId: this.config.appId },
         }, this.logger);
     }
     async startMfaUserSetup(phoneNumber, session) {
-        const url = `${this.config.authBaseUrl}/auth/startMfaUserSetup`;
+        const url = `${this.config.authBaseUrl}/startMfaUserSetup`;
         return httpFetch(url, {
             method: 'POST',
             body: { phoneNumber, session, mode: 'sdk', appId: this.config.appId },
         }, this.logger);
     }
     async finishMfaUserSetup(mfaCode, session) {
-        const url = `${this.config.authBaseUrl}/auth/finishMfaUserSetup`;
+        const url = `${this.config.authBaseUrl}/finishMfaUserSetup`;
         return httpFetch(url, {
             method: 'POST',
             body: { mfaCode, session, mode: 'sdk', appId: this.config.appId },
         }, this.logger);
     }
     async resetUserMfaSetup(backupCode, session) {
-        const url = `${this.config.authBaseUrl}/auth/resetUserMfaSetup`;
+        const url = `${this.config.authBaseUrl}/resetUserMfaSetup`;
         return httpFetch(url, {
             method: 'POST',
             body: { backupCode, session, mode: 'sdk', appId: this.config.appId },
@@ -94,23 +94,33 @@ export class DirectAuthService {
         };
     }
     // --- Signup ---
-    async signup(email, firstName, lastName) {
-        const url = `${this.config.authBaseUrl}/auth/signup`;
+    async signup(email, firstName, lastName, options) {
+        const url = `${this.config.authBaseUrl}/signup`;
         return httpFetch(url, {
             method: 'POST',
-            body: { email, firstName, lastName, appId: this.config.appId, mode: 'sdk' },
+            body: {
+                email,
+                firstName,
+                lastName,
+                appId: this.config.appId,
+                mode: 'sdk',
+                // TBP-36 — plan-specific signup links apply the plan at tenant creation.
+                ...(options?.plan ? { plan: options.plan } : {}),
+                ...(options?.currency ? { currency: options.currency } : {}),
+                ...(options?.recurrenceInterval ? { recurrenceInterval: options.recurrenceInterval } : {}),
+            },
         }, this.logger);
     }
     // --- Magic link ---
     async sendMagicLink(email) {
-        const url = `${this.config.authBaseUrl}/auth/magic-link`;
+        const url = `${this.config.authBaseUrl}/magic-link`;
         return httpFetch(url, {
             method: 'POST',
             body: { username: email, mode: 'sdk', appId: this.config.appId },
         }, this.logger);
     }
     async authenticateWithMagicLinkToken(token) {
-        const url = `${this.config.authBaseUrl}/auth/magic-link/authenticate`;
+        const url = `${this.config.authBaseUrl}/magic-link/authenticate`;
         return httpFetch(url, {
             method: 'POST',
             body: { token },
@@ -118,7 +128,7 @@ export class DirectAuthService {
     }
     // --- Password reset ---
     async sendResetPasswordLink(email) {
-        const url = `${this.config.apiBaseUrl}/auth/auth/password`;
+        const url = `${this.config.apiBaseUrl}/auth/password`;
         await httpFetch(url, {
             method: 'POST',
             body: { username: email },
@@ -126,7 +136,7 @@ export class DirectAuthService {
         }, this.logger);
     }
     async updatePassword(token, password) {
-        const url = `${this.config.apiBaseUrl}/auth/auth/password`;
+        const url = `${this.config.apiBaseUrl}/auth/password`;
         await httpFetch(url, {
             method: 'PUT',
             body: { token, password },
@@ -135,14 +145,14 @@ export class DirectAuthService {
     }
     // --- Passkeys: authentication ---
     async passkeysAuthenticationOptions() {
-        const url = `${this.config.authBaseUrl}/auth/passkeys/authentication-options`;
+        const url = `${this.config.authBaseUrl}/passkeys/authentication-options`;
         return httpFetch(url, {
             method: 'GET',
             headers: { 'x-app-id': this.config.appId },
         }, this.logger);
     }
     async passkeysAuthenticate(response) {
-        const url = `${this.config.authBaseUrl}/auth/passkeys/verify-authentication`;
+        const url = `${this.config.authBaseUrl}/passkeys/verify-authentication`;
         return httpFetch(url, {
             method: 'POST',
             body: { ...response, mode: 'sdk', appId: this.config.appId },
@@ -150,21 +160,21 @@ export class DirectAuthService {
     }
     // --- Passkeys: registration ---
     async requestPasskeySetupLink(email) {
-        const url = `${this.config.authBaseUrl}/auth/passkeys/request-setup-link`;
+        const url = `${this.config.authBaseUrl}/passkeys/request-setup-link`;
         return httpFetch(url, {
             method: 'POST',
             body: { username: email, appId: this.config.appId },
         }, this.logger);
     }
     async getPasskeyRegistrationOptions(token) {
-        const url = `${this.config.authBaseUrl}/auth/passkeys/registration-options?passkeySetupToken=${encodeURIComponent(token)}`;
+        const url = `${this.config.authBaseUrl}/passkeys/registration-options?passkeySetupToken=${encodeURIComponent(token)}`;
         return httpFetch(url, {
             method: 'GET',
             headers: { 'x-app-id': this.config.appId },
         }, this.logger);
     }
     async verifyPasskeyRegistration(credential, token) {
-        const url = `${this.config.authBaseUrl}/auth/passkeys/verify-registration?passkeySetupToken=${encodeURIComponent(token)}`;
+        const url = `${this.config.authBaseUrl}/passkeys/verify-registration?passkeySetupToken=${encodeURIComponent(token)}`;
         return httpFetch(url, {
