@skaile/workspaces 4.24.0 → 4.26.0

package/dist/chunk-73ZXUUL6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../transport/src/ws/server.ts"],"names":[],"mappings":";;;;AA6CA,SAAS,yBAAyB,GAAA,EAA6C;AAC7E,EAAA,IAAI,GAAA,CAAI,IAAA,KAAS,cAAA,EAAgB,OAAO,6BAAA;AAExC,EAAA,MAAM,WAAW,GAAA,CAAI,QAAA;AACrB,EAAA,IAAI,CAAC,YAAY,OAAO,QAAA,KAAa,YAAY,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACxE,IAAA,OAAO,4BAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,WAAA,KAAgB,QAAA,EAAU,OAAO,uCAAA;AACrD,EAAA,IAAI,OAAO,QAAA,CAAS,SAAA,KAAc,QAAA,EAAU,OAAO,qCAAA;AACnD,EAAA,IAAI,OAAO,QAAA,CAAS,SAAA,KAAc,QAAA,EAAU,OAAO,qCAAA;AAEnD,EAAA,MAAM,kBAAkB,GAAA,CAAI,eAAA;AAC5B,EAAA,IAAI,CAAC,mBAAmB,OAAO,eAAA,KAAoB,YAAY,KAAA,CAAM,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC7F,IAAA,OAAO,mCAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AACtD,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AACtD,EAAA,IAAI,OAAO,eAAA,CAAgB,KAAA,KAAU,QAAA,EAAU,OAAO,wCAAA;AAEtD,EAAA,IACE,CAAC,GAAA,CAAI,cAAA,IACL,OAAO,GAAA,CAAI,cAAA,KAAmB,QAAA,IAC9B,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,EAChC;AACA,IAAA,OAAO,kCAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,GAAA,CAAI,WAAA,IAAe,OAAO,GAAA,CAAI,WAAA,KAAgB,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG;AAC7F,IAAA,OAAO,+BAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAyBO,IAAM,2BAAN,MAA0D;AAAA,EACvD,UAAA,GAAgC,IAAA;AAAA,EAChC,GAAA,GAA8B,IAAA;AAAA,EAC9B,YAAA,GAAiC,IAAA;AAAA,EACxB,IAAA;AAAA,EACA,GAAA;AAAA,EACA,SAAA;AAAA,EAEA,eAAA,uBAAsB,GAAA,EAAqC;AAAA,EAC3D,eAAA,uBAAsB,GAAA,EAAgB;AAAA,EACtC,kBAAA,uBAAyB,GAAA,EAAgB;AAAA,EAE1D,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA;AACpC,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AAAA,EAC3B;AAAA;AAAA,EAGA,MAAM,MAAA,GAAwB;AAC5B,IAAA,MAAM,UAAA,GAAa,YAAA,CAAa,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC7C,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,cAAc,CAAA;AACnD,MAAA,GAAA,CAAI,IAAI,qBAAqB,CAAA;AAAA,IAC/B,CAAC,CAAA;AAKD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA;AACtB,IAAA,MAAM,GAAA,GAAM,IAAI,eAAA,CAAgB;AAAA,MAC9B,MAAA,EAAQ,UAAA;AAAA,MACR,YAAA,EAAc,QAAA,GACV,CAAC,IAAA,EAAM,EAAA,KAAO;AACZ,QAAA,MAAM,YAAY,sBAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,wBAAwB,CAAC,CAAA;AACnF,QAAA,IAAI,SAAA,KAAc,IAAA,IAAQ,WAAA,CAAY,SAAA,EAAW,QAAQ,CAAA,EAAG;AAC1D,UAAA,EAAA,CAAG,IAAI,CAAA;AAAA,QACT,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,IAAI,+CAA+C,CAAA;AACxD,UAAA,EAAA,CAAG,KAAA,EAAO,KAAK,cAAc,CAAA;AAAA,QAC/B;AAAA,MACF,CAAA,GACA;AAAA,KACL,CAAA;AACD,IAAA,GAAA,CAAI,GAAG,YAAA,EAAc,CAAC,OAAO,IAAA,CAAK,gBAAA,CAAiB,EAAE,CAAC,CAAA;AAItD,IAAA,MAAM,mBAAmB,MAAM;AAAA,IAAC,CAAA;AAChC,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,gBAAgB,CAAA;AAChC,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAEX,IAAA,IAAI;AACF,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC3C,QAAA,UAAA,CAAW,IAAA,CAAK,SAAS,MAAM,CAAA;AAC/B,QAAA,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,IAAA,EAAM,MAAM;AACjC,UAAA,UAAA,CAAW,GAAA,CAAI,SAAS,MAAM,CAAA;AAC9B,UAAA,OAAA,EAAQ;AAAA,QACV,CAAC,CAAA;AAAA,MACH,CAAC,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,KAAA,EAAM;AACV,MAAA,IAAA,CAAK,GAAA,GAAM,IAAA;AACX,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,GAAA,CAAI,GAAA,CAAI,SAAS,gBAAgB,CAAA;AAAA,IACnC;AAEA,IAAA,MAAM,IAAA,GAAO,WAAW,OAAA,EAAQ;AAChC,IAAA,MAAM,YAAY,OAAO,IAAA,KAAS,YAAY,IAAA,GAAO,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACtE,IAAA,IAAA,CAAK,GAAA,CAAI,CAAA,8BAAA,EAAiC,SAAS,CAAA,CAAE,CAAA;AAAA,EACvD;AAAA,EAEQ,iBAAiB,EAAA,EAAqB;AAC5C,IAAA,IAAI,KAAK,YAAA,EAAc;AAIrB,MAAA,IAAA,CAAK,IAAI,2CAA2C,CAAA;AACpD,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,IAAA,EAAM,4BAA4B,CAAA;AAAA,MAC5D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,IAAI,8BAA8B,CAAA;AACvC,IAAA,IAAA,CAAK,YAAA,GAAe,EAAA;AACpB,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,MAAA,OAAA,EAAQ;AAAA,IACV;AAEA,IAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAS;AACzB,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAC,CAAA;AAKtC,QAAA,IAAI,UAAU,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,SAAS,cAAA,EAAgB;AAC1E,UAAA,MAAM,MAAA,GAAS,yBAAyB,MAAM,CAAA;AAC9C,UAAA,IAAI,WAAW,IAAA,EAAM;AACnB,YAAA,IAAA,CAAK,GAAA,CAAI,CAAA,4CAAA,EAA+C,MAAM,CAAA,CAAE,CAAA;AAChE,YAAA,IAAA,CAAK,OAAA,CAAQ;AAAA,cACX,IAAA,EAAM,OAAA;AAAA,cACN,OAAA,EAAS,yBAAyB,MAAM,CAAA,CAAA;AAAA,cACxC,KAAA,EAAO;AAAA,aACR,CAAA;AACD,YAAA;AAAA,UACF;AAAA,QACF;AACA,QAAA,MAAM,GAAA,GAAM,MAAA;AACZ,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,UAAA,OAAA,CAAQ,GAAG,CAAA;AAAA,QACb;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,OAAA,CAAQ;AAAA,UACX,IAAA,EAAM,OAAA;AAAA,UACN,OAAA,EAAS,oBAAoB