@playfast/reform-remote-web 1.1.0 → 1.2.1

package/dist/errors.d.ts

@@ -0,0 +1,11 @@
+import { type Cause } from 'effect';
+type TaggedErrorClass<Tag extends string, A extends Record<string, unknown>> = new (args: A) => Cause.YieldableError & {
+    readonly _tag: Tag;
+} & Readonly<A>;
+declare const MissingWebSocketBase: TaggedErrorClass<'@playfast/reform-remote-web/MissingWebSocket', {
+    readonly message: string;
+}>;
+export declare class MissingWebSocket extends MissingWebSocketBase {
+}
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAQ,MAAM,QAAQ,CAAA;AAGzC,KAAK,gBAAgB,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAC7E,IAAI,EAAE,CAAC,KACJ,KAAK,CAAC,cAAc,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAA;CAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;AAEhE,QAAA,MAAM,oBAAoB,EAAE,gBAAgB,CAC1C,8CAA8C,EAC9C;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAG5B,CAAA;AAEF,qBAAa,gBAAiB,SAAQ,oBAAoB;CAAG"}

package/dist/errors.js

@@ -0,0 +1,5 @@
+import { Data } from 'effect';
+const MissingWebSocketBase = (Data.TaggedError('@playfast/reform-remote-web/MissingWebSocket'));
+export class MissingWebSocket extends MissingWebSocketBase {
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,IAAI,EAAE,MAAM,QAAQ,CAAA;AAOzC,MAAM,oBAAoB,GAGtB,CAAA,IAAI,CAAC,WAAW,CAAC,8CAA8C,CAEjE,CAAA,CAAA;AAEF,MAAM,OAAO,gBAAiB,SAAQ,oBAAoB;CAAG"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * as Transport from './transport.js';
+export * as Errors from './errors.js';
+export { type ClientStatus, createWebSocketClientTransport, type WebSocketClientTransport, type WebSocketClientTransportOptions, } from './transport.js';
+export { MissingWebSocket } from './errors.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAErC,OAAO,EACL,KAAK,YAAY,EACjB,8BAA8B,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,GACrC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export * as Transport from './transport.js';
+export * as Errors from './errors.js';
+export { createWebSocketClientTransport, } from './transport.js';
+export { MissingWebSocket } from './errors.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAErC,OAAO,EAEL,8BAA8B,GAG/B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}

package/dist/transport.d.ts

@@ -0,0 +1,20 @@
+import { Redacted } from 'effect';
+import type { InvokeMessage, RemoteTransport, ServerMessage } from '@playfast/reform-remote';
+export type ClientStatus = 'connecting' | 'open' | 'reconnecting' | 'closed';
+export interface WebSocketClientTransportOptionsExternalApi {
+    readonly url: string;
+    readonly baseDelayMs?: number;
+    readonly maxDelayMs?: number;
+    readonly protocols?: string | ReadonlyArray<string>;
+    readonly authToken?: Redacted.Redacted<string>;
+    readonly WebSocket?: typeof WebSocket;
+    readonly onStatus?: (status: ClientStatus) => void;
+}
+export type WebSocketClientTransportOptions = WebSocketClientTransportOptionsExternalApi;
+export type WebSocketClientTransport = RemoteTransport<InvokeMessage, ServerMessage> & {
+    readonly status: () => ClientStatus;
+    readonly onStatusChange: (listener: () => void) => () => void;
+    readonly close: () => void;
+};
+export declare const createWebSocketClientTransport: (options: WebSocketClientTransportOptions) => WebSocketClientTransport;
+//# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,QAAQ,EAAU,MAAM,QAAQ,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAG5F,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,CAAA;AA0D5E,MAAM,WAAW,0CAA0C;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IAEnD,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS,CAAA;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAA;CACnD;AAED,MAAM,MAAM,+BAA+B,GAAG,0CAA0C,CAAA;AAExF,MAAM,MAAM,wBAAwB,GAAG,eAAe,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,YAAY,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAA;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAA;CAC3B,CAAA;AAmBD,eAAO,MAAM,8BAA8B,GACzC,SAAS,+BAA+B,KACvC,wBA4IF,CAAA"}

