@schlessera/brain-ui-server 0.34.0 → 0.35.0

package/dist/ws/connection.js

@@ -31,6 +31,8 @@ import { handleClientMessage } from "./dispatch.js";
 export { websocket };
 const CONNECTION_LIMIT_CLOSE_CODE = 4008;
 const CONNECTION_LIMIT_CLOSE_REASON = "Connection limit reached";
+const REVOKED_BEFORE_ADMISSION_CLOSE_CODE = 1008;
+const REVOKED_BEFORE_ADMISSION_CLOSE_REASON = "Sessions invalidated";
 /**
  * The socket lifecycle handlers for one host, separate from the Hono upgrade
  * that wraps them.
@@ -40,16 +42,33 @@ const CONNECTION_LIMIT_CLOSE_REASON = "Connection limit reached";
  * production runs, which is what makes an assertion about a dropped frame an
  * assertion about the shipped code rather than about a re-implementation.
  */
-export function createWsHandlers(host) {
+export function createWsHandlers(host, principal) {
     // One bucket per connection, created here so it lives and dies with the
     // socket rather than in a map keyed by something a peer controls.
     const limiter = host.newRateLimiter();
+    // Authentication can await before it reaches this handler. Re-read durable
+    // validity as the coordinator constructs and synchronously registers the
+    // context, so there is no unregistered authorization state to lose.
+    const authorization = host.coordinator.openAuthorization({
+        principalId: principal.id,
+        expiresAt: principal.expiresAt,
+        valid: host.isPrincipalValid(principal),
+    });
     // Per-connection negotiation state: what revision this client declared.
     // Lives with the socket, like the limiter.
-    const connection = {};
+    const connection = {
+        principal,
+        authorization,
+    };
     return {
         async onOpen(_evt, ws) {
-            if (!host.clients.add(ws)) {
+            if (!connection.authorization.valid) {
+                connection.authorization.release();
+                ws.close(REVOKED_BEFORE_ADMISSION_CLOSE_CODE, REVOKED_BEFORE_ADMISSION_CLOSE_REASON);
+                return;
+            }
+            if (!host.clients.add(ws, principal.id, { onRemove: connection.authorization.release })) {
+                connection.authorization.release();
                 host.reportRefusedConnection();
                 // Hono's WSContext always exposes close(); the local structural socket
                 // type keeps it optional because send-only test/dispatch fakes never
@@ -92,11 +111,15 @@ export function createWsHandlers(host) {
                     providerId: turn.providerId ?? catalog.getStoredProviderId(sid) ?? undefined,
                     backendId: catalog.getStoredBackendId(sid) ?? turn.backend.id,
                 }, turn));
+                // Snapshot-on-connect owns a lease separate from the socket: a close
+                // while history loads must not make this work invisible to revocation.
+                const releaseAuthorization = connection.authorization.retain();
                 try {
                     const backend = await host.registry.getBackendForSession(catalog.getStoredBackendId(sid) ?? turn.backend.id);
                     const history = await backend.getHistory(sid);
-                    if (history.length > 0)
+                    if (connection.authorization.valid && history.length > 0) {
                         sendSessionHistory(ws, sid, history);
+                    }
                 }
                 catch (err) {
                     host.log.emit({
@@ -106,13 +129,16 @@ export function createWsHandlers(host) {
                     });
                 }
                 finally {
-                    host.sendMessage(ws, withTurnScope({
-                        type: "status",
-                        status: "thinking",
-                        detail: "Session in progress",
-                        sessionId: sid,
-                    }, turn));
-                    resendPendingInteractive(host, ws);
+                    releaseAuthorization();
+                    if (connection.authorization.valid) {
+                        host.sendMessage(ws, withTurnScope({
+                            type: "status",
+                            status: "thinking",
+                            detail: "Session in progress",
+                            sessionId: sid,
+                        }, turn));
+                        resendPendingInteractive(host, ws);
+                    }
                 }
                 return;
             }
@@ -124,6 +150,14 @@ export function createWsHandlers(host) {
             resendPendingInteractive(host, ws);
         },
         onMessage(evt, ws) {
+            if (connection.authorization.valid &&
+                connection.authorization.expiresAt <= Date.now()) {
+                host.expireAuthorizationContexts();
+            }
+            if (!connection.authorization.valid) {
+                host.reportDroppedFrame("revoked_principal");
+                return;
+            }
             // Boundary validation (rev 2): byte cap + JSON decode + schema, in one
             // place. No more casting client JSON to ClientMessage.
             //
@@ -160,6 +194,12 @@ export function createWsHandlers(host) {
                 host.sendMessage(ws, { type: "error", code: "PARSE_ERROR", message: parsed.error });
                 return;
             }
+            // Parsing is synchronous, but dispatch deliberately starts on a
+            // microtask. Keep this shared authority discoverable across that gap —
+            // including after an ordinary disconnect removes the admitted client.
+            // runSession adds its own reference before this one is released, so a
+            // chat startup remains continuously revocable through routing/billing.
+            const releaseAuthorization = connection.authorization.retain();
             // handleClientMessage is async — a rejection must not escape as an
             // unhandled rejection with no frame sent.
             void Promise.resolve()
@@ -180,9 +220,18 @@ export function createWsHandlers(host) {
                     code: "INTERNAL_ERROR",
                     message: "Failed to handle message",
                 });
+            })
+                .finally(() => {
+                releaseAuthorization();
             });
         },
         onClose(evt, ws) {
+            // Closure is not authorization: a frame parsed before this callback can
+            // still be mid-dispatch, and an activity_subscribe landing after the
+            // cleanup below would re-register the dead socket and keep the activity
+            // poller awake. Authorization stays whatever it is; this says the
+            // transport is gone.
+            connection.closed = true;
             host.log.emit({ severityText: "INFO", body: "client disconnected" });
             // No onError here on purpose: hono's Bun adapter never dispatches it
             // (only open/message/close reach these handlers), so a transport failure
@@ -194,6 +243,7 @@ export function createWsHandlers(host) {
                 host.reportAbnormalClose(code);
             }
             host.clients.remove(ws);
+            connection.authorization.release();
             host.activity?.stream.dropConnection(ws);
             // Turns keep running in the background. Once the LAST client leaves,
             // reject only the requests that need a live client RIGHT NOW (location,
@@ -207,10 +257,31 @@ export function createWsHandlers(host) {
                 host.coordinator.drainClientBoundForTurn(turn, "Client disconnected");
             }
         },
+        /** The HTTP upgrade failed, so no socket lifecycle callback will clean up. */
+        onUpgradeFailed() {
+            connection.authorization.release();
+        },
     };
 }
 /** Build the Hono WebSocket upgrade handler bound to one host. */
 export function createWsUpgrade(host) {
-    return upgradeWebSocket(() => createWsHandlers(host));
+    return async (c, next) => {
+        const principal = c.get("principal");
+        if (!principal) {
+            return c.json({ error: "Authentication required" }, 401);
+        }
+        const handlers = createWsHandlers(host, principal);
+        const upgrade = upgradeWebSocket(() => handlers);
+        try {
+            return await upgrade(c, async () => {
+                handlers.onUpgradeFailed();
+                await next();
+            });
+        }
+        catch (err) {
+            handlers.onUpgradeFailed();
+            throw err;
+        }
+    };
 }
 //# sourceMappingURL=connection.js.map

