@pellux/goodvibes-transport-http 0.30.3 → 0.33.0

package/README.md

@@ -1,8 +1,8 @@
 # @pellux/goodvibes-transport-http
 
-Internal workspace package backing `@pellux/goodvibes-sdk/transport-http`.
+Public GoodVibes HTTP transport package for JSON requests, auth headers, retry/backoff, SSE streams, and contract route invocation.
 
-Consumers should install `@pellux/goodvibes-sdk` and import this surface from the umbrella package.
+Most applications should install `@pellux/goodvibes-sdk` and import `@pellux/goodvibes-sdk/transport-http`. Install this package directly when you only need the HTTP transport subset.
 
 Exports include:
 - contract route invocation helpers
@@ -15,11 +15,11 @@ Exports include:
 Use this surface when you need lower-level HTTP/SSE control or when you are building a custom GoodVibes client on top of the synced contracts.
 
 ```ts
-import { createJsonRequestInit, requestJson } from '@pellux/goodvibes-sdk/transport-http';
+import { createJsonRequestInit, requestJsonRaw } from '@pellux/goodvibes-sdk/transport-http';
 
-const body = await requestJson(
+const body = await requestJsonRaw(
   fetch,
-  'http://127.0.0.1:3210/api/control-plane/auth',
+  'http://127.0.0.1:3421/api/control-plane/auth',
   createJsonRequestInit(process.env.GOODVIBES_TOKEN ?? null),
 );
 ```

package/dist/auth.d.ts

@@ -8,7 +8,23 @@ export type AuthTokenInput = string | {
     readonly token: string;
 } | AuthTokenResolver | (() => string | null | undefined | Promise<string | null | undefined>) | undefined;
 export type HeaderResolver = () => MaybePromise<HeadersInit | undefined>;
+/**
+ * Merge header inputs into a `Headers` instance.
+ *
+ * Use this when a streaming/browser API expects mutable `Headers`, such as
+ * EventSource-style setup or abort-aware fetch helpers. For ordinary JSON HTTP
+ * requests, prefer `mergeHeaderRecord` so callers receive a plain object that is
+ * cheap to serialize, inspect, and pass through middleware.
+ */
 export declare function mergeHeaders(...sources: Array<HeadersInit | undefined>): Headers;
+/**
+ * Merge header inputs into a lower-case plain record.
+ *
+ * Preferred for normal HTTP transport requests because the result is a stable
+ * `Record<string, string>` for middleware, trace injection, and JSON request
+ * construction. Use `mergeHeaders` only when a consumer specifically needs a
+ * platform `Headers` object.
+ */
 export declare function mergeHeaderRecord(...sources: Array<HeadersInit | undefined>): Record<string, string>;
 /**
  * Accepts any supported auth token form and returns a canonical async resolver.

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAE7C,MAAM,MAAM,iBAAiB,GAAG,MAAM,YAAY,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAE9E;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,MAAM,GACN;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1B,iBAAiB,GACjB,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GACtE,SAAS,CAAC;AAEd,MAAM,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;AA0CzE,wBAAgB,YAAY,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,OAAO,CAMhF;AAED,wBAAgB,iBAAiB,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIpG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,iBAAiB,CAY3E;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,YAAY,CAAC,EAAE,iBAAiB,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,GAAG,SAAS,EAChC,UAAU,CAAC,EAAE,cAAc,GAC1B,OAAO,CAAC,OAAO,CAAC,CAGlB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAE7C,MAAM,MAAM,iBAAiB,GAAG,MAAM,YAAY,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAE9E;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,MAAM,GACN;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1B,iBAAiB,GACjB,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GACtE,SAAS,CAAC;AAEd,MAAM,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;AA0CzE;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,OAAO,CAMhF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIpG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,iBAAiB,CAY3E;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,YAAY,CAAC,EAAE,iBAAiB,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,GAAG,SAAS,EAChC,UAAU,CAAC,EAAE,cAAc,GAC1B,OAAO,CAAC,OAAO,CAAC,CAGlB"}

package/dist/auth.js

@@ -39,6 +39,14 @@ function appendHeaderRecord(target, headers) {
             target[key.toLowerCase()] = value;
     }
 }
+/**
+ * Merge header inputs into a `Headers` instance.
+ *
+ * Use this when a streaming/browser API expects mutable `Headers`, such as
+ * EventSource-style setup or abort-aware fetch helpers. For ordinary JSON HTTP
+ * requests, prefer `mergeHeaderRecord` so callers receive a plain object that is
+ * cheap to serialize, inspect, and pass through middleware.
+ */
 export function mergeHeaders(...sources) {
     const headers = new Headers();
     for (const source of sources) {
@@ -46,6 +54,14 @@ export function mergeHeaders(...sources) {
     }
     return headers;
 }
+/**
+ * Merge header inputs into a lower-case plain record.
+ *
+ * Preferred for normal HTTP transport requests because the result is a stable
+ * `Record<string, string>` for middleware, trace injection, and JSON request
+ * construction. Use `mergeHeaders` only when a consumer specifically needs a
+ * platform `Headers` object.
+ */
 export function mergeHeaderRecord(...sources) {
     const headers = {};
     for (const source of sources)
@@ -69,7 +85,7 @@ export function normalizeAuthToken(input) {
         return async () => input;
     }
     if (typeof input === 'function') {
-        return async () => await input() ?? undefined;
+        return async () => (await input()) ?? undefined;
     }
     // { token: string } wrapper object
     return async () => input.token;

package/dist/backoff.d.ts

@@ -1,8 +1,8 @@
 export interface BackoffPolicy {
-    readonly maxAttempts?: number;
-    readonly baseDelayMs?: number;
-    readonly maxDelayMs?: number;
-    readonly backoffFactor?: number;
+    readonly maxAttempts?: number | undefined;
+    readonly baseDelayMs?: number | undefined;
+    readonly maxDelayMs?: number | undefined;
+    readonly backoffFactor?: number | undefined;
 }
 export interface ResolvedBackoffPolicy {
     readonly maxAttempts: number;

package/dist/backoff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backoff.d.ts","sourceRoot":"","sources":["../src/backoff.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,QAAQ,EAAE,qBAAqB,GAC9B,qBAAqB,CAOvB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,qBAAqB,GAC5B,MAAM,CAKR;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAqBf"}
+{"version":3,"file":"backoff.d.ts","sourceRoot":"","sources":["../src/backoff.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,QAAQ,EAAE,qBAAqB,GAC9B,qBAAqB,CAOvB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,qBAAqB,GAC5B,MAAM,CAKR;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/client-plumbing.d.ts

@@ -28,5 +28,5 @@ export interface JsonSchemaValidationFailure {
     readonly expected: string;
     readonly received: string;
 }
-export declare function firstJsonSchemaFailure(schema: Record<string, unknown>, value: unknown, path?: string, root?: Record<string, unknown>): JsonSchemaValidationFailure | undefined;
+export declare function firstJsonSchemaFailure(schema: Record<string, unknown>, value: unknown, path?: string, root?: Record<string, unknown>, _depth?: number): JsonSchemaValidationFailure | undefined;
 //# sourceMappingURL=client-plumbing.d.ts.map

package/dist/client-plumbing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-plumbing.d.ts","sourceRoot":"","sources":["../src/client-plumbing.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,MAAM,IAAI;KAC1C,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;CACpD,CAAC,MAAM,CAAC,CAAC,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,IACrC;IAAC,MAAM;CAAC,SAAS,CAAC,SAAS,CAAC,GACxB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,GACvC,MAAM,SAAS,MAAM,GACnB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACpC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,GACpC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,GACrC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAE5C,mFAAmF;AACnF,MAAM,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,SAAS,WAAW,IACvD;IAAC,MAAM;CAAC,SAAS,CAAC,SAAS,CAAC,GACxB,SAAS,GACT,MAAM,SAAS,MAAM,GACnB,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,MAAM,EAAE,KAAK,CAAC,CAAC,GAC1C,MAAM,CAAC;AAEf;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,QAAQ,EAC9C,IAAI,EAAE,SAAS,OAAO,EAAE,GACvB,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,QAAQ,GAAG,SAAS,CAAC,CAKrD;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAIxG;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,MAAM,EACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,OAAO,EACd,IAAI,SAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAU,GACrC,2BAA2B,GAAG,SAAS,CA2FzC"}
+{"version":3,"file":"client-plumbing.d.ts","sourceRoot":"","sources":["../src/client-plumbing.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,MAAM,IAAI;KAC1C,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;CACpD,CAAC,MAAM,CAAC,CAAC,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,IACrC;IAAC,MAAM;CAAC,SAAS,CAAC,SAAS,CAAC,GACxB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,GACvC,MAAM,SAAS,MAAM,GACnB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACpC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,GACpC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,GACrC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAE5C,mFAAmF;AACnF,MAAM,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,SAAS,WAAW,IACvD;IAAC,MAAM;CAAC,SAAS,CAAC,SAAS,CAAC,GACxB,SAAS,GACT,MAAM,SAAS,MAAM,GACnB,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,MAAM,EAAE,KAAK,CAAC,CAAC,GAC1C,MAAM,CAAC;AAEf;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,QAAQ,EAC9C,IAAI,EAAE,SAAS,OAAO,EAAE,GACvB,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,QAAQ,GAAG,SAAS,CAAC,CAMrD;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAIxG;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,MAAM,EACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAID,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,OAAO,EACd,IAAI,SAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAU,EACtC,MAAM,SAAI,GACT,2BAA2B,GAAG,SAAS,CA+FzC"}

