@smart-byte/leani-sdk 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/backfill.js

@@ -1,5 +1,6 @@
-import { LeaniError, responseError } from "./errors.js";
-export { LeaniError } from "./errors.js";
+import { LeaniError, TransportError, responseError } from "./errors.js";
+export { LeaniError, TransportError } from "./errors.js";
+import { concatBytes, idleWatchdog, readChunks, readJson, readText, resolveUnder, send, withDeadline, } from "./transport.js";
 const BACKFILL_BATCHING_PROFILES = {
     latency: {
         targetEncodedBytes: 256 * 1024,
@@ -29,6 +30,22 @@ const BACKFILL_BATCHING_PROFILES = {
 export function backfillBatchingProfile(profile) {
     return { ...BACKFILL_BATCHING_PROFILES[profile] };
 }
+/**
+ * The `fill_missing` subscription for the blocks a live gap notice
+ * announces, its `LiveGapChangeData`, or any other range the destination
+ * lacks. Its idempotency key derives from the consumer and the range, so
+ * creating it again, as after the notice is delivered again, returns the
+ * same subscription.
+ */
+export function liveGapBackfill(range, request) {
+    return {
+        ...request,
+        mode: "fill_missing",
+        fromBlock: range.fromBlock,
+        toBlock: range.toBlock,
+        idempotencyKey: `live-gap:${request.consumer.id}:${range.fromBlock}-${range.toBlock}`,
+    };
+}
 export class BackfillStreamError extends Error {
     code;
     earliestAvailableSequence;
@@ -53,18 +70,19 @@ export function createBackfillSubscriptionClient(options) {
     const timeoutMs = options.timeoutMs ?? 30_000;
     assertPositiveInteger(timeoutMs, "timeoutMs");
     const requestJson = async (method, path, body, signal, credential, sessionToken) => {
-        const response = await fetchImpl(new URL(path, baseUrl), {
+        const headers = requestHeaders(options.token, "application/json", credential, sessionToken);
+        const response = await send(fetchImpl, resolveUnder(baseUrl, path), {
             method,
-            headers: requestHeaders(options.token, "application/json", credential, sessionToken),
+            headers: method === "GET" || body !== undefined
+                ? headers
+                : markLeaniRequest(headers),
             body: body === undefined ? undefined : JSON.stringify(body),
-            signal: signal
-                ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)])
-                : AbortSignal.timeout(timeoutMs),
-        });
+            signal: withDeadline(signal, timeoutMs),
+        }, signal);
         if (!response.ok) {
             throw await responseError(response);
         }
-        return (await response.json());
+        return readJson(response, signal);
     };
     return Object.freeze({
         baseUrl,
@@ -127,29 +145,21 @@ export function createBackfillSubscriptionClient(options) {
         },
         inspect: (subscription, inspectOptions) => requestJson("GET", `admin/v1/backfill-subscriptions/${encodeURIComponent(assertIdentity(subscription, "subscription"))}`, undefined, inspectOptions?.signal),
         cancel: (subscription, cancelOptions) => requestJson("POST", `admin/v1/backfill-subscriptions/${encodeURIComponent(assertIdentity(subscription, "subscription"))}/cancel`, undefined, cancelOptions?.signal),
-        delete: (subscription, deleteOptions) => requestJson("DELETE", `admin/v1/backfill-subscriptions/${encodeURIComponent(assertIdentity(subscription, "subscription"))}`, undefined, deleteOptions?.signal),
+        retry: (subscription, retryOptions) => requestJson("POST", `admin/v1/backfill-subscriptions/${encodeURIComponent(assertIdentity(subscription, "subscription"))}/retry`, undefined, retryOptions?.signal),
+        delete: (subscription, deleteOptions) => requestJson("DELETE", `admin/v1/backfill-subscriptions/${encodeURIComponent(assertIdentity(subscription, "subscription"))}${deleteOptions?.discardUnacknowledged ? "?discardUnacknowledged=true" : ""}`, undefined, deleteOptions?.signal),
         changes: (subscription, consumer, changeOptions = {}) => {
             const path = consumerPath(subscription, consumer, "changes");
-            const url = new URL(path, baseUrl);
-            if (changeOptions.limit !== undefined) {
-                url.searchParams.set("limit", String(assertPositiveInteger(changeOptions.limit, "limit")));
-            }
-            return fetchImpl(url, {
-                headers: requestHeaders(options.token, "application/json", changeOptions.credential),
-                signal: changeOptions.signal,
-            }).then(async (response) => {
-                if (!response.ok) {
-                    throw await responseError(response);
-                }
-                return (await response.json());
-            });
+            const query = changeOptions.limit === undefined
+                ? ""
+                : `?limit=${assertPositiveInteger(changeOptions.limit, "limit")}`;
+            return requestJson("GET", `${path}${query}`, undefined, changeOptions.signal, changeOptions.credential);
         },
