@venizia/ignis-worker 0.2.0-10

package/dist/esm/transport/shared.js

@@ -0,0 +1,391 @@
+import { BaseHelper, getError, RequestIdGenerator } from '@venizia/ignis-helpers/core';
+import { BffEnvelope } from '../envelope/encode.js';
+import { WorkerBffTransport } from './worker.js';
+const DEFAULT_CHANNEL_NAME = 'ignis.bff';
+const DEFAULT_TIMEOUT_MS = 30_000;
+/** Which part this tab plays. `ELECTING` is the brief window before the lock answers. */
+export class BffRoles {
+    static { this.ELECTING = 'electing'; }
+    static { this.LEADER = 'leader'; }
+    static { this.FOLLOWER = 'follower'; }
+}
+class ChannelMessageKinds {
+    static { this.REQUEST = 'ignis.bff.request'; }
+    static { this.RESPONSE = 'ignis.bff.response'; }
+    static { this.ERROR = 'ignis.bff.error'; }
+}
+/**
+ * One BFF for every tab of an origin, instead of one per tab.
+ *
+ * The problem it solves is not a framework limitation, it is a storage one. PGlite in
+ * `opfs-ahp://` mode holds an exclusive access handle on the database file, and OPFS access handles
+ * are exclusive PER ORIGIN. Measured in Chromium with two tabs of the same page: the first tab
+ * works, and the second never boots its database -
+ * `Failed to execute 'createSyncAccessHandle' on 'FileSystemFileHandle': Access Handles cannot be
+ * created if there is another open Access Handle or Writable stream associated with the same file`.
+ * The first tab is unaffected, and closing it lets the second recover on reload - so the failure is
+ * contained and self-healing, but the second tab is simply dead until then.
+ *
+ * So exactly one tab may own the database. This transport elects that tab with the Web Locks API,
+ * gives it the Worker, and forwards every other tab's request to it over a `BroadcastChannel`,
+ * carried in the same envelope the Worker itself speaks. When the leader's tab closes, the lock is
+ * released by the browser and a follower is promoted automatically - no heartbeat, no timeout, no
+ * stale-leader window to reason about.
+ *
+ * A host with no `navigator.locks` runs single-tab, exactly as before. That is not a compromise:
+ * measured on a plain-http origin, `navigator.locks` and `navigator.storage.getDirectory` are BOTH
+ * undefined, because both are secure-context only. Wherever OPFS works the lock exists, and where it
+ * does not the database could not have started either.
+ */
+export class SharedBffTransport extends BaseHelper {
+    constructor(opts) {
+        super({ scope: opts.scope ?? SharedBffTransport.name });
+        this.pendingRequests = new Map();
+        this.role = BffRoles.ELECTING;
+        this.isClosed = false;
+        /** Drops this tab out of the lock QUEUE on close, so a closed transport cannot be promoted. */
+        this.leadershipQueueAbort = new AbortController();
+        /** Callers parked in `fetch()` while the election is still running. */
+        this.roleWaiters = [];
+        /**
+         * A `BroadcastChannel` never delivers a message to the instance that sent it, so a leader does not
+         * hear its own answers and a follower does not hear its own requests. Every tab does hear every
+         * OTHER tab, which is why a response is matched by id and silently ignored when it belongs to
+         * someone else.
+         */
+        this.handleChannelMessage = (event) => {
+            const message = event.data;
+            switch (message?.kind) {
+                case ChannelMessageKinds.REQUEST: {
+                    if (this.role !== BffRoles.LEADER) {
+                        return;
+                    }
+                    // `serveAsLeader` answers its own failures on the channel; this catch is for the one case
+                    // it cannot - the channel itself refusing the message, e.g. a body that will not clone.
+                    this.serveAsLeader({ envelope: message.envelope }).catch((error) => {
+                        this.logger
+                            .for(this.serveAsLeader.name)
+                            .error('Could not answer a follower at all | id: %s | error: %s', message.envelope.id, error);
+                    });
+                    return;
+                }
+                // Both decodes are guarded. The channel is origin-wide and its name is the application's, not
+                // a secret, and version skew is the realistic trigger: a long-lived tab on v1 and a new tab
+                // on v2 share the same channel and lock BY DESIGN. An envelope this build cannot read must
+                // fail its caller, never leave the promise unsettled for the full timeout.
