@openora/core 0.4.1-canary.9 → 0.4.1-canary.91

package/dist/server/kernel/platform-config-loader.js

@@ -17,11 +17,13 @@ import { definePlatformConfig, defaultPlatformConfig, } from '@openora/core/cont
  * On parse / schema failure, throws an Error with the offending paths.
  */
 export function loadPlatformConfig(path) {
-    if (!path)
+    if (!path) {
         return defaultPlatformConfig;
+    }
     const abs = resolve(path);
-    if (!existsSync(abs))
+    if (!existsSync(abs)) {
         return defaultPlatformConfig;
+    }
     const raw = readFileSync(abs, 'utf8');
     const ext = abs.split('.').pop()?.toLowerCase();
     let parsed;
@@ -42,12 +44,14 @@ export function loadPlatformConfig(path) {
  * `./platform-config.{yaml,json}` in cwd. Returns undefined if nothing is found.
  */
 export function resolvePlatformConfigPath(env = process.env) {
-    if (env.PLATFORM_CONFIG_PATH)
+    if (env.PLATFORM_CONFIG_PATH) {
         return env.PLATFORM_CONFIG_PATH;
+    }
     for (const candidate of ['platform-config.yaml', 'platform-config.yml', 'platform-config.json']) {
         const abs = resolve(candidate);
-        if (existsSync(abs))
+        if (existsSync(abs)) {
             return abs;
+        }
     }
     return undefined;
 }
@@ -57,13 +61,18 @@ function parseTrivialYaml(input) {
     const lines = input.split('\n');
     for (const rawLine of lines) {
         const line = rawLine.replace(/#.*$/, '').trimEnd();
-        if (!line.trim())
+        if (!line.trim()) {
             continue;
+        }
         const indent = line.length - line.trimStart().length;
         const body = line.trimStart();
-        while (stack[stack.length - 1].indent >= indent)
+        while ((stack.at(-1)?.indent ?? -Infinity) >= indent) {
             stack.pop();
-        const parent = stack[stack.length - 1];
+        }
+        const parent = stack.at(-1);
+        if (!parent) {
+            throw new Error('platform config parser: stack underflow');
+        }
         if (body.startsWith('- ')) {
             const inner = body.slice(2).trim();
             const item = { indent, isListItem: true, children: [] };
@@ -84,8 +93,9 @@ function parseTrivialYaml(input) {
         }
         else {
             const colon = body.indexOf(':');
-            if (colon === -1)
+            if (colon === -1) {
                 continue;
+            }
             const key = body.slice(0, colon).trim();
             const value = body.slice(colon + 1).trim();
             const node = { indent, key, value: value || undefined, children: [] };
@@ -102,8 +112,9 @@ function parseTrivialYaml(input) {
                 if (c.children.length > 0) {
                     const obj = {};
                     for (const kv of c.children) {
-                        if (kv.key !== undefined)
+                        if (kv.key !== undefined) {
                             obj[kv.key] = build(kv);
+                        }
                     }
                     return obj;
                 }
@@ -112,24 +123,31 @@ function parseTrivialYaml(input) {
         }
         const obj = {};
         for (const c of node.children) {
-            if (c.key !== undefined)
+            if (c.key !== undefined) {
                 obj[c.key] = build(c);
+            }
         }
         return obj;
     }
     function parseScalar(v) {
-        if (v === undefined || v === '')
+        if (v === undefined || v === '') {
             return undefined;
-        if (v === 'true')
+        }
+        if (v === 'true') {
             return true;
-        if (v === 'false')
+        }
+        if (v === 'false') {
             return false;
-        if (v === 'null' || v === '~')
+        }
+        if (v === 'null' || v === '~') {
             return null;
-        if (/^-?\d+$/.test(v))
+        }
+        if (/^-?\d+$/.test(v)) {
             return Number.parseInt(v, 10);
-        if (/^-?\d+\.\d+$/.test(v))
+        }
+        if (/^-?\d+\.\d+$/.test(v)) {
             return Number.parseFloat(v);
+        }
         if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
             return v.slice(1, -1);
         }