-        stream: (subscription, consumer, streamOptions = {}) => openBackfillStream(fetchImpl, baseUrl, options.token, subscription, consumer, streamOptions.credential, streamOptions.batching, streamOptions.signal),
-        streamLive: (processor, consumer, streamOptions = {}) => openLiveStream(fetchImpl, baseUrl, options.token, processor, consumer, streamOptions.credential, streamOptions.signal),
-        subscribe: (request) => openMultiLaneDelivery(fetchImpl, baseUrl, options.token, request),
+        stream: (subscription, consumer, streamOptions = {}) => openBackfillStream(fetchImpl, baseUrl, options.token, timeoutMs, subscription, consumer, streamOptions.credential, streamOptions.batching, streamOptions.signal),
+        streamLive: (processor, consumer, streamOptions = {}) => openLiveStream(fetchImpl, baseUrl, options.token, timeoutMs, processor, consumer, streamOptions.credential, streamOptions.signal),
+        subscribe: (request) => openMultiLaneDelivery(fetchImpl, baseUrl, options.token, timeoutMs, request),
     });
 }
-async function openMultiLaneDelivery(fetchImpl, baseUrl, token, request) {
+async function openMultiLaneDelivery(fetchImpl, baseUrl, token, timeoutMs, request) {
     const processor = assertIdentity(request.processor, "processor");
     const consumer = assertIdentity(request.consumer, "consumer");
     const history = request.lanes.history ?? [];
@@ -164,11 +174,11 @@ async function openMultiLaneDelivery(fetchImpl, baseUrl, token, request) {
     const lanes = [];
     try {
         if (request.lanes.live) {
-            const open = (signal = request.signal) => openLiveStream(fetchImpl, baseUrl, token, processor, consumer, request.credential, signal);
+            const open = (signal = request.signal) => openLiveStream(fetchImpl, baseUrl, token, timeoutMs, processor, consumer, request.credential, signal);
             lanes.push(unifiedLiveLane(await open(), open, request.signal));
         }
         for (const subscriptionId of historyIds) {
-            const open = (signal = request.signal) => openBackfillStream(fetchImpl, baseUrl, token, subscriptionId, consumer, request.credential, request.batching, signal);
+            const open = (signal = request.signal) => openBackfillStream(fetchImpl, baseUrl, token, timeoutMs, subscriptionId, consumer, request.credential, request.batching, signal);
             lanes.push(unifiedHistoryLane(subscriptionId, await open(), open, request.signal));
         }
     }
@@ -289,33 +299,10 @@ function unifiedHistoryLane(subscriptionId, initialSession, open, signal) {
                     return { done: true, value: undefined };
                 if (next.value.type === "heartbeat")
                     continue;
-                if (next.value.type === "backfill_complete") {
-                    complete = true;
-                    const record = next.value;
-                    return {
-                        done: false,
-                        value: {
-                            laneKind: "history",
-                            laneId: subscriptionId,
-                            streamId: record.streamId,
-                            ackCursor: record.cursor,
-                            events: [],
-                            completion: record,
-                            record,
-                        },
-                    };
-                }
-                const record = next.value;
+                complete = next.value.type === "backfill_complete";
                 return {
                     done: false,
-                    value: {
-                        laneKind: "history",
-                        laneId: subscriptionId,
-                        streamId: record.streamId,
-                        ackCursor: record.acknowledgeableCursor,
-                        events: record.changes,
-                        record,
-                    },
+                    value: historyDeliveryBatch(subscriptionId, next.value),
                 };
             }
         },
@@ -323,6 +310,28 @@ function unifiedHistoryLane(subscriptionId, initialSession, open, signal) {
         close: connection.close,
     };
 }
+/** A history batch or the completion with the cursor that acknowledges it. */
+function historyDeliveryBatch(laneId, record) {
+    if (record.type === "backfill_complete") {
+        return {
+            laneKind: "history",
+            laneId,
+            streamId: record.streamId,
+            ackCursor: record.cursor,
+            events: [],
+            completion: record,
+            record,
+        };
+    }
+    return {
+        laneKind: "history",
+        laneId,
+        streamId: record.streamId,
+        ackCursor: record.acknowledgeableCursor,
+        events: record.changes,
+        record,
+    };
+}
 function reconnectingLaneConnection(initialSession, open, signal) {
     const expected = initialSession.hello;
     const stop = new AbortController();
@@ -399,8 +408,10 @@ function reconnectingLaneConnection(initialSession, open, signal) {
             closed = true;
             stop.abort();
             await session.close();
+            // A stopped reconnect rejects with the abort reason, which may be the
+            // caller's own, of any type.
