@seatlayer/js 0.38.0 → 0.40.0

package/dist/index.cjs

@@ -436,796 +436,875 @@ module.exports = __toCommonJS(index_exports);
 // src/SeatingChart.ts
 var import_core = require("@seatlayer/core");
 
-// src/api.ts
-var ApiError = class extends Error {
-  constructor(status, message, code, conflicts, reason) {
-    super(message);
-    this.name = "ApiError";
-    this.status = status;
-    this.code = code;
-    this.conflicts = conflicts;
-    this.reason = reason;
-  }
-};
-var OBJECT_UNAVAILABLE_CODES = {
-  seat_conflict: "taken",
-  conflict: "taken",
-  channel_assignment_conflict: "ineligible",
-  allocation_exhausted: "exhausted"
-};
-var PubApi = class {
-  constructor(base, options = {}) {
-    this.base = base;
-    this.viewerId = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `viewer_${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
-    this.access = options.access;
-    this.onObjectUnavailable = options.onObjectUnavailable;
-  }
-  /** True when this client is bound to a buyer access session. */
-  get accessScoped() {
-    return !!this.access?.configured;
-  }
-  async request(path, init = {}, retried = false) {
-    const method = init.method ?? "GET";
-    const headers = {};
-    let body;
-    if (init.body !== void 0) {
-      headers["Content-Type"] = "application/json";
-      body = JSON.stringify(init.body);
-    }
-    const authorization = await this.access?.authorization(retried ? "unauthorized" : "initial");
-    if (authorization) headers.Authorization = authorization;
-    const res = await fetch(`${this.base}${path}`, { method, headers, body, credentials: "omit" });
-    const isJson = (res.headers.get("content-type") ?? "").includes("application/json");
-    const data = isJson ? await res.json().catch(() => null) : null;
-    if (!res.ok) {
-      const err = data;
-      const code = err?.code ?? err?.error;
-      if (this.access?.configured && (res.status === 401 || res.status === 403 || res.status === 422)) {
-        const refreshed = await this.access.handleFailure(res.status, code);
-        if (refreshed && !retried) return this.request(path, init, true);
-      }
-      if (res.status === 409) {
-        const reason = code ? OBJECT_UNAVAILABLE_CODES[code] : void 0;
-        const labels = err?.conflicts?.map((c) => c.label) ?? init.labels ?? [];
-        if (reason) this.onObjectUnavailable?.({ labels, reason, code });
-      }
-      throw new ApiError(
-        res.status,
-        err?.error ?? `request_failed_${res.status}`,
-        code,
-        err?.conflicts,
-        err?.reason
-      );
+// src/buyerRealtime.ts
+var SEATLAYER_V1 = "seatlayer.v1";
+var SEP = "\0";
+var CLOSE_ACCESS_REVOKED = 4401;
+var MAX_BACKOFF_MS = 15e3;
+var PING_INTERVAL_MS = 25e3;
+var PONG_GRACE_MS = 1e4;
+var RESUME_ANSWER_GRACE_MS = 5e3;
+function projectionFromSnapshot(frame) {
+  const fallback = typeof frame.default === "string" ? frame.default : "free";
+  const exceptions = {};
+  if (frame.seats && typeof frame.seats === "object") {
+    for (const [label, status] of Object.entries(frame.seats)) {
+      if (typeof status === "string" && status !== fallback) exceptions[label] = status;
     }
-    return data;
-  }
-  chart(key) {
-    return this.request(`/pub/events/${encodeURIComponent(key)}/chart`);
-  }
-  objects(key) {
-    return this.request(`/pub/events/${encodeURIComponent(key)}/objects`);
   }
-  hold(key, selections, ttlMs, replaceHoldId) {
-    return this.request(`/pub/events/${encodeURIComponent(key)}/hold`, {
-      method: "POST",
-      body: { selections, ...ttlMs ? { ttlMs } : {}, ...replaceHoldId ? { replaceHoldId } : {} },
-      labels: selections.map((s) => s.label)
-    });
+  return { default: fallback, exceptions };
+}
+function diffProjections(prev, next) {
+  if (!prev || prev.default !== next.default) return null;
+  const changes = [];
+  for (const [label, status] of Object.entries(next.exceptions)) {
+    if (prev.exceptions[label] !== status) changes.push({ label, status });
   }
-  // `zoneId` scopes the pick to one zone and `ttlMs` carries the host's checkout
-  // window — both are part of the route contract, and dropping either here made
-  // the SDK quietly pick venue-wide and hold for the server default instead.
-  bestAvailable(key, qty, categoryKey, zoneId, ttlMs) {
-    return this.request(`/pub/events/${encodeURIComponent(key)}/best-available`, {
-      method: "POST",
-      body: { qty, ...categoryKey ? { categoryKey } : {}, ...zoneId ? { zoneId } : {}, ...ttlMs ? { ttlMs } : {} }
-    });
+  for (const label of Object.keys(prev.exceptions)) {
+    if (!(label in next.exceptions)) changes.push({ label, status: next.default });
   }
-  resume(key, holdId) {
-    return this.request(`/pub/events/${encodeURIComponent(key)}/hold/resume`, {
-      method: "POST",
-      body: { holdId }
-    });
+  return changes;
+}
+function applyChanges(projection, changes) {
+  for (const change of changes) {
+    if (change.status === projection.default) delete projection.exceptions[change.label];
+    else projection.exceptions[change.label] = change.status;
   }
-  release(key, labels, holdId) {
-    return this.request(`/pub/events/${encodeURIComponent(key)}/release`, {
-      method: "POST",
-      body: { labels, holdId }
-    });
+}
+function assertCredentialFreeUrl(url) {
+  if (/(?:^|[?&#])(?:token|access_token|bearer|authorization|ticket|tkt|bse)=/i.test(url)) {
+    throw new Error("seatlayer: refusing to open a socket with a credential in the URL");
   }
-  /** P4 "need more time?": push an active hold's expiry out. Throws ApiError 409
-   *  (reason: expired | extend_limit | not_found | not_active) if it can't. */
-  extend(key, holdId, ttlMs) {
-    return this.request(`/pub/events/${encodeURIComponent(key)}/extend`, {
-      method: "POST",
-      body: { holdId, ...ttlMs ? { ttlMs } : {} }
-    });
+  if (/\bbse_[A-Za-z0-9._-]+/.test(url)) {
+    throw new Error("seatlayer: refusing to open a socket with a credential in the URL");
   }
-  /**
-   * Which gateways this event can actually take money through — the question
-   * `checkout: 'hosted'` has to answer BEFORE it shows a buyer a Pay button, so
-   * the answer is never discovered by failing a payment.
-   *
-   * Anonymous, and it discloses no account, key, mode or currency for a gateway
-   * that did not match.
-   */
-  paymentOptions(key) {
-    return this.request(`/pub/events/${encodeURIComponent(key)}/payment-options`);
+}
+var BuyerRealtimeClient = class {
+  constructor(options) {
+    this.ws = null;
+    this.stopped = true;
+    this.attempt = 0;
+    this.reconnectTimer = null;
+    this.pingTimer = null;
+    this.pongTimer = null;
+    this.resumeTimer = null;
+    /** Our model of this scope's projection. Null until the first snapshot. */
+    this.projection = null;
+    /** Last `snapshotVersion` seen on any frame that carried one — the resume point. */
+    this.version = null;
+    /** True once the 101 echoed `seatlayer.v1`. */
+    this.v1 = false;
+    /** Set when we offered v1 and the handshake came back without it — a proxy
+     *  most likely stripped the header, so the next attempt selects the v1 frame
+     *  format with the `?pv=1` marker instead (protocol doc §1). The marker
+     *  selects a format and can never carry a credential or widen a scope. */
+    this.useQueryMarker = false;
+    this.hidden = null;
+    this.closedSections = null;
+    this.opts = options;
+    assertCredentialFreeUrl(options.url);
   }
-  /**
-   * Turn a live hold into an order and start a payment.
-   *
-   * The amount is NOT sent: the server recomputes it from the hold's own items,
-   * which is the only reason a browser cannot alter what it pays. Nor is the
-   * PROVIDER — the event row decides which gateway charges, and a `provider` in
-   * the body is checked rather than obeyed (409 `provider_mismatch`). Omitting
-   * it is the shape that cannot disagree.
-   */
-  startCheckout(key, input) {
-    return this.request(`/pub/events/${encodeURIComponent(key)}/checkout`, {
-      method: "POST",
-      body: input
-    });
+  /** Negotiated protocol, for tests and diagnostics. */
+  get protocol() {
+    return this.ws ? this.v1 ? "v1" : "legacy" : null;
   }
-  /**
-   * Poll an order while its gateway webhook lands. The order id is an
-   * unguessable token the buyer already holds, so it acts as the capability —
-   * which is also why a buyer returning from a gateway page can be told what
-   * happened with nothing but the id in the return URL.
-   */
-  orderStatus(orderId) {
-    return this.request(`/pub/orders/${encodeURIComponent(orderId)}/status`);
+  get snapshotVersion() {
+    return this.version;
   }
-  /**
-   * Mint a one-use subscribe ticket for the next socket attempt (protocol doc
-   * §3). The bearer travels here, over ordinary HTTPS where CORS and Origin
-   * already apply; the socket then carries only the short-lived ticket, in its
-   * subprotocol list. TTL ≤ 30s, single redemption — mint one per attempt.
-   */
-  subscribeTicket(key) {
-    return this.request(`/pub/events/${encodeURIComponent(key)}/subscribe-tickets`, {
-      method: "POST",
-      body: {}
-    });
+  start() {
+    if (!this.stopped) return;
+    this.stopped = false;
+    void this.connect();
   }
-  /**
-   * The subscribe URL. Never carries a credential — not the bearer, not the
-   * ticket. Query parameters are diagnostics only.
-   */
-  subscribeUrl(key) {
-    const wsBase = this.base.replace(/^http/, "ws");
-    const params = new URLSearchParams({ surface: "picker", viewerId: this.viewerId });
-    return `${wsBase}/pub/events/${encodeURIComponent(key)}/subscribe?${params}`;
+  /** Stop for good (destroy, or a revocation). Safe to call twice. */
+  stop() {
+    this.stopped = true;
+    this.clearTimers();
+    const ws = this.ws;
+    this.ws = null;
+    if (ws) {
+      ws.onopen = null;
+      ws.onmessage = null;
+      ws.onclose = null;
+      ws.onerror = null;
+      try {
+        ws.close();
+      } catch {
+      }
+    }
   }
-  /**
-   * What PickerController opens its own socket with.
-   *
-   * Empty for an access-scoped client: a private scope authenticates with a
-   * subprotocol ticket, which a URL-only constructor cannot carry, so the SDK's
-   * BuyerRealtimeClient owns that socket instead and the controller skips its
-   * own (an empty URL is its documented "no live feed" contract). A tokenless
-   * public client returns exactly the URL it always has, so nothing about the
-   * public picker's realtime path changes.