package/dist/ws/connection.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/ws/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,IAAY,EAAE,EAAiB;IAC/D,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW,CACd,EAAE,EACF,aAAa,CACX;YACE,IAAI,EAAE,uBAAuB;YAC7B,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS;YAC9B,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ;YAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;YACtB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW;YAClC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,EACD,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,MAAM,CACT,CACF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC,WAAW,CACd,EAAE,EACF,aAAa,CACX,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,EAC5E,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,MAAM,CACT,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AACD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,eAAe,CAAC;AAI1E,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB,MAAM,2BAA2B,GAAG,IAAI,CAAC;AACzC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACtC,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,UAAU,GAAoB,EAAE,CAAC;IAEvC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,IAAW,EAAE,EAAa;YACrC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBAC/B,uEAAuE;gBACvE,qEAAqE;gBACrE,iCAAiC;gBACjC,EAAE,CAAC,KAAM,CAAC,2BAA2B,EAAE,6BAA6B,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAClE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;YAEtC,gEAAgE;YAChE,qEAAqE;YACrE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;gBACnB,IAAI,EAAE,cAAc;gBACpB,WAAW,EAAE,YAAY;gBACzB,YAAY,EAAE;oBACZ,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,IAAI;oBACd,mEAAmE;oBACnE,2DAA2D;oBAC3D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7C;aACF,CAAC,CAAC;YAEH,yEAAyE;YACzE,2EAA2E;YAC3E,4EAA4E;YAC5E,iDAAiD;YACjD,MAAM,YAAY,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACzE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAU,CAAC;gBAC5B,IAAI,CAAC,WAAW,CACd,EAAE;gBACF,qEAAqE;gBACrE,qEAAqE;gBACrE,iBAAiB;gBACjB,aAAa,CACX;oBACE,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,GAAG;oBACd,KAAK,EAAE,KAAK;oBACZ,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS;oBAC5E,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE;iBAC9D,EACD,IAAI,CACL,CACF,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CACtD,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CACnD,CAAC;oBACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;oBAC9C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;wBAAE,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;wBACZ,YAAY,EAAE,OAAO;wBACrB,IAAI,EAAE,4BAA4B;wBAClC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;qBACxE,CAAC,CAAC;gBACL,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC,WAAW,CACd,EAAE,EACF,aAAa,CACX;wBACE,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE,qBAAqB;wBAC7B,SAAS,EAAE,GAAG;qBACf,EACD,IAAI,CACL,CACF,CAAC;oBACF,wBAAwB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;gBACnB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,gBAAgB,IAAI,CAAC,OAAO,EAAE;aACvC,CAAC,CAAC;YACH,wBAAwB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,SAAS,CAAC,GAAiB,EAAE,EAAa;YACxC,uEAAuE;YACvE,uDAAuD;YACvD,EAAE;YACF,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,uDAAuD;YACvD,uEAAuE;YACvE,8DAA8D;YAC9D,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;gBACvC,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBACxC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,6BAA6B;iBACvC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBACxC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,iDAAiD;iBAC3D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,mEAAmE;gBACnE,sDAAsD;gBACtD,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,mEAAmE;YACnE,0CAA0C;YAC1C,KAAK,OAAO,CAAC,OAAO,EAAE;iBACnB,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;iBACrE,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,oEAAoE;gBACpE,qDAAqD;gBACrD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBACZ,YAAY,EAAE,OAAO;oBACrB,IAAI,EAAE,+BAA+B;oBACrC,UAAU,EAAE;wBACV,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;wBACjC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD;iBACF,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,0BAA0B;iBACpC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,CAAC,GAAe,EAAE,EAAa;YACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACrE,qEAAqE;YACrE,yEAAyE;YACzE,mEAAmE;YACnE,wEAAwE;YACxE,yDAAyD;YACzD,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;YAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC/D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACzC,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,8CAA8C;YAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;gBAAE,OAAO;YACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBAC5C,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/ws/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAK5C;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,IAAY,EAAE,EAAiB;IAC/D,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW,CACd,EAAE,EACF,aAAa,CACX;YACE,IAAI,EAAE,uBAAuB;YAC7B,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS;YAC9B,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ;YAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;YACtB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW;YAClC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,EACD,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,MAAM,CACT,CACF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC,WAAW,CACd,EAAE,EACF,aAAa,CACX,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,EAC5E,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,MAAM,CACT,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AACD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,eAAe,CAAC;AAI1E,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB,MAAM,2BAA2B,GAAG,IAAI,CAAC;AACzC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AACjE,MAAM,mCAAmC,GAAG,IAAI,CAAC;AACjD,MAAM,qCAAqC,GAAG,sBAAsB,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,SAAoB;IACjE,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACtC,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC;QACvD,WAAW,EAAE,SAAS,CAAC,EAAE;QACzB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;KACxC,CAAC,CAAC;IACH,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,UAAU,GAAoB;QAClC,SAAS;QACT,aAAa;KACd,CAAC;IACF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,IAAW,EAAE,EAAa;YACrC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;gBACpC,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBACnC,EAAE,CAAC,KAAM,CAAC,mCAAmC,EAAE,qCAAqC,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,IACE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,EACnF,CAAC;gBACD,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBACnC,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBAC/B,uEAAuE;gBACvE,qEAAqE;gBACrE,iCAAiC;gBACjC,EAAE,CAAC,KAAM,CAAC,2BAA2B,EAAE,6BAA6B,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAClE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;YAEtC,gEAAgE;YAChE,qEAAqE;YACrE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;gBACnB,IAAI,EAAE,cAAc;gBACpB,WAAW,EAAE,YAAY;gBACzB,YAAY,EAAE;oBACZ,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,IAAI;oBACd,mEAAmE;oBACnE,2DAA2D;oBAC3D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7C;aACF,CAAC,CAAC;YAEH,yEAAyE;YACzE,2EAA2E;YAC3E,4EAA4E;YAC5E,iDAAiD;YACjD,MAAM,YAAY,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACzE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAU,CAAC;gBAC5B,IAAI,CAAC,WAAW,CACd,EAAE;gBACF,qEAAqE;gBACrE,qEAAqE;gBACrE,iBAAiB;gBACjB,aAAa,CACX;oBACE,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,GAAG;oBACd,KAAK,EAAE,KAAK;oBACZ,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS;oBAC5E,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE;iBAC9D,EACD,IAAI,CACL,CACF,CAAC;gBACF,qEAAqE;gBACrE,uEAAuE;gBACvE,MAAM,oBAAoB,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;gBAC/D,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CACtD,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CACnD,CAAC;oBACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;oBAC9C,IAAI,UAAU,CAAC,aAAa,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzD,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;wBACZ,YAAY,EAAE,OAAO;wBACrB,IAAI,EAAE,4BAA4B;wBAClC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;qBACxE,CAAC,CAAC;gBACL,CAAC;wBAAS,CAAC;oBACT,oBAAoB,EAAE,CAAC;oBACvB,IAAI,UAAU,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;wBACnC,IAAI,CAAC,WAAW,CACd,EAAE,EACF,aAAa,CACX;4BACE,IAAI,EAAE,QAAQ;4BACd,MAAM,EAAE,UAAU;4BAClB,MAAM,EAAE,qBAAqB;4BAC7B,SAAS,EAAE,GAAG;yBACf,EACD,IAAI,CACL,CACF,CAAC;wBACF,wBAAwB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACrC,CAAC;gBACH,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;gBACnB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,gBAAgB,IAAI,CAAC,OAAO,EAAE;aACvC,CAAC,CAAC;YACH,wBAAwB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,SAAS,CAAC,GAAiB,EAAE,EAAa;YACxC,IACE,UAAU,CAAC,aAAa,CAAC,KAAK;gBAC9B,UAAU,CAAC,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAChD,CAAC;gBACD,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;gBACpC,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,uEAAuE;YACvE,uDAAuD;YACvD,EAAE;YACF,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,uDAAuD;YACvD,uEAAuE;YACvE,8DAA8D;YAC9D,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;gBACvC,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBACxC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,6BAA6B;iBACvC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBACxC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,iDAAiD;iBAC3D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,mEAAmE;gBACnE,sDAAsD;gBACtD,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,gEAAgE;YAChE,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,MAAM,oBAAoB,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC/D,mEAAmE;YACnE,0CAA0C;YAC1C,KAAK,OAAO,CAAC,OAAO,EAAE;iBACnB,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;iBACrE,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,oEAAoE;gBACpE,qDAAqD;gBACrD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBACZ,YAAY,EAAE,OAAO;oBACrB,IAAI,EAAE,+BAA+B;oBACrC,UAAU,EAAE;wBACV,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;wBACjC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD;iBACF,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,0BAA0B;iBACpC,CAAC,CAAC;YACL,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,oBAAoB,EAAE,CAAC;YACzB,CAAC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,CAAC,GAAe,EAAE,EAAa;YACpC,wEAAwE;YACxE,qEAAqE;YACrE,wEAAwE;YACxE,kEAAkE;YAClE,qBAAqB;YACrB,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACrE,qEAAqE;YACrE,yEAAyE;YACzE,mEAAmE;YACnE,wEAAwE;YACxE,yDAAyD;YACzD,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;YAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC/D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACzC,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,8CAA8C;YAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;gBAAE,OAAO;YACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBAC5C,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,eAAe;YACb,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;gBACjC,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC3B,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/ws/dispatch.d.ts