             await reconnectTask?.catch((error) => {
-                if (!isAbortError(error))
+                if (!reconnectSignal.aborted)
                     throw error;
             });
         },
@@ -418,26 +429,16 @@ function validateReplacementHello(expected, replacement) {
         throw streamProtocolError("live", "replacement connection changed its durable lane identity");
     }
 }
+/**
+ * Classified by where the failure came from, never by its message: the SDK
+ * reports every failure below HTTP as a retryable TransportError, and a
+ * caller's abort, a stream record, or a local check is never retried.
+ */
 function isRetryableDeliveryDisconnect(error) {
-    if (isAbortError(error) || error instanceof BackfillStreamError)
-        return false;
-    if (error instanceof LeaniError) {
-        return error.retryable || error.code === "consumer_session_active" ||
-            error.code === "consumer_session_lost";
-    }
-    if (!(error instanceof Error))
-        return false;
-    if (error.name === "consumer_session_active" ||
-        error.name === "consumer_session_lost") {
-        return true;
-    }
-    if (error.name === "NetworkError" || error.name === "TimeoutError")
-        return true;
-    return (error.name === "TypeError" &&
-        /fetch|network|load failed|socket|connection/i.test(error.message));
-}
-function isAbortError(error) {
-    return error instanceof Error && error.name === "AbortError";
+    return (error instanceof LeaniError &&
+        (error.retryable ||
+            error.code === "consumer_session_active" ||
+            error.code === "consumer_session_lost"));
 }
 async function waitForReconnectDelay(delayMs, signal) {
     if (signal.aborted) {
@@ -511,8 +512,8 @@ function iterateUnifiedLanes(lanes, claim) {
         },
     };
 }
-async function openBackfillStream(fetchImpl, baseUrl, token, subscription, consumer, credential, batching, signal) {
-    const session = await openDeliverySession(fetchImpl, baseUrl, token, backfillStreamPath(subscription, consumer, batching), consumerPath(subscription, consumer, "ack"), consumerPath(subscription, consumer, "lease"), credential, signal, "backfill");
+async function openBackfillStream(fetchImpl, baseUrl, token, timeoutMs, subscription, consumer, credential, batching, signal) {
+    const session = await openDeliverySession(fetchImpl, baseUrl, token, timeoutMs, backfillStreamPath(subscription, consumer, batching), consumerPath(subscription, consumer, "ack"), consumerPath(subscription, consumer, "lease"), credential, signal, "backfill");
     const batches = async function* () {
         for await (const record of session) {
             if (record.type === "batch") {
@@ -520,6 +521,15 @@ async function openBackfillStream(fetchImpl, baseUrl, token, subscription, consu
             }
         }
     };
+    // The stream ends once the completion is acknowledged, so iteration
+    // continues past it rather than closing the session first.
