@spfn/core 0.3.0-beta.22 → 0.3.0-beta.24

package/dist/{router-CysBmgv3.d.ts → router-ZDV1ISTo.d.ts}

@@ -40,6 +40,63 @@ interface EventContract {
     /** Contract version the event was removed in. */
     removedIn?: string;
 }
+/**
+ * What the stream request asked for, copied once at connect.
+ *
+ * A plain snapshot, never the live Hono context, so a frame filter can read it
+ * on every frame long after the request object is gone. Header names are
+ * lowercased. It may hold `cookie` and `authorization` values — never log it.
+ */
+interface SubscribeRequest {
+    /** Query parameters of the stream URL (`events`, `token` and any the app adds). */
+    query: Record<string, string>;
+    /** Request headers, names lowercased. */
+    headers: Record<string, string>;
+}
+/**
+ * What `.canSubscribe()` decides on, once per connection per requested event.
+ *
+ * `P` is whatever the SSE auth config's `resolvePrincipal` returns — core never
+ * knows what a principal is.
+ */
+interface SubscribeContext<P = unknown> {
+    /** The subject the one-time token was issued to. */
+    subject: string;
+    /** The value `resolvePrincipal` returned for this connection, `undefined` without one. */
+    principal: P | undefined;
+    /** The connect request snapshot. */
+    request: SubscribeRequest;
+}
+/**
+ * Decides at connect whether a subject may receive an event. `false` or a
+ * throw denies the event on that connection; the connection stays open.
+ */
+type SubscribePredicate<P = unknown> = (ctx: SubscribeContext<P>) => boolean | Promise<boolean>;
+/**
+ * What a per-event `.filter()` sees on every frame.
+ */
+interface FrameContext {
+    /** The connection's subject, `undefined` when the stream runs without auth. */
+    subject: string | undefined;
+    /** The connect request snapshot. */
+    request: SubscribeRequest;
+}
+/**
+ * Decides per frame whether one connection receives one payload. Sync: it runs
+ * for every connection on every emit, so it matches the payload against what
+ * the connection asked for and never reads storage.
+ */
+type FramePredicate<TPayload> = (payload: TPayload, ctx: FrameContext) => boolean;
+/**
+ * How an SSE handler lets `grant` / `revoke` reach its open connections.
+ * Each handler registers one per router key of the event.
+ */
+interface SubscriptionControl {
+    /** Activate the event on every open connection of `subject` where it is denied. */
+    grant: (subject: string) => void;
+    /** Deactivate the event on every open connection of `subject` where it is allowed. */
+    revoke: (subject: string) => void;
+}
 /**
  * Event definition interface
  */
@@ -68,6 +125,43 @@ interface EventDef<TPayload = void> {
      * declarations silently winning.
      */
     contract: (contract: EventContract) => EventDef<TPayload>;
+    /**
+     * The predicate declared with `.canSubscribe()`, absent when any subject
+     * that passes the global `authorize` may subscribe.
+     */
+    readonly _canSubscribe?: SubscribePredicate<any>;
+    /**
+     * Declare who may subscribe to this event over SSE.
+     *
+     * Runs once per connection, after the global `authorize`, only when the
+     * connection has a subject. `P` is the type of the principal the SSE auth
+     * config's `resolvePrincipal` returns. Set once: a second call throws.
+     *
+     * @example
+     * ```typescript
+     * export const auditLogged = defineEvent('audit.logged', payload)
+     *     .canSubscribe<AuthPrincipal>(({ principal }) => principal?.role === 'admin');
+     * ```
+     */
+    canSubscribe: <P = unknown>(predicate: SubscribePredicate<P>) => EventDef<TPayload>;
+    /**
+     * The per-frame predicate declared with `.filter()`.
+     */
+    readonly _filter?: FramePredicate<TPayload>;
+    /**
+     * Declare which frames of this event a connection receives.
+     *
+     * Runs per frame on every connection subscribed to the event, with or
+     * without a subject, beside the global `filter` map (both must pass). Sync.
+     * Set once: a second call throws.