@@ -1,8 +1,19 @@
 import type { ClientMessage } from "@schlessera/brain-ui-sdk/protocol";
 import type { WSContext } from "./clients.js";
+import type { AuthorizationContext } from "./turns.js";
 import type { WsHost } from "./host.js";
 /** Per-connection negotiation state, owned by the socket handler. */
 export interface ConnectionState {
+    /**
+     * The transport is gone. Set by onClose, and separate from `authorization`
+     * because a disconnect is not a revocation: work already underway keeps its
+     * authority, but nothing may register new per-connection state afterwards.
+     */
+    closed?: boolean;
+    /** Principal resolved once at the WebSocket upgrade boundary. */
+    principal: import("../db/principals.js").Principal;
+    /** Mutable in-memory decision invalidated synchronously by revocation. */
+    authorization: AuthorizationContext;
     /** Revision the client declared via `client_hello`; absent means rev 2. */
     protocolRev?: number;
 }
@@ -22,5 +33,5 @@ export interface ConnectionState {
 export declare function turnIdMatches(pending: {
     turnId: string;
 }, echoed: string | undefined, requireEcho: boolean): boolean;
-export declare function handleClientMessage(host: WsHost, ws: WSContext, msg: ClientMessage, connection?: ConnectionState): Promise<void>;
+export declare function handleClientMessage(host: WsHost, ws: WSContext, msg: ClientMessage, connection: ConnectionState): Promise<void>;
 //# sourceMappingURL=dispatch.d.ts.map