-   */
-  socketUrl(key) {
-    return this.accessScoped ? "" : this.subscribeUrl(key);
+  /** Restart after the host re-authorized a revoked buyer (`refreshAccess()`). */
+  restart() {
+    this.stop();
+    this.projection = null;
+    this.version = null;
+    this.attempt = 0;
+    this.start();
   }
-};
-
-// src/buyerAccess.ts
-var BuyerAccessUnavailableError = class extends Error {
-  constructor(event) {
-    super(`buyer_access_unavailable:${event.reason}`);
-    this.name = "BuyerAccessUnavailableError";
-    this.reason = event.reason;
-    this.code = event.code;
-    this.status = event.status;
+  // ---- connection -----------------------------------------------------------
+  async connect() {
+    if (this.stopped) return;
+    let protocols = [SEATLAYER_V1];
+    if (this.opts.mintTicket) {
+      let minted;
+      try {
+        minted = await this.opts.mintTicket();
+      } catch (err) {
+        this.reportIfAccessError(err);
+        this.scheduleReconnect();
+        return;
+      }
+      if (this.stopped) return;
+      if (minted?.protocols?.length) {
+        protocols = [...minted.protocols];
+        if (!protocols.includes(SEATLAYER_V1)) protocols.unshift(SEATLAYER_V1);
+      } else if (minted?.ticket) {
+        protocols = [SEATLAYER_V1, `tkt.${minted.ticket}`];
+      }
+    }
+    const offeredResume = this.version !== null;
+    if (offeredResume) protocols.push(`sv.${this.version}`);
+    const url = this.useQueryMarker ? `${this.opts.url}${this.opts.url.includes("?") ? "&" : "?"}pv=1` : this.opts.url;
+    assertCredentialFreeUrl(url);
+    let ws;
+    try {
+      const make = this.opts.socketFactory ?? ((u, p) => new WebSocket(u, p));
+      ws = make(url, protocols);
+    } catch {
+      this.scheduleReconnect();
+      return;
+    }
+    this.ws = ws;
+    ws.onopen = () => {
+      if (this.ws !== ws) return;
+      this.attempt = 0;
+      this.v1 = ws.protocol === SEATLAYER_V1;
+      if (!this.v1) this.useQueryMarker = true;
+      this.startKeepalive(ws);
+      if (offeredResume) {
+        this.resumeTimer = setTimeout(() => {
+          this.resumeTimer = null;
+          void this.opts.sink.resync();
+        }, RESUME_ANSWER_GRACE_MS);
+      } else {
+        void this.opts.sink.resync();
+      }
+    };
+    ws.onmessage = (event) => {
+      if (this.ws !== ws) return;
+      let parsed;
+      try {
+        parsed = JSON.parse(typeof event.data === "string" ? event.data : "");
+      } catch {
+        return;
+      }
+      if (!parsed || typeof parsed !== "object") return;
+      this.handleFrame(parsed);
+    };
+    ws.onclose = (event) => {
+      if (this.ws !== ws) return;
+      this.ws = null;
+      this.clearTimers();
+      if (event?.code === CLOSE_ACCESS_REVOKED) {
+        this.stopped = true;
+        this.opts.onAccessUnavailable?.({
+          reason: "revoked",
+          code: "access_revoked",
+          retryable: false
+        });
+        return;
+      }
+      this.scheduleReconnect();
+    };
+    ws.onerror = () => {
+      try {
+        ws.close();
+      } catch {
+      }
+    };
   }
-};
-var EXPIRED_CODES = /* @__PURE__ */ new Set(["buyer_access_expired"]);
-var RECOVERABLE = /* @__PURE__ */ new Set([
-  "paused",
-  "provider_failed",
-  "channel_denied"
-]);
-function classifyAccessFailure(status, code) {
-  switch (code) {
-    case "buyer_access_invalid":
-      return "invalid";
-    case "buyer_access_revoked":
-      return "revoked";
-    case "buyer_access_origin_mismatch":
-      return "origin_mismatch";
-    case "buyer_access_event_mismatch":
-      return "event_mismatch";
-    case "buyer_access_mode_mismatch":
-      return "mode_mismatch";
-    case "channel_access_denied":
-      return "channel_denied";
-    case "channel_paused":
-      return "paused";
-    case "invalid_channel_scope":
-      return "invalid_scope";
-    default:
-      break;
+  handleFrame(frame) {
+    const type = typeof frame.type === "string" ? frame.type : "";
+    if (frame.protocol === 1) this.v1 = true;
+    if (typeof frame.snapshotVersion === "number") this.version = frame.snapshotVersion;
+    if (type === "pong") {
+      this.clearPongTimer();
+      return;
+    }
+    if (Array.isArray(frame.hidden) || Array.isArray(frame.closed)) {
+      const hidden = Array.isArray(frame.hidden) ? frame.hidden : [];
+      const closed = Array.isArray(frame.closed) ? frame.closed : [];
+      const hKey = hidden.join(SEP);
+      const cKey = closed.join(SEP);
+      if (hKey !== this.hidden || cKey !== this.closedSections) {
+        this.hidden = hKey;
+        this.closedSections = cKey;
+        this.opts.sink.onSections?.(hidden, closed);
+      }
+    }
+    if (type === "hidden") return;
+    if (type === "presence") {
+      this.opts.sink.onPresence?.({
+        shoppingSessions: Number(frame.shoppingSessions) || 0,
+        activeHolds: Number(frame.activeHolds) || 0
+      });
+      return;
+    }
+    if (type === "allocation") {
+      return;
+    }
+    if (type === "snapshot" || !type && frame.seats) {
+      this.answered();
+      const next = projectionFromSnapshot(frame);
+      const changes = diffProjections(this.projection, next);
+      this.projection = next;
+      if (changes === null) void this.opts.sink.resync();
+      else if (changes.length) this.opts.sink.applyStatuses(changes);
+      return;
+    }
+    if (type === "delta" && Array.isArray(frame.changes)) {
+      this.answered();
+      const changes = frame.changes.filter((c) => typeof c?.label === "string" && typeof c?.status === "string").map((c) => ({ label: c.label, status: c.status }));
+      if (!changes.length) return;
+      if (this.projection) applyChanges(this.projection, changes);
+      this.opts.sink.applyStatuses(changes);
+    }
   }
-  if (status === 401) return "invalid";
-  return null;
+  /** The server answered our resume; cancel the fallback resync. */
+  answered() {
+    if (!this.resumeTimer) return;
+    clearTimeout(this.resumeTimer);
+    this.resumeTimer = null;
+  }
+  reportIfAccessError(err) {
+    const reason = err?.reason;
+    if (err?.name !== "BuyerAccessUnavailableError") return;
+    this.stopped = true;
+    this.opts.onAccessUnavailable?.({
+      reason: reason ?? "invalid",
+      code: err.code,
+      status: err.status,
+      retryable: reason === "paused"
+    });
+  }
+  // ---- keepalive & backoff --------------------------------------------------
+  /**
+   * Liveness is ping/pong, and only ping/pong. A socket that receives nothing
+   * for minutes is the normal, correct state for a narrowly-scoped buyer on a
+   * busy event (protocol doc §5), so quiet time never triggers a reconnect.
+   */
+  startKeepalive(ws) {
+    this.pingTimer = setInterval(() => {
+      if (this.ws !== ws) return;
+      try {
+        ws.send(JSON.stringify({ type: "ping" }));
+      } catch {
+        return;
+      }
+      this.clearPongTimer();
+      this.pongTimer = setTimeout(() => {
+        this.pongTimer = null;
+        try {
+          ws.close();
+        } catch {
+        }
+      }, PONG_GRACE_MS);
+    }, PING_INTERVAL_MS);
+  }
+  /**
+   * FULL jitter, not plain exponential backoff.
+   *
+   * A deterministic `2**attempt` schedule makes every browser that lost the same
+   * socket — a worker redeploy, a DO eviction, a flaky edge PoP — come back in
+   * the same millisecond, and an on-sale crowd reconnecting in lockstep is the
+   * thing that turns one blip into a self-sustaining thundering herd. Full
+   * jitter (`random() * ceiling`) spreads the same crowd across the whole
+   * window; the ceiling still doubles, so a persistent outage still backs off.
+   *
+   * `Math.random` is correct here: this is client code choosing a delay, not a
+   * Workflow step that has to replay deterministically.
+   */
+  scheduleReconnect() {
+    if (this.stopped || this.reconnectTimer) return;
+    const attempt = Math.min(this.attempt++, 5);
+    const ceiling = Math.min(1e3 * 2 ** attempt, MAX_BACKOFF_MS);
+    const delay = Math.random() * ceiling;
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      void this.connect();
+    }, delay);
+  }
+  clearPongTimer() {
+    if (!this.pongTimer) return;
+    clearTimeout(this.pongTimer);
+    this.pongTimer = null;
+  }
+  clearTimers() {
+    if (this.pingTimer) clearInterval(this.pingTimer);
+    this.pingTimer = null;
+    this.clearPongTimer();
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = null;
+    if (this.resumeTimer) clearTimeout(this.resumeTimer);
+    this.resumeTimer = null;
+  }
+};
+function rendererStatus(wire) {
+  if (wire === "blocked") return "not_for_sale";
+  if (wire === "held" || wire === "booked" || wire === "free" || wire === "not_for_sale") return wire;
+  return "free";
 }
-function isAccessExpiry(status, code) {
-  return status === 401 && !!code && EXPIRED_CODES.has(code);
+function createControllerSink(controller, options = {}) {
+  const idsForLabel = (label) => {
+    const table = controller.tableSelection(label);
+    if (table) return table.physicalSeatIds;
+    const id = controller.idForLabel(label);
+    return id ? [id] : [];
+  };
+  return {
+    applyStatuses(changes) {
+      const held = controller.currentHold()?.labels ?? [];
+      const buckets = {
+        free: [],
+        held: [],
+        booked: [],
+        not_for_sale: []
+      };
+      const flashes = [];
+      const lost = [];
+      const selected = new Map(controller.getSelection().map((s) => [s.label, s.id]));
+      for (const change of changes) {
+        const ids = idsForLabel(change.label);
+        if (!ids.length) continue;
+        const next = rendererStatus(change.status);
+        buckets[next].push(...ids);
+        if (options.flashOnLiveChange && next !== "free" && !held.includes(change.label) && ids.some((id) => controller.getStatus(id) === "free")) {
+          const color = next === "held" ? "#f4b740" : "#f43f5e";
+          for (const id of ids) flashes.push({ id, color });
+        }
+        if (next !== "free" && !held.includes(change.label) && selected.has(change.label)) {
+          lost.push(change.label);
+        }
+      }
+      for (const status of ["free", "held", "booked", "not_for_sale"]) {
+        if (buckets[status].length) controller.setStatus(buckets[status], status);
+      }
+      for (const flash of flashes) controller.flashSeat(flash.id, flash.color);
+      if (lost.length) {
+        const ids = lost.flatMap((label) => idsForLabel(label));
+        if (ids.length) controller.deselect(ids);
+        const ineligible = changes.some(
+          (c) => c.status === "blocked" && lost.includes(c.label)
+        );
+        options.onSelectedObjectUnavailable?.(lost, ineligible ? "ineligible" : "taken");
+      }
+      options.onStatusChange?.();
+    },
+    async resync() {
+      await controller.refresh();
+    },
+    /**
+     * Section availability moved. Statuses are re-pulled so the map repaints.