package/dist/client-plumbing.js

@@ -1,3 +1,13 @@
+import { ContractError } from '@pellux/goodvibes-errors';
+const MAX_SCHEMA_PATTERN_CHARS = 512;
+const MAX_SCHEMA_PATTERN_INPUT_CHARS = 50_000;
+const RISKY_SCHEMA_PATTERN_CHECKS = [
+    /(^|[^\\])\\[1-9]/,
+    /\((?:[^()\\]|\\.)*[+*{][^)]*\)\s*[+*{]/,
+    /\.\*(?:[^|)]{0,64})\.\*/,
+    // Lookbehind assertions (?<=...) can also produce pathological backtracking.
+    /\(\?<[=!]/,
+];
 /**
  * Splits a generated client helper's rest tuple into input and options.
  * The tuple type already proves the argument shape; runtime work is only the
@@ -7,6 +17,7 @@ export function splitClientArgs(args) {
     if (args.length > 2) {
         throw new ContractError(`Contract client helper expected at most 2 arguments but received ${args.length}.`);
     }
+    // drop misleading non-null assertions — args[0]/args[1] may be undefined.
     return [args[0], args[1]];
 }
 /** Convert a typed client input object into the record shape required by contract route helpers. */
@@ -22,26 +33,30 @@ export function mergeClientInput(fixed, input) {
         ...(clientInputRecord(input) ?? {}),
     };
 }
-export function firstJsonSchemaFailure(schema, value, path = '$', root = schema) {
+const MAX_SCHEMA_WALK_DEPTH = 32;
+export function firstJsonSchemaFailure(schema, value, path = '$', root = schema, _depth = 0) {
+    // Guard against cyclic $ref chains.
+    if (_depth >= MAX_SCHEMA_WALK_DEPTH)
+        return undefined;
     if (typeof schema.$ref === 'string') {
         const resolved = resolveLocalSchemaRef(root, schema.$ref);
-        return resolved ? firstJsonSchemaFailure(resolved, value, path, root) : undefined;
+        return resolved ? firstJsonSchemaFailure(resolved, value, path, root, _depth + 1) : undefined;
     }
     const allOf = readSchemaList(schema.allOf);
     for (const child of allOf) {
-        const failure = firstJsonSchemaFailure(child, value, path, root);
+        const failure = firstJsonSchemaFailure(child, value, path, root, _depth + 1);
         if (failure)
             return failure;
     }
     const anyOf = readSchemaList(schema.anyOf);
     if (anyOf.length > 0) {
-        const failures = anyOf.map((child) => firstJsonSchemaFailure(child, value, path, root));
+        const failures = anyOf.map((child) => firstJsonSchemaFailure(child, value, path, root, _depth + 1));
         if (failures.every(Boolean))
             return bestSchemaFailure(failures) ?? { path, expected: 'one matching schema', received: typeOfJsonValue(value) };
     }
     const oneOf = readSchemaList(schema.oneOf);
     if (oneOf.length > 0) {
-        const matches = oneOf.filter((child) => !firstJsonSchemaFailure(child, value, path, root)).length;
+        const matches = oneOf.filter((child) => !firstJsonSchemaFailure(child, value, path, root, _depth + 1)).length;
         if (matches !== 1)
             return { path, expected: 'exactly one matching schema', received: `${matches} matches` };
     }
@@ -73,8 +88,8 @@ export function firstJsonSchemaFailure(schema, value, path = '$', root = schema)
         return { path, expected: `length <= ${maxLength}`, received: `length ${value.length}` };
     }
     if (typeof value === 'string' && typeof schema.pattern === 'string') {
-        const pattern = new RegExp(schema.pattern);
-        if (!pattern.test(value))
+        const pattern = compileContractPattern(schema.pattern);
+        if (!contractPatternMatches(pattern, value))
             return { path, expected: `pattern ${schema.pattern}`, received: 'non-matching string' };
     }
     if (typeof value === 'string' && typeof schema.format === 'string' && !stringMatchesJsonSchemaFormat(value, schema.format)) {
@@ -86,7 +101,8 @@ export function firstJsonSchemaFailure(schema, value, path = '$', root = schema)
         const itemSchema = schema.items;
         if (itemSchema && typeof itemSchema === 'object' && !Array.isArray(itemSchema)) {
             for (let index = 0; index < value.length; index++) {
-                const failure = firstJsonSchemaFailure(itemSchema, value[index], `${path}[${index}]`, root);
+                // pass _depth + 1 so depth-reset through array items is prevented.
+                const failure = firstJsonSchemaFailure(itemSchema, value[index], `${path}[${index}]`, root, _depth + 1);
                 if (failure)
                     return failure;
             }
@@ -113,7 +129,8 @@ export function firstJsonSchemaFailure(schema, value, path = '$', root = schema)
                     continue;
                 if (!propertySchema || typeof propertySchema !== 'object' || Array.isArray(propertySchema))
                     continue;
-                const failure = firstJsonSchemaFailure(propertySchema, objectValue[key], `${path}.${key}`, root);
+                // pass _depth + 1 so nested property recursion respects the walk depth limit.
+                const failure = firstJsonSchemaFailure(propertySchema, objectValue[key], `${path}.${key}`, root, _depth + 1);
                 if (failure)
                     return failure;
             }
@@ -158,6 +175,24 @@ function readSchemaTypes(type) {
         return type.filter((entry) => typeof entry === 'string');
     return [];
 }
+function compileContractPattern(source) {
+    if (source.length > MAX_SCHEMA_PATTERN_CHARS) {
+        throw new ContractError(`Contract schema pattern exceeds ${MAX_SCHEMA_PATTERN_CHARS} characters.`);
+    }
+    for (const pattern of RISKY_SCHEMA_PATTERN_CHECKS) {
+        if (pattern.test(source)) {
+            throw new ContractError('Contract schema pattern is too expensive to evaluate safely.');
+        }
+    }
+    return new RegExp(source);
+}
+function contractPatternMatches(pattern, value) {
+    if (value.length > MAX_SCHEMA_PATTERN_INPUT_CHARS) {
+        throw new ContractError(`Contract schema pattern input exceeds ${MAX_SCHEMA_PATTERN_INPUT_CHARS} characters.`);
+    }
+    pattern.lastIndex = 0;
+    return pattern.test(value);
+}
 function valueMatchesJsonType(value, type) {
     switch (type) {
         case 'null': return value === null;
@@ -173,7 +208,10 @@ function valueMatchesJsonType(value, type) {
 function stringMatchesJsonSchemaFormat(value, format) {
     switch (format) {
         case 'date-time':
-            return !Number.isNaN(Date.parse(value)) && /\dT\d/.test(value);
+            // JSON Schema date-time requires a full date/time separator; Date.parse
+            // alone accepts date-only strings in some runtimes.
+            return /^\d{4}-\d{2}-\d{2}T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(value)
+                && !Number.isNaN(Date.parse(value));
         case 'date':
             return /^\d{4}-\d{2}-\d{2}$/.test(value) && !Number.isNaN(Date.parse(`${value}T00:00:00.000Z`));
         case 'time':
@@ -240,4 +278,3 @@ function typeOfJsonValue(value) {
         return 'array';
     return typeof value;
 }
-import { ContractError } from '@pellux/goodvibes-errors';

package/dist/contract-client.d.ts

@@ -8,23 +8,22 @@ export interface ContractRouteDefinition {
 export interface ContractRouteLike {
     readonly id: string;
     /** When true, this route is safe to retry on 5xx even for mutating HTTP verbs. */
-    readonly idempotent?: boolean;
+    readonly idempotent?: boolean | undefined;
 }
 export interface ContractInvokeOptions {
-    readonly signal?: AbortSignal;
-    readonly headers?: HeadersInit;
+    readonly signal?: AbortSignal | undefined;
+    readonly headers?: HeadersInit | undefined;
     /**
      * Optional Zod v4 schema to validate the parsed response body against.
      * When provided, a failed parse throws a {@link ContractError} with
      * field-level detail: operation, field path, expected type, and a
      * recovery hint.
      */
-    readonly responseSchema?: ZodType;
+    readonly responseSchema?: ZodType | undefined;
 }
 export interface ContractStreamOptions extends ContractInvokeOptions {
     readonly handlers: ServerSentEventHandlers;
 }
-export declare function buildContractInput(primaryKey: string, primaryValue: string, input?: Record<string, unknown>): Record<string, unknown>;
 export declare function requireContractRoute<TRoute extends ContractRouteLike>(routes: readonly TRoute[], routeId: string, kind: string): TRoute;
 export declare function invokeContractRoute<T = unknown>(transport: HttpTransport, route: ContractRouteDefinition & ContractRouteLike, input?: Record<string, unknown>, options?: ContractInvokeOptions): Promise<T>;
 export declare function openContractRouteStream(transport: HttpTransport, route: ContractRouteDefinition, input: Record<string, unknown> | undefined, options: ContractStreamOptions): Promise<() => void>;