package/dist/ws/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/ws/dispatch.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAK9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,WAAW,EAAE,OAAO,GACnB,OAAO,CAGT;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,aAAa,EAClB,UAAU,GAAE,eAAoB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAiMf"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/ws/dispatch.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAKvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,SAAS,EAAE,OAAO,qBAAqB,EAAE,SAAS,CAAC;IACnD,0EAA0E;IAC1E,aAAa,EAAE,oBAAoB,CAAC;IACpC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,WAAW,EAAE,OAAO,GACnB,OAAO,CAGT;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,aAAa,EAClB,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,IAAI,CAAC,CAkPf"}

package/dist/ws/dispatch.js

@@ -21,7 +21,18 @@ export function turnIdMatches(pending, echoed, requireEcho) {
         return !requireEcho;
     return echoed === pending.turnId;
 }
-export async function handleClientMessage(host, ws, msg, connection = {}) {
+export async function handleClientMessage(host, ws, msg, connection) {
+    // The socket callback schedules dispatch on a microtask. Revocation may land
+    // after parsing but before this function begins, so repeat the in-memory
+    // check at the actual dispatch boundary.
+    if (connection.authorization.valid &&
+        connection.authorization.expiresAt <= Date.now()) {
+        host.expireAuthorizationContexts();
+    }
+    if (!connection.authorization.valid) {
+        host.reportDroppedFrame("revoked_principal");
+        return;
+    }
     const { coordinator, catalog } = host;
     const requireEcho = (connection.protocolRev ?? 2) >= PROTOCOL_REV_CLIENT_ECHO;
     switch (msg.type) {
@@ -44,11 +55,13 @@ export async function handleClientMessage(host, ws, msg, connection = {}) {
                 return;
             }
             await handleChatMessage(host, ws, {
+                authorization: connection.authorization,
                 text: msg.text,
                 sessionId: msg.sessionId,
                 attachments: attachmentResult.attachments,
                 providerId: msg.providerId,
                 client: msg.client,
+                draftId: msg.draftId,
             });
             break;
         }
@@ -56,6 +69,7 @@ export async function handleClientMessage(host, ws, msg, connection = {}) {
             const pending = coordinator.pendingAskUser.get(msg.requestId);
             if (pending && turnIdMatches(pending, msg.turnId, requireEcho)) {
                 coordinator.pendingAskUser.delete(msg.requestId);
+                pending.turn.recorder?.recordAskUserResponse(connection.authorization.principalId);
                 pending.resolve({ answers: msg.answers, annotations: msg.annotations });
             }
             break;
@@ -64,6 +78,7 @@ export async function handleClientMessage(host, ws, msg, connection = {}) {
             const pending = coordinator.pendingAskUser.get(msg.requestId);
             if (pending && turnIdMatches(pending, msg.turnId, requireEcho)) {
                 coordinator.pendingAskUser.delete(msg.requestId);
+                pending.turn.recorder?.recordCancellation(connection.authorization.principalId, "ask_user");
                 pending.reject(new Error(msg.reason || "User cancelled the question"));
             }
             break;
@@ -115,7 +130,10 @@ export async function handleClientMessage(host, ws, msg, connection = {}) {
                 }
                 pending.resolve(msg.updatedInput
                     ? { behavior: "allow", updatedInput: msg.updatedInput }
-                    : { behavior: "allow" });
+                    : { behavior: "allow" }, {
+                    principalId: connection.authorization.principalId,
+                    ...(msg.always && pending.request.kind !== "command" ? { always: true } : {}),
+                });
             }
             break;
         }
@@ -123,15 +141,26 @@ export async function handleClientMessage(host, ws, msg, connection = {}) {
             const pending = coordinator.pendingApprovals.get(msg.toolUseId);
             if (pending && turnIdMatches(pending, msg.turnId, requireEcho)) {
                 coordinator.pendingApprovals.delete(msg.toolUseId);
-                pending.resolve({ behavior: "deny", message: msg.message });
+                pending.resolve({ behavior: "deny", message: msg.message }, { principalId: connection.authorization.principalId });
             }
             break;
         }
         case "cancel": {
             if (msg.sessionId) {
                 const turn = coordinator.bySession.get(msg.sessionId);
-                if (turn)
+                if (turn) {
+                    coordinator.recordCancellation(turn, connection.authorization.principalId);
                     coordinator.cancelTurn(turn, "Cancelled by user");
+                }
+                const starting = coordinator.startingBySession.get(msg.sessionId);
+                if (starting) {
+                    starting.cancelled = true;
+                    // Releasing here, not in runSession: a start cancelled before it
+                    // becomes a turn never reaches the loop that would drain its queue.
+                    for (const entry of starting.queue.splice(0))
+                        entry.releaseAuthorization();
+                    host.sendToClients({ type: "status", status: "idle", sessionId: msg.sessionId, detail: "Cancelled before starting" });
+                }
                 return;
             }
             // No sessionId: cancel the sole running session; ambiguous if several run.
@@ -145,14 +174,23 @@ export async function handleClientMessage(host, ws, msg, connection = {}) {
                 });
                 return;
             }
-            coordinator.cancelTurn([...coordinator.running][0], "Cancelled by user");
+            const turn = [...coordinator.running][0];
+            coordinator.recordCancellation(turn, connection.authorization.principalId);
+            coordinator.cancelTurn(turn, "Cancelled by user");
             break;
         }
         case "activity_subscribe": {
             // View-scoped opt-in: without a subscription this connection never
             // receives an activity frame. No turn correlation — subscriptions are
             // connection state, not turn state.
-            host.activity?.stream.handleSubscribe(ws, msg);
+            //
+            // Dispatch starts on a microtask, so this can run after onClose already
+            // dropped the connection's subscriptions. Registering here would resurrect
+            // a dead socket in the registry and keep the activity poller alive for the
+            // life of the process.
+            if (connection.closed)
+                break;
+            host.activity?.stream.handleSubscribe(ws, msg, connection.authorization.principalId);
             break;
         }
         case "activity_unsubscribe": {
@@ -170,6 +208,8 @@ export async function handleClientMessage(host, ws, msg, connection = {}) {
             try {
                 const backend = await host.registry.getBackendForSession(catalog.getStoredBackendId(msg.sessionId));
                 const messages = await backend.getHistory(msg.sessionId);
+                if (!connection.authorization.valid)
+                    return;
                 sendSessionHistory(ws, msg.sessionId, messages);
                 // A resume of a RUNNING session (reattach) must not report idle: idle
                 // would clear the client's running badge and finish its streaming