             method: 'POST',
             body: { ...credential, appId: this.config.appId },

package/dist/direct-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"direct-auth.js","sourceRoot":"","sources":["../src/direct-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAyBtC,MAAM,OAAO,iBAAiB;IAET;IACA;IAFnB,YACmB,MAAsB,EACtB,MAAc;QADd,WAAM,GAAN,MAAM,CAAgB;QACtB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK,CAAC,oBAAoB,CAAC,KAAa;QACtC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,yBAAyB,CAAC;QAChE,OAAO,SAAS,CAAqB,GAAG,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACjE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QAChD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,oBAAoB,CAAC;QAC3D,OAAO,SAAS,CAAa,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC3E,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,OAAe;QAClD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,qBAAqB,CAAC;QAC5D,OAAO,SAAS,CAAY,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAClE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,qBAAqB,CAAC;QAC5D,OAAO,SAAS,CAAY,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACzD,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,OAAe;QAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,yBAAyB,CAAC;QAChE,OAAO,SAAS,CAAY,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACtE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,OAAe;QACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,0BAA0B,CAAC;QACjE,OAAO,SAAS,CAAY,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAClE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB,EAAE,OAAe;QACzD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,yBAAyB,CAAC;QAChE,OAAO,SAAS,CAAY,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACrE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,YAAoB;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,eAAe,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAsB,GAAG,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,OAAO;gBACP,YAAY;gBACZ,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;gBACxB,KAAK,EAAE,wCAAwC;gBAC/C,IAAI,EAAE,KAAK;aACZ;SACF,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED,wCAAwC;IAExC,KAAK,CAAC,cAAc,CAAC,WAAmB;QACtC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,uBAAuB,CAAC;QAC9D,OAAO,SAAS,CAAc,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,WAAW,EAAE;SACtB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,kBAA0B;QACnE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,yBAAyB,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAsB,GAAG,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;SAC1C,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED,iBAAiB;IAEjB,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,SAAiB,EAAE,QAAgB;QAC7D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,cAAc,CAAC;QACrD,OAAO,SAAS,CAAe,GAAG,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;SAC5E,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,qBAAqB;IAErB,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,kBAAkB,CAAC;QACzD,OAAO,SAAS,CAAkB,GAAG,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACjE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,8BAA8B,CAAC,KAAa;QAChD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,+BAA+B,CAAC;QACtE,OAAO,SAAS,CAAa,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE;SAChB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,yBAAyB;IAEzB,KAAK,CAAC,qBAAqB,CAAC,KAAa;QACvC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,CAAC;QAC3D,MAAM,SAAS,CAAM,GAAG,EAAE;YACxB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACzB,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC3C,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB;QAClD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,CAAC;QAC3D,MAAM,SAAS,CAAM,GAAG,EAAE;YACxB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;YACzB,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC3C,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,mCAAmC;IAEnC,KAAK,CAAC,6BAA6B;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,uCAAuC,CAAC;QAC9E,OAAO,SAAS,CAAqB,GAAG,EAAE;YACxC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC3C,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,QAAa;QACtC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,sCAAsC,CAAC;QAC7E,OAAO,SAAS,CAAa,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC7D,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,iCAAiC;IAEjC,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,mCAAmC,CAAC;QAC1E,OAAO,SAAS,CAAuB,GAAG,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACpD,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,KAAa;QAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,yDAAyD,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3H,OAAO,SAAS,CAA6B,GAAG,EAAE;YAChD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC3C,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,UAAe,EAAE,KAAa;QAC5D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,wDAAwD,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1H,OAAO,SAAS,CAA4B,GAAG,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAClD,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"direct-auth.js","sourceRoot":"","sources":["../src/direct-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAyBtC,MAAM,OAAO,iBAAiB;IAET;IACA;IAFnB,YACmB,MAAsB,EACtB,MAAc;QADd,WAAM,GAAN,MAAM,CAAgB;QACtB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK,CAAC,oBAAoB,CAAC,KAAa;QACtC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,oBAAoB,CAAC;QAC3D,OAAO,SAAS,CAAqB,GAAG,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACjE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