+     *
+     * @example
+     * ```typescript
+     * export const runtimeChanged = defineEvent('runtime.changed', payload)
+     *     .filter((payload, { request }) => payload.workspaceId === request.query.workspaceId);
+     * ```
+     */
+    filter: (predicate: FramePredicate<TPayload>) => EventDef<TPayload>;
     /**
      * Subscribe to this event (in-memory handler)
      */
@@ -80,6 +174,23 @@ interface EventDef<TPayload = void> {
      * Emit the event (triggers all subscribers and queued jobs)
      */
     emit: TPayload extends void ? () => Promise<void> : (payload: TPayload) => Promise<void>;
+    /**
+     * Activate this event on every open SSE connection of `subject` where it is
+     * denied — by `canSubscribe` or `authorize` at connect, or by a `revoke`.
+     *
+     * Reaches every pod when the cache transport is attached. Never re-runs
+     * `canSubscribe`: it is an operator's statement about an open connection.
+     * An event the connection never requested cannot be granted.
+     */
+    grant: (subject: string) => Promise<void>;
+    /**
+     * Deactivate this event on every open SSE connection of `subject` where it
+     * is allowed; the client receives a `subscription.revoked` frame.
+     *
+     * Reaches every pod when the cache transport is attached. Affects open
+     * connections only — the next connect asks `canSubscribe` afresh.
+     */
+    revoke: (subject: string) => Promise<void>;
     /**
      * Enable cache-based pub/sub for multi-instance support
      * Must await before emitting events to ensure subscription is ready
@@ -90,6 +201,12 @@ interface EventDef<TPayload = void> {
      * Called by job registration system
      */
     _registerJobQueue: (queueName: string, sender: JobQueueSender) => void;
+    /**
+     * Internal: Let an SSE handler's connection registry receive `grant` /
+     * `revoke`. Called by `createSSEHandler` once per router key; every
+     * registered control receives every call. Returns the unregister function.
+     */
+    _registerSubscriptionControl: (control: SubscriptionControl) => () => void;
     /**
      * Internal: Drop the cache binding (cache + subscribed flag).
      * Called by the event cache transport on shutdown so a later useCache can
@@ -229,4 +346,4 @@ type InferEventPayloads<T extends EventRouterBase<any>> = T['_types'];
  */
 declare function defineEventRouter<TEvents extends Record<string, EventDef<any>>>(events: TEvents): EventRouterDef<TEvents>;
 
-export { type EventRouterDef as E, type InferEventNames as I, type JobQueueSender as J, type PubSubCache as P, type EventDef as a, type EventContract as b, type EventHandler as c, type EventRouterContract as d, type InferEventPayload$1 as e, type InferEventPayloads as f, type InferEventPayload as g, defineEventRouter as h, type EventRouterBase as i };
+export { type EventRouterDef as E, type FrameContext as F, type InferEventNames as I, type JobQueueSender as J, type PubSubCache as P, type SubscribeContext as S, type EventDef as a, type EventContract as b, type EventHandler as c, type EventRouterContract as d, type FramePredicate as e, type InferEventPayload$1 as f, type InferEventPayloads as g, type InferEventPayload as h, type SubscribePredicate as i, type SubscribeRequest as j, defineEventRouter as k, type EventRouterBase as l };

package/dist/server/index.d.ts

@@ -6,9 +6,9 @@ import { NamedMiddleware, Router } from '@spfn/core/route';
 import { OnErrorContext, ProxyGuardConfig, RateLimitOptions } from '@spfn/core/middleware';
 import { SafeFetchPolicy } from '@spfn/core/security';
 import { c as JobRouter, f as BossOptions } from '../boss-BiDCbbAQ.js';
-import { E as EventRouterDef, a as EventDef } from '../router-CysBmgv3.js';
-import { d as SSEHandlerConfig, e as SSEAuthConfig } from '../types-B8zAxFsE.js';
-import { W as WSRouterDef, f as WSHandlerConfig, e as WSMessageHandlers, g as WSAuthConfig } from '../types-W4u_S0lF.js';
+import { E as EventRouterDef, a as EventDef } from '../router-ZDV1ISTo.js';
+import { d as SSEHandlerConfig, e as SSEAuthConfig } from '../types-C_g6gD-w.js';
+import { W as WSRouterDef, f as WSHandlerConfig, e as WSMessageHandlers, g as WSAuthConfig } from '../types-cwMX0cyJ.js';