package/dist/ws/dispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../src/ws/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AASrD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA2B,EAC3B,MAA0B,EAC1B,WAAoB;IAEpB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,CAAC;IAC9C,OAAO,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,EAAa,EACb,GAAkB,EAClB,aAA8B,EAAE;IAEhC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACtC,MAAM,WAAW,GAAG,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,wBAAwB,CAAC;IAC9E,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,mEAAmE;YACnE,sEAAsE;YACtE,oDAAoD;YACpD,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;YACzC,OAAO;QACT,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9D,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gBAAgB,CAAC,MAAM;oBAChC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,EAAE;gBAChC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,WAAW,EAAE,gBAAgB,CAAC,WAAW;gBACzC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACjD,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACjD,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,6BAA6B,CAAC,CAAC,CAAC;YACzE,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,OAAO,GAAG,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClD,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,OAAO,GAAG,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClD,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9C,uEAAuE;gBACvE,mEAAmE;gBACnE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9C,OAAO,CAAC,MAAM,CACZ,IAAI,KAAK,CACP,GAAG,CAAC,IAAI,KAAK,WAAW;oBACtB,CAAC,CAAC,gCAAgC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;oBACzE,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,wBAAwB,CAC5C,CACF,CAAC;YACJ,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAChE,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACnD,iEAAiE;gBACjE,oEAAoE;gBACpE,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACrD,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,CAAC,OAAO,CACb,GAAG,CAAC,YAAY;oBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE;oBACvD,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAC1B,CAAC;YACJ,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAChE,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACnD,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACtD,IAAI,IAAI;oBAAE,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YACD,2EAA2E;YAC3E,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO;YAC3C,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,yDAAyD;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,WAAW,CAAC,UAAU,CAAC,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACzE,MAAM;QACR,CAAC;QAED,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,mEAAmE;YACnE,sEAAsE;YACtE,oCAAoC;YACpC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM;QACR,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACjD,MAAM;QACR,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;gBACnB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS;gBACnE,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS;aAClE,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACzD,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAChD,sEAAsE;gBACtE,kEAAkE;gBAClE,mEAAmE;gBACnE,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC7D,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,QAAQ;oBACd,GAAG,CAAC,WAAW;wBACb,CAAC,CAAC,EAAE,MAAM,EAAE,UAAmB,EAAE,MAAM,EAAE,qBAAqB,EAAE;wBAChE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;oBAC1D,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;gBAC9E,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;gBACnF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,oBAAoB;oBAC1B,OAAO;oBACP,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../src/ws/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAI7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAmBrD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA2B,EAC3B,MAA0B,EAC1B,WAAoB;IAEpB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,CAAC;IAC9C,OAAO,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,EAAa,EACb,GAAkB,EAClB,UAA2B;IAE3B,6EAA6E;IAC7E,yEAAyE;IACzE,yCAAyC;IACzC,IACE,UAAU,CAAC,aAAa,CAAC,KAAK;QAC9B,UAAU,CAAC,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAChD,CAAC;QACD,IAAI,CAAC,2BAA2B,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACtC,MAAM,WAAW,GAAG,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,wBAAwB,CAAC;IAC9E,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,mEAAmE;YACnE,sEAAsE;YACtE,oDAAoD;YACpD,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;YACzC,OAAO;QACT,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9D,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gBAAgB,CAAC,MAAM;oBAChC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,EAAE;gBAChC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,WAAW,EAAE,gBAAgB,CAAC,WAAW;gBACzC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAC1C,UAAU,CAAC,aAAa,CAAC,WAAW,CACrC,CAAC;gBACF,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CACvC,UAAU,CAAC,aAAa,CAAC,WAAW,EACpC,UAAU,CACX,CAAC;gBACF,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,6BAA6B,CAAC,CAAC,CAAC;YACzE,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,OAAO,GAAG,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClD,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,OAAO,GAAG,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClD,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9C,uEAAuE;gBACvE,mEAAmE;gBACnE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9C,OAAO,CAAC,MAAM,CACZ,IAAI,KAAK,CACP,GAAG,CAAC,IAAI,KAAK,WAAW;oBACtB,CAAC,CAAC,gCAAgC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;oBACzE,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,wBAAwB,CAC5C,CACF,CAAC;YACJ,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAChE,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACnD,iEAAiE;gBACjE,oEAAoE;gBACpE,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACrD,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,CAAC,OAAO,CACb,GAAG,CAAC,YAAY;oBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE;oBACvD,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EACzB;oBACE,WAAW,EAAE,UAAU,CAAC,aAAa,CAAC,WAAW;oBACjD,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9E,CACF,CAAC;YACJ,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAChE,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACnD,OAAO,CAAC,OAAO,CACb,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAC1C,EAAE,WAAW,EAAE,UAAU,CAAC,aAAa,CAAC,WAAW,EAAE,CACtD,CAAC;YACJ,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACtD,IAAI,IAAI,EAAE,CAAC;oBACT,WAAW,CAAC,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;oBAC3E,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;gBACpD,CAAC;gBACD,MAAM,QAAQ,GAAG,WAAW,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClE,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC;oBAC1B,iEAAiE;oBACjE,oEAAoE;oBACpE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;wBAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC;oBAC3E,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACxH,CAAC;gBACD,OAAO;YACT,CAAC;YACD,2EAA2E;YAC3E,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO;YAC3C,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,yDAAyD;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1C,WAAW,CAAC,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAC3E,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAClD,MAAM;QACR,CAAC;QAED,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,mEAAmE;YACnE,sEAAsE;YACtE,oCAAoC;YACpC,EAAE;YACF,wEAAwE;YACxE,2EAA2E;YAC3E,2EAA2E;YAC3E,uBAAuB;YACvB,IAAI,UAAU,CAAC,MAAM;gBAAE,MAAM;YAC7B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YACrF,MAAM;QACR,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACjD,MAAM;QACR,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;gBACnB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS;gBACnE,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS;aAClE,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACzD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK;oBAAE,OAAO;gBAC5C,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAChD,sEAAsE;gBACtE,kEAAkE;gBAClE,mEAAmE;gBACnE,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC7D,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,QAAQ;oBACd,GAAG,CAAC,WAAW;wBACb,CAAC,CAAC,EAAE,MAAM,EAAE,UAAmB,EAAE,MAAM,EAAE,qBAAqB,EAAE;wBAChE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;oBAC1D,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;gBAC9E,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;gBACnF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;oBACnB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,oBAAoB;oBAC1B,OAAO;oBACP,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/ws/history.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"history.d.ts","sourceRoot":"","sources":["../../src/ws/history.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,KAAK,SAAS,EAAU,MAAM,cAAc,CAAC;AAGtD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,qBAAqB,EAAE,GAChC,IAAI,CA6BN"}
+{"version":3,"file":"history.d.ts","sourceRoot":"","sources":["../../src/ws/history.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,KAAK,SAAS,EAAU,MAAM,cAAc,CAAC;AAGtD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,qBAAqB,EAAE,GAChC,IAAI,CA+BN"}