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,UAC7E,KAAA,EAAO;AAAA,SACR,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,MAAA,IAAA,CAAK,IAAI,iCAAiC,CAAA;AAC1C,MAAA,IAAI,IAAA,CAAK,iBAAiB,EAAA,EAAI;AAC5B,QAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,kBAAA,EAAoB;AAC7C,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,cAAc,SAAA,EAAU;AAAA,IAC/B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,KAAK,KAAA,EAAM;AAChB,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA;AACX,IAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,UAAA,CAAW,mBAAA,EAAoB;AAC/B,MAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,WAAW,KAAA,CAAM,MAAM,OAAA,EAAS,CAAC,CAAA;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,KAAK,KAAA,EAAyB;AAC5B,IAAA,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,EACpB;AAAA,EAEA,UAAU,OAAA,EAAsD;AAC9D,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,UAAU,OAAA,EAAiC;AACzC,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,aAAa,OAAA,EAAiC;AAC5C,IAAA,IAAA,CAAK,kBAAA,CAAmB,IAAI,OAAO,CAAA;AACnC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,kBAAA,CAAmB,OAAO,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,EACF;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,KAAK,YAAA,KAAiB,IAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,IAAI,SAAA,GAAgC;AAClC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY,OAAA,EAAQ;AACtC,IAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,GAAO,KAAK,IAAA,GAAO,MAAA;AAAA,EACxD;AAAA,EAEQ,QAAQ,IAAA,EAAqB;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,IAAA,CAAK,YAAA;AACpB,MAAA,IAAI,MAAA,IAAU,MAAA,CAAO,UAAA,KAAe,CAAA,EAAG;AACrC,QAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,MAClC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF","file":"chunk-73ZXUUL6.js","sourcesContent":["/**\n * WebSocketServerTransport — `ws`-based WebSocket server.\n *\n * Accepts one client at a time. Implements ServerTransport from @skaile/workspaces/types.\n * Built on the `ws` package + `node:http`, both of which run under Node and Bun.\n */\n\nimport { createServer, type Server as HttpServer } from \"node:http\";\nimport type { AgentCommand, AgentEvent, ServerTransport } from \"@skaile/workspaces/types\";\nimport { type WebSocket, WebSocketServer } from \"ws\";\nimport { decodeBearerFromHeader, tokensEqual } from \"./auth.js\";\n\n/**\n * Options for {@link WebSocketServerTransport}.\n *\n * @param port - TCP port to bind to; `0` picks a free port (read it back via `boundPort`).\n * @param onLog - Optional callback for internal log lines (client connect/disconnect events).\n * @param authToken - When set, every upgrade must present this token via the\n *   `skaile-bearer.<base64url>` subprotocol or the handshake is rejected with\n *   HTTP 401. When unset, no auth is enforced (back-compatible default).\n *\n * @docLink packages/transport/dev-guide#websocket-server-transport\n */\nexport interface WebSocketServerOptions {\n  port: number;\n  onLog?: (line: string) => void;\n  authToken?: string;\n}\n\n/**\n * Shape-validate a `session_init` frame at ingress before forwarding to the\n * runner. Protocol v3 requires the deterministic bootstrap envelope to carry\n * an identity tuple, a semver-shaped `protocolVersion`, a resolved config\n * object, and a `credentials` map keyed by `mounts` / `connectors`. Frames\n * that fail the guard are rejected on the wire so the runner never sees a\n * malformed boot envelope.\n *\n * Returns `null` when the frame is well-formed, or a human-readable reason\n * when it should be rejected.\n *\n * Spec: `_devlog/specs/2026-05-10-deterministic-session-bootstrap.md`\n * § \"SessionInitCommand schema\".\n *\n * @internal\n */\nfunction validateSessionInitShape(cmd: Record<string, unknown>): string | null {\n  if (cmd.type !== \"session_init\") return \"type must be 'session_init'\";\n\n  const identity = cmd.identity as Record<string, unknown> | undefined;\n  if (!identity || typeof identity !== \"object\" || Array.isArray(identity)) {\n    return \"identity must be an object\";\n  }\n  if (typeof identity.containerId !== \"string\") return \"identity.containerId must be a string\";\n  if (typeof identity.sessionId !== \"string\") return \"identity.sessionId must be a string\";\n  if (typeof identity.projectId !== \"string\") return \"identity.projectId must be a string\";\n\n  const protocolVersion = cmd.protocolVersion as Record<string, unknown> | undefined;\n  if (!protocolVersion || typeof protocolVersion !== \"object\" || Array.isArray(protocolVersion)) {\n    return \"protocolVersion must be an object\";\n  }\n  if (typeof protocolVersion.major !