package/dist/contract-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-client.d.ts","sourceRoot":"","sources":["../src/contract-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAgC,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE7F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;CAC5C;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKzB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,SAAS,iBAAiB,EACnE,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,MAAM,CAMR;AAED,wBAAsB,mBAAmB,CAAC,CAAC,GAAG,OAAO,EACnD,SAAS,EAAE,aAAa,EACxB,KAAK,EAAE,uBAAuB,GAAG,iBAAiB,EAClD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,CAAC,CAAC,CAyBZ;AAED,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,aAAa,EACxB,KAAK,EAAE,uBAAuB,EAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,IAAI,CAAC,CAYrB"}
+{"version":3,"file":"contract-client.d.ts","sourceRoot":"","sources":["../src/contract-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAgC,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE7F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;CAC5C;AAED,wBAAgB,oBAAoB,CAAC,MAAM,SAAS,iBAAiB,EACnE,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,MAAM,CAMR;AAED,wBAAsB,mBAAmB,CAAC,CAAC,GAAG,OAAO,EACnD,SAAS,EAAE,aAAa,EACxB,KAAK,EAAE,uBAAuB,GAAG,iBAAiB,EAClD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,CAAC,CAAC,CAyBZ;AAED,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,aAAa,EACxB,KAAK,EAAE,uBAAuB,EAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,IAAI,CAAC,CAYrB"}

package/dist/contract-client.js

@@ -1,11 +1,5 @@
 import { ContractError, GoodVibesSdkError } from '@pellux/goodvibes-errors';
 import { openRawServerSentEventStream } from './sse-stream.js';
-export function buildContractInput(primaryKey, primaryValue, input) {
-    return {
-        [primaryKey]: primaryValue,
-        ...(input ?? {}),
-    };
-}
 export function requireContractRoute(routes, routeId, kind) {
     const route = routes.find((candidate) => candidate.id === routeId);
     if (!route) {

package/dist/http-core.d.ts

@@ -5,9 +5,8 @@ import { type TransportPaths } from './paths.js';
 import { type TransportMiddleware, type TransportObserver } from '@pellux/goodvibes-transport-core';
 export type { HttpRetryPolicy, PerMethodRetryPolicy } from './retry.js';
 export type { TransportContext, TransportMiddleware } from '@pellux/goodvibes-transport-core';
-export type JsonValue = string | number | boolean | null | {
-    readonly [key: string]: JsonValue;
-} | readonly JsonValue[];
+export type { JsonValue } from '@pellux/goodvibes-contracts';
+import type { JsonValue } from '@pellux/goodvibes-contracts';
 export type JsonObject = {
     readonly [key: string]: JsonValue;
 };
@@ -19,53 +18,71 @@ export type JsonObject = {
 export declare function generateIdempotencyKey(): string;
 export interface HttpJsonTransportOptions {
     readonly baseUrl: string;
-    readonly authToken?: string | null;
-    readonly getAuthToken?: AuthTokenResolver;
-    readonly fetch?: typeof fetch;
-    readonly fetchImpl?: typeof fetch;
-    readonly headers?: HeadersInit;
-    readonly getHeaders?: HeaderResolver;
-    readonly retry?: HttpRetryPolicy;
-    readonly observer?: TransportObserver;
+    readonly authToken?: string | null | undefined;
+    readonly getAuthToken?: AuthTokenResolver | undefined;
+    readonly fetch?: typeof fetch | undefined;
+    readonly fetchImpl?: typeof fetch | undefined;
+    readonly headers?: HeadersInit | undefined;
+    readonly getHeaders?: HeaderResolver | undefined;
+    readonly retry?: HttpRetryPolicy | undefined;
+    readonly observer?: TransportObserver | undefined;
     /** Middleware chain applied to every HTTP request/response cycle. */
-    readonly middleware?: readonly TransportMiddleware[];
+    readonly middleware?: readonly TransportMiddleware[] | undefined;
+    /**
+     * Optional callback invoked when the retry loop decides to back off.
+     * Fires immediately before the sleep delay. Use this to emit TRANSPORT_RETRY_SCHEDULED.
+     */
+    readonly onRetryScheduled?: ((info: {
+        attempt: number;
+        maxAttempts: number;
+        backoffMs: number;
+        reason: string;
+    }) => void) | undefined;
+    /**
+     * Optional callback invoked when the sleep delay completes and the next attempt is
+     * about to start. Fires immediately after the sleep. Use to emit TRANSPORT_RETRY_EXECUTED.
+     */
+    readonly onRetryExecuted?: ((info: {
+        attempt: number;
+        maxAttempts: number;
+    }) => void) | undefined;
 }
 export interface HttpJsonRequestOptions {
-    readonly method?: string;
-    readonly body?: unknown;
-    readonly headers?: HeadersInit;
-    readonly signal?: AbortSignal;
-    readonly retry?: false | HttpRetryPolicy;
+    readonly method?: string | undefined;
+    readonly body?: unknown | undefined;
+    readonly headers?: HeadersInit | undefined;
+    readonly signal?: AbortSignal | undefined;
+    readonly retry?: false | HttpRetryPolicy | undefined;
     /**
      * Contract method / endpoint ID used to look up per-method retry policy overrides.
      * Populated automatically by `invokeContractRoute`; callers outside the contract
      * layer may also set this to opt into `perMethodPolicy` overrides.
      */
-    readonly methodId?: string;
+    readonly methodId?: string | undefined;
     /**
      * When `true`, this call is considered idempotent even if the HTTP verb is a
      * mutating method (POST/PUT/PATCH/DELETE). Enables retry-on-5xx for the call.
      * Populated automatically from `contract.idempotent`; takes lower precedence
      * than an explicit `perMethodPolicy` override.
      */
-    readonly idempotent?: boolean;
+    readonly idempotent?: boolean | undefined;
 }
 export interface ResolvedContractRequest {
     readonly url: string;
     readonly method: string;
-    readonly body?: Record<string, unknown>;
+    readonly body?: Record<string, unknown> | undefined;
 }
 export interface TransportJsonError {
     readonly status: number;
     readonly body: unknown;
     readonly url: string;
     readonly method: string;
-    readonly retryAfterMs?: number;
-    readonly cause?: unknown;
+    readonly retryAfterMs?: number | undefined;
+    readonly cause?: unknown | undefined;
 }
 export interface HttpJsonTransport {
     readonly baseUrl: string;
-    readonly authToken?: string | null;
+    readonly authToken?: string | null | undefined;
     readonly fetchImpl: typeof fetch;
     readonly paths: TransportPaths;
     buildUrl(path: string): string;
@@ -87,10 +104,12 @@ export declare const createJsonInit: typeof createJsonRequestInit;
 export declare function createFetch(fetchImpl?: typeof fetch, fallbackFetch?: typeof fetch): typeof fetch;
 export declare function readJsonBody(response: Response): Promise<unknown>;
 /**
- * @internal Low-level one-shot helper retained for legacy internal callers.
- * Public code should use `createHttpTransport(...).requestJson()` so auth,
- * middleware, retry policy, idempotency keys, and observers are applied.
+ * Low-level one-shot JSON request helper.
+ *
+ * This deliberately bypasses transport auth, middleware, retry policy,
+ * idempotency keys, and observers. Prefer
+ * `createHttpTransport(...).requestJson()` for normal application code.
  */
-export declare function requestJson<T>(fetchImpl: typeof fetch, url: string, init?: RequestInit): Promise<T>;
+export declare function requestJsonRaw<T>(fetchImpl: typeof fetch, url: string, init?: RequestInit): Promise<T>;
 export declare function createHttpJsonTransport(options: HttpJsonTransportOptions): HttpJsonTransport;
 //# sourceMappingURL=http-core.d.ts.map