+                case ChannelMessageKinds.RESPONSE: {
+                    const pending = this.takePending({ id: message.envelope.id });
+                    if (!pending) {
+                        return;
+                    }
+                    try {
+                        pending.resolve(BffEnvelope.decodeResponse({ envelope: message.envelope }));
+                    }
+                    catch (error) {
+                        this.logger
+                            .for(this.handleChannelMessage.name)
+                            .error('Undecodable response envelope | id: %s | error: %s', message.envelope.id, error);
+                        pending.reject(getError({
+                            message: `[SharedBffTransport] The leader's response could not be decoded | id: ${message.envelope.id}`,
+                            cause: error,
+                        }));
+                    }
+                    return;
+                }
+                case ChannelMessageKinds.ERROR: {
+                    const pending = this.takePending({ id: message.envelope.id });
+                    if (!pending) {
+                        return;
+                    }
+                    try {
+                        pending.reject(BffEnvelope.decodeError({ envelope: message.envelope }));
+                    }
+                    catch (error) {
+                        pending.reject(getError({
+                            message: `[SharedBffTransport] The leader's error envelope could not be decoded | id: ${message.envelope.id}`,
+                            cause: error,
+                        }));
+                    }
+                    return;
+                }
+                default: {
+                    return;
+                }
+            }
+        };
+        const channelName = opts.channelName ?? DEFAULT_CHANNEL_NAME;
+        this.createWorker = opts.createWorker;
+        this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.lockName = `${channelName}.leader`;
+        this.requestIdGenerator = new RequestIdGenerator({ scope: SharedBffTransport.name });
+        // Attached BEFORE the election starts: a tab that becomes leader a moment later must not miss a
+        // request a follower posted while it was still deciding.
+        this.channel = new BroadcastChannel(channelName);
+        this.channel.addEventListener('message', this.handleChannelMessage);
+        // A failed election must not leave `fetch()` parked forever waiting for a role that never
+        // arrives: this tab falls back to serving itself, which is the pre-election behaviour.
+        this.elect().catch((error) => {
+            // `close()` aborts the queued lock request, and the rejection that produces is the expected
+            // end of the election - not a failure to report.
+            if (this.isClosed) {
+                return;
+            }
+            this.logger
+                .for(this.elect.name)
+                .error('Leader election failed, falling back to single-tab | error: %s', error);
+            if (this.role === BffRoles.ELECTING) {
+                this.becomeLeader();
+            }
+        });
+    }
+    getRole() {
+        return this.role;
+    }
+    async fetch(opts) {
+        if (this.isClosed) {
+            throw getError({
+                message: '[SharedBffTransport] The transport is closed | open a new one to make requests',
+            });
+        }
+        await this.whenRoleSettled();
+        // Re-checked AFTER the await: `close()` can land while the election is still running, and
+        // posting then reaches a channel that is already closed - the caller would get a raw
+        // `DOMException` instead of this error, and a pending entry plus a live timer would be left
+        // behind on a transport nothing can settle.
+        if (this.isClosed) {
+            throw getError({
+                message: '[SharedBffTransport] The transport is closed | open a new one to make requests',
+            });
+        }
+        if (this.leaderStartupError) {
+            throw getError({
+                message: '[SharedBffTransport] This tab leads but its BFF worker never started | reload the page',
+                cause: this.leaderStartupError,
+            });
+        }
+        if (this.role === BffRoles.LEADER && this.leaderTransport) {
+            return this.leaderTransport.fetch(opts);
+        }
+        return this.fetchViaLeader(opts);
+    }
+    close() {
+        this.isClosed = true;
+        // A follower is parked in the lock QUEUE rather than holding anything. Without this it stays
+        // queued after close, and the browser would eventually hand leadership to a dead transport -
+        // which returns straight away, but only after the tab that could have served was skipped.