== \"number\") return \"protocolVersion.major must be a number\";\n  if (typeof protocolVersion.minor !== \"number\") return \"protocolVersion.minor must be a number\";\n  if (typeof protocolVersion.patch !== \"number\") return \"protocolVersion.patch must be a number\";\n\n  if (\n    !cmd.resolvedConfig ||\n    typeof cmd.resolvedConfig !== \"object\" ||\n    Array.isArray(cmd.resolvedConfig)\n  ) {\n    return \"resolvedConfig must be an object\";\n  }\n\n  if (!cmd.credentials || typeof cmd.credentials !== \"object\" || Array.isArray(cmd.credentials)) {\n    return \"credentials must be an object\";\n  }\n\n  return null;\n}\n\n/**\n * `ServerTransport` implementation backed by the `ws` package on top of a\n * `node:http` server.\n *\n * Enforces a single-client policy: if a new connection arrives while a client is\n * already connected, the stale connection is closed with code 4001 and replaced.\n * Incoming frames are parsed as JSON `AgentCommand` messages and fanned out to\n * registered `onCommand` handlers; outgoing `AgentEvent` objects are JSON-serialised\n * before sending. Call `listen()` to start accepting connections and `close()` to\n * shut down cleanly — `close()` terminates the active socket immediately rather\n * than keeping the event loop alive.\n *\n * @example\n * ```ts\n * const server = new WebSocketServerTransport({ port: 8080 });\n * await server.listen();\n * server.onCommand((cmd) => console.log(cmd));\n * server.send({ type: 'agent_end' });\n * await server.close();\n * ```\n *\n * @docLink packages/transport/dev-guide#websocket-server-transport\n */\nexport class WebSocketServerTransport implements ServerTransport {\n  private httpServer: HttpServer | null = null;\n  private wss: WebSocketServer | null = null;\n  private activeClient: WebSocket | null = null;\n  private readonly port: number;\n  private readonly log: (line: string) => void;\n  private readonly authToken?: string;\n\n  private readonly commandHandlers = new Set<(command: AgentCommand) => void>();\n  private readonly connectHandlers = new Set<() => void>();\n  private readonly disconnectHandlers = new Set<() => void>();\n\n  constructor(options: WebSocketServerOptions) {\n    this.port = options.port;\n    this.log = options.onLog ?? console.log;\n    this.authToken = options.authToken;\n  }\n\n  /** Start the server and accept connections. */\n  async listen(): Promise<void> {\n    const httpServer = createServer((_req, res) => {\n      res.writeHead(200, { \"content-type\": \"text/plain\" });\n      res.end(\"skaile agent server\");\n    });\n    // When an auth token is configured, reject the upgrade at handshake time\n    // (HTTP 401) unless the client presents the matching bearer subprotocol.\n    // Rejecting here — before `connection` — keeps unauthenticated sockets from\n    // ever reaching the command handlers.\n    const expected = this.authToken;\n    const wss = new WebSocketServer({\n      server: httpServer,\n      verifyClient: expected\n        ? (info, cb) => {\n            const presented = decodeBearerFromHeader(info.req.headers[\"sec-websocket-protocol\"]);\n            if (presented !== null && tokensEqual(presented, expected)) {\n              cb(true);\n            } else {\n              this.log(\"[ws-server] rejecting unauthenticated upgrade\");\n              cb(false, 401, \"Unauthorized\");\n            }\n          }\n        : undefined,\n    });\n    wss.on(\"connection\", (ws) => this.handleConnection(ws));\n    // `ws` re-emits the http server's errors on `wss`; unhandled during the bind,\n    // that throws before the reject below runs and `listen()` hangs. Scoped to the\n    // bind so a post-startup server error still surfaces loudly.\n    const swallowBindError = () => {};\n    wss.on(\"error\", swallowBindError);\n    this.httpServer = httpServer;\n    this.wss = wss;\n\n    try {\n      await new Promise<void>((resolve, reject) => {\n        httpServer.once(\"error\", reject);\n        httpServer.listen(this.port, () => {\n          httpServer.off(\"error\", reject);\n          resolve();\n        });\n      });\n    } catch (err) {\n      wss.close();\n      this.wss = null;\n      this.httpServer = null;\n      throw err;\n    } finally {\n      wss.off(\"error\", swallowBindError);\n    }\n\n    const addr = httpServer.address();\n    const boundPort = typeof addr === \"object\" && addr ? addr.port : this.port;\n    this.log(`[ws-server] listening on port ${boundPort}`);\n  }\n\n  private handleConnection(ws: WebSocket): void {\n    if (this.activeClient) {\n      // Close the stale connection instead of rejecting the new one.\n      // This handles the race where waitForWsReady's probe hasn't\n      // fully disconnected before the real gateway client connects.