package/dist/http-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-core.d.ts","sourceRoot":"","sources":["../src/http-core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,eAAe,EAAyB,MAAM,0BAA0B,CAAC;AAExI,OAAO,EAA2E,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AACjJ,OAAO,EAML,KAAK,eAAe,EAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAkC,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EAOL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACxE,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE9F,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACrC,SAAS,SAAS,EAAE,CAAC;AAEzB,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAKD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,eAAe,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChF,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,uBAAuB,CAAC;IAC/G,+DAA+D;IAC/D,GAAG,CAAC,UAAU,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC5C;AAMD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,GAAG,SAAS,CAapB;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,YAAY,CAAC,EAAE,MAAM,GACpB,eAAe,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAA;CAAE,CAc9D;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,eAAe,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAA;CAAE,CAuB9D;AAgDD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,SAAQ,EACd,OAAO,GAAE,WAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,cAAc,GAAE,WAAgB,GAC/B,WAAW,CAab;AAED,eAAO,MAAM,cAAc,8BAAwB,CAAC;AAEpD,wBAAgB,WAAW,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,EAAE,aAAa,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,CAMhG;AAmBD,wBAAsB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CASvE;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,CAAC,EACjC,SAAS,EAAE,OAAO,KAAK,EACvB,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,CAAC,CAAC,CAaZ;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAkN5F"}
+{"version":3,"file":"http-core.d.ts","sourceRoot":"","sources":["../src/http-core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,eAAe,EAAyB,MAAM,0BAA0B,CAAC;AAExI,OAAO,EAAyD,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAC/H,OAAO,EAML,KAAK,eAAe,EAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EAA+D,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9G,OAAO,EAOL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACxE,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAI9F,YAAY,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAKD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAClD,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,GAAG,SAAS,CAAC;IACjE;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACtI;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACnG;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,eAAe,GAAG,SAAS,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CACrD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChF,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,uBAAuB,CAAC;IAC/G,+DAA+D;IAC/D,GAAG,CAAC,UAAU,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC5C;AAMD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,GAAG,SAAS,CAapB;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,YAAY,CAAC,EAAE,MAAM,GACpB,eAAe,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAA;CAAE,CAc9D;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,eAAe,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAA;CAAE,CA4B9D;AAwDD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,SAAQ,EACd,OAAO,GAAE,WAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,cAAc,GAAE,WAAgB,GAC/B,WAAW,CAab;AAED,eAAO,MAAM,cAAc,8BAAwB,CAAC;AAEpD,wBAAgB,WAAW,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,EAAE,aAAa,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,CAMhG;AAqBD,wBAAsB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAQvE;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,SAAS,EAAE,OAAO,KAAK,EACvB,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,CAAC,CAAC,CAaZ;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAoP5F"}