+     *
+     * Known limit: rebuilding the chart when a section is newly HIDDEN (its
+     * seats are stripped, not greyed) lives inside PickerController's own
+     * socket handler and has no public entry point, so an access-scoped picker
+     * repaints statuses but does not restructure the chart until its next
+     * mount. Closing/opening a section — the common mid-sale move — is a
+     * status-level change and is handled here in full.
+     */
+    onSections(hidden, closed) {
+      void controller.refresh();
+      options.onSections?.(hidden, closed);
+    }
+  };
 }
-var DEFAULT_SKEW_MS = 3e4;
-var _token, _expiresAt, _provider, _skewMs, _inflight, _terminal, _lastFailure, _onExpired, _onUnavailable, _configured, _BuyerAccessContext_instances, accept_fn, renew_fn, fail_fn;
-var BuyerAccessContext = class {
-  constructor(options) {
-    __privateAdd(this, _BuyerAccessContext_instances);
-    /** Private field: not enumerable, not spreadable, not serializable. */
-    __privateAdd(this, _token, null);
-    __privateAdd(this, _expiresAt, 0);
-    __privateAdd(this, _provider);
-    __privateAdd(this, _skewMs);
-    __privateAdd(this, _inflight, null);
-    __privateAdd(this, _terminal, null);
-    /** The most recent failure, terminal or not — so one cause reports once. */
-    __privateAdd(this, _lastFailure, null);
-    __privateAdd(this, _onExpired);
-    __privateAdd(this, _onUnavailable);
-    /** Decided once, at construction. See the `configured` getter. */
-    __privateAdd(this, _configured, false);
-    __privateSet(this, _provider, options.provider);
-    __privateSet(this, _skewMs, options.skewMs ?? DEFAULT_SKEW_MS);
-    __privateSet(this, _onExpired, options.onExpired);
-    __privateSet(this, _onUnavailable, options.onUnavailable);
-    if (options.token) {
-      const seed = typeof options.token === "string" ? { token: options.token } : options.token;
-      __privateMethod(this, _BuyerAccessContext_instances, accept_fn).call(this, seed);
+
+// src/api.ts
+var ApiError = class extends Error {
+  constructor(status, message, code, conflicts, reason, retryAfterS) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code;
+    this.conflicts = conflicts;
+    this.reason = reason;
+    this.retryAfterS = retryAfterS;
+  }
+};
+var MAX_RATE_LIMIT_WAIT_S = 10;
+var DEFAULT_RATE_LIMIT_WAIT_S = 1;
+function parseRetryAfter(header, bodyValue) {
+  const raw = (header ?? "").trim();
+  if (raw) {
+    const seconds = Number(raw);
+    if (Number.isFinite(seconds) && seconds >= 0) return Math.ceil(seconds);
+    const at = Date.parse(raw);
+    if (Number.isFinite(at)) return Math.max(0, Math.ceil((at - Date.now()) / 1e3));
+  }
+  if (typeof bodyValue === "number" && Number.isFinite(bodyValue) && bodyValue >= 0) {
+    return Math.ceil(bodyValue);
+  }
+  return void 0;
+}
+var OBJECT_UNAVAILABLE_CODES = {
+  seat_conflict: "taken",
+  conflict: "taken",
+  channel_assignment_conflict: "ineligible",
+  allocation_exhausted: "exhausted"
+};
+var PubApi = class {
+  constructor(base, options = {}) {
+    this.base = base;
+    this.viewerId = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `viewer_${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
+    this.access = options.access;
+    this.onObjectUnavailable = options.onObjectUnavailable;
+  }
+  /** True when this client is bound to a buyer access session. */
+  get accessScoped() {
+    return !!this.access?.configured;
+  }
+  async request(path, init = {}, retried = {}) {
+    const method = init.method ?? "GET";
+    const headers = {};
+    let body;
+    if (init.body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(init.body);
     }
-    __privateSet(this, _configured, !!__privateGet(this, _provider) || !!__privateGet(this, _token));
+    const authorization = await this.access?.authorization(retried.auth ? "unauthorized" : "initial");
+    if (authorization) headers.Authorization = authorization;
+    const res = await fetch(`${this.base}${path}`, { method, headers, body, credentials: "omit" });
+    const isJson = (res.headers.get("content-type") ?? "").includes("application/json");
+    const data = isJson ? await res.json().catch(() => null) : null;
+    if (!res.ok) {
+      const err = data;
+      const code = err?.code ?? err?.error;
+      if (this.access?.configured && (res.status === 401 || res.status === 403 || res.status === 422)) {
+        const refreshed = await this.access.handleFailure(res.status, code);
+        if (refreshed && !retried.auth) return this.request(path, init, { ...retried, auth: true });
+      }
+      if (res.status === 409) {
+        const reason = code ? OBJECT_UNAVAILABLE_CODES[code] : void 0;
+        const labels = err?.conflicts?.map((c) => c.label) ?? init.labels ?? [];
+        if (reason) this.onObjectUnavailable?.({ labels, reason, code });
+      }
+      let retryAfterS;
+      if (res.status === 429) {
+        retryAfterS = parseRetryAfter(res.headers.get("Retry-After"), err?.retryAfterSeconds) ?? DEFAULT_RATE_LIMIT_WAIT_S;
+        if (method === "GET" && !retried.rateLimit && retryAfterS <= MAX_RATE_LIMIT_WAIT_S) {
+          await new Promise((resolve) => setTimeout(resolve, retryAfterS * 1e3));
+          return this.request(path, init, { ...retried, rateLimit: true });
+        }
+      }
+      throw new ApiError(
+        res.status,
+        err?.error ?? `request_failed_${res.status}`,
+        code,
+        err?.conflicts,
+        err?.reason,
+        retryAfterS
+      );
+    }
+    return data;
+  }
+  chart(key) {
+    return this.request(`/pub/events/${encodeURIComponent(key)}/chart`);
+  }
+  objects(key) {
+    return this.request(`/pub/events/${encodeURIComponent(key)}/objects`);
+  }
+  hold(key, selections, ttlMs, replaceHoldId) {
+    return this.request(`/pub/events/${encodeURIComponent(key)}/hold`, {
+      method: "POST",
+      body: { selections, ...ttlMs ? { ttlMs } : {}, ...replaceHoldId ? { replaceHoldId } : {} },
+      labels: selections.map((s) => s.label)
+    });
+  }
+  // `zoneId` scopes the pick to one zone and `ttlMs` carries the host's checkout
+  // window — both are part of the route contract, and dropping either here made
+  // the SDK quietly pick venue-wide and hold for the server default instead.
+  bestAvailable(key, qty, categoryKey, zoneId, ttlMs) {
+    return this.request(`/pub/events/${encodeURIComponent(key)}/best-available`, {
+      method: "POST",
+      body: { qty, ...categoryKey ? { categoryKey } : {}, ...zoneId ? { zoneId } : {}, ...ttlMs ? { ttlMs } : {} }
+    });
+  }
+  resume(key, holdId) {
+    return this.request(`/pub/events/${encodeURIComponent(key)}/hold/resume`, {
+      method: "POST",
+      body: { holdId }
+    });
+  }
+  release(key, labels, holdId) {
+    return this.request(`/pub/events/${encodeURIComponent(key)}/release`, {
+      method: "POST",
+      body: { labels, holdId }
+    });
+  }
+  /** P4 "need more time?": push an active hold's expiry out. Throws ApiError 409
+   *  (reason: expired | extend_limit | not_found | not_active) if it can't. */
+  extend(key, holdId, ttlMs) {
+    return this.request(`/pub/events/${encodeURIComponent(key)}/extend`, {
+      method: "POST",
+      body: { holdId, ...ttlMs ? { ttlMs } : {} }
+    });
   }
   /**
-   * True when this picker is access-scoped at all. A false here is the
-   * tokenless public picker, which must behave exactly as it always has.
+   * Which gateways this event can actually take money through — the question
+   * `checkout: 'hosted'` has to answer BEFORE it shows a buyer a Pay button, so
+   * the answer is never discovered by failing a payment.
    *
-   * Answered from what the HOST asked for, never from live token state. It used
-   * to be `!!#provider || !!#token`, which quietly inverted this file's central
-   * rule for a one-shot `buyerAccessToken` host: `#fail()` clears `#token`, so
-   * the first refusal turned a configured context into an "unconfigured" one,
-   * `authorization()` then returned null instead of throwing, and the very next
-   * call went out with no bearer — the anonymous Public sale fallback this
-   * module exists to prevent. A provider host never saw it, because `#provider`
-   * held `configured` true. Found against a live worker in the M9 pass.
+   * Anonymous, and it discloses no account, key, mode or currency for a gateway
+   * that did not match.
    */
-  get configured() {
-    return __privateGet(this, _configured);
+  paymentOptions(key) {
+    return this.request(`/pub/events/${encodeURIComponent(key)}/payment-options`);
   }
-  /** Set once a state arrives that refreshing cannot clear. */
-  get unavailable() {
-    return __privateGet(this, _terminal);
+  /**
+   * Turn a live hold into an order and start a payment.
+   *
+   * The amount is NOT sent: the server recomputes it from the hold's own items,
+   * which is the only reason a browser cannot alter what it pays. Nor is the
+   * PROVIDER — the event row decides which gateway charges, and a `provider` in
+   * the body is checked rather than obeyed (409 `provider_mismatch`). Omitting
+   * it is the shape that cannot disagree.
+   */
+  startCheckout(key, input) {
+    return this.request(`/pub/events/${encodeURIComponent(key)}/checkout`, {
+      method: "POST",
+      body: input
+    });
   }
-  /** True while a usable bearer is held (ignores skew). */
-  get hasToken() {
-    return !!__privateGet(this, _token) && (__privateGet(this, _expiresAt) === 0 || __privateGet(this, _expiresAt) > Date.now());
+  /**
+   * Poll an order while its gateway webhook lands. The order id is an
+   * unguessable token the buyer already holds, so it acts as the capability —
+   * which is also why a buyer returning from a gateway page can be told what
+   * happened with nothing but the id in the return URL.
+   */
+  orderStatus(orderId) {
+    return this.request(`/pub/orders/${encodeURIComponent(orderId)}/status`);
   }
-  /** Epoch ms the current token expires, or 0 when the host didn't say. */
-  get expiresAt() {
-    return __privateGet(this, _expiresAt);
+  /**
+   * Mint a one-use subscribe ticket for the next socket attempt (protocol doc
+   * §3). The bearer travels here, over ordinary HTTPS where CORS and Origin
+   * already apply; the socket then carries only the short-lived ticket, in its
+   * subprotocol list. TTL ≤ 30s, single redemption — mint one per attempt.