package/dist/transport.js

@@ -0,0 +1,166 @@
+import { Effect, Fiber, Option, Redacted, Schema } from 'effect';
+import { MissingWebSocket } from './errors.js';
+const DEFAULT_BASE_DELAY_MS = 250;
+const DEFAULT_MAX_DELAY_MS = 5000;
+const WirePropSchema = Schema.Union(Schema.Struct({
+    _tag: Schema.Literal('Data'),
+    name: Schema.String,
+    value: Schema.Unknown,
+}), Schema.Struct({
+    _tag: Schema.Literal('Event'),
+    name: Schema.String,
+    handle: Schema.String,
+}));
+const WireNodeSchema = Schema.Struct({
+    id: Schema.String,
+    name: Schema.String,
+    parentId: Schema.NullOr(Schema.String),
+    childIndex: Schema.Number,
+    slot: Schema.NullOr(Schema.String),
+    key: Schema.NullOr(Schema.String),
+    props: Schema.Array(WirePropSchema),
+});
+const WirePatchSchema = Schema.Union(Schema.Struct({ _tag: Schema.Literal('Upsert'), node: WireNodeSchema }), Schema.Struct({ _tag: Schema.Literal('Delete'), id: Schema.String }));
+const InvokeMessageJson = Schema.parseJson(Schema.Struct({
+    _tag: Schema.Literal('Invoke'),
+    handle: Schema.String,
+    payload: Schema.Unknown,
+}));
+const ServerMessageJson = Schema.parseJson(Schema.Union(Schema.Struct({
+    _tag: Schema.Literal('Snapshot'),
+    tree: Schema.Array(WireNodeSchema),
+}), Schema.Struct({
+    _tag: Schema.Literal('Patches'),
+    patches: Schema.Array(WirePatchSchema),
+})));
+const encodeInvokeMessage = Schema.encodeSync(InvokeMessageJson);
+// A frame off the network is untrusted: version skew against a newer server, a
+// truncated write or a hostile endpoint must cost that frame and nothing else. A
+// throw here would escape the socket's own event dispatch — an uncaught exception
+// under `ws`, a lost frame plus a global error in a browser — and the socket never
+// closes, so the reconnect ladder is never armed. Same answer the servers give.
+const decodeServerMessage = Schema.decodeUnknownOption(ServerMessageJson);
+const resolveWebSocket = (injected) => {
+    const globalScope = globalThis;
+    const impl = injected ?? globalScope.WebSocket;
+    return Option.getOrThrowWith(Option.fromNullable(impl), () => new MissingWebSocket({
+        message: 'No global WebSocket; pass `WebSocket` in options (e.g. the `ws` package in Node <22).',
+    }));
+};
+export const createWebSocketClientTransport = (options) => {
+    const url = options.url;
+    const WebSocketImpl = resolveWebSocket(options.WebSocket);
+    const baseDelayMs = options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+    const maxDelayMs = options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+    const baseProtocols = options.protocols === undefined
+        ? []
+        : typeof options.protocols === 'string'
+            ? [options.protocols]
+            : options.protocols;
+    const protocols = options.authToken !== undefined
+        ? [`bearer.${Redacted.value(options.authToken)}`, ...baseProtocols]
+        : baseProtocols.length === 0
+            ? undefined
+            : baseProtocols;
+    const handlers = new Set();
+    const statusListeners = new Set();
+    const state = {
+        socket: Option.none(),
+        status: 'connecting',
+        attempts: 0,
+        timer: Option.none(),
+        queue: [],
+        inbox: [],
+    };
+    const setStatus = (status) => {
+        if (status === state.status) {
+            return;
+        }
+        state.status = status;
+        options.onStatus?.(status);
+        statusListeners.forEach((listener) => listener());
+    };
+    const flush = () => {
+        if (!Option.isSome(state.socket)) {
+            return;
+        }
+        const socket = state.socket.value;
+        if (socket.readyState !== WebSocketImpl.OPEN) {
+            return;
+        }
+        const pending = state.queue;
+        state.queue = [];
+        pending.forEach((message) => socket.send(encodeInvokeMessage(message)));
+    };
+    const scheduleReconnect = () => {
+        if (state.status === 'closed') {
+            return;
+        }
+        setStatus('reconnecting');
+        const delay = Math.min(maxDelayMs, baseDelayMs * 2 ** state.attempts);
+        state.attempts += 1;
+        state.timer = Option.some(Effect.runFork(Effect.sleep(delay).pipe(Effect.andThen(Effect.sync(connect)))));
+    };
+    // A socket may fire both error and close; clearing first prevents duplicate reconnects.
+    const handleDrop = (socket) => {
+        if (Option.isNone(state.socket) || state.socket.value !== socket) {