+        this.leadershipQueueAbort.abort();
+        // ORDER IS THE POINT, and it is the opposite of the obvious one. The worker has to be GONE
+        // before the lock is released: releasing first promotes another tab, which opens the same OPFS
+        // database while this worker still holds the exclusive access handle - the exact failure this
+        // transport exists to prevent, reintroduced by its own teardown.
+        //
+        // `terminate()` is abrupt by design. It is no worse than the tab-close path the browser already
+        // takes on every leader, and leaving the worker alive is strictly worse than an abrupt stop.
+        this.leaderTransport?.close();
+        this.leaderTransport = undefined;
+        this.leaderWorker?.terminate();
+        this.leaderWorker = undefined;
+        // Only now: the next tab may open the database.
+        this.releaseLeadership?.();
+        this.releaseLeadership = undefined;
+        this.channel.removeEventListener('message', this.handleChannelMessage);
+        this.channel.close();
+        this.rejectAllPending({ reason: 'the transport was closed' });
+        this.settleRoleWaiters();
+    }
+    async elect() {
+        const locks = globalThis.navigator?.locks;
+        if (!locks) {
+            this.logger
+                .for(this.elect.name)
+                .warn('navigator.locks is unavailable - running single-tab | a second tab cannot open the same OPFS database');
+            this.becomeLeader();
+            return;
+        }
+        // `ifAvailable` answers NOW instead of queueing, which is what lets this tab find out it is a
+        // follower rather than hanging until the current leader goes away.
+        const hasWon = await locks.request(this.lockName, { ifAvailable: true }, async (lock) => {
+            if (!lock) {
+                return false;
+            }
+            // Symmetric with the queued branch below, and not defensive padding. A real `LockManager`
+            // grants from a queued task - it never runs this callback synchronously inside `request()` -
+            // so `close()` can land between the constructor and this line. Without the guard a CLOSED
+            // transport starts a worker, reports itself leader, and then holds the lock for the lifetime
+            // of the page: `close()` has already read and cleared `releaseLeadership`, so the assignment
+            // `heldUntilClosed()` makes below can never be resolved by anything. No other tab is ever
+            // promoted, and this one answers nobody - its channel listener is already detached.
+            //
+            // Returning true, not false: this tab DID hold the lock. Returning releases it immediately,
+            // which is exactly what a closed transport should do with it.
+            if (this.isClosed) {
+                return true;
+            }
+            this.becomeLeader();
+            await this.heldUntilClosed();
+            return true;
+        });
+        if (hasWon || this.isClosed) {
+            return;
+        }
+        this.becomeFollower();
+        // Queues behind the current leader. The browser releases its lock when that tab goes away - a
+        // crash included - so this resolves without anything having to detect the death.
+        await locks.request(this.lockName, { signal: this.leadershipQueueAbort.signal }, async () => {
+            if (this.isClosed) {
+                return;
+            }
+            this.logger
+                .for(this.elect.name)
+                .info('Promoted to leader | previous leader released the lock');
+            this.becomeLeader();
+            await this.heldUntilClosed();
+        });
+    }
+    becomeLeader() {
+        // Anything this tab had in flight was addressed to the leader that just went away. It cannot be
+        // replayed - a write may well have been applied - so it is failed explicitly rather than left
+        // to run out its timeout under a leader that will never answer it.
+        this.rejectAllPending({
+            reason: 'the leader serving it went away before this tab was promoted',
+        });
+        try {
+            this.leaderWorker = this.createWorker();
+            this.leaderTransport = new WorkerBffTransport({
+                worker: this.leaderWorker,
+                timeoutMs: this.timeoutMs,
+            });
+        }
+        catch (error) {
+            // A CSP refusal or a bad worker URL must still SETTLE the role. `whenRoleSettled()` has no
+            // timeout of its own and the per-request timer is armed only inside `fetchViaLeader()`, which
+            // this tab never reaches - so leaving the role unsettled hangs every caller forever, with no
+            // error and no log per request.