package/dist/http-core.js

@@ -1,8 +1,8 @@
 import { ConfigurationError, ContractError, GoodVibesSdkError, HttpStatusError, createHttpStatusError } from '@pellux/goodvibes-errors';
 import { sleepWithSignal } from './backoff.js';
-import { mergeHeaderRecord, normalizeAuthToken, resolveAuthToken, resolveHeaders } from './auth.js';
+import { mergeHeaderRecord, normalizeAuthToken, resolveHeaders } from './auth.js';
 import { applyPerMethodPolicy, getHttpRetryDelay, isRetryableHttpStatus, isRetryableNetworkError, resolveHttpRetryPolicy, } from './retry.js';
-import { buildUrl, createTransportPaths } from './paths.js';
+import { assertSameOriginAbsoluteUrl, buildUrl, createTransportPaths } from './paths.js';
 import { composeMiddleware, createUuidV4, injectTraceparentAsync, invokeTransportObserver, transportErrorFromUnknown, } from '@pellux/goodvibes-transport-core';
 /**
  * Generate a UUID v4 idempotency key.
@@ -57,10 +57,15 @@ export function createNetworkTransportError(error, url, method) {
         ? error.message.trim()
         : `Transport request failed before receiving a response for ${url}`;
     const hint = `Transport could not reach ${url}. Verify the baseUrl is reachable.`;
+    // only mark network/connection errors as recoverable (i.e. fetch-thrown).
+    // TypeError or other programmer errors should not trigger retries.
+    const isNetworkError = error instanceof TypeError
+        || (error instanceof Error && /^(?:EAI_AGAIN|ECONNRESET|ECONNREFUSED|ETIMEDOUT|ENOTFOUND|EPIPE|ECONNABORTED)$/.test(error.code ?? ''))
+        || (error instanceof Error && /^UND_ERR_/.test(error.code ?? ''));
     const networkError = new HttpStatusError(message, {
         category: 'network',
         source: 'transport',
-        recoverable: true,
+        recoverable: isNetworkError,
         url,
         method,
         body: { error: message },
@@ -92,11 +97,11 @@ function addQueryValue(url, key, value) {
         return;
     }
     if (typeof value === 'object') {
-        // Contract query parameters are primitive or repeated primitive values.
-        // Object values are preserved as JSON strings so callers do not silently
-        // lose structured filters when a route explicitly accepts them.
-        url.searchParams.append(key, JSON.stringify(value));
-        return;
+        // object query values cannot be reliably round-tripped through URL
+        // query strings (no daemon route parses JSON-stringified query params).
+        // Throw a ContractError instead of implicitly serialising; callers must
+        // decompose objects into primitive fields before passing as query parameters.
+        throw new ContractError(`Contract query parameter "${key}" is an object, which cannot be safely serialised as a URL query value. Decompose it into primitive fields.`);
     }
     url.searchParams.append(key, String(value));
 }
@@ -106,10 +111,16 @@ function hasHeader(headers, name) {
 }
 function splitContractInput(path, input = {}) {
     const remaining = { ...input };
-    const interpolatedPath = path.replace(/\{([A-Za-z_][A-Za-z0-9_.-]*)\}/g, (_match, key) => {
+    // forbid '.' in path-param names to prevent ambiguous flat-key lookup.
+    // Contract generators must not emit dotted param names like {foo.bar}.
+    const interpolatedPath = path.replace(/\{([A-Za-z_][A-Za-z0-9_-]*)\}/g, (_match, key) => {
         const value = toStringValue(remaining[key], key);
         delete remaining[key];
-        return encodeURIComponent(value);
+        // encodeURIComponent leaves RFC 3986 sub-delimiters (!'()*~) unencoded.
+        // If the server uses regex routing, an unencoded `!`, `(`, `)`, `*`, `~`, or
+        // `'` in a path segment could match against a route pattern unexpectedly.
+        // Encode those characters explicitly after the standard percent-encoding pass.
+        return encodeURIComponent(value).replace(/[!'()*~]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
     });
     if (/[{}]/.test(interpolatedPath)) {
         throw new ContractError(`Malformed contract path "${path}". Path parameters must use "{name}" with identifier-like names.`);
@@ -120,7 +131,7 @@ export function createJsonRequestInit(token, body, method = 'GET', headers = {},
     return {
         method,
         credentials: 'include',
-        signal,
+        ...(signal !== undefined ? { signal } : {}),
         headers: mergeHeaderRecord(defaultHeaders, token ? { Authorization: `Bearer ${token}` } : undefined, body !== undefined ? { 'Content-Type': 'application/json' } : undefined, headers),
         ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
     };
@@ -133,20 +144,21 @@ export function createFetch(fetchImpl, fallbackFetch) {
     }
     return resolved.bind(globalThis);
 }
+const MAX_RETRY_AFTER_MS = 10 * 60 * 1000; // 10 minutes
 function parseRetryAfterMs(headers) {
     const retryAfter = headers.get('retry-after');
     if (!retryAfter)
         return undefined;
-    // Numeric seconds
+    // Numeric seconds — cap to prevent hostile/buggy huge values.
     const seconds = Number(retryAfter);
-    if (!Number.isNaN(seconds) && seconds >= 0) {
-        return Math.ceil(seconds * 1000);
+    if (!Number.isNaN(seconds) && seconds > 0) {
+        return Math.min(Math.ceil(seconds * 1000), MAX_RETRY_AFTER_MS);
     }
     // HTTP-date
     const date = new Date(retryAfter);
     if (!Number.isNaN(date.getTime())) {
         const ms = date.getTime() - Date.now();
-        return ms > 0 ? ms : 0;
+        return ms > 0 ? Math.min(ms, MAX_RETRY_AFTER_MS) : 0;
     }
     return undefined;
 }
@@ -157,17 +169,18 @@ export async function readJsonBody(response) {
     try {
         return JSON.parse(text);
     }
-    catch (error) {
-        void error;
+    catch {
         return text;
     }
 }
 /**
- * @internal Low-level one-shot helper retained for legacy internal callers.
- * Public code should use `createHttpTransport(...).requestJson()` so auth,
- * middleware, retry policy, idempotency keys, and observers are applied.
+ * Low-level one-shot JSON request helper.
+ *
+ * This deliberately bypasses transport auth, middleware, retry policy,
+ * idempotency keys, and observers. Prefer
+ * `createHttpTransport(...).requestJson()` for normal application code.
  */
-export async function requestJson(fetchImpl, url, init = {}) {
+export async function requestJsonRaw(fetchImpl, url, init = {}) {
     let response;
     try {
         response = await fetchImpl(url, init);
@@ -192,11 +205,13 @@ export function createHttpJsonTransport(options) {
     const retryPolicy = options.retry;
     const paths = createTransportPaths(baseUrl);
     const observer = options.observer;
+    const onRetryScheduled = options.onRetryScheduled;
+    const onRetryExecuted = options.onRetryExecuted;
     // Persistent middleware chain — mutated via use().
     const middlewareChain = [...(options.middleware ?? [])];
     const requestJsonForTransport = async (pathOrUrl, requestOptions = {}) => {
         const url = pathOrUrl.startsWith('http://') || pathOrUrl.startsWith('https://')
-            ? pathOrUrl
+            ? assertSameOriginAbsoluteUrl(pathOrUrl, baseUrl)
             : buildUrl(baseUrl, pathOrUrl);
         const method = requestOptions.method ?? (requestOptions.body === undefined ? 'GET' : 'POST');
         const methodId = requestOptions.methodId;
@@ -208,7 +223,17 @@ export function createHttpJsonTransport(options) {
         // Determine idempotency: non-GET mutations without an explicit idempotent flag do NOT retry.
         // This is enforced below by gating the retry check on method type.
         const isMutatingMethod = IDEMPOTENCY_KEY_METHODS.has(method.toUpperCase());
-        const idempotencyKey = isMutatingMethod ? generateIdempotencyKey() : undefined;
+        // pin traceparent once before the retry loop so all retries share one trace span.
+        const pinnedTraceHeaders = {};
+        await injectTraceparentAsync(pinnedTraceHeaders);
+        // only generate an idempotency key when the call is actually idempotent
+        // (contract-marked or has a per-method policy override). Sending keys on all
+        // mutating methods could cause duplicate suppression for a non-retried request
+        // if a proxy retries it outside the SDK's control.
+        const hasPerMethodOverride = methodId !== undefined && resolveHttpRetryPolicy(retryPolicy, requestOptions.retry).perMethodPolicy[methodId] !== undefined;
+        const idempotencyKey = isMutatingMethod && (contractIdempotent || hasPerMethodOverride)
+            ? generateIdempotencyKey()
+            : undefined;
         let attempt = 0;
         while (true) {
             attempt += 1;
@@ -222,15 +247,17 @@ export function createHttpJsonTransport(options) {
             if (requestOptions.body !== undefined) {
                 mergedHeaders['Content-Type'] = 'application/json';
             }
-            // Inject W3C traceparent if OTel is active. This path is async so pure
-            // ESM OpenTelemetry providers can be loaded before the request is sent.
-            await injectTraceparentAsync(mergedHeaders);
+            // merge pre-pinned traceparent headers (captured once before the retry loop)
+            // so all retry attempts share a single logical trace span.
+            for (const [k, v] of Object.entries(pinnedTraceHeaders)) {
+                mergedHeaders[k] = v;
+            }
             // Inject idempotency key for mutating methods.
             if (idempotencyKey && !hasHeader(mergedHeaders, 'Idempotency-Key')) {
                 mergedHeaders['Idempotency-Key'] = idempotencyKey;
             }
             // Notify observer before dispatching the request.
-            invokeTransportObserver(() => observer?.onTransportActivity?.({ direction: 'send', url, kind: 'http' }));
+            invokeTransportObserver(() => observer?.onTransportActivity?.({ direction: 'send', url, kind: 'http' }), observer?.onObserverError);
             const sendAt = Date.now();
             // Build the middleware context for this attempt.
             const ctx = {
@@ -241,12 +268,14 @@ export function createHttpJsonTransport(options) {
                 options: requestOptions,
                 signal: requestOptions.signal,
             };
+            // stash parsed body here so the no-middleware fast path avoids re-parsing.
+            let _parsedBodyCache = undefined;
             // Build the inner fetch that middleware wraps (and also used directly without middleware).
             const innerFetch = async (c) => {
                 const init = {
                     method: c.method,
                     credentials: 'include',
-                    signal: c.signal,
+                    ...(c.signal !== undefined ? { signal: c.signal } : {}),
                     headers: c.headers,
                     ...(c.body !== undefined ? { body: JSON.stringify(c.body) } : {}),
                 };
@@ -262,8 +291,17 @@ export function createHttpJsonTransport(options) {
                     const retryAfterMs = parseRetryAfterMs(response.headers);
                     throw createTransportError(response.status, c.url, c.method, body, retryAfterMs);
                 }
-                // Return synthetic Response carrying parsed body so callers can .json() it.
-                return new Response(JSON.stringify(body), { status: response.status });
+                // stash the already-parsed body so the no-middleware fast path can
+                // read it directly without a JSON.stringify → JSON.parse round-trip.
+                _parsedBodyCache = body;
+                // Also expose on ctx so middleware callers can read parsedBody directly.
+                ctx.parsedBody = body;
+                // Return synthetic Response carrying parsed body so callers (middleware) can .json().
+                return new Response(JSON.stringify(body), {
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: response.headers,
+                });
             };
             try {
                 if (middlewareChain.length > 0) {
@@ -281,25 +319,27 @@ export function createHttpJsonTransport(options) {
                             method,
                         });
                     }
-                    const result = await ctx.response.json();
+                    // use parsedBody stashed by innerFetch to avoid a JSON round-trip.
+                    const result = (ctx.parsedBody !== undefined ? ctx.parsedBody : await ctx.response.json());
                     invokeTransportObserver(() => observer?.onTransportActivity?.({
                         direction: 'recv',
                         url,
                         kind: 'http',
                         durationMs: ctx.durationMs,
-                    }));
+                    }), observer?.onObserverError);
                     return result;
                 }
                 // No-middleware fast path — directly invoke innerFetch with ctx.
-                const rawResponse = await innerFetch(ctx);
-                const result = await rawResponse.json();
+                await innerFetch(ctx);
+                // use the cached parsed body (set by innerFetch) to avoid JSON round-trip.
+                const result = _parsedBodyCache;
                 // Notify observer after a successful response.
                 invokeTransportObserver(() => observer?.onTransportActivity?.({
                     direction: 'recv',
                     url,
                     kind: 'http',
                     durationMs: Date.now() - sendAt,
-                }));
+                }), observer?.onObserverError);
                 return result;
             }
             catch (error) {
@@ -323,7 +363,7 @@ export function createHttpJsonTransport(options) {
                     return error;
                 })();
                 // Notify observer of the transport error before deciding to retry or rethrow.
-                invokeTransportObserver(() => observer?.onError?.(transportErrorFromUnknown(wrappedError, 'HTTP transport error')));
+                invokeTransportObserver(() => observer?.onError?.(transportErrorFromUnknown(wrappedError, 'HTTP transport error')), observer?.onObserverError);
                 const status = typeof wrappedError === 'object' && wrappedError !== null && 'transport' in wrappedError
                     ? wrappedError.transport?.status
                     : undefined;
@@ -337,7 +377,13 @@ export function createHttpJsonTransport(options) {
                 if (!shouldRetry) {
                     throw wrappedError;
                 }
-                await sleepWithSignal(getHttpRetryDelay(attempt + 1, resolvedRetry), requestOptions.signal);
+                const backoffMs = getHttpRetryDelay(attempt, resolvedRetry);
+                const retryReason = typeof status === 'number' && status > 0 ? `http-${status}` : 'network-error';
+                // Notify callers before the retry sleep starts.
+                onRetryScheduled?.({ attempt, maxAttempts: resolvedRetry.maxAttempts, backoffMs, reason: retryReason });
+                await sleepWithSignal(backoffMs, requestOptions.signal);
+                // Notify callers after the retry sleep completes.
+                onRetryExecuted?.({ attempt, maxAttempts: resolvedRetry.maxAttempts });
             }
         }
     };