package/dist/server/kernel/platform-config-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-config-loader.js","sourceRoot":"","sources":["../../../src/server/kernel/platform-config-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GAGtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,qBAAqB,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC;IAEhD,IAAI,MAAe,CAAC;IACpB,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;SAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAC3C,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,SAAS,GAAG,IAAI;YAC9D,4BAA4B,CAC/B,CAAC;IACJ,CAAC;IAED,OAAO,oBAAoB,CAAC,MAA6B,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,oBAAoB;QAAE,OAAO,GAAG,CAAC,oBAAoB,CAAC;IAC9D,KAAK,MAAM,SAAS,IAAI,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAChG,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IAQrC,MAAM,IAAI,GAAS,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChD,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEhC,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAE9B,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,MAAM,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAExC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,GAAS,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACjB,MAAM,EAAE,MAAM,GAAG,CAAC;oBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE;oBACjC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS;oBACjD,QAAQ,EAAE,EAAE;iBACb,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAS,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC5E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,SAAS,KAAK,CAAC,IAAU;QACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7B,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,GAAG,GAA4B,EAAE,CAAC;oBACxC,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;wBAC5B,IAAI,EAAE,CAAC,GAAG,KAAK,SAAS;4BAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;oBACpD,CAAC;oBACD,OAAO,GAAG,CAAC;gBACb,CAAC;gBACD,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS,WAAW,CAAC,CAAqB;QACxC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QAClD,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC"}
+{"version":3,"file":"platform-config-loader.js","sourceRoot":"","sources":["../../../src/server/kernel/platform-config-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GAGtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC;IAEhD,IAAI,MAAe,CAAC;IACpB,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;SAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAC3C,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,SAAS,GAAG,IAAI;YAC9D,4BAA4B,CAC/B,CAAC;IACJ,CAAC;IAED,OAAO,oBAAoB,CAAC,MAA6B,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAC7B,OAAO,GAAG,CAAC,oBAAoB,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAChG,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IAQrC,MAAM,IAAI,GAAS,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChD,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEhC,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAE9B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,GAAS,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACjB,MAAM,EAAE,MAAM,GAAG,CAAC;oBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE;oBACjC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS;oBACjD,QAAQ,EAAE,EAAE;iBACb,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAS,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC5E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,SAAS,KAAK,CAAC,IAAU;QACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7B,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,GAAG,GAA4B,EAAE,CAAC;oBACxC,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;wBAC5B,IAAI,EAAE,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;4BACzB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;wBAC1B,CAAC;oBACH,CAAC;oBACD,OAAO,GAAG,CAAC;gBACb,CAAC;gBACD,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACxB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS,WAAW,CAAC,CAAqB;QACxC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC"}

package/dist/server/kernel/rate-limiter.d.ts

@@ -1,13 +1,5 @@
 import { ORPCError } from '@orpc/server';
-import type { RateLimiterAdapter, RateLimitOptions, RateLimitResult } from '@openora/core/contracts';
-export declare class InProcessRateLimiter implements RateLimiterAdapter {
-    private readonly windows;
-    private readonly sweeper;
-    constructor();
-    consume(key: string, opts: RateLimitOptions): Promise<RateLimitResult>;
-    private sweep;
-    close(): void;
-}
+import type { RateLimiterAdapter, RateLimitOptions } from '@openora/core/contracts';
 /** A 429 (TOO_MANY_REQUESTS) error carrying the client-facing back-off hint in its data. */
 export declare function makeRateLimitError(retryAfterMs: number): ORPCError<'TOO_MANY_REQUESTS', {
     retryAfterMs: number;
@@ -16,5 +8,5 @@ export declare function makeRateLimitError(retryAfterMs: number): ORPCError<'TOO
  * Consume one unit for `key`; throw a 429 with retryAfterMs when the limit is exceeded.
  * No-ops when `limiter` is undefined so call sites don't need an optional-guard wrapper.
  */
-export declare function assertRateLimit(limiter: RateLimiterAdapter | undefined, key: string, opts: RateLimitOptions): Promise<void>;
+export declare function assertRateLimit<K extends string = string>(limiter: RateLimiterAdapter<K> | undefined, key: K, opts: RateLimitOptions): Promise<void>;
 //# sourceMappingURL=rate-limiter.d.ts.map