+            this.leaderStartupError = error;
+            this.logger
+                .for(this.becomeLeader.name)
+                .error('Could not start the BFF worker | error: %s', error);
+        }
+        this.role = BffRoles.LEADER;
+        this.settleRoleWaiters();
+    }
+    becomeFollower() {
+        this.role = BffRoles.FOLLOWER;
+        this.settleRoleWaiters();
+    }
+    heldUntilClosed() {
+        return new Promise(resolve => {
+            this.releaseLeadership = resolve;
+        });
+    }
+    whenRoleSettled() {
+        if (this.role !== BffRoles.ELECTING) {
+            return Promise.resolve();
+        }
+        return new Promise(resolve => {
+            this.roleWaiters.push(resolve);
+        });
+    }
+    settleRoleWaiters() {
+        const waiters = this.roleWaiters;
+        this.roleWaiters = [];
+        for (const waiter of waiters) {
+            waiter();
+        }
+    }
+    /**
+     * The caller's `AbortSignal` is honoured HERE as well as in `WorkerBffTransport`. Without it the
+     * same page code behaves differently depending on which tab won the lock: abort works in the
+     * leader and silently does nothing in every follower, so a data provider that aborts on unmount
+     * leaves promises pending for the full timeout in every tab but one.
+     *
+     * Aborting settles the CALLER. It does not cancel the leader's work - there is no cancel message,
+     * and a write already dispatched cannot be taken back.
+     */
+    async fetchViaLeader(opts) {
+        const { signal } = opts.request;
+        if (signal?.aborted) {
+            throw this.toAbortError({ signal });
+        }
+        const id = this.requestIdGenerator.nextId();
+        const envelope = await BffEnvelope.encodeRequest({
+            request: opts.request,
+            id,
+            url: BffEnvelope.toSyntheticUrl({ url: opts.request.url }),
+        });
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.takePending({ id })?.reject(getError({
+                    message: `[SharedBffTransport] Timed out waiting for the leader tab | id: ${id} | timeoutMs: ${this.timeoutMs}`,
+                }));
+            }, this.timeoutMs);
+            const handleAbort = () => {
+                this.takePending({ id })?.reject(this.toAbortError({ signal }));
+            };
+            signal?.addEventListener('abort', handleAbort);
+            this.pendingRequests.set(id, {
+                resolve,
+                reject,
+                release: () => {
+                    clearTimeout(timer);
+                    signal?.removeEventListener('abort', handleAbort);
+                },
+            });
+            // Buffering the body took an await, and `addEventListener('abort')` never fires on a signal
+            // that aborted before it was attached - without this re-read that window loses the abort.
+            if (signal?.aborted) {
+                handleAbort();
+                return;
+            }
+            this.channel.postMessage({
+                kind: ChannelMessageKinds.REQUEST,
+                envelope,
+            });
+        });
+    }
+    /** `signal.reason` first, the way `globalThis.fetch` rejects, so a custom abort reason survives. */
+    toAbortError(opts) {
+        return (opts.signal?.reason ??
+            getError({ message: '[SharedBffTransport] The request was aborted by its caller' }));
+    }
+    takePending(opts) {
+        const pending = this.pendingRequests.get(opts.id);
+        if (!pending) {
+            return undefined;
+        }
+        this.pendingRequests.delete(opts.id);
+        pending.release();
+        return pending;
+    }
+    rejectAllPending(opts) {
+        for (const id of [...this.pendingRequests.keys()]) {
+            this.takePending({ id })?.reject(getError({
+                message: `[SharedBffTransport] Request abandoned | id: ${id} | reason: ${opts.reason}`,
+            }));
+        }
+    }
+    async serveAsLeader(opts) {
+        const { envelope } = opts;
+        try {
+            const response = await this.leaderTransport.fetch({
+                request: BffEnvelope.decodeRequest({ envelope }),
+            });
+            this.channel.postMessage({
+                kind: ChannelMessageKinds.RESPONSE,
+                envelope: await BffEnvelope.encodeResponse({ response, id: envelope.id }),
+            });
+        }
+        catch (error) {
+            // The follower gets the failure as a failure, rather than waiting out a timeout that would
+            // tell it nothing about what went wrong.