+   */
+  subscribeTicket(key) {
+    return this.request(`/pub/events/${encodeURIComponent(key)}/subscribe-tickets`, {
+      method: "POST",
+      body: {}
+    });
+  }
+  /**
+   * The subscribe URL. Never carries a credential — not the bearer, not the
+   * ticket. Query parameters are diagnostics only.
+   */
+  subscribeUrl(key) {
+    const wsBase = this.base.replace(/^http/, "ws");
+    const params = new URLSearchParams({ surface: "picker", viewerId: this.viewerId });
+    return `${wsBase}/pub/events/${encodeURIComponent(key)}/subscribe?${params}`;
+  }
+  /**
+   * What PickerController opens its own socket with.
+   *
+   * Empty for an access-scoped client: a private scope authenticates with a
+   * subprotocol ticket, which a URL-only constructor cannot carry, so the SDK's
+   * BuyerRealtimeClient owns that socket instead and the controller skips its
+   * own (an empty URL is its documented "no live feed" contract). A tokenless
+   * public client returns exactly the URL it always has, so nothing about the
+   * public picker's realtime path changes.
+   */
+  socketUrl(key) {
+    return this.accessScoped ? "" : this.subscribeUrl(key);
   }
   /**
-   * The `Authorization` header value for a scoped operation.
+   * The subprotocol list a PLAIN `new WebSocket(url, protocols)` must offer for
+   * this transport — `PickerTransport.socketProtocols`, which PickerController
+   * calls optionally and which nothing implemented until now.
    *
-   * Returns null only when this context is not configured at all (the ordinary
-   * anonymous public picker). A configured context either returns a bearer or
-   * throws `BuyerAccessUnavailableError` — it never returns null, because a
-   * null here would send the request as anonymous Public sale.
+   * Offering `seatlayer.v1` is the whole point: without it the DO answers an
+   * anonymous socket with the LEGACY verbose frame — every unit of a 10k-seat
+   * event, on connect and on every reconnect — instead of the compact
+   * `{default, exceptions}` form. Empty for an access-scoped client, which
+   * authenticates with a one-use ticket a URL-only constructor cannot carry and
+   * whose socket BuyerRealtimeClient owns instead (see `socketUrl`).
+   *
+   * `createRealtime` below is the preferred path and supersedes this for any
+   * host that can use it; this stays the correct answer for a host that builds
+   * the socket itself from the transport contract.
    */
-  async authorization(reason = "initial") {
-    if (!this.configured) return null;
-    if (__privateGet(this, _terminal)) throw new BuyerAccessUnavailableError(__privateGet(this, _terminal));
-    const now = Date.now();
-    const stale = !__privateGet(this, _token) || __privateGet(this, _expiresAt) > 0 && __privateGet(this, _expiresAt) - __privateGet(this, _skewMs) <= now;
-    if (stale) {
-      const expired = !!__privateGet(this, _token) && __privateGet(this, _expiresAt) > 0 && __privateGet(this, _expiresAt) <= now;
-      const why = __privateGet(this, _token) ? expired ? "expired" : "expiring" : reason;
-      const token = await __privateMethod(this, _BuyerAccessContext_instances, renew_fn).call(this, why);
-      if (!token) {
-        throw new BuyerAccessUnavailableError(
-          __privateGet(this, _terminal) ?? __privateGet(this, _lastFailure) ?? __privateMethod(this, _BuyerAccessContext_instances, fail_fn).call(this, "provider_failed")
-        );
-      }
-      return `Bearer ${token}`;
-    }
-    return `Bearer ${__privateGet(this, _token)}`;
+  socketProtocols(key) {
+    void key;
+    return this.accessScoped ? [] : [SEATLAYER_V1];
   }
   /**
-   * Handle a 401/403 from a scoped call. Returns true when the caller should
-   * retry the same request once with the refreshed bearer.
+   * Hand PickerController the v1 realtime client instead of letting it open a
+   * bare socket — `PickerTransport.createRealtime`.
+   *
+   * This is what puts an ANONYMOUS buyer (the on-sale case) on the same wire as
+   * a private-channel one: compact snapshots, `sv.<n>` resume so a reconnect
+   * inside the ring costs a delta rather than a full re-snapshot, ping/pong
+   * liveness, and one jittered backoff implementation shared by both. The
+   * anonymous case simply passes no `mintTicket` — the `/pub/events/:key/
+   * subscribe` upgrade requires no ticket, and the DO resolves a ticketless
+   * socket to the public scope.
+   *
+   * Null when access-scoped: that socket is owned by the widget's own
+   * BuyerRealtimeClient (with the ticket exchange), and `socketUrl()` already
+   * returns '' so the controller opens nothing.
    */
-  async handleFailure(status, code) {
-    var _a;
-    if (!this.configured) return false;
-    if (isAccessExpiry(status, code)) {
-      __privateSet(this, _token, null);
-      __privateSet(this, _expiresAt, 0);
-      const token = await __privateMethod(this, _BuyerAccessContext_instances, renew_fn).call(this, "unauthorized", code);
-      (_a = __privateGet(this, _onExpired)) == null ? void 0 : _a.call(this, { reason: "unauthorized", code, refreshed: !!token });
-      return !!token;
-    }
-    const reason = classifyAccessFailure(status, code);
-    if (reason) {
-      __privateMethod(this, _BuyerAccessContext_instances, fail_fn).call(this, reason, code, status);
-      return false;
-    }
-    return false;
-  }
-  /** Host-driven re-acquisition (after the buyer signs in again, say). */
-  async refresh(reason = "manual") {
-    __privateSet(this, _terminal, null);
-    __privateSet(this, _lastFailure, null);
-    __privateSet(this, _token, null);
-    __privateSet(this, _expiresAt, 0);
-    return !!await __privateMethod(this, _BuyerAccessContext_instances, renew_fn).call(this, reason);
-  }
-  /** Drop the bearer. Called on destroy so nothing outlives the widget. */
-  clear() {
-    __privateSet(this, _token, null);
-    __privateSet(this, _expiresAt, 0);
-    __privateSet(this, _inflight, null);
-  }
-  /** Redaction: the bearer must not survive a stringify or an interpolation. */
-  toJSON() {
-    return { configured: this.configured, hasToken: this.hasToken };
-  }
-  toString() {
-    return "[BuyerAccessContext redacted]";
-  }
-};
-_token = new WeakMap();
-_expiresAt = new WeakMap();
-_provider = new WeakMap();
-_skewMs = new WeakMap();
-_inflight = new WeakMap();
-_terminal = new WeakMap();
-_lastFailure = new WeakMap();
-_onExpired = new WeakMap();
-_onUnavailable = new WeakMap();
-_configured = new WeakMap();
-_BuyerAccessContext_instances = new WeakSet();
-// ---- internals ------------------------------------------------------------
-accept_fn = function(next) {
-  if (!next || typeof next.token !== "string" || !next.token) return null;
-  __privateSet(this, _token, next.token);
-  __privateSet(this, _expiresAt, typeof next.expiresAt === "number" ? next.expiresAt : 0);
-  return __privateGet(this, _token);
-};
-/**
- * One provider call at a time. Several operations racing an expiry (chart +
- * objects + a socket ticket) must not mint several sessions — the guide's
- * rotate-on-retry rule would revoke the ones they didn't observe.
- */
-renew_fn = function(reason, code) {
-  if (__privateGet(this, _inflight)) return __privateGet(this, _inflight);
-  const provider = __privateGet(this, _provider);
-  if (!provider) {
-    __privateMethod(this, _BuyerAccessContext_instances, fail_fn).call(this, "no_token", code);
-    return Promise.resolve(null);
-  }
-  const run = (async () => {
-    try {
-      const next = await provider({ reason });
-      const token = __privateMethod(this, _BuyerAccessContext_instances, accept_fn).call(this, next);
-      if (!token) {
-        __privateMethod(this, _BuyerAccessContext_instances, fail_fn).call(this, "provider_failed", code);
-        return null;
-      }
-      return token;
-    } catch {
-      __privateMethod(this, _BuyerAccessContext_instances, fail_fn).call(this, "provider_failed", code);
-      return null;
-    } finally {
-      __privateSet(this, _inflight, null);
-    }
-  })();
-  __privateSet(this, _inflight, run);
-  return run;
-};
-fail_fn = function(reason, code, status) {
-  var _a;
-  const event = {
-    reason,
-    code,
-    status,
-    // Unchanged: `retryable` means "the SAME request may succeed later".
-    // `provider_failed` is recoverable but not retryable — the host must fix
-    // its mint endpoint first — so the two sets are deliberately different.