package/dist/server/kernel/rate-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EAChB,MAAM,yBAAyB,CAAC;AAejC,qBAAa,oBAAqB,YAAW,kBAAkB;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;;IAOzD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAiBtE,OAAO,CAAC,KAAK;IAOb,KAAK,IAAI,IAAI;CAId;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,GACnB,SAAS,CAAC,mBAAmB,EAAE;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAK1D;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEpF,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,GACnB,SAAS,CAAC,mBAAmB,EAAE;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAK1D;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAC7D,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,SAAS,EAC1C,GAAG,EAAE,CAAC,EACN,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAQf"}

package/dist/server/kernel/rate-limiter.js

@@ -1,37 +1,4 @@
 import { ORPCError } from '@orpc/server';
-const SWEEP_INTERVAL_MS = 60_000;
-export class InProcessRateLimiter {
-    windows = new Map();
-    sweeper;
-    constructor() {
-        this.sweeper = setInterval(() => this.sweep(), SWEEP_INTERVAL_MS);
-        this.sweeper.unref?.();
-    }
-    consume(key, opts) {
-        const now = Date.now();
-        const existing = this.windows.get(key);
-        if (!existing || now >= existing.resetAt) {
-            this.windows.set(key, { count: 1, resetAt: now + opts.windowMs });
-            return Promise.resolve({ allowed: true, retryAfterMs: 0 });
-        }
-        if (existing.count < opts.limit) {
-            existing.count += 1;
-            return Promise.resolve({ allowed: true, retryAfterMs: 0 });
-        }
-        return Promise.resolve({ allowed: false, retryAfterMs: existing.resetAt - now });
-    }
-    sweep() {
-        const now = Date.now();
-        for (const [key, window] of this.windows) {
-            if (now >= window.resetAt)
-                this.windows.delete(key);
-        }
-    }
-    close() {
-        clearInterval(this.sweeper);
-        this.windows.clear();
-    }
-}
 /** A 429 (TOO_MANY_REQUESTS) error carrying the client-facing back-off hint in its data. */
 export function makeRateLimitError(retryAfterMs) {
     return new ORPCError('TOO_MANY_REQUESTS', {
@@ -44,10 +11,12 @@ export function makeRateLimitError(retryAfterMs) {
  * No-ops when `limiter` is undefined so call sites don't need an optional-guard wrapper.
  */
 export async function assertRateLimit(limiter, key, opts) {
-    if (!limiter)
+    if (!limiter) {
         return;
+    }
     const { allowed, retryAfterMs } = await limiter.consume(key, opts);
-    if (!allowed)
+    if (!allowed) {
         throw makeRateLimitError(retryAfterMs);
+    }
 }
 //# sourceMappingURL=rate-limiter.js.map

package/dist/server/kernel/rate-limiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/server/kernel/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAkBzC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,OAAO,oBAAoB;IACd,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,OAAO,CAAiC;IAEzD;QACE,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,IAAsB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,CAAC,QAAQ,IAAI,GAAG,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAChC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK;QACH,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAChC,YAAoB;IAEpB,OAAO,IAAI,SAAS,CAAC,mBAAmB,EAAE;QACxC,OAAO,EAAE,4CAA4C;QACrD,IAAI,EAAE,EAAE,YAAY,EAAE;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAuC,EACvC,GAAW,EACX,IAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO;QAAE,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/server/kernel/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAChC,YAAoB;IAEpB,OAAO,IAAI,SAAS,CAAC,mBAAmB,EAAE;QACxC,OAAO,EAAE,4CAA4C;QACrD,IAAI,EAAE,EAAE,YAAY,EAAE;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA0C,EAC1C,GAAM,EACN,IAAsB;IAEtB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}