+            this.logger
+                .for(this.serveAsLeader.name)
+                .error('Failed to serve a follower request | id: %s | error: %s', envelope.id, error);
+            this.channel.postMessage({
+                kind: ChannelMessageKinds.ERROR,
+                envelope: BffEnvelope.encodeError({ id: envelope.id, error }),
+            });
+        }
+    }
+}
+//# sourceMappingURL=shared.js.map

package/dist/esm/transport/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/transport/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEvF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAE9C,MAAM,oBAAoB,GAAG,WAAW,CAAC;AACzC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,yFAAyF;AACzF,MAAM,OAAO,QAAQ;aACH,aAAQ,GAAG,UAAU,CAAC;aACtB,WAAM,GAAG,QAAQ,CAAC;aAClB,aAAQ,GAAG,UAAU,CAAC;;AAKxC,MAAM,mBAAmB;aACP,YAAO,GAAG,mBAAmB,CAAC;aAC9B,aAAQ,GAAG,oBAAoB,CAAC;aAChC,UAAK,GAAG,iBAAiB,CAAC;;AA8B5C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAgChD,YAAY,IAAgC;QAC1C,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;QA3BzC,oBAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;QAE9D,SAAI,GAAa,QAAQ,CAAC,QAAQ,CAAC;QAEnC,aAAQ,GAAG,KAAK,CAAC;QAgBzB,+FAA+F;QAC9E,yBAAoB,GAAG,IAAI,eAAe,EAAE,CAAC;QAE9D,uEAAuE;QAC/D,gBAAW,GAAsB,EAAE,CAAC;QA0T5C;;;;;WAKG;QACc,yBAAoB,GAAG,CAAC,KAAmB,EAAQ,EAAE;YACpE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAmC,CAAC;YAE1D,QAAQ,OAAO,EAAE,IAAI,EAAE,CAAC;gBACtB,KAAK,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;oBACjC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;wBAClC,OAAO;oBACT,CAAC;oBAED,0FAA0F;oBAC1F,wFAAwF;oBACxF,IAAI,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;wBAC1E,IAAI,CAAC,MAAM;6BACR,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;6BAC5B,KAAK,CACJ,yDAAyD,EACzD,OAAO,CAAC,QAAQ,CAAC,EAAE,EACnB,KAAK,CACN,CAAC;oBACN,CAAC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,8FAA8F;gBAC9F,4FAA4F;gBAC5F,2FAA2F;gBAC3F,2EAA2E;gBAC3E,KAAK,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAClC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO;oBACT,CAAC;oBAED,IAAI,CAAC;wBACH,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;oBAC9E,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,MAAM;6BACR,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;6BACnC,KAAK,CACJ,oDAAoD,EACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,EACnB,KAAK,CACN,CAAC;wBACJ,OAAO,CAAC,MAAM,CACZ,QAAQ,CAAC;4BACP,OAAO,EAAE,yEAAyE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE;4BACvG,KAAK,EAAE,KAAK;yBACb,CAAC,CACH,CAAC;oBACJ,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,KAAK,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO;oBACT,CAAC;oBAED,IAAI,CAAC;wBACH,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;oBAC1E,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,MAAM,CACZ,QAAQ,CAAC;4BACP,OAAO,EAAE,+EAA+E,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE;4BAC7G,KAAK,EAAE,KAAK;yBACb,CAAC,CACH,CAAC;oBACJ,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,CAAC,CAAC;oBACR,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAvYA,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAE7D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,GAAG,WAAW,SAAS,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;QAErF,gGAAgG;QAChG,yDAAyD;QACzD,IAAI,CAAC,OAAO,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAEpE,0FAA0F;QAC1F,uFAAuF;QACvF,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACpC,4FAA4F;YAC5F,iDAAiD;YACjD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;iBACpB,KAAK,CAAC,gEAAgE,EAAE,KAAK,CAAC,CAAC;YAElF,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAA0B;QACpC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,gFAAgF;aAC1F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE7B,0FAA0F;QAC1F,qFAAqF;QACrF,4FAA4F;QAC5F,4CAA4C;QAC5C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,gFAAgF;aAC1F,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,wFAAwF;gBAC1F,KAAK,EAAE,IAAI,CAAC,kBAAkB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAErB,6FAA6F;QAC7F,6FAA6F;QAC7F,0FAA0F;QAC1F,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;QAElC,2FAA2F;QAC3F,+FAA+F;QAC/F,8FAA8F;QAC9F,iEAAiE;QACjE,EAAE;QACF,gGAAgG;QAChG,6FAA6F;QAC7F,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAE9B,gDAAgD;QAChD,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