-    retryable: reason === "paused" || reason === "channel_denied"
-  };
-  __privateSet(this, _lastFailure, event);
-  if (!RECOVERABLE.has(reason)) {
-    __privateSet(this, _terminal, event);
-    __privateSet(this, _token, null);
-    __privateSet(this, _expiresAt, 0);
+  createRealtime(key, sink) {
+    if (this.accessScoped) return null;
+    return new BuyerRealtimeClient({ url: this.subscribeUrl(key), sink });
   }
-  (_a = __privateGet(this, _onUnavailable)) == null ? void 0 : _a.call(this, event);
-  return event;
 };
-function createBuyerAccessContext(options, hooks = {}) {
-  if (!options.buyerAccessTokenProvider && !options.buyerAccessToken) return null;
-  return new BuyerAccessContext({
-    provider: options.buyerAccessTokenProvider,
-    token: options.buyerAccessToken,
-    ...hooks
-  });
-}
 
-// src/buyerRealtime.ts
-var SEATLAYER_V1 = "seatlayer.v1";
-var SEP = "\0";
-var CLOSE_ACCESS_REVOKED = 4401;
-var MAX_BACKOFF_MS = 15e3;
-var PING_INTERVAL_MS = 25e3;
-var PONG_GRACE_MS = 1e4;
-var RESUME_ANSWER_GRACE_MS = 5e3;
-function projectionFromSnapshot(frame) {
-  const fallback = typeof frame.default === "string" ? frame.default : "free";
-  const exceptions = {};
-  if (frame.seats && typeof frame.seats === "object") {
-    for (const [label, status] of Object.entries(frame.seats)) {
-      if (typeof status === "string" && status !== fallback) exceptions[label] = status;
-    }
-  }
-  return { default: fallback, exceptions };
-}
-function diffProjections(prev, next) {
-  if (!prev || prev.default !== next.default) return null;
-  const changes = [];
-  for (const [label, status] of Object.entries(next.exceptions)) {
-    if (prev.exceptions[label] !== status) changes.push({ label, status });
-  }
-  for (const label of Object.keys(prev.exceptions)) {
-    if (!(label in next.exceptions)) changes.push({ label, status: next.default });
+// src/buyerAccess.ts
+var BuyerAccessUnavailableError = class extends Error {
+  constructor(event) {
+    super(`buyer_access_unavailable:${event.reason}`);
+    this.name = "BuyerAccessUnavailableError";
+    this.reason = event.reason;
+    this.code = event.code;
+    this.status = event.status;
   }
-  return changes;
-}
-function applyChanges(projection, changes) {
-  for (const change of changes) {
-    if (change.status === projection.default) delete projection.exceptions[change.label];
-    else projection.exceptions[change.label] = change.status;
+};
+var EXPIRED_CODES = /* @__PURE__ */ new Set(["buyer_access_expired"]);
+var RECOVERABLE = /* @__PURE__ */ new Set([
+  "paused",
+  "provider_failed",
+  "channel_denied"
+]);
+function classifyAccessFailure(status, code) {
+  switch (code) {
+    case "buyer_access_invalid":
+      return "invalid";
+    case "buyer_access_revoked":
+      return "revoked";
+    case "buyer_access_origin_mismatch":
+      return "origin_mismatch";
+    case "buyer_access_event_mismatch":
+      return "event_mismatch";
+    case "buyer_access_mode_mismatch":
+      return "mode_mismatch";
+    case "channel_access_denied":
+      return "channel_denied";
+    case "channel_paused":
+      return "paused";
+    case "invalid_channel_scope":
+      return "invalid_scope";
+    default:
+      break;
   }
+  if (status === 401) return "invalid";
+  return null;
 }
-function assertCredentialFreeUrl(url) {
-  if (/(?:^|[?&#])(?:token|access_token|bearer|authorization|ticket|tkt|bse)=/i.test(url)) {
-    throw new Error("seatlayer: refusing to open a socket with a credential in the URL");
-  }
-  if (/\bbse_[A-Za-z0-9._-]+/.test(url)) {
-    throw new Error("seatlayer: refusing to open a socket with a credential in the URL");
-  }
+function isAccessExpiry(status, code) {
+  return status === 401 && !!code && EXPIRED_CODES.has(code);
 }
-var BuyerRealtimeClient = class {
+var DEFAULT_SKEW_MS = 3e4;
+var _token, _expiresAt, _provider, _skewMs, _inflight, _terminal, _lastFailure, _onExpired, _onUnavailable, _configured, _BuyerAccessContext_instances, accept_fn, renew_fn, fail_fn;
+var BuyerAccessContext = class {
   constructor(options) {
-    this.ws = null;
-    this.stopped = true;
-    this.attempt = 0;
-    this.reconnectTimer = null;
-    this.pingTimer = null;
-    this.pongTimer = null;
-    this.resumeTimer = null;
-    /** Our model of this scope's projection. Null until the first snapshot. */
-    this.projection = null;
-    /** Last `snapshotVersion` seen on any frame that carried one — the resume point. */
-    this.version = null;
-    /** True once the 101 echoed `seatlayer.v1`. */
-    this.v1 = false;
-    /** Set when we offered v1 and the handshake came back without it — a proxy
-     *  most likely stripped the header, so the next attempt selects the v1 frame
-     *  format with the `?pv=1` marker instead (protocol doc §1). The marker
-     *  selects a format and can never carry a credential or widen a scope. */
-    this.useQueryMarker = false;
-    this.hidden = null;
-    this.closedSections = null;
-    this.opts = options;
-    assertCredentialFreeUrl(options.url);
-  }
-  /** Negotiated protocol, for tests and diagnostics. */
-  get protocol() {
-    return this.ws ? this.v1 ? "v1" : "legacy" : null;
+    __privateAdd(this, _BuyerAccessContext_instances);
+    /** Private field: not enumerable, not spreadable, not serializable. */
+    __privateAdd(this, _token, null);
+    __privateAdd(this, _expiresAt, 0);
+    __privateAdd(this, _provider);
+    __privateAdd(this, _skewMs);
+    __privateAdd(this, _inflight, null);
+    __privateAdd(this, _terminal, null);
+    /** The most recent failure, terminal or not — so one cause reports once. */
+    __privateAdd(this, _lastFailure, null);
+    __privateAdd(this, _onExpired);
+    __privateAdd(this, _onUnavailable);
+    /** Decided once, at construction. See the `configured` getter. */
+    __privateAdd(this, _configured, false);
+    __privateSet(this, _provider, options.provider);
+    __privateSet(this, _skewMs, options.skewMs ?? DEFAULT_SKEW_MS);
+    __privateSet(this, _onExpired, options.onExpired);
+    __privateSet(this, _onUnavailable, options.onUnavailable);
+    if (options.token) {
+      const seed = typeof options.token === "string" ? { token: options.token } : options.token;
+      __privateMethod(this, _BuyerAccessContext_instances, accept_fn).call(this, seed);
+    }
+    __privateSet(this, _configured, !!__privateGet(this, _provider) || !!__privateGet(this, _token));
   }
-  get snapshotVersion() {
-    return this.version;
+  /**
+   * True when this picker is access-scoped at all. A false here is the
+   * tokenless public picker, which must behave exactly as it always has.
+   *
+   * Answered from what the HOST asked for, never from live token state. It used
+   * to be `!!#provider || !!#token`, which quietly inverted this file's central
+   * rule for a one-shot `buyerAccessToken` host: `#fail()` clears `#token`, so
+   * the first refusal turned a configured context into an "unconfigured" one,
+   * `authorization()` then returned null instead of throwing, and the very next
+   * call went out with no bearer — the anonymous Public sale fallback this
+   * module exists to prevent. A provider host never saw it, because `#provider`
+   * held `configured` true. Found against a live worker in the M9 pass.
+   */
+  get configured() {
+    return __privateGet(this, _configured);
   }
-  start() {
-    if (!this.stopped) return;
-    this.stopped = false;
-    void this.connect();
+  /** Set once a state arrives that refreshing cannot clear. */
+  get unavailable() {
+    return __privateGet(this, _terminal);
   }
-  /** Stop for good (destroy, or a revocation). Safe to call twice. */
-  stop() {
-    this.stopped = true;
-    this.clearTimers();
-    const ws = this.ws;
-    this.ws = null;
-    if (ws) {
-      ws.onopen = null;
-      ws.onmessage = null;
-      ws.onclose = null;
-      ws.onerror = null;
-      try {
-        ws.close();
-      } catch {
-      }
-    }
+  /** True while a usable bearer is held (ignores skew). */
+  get hasToken() {
+    return !!__privateGet(this, _token) && (__privateGet(this, _expiresAt) === 0 || __privateGet(this, _expiresAt) > Date.now());
   }
-  /** Restart after the host re-authorized a revoked buyer (`refreshAccess()`). */
-  restart() {
-    this.stop();
-    this.projection = null;
-    this.version = null;
-    this.attempt = 0;
-    this.start();
+  /** Epoch ms the current token expires, or 0 when the host didn't say. */
+  get expiresAt() {
+    return __privateGet(this, _expiresAt);
   }
-  // ---- connection -----------------------------------------------------------
-  async connect() {
-    if (this.stopped) return;
-    let protocols = [SEATLAYER_V1];
-    if (this.opts.mintTicket) {
-      let minted;
-      try {
-        minted = await this.opts.mintTicket();
-      } catch (err) {
-        this.reportIfAccessError(err);
-        this.scheduleReconnect();
-        return;
-      }
-      if (this.stopped) return;
-      if (minted?.protocols?.length) {
-        protocols = [...minted.protocols];
-        if (!protocols.includes(SEATLAYER_V1)) protocols.unshift(SEATLAYER_V1);
-      } else if (minted?.ticket) {
-        protocols = [SEATLAYER_V1, `tkt.${minted.ticket}`];
+  /**
+   * The `Authorization` header value for a scoped operation.
+   *
+   * Returns null only when this context is not configured at all (the ordinary
+   * anonymous public picker). A configured context either returns a bearer or
+   * throws `BuyerAccessUnavailableError` — it never returns null, because a
+   * null here would send the request as anonymous Public sale.
+   */
+  async authorization(reason = "initial") {
+    if (!this.configured) return null;
+    if (__privateGet(this, _terminal)) throw new BuyerAccessUnavailableError(__privateGet(this, _terminal));
+    const now = Date.now();
+    const stale = !__privateGet(this, _token) || __privateGet(this, _expiresAt) > 0 && __privateGet(this, _expiresAt) - __privateGet(this, _skewMs) <= now;
+    if (stale) {
+      const expired = !!__privateGet(this, _token) && __privateGet(this, _expiresAt) > 0 && __privateGet(this, _expiresAt) <= now;
+      const why = __privateGet(this, _token) ? expired ? "expired" : "expiring" : reason;
+      const token = await __privateMethod(this, _BuyerAccessContext_instances, renew_fn).call(this, why);
+      if (!token) {
+        throw new BuyerAccessUnavailableError(
+          __privateGet(this, _terminal) ?? __privateGet(this, _lastFailure) ?? __privateMethod(this, _BuyerAccessContext_instances, fail_fn).call(this, "provider_failed")
+        );
       }
+      return `Bearer ${token}`;
     }
-    const offeredResume = this.version !== null;
-    if (offeredResume) protocols.push(`sv.${this.version}`);
-    const url = this.useQueryMarker ? `${this.opts.url}${this.opts.url.includes("?") ? "&" : "?"}pv=1` : this.opts.url;
-    assertCredentialFreeUrl(url);
-    let ws;
-    try {
-      const make = this.opts.socketFactory ?? ((u, p) => new WebSocket(u, p));
-      ws = make(url, protocols);
-    } catch {
-      this.scheduleReconnect();
-      return;
-    }
-    this.ws = ws;
-    ws.onopen = () => {
-      if (this.ws !== ws) return;
-      this.attempt = 0;
-      this.v1 = ws.protocol === SEATLAYER_V1;
-      if (!this.v1) this.useQueryMarker = true;
-      this.startKeepalive(ws);
-      if (offeredResume) {
-        this.resumeTimer = setTimeout(() => {
-          this.resumeTimer = null;
-          void this.opts.sink.resync();
-        }, RESUME_ANSWER_GRACE_MS);
-      } else {
-        void this.opts.sink.resync();
-      }
-    };
-    ws.onmessage = (event) => {
-      if (this.ws !== ws) return;
-      let parsed;
-      try {
-        parsed = JSON.parse(typeof event.data === "string" ? event.data : "");
-      } catch {
-        return;
-      }
-      if (!parsed || typeof parsed !== "object") return;
-      this.handleFrame(parsed);
-    };
-    ws.onclose = (event) => {
-      if (this.ws !== ws) return;
-      this.ws = null;
-      this.clearTimers();
-      if (event?.code === CLOSE_ACCESS_REVOKED) {
-        this.stopped = true;
-        this.opts.onAccessUnavailable?.({
-          reason: "revoked",
-          code: "access_revoked",
-          retryable: false
-        });
-        return;
-      }
-      this.scheduleReconnect();
-    };
-    ws.onerror = () => {
-      try {
-        ws.close();
-      } catch {
-      }
-    };
+    return `Bearer ${__privateGet(this, _token)}`;
   }
-  handleFrame(frame) {
-    const type = typeof frame.type === "string" ? frame.type : "";
-    if (frame.protocol === 1) this.v1 = true;
-    if (typeof frame.snapshotVersion === "number") this.version = frame.snapshotVersion;
-    if (type === "pong") {
-      this.clearPongTimer();
-      return;
-    }
-    if (Array.isArray(frame.hidden) || Array.isArray(frame.closed)) {
-      const hidden = Array.isArray(frame.hidden) ? frame.hidden : [];
-      const closed = Array.isArray(frame.closed) ? frame.closed : [];
-      const hKey = hidden.join(SEP);
-      const cKey = closed.join(SEP);
-      if (hKey !== this.hidden || cKey !== this.closedSections) {
-        this.hidden = hKey;
-        this.closedSections = cKey;
-        this.opts.sink.onSections?.(hidden, closed);
-      }
-    }
-    if (type === "hidden") return;
-    if (type === "presence") {
-      this.opts.sink.onPresence?.({
-        shoppingSessions: Number(frame.shoppingSessions) || 0,
-        activeHolds: Number(frame.activeHolds) || 0
-      });
-      return;
-    }
-    if (type === "allocation") {
-      return;
-    }
-    if (type === "snapshot" || !type && frame.seats) {
-      this.answered();
-      const next = projectionFromSnapshot(frame);
-      const changes = diffProjections(this.projection, next);
-      this.projection = next;
-      if (changes === null) void this.opts.sink.resync();
-      else if (changes.length) this.opts.sink.applyStatuses(changes);
-      return;
-    }
-    if (type === "delta" && Array.isArray(frame.changes)) {
-      this.answered();
-      const changes = frame.changes.filter((c) => typeof c?.label === "string" && typeof c?.status === "string").map((c) => ({ label: c.label, status: c.status }));
-      if (!changes.length) return;
-      if (this.projection) applyChanges(this.projection, changes);
-      this.opts.sink.applyStatuses(changes);
+  /**
+   * Handle a 401/403 from a scoped call. Returns true when the caller should
+   * retry the same request once with the refreshed bearer.
