connectbase-client 6.13.0 → 6.15.0

package/dist/index.js

@@ -41,6 +41,7 @@ __export(index_exports, {
   RolesAPI: () => RolesAPI,
   SessionManager: () => SessionManager,
   VideoProcessingError: () => VideoProcessingError,
+  WsTicketError: () => WsTicketError,
   default: () => index_default,
   detectInAppBrowser: () => detectInAppBrowser,
   escapeToExternalBrowser: () => escapeToExternalBrowser,
@@ -170,9 +171,9 @@ var AdsAPI = class {
 
 // src/types/error.ts
 var ApiError = class extends Error {
-  constructor(statusCode, message, code, details) {
+  constructor(statusCode2, message, code, details) {
     super(message);
-    this.statusCode = statusCode;
+    this.statusCode = statusCode2;
     this.name = "ApiError";
     this.code = code;
     this.details = details;
@@ -290,7 +291,7 @@ var RealtimeConnectionError = class extends Error {
     this.name = "RealtimeConnectionError";
     this.code = init.code || "unknown";
     this.closeCode = init.closeCode;
-    this.retryable = init.retryable ?? isRetryableRealtimeRejection(this.code);
+    this.retryable = init.retryable ?? isRetryableRealtimeRejection(this.code, init.closeCode);
     this.details = init.details;
     this.retryAfterMs = init.retryAfterMs;
   }
@@ -307,8 +308,8 @@ var RealtimeConnectionError = class extends Error {
     };
   }
 };
-function isRetryableRealtimeRejection(code) {
-  return code === "connection_limit_exceeded" || code === "server_at_capacity" || code === "rate_limited" || code === "auth_unavailable" || code === "internal_error";
+function isRetryableRealtimeRejection(code, closeCode) {
+  return closeCode === 4429 || closeCode === 4500 || closeCode === 4503 || code === "connection_limit_exceeded" || code === "rate_limit_exceeded" || code === "server_at_capacity" || code === "rate_limited" || code === "auth_unavailable" || code === "internal_error" || code === "invalid_ws_ticket" || code === "ws_ticket_unavailable";
 }
 var RealtimeRequestError = class extends Error {
   constructor(init) {
@@ -3698,9 +3699,107 @@ var HttpClient = class {
   }
 };
 