 import { DatabaseProvider, MigrationStatus, MigrationStatusDb } from '@spfn/core/db';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import { Static } from '@sinclair/typebox';

package/dist/server/index.js

@@ -468,6 +468,114 @@ function createBoundedWriter(stream, maxQueue, onClose) {
     }
   };
 }
+var registryLogger = logger.child("@spfn/core:sse");
+var SUBSCRIPTION_GRANTED = "subscription.granted";
+var SUBSCRIPTION_REVOKED = "subscription.revoked";
+function createConnectionRegistry() {
+  const bySubject = /* @__PURE__ */ new Map();
+  const pendingBySubject = /* @__PURE__ */ new Map();
+  const beginAdmission = (subject, signal) => {
+    const changes = /* @__PURE__ */ new Map();
+    addToSet(pendingBySubject, subject, changes);
+    const end = endOnce(signal, () => removeFromSet(pendingBySubject, subject, changes));
+    return {
+      cancel: end,
+      open: (connection) => {
+        if (!end()) {
+          return false;
+        }
+        applyRecorded(connection, changes);
+        addToSet(bySubject, subject, connection);
+        return true;
+      }
+    };
+  };
+  const change = (kind, subject, eventName) => {
+    const pending = pendingBySubject.get(subject);
+    const connections = bySubject.get(subject);
+    pending?.forEach((changes) => changes.set(eventName, kind));
+    connections?.forEach((connection) => (kind === "grant" ? grantOn : revokeOn)(connection, eventName));
+    if (!pending && !connections) {
+      registryLogger.debug("SSE subscription change for a subject with no open connection ignored", {
+        event: eventName,
+        subject
+      });
+    }
+  };
+  return {
+    beginAdmission,
+    remove: (connection) => {
+      if (connection.subject) {
+        removeFromSet(bySubject, connection.subject, connection);
+      }
+    },
+    /** Open connections only — a pending admission is not counted. */
+    count: (subject) => bySubject.get(subject)?.size ?? 0,
+    pendingCount: (subject) => pendingBySubject.get(subject)?.size ?? 0,
+    grant: (subject, eventName) => change("grant", subject, eventName),
+    revoke: (subject, eventName) => change("revoke", subject, eventName)
+  };
+}
+function endOnce(signal, remove) {
+  let ended = false;
+  const end = () => {
+    if (ended) {
+      return false;
+    }
+    ended = true;
+    signal.removeEventListener("abort", end);
+    remove();
+    return true;
+  };
+  signal.addEventListener("abort", end, { once: true });
+  if (signal.aborted) {
+    end();
+  }
+  return end;
+}
+function addToSet(map, key, value) {
+  const set = map.get(key) ?? /* @__PURE__ */ new Set();
+  set.add(value);
+  map.set(key, set);
+}
+function removeFromSet(map, key, value) {
+  const set = map.get(key);
+  set?.delete(value);
+  if (set?.size === 0) {
+    map.delete(key);
+  }
+}
+function applyRecorded(connection, changes) {
+  changes.forEach((kind, eventName) => {
+    const [from, to] = kind === "grant" ? [connection.denied, connection.allowed] : [connection.allowed, connection.denied];
+    if (from.delete(eventName)) {
+      to.add(eventName);
+    }
+  });
+}
+function grantOn(connection, eventName) {
+  if (!connection.denied.has(eventName)) {
+    return;
+  }
+  connection.unsubscribes.set(eventName, connection.subscribe(eventName));
+  connection.denied.delete(eventName);
+  connection.allowed.add(eventName);
+  connection.notify(SUBSCRIPTION_GRANTED, eventName);
+}
+function revokeOn(connection, eventName) {
+  if (!connection.allowed.has(eventName)) {
+    return;
+  }
+  connection.unsubscribes.get(eventName)?.();
+  connection.unsubscribes.delete(eventName);
+  connection.allowed.delete(eventName);
+  connection.denied.add(eventName);
+  connection.notify(SUBSCRIPTION_REVOKED, eventName);
+}
+function unsubscribeAll(connection) {
+  connection.unsubscribes.forEach((unsubscribe) => unsubscribe());
+  connection.unsubscribes.clear();
+}
 
 // src/event/sse/handler.ts
 var sseLogger = logger.child("@spfn/core:sse");
@@ -498,125 +606,264 @@ function createSSEHandler(router, config = {}, tokenManager) {
     auth: authConfig,
     maxQueue = DEFAULT_MAX_QUEUE
   } = config;
-  return async (c) => {
-    const subject = await authenticateToken(c, tokenManager);
-    if (subject === false) {
-      return c.json({ error: "Missing token parameter" }, 401);