+    const deliveryBatches = async function* () {
+        for await (const record of session) {
+            if (record.type !== "heartbeat") {
+                yield historyDeliveryBatch(session.hello.subscriptionId, record);
+            }
+        }
+    };
     const events = async function* () {
         for await (const batch of batches()) {
             yield* batch.changes;
@@ -530,90 +540,119 @@ async function openBackfillStream(fetchImpl, baseUrl, token, subscription, consu
         acknowledge: session.acknowledge.bind(session),
         close: session.close.bind(session),
         batches,
+        deliveryBatches,
         events,
         [Symbol.asyncIterator]: session[Symbol.asyncIterator].bind(session),
     });
 }
-async function openLiveStream(fetchImpl, baseUrl, token, processor, consumer, credential, signal) {
-    return openDeliverySession(fetchImpl, baseUrl, token, liveConsumerPath(processor, consumer, "stream"), liveConsumerPath(processor, consumer, "ack"), liveConsumerPath(processor, consumer, "lease"), credential, signal, "live");
+async function openLiveStream(fetchImpl, baseUrl, token, timeoutMs, processor, consumer, credential, signal) {
+    return openDeliverySession(fetchImpl, baseUrl, token, timeoutMs, liveConsumerPath(processor, consumer, "stream"), liveConsumerPath(processor, consumer, "ack"), liveConsumerPath(processor, consumer, "lease"), credential, signal, "live");
 }
-async function openDeliverySession(fetchImpl, baseUrl, token, streamPath, acknowledgePath, renewPath, credential, signal, streamKind) {
-    const connectionStop = new AbortController();
-    const stopFromCaller = () => connectionStop.abort(signal?.reason);
+async function openDeliverySession(fetchImpl, baseUrl, token, timeoutMs, streamPath, acknowledgePath, renewPath, credential, signal, streamKind) {
+    const connection = new AbortController();
+    // A connection that fails on its own, rather than through the caller's
+    // abort or close(), keeps the failure for the iterator and acknowledge().
+    let failure;
+    const fail = (error) => {
+        if (connection.signal.aborted) {
+            return;
+        }
+        failure = error;
+        connection.abort(error);
+    };
+    const stopFromCaller = () => connection.abort(signal?.reason);
+    signal?.addEventListener("abort", stopFromCaller, { once: true });
     if (signal?.aborted) {
         stopFromCaller();
     }
-    else {
-        signal?.addEventListener("abort", stopFromCaller, { once: true });
-    }
-    const response = await fetchImpl(new URL(streamPath, baseUrl), {
-        headers: requestHeaders(token, "application/x-ndjson", credential),
-        signal: connectionStop.signal,
-    });
-    if (!response.ok) {
-        signal?.removeEventListener("abort", stopFromCaller);
-        throw await responseError(response);
-    }
-    if (!response.body) {
-        signal?.removeEventListener("abort", stopFromCaller);
-        throw new BackfillStreamError({
-            type: "error",
-            code: "stream_body_missing",
-            message: `${streamKind} stream response has no body`,
-            earliestAvailableSequence: null,
-            latestAvailableSequence: null,
-        });
-    }
-    const records = parseNdjson(response.body, connectionStop.signal);
-    const first = await records.next();
-    if (first.done) {
-        connectionStop.abort();
-        signal?.removeEventListener("abort", stopFromCaller);
-        throw streamProtocolError(streamKind, "stream ended before its hello record");
+    // Until its hello arrives, the stream may stay silent as long as a JSON
+    // request may take; afterwards, for three heartbeat intervals.
+    let watchdog = idleWatchdog(timeoutMs, () => fail(new TransportError(`${streamKind} stream sent no hello within ${timeoutMs} ms`)));
+    let records;
+    let wireHello;
+    let sessionToken;
+    let leaseTtlMs;
+    let heartbeatIntervalMs;
+    try {
+        watchdog.arm();
+        const response = await send(fetchImpl, resolveUnder(baseUrl, streamPath), {
+            headers: requestHeaders(token, "application/x-ndjson", credential),
+            signal: connection.signal,
+        }, signal);
+        if (!response.ok) {
+            throw await responseError(response);
+        }
+        if (!response.body) {
+            throw new BackfillStreamError({
+                type: "error",
+                code: "stream_body_missing",
+                message: `${streamKind} stream response has no body`,
+                earliestAvailableSequence: null,
+                latestAvailableSequence: null,
+            });
+        }
+        records = ndjsonRecords(response.body, connection.signal, () => watchdog.arm());
+        const first = await records.next();
+        if (first.done) {
+            throw streamProtocolError(streamKind, "stream ended before its hello record");