QAEnC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,IAAI,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC;QAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;iBACpB,IAAI,CACH,uGAAuG,CACxG,CAAC;YACJ,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,8FAA8F;QAC9F,mEAAmE;QACnE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACpF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;YAED,0FAA0F;YAC1F,6FAA6F;YAC7F,0FAA0F;YAC1F,6FAA6F;YAC7F,6FAA6F;YAC7F,0FAA0F;YAC1F,oFAAoF;YACpF,EAAE;YACF,4FAA4F;YAC5F,8DAA8D;YAC9D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,8FAA8F;QAC9F,iFAAiF;QACjF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE;YAC1F,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;iBACpB,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,YAAY;QAClB,gGAAgG;QAChG,8FAA8F;QAC9F,mEAAmE;QACnE,IAAI,CAAC,gBAAgB,CAAC;YACpB,MAAM,EAAE,8DAA8D;SACvE,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,CAAC,eAAe,GAAG,IAAI,kBAAkB,CAAC;gBAC5C,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2FAA2F;YAC3F,8FAA8F;YAC9F,6FAA6F;YAC7F,gCAAgC;YAChC,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;YAChC,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;iBAC3B,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,eAAe;QACrB,OAAO,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YACjC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QAED,OAAO,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;QAEtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,cAAc,CAAC,IAA0B;QACrD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEhC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QAE5C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC;YAC/C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,EAAE;YACF,GAAG,EAAE,WAAW,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,CAAC,CAAC;QAEH,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAC9B,QAAQ,CAAC;oBACP,OAAO,EAAE,mEAAmE,EAAE,iBAAiB,IAAI,CAAC,SAAS,EAAE;iBAChH,CAAC,CACH,CAAC;YACJ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAEnB,MAAM,WAAW,GAAG,GAAS,EAAE;gBAC7B,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,CAAC;YACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAE/C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE;gBAC3B,OAAO;gBACP,MAAM;gBACN,OAAO,EAAE,GAAG,EAAE;oBACZ,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpD,CAAC;aACF,CAAC,CAAC;YAEH,4FAA4F;YAC5F,0FAA0F;YAC1F,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,WAAW,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;gBACvB,IAAI,EAAE,mBAAmB,CAAC,OAAO;gBACjC,QAAQ;aACiB,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oGAAoG;IAC5F,YAAY,CAAC,IAA8B;QACjD,OAAO,CACL,IAAI,CAAC,MAAM,EAAE,MAAM;YACnB,QAAQ,CAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CACpF,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,IAAoB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,gBAAgB,CAAC,IAAwB;QAC/C,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAC9B,QAAQ,CAAC;gBACP,OAAO,EAAE,gDAAgD,EAAE,cAAc,IAAI,CAAC,MAAM,EAAE;aACvF,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAsFO,KAAK,CAAC,aAAa,CAAC,IAAuC;QACjE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAE1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAgB,CAAC,KAAK,CAAC;gBACjD,OAAO,EAAE,WAAW,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC;aACjD,CAAC,CAAC;YAEH,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;gBACvB,IAAI,EAAE,mBAAmB,CAAC,QAAQ;gBAClC,QAAQ,EAAE,MAAM,WAAW,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;aAChD,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2FAA2F;YAC3F,yCAAyC;YACzC,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;iBAC5B,KAAK,CAAC,yDAAyD,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAExF,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;gBACvB,IAAI,EAAE,mBAAmB,CAAC,KAAK;gBAC/B,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;aACpC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF"}

package/dist/esm/transport/worker.d.ts

@@ -0,0 +1,62 @@
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import type { IBffTransport } from './common/types.js';
+/**
+ * UI-side half of the BFF: posts an encoded request to a real `Worker` and resolves the matching
+ * response by `id` - the far side of `WorkerApplication.listen()`.