+  const registry = createConnectionRegistry();
+  registerSubscriptionControls(router, registry);
+  const streamConfig = { router, authConfig, registry, pingInterval, maxQueue };
+  const handler = async (c) => {
+    const admission = await admitConnection(c, streamConfig, tokenManager);
+    if (admission instanceof Response) {
+      return admission;
     }
-    if (subject === null) {
-      return c.json({ error: "Invalid or expired token" }, 401);
+    if (c.req.raw.signal.aborted) {
+      admission.pending?.cancel();
+      return new Response(null, { status: 499 });
     }
-    if (subject) {
-      c.set("sseSubject", subject);
+    c.header("X-Accel-Buffering", "no");
+    return streamSSE(c, (stream) => runStream(c, stream, admission, streamConfig), async (err) => {
+      sseLogger.error("SSE stream error", {
+        error: err.message
+      });
+    });
+  };
+  return Object.assign(handler, {
+    /** @internal Open registered connections of a subject (tests). */
+    _openConnections: (subject) => registry.count(subject),
+    /** @internal Connects of a subject still in admission (tests). */
+    _pendingAdmissions: (subject) => registry.pendingCount(subject)
+  });
+}
+function registerSubscriptionControls(router, registry) {
+  for (const eventName of router.eventNames) {
+    router.events[eventName]._registerSubscriptionControl({
+      grant: (subject) => registry.grant(subject, eventName),
+      revoke: (subject) => registry.revoke(subject, eventName)
+    });
+  }
+}
+async function admitConnection(c, config, tokenManager) {
+  const { router, authConfig, registry } = config;
+  const subject = await authenticateToken(c, tokenManager);
+  if (subject === false) {
+    return c.json({ error: "Missing token parameter" }, 401);
+  }
+  if (subject === null) {
+    return c.json({ error: "Invalid or expired token" }, 401);
+  }
+  if (subject) {
+    c.set("sseSubject", subject);
+  }
+  const requested = parseRequestedEvents(c);
+  if (!requested) {
+    return c.json({ error: "Missing events parameter" }, 400);
+  }
+  const validEventNames = router.eventNames;
+  const invalidEvents = requested.filter((e) => !validEventNames.includes(e));
+  if (invalidEvents.length > 0) {
+    return c.json({
+      error: "Invalid event names",
+      invalidEvents,
+      validEvents: validEventNames
+    }, 400);
+  }
+  return whilePending(
+    subject ? registry.beginAdmission(subject, c.req.raw.signal) : void 0,
+    () => authorizeConnection(c, router, authConfig, subject, requested)
+  );
+}
+async function whilePending(pending, check) {
+  let outcome;
+  try {
+    outcome = await check();
+    return outcome instanceof Response ? outcome : { ...outcome, pending };
+  } finally {
+    if (!outcome || outcome instanceof Response) {
+      pending?.cancel();
     }
-    const requestedEvents = parseRequestedEvents(c);
-    if (!requestedEvents) {
-      return c.json({ error: "Missing events parameter" }, 400);
+  }
+}
+async function authorizeConnection(c, router, authConfig, subject, requested) {
+  const authorized = await authorizeEvents(subject, requested, authConfig);
+  if (authorized === null) {
+    return c.json({ error: "Not authorized for any requested events" }, 403);
+  }
+  const request = { query: c.req.query(), headers: c.req.header() };
+  const resolved = await resolveConnectionPrincipal(subject, request, authConfig);
+  if (!resolved) {
+    return c.json({ error: "Principal could not be resolved" }, 403);
+  }
+  const allowed = subject ? await checkCanSubscribe(router, authorized, { subject, principal: resolved.principal, request }) : authorized;
+  const denied = requested.filter((e) => !allowed.includes(e));
+  sseLogger.debug("SSE connection requested", {
+    events: allowed,
+    deniedEvents: denied,
+    subject: subject || void 0,
+    clientIp: c.req.header("x-forwarded-for") || c.req.header("x-real-ip")
+  });
+  return { subject, requested, allowed, denied, request };
+}
+async function resolveConnectionPrincipal(subject, request, authConfig) {
+  if (!subject || !authConfig?.resolvePrincipal) {
+    return { principal: void 0 };
+  }
+  try {
+    return { principal: await authConfig.resolvePrincipal(subject, request) };
+  } catch {
+    sseLogger.warn("SSE principal could not be resolved \u2014 connection refused", { subject });