QAChD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,eAAe,CAAC;QACtD,OAAO,SAAS,CAAa,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC3E,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,OAAe;QAClD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,gBAAgB,CAAC;QACvD,OAAO,SAAS,CAAY,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAClE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,gBAAgB,CAAC;QACvD,OAAO,SAAS,CAAY,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACzD,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,OAAe;QAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,oBAAoB,CAAC;QAC3D,OAAO,SAAS,CAAY,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACtE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,OAAe;QACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,qBAAqB,CAAC;QAC5D,OAAO,SAAS,CAAY,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAClE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB,EAAE,OAAe;QACzD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,oBAAoB,CAAC;QAC3D,OAAO,SAAS,CAAY,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACrE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,YAAoB;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,eAAe,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAsB,GAAG,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,OAAO;gBACP,YAAY;gBACZ,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;gBACxB,KAAK,EAAE,wCAAwC;gBAC/C,IAAI,EAAE,KAAK;aACZ;SACF,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED,wCAAwC;IAExC,KAAK,CAAC,cAAc,CAAC,WAAmB;QACtC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,uBAAuB,CAAC;QAC9D,OAAO,SAAS,CAAc,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,WAAW,EAAE;SACtB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,kBAA0B;QACnE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,yBAAyB,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAsB,GAAG,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;SAC1C,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED,iBAAiB;IAEjB,KAAK,CAAC,MAAM,CACV,KAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,OAA2E;QAE3E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,SAAS,CAAC;QAChD,OAAO,SAAS,CAAe,GAAG,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,KAAK;gBACL,SAAS;gBACT,QAAQ;gBACR,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;gBACxB,IAAI,EAAE,KAAK;gBACX,yEAAyE;gBACzE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3F;SACF,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,qBAAqB;IAErB,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,aAAa,CAAC;QACpD,OAAO,SAAS,CAAkB,GAAG,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACjE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,8BAA8B,CAAC,KAAa;QAChD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,0BAA0B,CAAC;QACjE,OAAO,SAAS,CAAa,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE;SAChB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,yBAAyB;IAEzB,KAAK,CAAC,qBAAqB,CAAC,KAAa;QACvC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,gBAAgB,CAAC;QACtD,MAAM,SAAS,CAAM,GAAG,EAAE;YACxB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACzB,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC3C,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB;QAClD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,gBAAgB,CAAC;QACtD,MAAM,SAAS,CAAM,GAAG,EAAE;YACxB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;YACzB,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC3C,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,mCAAmC;IAEnC,KAAK,CAAC,6BAA6B;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,kCAAkC,CAAC;QACzE,OAAO,SAAS,CAAqB,GAAG,EAAE;YACxC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC3C,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,QAAa;QACtC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,iCAAiC,CAAC;QACxE,OAAO,SAAS,CAAa,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC7D,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,iCAAiC;IAEjC,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,8BAA8B,CAAC;QACrE,OAAO,SAAS,CAAuB,GAAG,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SACpD,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,KAAa;QAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,oDAAoD,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtH,OAAO,SAAS,CAA6B,GAAG,EAAE;YAChD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAC3C,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,UAAe,EAAE,KAAa;QAC5D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,mDAAmD,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrH,OAAO,SAAS,CAA4B,GAAG,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;SAClD,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;CACF"}

package/dist/flags/realtime.d.ts

@@ -124,6 +124,16 @@ export interface QuotaUpdatedMessage {
      * `'metered'` in that case.
      */
     policy?: 'hard' | 'metered';
+    /**
+     * TBP-275 — metered overage context. Optional (absent for hard quotas and
+     * older servers). `unitAmount` + `currency` describe the per-unit price;
+     * `overageEstimate` is the server-computed estimated cost this period;
+     * `overcap` is true once usage passed the included allotment.
+     */
+    unitAmount?: number;
+    currency?: string;
+    overageEstimate?: number;
+    overcap?: boolean;
 }
 /**
  * Billing 2.0 US-12 — wholesale entitlement snapshot push. The bridge-api
@@ -322,6 +332,31 @@ export declare class RealtimeClient {
     private fetchServerConfig;
     private authorize;
     private openWebSocket;
+    /**
+     * TBP-148 — AppSync Events transport.