+   */
+  async handleFailure(status, code) {
+    var _a;
+    if (!this.configured) return false;
+    if (isAccessExpiry(status, code)) {
+      __privateSet(this, _token, null);
+      __privateSet(this, _expiresAt, 0);
+      const token = await __privateMethod(this, _BuyerAccessContext_instances, renew_fn).call(this, "unauthorized", code);
+      (_a = __privateGet(this, _onExpired)) == null ? void 0 : _a.call(this, { reason: "unauthorized", code, refreshed: !!token });
+      return !!token;
     }
+    const reason = classifyAccessFailure(status, code);
+    if (reason) {
+      __privateMethod(this, _BuyerAccessContext_instances, fail_fn).call(this, reason, code, status);
+      return false;
+    }
+    return false;
   }
-  /** The server answered our resume; cancel the fallback resync. */
-  answered() {
-    if (!this.resumeTimer) return;
-    clearTimeout(this.resumeTimer);
-    this.resumeTimer = null;
-  }
-  reportIfAccessError(err) {
-    const reason = err?.reason;
-    if (err?.name !== "BuyerAccessUnavailableError") return;
-    this.stopped = true;
-    this.opts.onAccessUnavailable?.({
-      reason: reason ?? "invalid",
-      code: err.code,
-      status: err.status,
-      retryable: reason === "paused"
-    });
-  }
-  // ---- keepalive & backoff --------------------------------------------------
-  /**
-   * Liveness is ping/pong, and only ping/pong. A socket that receives nothing
-   * for minutes is the normal, correct state for a narrowly-scoped buyer on a
-   * busy event (protocol doc §5), so quiet time never triggers a reconnect.
-   */
-  startKeepalive(ws) {
-    this.pingTimer = setInterval(() => {
-      if (this.ws !== ws) return;
-      try {
-        ws.send(JSON.stringify({ type: "ping" }));
-      } catch {
-        return;
-      }
-      this.clearPongTimer();
-      this.pongTimer = setTimeout(() => {
-        this.pongTimer = null;
-        try {
-          ws.close();
-        } catch {
-        }
-      }, PONG_GRACE_MS);
-    }, PING_INTERVAL_MS);
+  /** Host-driven re-acquisition (after the buyer signs in again, say). */
+  async refresh(reason = "manual") {
+    __privateSet(this, _terminal, null);
+    __privateSet(this, _lastFailure, null);
+    __privateSet(this, _token, null);
+    __privateSet(this, _expiresAt, 0);
+    return !!await __privateMethod(this, _BuyerAccessContext_instances, renew_fn).call(this, reason);
   }
-  scheduleReconnect() {
-    if (this.stopped || this.reconnectTimer) return;
-    const attempt = Math.min(this.attempt++, 5);
-    const delay = Math.min(1e3 * 2 ** attempt, MAX_BACKOFF_MS);
-    this.reconnectTimer = setTimeout(() => {
-      this.reconnectTimer = null;
-      void this.connect();
-    }, delay);
+  /** Drop the bearer. Called on destroy so nothing outlives the widget. */
+  clear() {
+    __privateSet(this, _token, null);
+    __privateSet(this, _expiresAt, 0);
+    __privateSet(this, _inflight, null);
   }
-  clearPongTimer() {
-    if (!this.pongTimer) return;
-    clearTimeout(this.pongTimer);
-    this.pongTimer = null;
+  /** Redaction: the bearer must not survive a stringify or an interpolation. */
+  toJSON() {
+    return { configured: this.configured, hasToken: this.hasToken };
   }
-  clearTimers() {
-    if (this.pingTimer) clearInterval(this.pingTimer);
-    this.pingTimer = null;
-    this.clearPongTimer();
-    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
-    this.reconnectTimer = null;
-    if (this.resumeTimer) clearTimeout(this.resumeTimer);
-    this.resumeTimer = null;
+  toString() {
+    return "[BuyerAccessContext redacted]";
   }
 };
-function rendererStatus(wire) {
-  if (wire === "blocked") return "not_for_sale";
-  if (wire === "held" || wire === "booked" || wire === "free" || wire === "not_for_sale") return wire;
-  return "free";
-}
-function createControllerSink(controller, options = {}) {
-  const idsForLabel = (label) => {
-    const table = controller.tableSelection(label);
-    if (table) return table.physicalSeatIds;
-    const id = controller.idForLabel(label);
-    return id ? [id] : [];
-  };
-  return {
-    applyStatuses(changes) {
-      const held = controller.currentHold()?.labels ?? [];
-      const buckets = {
-        free: [],
-        held: [],
-        booked: [],
-        not_for_sale: []
-      };
-      const flashes = [];
-      const lost = [];
-      const selected = new Map(controller.getSelection().map((s) => [s.label, s.id]));
-      for (const change of changes) {
-        const ids = idsForLabel(change.label);
-        if (!ids.length) continue;
-        const next = rendererStatus(change.status);
-        buckets[next].push(...ids);
-        if (options.flashOnLiveChange && next !== "free" && !held.includes(change.label) && ids.some((id) => controller.getStatus(id) === "free")) {
-          const color = next === "held" ? "#f4b740" : "#f43f5e";
-          for (const id of ids) flashes.push({ id, color });
-        }
-        if (next !== "free" && !held.includes(change.label) && selected.has(change.label)) {
-          lost.push(change.label);
-        }
-      }
-      for (const status of ["free", "held", "booked", "not_for_sale"]) {
-        if (buckets[status].length) controller.setStatus(buckets[status], status);
-      }
-      for (const flash of flashes) controller.flashSeat(flash.id, flash.color);
-      if (lost.length) {
-        const ids = lost.flatMap((label) => idsForLabel(label));
-        if (ids.length) controller.deselect(ids);
-        const ineligible = changes.some(
-          (c) => c.status === "blocked" && lost.includes(c.label)
-        );
-        options.onSelectedObjectUnavailable?.(lost, ineligible ? "ineligible" : "taken");
+_token = new WeakMap();
+_expiresAt = new WeakMap();
+_provider = new WeakMap();
+_skewMs = new WeakMap();
+_inflight = new WeakMap();
+_terminal = new WeakMap();
+_lastFailure = new WeakMap();
+_onExpired = new WeakMap();
+_onUnavailable = new WeakMap();
+_configured = new WeakMap();
+_BuyerAccessContext_instances = new WeakSet();
+// ---- internals ------------------------------------------------------------
+accept_fn = function(next) {
+  if (!next || typeof next.token !== "string" || !next.token) return null;
+  __privateSet(this, _token, next.token);
+  __privateSet(this, _expiresAt, typeof next.expiresAt === "number" ? next.expiresAt : 0);
+  return __privateGet(this, _token);
+};
+/**
+ * One provider call at a time. Several operations racing an expiry (chart +
+ * objects + a socket ticket) must not mint several sessions — the guide's
+ * rotate-on-retry rule would revoke the ones they didn't observe.
+ */
+renew_fn = function(reason, code) {
+  if (__privateGet(this, _inflight)) return __privateGet(this, _inflight);
+  const provider = __privateGet(this, _provider);
+  if (!provider) {
+    __privateMethod(this, _BuyerAccessContext_instances, fail_fn).call(this, "no_token", code);
+    return Promise.resolve(null);
+  }
+  const run = (async () => {
+    try {
+      const next = await provider({ reason });
+      const token = __privateMethod(this, _BuyerAccessContext_instances, accept_fn).call(this, next);
+      if (!token) {
+        __privateMethod(this, _BuyerAccessContext_instances, fail_fn).call(this, "provider_failed", code);
+        return null;
       }
-      options.onStatusChange?.();
-    },
-    async resync() {
-      await controller.refresh();
-    },
-    /**
-     * Section availability moved. Statuses are re-pulled so the map repaints.
-     *
-     * Known limit: rebuilding the chart when a section is newly HIDDEN (its
-     * seats are stripped, not greyed) lives inside PickerController's own
-     * socket handler and has no public entry point, so an access-scoped picker
-     * repaints statuses but does not restructure the chart until its next
-     * mount. Closing/opening a section — the common mid-sale move — is a
-     * status-level change and is handled here in full.
-     */
-    onSections(hidden, closed) {
-      void controller.refresh();
-      options.onSections?.(hidden, closed);
+      return token;
+    } catch {
+      __privateMethod(this, _BuyerAccessContext_instances, fail_fn).call(this, "provider_failed", code);
+      return null;
+    } finally {
+      __privateSet(this, _inflight, null);
     }
+  })();
+  __privateSet(this, _inflight, run);
+  return run;
+};
+fail_fn = function(reason, code, status) {
+  var _a;
+  const event = {
+    reason,
+    code,
+    status,
+    // Unchanged: `retryable` means "the SAME request may succeed later".
+    // `provider_failed` is recoverable but not retryable — the host must fix
+    // its mint endpoint first — so the two sets are deliberately different.