package/dist/server/kernel/realtime-authorizer.d.ts

@@ -1,10 +1,8 @@
 import type { RealtimeClientAuthorizer, RealtimeClientAuthorizerInput, RealtimeConnectionGrant } from '@openora/core/contracts';
-export type SseClientAuthorizerOptions = {
-    streamPath?: string;
-};
+/** First-party SSE grant; the session cookie authorizes the stream itself. */
 export declare class SseClientAuthorizer implements RealtimeClientAuthorizer {
     private readonly streamPath;
-    constructor(options?: SseClientAuthorizerOptions);
+    constructor(streamPath?: string);
     issueGrant(input: RealtimeClientAuthorizerInput): RealtimeConnectionGrant;
 }
 //# sourceMappingURL=realtime-authorizer.d.ts.map

package/dist/server/kernel/realtime-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime-authorizer.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/realtime-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,EACxB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,MAAM,0BAA0B,GAAG;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,qBAAa,mBAAoB,YAAW,wBAAwB;IAClE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,OAAO,GAAE,0BAA+B;IAIpD,UAAU,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB;CAG1E"}
+{"version":3,"file":"realtime-authorizer.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/realtime-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,qBAAa,mBAAoB,YAAW,wBAAwB;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,SAAiB;IAExD,UAAU,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB;CAG1E"}

package/dist/server/kernel/realtime-authorizer.js

@@ -1,7 +1,8 @@
+/** First-party SSE grant; the session cookie authorizes the stream itself. */
 export class SseClientAuthorizer {
     streamPath;
-    constructor(options = {}) {
-        this.streamPath = options.streamPath ?? '/chat/stream';
+    constructor(streamPath = '/chat/stream') {
+        this.streamPath = streamPath;
     }
     issueGrant(input) {
         return { provider: 'sse', streamPath: this.streamPath, channels: input.channels };

package/dist/server/kernel/realtime-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"realtime-authorizer.js","sourceRoot":"","sources":["../../../src/server/kernel/realtime-authorizer.ts"],"names":[],"mappings":"AAcA,MAAM,OAAO,mBAAmB;IACb,UAAU,CAAS;IAEpC,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACzD,CAAC;IAED,UAAU,CAAC,KAAoC;QAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IACpF,CAAC;CACF"}
+{"version":3,"file":"realtime-authorizer.js","sourceRoot":"","sources":["../../../src/server/kernel/realtime-authorizer.ts"],"names":[],"mappings":"AAMA,8EAA8E;AAC9E,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,aAAa,cAAc;QAA3B,eAAU,GAAV,UAAU,CAAiB;IAAG,CAAC;IAE5D,UAAU,CAAC,KAAoC;QAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IACpF,CAAC;CACF"}

package/dist/server/kernel/realtime-transport.d.ts

@@ -1,8 +1,13 @@
-import type { RealtimeTransport, RealtimePresence } from '@openora/core/contracts';
+import type { RealtimePresence, RealtimeTransport } from '@openora/core/contracts';
+/** First-party process-local fan-out used by the default SSE transport. */
 export declare class InProcessRealtimeTransport implements RealtimeTransport {
     private readonly channels;
+    private readonly inProcessPresence;
     readonly presence: RealtimePresence;
     publish<T>(channel: string, event: T): void;
-    subscribe<T>(channel: string, handler: (event: T) => void): () => void;
+    remove<T>(channel: string, event: T): void;
+    subscribe<T>(channel: string, handler: (event: T) => void, clientId?: string): () => void;
+    revokeClientFromChannel(clientId: string, channel: string): void;
+    getOnlineUserIds(channel: string): Promise<string[]>;
 }
 //# sourceMappingURL=realtime-transport.d.ts.map

package/dist/server/kernel/realtime-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime-transport.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/realtime-transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AA0BnF,qBAAa,0BAA2B,YAAW,iBAAiB;IAClE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAA2B;IAE9D,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAa3C,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI;CAWvE"}
+{"version":3,"file":"realtime-transport.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/realtime-transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AA6CnF,2EAA2E;AAC3E,qBAAa,0BAA2B,YAAW,iBAAiB;IAClE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAC7D,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAA0B;IAE7D,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAe3C,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAI1C,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;IAiBzF,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAehE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAGrD"}