\n      this.log(\"[ws-server] replacing previous connection\");\n      try {\n        this.activeClient.close(4001, \"Replaced by new connection\");\n      } catch {\n        // already closed\n      }\n    }\n    this.log(\"[ws-server] client connected\");\n    this.activeClient = ws;\n    for (const handler of this.connectHandlers) {\n      handler();\n    }\n\n    ws.on(\"message\", (data) => {\n      try {\n        const parsed = JSON.parse(String(data)) as Record<string, unknown>;\n        // Protocol v3: shape-validate `session_init` at ingress so the\n        // runner never receives a malformed boot envelope. Other command\n        // shapes pass through unchanged — invalid `AgentCommand`s surface\n        // through the existing per-command handlers in serve.ts.\n        if (parsed && typeof parsed === \"object\" && parsed.type === \"session_init\") {\n          const reason = validateSessionInitShape(parsed);\n          if (reason !== null) {\n            this.log(`[ws-server] rejecting invalid session_init: ${reason}`);\n            this.sendRaw({\n              type: \"error\",\n              message: `Invalid session_init: ${reason}`,\n              fatal: false,\n            });\n            return;\n          }\n        }\n        const cmd = parsed as unknown as AgentCommand;\n        for (const handler of this.commandHandlers) {\n          handler(cmd);\n        }\n      } catch (err) {\n        this.sendRaw({\n          type: \"error\",\n          message: `Invalid message: ${err instanceof Error ? err.message : String(err)}`,\n          fatal: false,\n        });\n      }\n    });\n\n    ws.on(\"close\", () => {\n      this.log(\"[ws-server] client disconnected\");\n      if (this.activeClient === ws) {\n        this.activeClient = null;\n        for (const handler of this.disconnectHandlers) {\n          handler();\n        }\n      }\n    });\n  }\n\n  /**\n   * Stop the server.\n   *\n   * Terminates the active socket immediately — otherwise a still-connected\n   * client would keep the event loop alive and block process shutdown.\n   */\n  async close(): Promise<void> {\n    try {\n      this.activeClient?.terminate();\n    } catch {\n      // already closed\n    }\n    this.activeClient = null;\n    this.wss?.close();\n    this.wss = null;\n    const httpServer = this.httpServer;\n    this.httpServer = null;\n    if (httpServer) {\n      httpServer.closeAllConnections();\n      await new Promise<void>((resolve) => httpServer.close(() => resolve()));\n    }\n  }\n\n  send(event: AgentEvent): void {\n    this.sendRaw(event);\n  }\n\n  onCommand(handler: (command: AgentCommand) => void): () => void {\n    this.commandHandlers.add(handler);\n    return () => {\n      this.commandHandlers.delete(handler);\n    };\n  }\n\n  onConnect(handler: () => void): () => void {\n    this.connectHandlers.add(handler);\n    return () => {\n      this.connectHandlers.delete(handler);\n    };\n  }\n\n  onDisconnect(handler: () => void): () => void {\n    this.disconnectHandlers.add(handler);\n    return () => {\n      this.disconnectHandlers.delete(handler);\n    };\n  }\n\n  get connected(): boolean {\n    return this.activeClient !== null;\n  }\n\n  /** The port actually bound by `listen()` (resolves `port: 0`); `undefined` when not listening. */\n  get boundPort(): number | undefined {\n    const addr = this.httpServer?.address();\n    return typeof addr === \"object\" && addr ? addr.port : undefined;\n  }\n\n  private sendRaw(data: unknown): void {\n    try {\n      const client = this.activeClient;\n      if (client && client.readyState === 1) {\n        client.send(JSON.stringify(data));\n      }\n    } catch {\n      // Silently ignore send failures\n    }\n  }\n}\n"]}

package/dist/chunk-JKJ7XYLG.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../transport/src/ws/client.ts"],"names":[],"mappings":";;;AAUA,IAAM,8BAAA,GAAiC,CAAA;AACvC,IAAM,yBAAA,GAA4B,GAAA;AAClC,IAAM,wBAAA,GAA2B,GAAA;AACjC,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,0BAAA,GAA6B,GAAA;AA2CnC,IAAM,KAAA,GAAQ,OAAQ,UAAA,CAAiC,GAAA,KAAQ,WAAA;AAO/D,eAAe,aAAA,GAAwC;AACrD,EAAA,IAAI,OAAO,YAAY,WAAA,EAAa;AAClC,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,SAAA,GAAY,IAAA;AAClB,EAAA,MAAM,MAAO,MAAM;AAAA;AAAA;AAAA,IAAoD;AAAA,GAAA;AAIvE,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,SAAA,IAAa,GAAA,CAAI,OAAA;AAClC,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAC5E,EAAA,OAAO,IAAA;AACT;AAoBO,IAAM,2BAAN,MAA0D;AAAA,EACvD,EAAA,GAAuB,IAAA;AAAA,EACd,GAAA;AAAA,EACA,eAAA;AAAA,EACA,WAAA;AAAA,EACA,gBAAA;AAAA,EACA,GAAA;AAAA,EACA,YAAA;AAAA,EACA,GAAA;