package/dist/http.d.ts

@@ -2,11 +2,11 @@ import { type AuthTokenResolver, type HeaderResolver, type MaybePromise, mergeHe
 import { type BackoffPolicy, type ResolvedBackoffPolicy, computeBackoffDelay, normalizeBackoffPolicy, sleepWithSignal } from './backoff.js';
 import { type HttpRetryPolicy, type ResolvedHttpRetryPolicy, DEFAULT_HTTP_RETRY_POLICY, getHttpRetryDelay, isRetryableHttpStatus, isRetryableNetworkError, normalizeHttpRetryPolicy, resolveHttpRetryPolicy } from './retry.js';
 import { type ResolvedStreamReconnectPolicy, type StreamReconnectPolicy, DEFAULT_STREAM_RECONNECT_POLICY, getStreamReconnectDelay, normalizeStreamReconnectPolicy } from './reconnect.js';
-import { createFetch, createJsonInit, createJsonRequestInit, generateIdempotencyKey, readJsonBody, requestJson, type HttpJsonRequestOptions, type HttpJsonTransport, type HttpJsonTransportOptions, type JsonObject, type JsonValue, type ResolvedContractRequest, type TransportContext, type TransportMiddleware, type TransportJsonError } from './http-core.js';
+import { createFetch, createJsonInit, createJsonRequestInit, generateIdempotencyKey, readJsonBody, requestJsonRaw, type HttpJsonRequestOptions, type HttpJsonTransport, type HttpJsonTransportOptions, type JsonObject, type JsonValue, type ResolvedContractRequest, type TransportContext, type TransportMiddleware, type TransportJsonError } from './http-core.js';
 export type { AuthTokenResolver, BackoffPolicy, HeaderResolver, HttpJsonRequestOptions, HttpRetryPolicy, JsonObject, JsonValue, MaybePromise, ResolvedBackoffPolicy, ResolvedContractRequest, ResolvedHttpRetryPolicy, ResolvedStreamReconnectPolicy, StreamReconnectPolicy, TransportContext, TransportJsonError, TransportMiddleware, };
 export type HttpTransportOptions = HttpJsonTransportOptions;
 export type HttpTransport = HttpJsonTransport;
-export { createFetch, createJsonInit, createJsonRequestInit, generateIdempotencyKey, readJsonBody, requestJson, mergeHeaders, resolveAuthToken, resolveHeaders, computeBackoffDelay, normalizeBackoffPolicy, sleepWithSignal, DEFAULT_HTTP_RETRY_POLICY, getHttpRetryDelay, isRetryableHttpStatus, isRetryableNetworkError, normalizeHttpRetryPolicy, resolveHttpRetryPolicy, DEFAULT_STREAM_RECONNECT_POLICY, getStreamReconnectDelay, normalizeStreamReconnectPolicy, };
+export { createFetch, createJsonInit, createJsonRequestInit, generateIdempotencyKey, readJsonBody, requestJsonRaw, mergeHeaders, resolveAuthToken, resolveHeaders, computeBackoffDelay, normalizeBackoffPolicy, sleepWithSignal, DEFAULT_HTTP_RETRY_POLICY, getHttpRetryDelay, isRetryableHttpStatus, isRetryableNetworkError, normalizeHttpRetryPolicy, resolveHttpRetryPolicy, DEFAULT_STREAM_RECONNECT_POLICY, getStreamReconnectDelay, normalizeStreamReconnectPolicy, };
 export declare function normalizeTransportError(error: unknown): Error;
 export declare function createHttpTransport(options: HttpTransportOptions): HttpTransport;
 //# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,+BAA+B,EAC/B,uBAAuB,EACvB,8BAA8B,EAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,WAAW,EAEX,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EAEtB,YAAY,EACZ,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,UAAU,EACV,SAAS,EACT,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACpB,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAC9C,OAAO,EACL,WAAW,EACX,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,8BAA8B,GAC/B,CAAC;AAwBF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CA8D7D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAmBhF"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,+BAA+B,EAC/B,uBAAuB,EACvB,8BAA8B,EAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,WAAW,EAEX,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EAEtB,YAAY,EACZ,cAAc,EACd,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,UAAU,EACV,SAAS,EACT,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACpB,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAC9C,OAAO,EACL,WAAW,EACX,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,8BAA8B,GAC/B,CAAC;AAwBF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CA8D7D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAmBhF"}

package/dist/http.js

@@ -3,8 +3,8 @@ import { mergeHeaders, resolveAuthToken, resolveHeaders, } from './auth.js';
 import { computeBackoffDelay, normalizeBackoffPolicy, sleepWithSignal, } from './backoff.js';
 import { DEFAULT_HTTP_RETRY_POLICY, getHttpRetryDelay, isRetryableHttpStatus, isRetryableNetworkError, normalizeHttpRetryPolicy, resolveHttpRetryPolicy, } from './retry.js';
 import { DEFAULT_STREAM_RECONNECT_POLICY, getStreamReconnectDelay, normalizeStreamReconnectPolicy, } from './reconnect.js';
-import { createFetch, createHttpJsonTransport, createJsonInit, createJsonRequestInit, generateIdempotencyKey, inferTransportHint, readJsonBody, requestJson, } from './http-core.js';
-export { createFetch, createJsonInit, createJsonRequestInit, generateIdempotencyKey, readJsonBody, requestJson, mergeHeaders, resolveAuthToken, resolveHeaders, computeBackoffDelay, normalizeBackoffPolicy, sleepWithSignal, DEFAULT_HTTP_RETRY_POLICY, getHttpRetryDelay, isRetryableHttpStatus, isRetryableNetworkError, normalizeHttpRetryPolicy, resolveHttpRetryPolicy, DEFAULT_STREAM_RECONNECT_POLICY, getStreamReconnectDelay, normalizeStreamReconnectPolicy, };
+import { createFetch, createHttpJsonTransport, createJsonInit, createJsonRequestInit, generateIdempotencyKey, inferTransportHint, readJsonBody, requestJsonRaw, } from './http-core.js';
+export { createFetch, createJsonInit, createJsonRequestInit, generateIdempotencyKey, readJsonBody, requestJsonRaw, mergeHeaders, resolveAuthToken, resolveHeaders, computeBackoffDelay, normalizeBackoffPolicy, sleepWithSignal, DEFAULT_HTTP_RETRY_POLICY, getHttpRetryDelay, isRetryableHttpStatus, isRetryableNetworkError, normalizeHttpRetryPolicy, resolveHttpRetryPolicy, DEFAULT_STREAM_RECONNECT_POLICY, getStreamReconnectDelay, normalizeStreamReconnectPolicy, };
 function isTransportError(error) {
     return Boolean(error
         && typeof error === 'object'
@@ -51,7 +51,7 @@ export function normalizeTransportError(error) {
         });
     }
     if (error instanceof Error) {
-        // Defensive string-match fallback for non-SDK errors that slip through.
+        // Defensive string-match path for non-SDK errors that slip through.
         // With structured throws in http-core.ts, these paths are rarely exercised.
         if (error.message === 'Fetch implementation is required' || error.message === 'Transport baseUrl is required') {
             return new ConfigurationError(error.message);

package/dist/index.d.ts

@@ -1,10 +1,10 @@
 export type { ContractInvokeOptions, ContractRouteDefinition, ContractRouteLike, ContractStreamOptions, } from './contract-client.js';
-export { buildContractInput, invokeContractRoute, openContractRouteStream, requireContractRoute, } from './contract-client.js';
+export { invokeContractRoute, openContractRouteStream, requireContractRoute, } from './contract-client.js';
 export type { JsonSchemaValidationFailure, MethodArgs, RequiredKeys, WithoutKeys } from './client-plumbing.js';
 export { clientInputRecord, firstJsonSchemaFailure, mergeClientInput, splitClientArgs } from './client-plumbing.js';
 export type { HttpJsonRequestOptions, HttpTransport, HttpTransportOptions, JsonObject, JsonValue, ResolvedContractRequest, TransportJsonError, } from './http.js';
-export { createFetch, createHttpTransport, createJsonInit, createJsonRequestInit, normalizeTransportError, readJsonBody, requestJson, } from './http.js';
-export type { TransportContext, TransportMiddleware } from './http-core.js';
+export { createFetch, createHttpTransport, createJsonInit, createJsonRequestInit, normalizeTransportError, readJsonBody, requestJsonRaw, } from './http.js';
+export type { HttpJsonTransport, HttpJsonTransportOptions, TransportContext, TransportMiddleware } from './http-core.js';
 export { generateIdempotencyKey } from './http-core.js';
 export type { ServerSentEventHandlers, ServerSentEventOptions } from './sse.js';
 export { openServerSentEventStream } from './sse.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC/G,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACpH,YAAY,EACV,sBAAsB,EACtB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,SAAS,EACT,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EAAE,uBAAuB,IAAI,0BAA0B,EAAE,sBAAsB,IAAI,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAClJ,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAClH,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC5F,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAClM,YAAY,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,+BAA+B,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAC1H,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC/G,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACpH,YAAY,EACV,sBAAsB,EACtB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,SAAS,EACT,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACzH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EAAE,uBAAuB,IAAI,0BAA0B,EAAE,sBAAsB,IAAI,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAClJ,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAClH,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC5F,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAClM,YAAY,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,+BAA+B,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAC1H,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
-export { buildContractInput, invokeContractRoute, openContractRouteStream, requireContractRoute, } from './contract-client.js';
+export { invokeContractRoute, openContractRouteStream, requireContractRoute, } from './contract-client.js';
 export { clientInputRecord, firstJsonSchemaFailure, mergeClientInput, splitClientArgs } from './client-plumbing.js';
-export { createFetch, createHttpTransport, createJsonInit, createJsonRequestInit, normalizeTransportError, readJsonBody, requestJson, } from './http.js';
+export { createFetch, createHttpTransport, createJsonInit, createJsonRequestInit, normalizeTransportError, readJsonBody, requestJsonRaw, } from './http.js';
 export { generateIdempotencyKey } from './http-core.js';
 export { openServerSentEventStream } from './sse.js';
 export { openRawServerSentEventStream } from './sse-stream.js';