package/dist/server/kernel/realtime-transport.js

@@ -1,52 +1,93 @@
 class InProcessPresence {
     members = new Map();
-    join(channel, memberId) {
-        const set = this.members.get(channel) ?? new Set();
-        set.add(memberId);
-        this.members.set(channel, set);
-    }
-    leave(channel, memberId) {
-        const set = this.members.get(channel);
-        if (!set)
+    join(channel, memberId, connectionId) {
+        const channelMembers = this.members.get(channel) ?? new Map();
+        const connections = channelMembers.get(memberId) ?? new Set();
+        connections.add(connectionId);
+        channelMembers.set(memberId, connections);
+        this.members.set(channel, channelMembers);
+    }
+    leave(channel, memberId, connectionId) {
+        const channelMembers = this.members.get(channel);
+        const connections = channelMembers?.get(memberId);
+        if (!channelMembers || !connections) {
             return;
-        set.delete(memberId);
-        if (set.size === 0)
+        }
+        connections.delete(connectionId);
+        if (connections.size === 0) {
+            channelMembers.delete(memberId);
+        }
+        if (channelMembers.size === 0) {
             this.members.delete(channel);
+        }
     }
     count(channel) {
         return this.members.get(channel)?.size ?? 0;
     }
+    /** Returns authenticated member IDs (excludes anonymous:* entries). */
+    getUserIds(channel) {
+        const channelMembers = this.members.get(channel);
+        if (!channelMembers) {
+            return [];
+        }
+        return Array.from(channelMembers.keys()).filter((id) => !id.startsWith('anonymous:'));
+    }
 }
-// Reference adoption: chat message fan-out + big-win feed. See ADR-0007.
+/** First-party process-local fan-out used by the default SSE transport. */
 export class InProcessRealtimeTransport {
     channels = new Map();
-    presence = new InProcessPresence();
+    inProcessPresence = new InProcessPresence();
+    presence = this.inProcessPresence;
     publish(channel, event) {
         const subscribers = this.channels.get(channel);
-        if (!subscribers)
+        if (!subscribers) {
             return;
+        }
         // Snapshot so a handler that unsubscribes mid-iteration can't corrupt the loop.
-        for (const handler of Array.from(subscribers)) {
+        for (const { handler } of Array.from(subscribers)) {
             try {
                 handler(event);
             }
             catch {
-                // failing subscriber must not break fan-out to others
+                // One disconnected subscriber must not stop fan-out to others.
             }
         }
     }
-    subscribe(channel, handler) {
-        const set = this.channels.get(channel) ?? new Set();
-        set.add(handler);
-        this.channels.set(channel, set);
+    remove(channel, event) {
+        this.publish(channel, event);
+    }
+    subscribe(channel, handler, clientId) {
+        const subscribers = this.channels.get(channel) ?? new Set();
+        const subscription = { handler: handler, clientId };
+        subscribers.add(subscription);
+        this.channels.set(channel, subscribers);
         return () => {
             const current = this.channels.get(channel);
-            if (!current)
+            if (!current) {
                 return;
-            current.delete(handler);
-            if (current.size === 0)
+            }
+            current.delete(subscription);
+            if (current.size === 0) {
                 this.channels.delete(channel);
+            }
         };
     }
+    revokeClientFromChannel(clientId, channel) {
+        const subscribers = this.channels.get(channel);
+        if (!subscribers) {
+            return;
+        }
+        for (const subscription of Array.from(subscribers)) {
+            if (subscription.clientId === clientId) {
+                subscribers.delete(subscription);
+            }
+        }
+        if (subscribers.size === 0) {
+            this.channels.delete(channel);
+        }
+    }
+    getOnlineUserIds(channel) {
+        return Promise.resolve(this.inProcessPresence.getUserIds(channel));
+    }
 }
 //# sourceMappingURL=realtime-transport.js.map