AAAA;AAAA,EAET,SAAA,GAAkC,IAAA;AAAA,EAElC,cAAA,GAAwD,IAAA;AAAA,EACxD,iBAAA,GAAoB,CAAA;AAAA,EACpB,gBAAA,GAAmB,KAAA;AAAA,EAEV,eAAA,uBAAsB,GAAA,EAAiC;AAAA,EACvD,kBAAA,uBAAyB,GAAA,EAAgB;AAAA,EAE1D,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,MAAM,OAAA,CAAQ,GAAA;AACnB,IAAA,IAAA,CAAK,eAAA,GAAkB;AAAA,MACrB,WAAA,EAAa,OAAA,CAAQ,SAAA,EAAW,WAAA,IAAe,8BAAA;AAAA,MAC/C,MAAA,EAAQ,OAAA,CAAQ,SAAA,EAAW,MAAA,IAAU,yBAAA;AAAA,MACrC,KAAA,EAAO,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS;AAAA,KACrC;AACA,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC1C,IAAA,IAAA,CAAK,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,0BAAA;AACpD,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,KAAA,KAAU,MAAM;AAAA,IAAC,CAAA,CAAA;AACpC,IAAA,IAAA,CAAK,YAAA,GAAe,QAAQ,IAAA,GAAO,CAAC,wBAAwB,OAAA,CAAQ,IAAI,CAAC,CAAA,GAAI,EAAC;AAC9E,IAAA,IAAA,CAAK,MAAM,OAAA,CAAQ,GAAA;AAAA,EACrB;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAA,CAAK,gBAAA,GAAmB,KAAA;AACxB,IAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,IAAA,IAAI,IAAA,CAAK,GAAA,IAAO,CAAC,KAAA,IAAS,CAAC,KAAK,SAAA,EAAW,IAAA,CAAK,SAAA,GAAY,MAAM,aAAA,EAAc;AAChF,IAAA,OAAO,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,EAC5B;AAAA,EAEA,MAAM,UAAA,GAA4B;AAChC,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AACxB,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,IAAI,KAAK,EAAA,EAAI;AACX,MAAA,IAAI,IAAA,CAAK,EAAA,CAAG,UAAA,KAAe,SAAA,CAAU,IAAA,EAAM;AACzC,QAAA,IAAA,CAAK,EAAA,CAAG,KAAA,CAAM,GAAA,EAAM,mBAAmB,CAAA;AAAA,MACzC;AACA,MAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,KAAK,OAAA,EAA6B;AAChC,IAAA,IAAI,CAAC,IAAA,CAAK,EAAA,IAAM,KAAK,EAAA,CAAG,UAAA,KAAe,UAAU,IAAA,EAAM;AACrD,MAAA,IAAA,CAAK,IAAI,wCAAwC,CAAA;AACjD,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,EAAA,CAAG,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,EACtC;AAAA,EAEA,UAAU,OAAA,EAAkD;AAC1D,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,OAAO,CAAA;AAChC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,eAAA,CAAgB,OAAO,OAAO,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EAEA,aAAa,OAAA,EAAiC;AAC5C,IAAA,IAAA,CAAK,kBAAA,CAAmB,IAAI,OAAO,CAAA;AACnC,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,kBAAA,CAAmB,OAAO,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,EACF;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAMQ,SAAA,CAAU,YAAY,KAAA,EAAsB;AAClD,IAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC5C,MAAA,IAAA,CAAK,GAAA,CAAI,CAAA,0BAAA,EAA6B,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AAEhD,MAAA,MAAM,EAAA,GAAK,KAAK,YAAA,EAAa;AAC7B,MAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AAMV,MAAA,IAAI,OAAA,GAAU,KAAA;AACd,MAAA,IAAI,MAAA,GAAS,KAAA;AACb,MAAA,MAAM,WAAA,GAAc,CAAC,OAAA,KAAoB;AACvC,QAAA,IAAI,OAAA,EAAS;AACb,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,MAC3B,CAAA;AAEA,MAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC/B,QAAA,IAAI,OAAA,EAAS;AAIb,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,IAAA,CAAK,GAAG,EAAE,CAAC,CAAA;AACrD,QAAA,EAAA,CAAG,KAAA,EAAM;AAAA,MACX,CAAA,EAAG,KAAK,gBAAgB,CAAA;AAExB,MAAA,EAAA,CAAG,gBAAA,CAAiB,QAAQ,MAAM;AAChC,QAAA,YAAA,CAAa,OAAO,CAAA;AACpB,QAAA,MAAA,GAAS,IAAA;AACT,QAAA,IAAA,CAAK,IAAI,uBAAuB,CAAA;AAChC,QAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,QAAA,IAAA,CAAK,cAAA,EAAe;AACpB,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,OAAA,GAAU,IAAA;AACV,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,gBAAA,CAAiB,SAAA,EAAW,CAAC,KAAA,KAAU;AACxC,QAAA,IAAI;AACF,UAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,KAAA,CAAM,IAAI,CAAC,CAAA;AAC1C,UAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,YAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,UACd;AAAA,QACF,CAAA,CAAA,MAAQ;AACN,UAAA,IAAA,CAAK,IAAI,qCAAqC,CAAA;AAAA,QAChD;AAAA,MACF,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,gBAAA,CAAiB,OAAA,EAAS,CAAC,KAAA,KAAU;AACtC,QAAA,YAAA,CAAa,OAAO,CAAA;AACpB,QAAA,IAAA,CAAK,cAAA,EAAe;AACpB,QAAA,IAAA,CAAK,GAAA,CAAI,CAAA,+BAAA,EAAkC,KAAA,CAAM,IAAI,CAAA,CAAA,CAAG,CAAA;AAExD,QAAA,KAAA,MAAW,OAAA,IAAW,KAAK,kBAAA,EAAoB;AAC7C,UAAA,OAAA,EAAQ;AAAA,QACV;AAKA,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,WAAA,CAAY,iBAAiB,IAAA,CAAK,GAAG,CAAA,0BAAA,EAA6B,KAAA,CAAM,IAAI,CAAA,CAAA,CAAG,CAAA;AAC/E,UAAA,IAAI,CAAC,SAAA,IAAa,CAAC,KAAK,gBAAA,IAAoB,KAAA,CAAM,SAAS,GAAA,EAAM;AAC/D,YAAA,IAAA,CAAK,iBAAA,EAAkB;AAAA,UACzB;AACA,UAAA;AAAA,QACF;AAEA,QAAA,IAAI,CAAC,IAAA,CAAK,gBAAA,IAAoB,KAAA,CAAM,SAAS,GAAA,EAAM;AACjD,UAAA,IAAA,CAAK,iBAAA,EAAkB;AAAA,QACzB;AAAA,MACF,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,gBAAA,CAAiB,SAAS,MAAM;AACjC,QAAA,YAAA,CAAa,OAAO,CAAA;AAGpB,QAAA,IAAI,CAAC,MAAA,EAAQ,WAAA,CAAY,CAAA,cAAA,EAAiB,IAAA,CAAK,GAAG,CAAA,mBAAA,CAAqB,CAAA;AAAA,MACzE,