+            return;
+        }
+        state.socket = Option.none();
+        scheduleReconnect();
+    };
+    function connect() {
+        const socket = protocols === undefined ? new WebSocketImpl(url) : new WebSocketImpl(url, [...protocols]);
+        state.socket = Option.some(socket);
+        socket.addEventListener('open', () => {
+            state.attempts = 0;
+            setStatus('open');
+            flush();
+        });
+        socket.addEventListener('message', (event) => {
+            Option.match(decodeServerMessage(event.data), {
+                onNone: () => Effect.runSync(Effect.logWarning('reform: dropped a server frame this client cannot parse')),
+                onSome: (message) => {
+                    if (handlers.size === 0) {
+                        state.inbox = [...state.inbox, message];
+                        return;
+                    }
+                    handlers.forEach((handler) => handler(message));
+                },
+            });
+        });
+        socket.addEventListener('close', () => handleDrop(socket));
+        socket.addEventListener('error', () => handleDrop(socket));
+    }
+    connect();
+    return {
+        send: (message) => {
+            state.queue = [...state.queue, message];
+            flush();
+        },
+        onMessage: (handler) => {
+            handlers.add(handler);
+            if (state.inbox.length > 0) {
+                const buffered = state.inbox;
+                state.inbox = [];
+                buffered.forEach((message) => handler(message));
+            }
+            return () => void handlers.delete(handler);
+        },
+        status: () => state.status,
+        onStatusChange: (listener) => {
+            statusListeners.add(listener);
+            return () => void statusListeners.delete(listener);
+        },
+        close: () => {
+            setStatus('closed');
+            if (Option.isSome(state.timer)) {
+                Effect.runSync(Fiber.interrupt(state.timer.value));
+            }
+            if (Option.isSome(state.socket)) {
+                state.socket.value.close();
+            }
+        },
+    };
+};
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAI9C,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEjC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CACjC,MAAM,CAAC,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,KAAK,EAAE,MAAM,CAAC,OAAO;CACtB,CAAC,EACF,MAAM,CAAC,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC,CACH,CAAA;AACD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,MAAM,CAAC,MAAM;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC,MAAM;IACzB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAClC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EACvE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CACrE,CAAA;AACD,MAAM,iBAAiB,GAAgD,MAAM,CAAC,SAAS,CACrF,MAAM,CAAC,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,OAAO;CACxB,CAAC,CACH,CAAA;AACD,MAAM,iBAAiB,GAAgD,MAAM,CAAC,SAAS,CACrF,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;CACnC,CAAC,EACF,MAAM,CAAC,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;CACvC,CAAC,CACH,CACF,CAAA;AACD,MAAM,mBAAmB,GAAuC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAA;AACpG,+EAA+E;AAC/E,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,gFAAgF;AAChF,MAAM,mBAAmB,GACvB,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAA;AAyB/C,MAAM,gBAAgB,GAAG,CAAC,QAAsC,EAAoB,EAAE;IACpF,MAAM,WAAW,GAAqC,UAAU,CAAA;IAChE,MAAM,IAAI,GAAG,QAAQ,IAAI,WAAW,CAAC,SAAS,CAAA;IAC9C,OAAO,MAAM,CAAC,cAAc,CAC1B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EACzB,GAAG,EAAE,CACH,IAAI,gBAAgB,CAAC;QACnB,OAAO,EACL,uFAAuF;KAC1F,CAAC,CACL,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,OAAwC,EACd,EAAE;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACzD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAA;IAChE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,oBAAoB,CAAA;IAE7D,MAAM,aAAa,GACjB,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;YACrC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YACrB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAA;IACzB,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,CAAC,UAAU,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,aAAa,CAAC;QACnE,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,aAAa,CAAA;IAErB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAA;IAC5D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAc,CAAA;IAC7C,MAAM,KAAK,GAQP;QACF,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,CAAC;QACX,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE;QACpB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACV,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,MAAoB,EAAQ,EAAE;QAC/C,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,OAAM;QACR,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;QACrB,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAA;QAC1B,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAA;IACnD,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAA;QACjC,IAAI,MAAM,CAAC,UAAU,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAM;QACR,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAA;QAC3B,KAAK,CAAC,KAAK,GAAG,EAAE,CAAA;QAChB,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACzE,CAAC,CAAA;IAED,MAAM,iBAAiB,GAAG,GAAS,EAAE;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAM;QACR,CAAC;QACD,SAAS,CAAC,cAAc,CAAC,CAAA;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;QACrE,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAA;QACnB,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAC/E,CAAA;IACH,CAAC,CAAA;IAED,wFAAwF;IACxF,MAAM,UAAU,GAAG,CAAC,MAAiB,EAAQ,EAAE;QAC7C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACjE,OAAM;QACR,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QAC5B,iBAAiB,EAAE,CAAA;IACrB,CAAC,CAAA;IAED,SAAS,OAAO;QACd,MAAM,MAAM,GACV,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAA;QAC3F,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE;YACnC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAA;YAClB,SAAS,CAAC,MAAM,CAAC,CAAA;YACjB,KAAK,EAAE,CAAA;QACT,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAA4B,EAAE,EAAE;YAClE,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;gBAC5C,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,UAAU,CAAC,yDAAyD,CAAC,CAC7E;gBACH,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;oBAClB,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;wBACxB,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;wBACvC,OAAM;oBACR,CAAC;oBACD,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;gBACjD,CAAC;aACF,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,OAAO,EAAE,CAAA;IAET,OAAO;QACL,IAAI,EAAE,CAAC,OAAsB,EAAQ,EAAE;YACrC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YACvC,KAAK,EAAE,CAAA;QACT,CAAC;QACD,SAAS,EAAE,CAAC,OAAyC,EAAgB,EAAE;YACrE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACrB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAA;gBAC5B,KAAK,CAAC,KAAK,GAAG,EAAE,CAAA;gBAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;YACjD,CAAC;YACD,OAAO,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM;QAC1B,cAAc,EAAE,CAAC,QAAoB,EAAgB,EAAE;YACrD,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC7B,OAAO,GAAG,EAAE,CAAC,KAAK,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACpD,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,SAAS,CAAC,QAAQ,CAAC,CAAA;YACnB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;YACpD,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YAC5B,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playfast/reform-remote-web",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "Browser/web WebSocket client transport for reform-remote — streams a server-run reform scene to a thin renderer.",
   "keywords": [
     "effect",
@@ -19,15 +19,26 @@
     "directory": "packages/reform-remote-web"
   },
   "files": [
+    "dist",
     "src",
     "README.md"
   ],
   "type": "module",
   "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     "./package.json": "./package.json",
-    ".": "./src/index.ts",
-    "./*": "./src/*.ts"
+    ".": {
+      "playfast-src": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./*": {
+      "playfast-src": "./src/*.ts",
+      "types": "./dist/*.d.ts",
+      "default": "./dist/*.js"
+    }
   },
   "publishConfig": {
     "access": "public"
@@ -35,12 +46,13 @@
   "scripts": {
     "clean": "rm -rf dist .tsbuildinfo",
     "check": "tsc --noEmit",
-    "build": "tsc -p tsconfig.build.json",
+    "build": "rm -rf dist .tsbuildinfo && tsc -p tsconfig.build.json && bun ../../scripts/fix-esm-extensions.ts dist",
     "test": "vitest run",
     "test:watch": "vitest",
     "coverage": "vitest run --coverage",
     "lint": "oxlint src",
-    "lint:fix": "oxlint --fix src"
+    "lint:fix": "oxlint --fix src",
+    "prepack": "bun run build"
   },
   "devDependencies": {
     "@playfast/reform": "*",