+        }
+        const firstType = first.value.type;
+        if (firstType === "error" || firstType === "reset_required") {
+            throw new BackfillStreamError(first.value);
+        }
+        if (firstType !== "hello") {
+            throw streamProtocolError(streamKind, "first stream record is not hello");
+        }
+        wireHello = first.value;
+        sessionToken = assertIdentity(wireHello.sessionToken, "stream hello sessionToken");
+        leaseTtlMs = parseHelloDuration(wireHello.leaseTtlMs, "leaseTtlMs");
+        heartbeatIntervalMs = parseHelloDuration(wireHello.heartbeatIntervalMs, "heartbeatIntervalMs");
     }
-    const firstType = first.value.type;
-    if (firstType === "error" || firstType === "reset_required") {
-        connectionStop.abort();
+    catch (error) {
+        connection.abort();
         signal?.removeEventListener("abort", stopFromCaller);
-        throw new BackfillStreamError(first.value);
+        await records?.return(undefined).catch(() => undefined);
+        throw failure ?? error;
     }
-    if (firstType !== "hello") {
-        connectionStop.abort();
-        signal?.removeEventListener("abort", stopFromCaller);
-        throw streamProtocolError(streamKind, "first stream record is not hello");
+    finally {
+        watchdog.disarm();
     }
-    const wireHello = first.value;
-    const sessionToken = assertIdentity(wireHello.sessionToken, "stream hello sessionToken");
-    const leaseTtlMs = parseLeaseTtl(wireHello.leaseTtlMs);
+    const stream = records;
     const { sessionToken: _sessionToken, ...publicHello } = wireHello;
-    const renewalStop = new AbortController();
-    let renewalError;
-    const renewalTask = renewSessionUntilStopped(fetchImpl, baseUrl, token, renewPath, credential, sessionToken, leaseTtlMs, renewalStop.signal).catch((error) => {
-        if (!renewalStop.signal.aborted) {
-            renewalError = error;
+    const idleMs = 3 * heartbeatIntervalMs;
+    watchdog = idleWatchdog(idleMs, () => fail(new TransportError(`${streamKind} stream sent nothing for ${idleMs} ms`)));
+    const renewal = new AbortController();
+    const renewalTask = renewSessionUntilStopped(fetchImpl, baseUrl, token, timeoutMs, renewPath, credential, sessionToken, leaseTtlMs, renewal.signal).catch((error) => {
+        // A lease that cannot be renewed ends the connection at once instead of
+        // at the next record, which may never come.
+        if (!renewal.signal.aborted) {
+            fail(error);
         }
     });
     let iteratorClaimed = false;
     let closeTask;
     const close = () => {
         closeTask ??= (async () => {
-            renewalStop.abort();
-            connectionStop.abort();
+            renewal.abort();
+            watchdog.disarm();
+            connection.abort();
             signal?.removeEventListener("abort", stopFromCaller);
             try {
-                await records.return(undefined);
+                await stream.return(undefined);
             }
             catch (error) {
-                if (!connectionStop.signal.aborted) {
+                if (!connection.signal.aborted) {
                     throw error;
                 }
             }
             await renewalTask;
             try {
-                await fetchImpl(new URL(renewPath, baseUrl), {
+                const released = await send(fetchImpl, resolveUnder(baseUrl, renewPath), {
                     method: "DELETE",
-                    headers: requestHeaders(token, "application/json", credential, sessionToken),
-                });
+                    headers: markLeaniRequest(requestHeaders(token, "application/json", credential, sessionToken)),
+                    signal: AbortSignal.timeout(timeoutMs),
+                }, undefined);
+                void released.body?.cancel().catch(() => undefined);
             }
             catch {
                 // The lease also expires and is passively released when the stream
@@ -629,14 +668,27 @@ async function openDeliverySession(fetchImpl, baseUrl, token, streamPath, acknow
         iteratorClaimed = true;
         try {
             while (true) {
-                if (renewalError !== undefined) {
-                    throw renewalError;
+                let next;
+                // Only a pending read counts silence, not the time the application
+                // spends on a record.
+                watchdog.arm();
+                try {
+                    next = await stream.next();
                 }
-                const next = await records.next();
-                if (next.done) {
-                    if (renewalError !== undefined) {
-                        throw renewalError;
+                catch (error) {
+                    // The caller's abort and close() end the iteration quietly.