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EAEQ,YAAA,GAA0B;AAChC,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,MAAM,EAAE,EAAA,EAAG,GAAI,IAAA,CAAK,GAAA;AACpB,MAAA,IAAI,KAAA,EAAO;AAET,QAAA,MAAM,IAAA,GAAO,EAAE,SAAA,EAAW,IAAA,CAAK,cAAc,GAAA,EAAK,EAAE,IAAG,EAAE;AACzD,QAAA,OAAO,IAAI,SAAA,CAAU,IAAA,CAAK,GAAA,EAAK,IAA2B,CAAA;AAAA,MAC5D;AACA,MAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,MAAM,IAAI,MAAM,4CAA4C,CAAA;AACjF,MAAA,OAAO,IAAI,KAAK,SAAA,CAAU,IAAA,CAAK,KAAK,IAAA,CAAK,YAAA,EAAc,EAAE,EAAA,EAAI,CAAA;AAAA,IAC/D;AAGA,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,MAAA,GAAS,CAAA,GAC9B,IAAI,SAAA,CAAU,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,YAAY,CAAA,GACzC,IAAI,SAAA,CAAU,KAAK,GAAG,CAAA;AAAA,EAC5B;AAAA,EAEQ,iBAAA,GAA0B;AAChC,IAAA,IAAI,IAAA,CAAK,iBAAA,IAAqB,IAAA,CAAK,eAAA,CAAgB,WAAA,EAAa;AAC9D,MAAA,IAAA,CAAK,GAAA,CAAI,CAAA,sCAAA,EAAyC,IAAA,CAAK,iBAAiB,CAAA,SAAA,CAAW,CAAA;AACnF,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,iBAAA,EAAA;AACL,IAAA,MAAM,QAAQ,IAAA,CAAK,GAAA;AAAA,MACjB,IAAA,CAAK,eAAA,CAAgB,MAAA,GAAS,CAAA,KAAM,KAAK,iBAAA,GAAoB,CAAA,CAAA;AAAA,MAC7D,KAAK,eAAA,CAAgB;AAAA,KACvB;AACA,IAAA,IAAA,CAAK,IAAI,CAAA,4BAAA,EAA+B,KAAK,CAAA,YAAA,EAAe,IAAA,CAAK,iBAAiB,CAAA,CAAA,CAAG,CAAA;AAErF,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAI,KAAK,gBAAA,EAAkB;AAC3B,MAAA,IAAA,CAAK,SAAA,EAAU,CAAE,KAAA,CAAM,MAAM;AAAA,MAE7B,CAAC,CAAA;AAAA,IACH,GAAG,KAAK,CAAA;AAAA,EACV;AAAA,EAEQ,cAAA,GAAuB;AAC7B,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,IAAA,CAAK,cAAA,GAAiB,YAAY,MAAM;AACtC,MAAA,IAAI,IAAA,CAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA,EAAM;AAE1C,QAAA,IAAI;AACF,UAAC,IAAA,CAAK,GAAwC,IAAA,IAAO;AAAA,QACvD,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,CAAA,EAAG,KAAK,WAAW,CAAA;AAAA,EACrB;AAAA,EAEQ,cAAA,GAAuB;AAC7B,IAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,MAAA,aAAA,CAAc,KAAK,cAAc,CAAA;AACjC,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,IACxB;AAAA,EACF;AACF","file":"chunk-JKJ7XYLG.js","sourcesContent":["/**\n * WebSocketClientTransport — connects to a skaile serve WebSocket server.\n *\n * Handles connection, reconnection with exponential backoff, heartbeat,\n * and JSON serialization. Implements ClientTransport from @skaile/workspaces/types.\n */\n\nimport type { AgentCommand, AgentEvent, ClientTransport } from \"@skaile/workspaces/types\";\nimport { encodeBearerSubprotocol } from \"./auth.js\";\n\nconst DEFAULT_RECONNECT_MAX_ATTEMPTS = 5;\nconst DEFAULT_RECONNECT_BASE_MS = 1_000;\nconst DEFAULT_RECONNECT_MAX_MS = 30_000;\nconst DEFAULT_HEARTBEAT_MS = 30_000;\nconst DEFAULT_CONNECT_TIMEOUT_MS = 10_000;\n\n/**\n * Options for {@link WebSocketClientTransport}.\n *\n * @param url - WebSocket server URL to connect to (e.g. `ws://localhost:8080`).\n * @param reconnect - Exponential-backoff reconnect policy. Defaults: 5 attempts, 1s base, 30s max.\n * @param heartbeatMs - Interval in milliseconds between WebSocket ping frames. Default: 30 000.\n * @param connectTimeoutMs - Maximum time in milliseconds to wait for the initial handshake. Default: 10 000.\n * @param onLog - Optional callback for internal log lines (connection state, errors).\n * @param auth - Optional bearer token sent via the WebSocket subprotocol; must\n *   match the server's `authToken` or the handshake is rejected with HTTP 401.\n * @param tls - Optional per-connection TLS settings for a `wss://` URL. `ca`\n *   (PEM) replaces the default trust store for this connection only, so the\n *   server certificate must chain to it. Server-side runtimes only: Bun passes\n *   it to its native `WebSocket`, Node dials through the `ws` package (the\n *   global WebSocket takes no CA). Unset, the dial is exactly as before.\n *\n * @docLink packages/transport/dev-guide#websocket-client-transport\n */\nexport interface WebSocketClientOptions {\n  url: string;\n  reconnect?: {\n    maxAttempts?: number;\n    baseMs?: number;\n    maxMs?: number;\n  };\n  heartbeatMs?: number;\n  connectTimeoutMs?: number;\n  onLog?: (line: string) => void;\n  auth?: string;\n  tls?: {\n    ca: string | string[];\n  };\n}\n\n/** The `ws` package's WebSocket constructor, as far as this client uses it. */\ntype WsPackageCtor = new (\n  url: string,\n  protocols: string[],\n  options: { ca: string | string[] },\n) => WebSocket;\n\nconst isBun = typeof (globalThis as { Bun?: unknown }).Bun !== \"undefined\";\n\n/**\n * Load the `ws` package only when a CA pin needs it under Node, so the client\n * subpath keeps no static `ws` import (browser bundles never reach this). The\n * variable specifier keeps bundlers from inlining it.