package/src/transport-malformed-frame.test.ts

@@ -0,0 +1,130 @@
+import { expect, test } from 'vitest'
+import { Data, Option } from 'effect'
+import type { ServerMessage } from '@playfast/reform-remote'
+import { createWebSocketClientTransport } from './transport'
+
+/**
+ * Round-3 adversarial audit — claim 4.
+ *
+ * `reform-remote-node` and `reform-remote-bun` swapped `Schema.decodeUnknownSync`
+ * for `Schema.decodeUnknownOption` on the invoke frame, with the reason: "the frame
+ * comes from the network... A throw here lands inside a `socket.on('message')`
+ * listener, where it escapes as a stream error and takes the shared serving path
+ * down with it."
+ *
+ * The identical construct is still in the client transport. `decodeServerMessage`
+ * is `Schema.decodeUnknownSync(ServerMessageJson)` (transport.ts:56) and it is
+ * called straight inside `socket.addEventListener('message', ...)` (transport.ts:184),
+ * so one frame this client cannot parse — version skew against a newer server, a
+ * truncated write, a hostile endpoint — throws out of the socket's own event
+ * dispatch. Under the `ws` package (which this transport documents for Node < 22)
+ * that is an uncaught exception and the host process exits; in a browser it is a
+ * global error and the frame is lost, and if the lost frame was the opening
+ * Snapshot the app renders null forever because the transport's own reconnect
+ * ladder is never armed (the socket did not close).
+ *
+ * Dropping the frame is the answer the servers already give.
+ */
+
+class NoSocket extends Data.TaggedError('NoSocket')<{ readonly message: string }> {}
+
+type Listener = (event: unknown) => void
+
+// Mirrors the fake in `transport.test.ts`: no real I/O, events fired by hand.
+class ProbeSocket {
+  static readonly CONNECTING = 0
+  static readonly OPEN = 1
+  static readonly CLOSING = 2
+  static readonly CLOSED = 3
+  static instances: ProbeSocket[] = []
+
+  readyState: number = ProbeSocket.CONNECTING
+  readonly sent: string[] = []
+  readonly url: string
+  private readonly listeners = new Map<string, Set<Listener>>()
+
+  constructor(url: string) {
+    this.url = url
+    ProbeSocket.instances.push(this)
+  }
+
+  addEventListener(type: string, cb: Listener): void {
+    const set = this.listeners.get(type) ?? new Set<Listener>()
+    set.add(cb)
+    this.listeners.set(type, set)
+  }
+
+  removeEventListener(type: string, cb: Listener): void {
+    this.listeners.get(type)?.delete(cb)
+  }
+
+  send(data: string): void {
+    this.sent.push(data)
+  }
+
+  close(): void {
+    this.readyState = ProbeSocket.CLOSED
+  }
+
+  emitOpen(): void {
+    this.readyState = ProbeSocket.OPEN
+    this.fire('open', {})
+  }
+
+  // Whatever the endpoint actually wrote, verbatim — the point of the test.
+  emitRaw(data: string): void {
+    this.fire('message', { data })
+  }
+
+  private fire(type: string, event: unknown): void {
+    this.listeners.get(type)?.forEach((cb) => cb(event))
+  }
+}
+
+const makeProbe = () => {
+  ProbeSocket.instances = []
+  const transport = createWebSocketClientTransport({
+    url: 'ws://audit3',
+    // Same single cast as `transport.test.ts`: `typeof WebSocket` is a DOM
+    // constructor type the fake cannot structurally satisfy.
+    WebSocket: ProbeSocket as unknown as typeof WebSocket,
+  })
+  const socket = Option.getOrThrowWith(
+    Option.fromNullable(ProbeSocket.instances[0]),
+    () => new NoSocket({ message: 'transport did not construct a socket' }),
+  )
+  return { transport, socket }
+}
+
+const SNAPSHOT = JSON.stringify({ _tag: 'Snapshot', tree: [] })
+
+test('a server frame this client cannot parse is dropped, not thrown at the socket', () => {
+  const { transport, socket } = makeProbe()
+  socket.emitOpen()
+  const received: ServerMessage[] = []
+  transport.onMessage((message) => received.push(message))
+
+  // Control — a well-formed frame is delivered.
+  socket.emitRaw(SNAPSHOT)
+  expect(received.length).toBe(1)
+
+  const thrown: string[] = []
+  const deliver = (label: string, data: string): void => {
+    try {
+      socket.emitRaw(data)
+    } catch {
+      thrown.push(label)
+    }
+  }
+  deliver('not json', 'this-is-not-json')
+  deliver('unknown message tag', JSON.stringify({ _tag: 'Nope' }))
+  deliver('unknown patch tag', JSON.stringify({ _tag: 'Patches', patches: [{ _tag: 'Weird' }] }))
+  deliver('node missing fields', JSON.stringify({ _tag: 'Snapshot', tree: [{ id: 'x' }] }))
+  expect(thrown).toEqual([])
+
+  // …and the connection is still usable afterwards: an unparseable frame costs
+  // that frame, nothing else.
+  socket.emitRaw(SNAPSHOT)
+  expect(received.length).toBe(2)
+  transport.close()
+})