+     *
+     * Wire protocol (AWS public spec for AppSync Events, distinct from the older
+     * AppSync GraphQL `graphql-ws` subscriptions):
+     *   - WebSocket to `wss://<endpoint>/event/realtime` (path appended if the
+     *     endpoint from /realtime/config doesn't already include it — stage
+     *     CFN output is the bare host today; the spec test uses the full URL).
+     *   - Subprotocols: `['aws-appsync-event-ws', 'header-<base64url-json>']`.
+     *     The `header-…` token carries auth, since browsers can't set arbitrary
+     *     HTTP headers on a WebSocket.
+     *   - After open: `{type:'connection_init'}` → server replies
+     *     `{type:'connection_ack', connectionTimeoutMs}` → then one
+     *     `{type:'subscribe', id, channel, authorization}` per channel.
+     *   - Data: `{type:'data', id, event:'<json-string>'}` — `event` is a string
+     *     (matches `appsync-events.adapter.ts:90` JSON.stringify).
+     *   - Keepalive: server sends `{type:'ka'}` (silently ignored).
+     *   - Channel wire format: `<ns>/<id>` (colon-to-slash; mirrors
+     *     `appsync-events.adapter.ts:87` and `appsync-authorizer.handler.ts:59`).
+     *
+     * Anonymous flow: `getAuthToken()` returns undefined → Authorization sent as
+     * empty string. The Lambda authorizer accepts that only for `app:<appId>`
+     * channels whose origin matches the app's allowedOrigins (demo path).
+     */
+    private openAppSyncWebSocket;
     private handleMessage;
     private scheduleReconnect;
 }

package/dist/flags/realtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../../src/flags/realtime.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,aAAa,CAAC;IACjF,0DAA0D;IAC1D,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CACzC;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;CACjD;AAeD,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,GAAG,cAAc,GAAG,MAAM,CAAC;CAC9E;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,2BAA2B,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EACA,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,sBAAsB,GACtB,uBAAuB,GACvB,0BAA0B,GAC1B,4BAA4B,GAC5B,gCAAgC,GAChC,8BAA8B,GAC9B,4BAA4B,GAC5B,iBAAiB,GACjB,yBAAyB,GACzB,mBAAmB,GACnB,mBAAmB,GACnB,sBAAsB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IAEpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,YAAY,EAAE,IAAI,GAAG,aAAa,GAAG,UAAU,CAAC;IAChD;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE;QACJ,GAAG,EAAE;YACH,QAAQ,EAAE;gBACR,IAAI,EAAE,MAAM,CAAC;gBACb,IAAI,EAAE,MAAM,CAAC;gBACb,oBAAoB,CAAC,EAAE,MAAM,CAAC;gBAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;gBACnB,OAAO,CAAC,EAAE,MAAM,CAAC;gBACjB,UAAU,CAAC,EAAE,MAAM,CAAC;aACrB,CAAC;SACH,CAAC;QACF,MAAM,EAAE;YACN,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,YAAY,EAAE;gBACZ,IAAI,EAAE;oBAAE,IAAI,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE,CAAC;gBACrC,MAAM,EAAE,MAAM,CAAC;gBACf,MAAM,CAAC,EAAE,MAAM,CAAC;gBAChB,WAAW,CAAC,EAAE,OAAO,CAAC;aACvB,CAAC;YACF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvC,CAAC;QACF,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,8BAA8B,GAC9B,uBAAuB,GACvB,mBAAmB,GACnB,0BAA0B,GAC1B,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;AAExE,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CASlB;IACF,OAAO,CAAC,EAAE,CAAC,CAAgB;IAC3B,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,cAAc,CAAC,CAAgC;IACvD,OAAO,CAAC,MAAM,CAAC,CAAc;IAC7B,OAAO,CAAC,eAAe,CAAC,CAAkC;IAC1D,OAAO,CAAC,6BAA6B,CAAC,CAAgD;IACtF,OAAO,CAAC,sBAAsB,CAAC,CAAyC;IACxE,OAAO,CAAC,kBAAkB,CAAC,CAAqC;IAChE,OAAO,CAAC,yBAAyB,CAAC,CAA4C;IAG9E,OAAO,CAAC,cAAc,CAAC,CAAwC;IAC/D,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,WAAW,CAAC,CAAa;IACjC,OAAO,CAAC,OAAO,CAAS;gBAEZ,GAAG,EAAE,oBAAoB;IAuBrC,+EAA+E;IAC/E,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIjC,qDAAqD;IACrD,cAAc,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI;IAI3D;;;;OAIG;IACH,4BAA4B,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,8BAA8B,KAAK,IAAI,GAAG,IAAI;IAIvF;;;;;OAKG;IACH,qBAAqB,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,uBAAuB,KAAK,IAAI,GAAG,IAAI;IAIzE;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,IAAI,GAAG,IAAI;IAIjE;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,0BAA0B,KAAK,IAAI,GAAG,IAAI;IAI/E;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,sBAAsB,KAAK,IAAI,