package/dist/ws/history.js

@@ -1,5 +1,5 @@
 import { sendTo } from "./clients.js";
-import { HISTORY_CHUNK_BYTES, shrinkForReplication } from "./shrink.js";
+import { HISTORY_CHUNK_BYTES, jsonBytes, shrinkForReplication } from "./shrink.js";
 /**
  * Send a structured history to one socket as one or more `session_history`
  * frames. Each message is size-bounded, then batched into byte-limited chunks
@@ -14,8 +14,7 @@ import { HISTORY_CHUNK_BYTES, shrinkForReplication } from "./shrink.js";
  * silently overwrites the wrong pane).
  */
 export function sendSessionHistory(ws, sessionId, messages) {
-    const bounded = messages.map((m) => shrinkForReplication(m));
-    if (bounded.length === 0) {
+    if (messages.length === 0) {
         sendTo(ws, { type: "session_history", sessionId, messages: [] });
         return;
     }
@@ -33,8 +32,11 @@ export function sendSessionHistory(ws, sessionId, messages) {
         batch = [];
         batchBytes = 0;
     };
-    for (const message of bounded) {
-        const size = JSON.stringify(message).length;
+    for (const original of messages) {
+        // Reserve the frame wrapper separately: bounding a message to the entire
+        // frame cap caused sendTo to shrink its parent history array a second time.
+        const message = shrinkForReplication(original, HISTORY_CHUNK_BYTES);
+        const size = jsonBytes(message) + 1; // comma between messages
         if (batch.length > 0 && batchBytes + size > HISTORY_CHUNK_BYTES)
             flush();
         batch.push(message);