package/src/transport.ts

@@ -52,8 +52,13 @@ const ServerMessageJson: Schema.Schema<ServerMessage, string, never> = Schema.pa
   ),
 )
 const encodeInvokeMessage: (message: InvokeMessage) => string = Schema.encodeSync(InvokeMessageJson)
-const decodeServerMessage: (input: unknown) => ServerMessage =
-  Schema.decodeUnknownSync(ServerMessageJson)
+// A frame off the network is untrusted: version skew against a newer server, a
+// truncated write or a hostile endpoint must cost that frame and nothing else. A
+// throw here would escape the socket's own event dispatch — an uncaught exception
+// under `ws`, a lost frame plus a global error in a browser — and the socket never
+// closes, so the reconnect ladder is never armed. Same answer the servers give.
+const decodeServerMessage: (input: unknown) => Option.Option<ServerMessage> =
+  Schema.decodeUnknownOption(ServerMessageJson)
 
 export interface WebSocketClientTransportOptionsExternalApi {
   readonly url: string
@@ -184,12 +189,19 @@ export const createWebSocketClientTransport = (
       flush()
     })
     socket.addEventListener('message', (event: MessageEvent<unknown>) => {
-      const message = decodeServerMessage(event.data)
-      if (handlers.size === 0) {
-        state.inbox = [...state.inbox, message]
-        return
-      }
-      handlers.forEach((handler) => handler(message))
+      Option.match(decodeServerMessage(event.data), {
+        onNone: () =>
+          Effect.runSync(
+            Effect.logWarning('reform: dropped a server frame this client cannot parse'),
+          ),
+        onSome: (message) => {
+          if (handlers.size === 0) {
+            state.inbox = [...state.inbox, message]
+            return
+          }
+          handlers.forEach((handler) => handler(message))
+        },
+      })
     })
     socket.addEventListener('close', () => handleDrop(socket))
     socket.addEventListener('error', () => handleDrop(socket))