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,IAAI;IAIjC;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,IAAI;IAIlC;;;;;;;;;;;;;;;;OAgBG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBlC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IASzC;;;;OAIG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAQrD;;;;OAIG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAS3C,oCAAoC;IAC9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB5B,wCAAwC;IAClC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B,6BAA6B;IAC7B,QAAQ,IAAI,eAAe;IAI3B;;;;;;;;OAQG;IACH,mBAAmB,IAAI,MAAM,EAAE;YAUjB,iBAAiB;YAWjB,SAAS;IAgBvB,OAAO,CAAC,aAAa;IA6DrB,OAAO,CAAC,aAAa;IAoFrB,OAAO,CAAC,iBAAiB;CAU1B"}
+{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../../src/flags/realtime.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,aAAa,CAAC;IACjF,0DAA0D;IAC1D,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CACzC;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;CACjD;AAeD,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,GAAG,cAAc,GAAG,MAAM,CAAC;CAC9E;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,2BAA2B,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EACA,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,sBAAsB,GACtB,uBAAuB,GACvB,0BAA0B,GAC1B,4BAA4B,GAC5B,gCAAgC,GAChC,8BAA8B,GAC9B,4BAA4B,GAC5B,iBAAiB,GACjB,yBAAyB,GACzB,mBAAmB,GACnB,mBAAmB,GACnB,sBAAsB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IAEpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,YAAY,EAAE,IAAI,GAAG,aAAa,GAAG,UAAU,CAAC;IAChD;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE;QACJ,GAAG,EAAE;YACH,QAAQ,EAAE;gBACR,IAAI,EAAE,MAAM,CAAC;gBACb,IAAI,EAAE,MAAM,CAAC;gBACb,oBAAoB,CAAC,EAAE,MAAM,CAAC;gBAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;gBACnB,OAAO,CAAC,EAAE,MAAM,CAAC;gBACjB,UAAU,CAAC,EAAE,MAAM,CAAC;aACrB,CAAC;SACH,CAAC;QACF,MAAM,EAAE;YACN,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,YAAY,EAAE;gBACZ,IAAI,EAAE;oBAAE,IAAI,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE,CAAC;gBACrC,MAAM,EAAE,MAAM,CAAC;gBACf,MAAM,CAAC,EAAE,MAAM,CAAC;gBAChB,WAAW,CAAC,EAAE,OAAO,CAAC;aACvB,CAAC;YACF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvC,CAAC;QACF,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,8BAA8B,GAC9B,uBAAuB,GACvB,mBAAmB,GACnB,0BAA0B,GAC1B,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;AAExE,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CASlB;IACF,OAAO,CAAC,EAAE,CAAC,CAAgB;IAC3B,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,cAAc,CAAC,CAAgC;IACvD,OAAO,CAAC,MAAM,CAAC,CAAc;IAC7B,OAAO,CAAC,eAAe,CAAC,CAAkC;IAC1D,OAAO,CAAC,6BAA6B,CAAC,CAAgD;IACtF,OAAO,CAAC,sBAAsB,CAAC,CAAyC;IACxE,OAAO,CAAC,kBAAkB,CAAC,CAAqC;IAChE,OAAO,CAAC,yBAAyB,CAAC,CAA4C;IAG9E,OAAO,CAAC,cAAc,CAAC,CAAwC;IAC/D,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,WAAW,CAAC,CAAa;IACjC,OAAO,CAAC,OAAO,CAAS;gBAEZ,GAAG,EAAE,oBAAoB;IAuBrC,+EAA+E;IAC/E,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIjC,qDAAqD;IACrD,cAAc,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI;IAI3D;;;;OAIG;IACH,4BAA4B,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,8BAA8B,KAAK,IAAI,GAAG,IAAI;IAIvF;;;;;OAKG;IACH,qBAAqB,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,uBAAuB,KAAK,IAAI,GAAG,IAAI;IAIzE;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,IAAI,GAAG,IAAI;IAIjE;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,0BAA0B,KAAK,IAAI,GAAG,IAAI;IAI/E;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,sBAAsB,KAAK,IAAI,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,IAAI;IAIjC;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,IAAI;IAIlC;;;;;;;;;;;;;;;;OAgBG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBlC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IASzC;;;;OAIG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAQrD;;;;OAIG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAS3C,oCAAoC;IAC9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiC5B,wCAAwC;IAClC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B,6BAA6B;IAC7B,QAAQ,IAAI,eAAe;IAI3B;;;;;;;;OAQG;IACH,mBAAmB,IAAI,MAAM,EAAE;YAUjB,iBAAiB;YAWjB,SAAS;IAgBvB,OAAO,CAAC,aAAa;IA6DrB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,oBAAoB;IAsI5B,OAAO,CAAC,aAAa;IAoFrB,OAAO,CAAC,iBAAiB;CAU1B"}

package/dist/flags/realtime.js

@@ -1,12 +1,16 @@
 // SDK realtime client (TBP-150).