+                    if (failure === undefined && connection.signal.aborted) {
+                        return;
                     }
+                    throw failure ?? error;
+                }
+                finally {
+                    watchdog.disarm();
+                }
+                if (failure !== undefined) {
+                    throw failure;
+                }
+                if (next.done) {
                     return;
                 }
                 const record = next.value;
@@ -660,19 +712,20 @@ async function openDeliverySession(fetchImpl, baseUrl, token, streamPath, acknow
             if (closeTask !== undefined) {
                 throw new TypeError("delivery session is closed");
             }
-            if (renewalError !== undefined) {
-                throw renewalError;
+            if (failure !== undefined) {
+                throw failure;
             }
-            const acknowledge = await fetchImpl(new URL(acknowledgePath, baseUrl), {
+            const caller = acknowledgeOptions?.signal;
+            const acknowledge = await send(fetchImpl, resolveUnder(baseUrl, acknowledgePath), {
                 method: "POST",
                 headers: requestHeaders(token, "application/json", credential, sessionToken),
                 body: JSON.stringify({ cursor: assertIdentity(cursor, "cursor") }),
-                signal: acknowledgeOptions?.signal,
-            });
+                signal: withDeadline(caller, timeoutMs),
+            }, caller);
             if (!acknowledge.ok) {
                 throw await responseError(acknowledge);
             }
-            return (await acknowledge.json());
+            return readJson(acknowledge, caller);
         },
         close,
         [Symbol.asyncIterator]: iterate,
@@ -687,79 +740,125 @@ function streamProtocolError(streamKind, message) {
         latestAvailableSequence: null,
     });
 }
-async function renewSessionUntilStopped(fetchImpl, baseUrl, token, renewPath, credential, sessionToken, leaseTtlMs, stop) {
+async function renewSessionUntilStopped(fetchImpl, baseUrl, token, timeoutMs, renewPath, credential, sessionToken, leaseTtlMs, stop) {
     const intervalMs = Math.max(50, Math.floor(leaseTtlMs / 3));
+    const firstRetryMs = Math.max(10, Math.floor(intervalMs / 10));
+    // The node renewed the lease no earlier than the request that renewed it.
+    let renewedAt = performance.now();
+    let delayMs = intervalMs;
+    let retryMs = firstRetryMs;
     while (!stop.aborted) {
-        await abortableDelay(intervalMs, stop);
+        await abortableDelay(delayMs, stop);
         if (stop.aborted) {
             return;
         }
-        const response = await fetchImpl(new URL(renewPath, baseUrl), {
-            method: "POST",
-            headers: requestHeaders(token, "application/json", credential, sessionToken),
-            signal: stop,
-        });
-        if (!response.ok) {
-            throw await responseError(response);
+        const attemptedAt = performance.now();
+        const leaseLeftMs = renewedAt + leaseTtlMs - attemptedAt;
+        try {
+            const response = await send(fetchImpl, resolveUnder(baseUrl, renewPath), {
+                method: "POST",
+                headers: markLeaniRequest(requestHeaders(token, "application/json", credential, sessionToken)),
+                // An answer after the lease lapsed could not keep it.
+                signal: withDeadline(stop, Math.max(1, Math.min(timeoutMs, Math.floor(leaseLeftMs)))),
+            }, stop);
+            if (!response.ok) {
+                throw await responseError(response);
+            }
+            await readText(response, stop);
+            renewedAt = attemptedAt;
+            delayMs = intervalMs;
+            retryMs = firstRetryMs;
+        }
+        catch (error) {
+            // Retry a transient failure, with backoff, while the lease holds.
+            const retryable = error instanceof LeaniError && error.retryable;
+            if (stop.aborted ||
+                !retryable ||
+                renewedAt + leaseTtlMs - performance.now() <= retryMs) {
+                throw error;
+            }
+            delayMs = retryMs;
+            retryMs *= 2;
         }
-        await response.arrayBuffer();
     }
 }
 function abortableDelay(delayMs, signal) {
     return new Promise((resolve) => {
-        const timeout = setTimeout(resolve, delayMs);
-        signal.addEventListener("abort", () => {
+        const finish = () => {
             clearTimeout(timeout);
+            signal.removeEventListener("abort", finish);
             resolve();
-        }, { once: true });
+        };
+        const timeout = setTimeout(finish, delayMs);
+        signal.addEventListener("abort", finish, { once: true });
     });
 }
-function parseLeaseTtl(value) {
-    const ttl = Number(value);
-    if (!Number.isSafeInteger(ttl) || ttl <= 0) {
-        throw new TypeError("stream hello contains an invalid leaseTtlMs");
+function parseHelloDuration(value, field) {
+    const milliseconds = Number(value);
+    if (!Number.isSafeInteger(milliseconds) || milliseconds <= 0) {
+        throw new TypeError(`stream hello contains an invalid ${field}`);
     }
-    return ttl;
+    return milliseconds;
 }
 export async function* parseNdjson(body, signal) {
-    const reader = body.getReader();
-    const cancel = () => { void reader.cancel().catch(() => { }); };
-    signal?.addEventListener("abort", cancel, { once: true });
-    if (signal?.aborted)
-        cancel();
+    yield* ndjsonRecords(body, signal);
+}
+/**
+ * The largest NDJSON record the client buffers: the node's default buffer
+ * for a batch's changes, 64 MiB, and room for the batch's own fields.