\n */\nasync function loadWsPackage(): Promise<WsPackageCtor> {\n  if (typeof process === \"undefined\") {\n    throw new Error(\"WebSocketClientTransport `tls` is supported under Node and Bun only\");\n  }\n  const specifier = \"ws\";\n  const mod = (await import(/* @vite-ignore */ /* webpackIgnore: true */ specifier)) as {\n    WebSocket?: WsPackageCtor;\n    default?: WsPackageCtor;\n  };\n  const ctor = mod.WebSocket ?? mod.default;\n  if (!ctor) throw new Error(\"the ws package exports no WebSocket constructor\");\n  return ctor;\n}\n\n/**\n * `ClientTransport` implementation that connects to a skaile agent server over WebSocket.\n *\n * Uses the browser-standard `WebSocket` API so it works in both Bun and browser\n * environments. On an unintentional disconnect it automatically retries with\n * exponential backoff (default: 5 attempts, 1s base, 30s max). A periodic ping\n * keeps the connection alive through NAT and load-balancer idle timeouts. All\n * `AgentCommand` / `AgentEvent` messages are JSON-serialised on the wire.\n *\n * @example\n * ```ts\n * const transport = new WebSocketClientTransport({ url: 'ws://localhost:8080' });\n * await transport.connect();\n * transport.send({ type: 'prompt', prompt: 'Hello' });\n * ```\n *\n * @docLink packages/transport/dev-guide#websocket-client-transport\n */\nexport class WebSocketClientTransport implements ClientTransport {\n  private ws: WebSocket | null = null;\n  private readonly url: string;\n  private readonly reconnectConfig: Required<NonNullable<WebSocketClientOptions[\"reconnect\"]>>;\n  private readonly heartbeatMs: number;\n  private readonly connectTimeoutMs: number;\n  private readonly log: (line: string) => void;\n  private readonly subprotocols: string[];\n  private readonly tls: WebSocketClientOptions[\"tls\"];\n  /** Loaded on the first connect when {@link tls} is set under Node. */\n  private wsPackage: WsPackageCtor | null = null;\n\n  private heartbeatTimer: ReturnType<typeof setInterval> | null = null;\n  private reconnectAttempts = 0;\n  private intentionalClose = false;\n\n  private readonly messageHandlers = new Set<(event: AgentEvent) => void>();\n  private readonly disconnectHandlers = new Set<() => void>();\n\n  constructor(options: WebSocketClientOptions) {\n    this.url = options.url;\n    this.reconnectConfig = {\n      maxAttempts: options.reconnect?.maxAttempts ?? DEFAULT_RECONNECT_MAX_ATTEMPTS,\n      baseMs: options.reconnect?.baseMs ?? DEFAULT_RECONNECT_BASE_MS,\n      maxMs: options.reconnect?.maxMs ?? DEFAULT_RECONNECT_MAX_MS,\n    };\n    this.heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;\n    this.connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;\n    this.log = options.onLog ?? (() => {});\n    this.subprotocols = options.auth ? [encodeBearerSubprotocol(options.auth)] : [];\n    this.tls = options.tls;\n  }\n\n  async connect(): Promise<void> {\n    this.intentionalClose = false;\n    this.reconnectAttempts = 0;\n    if (this.tls && !isBun && !this.wsPackage) this.wsPackage = await loadWsPackage();\n    return this.doConnect(true);\n  }\n\n  async disconnect(): Promise<void> {\n    this.intentionalClose = true;\n    this.clearHeartbeat();\n    if (this.ws) {\n      if (this.ws.readyState === WebSocket.OPEN) {\n        this.ws.close(1000, \"Client disconnect\");\n      }\n      this.ws = null;\n    }\n  }\n\n  send(command: AgentCommand): void {\n    if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {\n      this.log(\"[ws-client] cannot send: not connected\");\n      return;\n    }\n    this.ws.send(JSON.stringify(command));\n  }\n\n  onMessage(handler: (event: AgentEvent) => void): () => void {\n    this.messageHandlers.add(handler);\n    return () => {\n      this.messageHandlers.delete(handler);\n    };\n  }\n\n  onDisconnect(handler: () => void): () => void {\n    this.disconnectHandlers.add(handler);\n    return () => {\n      this.disconnectHandlers.delete(handler);\n    };\n  }\n\n  get connected(): boolean {\n    return this.ws?.readyState === WebSocket.OPEN;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Internal\n  // ---------------------------------------------------------------------------\n\n  private doConnect(isInitial = false): Promise<void> {\n    return new Promise<void>((resolve, reject) => {\n      this.log(`[ws-client] connecting to ${this.url}`);\n\n      const ws = this.createSocket();\n      this.ws = ws;\n\n      // Settle the connect promise exactly once. A close or error that arrives\n      // before `open` is a handshake/connect failure (e.g. a rejected auth\n      // upgrade, code 401, or a refused port) — reject so the caller sees it\n      // instead of hanging until the connect timeout.