+    return null;
+  }
+}
+async function checkCanSubscribe(router, events, ctx) {
+  const verdicts = await Promise.all(events.map((eventName) => askCanSubscribe(eventName, router.events[eventName], ctx)));
+  return events.filter((_, i) => verdicts[i]);
+}
+async function askCanSubscribe(eventName, eventDef, ctx) {
+  if (!eventDef) {
+    return false;
+  }
+  if (!eventDef._canSubscribe) {
+    return true;
+  }
+  try {
+    return await eventDef._canSubscribe(ctx) === true;
+  } catch {
+    sseLogger.warn("SSE canSubscribe threw \u2014 event denied on this connection", {
+      event: eventName,
+      subject: ctx.subject
+    });
+    return false;
+  }
+}
+async function runStream(c, stream, admission, config) {
+  const { allowed, denied, subject, request } = admission;
+  let connectionDead = false;
+  let pingTimer;
+  let onClosed;
+  const cleanup = (reason) => {
+    if (connectionDead) return;
+    connectionDead = true;
+    clearInterval(pingTimer);
+    unsubscribeAll(connection);
+    config.registry.remove(connection);
+    writer.close();
+    onClosed?.();
+    sseLogger.info("SSE dead connection cleaned up", {
+      events: [...connection.allowed],
+      reason
+    });
+  };
+  const writer = createBoundedWriter(stream, config.maxQueue, (reason) => {
+    sseLogger.warn("SSE connection closed", { events: [...connection.allowed], reason });
+    cleanup(reason);
+  });
+  const connection = {
+    subject,
+    requested: admission.requested,
+    allowed: new Set(allowed),
+    denied: new Set(denied),
+    unsubscribes: /* @__PURE__ */ new Map(),
+    request,
+    subscribe: createEventSubscriber({
+      router: config.router,
+      authConfig: config.authConfig,
+      subject,
+      request,
+      writer,
+      isDead: () => connectionDead
+    }),
+    notify: (frame, eventName) => {
+      if (connectionDead) return;
+      writer.enqueue({ event: frame, data: JSON.stringify({ event: eventName }) });
     }
-    const validEventNames = router.eventNames;
-    const invalidEvents = requestedEvents.filter((e) => !validEventNames.includes(e));
-    if (invalidEvents.length > 0) {
-      return c.json({
-        error: "Invalid event names",
-        invalidEvents,
-        validEvents: validEventNames
-      }, 400);
-    }
-    const allowedEvents = await authorizeEvents(subject, requestedEvents, authConfig);
-    if (allowedEvents === null) {
-      return c.json({ error: "Not authorized for any requested events" }, 403);
-    }
-    sseLogger.debug("SSE connection requested", {
-      events: allowedEvents,
-      subject: subject || void 0,
-      clientIp: c.req.header("x-forwarded-for") || c.req.header("x-real-ip")
+  };
+  if (admission.pending?.open(connection) === false) {
+    cleanup("aborted during admission");
+    return;
+  }
+  openSubscriptions(connection, writer);
+  pingTimer = setInterval(() => {
+    if (connectionDead) return;
+    writer.enqueue({
+      event: "ping",
+      data: JSON.stringify({ timestamp: Date.now() })
     });
-    c.header("X-Accel-Buffering", "no");
-    return streamSSE(c, async (stream) => {
-      const unsubscribes = [];
-      let messageId = 0;
-      let connectionDead = false;
-      let pingTimer;
-      let writer;
-      let onClosed;
-      const cleanup = (reason) => {
-        if (connectionDead) return;
-        connectionDead = true;
-        clearInterval(pingTimer);
-        unsubscribes.forEach((fn) => fn());
-        writer?.close();
-        onClosed?.();
-        sseLogger.info("SSE dead connection cleaned up", {
-          events: allowedEvents,
-          reason
-        });
-      };
-      writer = createBoundedWriter(stream, maxQueue, (reason) => {
-        sseLogger.warn("SSE connection closed", { events: allowedEvents, reason });
-        cleanup(reason);
-      });
-      writer.enqueue({
-        event: "connected",
-        data: JSON.stringify({
-          subscribedEvents: allowedEvents,
-          timestamp: Date.now()
-        })
-      });
-      for (const eventName of allowedEvents) {
-        const eventDef = router.events[eventName];
-        if (!eventDef) {
-          continue;
-        }
-        const unsubscribe = eventDef.subscribe((payload) => {