package/dist/server/kernel/realtime-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"realtime-transport.js","sourceRoot":"","sources":["../../../src/server/kernel/realtime-transport.ts"],"names":[],"mappings":"AAIA,MAAM,iBAAiB;IACJ,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE1D,IAAI,CAAC,OAAe,EAAE,QAAgB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,QAAgB;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrB,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,OAAe;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,yEAAyE;AACzE,MAAM,OAAO,0BAA0B;IACpB,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnD,QAAQ,GAAqB,IAAI,iBAAiB,EAAE,CAAC;IAE9D,OAAO,CAAI,OAAe,EAAE,KAAQ;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,gFAAgF;QAChF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,CAAI,OAAe,EAAE,OAA2B;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAW,CAAC;QAC7D,GAAG,CAAC,GAAG,CAAC,OAAkB,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,GAAG,EAAE;YACV,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,OAAO,CAAC,MAAM,CAAC,OAAkB,CAAC,CAAC;YACnC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"realtime-transport.js","sourceRoot":"","sources":["../../../src/server/kernel/realtime-transport.ts"],"names":[],"mappings":"AAKA,MAAM,iBAAiB;IACJ,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEvE,IAAI,CAAC,OAAe,EAAE,QAAgB,EAAE,YAAoB;QAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAuB,CAAC;QACnF,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACtE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9B,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,QAAgB,EAAE,YAAoB;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QACD,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACjC,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAe;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,uEAAuE;IACvE,UAAU,CAAC,OAAe;QACxB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IACxF,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,0BAA0B;IACpB,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IAChD,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACpD,QAAQ,GAAqB,IAAI,CAAC,iBAAiB,CAAC;IAE7D,OAAO,CAAI,OAAe,EAAE,KAAQ;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,gFAAgF;QAChF,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAI,OAAe,EAAE,KAAQ;QACjC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,SAAS,CAAI,OAAe,EAAE,OAA2B,EAAE,QAAiB;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAgB,CAAC;QAC1E,MAAM,YAAY,GAAG,EAAE,OAAO,EAAE,OAAkB,EAAE,QAAQ,EAAE,CAAC;QAC/D,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACxC,OAAO,GAAG,EAAE;YACV,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,uBAAuB,CAAC,QAAgB,EAAE,OAAe;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,IAAI,YAAY,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACvC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;CACF"}

package/dist/server/kernel/redis-cache.d.ts

@@ -7,6 +7,9 @@ export declare class RedisCache implements CacheAdapter {
     set<T>(key: string, value: T, opts: {
         ttlMs: number;
     }): Promise<void>;
+    setIfAbsent<T>(key: string, value: T, opts: {
+        ttlMs: number;
+    }): Promise<boolean>;
     delete(key: string | string[]): Promise<void>;
 }
 //# sourceMappingURL=redis-cache.d.ts.map

package/dist/server/kernel/redis-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-cache.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD,qBAAa,UAAW,YAAW,YAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAE1C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAO3C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMpD"}
+{"version":3,"file":"redis-cache.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD,qBAAa,UAAW,YAAW,YAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAE1C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAW3C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASrE,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAWhF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAUpD"}

package/dist/server/kernel/redis-cache.js

@@ -10,26 +10,41 @@ export class RedisCache {
         this.client = client;
     }
     async get(key) {
-        if (!this.client.isReady)
+        if (!this.client.isReady) {
             return undefined;
+        }
         const raw = await this.client.get(PREFIX + key);
-        if (raw === null)
+        if (raw === null) {
             return undefined;
+        }
         return JSON.parse(raw);
     }
     async set(key, value, opts) {
-        if (!this.client.isReady)
+        if (!this.client.isReady) {
             return;
+        }
         await this.client.set(PREFIX + key, JSON.stringify(value), {
             expiration: { type: 'PX', value: opts.ttlMs },
         });
     }
+    async setIfAbsent(key, value, opts) {
+        if (!this.client.isReady) {
+            throw new Error('Redis is not ready');
+        }
+        const result = await this.client.set(PREFIX + key, JSON.stringify(value), {
+            expiration: { type: 'PX', value: opts.ttlMs },
+            NX: true,
+        });
+        return result === 'OK';
+    }
     async delete(key) {
-        if (!this.client.isReady)
+        if (!this.client.isReady) {
             return;
+        }
         const keys = (Array.isArray(key) ? key : [key]).map((k) => PREFIX + k);
-        if (keys.length === 0)
+        if (keys.length === 0) {
             return;
+        }
         await this.client.del(keys);
     }
 }