+ *
+ * The three worker listeners are attached ONCE, in the constructor, and every request is tracked in
+ * `pendingRequests` instead. Registering them per request looks equivalent and is not: they are
+ * scoped to the shared `Worker`, so a single `messageerror` - which means exactly one message
+ * failed to deserialise - would fire every in-flight request's handler, rejecting nine healthy
+ * requests that are about to be answered normally.
+ */
+export declare class WorkerBffTransport extends BaseHelper implements IBffTransport {
+    private readonly worker;
+    private readonly timeoutMs;
+    private readonly requestIdGenerator;
+    private readonly pendingRequests;
+    /** Set by `close()`, so a later `fetch()` is refused instead of reaching a worker nothing listens to. */
+    private isClosed;
+    /** Outstanding `handleWorkerError` grace timers, cleared by `close()` so none outlives the transport. */
+    private readonly graceTimers;
+    constructor(opts: {
+        worker: Worker;
+        timeoutMs?: number;
+    });
+    /** Removes a pending request from the map and releases its timer and abort listener, so nothing can settle it twice. */
+    private readonly takePending;
+    private readonly handleMessage;
+    /**
+     * An `error` event does NOT mean the worker is dead.
+     *
+     * Measured in Chromium: a synchronous uncaught throw anywhere in the worker - a third-party timer,
+     * say - fires this event while the worker keeps serving, and the genuine responses to the
+     * in-flight requests arrive a moment later. Rejecting immediately reported a committed POST as
+     * failed and then dropped its real 200 on the floor, because nothing was left waiting for it.
+     *
+     * So the event is logged at once and the requests are given a grace window. Whatever the worker
+     * still answers inside it settles normally; whatever is left after it really is lost, and is
+     * rejected with the diagnostics rather than left to run out its own timeout.
+     */
+    private readonly handleWorkerError;
+    /** `ErrorEvent` carries the useful fields; a plain `Event` does not, so both shapes are handled. */
+    private describeErrorEvent;
+    /**
+     * `messageerror` means exactly ONE posted message failed to deserialise, and the event carries
+     * nothing that says which. With a single request in flight that is unambiguous, so it settles
+     * now; with several, the lost answer belongs to one of them and rejecting the rest would be a
+     * lie - each then ends on its own timeout, under its own id.
+     */
+    private readonly handleMessageError;
+    fetch(opts: {
+        request: Request;
+    }): Promise<Response>;
+    /** `signal.reason` first, the way `globalThis.fetch` rejects, so `controller.abort(myReason)` still reaches the caller. */
+    private toAbortError;
+    /**
+     * Detaches the three worker listeners and fails whatever is still in flight. The worker itself is
+     * left alone - this transport did not create it, and a page may hand the same one to another.
+     */
+    close(): void;
+}
+//# sourceMappingURL=worker.d.ts.map

package/dist/esm/transport/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../../src/transport/worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAInE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAoBpD;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,SAAQ,UAAW,YAAW,aAAa;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEhC;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsC;IAEtE,yGAAyG;IACzG,OAAO,CAAC,QAAQ,CAAS;IAEzB,yGAAyG;IACzG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4C;gBAE5D,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;IAWxD,wHAAwH;IACxH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAS1B;IAEF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAgC5B;IAEF;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CA+BhC;IAEF,oGAAoG;IACpG,OAAO,CAAC,kBAAkB;IAe1B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAkBjC;IAEI,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0E1D,2HAA2H;IAC3H,OAAO,CAAC,YAAY;IAOpB;;;OAGG;IACH,KAAK,IAAI,IAAI;CAmBd"}