-          if (connectionDead) return;
-          if (subject && authConfig?.filter?.[eventName]) {
-            if (!authConfig.filter[eventName](subject, payload)) {
-              return;
-            }
-          }
-          messageId++;
-          sseLogger.debug("SSE sending event", {
-            event: eventName,
-            messageId
-          });
-          writer.enqueue({
-            id: String(messageId),
-            event: eventName,
-            data: serializeFrame(eventName, payload)
-          });
-        });
-        unsubscribes.push(unsubscribe);
+  }, config.pingInterval);
+  await waitForDisconnect(c.req.raw.signal, () => connectionDead, (resolve2) => {
+    onClosed = resolve2;
+  });
+  cleanup();
+}
+function openSubscriptions(connection, writer) {
+  writer.enqueue({
+    event: "connected",
+    data: JSON.stringify({
+      subscribedEvents: [...connection.allowed],
+      deniedEvents: [...connection.denied],
+      timestamp: Date.now()
+    })
+  });
+  for (const eventName of connection.allowed) {
+    connection.unsubscribes.set(eventName, connection.subscribe(eventName));
+  }
+  sseLogger.info("SSE connection established", {
+    events: [...connection.allowed],
+    deniedEvents: [...connection.denied],
+    subscriptionCount: connection.unsubscribes.size
+  });
+}
+async function waitForDisconnect(abortSignal, isDead, onServerClose) {
+  if (abortSignal.aborted || isDead()) {
+    return;
+  }
+  await new Promise((resolve2) => {
+    const onAbort = () => resolve2();
+    abortSignal.addEventListener("abort", onAbort, { once: true });
+    onServerClose(() => {
+      abortSignal.removeEventListener("abort", onAbort);
+      resolve2();
+    });
+  });
+}
+function createEventSubscriber(ctx) {
+  let messageId = 0;
+  return (eventName) => {
+    const eventDef = ctx.router.events[eventName];
+    let active = true;
+    const unsubscribe = eventDef.subscribe((payload) => {
+      if (!active || ctx.isDead() || !passesFrameFilters(eventName, eventDef, payload, ctx)) {
+        return;
       }
-      sseLogger.info("SSE connection established", {
-        events: allowedEvents,
-        subscriptionCount: unsubscribes.length
+      messageId++;
+      sseLogger.debug("SSE sending event", {
+        event: eventName,
+        messageId
       });
-      pingTimer = setInterval(() => {
-        if (connectionDead) return;
-        writer.enqueue({
-          event: "ping",
-          data: JSON.stringify({ timestamp: Date.now() })
-        });
-      }, pingInterval);
-      const abortSignal = c.req.raw.signal;
-      if (!abortSignal.aborted && !connectionDead) {
-        await new Promise((resolve2) => {
-          const onAbort = () => resolve2();
-          abortSignal.addEventListener("abort", onAbort, { once: true });
-          onClosed = () => {
-            abortSignal.removeEventListener("abort", onAbort);
-            resolve2();
-          };
-        });
-      }
-      cleanup();
-    }, async (err) => {
-      sseLogger.error("SSE stream error", {
-        error: err.message
+      ctx.writer.enqueue({
+        id: String(messageId),
+        event: eventName,
+        data: serializeFrame(eventName, payload)
       });
     });
+    return () => {
+      active = false;
+      unsubscribe();
+    };
   };
 }
+function passesFrameFilters(eventName, eventDef, payload, ctx) {
+  const globalFilter = ctx.authConfig?.filter?.[eventName];
+  if (ctx.subject && globalFilter && !globalFilter(ctx.subject, payload)) {
+    return false;
+  }
+  if (!eventDef._filter) {
+    return true;
+  }
+  try {
+    return eventDef._filter(payload, { subject: ctx.subject, request: ctx.request }) === true;
+  } catch {
+    sseLogger.warn("SSE event filter threw \u2014 frame dropped", { event: eventName, subject: ctx.subject });
+    return false;
+  }
+}
 async function authenticateToken(c, tokenManager) {
   if (!tokenManager) {
     return void 0;
@@ -632,7 +879,7 @@ function parseRequestedEvents(c) {
   if (!eventsParam) {
     return null;
   }
-  return eventsParam.split(",").map((e) => e.trim());
+  return [...new Set(eventsParam.split(",").map((e) => e.trim()))];
 }
 async function authorizeEvents(subject, requestedEvents, authConfig) {
   if (!subject || !authConfig?.authorize) {