package/dist/server/kernel/redis-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis-cache.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-cache.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,gFAAgF;AAChF,0DAA0D;AAC1D,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,IAAuB;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YACzD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAsB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACjC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"redis-cache.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-cache.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,gFAAgF;AAChF,0DAA0D;AAC1D,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,IAAuB;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YACzD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAI,GAAW,EAAE,KAAQ,EAAE,IAAuB;QACjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YACxE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAC7C,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;QACH,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAsB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF"}

package/dist/server/kernel/redis-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-client.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAGrC,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AAQ1D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAS1D"}
+{"version":3,"file":"redis-client.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAGrC,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AAU1D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAY1D"}

package/dist/server/kernel/redis-client.js

@@ -1,5 +1,6 @@
 import { createClient } from 'redis';
 import { createLogger } from './logger.js';
+const REDIS_CONNECT_TIMEOUT_MS = 5000;
 // One shared client for both the RedisCache and RedisRateLimiter adapters, bound
 // by createApp when REDIS_URL is set. node-redis throws at the process level if no
 // 'error' listener is attached, so we attach one and log instead of crashing;
@@ -10,7 +11,10 @@ export function createRedisClient(url) {
     const logger = createLogger('redis');
     const client = createClient({
         url,
-        socket: { reconnectStrategy: (retries) => Math.min(retries * 100, 2000) },
+        socket: {
+            connectTimeout: REDIS_CONNECT_TIMEOUT_MS,
+            reconnectStrategy: (retries) => Math.min(retries * 100, 2000),
+        },
     });
     client.on('error', (err) => logger.error({ err }, 'redis client error'));
     client.connect().catch((err) => logger.error({ err }, 'redis connect failed'));

package/dist/server/kernel/redis-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis-client.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,iFAAiF;AACjF,mFAAmF;AACnF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,wCAAwC;AACxC,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG;QACH,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE;KAC1E,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"redis-client.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,iFAAiF;AACjF,mFAAmF;AACnF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,wCAAwC;AACxC,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG;QACH,MAAM,EAAE;YACN,cAAc,EAAE,wBAAwB;YACxC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC;SAC9D;KACF,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/kernel/redis-rate-limiter.d.ts

@@ -1,10 +1,22 @@
 import type { RateLimiterAdapter, RateLimitOptions, RateLimitResult } from '@openora/core/contracts';
 import type { RedisClient } from './redis-client.js';
+/**
+ * Redis-backed `RATE_LIMITER`, auto-bound by `createApp` when `REDIS_URL` is
+ * set - a fixed-window counter, incremented and expiry-set in one atomic Lua
+ * round-trip so concurrent replicas can't both read a stale count and slip
+ * past the limit. On a backend error/unreachable client it fails OPEN
+ * (allows the request) by default; callers that pass `onUnavailable: 'deny'`
+ * (credential-guessing surfaces, where an unthrottled window is worse than a
+ * false-positive 429) fail CLOSED instead. Never logs the raw key - it can
+ * embed a token or email (`pwreset:<token>`, `login:<email>`) - only the
+ * prefix before the first `:` is recorded.
+ */
 export declare class RedisRateLimiter implements RateLimiterAdapter {
     private readonly client;
     private readonly logger;
     constructor(client: RedisClient);
     consume(key: string, opts: RateLimitOptions): Promise<RateLimitResult>;
+    reset(key: string): Promise<void>;
     private unavailable;
 }
 //# sourceMappingURL=redis-rate-limiter.d.ts.map