package/dist/ws/history.js.map

@@ -1 +1 @@
-{"version":3,"file":"history.js","sourceRoot":"","sources":["../../src/ws/history.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,MAAM,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAAa,EACb,SAAiB,EACjB,QAAiC;IAEjC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,IAAI,KAAK,GAA4B,EAAE,CAAC;IACxC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,CAAC,EAAE,EAAE;YACT,IAAI,EAAE,iBAAiB;YACvB,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SACrC,CAAC,CAAC;QACH,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,GAAG,EAAE,CAAC;QACX,UAAU,GAAG,CAAC,CAAC;IACjB,CAAC,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,GAAG,IAAI,GAAG,mBAAmB;YAAE,KAAK,EAAE,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IACD,KAAK,EAAE,CAAC;AACV,CAAC"}
+{"version":3,"file":"history.js","sourceRoot":"","sources":["../../src/ws/history.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,MAAM,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAAa,EACb,SAAiB,EACjB,QAAiC;IAEjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,IAAI,KAAK,GAA4B,EAAE,CAAC;IACxC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,CAAC,EAAE,EAAE;YACT,IAAI,EAAE,iBAAiB;YACvB,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SACrC,CAAC,CAAC;QACH,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,GAAG,EAAE,CAAC;QACX,UAAU,GAAG,CAAC,CAAC;IACjB,CAAC,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,yBAAyB;QAC9D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,GAAG,IAAI,GAAG,mBAAmB;YAAE,KAAK,EAAE,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IACD,KAAK,EAAE,CAAC;AACV,CAAC"}

package/dist/ws/host.d.ts

@@ -7,10 +7,14 @@ import { type Observability } from "../observability/index.js";
 import { FrameRateLimiter } from "./rate-limit.js";
 import type { ActivityStore } from "../activity/store.js";
 import type { ActivityStream } from "../activity/stream.js";
+import type { PushSender } from "../activity/push-sender.js";
+import type { Principal } from "../db/principals.js";
 /** The activity record and its live stream, when the host records activity. */
 export interface ActivityRuntime {
     store: ActivityStore;
     stream: ActivityStream;
+    /** Push bindings invalidated through the same principal-revocation boundary. */
+    pushSender?: Pick<PushSender, "unbindPrincipal">;
     /** Read seam for the agent-facing query tool (bridge.queryActivity). */
     query?: (query: import("@schlessera/brain-ui-sdk/server").ActivityQuery) => Record<string, unknown>;
 }
@@ -70,6 +74,13 @@ export interface WsHostOptions {
     };
     /** Maximum WebSocket connections accepted by this host (default 32). */
     wsMaxConnections?: number;
+    /**
+     * Final synchronous check before a resolved principal becomes discoverable
+     * to in-memory revocation. Production re-reads the principal row here; a
+     * host without durable authentication (including focused tests) accepts the
+     * already-resolved principal.
+     */
+    isPrincipalValid?: (principal: Principal) => boolean;
     /**
      * Activity recording (span store + live stream). Optional: a host without
      * one records nothing and never sends activity frames — which is also what
@@ -120,6 +131,7 @@ export declare class WsHost {
         ratePerSecond: number;
         burst: number;
     } | null;
+    readonly isPrincipalValid: (principal: Principal) => boolean;
     readonly activity: ActivityRuntime | null;
     readonly toolPermissions: ToolPermissions | null;
     /** Scoped instruments, resolved once — `[ws]` is the existing log prefix. */
@@ -130,6 +142,7 @@ export declare class WsHost {
     private readonly turnsFailed;
     private readonly wsErrors;
     private readonly connectionsRefused;
+    private readonly authorizationExpiryTimer;
     constructor(options: WsHostOptions);
     /** A metering bucket for one new connection, or null when metering is off. */
     newRateLimiter(): FrameRateLimiter | null;
@@ -167,6 +180,15 @@ export declare class WsHost {
     reportAbnormalClose(code: number): void;
     /** Fan a frame out to every attached client (size-bounded per frame). */
     sendToClients(msg: ServerMessage): void;
+    /**
+     * Apply principal-store revocation to every in-memory authority boundary.
+     * Running turns are marked but deliberately not aborted.
+     */
+    revokePrincipals(principalIds: readonly string[], code: number, reason: string): void;
+    /** Route expiry through the same full boundary as explicit revocation. */
+    expireAuthorizationContexts(now?: number): void;
+    /** Stop host-owned timers during application/test teardown. */
+    close(): void;
     /** Send a frame to one specific socket (size-bounded). */
     sendMessage(ws: WSContext, msg: ServerMessage): void;
 }