+    retryable: reason === "paused" || reason === "channel_denied"
   };
+  __privateSet(this, _lastFailure, event);
+  if (!RECOVERABLE.has(reason)) {
+    __privateSet(this, _terminal, event);
+    __privateSet(this, _token, null);
+    __privateSet(this, _expiresAt, 0);
+  }
+  (_a = __privateGet(this, _onUnavailable)) == null ? void 0 : _a.call(this, event);
+  return event;
+};
+function createBuyerAccessContext(options, hooks = {}) {
+  if (!options.buyerAccessTokenProvider && !options.buyerAccessToken) return null;
+  return new BuyerAccessContext({
+    provider: options.buyerAccessTokenProvider,
+    token: options.buyerAccessToken,
+    ...hooks
+  });
 }
 
 // src/seatLayerBrand.ts
@@ -9570,13 +9649,39 @@ var SeatManager = class {
     this.labelToId = /* @__PURE__ */ new Map();
     this.labelToSeat = /* @__PURE__ */ new Map();
     this.allIds = [];
+    /**
+     * GA inventory units — real sellable labels the server counts, with NO seat
+     * geometry and therefore no renderer binding. They live here rather than in
+     * `labelToId`/`allIds` so every paint path keeps addressing paintable nodes
+     * only, while the tally denominator finally covers the same universe the
+     * numerator does. Without them a GA sale hit `booked` but not `total`:
+     * Free under-reported by GA capacity and SOLD% could exceed 100%.
+     */
+    this.gaUnitLabelSet = /* @__PURE__ */ new Set();
     this.status = /* @__PURE__ */ new Map();
+    /** Live non-free counters, moved by each delta rather than re-walked. */
+    this.counts = { held: 0, booked: 0, blocked: 0 };
+    /** Bumped whenever the seat model is replaced wholesale (a full snapshot). */
+    this.modelVersion = 0;
     this.currency = "USD";
     this.authoritativeGrossRevenue = 0;
     this.revenueStatus = "loading";
     this.revenueRequest = 0;
-    this.revenueRefreshTimer = null;
     this.controlRoomSnapshot = null;
+    /**
+     * The server's own totals, pinned to the client model they were read against.
+     * Display = server baseline + (client now − client then), so the authoritative
+     * numbers land exactly on arrival and deltas still move them between reads.
+     * A wholesale model replacement invalidates the pairing (`model`), and the
+     * client tallies — themselves a fresh authenticated read — take over.
+     */
+    this.serverBaseline = null;
+    /** Latest presence frame, held whether or not a snapshot has landed yet. */
+    this.livePresence = null;
+    /** Latest cumulative booked gross pushed on a delta frame. */
+    this.liveGross = null;
+    /** Coalesces a burst of deltas into one KPI/rail repaint. */
+    this.paintHandle = null;
     this.trendWindowMinutes = 15;
     this.heatEnabled = false;
     this.lastKpiValues = /* @__PURE__ */ new Map();
@@ -9674,12 +9779,7 @@ var SeatManager = class {
       const res = await this.api.chart(this.key);
       this.doc = res.doc;
       this.currency = res.event.currency ?? this.opts.currency ?? this.currency;
-      const seats = (0, import_core3.expandChart)(res.doc);
-      for (const s of seats) {
-        this.labelToId.set(s.label, s.id);
-        this.labelToSeat.set(s.label, s);
-        this.allIds.push(s.id);
-      }
+      this.buildUnitUniverse(res.doc);
       this.buildRenderer();
       this.buildSectionOptions();
       const [, controlRoom] = await Promise.all([
@@ -10040,7 +10140,10 @@ var SeatManager = class {
     if (this.followLiveTimer) clearTimeout(this.followLiveTimer);
     if (this.followSeatTimer) clearTimeout(this.followSeatTimer);
     if (this.unblockAllConfirmTimer) clearTimeout(this.unblockAllConfirmTimer);
-    if (this.revenueRefreshTimer) clearTimeout(this.revenueRefreshTimer);
+    if (this.paintHandle !== null && typeof cancelAnimationFrame === "function") {
+      cancelAnimationFrame(this.paintHandle);
+    }
+    this.paintHandle = null;
     this.channels?.destroy();
     this.channels = null;
     if (this.tokenRefreshTimer) clearTimeout(this.tokenRefreshTimer);
@@ -10123,6 +10226,37 @@ var SeatManager = class {
     }
     this.syncSelection();
   }
+  /**
+   * Build the client's inventory universe from the chart.
+   *
+   * `expandChart` yields SEATS — it has no output for a GA area, whose capacity
+   * is sold as N synthetic unit labels. The server's seat map keys, its deltas
+   * and its `totals` all speak those labels, so a client that only knows seats
+   * counts GA sales in the numerator (every key of the snapshot is written into
+   * `status`) while leaving them out of the denominator. Registering the GA
+   * units here — labels only, never a render binding — is what makes the two
+   * agree.
+   */
+  buildUnitUniverse(doc) {
+    for (const seat of (0, import_core3.expandChart)(doc)) {
+      this.labelToId.set(seat.label, seat.id);
+      this.labelToSeat.set(seat.label, seat);
+      this.allIds.push(seat.id);
+    }
+    for (const area of (0, import_core3.gaAreasOf)(doc)) {
+      for (const label of (0, import_core3.gaUnitLabels)(area)) {
+        if (!this.labelToId.has(label)) this.gaUnitLabelSet.add(label);
+      }
+    }
+  }
+  /** Every sellable unit the client knows: seats + GA capacity. */
+  unitTotal() {
+    return this.allIds.length + this.gaUnitLabelSet.size;
+  }
+  /** Every label the client models, whether or not it can be painted. */
+  knownLabels() {
+    return [...this.labelToId.keys(), ...this.gaUnitLabelSet];
+  }
   repaintAll() {
     const r = this.renderer;
     if (!r) return;
@@ -10172,7 +10306,7 @@ var SeatManager = class {
     ws.onopen = () => {
       this.attempt = 0;
       this.setLive(true);
-      void this.resnapshot().then(() => this.scheduleRevenueRefresh(0));
+      void this.resnapshot().then(() => this.refreshControlRoom()).catch((err) => this.opts.onError?.(err));
       void this.refreshAvailability();
     };
     ws.onmessage = (e) => this.onMessage(e);
@@ -10210,15 +10344,18 @@ var SeatManager = class {
       this.updateEffectiveAvailability(m.hidden, m.closed);
     }
     if (m.type === "presence") {
-      if (this.controlRoomSnapshot && typeof m.shoppingSessions === "number" && typeof m.activeHolds === "number") {
-        this.controlRoomSnapshot = {
-          ...this.controlRoomSnapshot,
-          presence: { shoppingSessions: m.shoppingSessions, activeHolds: m.activeHolds }
+      if (typeof m.shoppingSessions === "number" && typeof m.activeHolds === "number") {
+        this.livePresence = {
+          at: Date.now(),
+          value: { shoppingSessions: m.shoppingSessions, activeHolds: m.activeHolds }
         };
+        if (this.controlRoomSnapshot) {
+          this.controlRoomSnapshot = { ...this.controlRoomSnapshot, presence: this.livePresence.value };
+          this.opts.onControlRoom?.(this.controlRoomSnapshot);
+        }
         this.lastSyncedAt = Date.now();
         this.recomputeTallies();
         this.paintMonitorInsights();
-        this.opts.onControlRoom?.(this.controlRoomSnapshot);
       }
       return;
     }
@@ -10232,7 +10369,7 @@ var SeatManager = class {
         const st = ["free", "held", "booked", "blocked"].includes(ch.status) ? ch.status : "free";
         const prev = this.status.get(ch.label) ?? "free";
         if (prev === st) continue;
-        this.status.set(ch.label, st);
+        this.setStatusLabel(ch.label, st, prev);
         const id = this.labelToId.get(ch.label);
         if (id) {
           this.renderer?.setStatus([id], toRenderStatus(st));
@@ -10252,10 +10389,38 @@ var SeatManager = class {
         this.lastSyncedAt = Date.now();
         this.afterPaint();
       }
+      if (typeof m.revenue?.gross === "number" && Number.isFinite(m.revenue.gross)) {
+        this.applyLiveGross(m.revenue.gross);
+      }
       this.recomputeTallies();
-      if (ids.length) this.scheduleRevenueRefresh();
     }
   }
+  /**
+   * Adopt the cumulative booked gross a delta frame carried.
+   *
+   * Stashed with its arrival time so an in-flight control-room read can decide
+   * whether it is holding the newer number: a frame that landed after the
+   * request started is newer than the response, one that landed before is not.
+   */
+  applyLiveGross(gross) {
+    this.liveGross = { at: Date.now(), value: gross };
+    this.authoritativeGrossRevenue = gross;
+    this.revenueStatus = "current";
+    if (this.controlRoomSnapshot) {
+      this.controlRoomSnapshot = {
+        ...this.controlRoomSnapshot,
+        revenue: { ...this.controlRoomSnapshot.revenue, gross }
+      };
+      this.opts.onControlRoom?.(this.controlRoomSnapshot);
+    }
+  }
+  /** The single writer for a label's status, so the counters never drift. */
+  setStatusLabel(label, next, prev = this.status.get(label) ?? "free") {
+    this.status.set(label, next);
+    if (prev === next) return;
+    if (prev !== "free") this.counts[prev] -= 1;
+    if (next !== "free") this.counts[next] += 1;
+  }
   async resnapshot() {
     try {
       const objs = await this.api.objects(this.key);
@@ -10278,23 +10443,31 @@ var SeatManager = class {
     const next = /* @__PURE__ */ new Map();
     if (fallback !== void 0) {
       const base = known(fallback);
-      for (const label of this.labelToId.keys()) next.set(label, base);
+      for (const label of this.knownLabels()) next.set(label, base);
     }
     for (const [label, st] of Object.entries(seats)) {
       next.set(label, known(st));
     }
     this.status = next;
+    this.modelVersion += 1;
+    this.recountAll();
     this.lastSyncedAt = Date.now();
     this.repaintAll();
     this.afterPaint();
     this.recomputeTallies();
   }
+  /** The one O(n) walk left: a wholesale model replacement re-bases the counters. */
+  recountAll() {
+    const counts = { held: 0, booked: 0, blocked: 0 };
+    for (const st of this.status.values()) if (st !== "free") counts[st] += 1;
+    this.counts = counts;
+  }
   /** Optimistic local write shared by organizer actions. Paint and tally once,
    * even when an arena-sized operation changes hundreds of seats. */
   setSeatsLocal(labels, st) {
     const ids = [];
     for (const label of labels) {
-      this.status.set(label, st);
+      this.setStatusLabel(label, st);
       const id = this.labelToId.get(label);
       if (id) ids.push(id);
     }
@@ -10420,12 +10593,33 @@ var SeatManager = class {
     this.revenueStatus = "current";
     this.recomputeTallies();
   }
+  /**
+   * Read the server's own control-room projection.
+   *
+   * Called on mount, on every socket (re)connect and after an organizer action —
+   * never on a timer and never per delta frame. Presence and gross that arrived
+   * on the socket AFTER this request started are newer than the response, so
+   * they survive it; anything older defers to the read.