package/dist/server/kernel/redis-rate-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAqBrD,qBAAa,gBAAiB,YAAW,kBAAkB;IAG7C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAEhC,MAAM,EAAE,WAAW;IAE1C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAsB5E,OAAO,CAAC,WAAW;CAUpB"}
+{"version":3,"file":"redis-rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAqBrD;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,kBAAkB;IAG7C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAEhC,MAAM,EAAE,WAAW;IAE1C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAmBtE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvC,OAAO,CAAC,WAAW;CAUpB"}

package/dist/server/kernel/redis-rate-limiter.js

@@ -15,6 +15,17 @@ if count == 1 then
 end
 return { count, redis.call('PTTL', KEYS[1]) }
 `;
+/**
+ * Redis-backed `RATE_LIMITER`, auto-bound by `createApp` when `REDIS_URL` is
+ * set - a fixed-window counter, incremented and expiry-set in one atomic Lua
+ * round-trip so concurrent replicas can't both read a stale count and slip
+ * past the limit. On a backend error/unreachable client it fails OPEN
+ * (allows the request) by default; callers that pass `onUnavailable: 'deny'`
+ * (credential-guessing surfaces, where an unthrottled window is worse than a
+ * false-positive 429) fail CLOSED instead. Never logs the raw key - it can
+ * embed a token or email (`pwreset:<token>`, `login:<email>`) - only the
+ * prefix before the first `:` is recorded.
+ */
 export class RedisRateLimiter {
     client;
     logger = createLogger('redis-rate-limiter');
@@ -22,8 +33,9 @@ export class RedisRateLimiter {
         this.client = client;
     }
     async consume(key, opts) {
-        if (!this.client.isReady)
+        if (!this.client.isReady) {
             return this.unavailable(opts, { keyPrefix: key.split(':')[0] });
+        }
         try {
             const reply = await this.client.eval(CONSUME_SCRIPT, {
                 keys: [PREFIX + key],
@@ -39,6 +51,17 @@ export class RedisRateLimiter {
             return this.unavailable(opts, { keyPrefix: key.split(':')[0], err });
         }
     }
+    async reset(key) {
+        if (!this.client.isReady) {
+            return;
+        }
+        try {
+            await this.client.del(PREFIX + key);
+        }
+        catch (err) {
+            this.logger.warn({ keyPrefix: key.split(':')[0], err }, 'rate limiter reset failed');
+        }
+    }
     // Backend unreachable: fail-open by default to keep availability (throttling pauses
     // during an outage); fail-closed for keys that opt into 'deny' where an unthrottled
     // window is worse than a 429 (credential guessing).

package/dist/server/kernel/redis-rate-limiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis-rate-limiter.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-rate-limiter.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,GAAG,KAAK,CAAC;AAErB,iFAAiF;AACjF,mFAAmF;AACnF,8EAA8E;AAC9E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,yEAAyE;AACzE,qFAAqF;AACrF,MAAM,cAAc,GAAG;;;;;;CAMtB,CAAC;AAEF,MAAM,OAAO,gBAAgB;IAGE;IAFZ,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAE7D,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;gBACnD,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC;gBACpB,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aACnC,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,oFAAoF;IACpF,oDAAoD;IACpD,oFAAoF;IACpF,0DAA0D;IAClD,WAAW,CAAC,IAAsB,EAAE,GAA4B;QACtE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,GAAG,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,OAAO,EAAE,EACxD,kCAAkC,CACnC,CAAC;QACF,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;CACF"}
+{"version":3,"file":"redis-rate-limiter.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-rate-limiter.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,GAAG,KAAK,CAAC;AAErB,iFAAiF;AACjF,mFAAmF;AACnF,8EAA8E;AAC9E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,yEAAyE;AACzE,qFAAqF;AACrF,MAAM,cAAc,GAAG;;;;;;CAMtB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAgB;IAGE;IAFZ,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAE7D,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;gBACnD,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC;gBACpB,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aACnC,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,2BAA2B,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,oFAAoF;IACpF,oDAAoD;IACpD,oFAAoF;IACpF,0DAA0D;IAClD,WAAW,CAAC,IAAsB,EAAE,GAA4B;QACtE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,GAAG,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,OAAO,EAAE,EACxD,kCAAkC,CACnC,CAAC;QACF,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;CACF"}