 //
 // Auto-discovers the workspace's pub/sub protocol from `GET /realtime/config`
-// (TBP-147), authorizes via `POST /realtime/authorize` (TBP-151), and connects
-// to receive live flag updates + per-user identity changes.
+// (TBP-147), authorizes via `POST /realtime/authorize` (TBP-151 — Centrifugo
+// path only; AppSync uses a Lambda authorizer server-side), and connects to
+// receive live flag updates + per-user identity changes.
 //
 // Two protocols, one shape:
-//   - `centrifugo`: WebSocket to a Centrifugo server using a signed connect token
-//   - `appsync`: planned (TBP-148); not implemented here
+//   - `centrifugo`: WebSocket to a Centrifugo server using a signed connect token.
+//   - `appsync`:    WebSocket to AWS AppSync Events (TBP-148). Client carries
+//                   its Bridge JWT directly in the `header-…` subprotocol; the
+//                   Lambda authorizer makes per-channel decisions server-side
+//                   (no `/realtime/authorize` round-trip).
 //
 // `noop` server-side → realtime is disabled; the SDK falls back to periodic
 // poll or simply doesn't get live updates.
@@ -226,14 +230,22 @@ export class RealtimeClient {
                 this.state = 'closed';
                 return;
             }
-            if (serverConfig.kind !== 'centrifugo') {
-                // appsync impl is deferred (TBP-148). Silently no-op for now.
-                this.state = 'closed';
+            const channels = this.channelsToSubscribe();
+            if (serverConfig.kind === 'appsync') {
+                // AppSync uses a Lambda authorizer for per-channel auth — no client-side
+                // /realtime/authorize round-trip. The Bridge JWT is carried in the
+                // subprotocol negotiation; the Lambda decides allow/deny per channel.
+                this.openAppSyncWebSocket(serverConfig.endpoint, channels);
                 return;
             }
-            const channels = this.channelsToSubscribe();
-            const auth = await this.authorize(channels);
-            this.openWebSocket(serverConfig.endpoint, auth);
+            if (serverConfig.kind === 'centrifugo') {
+                const auth = await this.authorize(channels);
+                this.openWebSocket(serverConfig.endpoint, auth);
+                return;
+            }
+            // Unknown protocol — close cleanly so consumers don't get stuck in
+            // 'connecting'. New transports must be added explicitly here.
+            this.state = 'closed';
         }
         catch {
             this.state = 'closed';
@@ -376,6 +388,168 @@ export class RealtimeClient {
             // Let onclose handle reconnect — errors are noisy but not actionable.
         };
     }
+    /**
+     * TBP-148 — AppSync Events transport.
+     *
+     * Wire protocol (AWS public spec for AppSync Events, distinct from the older
+     * AppSync GraphQL `graphql-ws` subscriptions):
+     *   - WebSocket to `wss://<endpoint>/event/realtime` (path appended if the
+     *     endpoint from /realtime/config doesn't already include it — stage
+     *     CFN output is the bare host today; the spec test uses the full URL).
+     *   - Subprotocols: `['aws-appsync-event-ws', 'header-<base64url-json>']`.
+     *     The `header-…` token carries auth, since browsers can't set arbitrary
+     *     HTTP headers on a WebSocket.
+     *   - After open: `{type:'connection_init'}` → server replies
+     *     `{type:'connection_ack', connectionTimeoutMs}` → then one
+     *     `{type:'subscribe', id, channel, authorization}` per channel.
+     *   - Data: `{type:'data', id, event:'<json-string>'}` — `event` is a string
+     *     (matches `appsync-events.adapter.ts:90` JSON.stringify).
+     *   - Keepalive: server sends `{type:'ka'}` (silently ignored).
+     *   - Channel wire format: `<ns>/<id>` (colon-to-slash; mirrors
+     *     `appsync-events.adapter.ts:87` and `appsync-authorizer.handler.ts:59`).
+     *
+     * Anonymous flow: `getAuthToken()` returns undefined → Authorization sent as
+     * empty string. The Lambda authorizer accepts that only for `app:<appId>`
+     * channels whose origin matches the app's allowedOrigins (demo path).