+ */
+const MAX_NDJSON_RECORD_BYTES = 65 * 1024 * 1024;
+const LINE_FEED = 0x0a;
+/**
+ * Split NDJSON records at line feeds, scanning each byte once. A line feed is
+ * ASCII, so a scan by byte never splits a UTF-8 character.
+ */
+async function* ndjsonRecords(body, signal, onChunk) {
     const decoder = new TextDecoder();
-    let buffer = "";
-    try {
-        while (true) {
-            if (signal?.aborted) {
-                throw signal.reason ?? new DOMException("aborted", "AbortError");
+    // The bytes received so far of the record in progress.
+    let pending = [];
+    let pendingBytes = 0;
+    for await (const chunk of readChunks(body, signal, onChunk)) {
+        let lineStart = 0;
+        let newline = chunk.indexOf(LINE_FEED);
+        while (newline >= 0) {
+            const tail = chunk.subarray(lineStart, newline);
+            if (pendingBytes + tail.length > MAX_NDJSON_RECORD_BYTES) {
+                throw ndjsonRecordTooLarge();
             }
-            const { done, value } = await reader.read();
-            buffer += decoder.decode(value, { stream: !done });
-            let newline = buffer.indexOf("\n");
-            while (newline >= 0) {
-                const line = buffer.slice(0, newline).trim();
-                buffer = buffer.slice(newline + 1);
-                if (line) {
-                    yield JSON.parse(line);
-                }
-                newline = buffer.indexOf("\n");
+            const line = decoder
+                .decode(concatBytes(pending, pendingBytes, tail))
+                .trim();
+            pending = [];
+            pendingBytes = 0;
+            lineStart = newline + 1;
+            if (line) {
+                yield JSON.parse(line);
             }
-            if (done) {
-                const finalLine = buffer.trim();
-                if (finalLine) {
-                    yield JSON.parse(finalLine);
-                }
-                return;
+            newline = chunk.indexOf(LINE_FEED, lineStart);
+        }
+        const rest = chunk.subarray(lineStart);
+        if (rest.length > 0) {
+            pendingBytes += rest.length;
+            if (pendingBytes > MAX_NDJSON_RECORD_BYTES) {
+                throw ndjsonRecordTooLarge();
             }
+            pending.push(rest);
         }
     }
-    finally {
-        signal?.removeEventListener("abort", cancel);
-        await reader.cancel().catch(() => { });
-        reader.releaseLock();
+    if (signal?.aborted) {
+        throw signal.reason ?? new DOMException("aborted", "AbortError");
+    }
+    const finalLine = decoder
+        .decode(concatBytes(pending, pendingBytes, new Uint8Array()))
+        .trim();
+    if (finalLine) {
+        yield JSON.parse(finalLine);
     }
 }
+function ndjsonRecordTooLarge() {
+    return new LeaniError(`NDJSON record exceeds ${MAX_NDJSON_RECORD_BYTES} bytes`, { status: 200, code: "invalid_response", retryable: false });
+}
 function normalizeBaseUrl(value) {
     const url = new URL(value);
     if (!url.pathname.endsWith("/")) {
@@ -783,6 +882,11 @@ function requestHeaders(token, accept, credential, sessionToken) {
     }
     return headers;
 }
+/** Mark a mutation without a JSON body, which the node otherwise refuses. */
+function markLeaniRequest(headers) {
+    headers.set("x-leani-request", "1");
+    return headers;
+}
 function consumerPath(subscription, consumer, operation) {
     return (`v1/backfill-subscriptions/${encodeURIComponent(assertIdentity(subscription, "subscription"))}` +
         `/consumers/${encodeURIComponent(assertIdentity(consumer, "consumer"))}/${operation}`);