package/dist/paths.d.ts

@@ -25,8 +25,22 @@ export interface TransportPaths {
     readonly peerRequestsUrl: string;
     readonly peerListUrl: string;
     readonly remoteWorkUrl: string;
+    /**
+     * Alias for `controlPlaneUrl`. Provided for convenience.
+     */
+    readonly controlUrl: string;
 }
 export declare function normalizeBaseUrl(baseUrl: string): string;
 export declare function buildUrl(baseUrl: string, path: string): string;
+/**
+ * Assert that an absolute URL has the same origin as a reference URL (or baseUrl).
+ *
+ * Used by transport call sites that allow absolute URLs as a convenience but
+ * MUST NOT leak the bearer Authorization header to a different origin. Throws
+ * `ConfigurationError SDK_TRANSPORT_CROSS_ORIGIN` when origins diverge.
+ *
+ * Returns the validated absolute URL unchanged on success.
+ */
+export declare function assertSameOriginAbsoluteUrl(absoluteUrl: string, originReferenceUrl: string): string;
 export declare function createTransportPaths(baseUrl: string): TransportPaths;
 //# sourceMappingURL=paths.d.ts.map

package/dist/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMxD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CA8BpE"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoCxD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAU9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,MAAM,CA6BnG;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CA+BpE"}

package/dist/paths.js

@@ -4,11 +4,91 @@ export function normalizeBaseUrl(baseUrl) {
     if (!normalized) {
         throw new ConfigurationError('Transport baseUrl is required. Pass a non-empty baseUrl string to your transport or SDK options.', { code: 'SDK_TRANSPORT_BASE_URL_REQUIRED' });
     }
+    let parsed;
+    try {
+        parsed = new URL(normalized);
+    }
+    catch (cause) {
+        throw new ConfigurationError('Transport baseUrl must be an absolute URL.', {
+            code: 'SDK_TRANSPORT_BASE_URL_INVALID',
+            source: 'transport',
+            hint: 'Pass a full URL such as https://goodvibes.example.com.',
+            cause,
+        });
+    }
+    const protocol = parsed.protocol;
+    if (protocol !== 'https:' && protocol !== 'wss:' && protocol !== 'http:' && protocol !== 'ws:') {
+        throw new ConfigurationError(`Unsupported transport baseUrl protocol: ${protocol}`, {
+            code: 'SDK_TRANSPORT_BASE_URL_PROTOCOL_UNSUPPORTED',
+            source: 'transport',
+            hint: 'Use https:// or wss://. http:// and ws:// are accepted only for local development or explicit insecure deployments.',
+        });
+    }
+    const host = parsed.hostname.toLowerCase();
+    const local = host === 'localhost' || host === '::1' || host === '127.0.0.1' || host.startsWith('127.');
+    const runtimeProcess = globalThis.process;
+    const allowInsecure = runtimeProcess?.env?.GOODVIBES_ALLOW_INSECURE_TRANSPORT === 'true';
+    if ((protocol === 'http:' || protocol === 'ws:') && !local && !allowInsecure) {
+        throw new ConfigurationError('Refusing insecure non-local GoodVibes transport baseUrl.', {
+            code: 'SDK_TRANSPORT_INSECURE_BASE_URL',
+            source: 'transport',
+            hint: 'Use https:// or wss://, or set GOODVIBES_ALLOW_INSECURE_TRANSPORT=true for an intentional non-local development deployment.',
+        });
+    }
     return normalized.replace(/\/+$/, '');
 }
 export function buildUrl(baseUrl, path) {
     const normalized = normalizeBaseUrl(baseUrl);
-    return new URL(path, `${normalized}/`).toString();
+    if (/^[a-z][a-z0-9+\-.]*:/i.test(path)) {
+        throw new ConfigurationError(`Absolute path not allowed: ${path}`, { code: 'SDK_TRANSPORT_PATH_ABSOLUTE' });
+    }
+    try {
+        return new URL(path, `${normalized}/`).toString();
+    }
+    catch (cause) {
+        throw new ConfigurationError(`Invalid transport path: ${path}`, { code: 'SDK_TRANSPORT_PATH_INVALID', cause });
+    }
+}
+/**
+ * Assert that an absolute URL has the same origin as a reference URL (or baseUrl).
+ *
+ * Used by transport call sites that allow absolute URLs as a convenience but
+ * MUST NOT leak the bearer Authorization header to a different origin. Throws
+ * `ConfigurationError SDK_TRANSPORT_CROSS_ORIGIN` when origins diverge.
+ *
+ * Returns the validated absolute URL unchanged on success.
+ */
+export function assertSameOriginAbsoluteUrl(absoluteUrl, originReferenceUrl) {
+    let parsed;
+    try {
+        parsed = new URL(absoluteUrl);
+    }
+    catch (cause) {
+        throw new ConfigurationError(`Invalid absolute transport URL: ${absoluteUrl}`, {
+            code: 'SDK_TRANSPORT_URL_INVALID',
+            source: 'transport',
+            cause,
+        });
+    }
+    let referenceOrigin;
+    try {
+        referenceOrigin = new URL(originReferenceUrl).origin;
+    }
+    catch (cause) {
+        throw new ConfigurationError(`Invalid transport origin reference URL: ${originReferenceUrl}`, {
+            code: 'SDK_TRANSPORT_URL_INVALID',
+            source: 'transport',
+            cause,
+        });
+    }
+    if (parsed.origin !== referenceOrigin) {
+        throw new ConfigurationError(`Cross-origin transport request rejected: ${parsed.origin} does not match transport baseUrl origin ${referenceOrigin}`, {
+            code: 'SDK_TRANSPORT_CROSS_ORIGIN',
+            source: 'transport',
+            hint: 'The transport bearer token would be sent to a different origin. Use a same-origin URL or open a separate transport for the cross-origin endpoint.',
+        });
+    }
+    return absoluteUrl;
 }
 export function createTransportPaths(baseUrl) {
     const normalized = normalizeBaseUrl(baseUrl);
@@ -39,5 +119,6 @@ export function createTransportPaths(baseUrl) {
         peerRequestsUrl: buildUrl(normalized, '/api/remote/pair/requests'),
         peerListUrl: buildUrl(normalized, '/api/remote/peers'),
         remoteWorkUrl: buildUrl(normalized, '/api/remote/work'),
+        controlUrl: buildUrl(normalized, '/api/control-plane'),
     };
 }

package/dist/reconnect.d.ts

@@ -1,6 +1,6 @@
 import { type BackoffPolicy, type ResolvedBackoffPolicy } from './backoff.js';
 export interface StreamReconnectPolicy extends BackoffPolicy {
-    readonly enabled?: boolean;
+    readonly enabled?: boolean | undefined;
 }
 export interface ResolvedStreamReconnectPolicy extends ResolvedBackoffPolicy {
     readonly enabled: boolean;

package/dist/reconnect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconnect.d.ts","sourceRoot":"","sources":["../src/reconnect.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE3H,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,gGAAgG;AAChG,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,eAAO,MAAM,+BAA+B,EAAE,6BAM7C,CAAC;AAEF,wBAAgB,8BAA8B,CAC5C,MAAM,CAAC,EAAE,qBAAqB,GAC7B,6BAA6B,CAM/B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,6BAA6B,GACpC,MAAM,CAER"}
+{"version":3,"file":"reconnect.d.ts","sourceRoot":"","sources":["../src/reconnect.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE3H,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,gGAAgG;AAChG,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,eAAO,MAAM,+BAA+B,EAAE,6BAM7C,CAAC;AAEF,wBAAgB,8BAA8B,CAC5C,MAAM,CAAC,EAAE,qBAAqB,GAC7B,6BAA6B,CAM/B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,6BAA6B,GACpC,MAAM,CAER"}

package/dist/retry.d.ts

@@ -1,16 +1,16 @@
 import { type BackoffPolicy, type ResolvedBackoffPolicy } from './backoff.js';
 export interface PerMethodRetryPolicy {
-    readonly maxAttempts?: number;
-    readonly baseDelayMs?: number;
-    readonly maxDelayMs?: number;
-    readonly backoffFactor?: number;
+    readonly maxAttempts?: number | undefined;
+    readonly baseDelayMs?: number | undefined;
+    readonly maxDelayMs?: number | undefined;
+    readonly backoffFactor?: number | undefined;
 }
 export interface HttpRetryPolicy extends BackoffPolicy {
-    readonly retryOnStatuses?: readonly number[];
-    readonly retryOnMethods?: readonly string[];
-    readonly retryOnNetworkError?: boolean;
+    readonly retryOnStatuses?: readonly number[] | undefined;
+    readonly retryOnMethods?: readonly string[] | undefined;
+    readonly retryOnNetworkError?: boolean | undefined;
     /** Per-method retry policy overrides keyed by method ID. */
-    readonly perMethodPolicy?: Readonly<Record<string, PerMethodRetryPolicy>>;
+    readonly perMethodPolicy?: Readonly<Record<string, PerMethodRetryPolicy>> | undefined;
 }
 export interface ResolvedHttpRetryPolicy extends ResolvedBackoffPolicy {
     readonly retryOnStatuses: readonly number[];