+     */
+    openAppSyncWebSocket(endpoint, channels) {
+        const { url, httpHost } = normalizeAppSyncEndpoint(endpoint);
+        // AWS spec: the auth header's `host` field refers to the HTTP endpoint
+        // even when the wss:// call is made against the realtime endpoint. The
+        // server-side validation uses this to verify the connection — sending
+        // the realtime host instead produces a silent close 1000 right after
+        // the WS upgrade succeeds.
+        const authHeader = buildAppSyncAuthHeader(this.cfg.getAuthToken?.(), httpHost);
+        const headerProtocol = `header-${base64urlEncode(JSON.stringify(authHeader))}`;
+        const ws = this.cfg.websocketFactory(url, [APPSYNC_WS_PROTOCOL, headerProtocol]);
+        this.ws = ws;
+        ws.onopen = () => {
+            if (this.ws !== ws)
+                return;
+            // `state` stays 'connecting' until connection_ack lands — premature
+            // transition would let the client miss server-side rejects (auth
+            // failure surfaces as a quick close right after open).
+            try {
+                ws.send(JSON.stringify({ type: 'connection_init' }));
+            }
+            catch {
+                // onclose will fire on a broken socket; no further work here.
+            }
+        };
+        ws.onmessage = (ev) => {
+            if (this.ws !== ws)
+                return;
+            let frame;
+            try {
+                frame = typeof ev.data === 'string' ? JSON.parse(ev.data) : ev.data;
+            }
+            catch {
+                return; // malformed — ignore
+            }
+            if (!frame || typeof frame !== 'object')
+                return;
+            const type = typeof frame.type === 'string' ? frame.type : '';
+            switch (type) {
+                case 'connection_ack': {
+                    // Handshake complete — open the gate for app traffic.
+                    this.state = 'open';
+                    this.reconnectDelayMs = this.cfg.reconnectBaseMs;
+                    for (const channel of channels) {
+                        try {
+                            ws.send(JSON.stringify({
+                                type: 'subscribe',
+                                id: appSyncSubscriptionId(),
+                                channel: appSyncChannelToWire(channel),
+                                authorization: authHeader,
+                            }));
+                        }
+                        catch {
+                            // ignore — onclose will pick up a broken socket.
+                        }
+                    }
+                    try {
+                        this.onOpenHook?.();
+                    }
+                    catch {
+                        // hook errors must not break the connection.
+                    }
+                    break;
+                }
+                case 'ka':
+                    // Keepalive — server-initiated, no client response required.
+                    break;
+                case 'data': {
+                    // Per AWS spec, the `event` field is an **array of stringified JSON
+                    // values** (publish accepts `events: [...]`; data delivers `event:
+                    // [...]`). The backend currently publishes one entry per frame
+                    // (`events: [JSON.stringify(payload)]`), but the wire shape is an
+                    // array either way — iterate, decode each, dispatch independently.
+                    const rawList = Array.isArray(frame.event)
+                        ? frame.event
+                        : typeof frame.event === 'string'
+                            ? [frame.event]
+                            : [];
+                    for (const raw of rawList) {
+                        if (typeof raw !== 'string')
+                            continue;
+                        let payload;
+                        try {
+                            payload = JSON.parse(raw);
+                        }
+                        catch {
+                            continue;
+                        }
+                        if (payload &&
+                            typeof payload === 'object' &&
+                            typeof payload.kind === 'string') {
+                            try {
+                                this.handleMessage(payload);
+                            }
+                            catch {
+                                // hook errors are isolated per-handler in handleMessage.
+                            }
+                        }
+                    }
+                    break;
+                }
+                case 'subscribe_success':
+                    // Per-channel ack — no action required, server now streams data.
+                    break;
+                case 'connection_error':
+                case 'subscribe_error':
+                case 'error':
+                    // Server-side reject — close cleanly so onclose triggers reconnect.
+                    // We intentionally don't surface the error message: the next
+                    // connect's authorize will succeed or fail with the same signal.
+                    try {
+                        ws.close(1011, `appsync:${type}`);
+                    }
+                    catch {
+                        // ignore
+                    }
+                    break;
+                default:
+                    // Unknown frame type — ignore. Forward-compatible with future
+                    // protocol additions (e.g. `keepalive`, `pong`, …).
+                    break;
+            }
+        };
+        ws.onclose = () => {
+            if (this.ws !== ws)
+                return;
+            this.state = 'closed';
+            try {
+                this.onCloseHook?.();
+            }
+            catch {
+                // hook errors must not block reconnect scheduling.
+            }
+            this.scheduleReconnect();
+        };
+        ws.onerror = () => {
+            // Let onclose handle reconnect — errors are noisy but not actionable.