\n      let settled = false;\n      let opened = false;\n      const failConnect = (message: string) => {\n        if (settled) return;\n        settled = true;\n        reject(new Error(message));\n      };\n\n      const timeout = setTimeout(() => {\n        if (settled) return;\n        // Reject with the timeout reason first, then close — closing may\n        // synchronously fire the `close` handler, whose `failConnect` is then a\n        // no-op thanks to the `settled` guard (preserves the timeout message).\n        settled = true;\n        reject(new Error(`Connection timeout to ${this.url}`));\n        ws.close();\n      }, this.connectTimeoutMs);\n\n      ws.addEventListener(\"open\", () => {\n        clearTimeout(timeout);\n        opened = true;\n        this.log(\"[ws-client] connected\");\n        this.reconnectAttempts = 0;\n        this.startHeartbeat();\n        if (!settled) {\n          settled = true;\n          resolve();\n        }\n      });\n\n      ws.addEventListener(\"message\", (event) => {\n        try {\n          const data = JSON.parse(String(event.data)) as AgentEvent;\n          for (const handler of this.messageHandlers) {\n            handler(data);\n          }\n        } catch {\n          this.log(\"[ws-client] failed to parse message\");\n        }\n      });\n\n      ws.addEventListener(\"close\", (event) => {\n        clearTimeout(timeout);\n        this.clearHeartbeat();\n        this.log(`[ws-client] disconnected (code=${event.code})`);\n\n        for (const handler of this.disconnectHandlers) {\n          handler();\n        }\n\n        // Closed before ever opening == connect failure. Reject the pending\n        // connect; only background (reconnect) attempts chain another retry —\n        // an initial connect failure is surfaced to the caller, who owns retry.\n        if (!opened) {\n          failConnect(`Connection to ${this.url} closed before open (code=${event.code})`);\n          if (!isInitial && !this.intentionalClose && event.code !== 1000) {\n            this.scheduleReconnect();\n          }\n          return;\n        }\n\n        if (!this.intentionalClose && event.code !== 1000) {\n          this.scheduleReconnect();\n        }\n      });\n\n      ws.addEventListener(\"error\", () => {\n        clearTimeout(timeout);\n        // A pre-open error is a connect failure; reject now. The close event\n        // (which usually follows) is idempotent via the `settled` guard.\n        if (!opened) failConnect(`Connection to ${this.url} failed before open`);\n      });\n    });\n  }\n\n  private createSocket(): WebSocket {\n    if (this.tls) {\n      const { ca } = this.tls;\n      if (isBun) {\n        // Bun's WebSocket takes an options object in place of the protocols.\n        const init = { protocols: this.subprotocols, tls: { ca } };\n        return new WebSocket(this.url, init as unknown as string[]);\n      }\n      if (!this.wsPackage) throw new Error(\"ws package not loaded before a pinned dial\");\n      return new this.wsPackage(this.url, this.subprotocols, { ca });\n    }\n    // Pass the bearer subprotocol when auth is configured; an empty list keeps\n    // the no-auth handshake byte-identical to before.\n    return this.subprotocols.length > 0\n      ? new WebSocket(this.url, this.subprotocols)\n      : new WebSocket(this.url);\n  }\n\n  private scheduleReconnect(): void {\n    if (this.reconnectAttempts >= this.reconnectConfig.maxAttempts) {\n      this.log(`[ws-client] giving up reconnect after ${this.reconnectAttempts} attempts`);\n      return;\n    }\n\n    this.reconnectAttempts++;\n    const delay = Math.min(\n      this.reconnectConfig.baseMs * 2 ** (this.reconnectAttempts - 1),\n      this.reconnectConfig.maxMs,\n    );\n    this.log(`[ws-client] reconnecting in ${delay}ms (attempt ${this.reconnectAttempts})`);\n\n    setTimeout(() => {\n      if (this.intentionalClose) return;\n      this.doConnect().catch(() => {\n        // doConnect rejection triggers another close → scheduleReconnect cycle\n      });\n    }, delay);\n  }\n\n  private startHeartbeat(): void {\n    this.clearHeartbeat();\n    this.heartbeatTimer = setInterval(() => {\n      if (this.ws?.readyState === WebSocket.OPEN) {\n        // WebSocket ping — Bun's WebSocket supports ping natively\n        try {\n          (this.ws as unknown as { ping?: () => void }).ping?.();\n        } catch {\n          // Fallback: some environments don't support ping on the client\n        }\n      }\n    }, this.heartbeatMs);\n  }\n\n  private clearHeartbeat(): void {\n    if (this.heartbeatTimer) {\n      clearInterval(this.heartbeatTimer);\n      this.heartbeatTimer = null;\n    }\n  }\n}\n"]}