package/dist/ws/host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/ws/host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAU,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,iCAAiC,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrG;AAQD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,QAAmB,CAAC;AACjD,eAAO,MAAM,eAAe,QAAmB,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,QAAQ,EAAE,eAAe,CAAC;IAC1B,+DAA+D;IAC/D,OAAO,EAAE,cAAc,CAAC;IACxB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,MAAM,CAAC;IACrC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,4CAA4C;IAC5C,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM9E;AAED;;;;;GAKG;AACH,qBAAa,MAAM;IACjB,QAAQ,CAAC,WAAW,kBAAyB;IAC7C,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,qBAAqB,EAAE,MAAM,MAAM,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,eAAe,GAAG,IAAI,CAAC;IACjD,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAE5B;IACF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAE3B;IACF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAE7B;IACF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAE1B;IACF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAEvB;IACF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEjC;gBAEU,OAAO,EAAE,aAAa;IAoClC,8EAA8E;IAC9E,cAAc,IAAI,gBAAgB,GAAG,IAAI;IAIzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IASzD,mFAAmF;IACnF,uBAAuB,IAAI,IAAI;IAY/B,4EAA4E;IAC5E,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAS7C,6EAA6E;IAC7E,mBAAmB,CAAC,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IASnE;;;;;;;;OAQG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAe1E;;;;;OAKG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IASvC,yEAAyE;IACzE,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI;IAYvC,0DAA0D;IAC1D,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,GAAG,IAAI;CAGrD"}
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/ws/host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAU,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB,gFAAgF;IAChF,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACjD,wEAAwE;IACxE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,iCAAiC,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrG;AAWD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,QAAmB,CAAC;AACjD,eAAO,MAAM,eAAe,QAAmB,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,QAAQ,EAAE,eAAe,CAAC;IAC1B,+DAA+D;IAC/D,OAAO,EAAE,cAAc,CAAC;IACxB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,MAAM,CAAC;IACrC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,4CAA4C;IAC5C,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM9E;AAED;;;;;GAKG;AACH,qBAAa,MAAM;IACjB,QAAQ,CAAC,WAAW,kBAAyB;IAC7C,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,qBAAqB,EAAE,MAAM,MAAM,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC;IAC7D,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,eAAe,GAAG,IAAI,CAAC;IACjD,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAE5B;IACF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAE3B;IACF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAE7B;IACF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAE1B;IACF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAEvB;IACF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEjC;IACF,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAiC;gBAE9D,OAAO,EAAE,aAAa;IA4ClC,8EAA8E;IAC9E,cAAc,IAAI,gBAAgB,GAAG,IAAI;IAIzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IASzD,mFAAmF;IACnF,uBAAuB,IAAI,IAAI;IAY/B,4EAA4E;IAC5E,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAS7C,6EAA6E;IAC7E,mBAAmB,CAAC,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IASnE;;;;;;;;OAQG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAe1E;;;;;OAKG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IASvC,yEAAyE;IACzE,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI;IAYvC;;;OAGG;IACH,gBAAgB,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAcrF,0EAA0E;IAC1E,2BAA2B,CAAC,GAAG,SAAa,GAAG,IAAI;IAUnD,+DAA+D;IAC/D,KAAK,IAAI,IAAI;IAIb,0DAA0D;IAC1D,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,GAAG,IAAI;CAGrD"}

package/dist/ws/host.js

@@ -6,6 +6,9 @@ import { FrameRateLimiter } from "./rate-limit.js";
 const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
 /** Default cap on concurrently RUNNING sessions (MAX_CONCURRENT_SESSIONS). */
 const DEFAULT_MAX_CONCURRENT_SESSIONS = 3;
+const AUTHORIZATION_EXPIRY_SWEEP_MS = 1_000;
+const SESSION_EXPIRED_CLOSE_CODE = 1008;
+const SESSION_EXPIRED_CLOSE_REASON = "Session expired";
 /**
  * Budget for the host-side follow-up queue of ONE session (backends without a
  * native `followUp`; with one, messages go into the running turn and none of
@@ -56,6 +59,7 @@ export class WsHost {
     maxConcurrentSessions;
     observability;
     wsRate;
+    isPrincipalValid;
     activity;
     toolPermissions;
     /** Scoped instruments, resolved once — `[ws]` is the existing log prefix. */
@@ -66,8 +70,11 @@ export class WsHost {
     turnsFailed;
     wsErrors;
     connectionsRefused;
+    authorizationExpiryTimer;
     constructor(options) {
-        this.clients = new ClientSet(options.wsMaxConnections);
+        this.clients = new ClientSet(options.wsMaxConnections, (principalIds) => {
+            this.coordinator.invalidateAuthorizations(principalIds);
+        });
         this.registry = options.registry;
         this.catalog = options.catalog;
         this.appName = options.appName ?? "Brain UI";
@@ -77,6 +84,7 @@ export class WsHost {
         this.observability = options.observability ?? createSilentObservability();
         this.wsRate =
             options.wsRate && options.wsRate.ratePerSecond > 0 ? options.wsRate : null;
+        this.isPrincipalValid = options.isPrincipalValid ?? (() => true);
         this.activity = options.activity ?? null;
         this.toolPermissions = options.toolPermissions ?? null;
         this.log = this.observability.logger("ws");
@@ -100,6 +108,8 @@ export class WsHost {
             description: "WebSocket connections refused before admission",
         });
         this.coordinator.log = this.log;
+        this.authorizationExpiryTimer = setInterval(() => this.expireAuthorizationContexts(), AUTHORIZATION_EXPIRY_SWEEP_MS);
+        this.authorizationExpiryTimer.unref?.();
     }
     /** A metering bucket for one new connection, or null when metering is off. */
     newRateLimiter() {
@@ -200,6 +210,34 @@ export class WsHost {
             });
         });
     }
+    /**
+     * Apply principal-store revocation to every in-memory authority boundary.
+     * Running turns are marked but deliberately not aborted.
+     */
+    revokePrincipals(principalIds, code, reason) {
+        const revoked = new Set(principalIds);
+        if (revoked.size === 0)
+            return;
+        const affectedRunning = this.coordinator.revokePrincipals(revoked);
+        for (const principalId of revoked) {
+            this.clients.closeFor(principalId, code, reason);
+            this.activity?.stream.dropFor(principalId);
+            this.activity?.pushSender?.unbindPrincipal(principalId);
+        }
+        for (const turn of affectedRunning) {
+            turn.recorder?.recordPrincipalRevocation(turn.principalId);
+        }
+    }
+    /** Route expiry through the same full boundary as explicit revocation. */
+    expireAuthorizationContexts(now = Date.now()) {
+        const expired = new Set();
+        this.coordinator.collectExpiredPrincipalIds(now, expired);
+        this.revokePrincipals([...expired], SESSION_EXPIRED_CLOSE_CODE, SESSION_EXPIRED_CLOSE_REASON);
+    }
+    /** Stop host-owned timers during application/test teardown. */
+    close() {
+        clearInterval(this.authorizationExpiryTimer);
+    }
     /** Send a frame to one specific socket (size-bounded). */
     sendMessage(ws, msg) {
         sendTo(ws, msg);