package/dist/retry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AACA,OAAO,EAA+C,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE3H,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;CAC1E;AAED,eAAO,MAAM,yBAAyB,EAAE,uBASvC,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,MAAM,CAAC,EAAE,eAAe,GACvB,uBAAuB,CASzB;AAED,wBAAgB,sBAAsB,CACpC,aAAa,CAAC,EAAE,eAAe,EAC/B,QAAQ,CAAC,EAAE,KAAK,GAAG,eAAe,GACjC,uBAAuB,CAczB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,uBAAuB,EAC7B,QAAQ,EAAE,MAAM,GACf,uBAAuB,CAUzB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,uBAAuB,GAC9B,MAAM,CAER;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAGT;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAET"}
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AACA,OAAO,EAA+C,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE3H,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACnD,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;CACvF;AAED,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;CAC1E;AAED,eAAO,MAAM,yBAAyB,EAAE,uBASvC,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,MAAM,CAAC,EAAE,eAAe,GACvB,uBAAuB,CASzB;AAED,wBAAgB,sBAAsB,CACpC,aAAa,CAAC,EAAE,eAAe,EAC/B,QAAQ,CAAC,EAAE,KAAK,GAAG,eAAe,GACjC,uBAAuB,CAczB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,uBAAuB,EAC7B,QAAQ,EAAE,MAAM,GACf,uBAAuB,CAUzB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,uBAAuB,GAC9B,MAAM,CAER;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAGT;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAET"}

package/dist/sse-stream.d.ts

@@ -2,26 +2,26 @@ import { type AuthTokenResolver } from './auth.js';
 import { type StreamReconnectPolicy } from './reconnect.js';
 import { isAbortError } from '@pellux/goodvibes-transport-core';
 export interface ServerSentEventHandlers {
-    readonly onEvent?: (eventName: string, payload: unknown) => void;
-    readonly onReady?: (payload: unknown) => void;
-    readonly onError?: (error: unknown) => void;
+    readonly onEvent?: ((eventName: string, payload: unknown) => void) | undefined;
+    readonly onReady?: ((payload: unknown) => void) | undefined;
+    readonly onError?: ((error: unknown) => void) | undefined;
     readonly onReconnect?: (input: {
         readonly attempt: number;
         readonly delayMs: number;
     }) => void;
-    readonly onClose?: () => void;
+    readonly onClose?: (() => void) | undefined;
     readonly onTerminate?: (input: {
         readonly error: unknown;
         readonly reconnectAttempts: number;
     }) => void;
 }
 export interface ServerSentEventOptions {
-    readonly signal?: AbortSignal;
-    readonly headers?: HeadersInit;
-    readonly authToken?: string | null;
-    readonly getAuthToken?: AuthTokenResolver;
-    readonly lastEventId?: string | null;
-    readonly reconnect?: StreamReconnectPolicy;
+    readonly signal?: AbortSignal | undefined;
+    readonly headers?: HeadersInit | undefined;
+    readonly authToken?: string | null | undefined;
+    readonly getAuthToken?: AuthTokenResolver | undefined;
+    readonly lastEventId?: string | null | undefined;
+    readonly reconnect?: StreamReconnectPolicy | undefined;
 }
 export { isAbortError };
 export { openRawServerSentEventStream as openServerSentEventStream };

package/dist/sse-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse-stream.d.ts","sourceRoot":"","sources":["../src/sse-stream.ts"],"names":[],"mappings":"AACA,OAAO,EAAkC,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAGhE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACzG;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC;CAC5C;AAYD,OAAO,EAAE,YAAY,EAAE,CAAC;AAwCxB,OAAO,EAAE,4BAA4B,IAAI,yBAAyB,EAAE,CAAC;AAMrE,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,OAAO,KAAK,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,uBAAuB,EACjC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,MAAM,IAAI,CAAC,CAyLrB"}
+{"version":3,"file":"sse-stream.d.ts","sourceRoot":"","sources":["../src/sse-stream.ts"],"names":[],"mappings":"AACA,OAAO,EAAkC,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAGhE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACzG;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACxD;AAWD,OAAO,EAAE,YAAY,EAAE,CAAC;AAwCxB,OAAO,EAAE,4BAA4B,IAAI,yBAAyB,EAAE,CAAC;AAMrE,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,OAAO,KAAK,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,uBAAuB,EACjC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,MAAM,IAAI,CAAC,CA6LrB"}

package/dist/sse-stream.js

@@ -4,13 +4,12 @@ import { getStreamReconnectDelay, normalizeStreamReconnectPolicy, } from './reco
 import { createHttpStatusError, HttpStatusError } from '@pellux/goodvibes-errors';
 import { isAbortError } from '@pellux/goodvibes-transport-core';
 function readEventPayload(data) {
-    if (!data.trim())
+    if (!data.trimEnd())
         return null;
     try {
         return JSON.parse(data);
     }
-    catch (error) {
-        void error;
+    catch {
         return data;
     }
 }
@@ -137,18 +136,18 @@ export async function openRawServerSentEventStream(fetchImpl, url, handlers, opt
                 if (line.startsWith(':'))
                     return;
                 if (line.startsWith('id:')) {
-                    const candidate = line.slice(3).trim();
+                    const candidate = line.slice(3).replace(/^ /, '');
                     if (candidate) {
                         lastEventId = candidate;
                     }
                     return;
                 }
                 if (line.startsWith('event:')) {
-                    eventName = line.slice(6).trim();
+                    eventName = line.slice(6).replace(/^ /, '');
                     return;
                 }
                 if (line.startsWith('data:')) {
-                    data += `${data ? '\n' : ''}${line.slice(5).trim()}`;
+                    data += `${data ? '\n' : ''}${line.slice(5).replace(/^ /, '')}`;
                 }
             };
             try {
@@ -169,6 +168,10 @@ export async function openRawServerSentEventStream(fetchImpl, url, handlers, opt
                     consumeLine(buffer.replace(/\r$/, ''));
                     flush();
                 }
+                // Abort and remote-close can land in the same microtask. Yield once so
+                // the abort listener can mark the stream stopped before reconnect logic
+                // treats the close as unexpected.
+                await Promise.resolve();
                 if (reconnectPolicy.enabled && !controller.signal.aborted && !outerController.signal.aborted && !stopped) {
                     throw createStreamError(response.status, url, 'Stream closed unexpectedly');
                 }

package/dist/sse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,IAAI,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AACxJ,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,YAAY,EAAE,uBAAuB,EAAE,CAAC;AACxC,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,0BAA0B,EAAE,WAAW,CAAC;CAAG;AAEhG,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,uBAAuB,EACjC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,MAAM,IAAI,CAAC,CASrB"}
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,IAAI,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AACxJ,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,YAAY,EAAE,uBAAuB,EAAE,CAAC;AACxC,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,0BAA0B,EAAE,WAAW,CAAC;CAAG;AAEhG,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,uBAAuB,EACjC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,MAAM,IAAI,CAAC,CASrB"}

package/dist/sse.js

@@ -1,7 +1,8 @@
+import { assertSameOriginAbsoluteUrl } from './paths.js';
 import { openRawServerSentEventStream } from './sse-stream.js';
 export async function openServerSentEventStream(transport, pathOrUrl, handlers, options = {}) {
     const url = pathOrUrl.startsWith('http://') || pathOrUrl.startsWith('https://')
-        ? pathOrUrl
+        ? assertSameOriginAbsoluteUrl(pathOrUrl, transport.buildUrl('/'))
         : transport.buildUrl(pathOrUrl);
     return await openRawServerSentEventStream(transport.fetchImpl, url, handlers, {
         ...options,

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@pellux/goodvibes-transport-http",
-  "version": "0.30.3",
+  "version": "0.33.0",
   "engines": {
-    "node": ">=20.0.0"
+    "bun": "1.3.10",
+    "node": ">=22.0.0"
   },
   "description": "HTTP, JSON, path, and SSE transport primitives for GoodVibes client integrations.",
   "type": "module",
@@ -80,8 +81,9 @@
     "transport"
   ],
   "dependencies": {
-    "@pellux/goodvibes-errors": "0.30.3",
-    "@pellux/goodvibes-transport-core": "0.30.3",
+    "@pellux/goodvibes-contracts": "0.33.0",
+    "@pellux/goodvibes-errors": "0.33.0",
+    "@pellux/goodvibes-transport-core": "0.33.0",
     "zod": "^4.3.6"
   },
   "publishConfig": {