+   */
   async refreshControlRoom() {
     const request = ++this.revenueRequest;
+    const requestedAt = Date.now();
     try {
-      const snapshot = await this.api.controlRoom(this.key, this.trendWindowMinutes);
+      const fetched = await this.api.controlRoom(this.key, this.trendWindowMinutes);
+      let snapshot = fetched;
       if (request === this.revenueRequest) {
+        if (this.livePresence && this.livePresence.at >= requestedAt) {
+          snapshot = { ...snapshot, presence: this.livePresence.value };
+        } else {
+          this.livePresence = null;
+        }
+        if (this.liveGross && this.liveGross.at >= requestedAt) {
+          snapshot = { ...snapshot, revenue: { ...snapshot.revenue, gross: this.liveGross.value } };
+        } else {
+          this.liveGross = null;
+        }
         this.controlRoomSnapshot = snapshot;
+        this.rebaseServerTotals(snapshot);
         this.lastSyncedAt = Date.now();
         this.authoritativeGrossRevenue = snapshot.revenue.gross;
         this.currency = snapshot.currency;
@@ -10444,37 +10638,80 @@ var SeatManager = class {
       throw err;
     }
   }
-  scheduleRevenueRefresh(delay = 140) {
-    this.revenueStatus = "stale";
-    this.recomputeTallies();
-    if (this.revenueRefreshTimer) clearTimeout(this.revenueRefreshTimer);
-    this.revenueRefreshTimer = setTimeout(() => {
-      this.revenueRefreshTimer = null;
-      void this.refreshControlRoom().catch((err) => this.opts.onError?.(err));
-    }, delay);
+  /** Pin the server's totals to the client model they were read against. */
+  rebaseServerTotals(snapshot) {
+    const totals = snapshot.totals;
+    if (!totals || ["free", "held", "booked", "blocked"].some(
+      (key) => !Number.isFinite(totals[key])
+    )) {
+      this.serverBaseline = null;
+      return;
+    }
+    this.serverBaseline = {
+      model: this.modelVersion,
+      server: { free: totals.free, held: totals.held, booked: totals.booked, blocked: totals.blocked },
+      client: this.clientTallies()
+    };
   }
-  recomputeTallies() {
+  /** What the client's own model says — GA units included since `render()`. */
+  clientTallies() {
+    const { held, booked, blocked } = this.counts;
+    return { held, booked, blocked, free: Math.max(0, this.unitTotal() - held - booked - blocked) };
+  }
+  /**
+   * The numbers the KPI bar and rail render.
+   *
+   * The server is the authority: its totals land exactly as read, and the
+   * delta-driven client model carries them forward until the next read. Before
+   * the first snapshot — and after a wholesale model replacement invalidates the
+   * pairing — the client model stands alone.
+   */
+  buildTallies() {
+    const client = this.clientTallies();
+    const baseline = this.serverBaseline?.model === this.modelVersion ? this.serverBaseline : null;
+    const of = (key) => baseline ? Math.max(0, baseline.server[key] + (client[key] - baseline.client[key])) : client[key];
+    const seatTotal = this.controlRoomSnapshot?.event?.seatTotal;
     const t3 = {
-      free: 0,
-      held: 0,
-      booked: 0,
-      blocked: 0,
-      total: this.allIds.length,
+      free: of("free"),
+      held: of("held"),
+      booked: of("booked"),
+      blocked: of("blocked"),
+      total: Number.isFinite(seatTotal) ? seatTotal : this.unitTotal(),
       capacityPct: 0,
       sellThroughPct: 0,
       grossRevenue: this.authoritativeGrossRevenue,
       revenueStatus: this.revenueStatus,
       currency: this.currency
     };
-    let nonFree = 0;
-    for (const st of this.status.values()) {
-      t3[st] += 1;
-      if (st !== "free") nonFree += 1;
-    }
-    t3.free = Math.max(0, t3.total - nonFree);
     t3.capacityPct = t3.total ? Math.round(t3.booked / t3.total * 100) : 0;
     const sellable = t3.total - t3.blocked;
     t3.sellThroughPct = sellable > 0 ? Math.round(t3.booked / sellable * 100) : 0;
+    return t3;
+  }
+  /**
+   * Queue one KPI/rail repaint for this burst of changes.
+   *
+   * A delta frame can carry hundreds of seats and `paintKpis` rebuilds eight
+   * nodes from scratch, so painting per change is what made an arena-sized
+   * frame expensive. Coalescing on a frame keeps the burst to a single rebuild;
+   * without `requestAnimationFrame` (SSR, an older test env) it paints inline
+   * rather than dropping the update.
+   */
+  recomputeTallies() {
+    if (this.closed) return;
+    if (typeof requestAnimationFrame !== "function") {
+      this.flushTallies();
+      return;
+    }
+    if (this.paintHandle !== null) return;
+    this.paintHandle = requestAnimationFrame(() => {
+      this.paintHandle = null;
+      this.flushTallies();
+    });
+  }
+  flushTallies() {
+    if (this.closed) return;
+    const t3 = this.buildTallies();
     this.paintKpis(t3);
     if (this.mode === "view") {
       this.paintLegend(t3);
@@ -10761,16 +10998,16 @@ var SeatManager = class {
   paintKpis(t3) {
     if (!this.els.kpis) return;
     const rev = t3.revenueStatus === "current" ? fmtMoney(t3.grossRevenue, t3.currency) : "\u2014";
-    const presence = this.controlRoomSnapshot?.presence;
+    const presence = this.presenceCounts();
     const items = [
-      { key: "sold-seats", raw: t3.booked, n: t3.booked.toLocaleString(), l: "Sold seats", dot: "#22a06b" },
-      { key: "held-seats", raw: t3.held, n: t3.held.toLocaleString(), l: "Held seats", dot: "#f4b740" },
-      { key: "buyers", raw: presence?.shoppingSessions ?? null, n: presence ? presence.shoppingSessions.toLocaleString() : "\u2014", l: "Buyers" },
-      { key: "active-holds", raw: presence?.activeHolds ?? null, n: presence ? presence.activeHolds.toLocaleString() : "\u2014", l: "Active holds" },
-      { key: "free-seats", raw: t3.free, n: t3.free.toLocaleString(), l: "Free seats", dot: "#6e7bff" },
-      { key: "blocked", raw: t3.blocked, n: t3.blocked.toLocaleString(), l: "Blocked", dot: "#8b94ac" },
-      { key: "sold-pct", raw: t3.capacityPct, n: `${t3.capacityPct}%`, l: "Sold" },
-      { key: "gross-sales", raw: t3.revenueStatus === "current" ? t3.grossRevenue : null, n: rev, l: "Gross sales" }
+      { key: "sold-seats", raw: t3.booked, n: t3.booked.toLocaleString(), l: "Sold seats", dot: "#22a06b", title: "Seats booked" },
+      { key: "held-seats", raw: t3.held, n: t3.held.toLocaleString(), l: "Held seats", dot: "#f4b740", title: "Seats held in a checkout right now" },
+      { key: "free-seats", raw: t3.free, n: t3.free.toLocaleString(), l: "Free seats", dot: "#6e7bff", title: "Seats on sale and unsold" },
+      { key: "blocked", raw: t3.blocked, n: t3.blocked.toLocaleString(), l: "Blocked", dot: "#8b94ac", title: "Seats withheld from sale" },
+      { key: "buyers", raw: presence?.shoppingSessions ?? null, n: presence ? presence.shoppingSessions.toLocaleString() : "\u2014", l: "Buyers", title: "People on the map right now" },
+      { key: "carts", raw: presence?.activeHolds ?? null, n: presence ? presence.activeHolds.toLocaleString() : "\u2014", l: "Carts", title: "Checkouts holding seats right now \u2014 sessions, not seats" },
+      { key: "sold-pct", raw: t3.capacityPct, n: `${t3.capacityPct}%`, l: "Sold", title: "Sold seats as a share of the whole event" },
+      { key: "gross-sales", raw: t3.revenueStatus === "current" ? t3.grossRevenue : null, n: rev, l: "Gross sales", title: "Exact booked gross" }
     ];
     let hasChanges = false;
     this.els.kpis.innerHTML = items.map((item) => {
@@ -10786,7 +11023,7 @@ var SeatManager = class {
       }
       if (item.raw != null) this.lastKpiValues.set(item.key, item.raw);
       const activeDelta = this.activeKpiDeltas.get(item.key);
-      return `<div class="slm-kpi${activeDelta ? " changed" : ""}" data-kpi="${item.key}">
+      return `<div class="slm-kpi${activeDelta ? " changed" : ""}" data-kpi="${item.key}" title="${esc2(item.title)}">
         <b>${item.dot ? `<span class="dot" style="background:${item.dot}"></span>` : ""}${item.n}</b><span>${item.l}</span>
         ${activeDelta ? `<span class="slm-kpidelta${activeDelta.down ? " down" : ""}">${activeDelta.text}</span>` : ""}
       </div>`;
@@ -10844,15 +11081,21 @@ var SeatManager = class {
     this.paintMomentumHelp();
     this.paintFeed();
   }
+  /** Live presence wins over the snapshot's copy — it is the fresher channel,
+   *  and it exists from the first frame rather than the first fetch. */
+  presenceCounts() {
+    return this.livePresence?.value ?? this.controlRoomSnapshot?.presence ?? null;
+  }
   paintMonitorInsights() {
     if (this.mode !== "view") return;
     const snapshot = this.controlRoomSnapshot;
     if (this.els.presence) {
       const connected = this.root?.classList.contains("live");
       const sync = this.lastSyncedAt ? relTime(this.lastSyncedAt, Date.now()) : "waiting";
+      const presence = this.presenceCounts();
       this.els.presence.innerHTML = `
-        <div class="slm-healthitem"><b>${snapshot ? snapshot.presence.shoppingSessions.toLocaleString() : "\u2014"}</b><span>Buyer sessions</span></div>
-        <div class="slm-healthitem"><b>${snapshot ? snapshot.presence.activeHolds.toLocaleString() : "\u2014"}</b><span>Active holds</span></div>
+        <div class="slm-healthitem" title="People on the map right now"><b>${presence ? presence.shoppingSessions.toLocaleString() : "\u2014"}</b><span>Buyers</span></div>
+        <div class="slm-healthitem" title="Checkouts holding seats right now \u2014 sessions, not seats"><b>${presence ? presence.activeHolds.toLocaleString() : "\u2014"}</b><span>Carts</span></div>
         <div class="slm-healthitem"><b>${connected ? "Healthy" : "Reconnecting"}</b><span>Live connection</span></div>
         <div class="slm-healthitem"><b>${sync}</b><span>Last sync</span></div>`;
     }
@@ -11463,7 +11706,7 @@ var SeatManager = class {
       const activity = action === "block" ? this.pushActivity(labels, "blocked", "blocked") : action === "unblock" || action === "unblockAll" ? this.pushActivity(labels, "unblocked", "free") : action === "cancelBooking" ? this.pushActivity(labels, "cancelled", "free") : null;
       if (activity) this.paintSpatialActivity(activity);
     }
-    if (action !== "setHoldTtl") this.scheduleRevenueRefresh(0);
+    if (action !== "setHoldTtl") void this.refreshControlRoom().catch((err) => this.opts.onError?.(err));
     this.opts.onActionComplete?.({ action, labels, count: labels.length });
   }
   toastOk(msg) {