+        };
+    }
     handleMessage(msg) {
         switch (msg.kind) {
             case 'flag.updated':
@@ -501,4 +675,105 @@ function parseMessage(raw) {
         return null;
     return data;
 }
+// ── AppSync Events helpers (TBP-148) ─────────────────────────────────────────
+/** Subprotocol identifier for AppSync Events realtime channels. */
+const APPSYNC_WS_PROTOCOL = 'aws-appsync-event-ws';
+/**
+ * Normalize the realtime endpoint to a full `wss://…/event/realtime` URL and
+ * compute the matching HTTP host (needed in the auth header — AppSync
+ * server-side validation uses the HTTP host, NOT the realtime host).
+ *
+ * Stage's CFN output currently surfaces a bare host (`<id>.appsync-realtime-api.<region>.amazonaws.com`),
+ * while the backend spec tests use the fully-qualified `wss://…/event/realtime`.
+ * Both must work — this normalizer accepts either.
+ *
+ * HTTP-host derivation: AWS uses two parallel domains for AppSync Events:
+ *   wss://<id>.appsync-realtime-api.<region>.amazonaws.com/event/realtime
+ *   https://<id>.appsync-api.<region>.amazonaws.com/event
+ * The HTTP host is the realtime host with `appsync-realtime-api` swapped for
+ * `appsync-api`. Custom domains skip the suffix entirely (host == http host).
+ */
+function normalizeAppSyncEndpoint(endpoint) {
+    let raw = endpoint.trim();
+    if (!raw.startsWith('ws://') && !raw.startsWith('wss://')) {
+        raw = `wss://${raw}`;
+    }
+    raw = raw.replace(/\/+$/, '');
+    if (!/\/event\/realtime$/.test(raw)) {
+        raw = `${raw}/event/realtime`;
+    }
+    let realtimeHost = '';
+    try {
+        realtimeHost = new URL(raw).host;
+    }
+    catch {
+        realtimeHost = endpoint.replace(/^wss?:\/\//, '').split('/')[0] ?? '';
+    }
+    // Swap the realtime suffix → http suffix. If the host doesn't match the
+    // standard AppSync naming (e.g. custom domain), pass it through unchanged
+    // — the same host serves both endpoints on custom domains.
+    const httpHost = realtimeHost.replace('.appsync-realtime-api.', '.appsync-api.');
+    return { url: raw, httpHost };
+}
+/**
+ * Build the AppSync Events auth header carried in the `header-…` subprotocol
+ * token. Anonymous sessions send Authorization: '' — the Lambda authorizer
+ * accepts that only for `app:<appId>` channels with a passing origin check.
+ */
+function buildAppSyncAuthHeader(token, host) {
+    return {
+        Authorization: token ? `Bearer ${token}` : '',
+        host,
+    };
+}
+/**
+ * Base64url-encode a UTF-8 string. AppSync Events expects the `header-…`
+ * subprotocol token to be base64url (no padding). Uses `btoa` when available
+ * (every modern browser + Node ≥16 globalThis); falls back to a manual encode
+ * for the rare environment where it isn't.
+ */
+function base64urlEncode(input) {
+    let b64;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const g = globalThis;
+    if (typeof g.btoa === 'function') {
+        // btoa wants binary string; encode UTF-8 → bytes first so non-ASCII JWTs
+        // survive (rare but legal — JWT header/claims can be unicode).
+        const utf8 = unescape(encodeURIComponent(input));
+        b64 = g.btoa(utf8);
+    }
+    else if (typeof g.Buffer?.from === 'function') {
+        b64 = g.Buffer.from(input, 'utf-8').toString('base64');
+    }
+    else {
+        // No encoder available — return the raw input. Will fail the handshake,
+        // but loudly (Lambda authorizer rejects), which is preferable to silent
+        // corruption.
+        return input;
+    }
+    return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/**
+ * Translate internal channel name (`<ns>:<id>`) to the AppSync wire form
+ * (`<ns>/<id>`). Mirrors the publish side at
+ * `microservices/shared/realtime/adapters/appsync-events.adapter.ts:87`
+ * and the Lambda authorizer's normalizer at
+ * `microservices/shared/realtime/appsync-authorizer.handler.ts:59`.
+ */
+function appSyncChannelToWire(internal) {
+    return internal.replace(':', '/');
+}
+/**
+ * Stable per-subscribe identifier. Prefer `crypto.randomUUID()` (ES2022,
+ * available in every supported runtime — browser globals + Node ≥19); fall
+ * back to a Math.random-based id for the rare environment where it isn't.
+ */
+function appSyncSubscriptionId() {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const g = globalThis;
+    if (g.crypto?.randomUUID) {
+        return g.crypto.randomUUID();
+    }
+    return `sub-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
 //# sourceMappingURL=realtime.js.map