+// src/core/ws-ticket.ts
+var WsTicketError = class extends Error {
+  constructor(init) {
+    super(
+      init.message || init.code || `WebSocket ticket request failed (${init.status})`
+    );
+    this.name = "WsTicketError";
+    this.status = init.status;
+    this.code = init.code || "ws_ticket_rejected";
+    this.retryAfterMs = init.retryAfterMs;
+  }
+};
+var DEFAULT_TICKET_TIMEOUT_MS = 5e3;
+var unsupported = /* @__PURE__ */ new Set();
+function supportKey(url, kind) {
+  try {
+    const u = new URL(url);
+    return `${u.origin}|${kind}`;
+  } catch {
+    return `${url}|${kind}`;
+  }
+}
+async function fetchWsTicket(url, kind, credential, options = {}) {
+  const key = supportKey(url, kind);
+  if (unsupported.has(key)) return null;
+  const headers = {};
+  if (credential.kind === "access_token") {
+    headers.Authorization = `Bearer ${credential.value}`;
+  } else {
+    headers["X-Public-Key"] = credential.value;
+  }
+  const { signal, cleanup } = createTimeoutController({
+    timeout: Math.max(
+      1,
+      Math.min(
+        options.timeoutMs ?? DEFAULT_TICKET_TIMEOUT_MS,
+        DEFAULT_TICKET_TIMEOUT_MS
+      )
+    ),
+    signal: options.signal
+  });
+  let response;
+  try {
+    response = await withAbort(
+      fetch(url, { method: "POST", headers, credentials: "omit", signal }),
+      signal
+    );
+  } catch (err) {
+    cleanup();
+    if (options.signal?.aborted) throw err;
+    return null;
+  }
+  try {
+    if (response.ok) {
+      const body2 = await response.json().catch(() => null);
+      return typeof body2?.ticket === "string" && body2.ticket !== "" ? body2.ticket : null;
+    }
+    if (response.status === 404 || response.status === 405 || response.status === 501) {
+      unsupported.add(key);
+      return null;
+    }
+    if (response.status >= 500) return null;
+    const body = await response.json().catch(() => null);
+    const raw = typeof body?.error === "string" ? body.error : void 0;
+    const isCode = raw !== void 0 && /^[a-z0-9_]+$/.test(raw);
+    const code = isCode ? raw : statusCode(response.status);
+    const message = typeof body?.message === "string" ? body.message : raw;
+    const retryAfterMs = typeof body?.retry_after_ms === "number" && body.retry_after_ms > 0 ? body.retry_after_ms : void 0;
+    throw new WsTicketError({
+      status: response.status,
+      code,
+      message,
+      retryAfterMs
+    });
+  } finally {
+    cleanup();
+  }
+}
+function statusCode(status) {
+  switch (status) {
+    case 401:
+      return "unauthorized";
+    case 402:
+      return "quota_exceeded";
+    case 403:
+      return "forbidden";
+    case 429:
+      return "rate_limited";
+    default:
+      return "ws_ticket_rejected";
+  }
+}
+function ticketUrl(base, path) {
+  const httpBase = base.replace(/^ws(s?):\/\//, "http$1://").replace(/\/+$/, "");
+  return `${httpBase}${path}`;
+}
+
 // src/api/database.ts
 var REALTIME_TOKEN_MIN_VALIDITY_SEC = 600;
 var REALTIME_CONNECT_TOKEN_MIN_VALIDITY_SEC = 60;
+var REALTIME_CONNECT_TIMEOUT_MS = 15e3;
 var REALTIME_AUTH_REFRESH_RETRY_MS = 3e4;
 var REALTIME_CLOSING_NOTICE_CODES = /* @__PURE__ */ new Set([
   "TOKEN_EXPIRED",
@@ -3708,6 +3807,20 @@ var REALTIME_CLOSING_NOTICE_CODES = /* @__PURE__ */ new Set([
 ]);
 var CLOSE_CODE_TOKEN_EXPIRED = 4401;
 var CLOSE_CODE_MEMBER_REVOKED = 4403;
+function toRealtimeRejection(msg) {
+  if (msg.type !== "error" || msg.request_id || typeof msg.close_code !== "number") {
+    return null;
+  }
+  const details = msg.details;
+  return new RealtimeConnectionError({
+    code: typeof msg.code === "string" ? msg.code : void 0,
+    message: typeof msg.message === "string" ? msg.message : void 0,
+    closeCode: msg.close_code,
+    retryable: typeof msg.retryable === "boolean" ? msg.retryable : void 0,
+    details: details && typeof details === "object" && !Array.isArray(details) ? details : void 0,
+    retryAfterMs: typeof msg.retry_after_ms === "number" && msg.retry_after_ms > 0 ? msg.retry_after_ms : void 0
+  });
+}
 var DatabaseAPI = class {
   constructor(http) {
     this.realtimeWs = null;
@@ -4645,23 +4758,59 @@ var DatabaseAPI = class {
       );
       if (fresh) opts.accessToken = fresh;
     }
-    return this.doRealtimeConnect();
+    let ticket;
+    try {
+      ticket = await this.realtimeTicket();
+    } catch (e) {
+      if (e instanceof WsTicketError) {
+        const err = new RealtimeConnectionError({
+          code: e.code,
+          message: e.message,
+          closeCode: 4e3 + e.status,
+          retryAfterMs: e.retryAfterMs
+        });
+        this.handleRealtimeRejection(err);
+        throw err;
+      }
+      throw e;
+    }
+    return this.doRealtimeConnect(ticket);
+  }
+  /**
+   * 연결 시도 한 번에 쓸 1회용 티켓을 받는다(core/ws-ticket.ts). 브라우저 WebSocket 은 헤더를 못 붙여 예전에는 멤버 토큰을
+   * URL(`?access_token=`)에 실었다 — 이제 헤더로 티켓을 받아 `?ticket=` 만 싣는다. 서버가 티켓을 모르거나(구버전) 잠시 못
+   * 주면 null 이고 예전처럼 붙는다. cross-app OAuth 토큰도 같은 경로다(서버가 티켓에서 토큰을 되살려 같은 검증을 한다).
+   */
+  async realtimeTicket() {
+    const opts = this.realtimeOptions;
+    if (!opts?.accessToken) return null;
+    const baseUrl = opts.dataServerUrl || this.http.getBaseUrl();
+    return fetchWsTicket(
+      ticketUrl(baseUrl, "/v1/database/realtime/ws-ticket"),
+      "data.realtime",
+      { kind: "access_token", value: opts.accessToken },
+      { timeoutMs: REALTIME_CONNECT_TIMEOUT_MS }
+    );
   }
-  doRealtimeConnect() {
+  doRealtimeConnect(ticket = null) {
     if (!this.realtimeOptions)
       return Promise.reject(new Error("No realtime options"));
     this.setRealtimeState("connecting");
     const baseUrl = this.realtimeOptions.dataServerUrl || this.http.getBaseUrl();
     const wsUrl = baseUrl.replace(/^http/, "ws");
-    let url = `${wsUrl}/v1/database/realtime/ws?access_token=${encodeURIComponent(this.realtimeOptions.accessToken)}`;
+    let url = ticket ? `${wsUrl}/v1/database/realtime/ws?ticket=${encodeURIComponent(ticket)}` : `${wsUrl}/v1/database/realtime/ws?access_token=${encodeURIComponent(this.realtimeOptions.accessToken)}`;
     this.realtimeTokenRefresh = this.http.canRefreshMemberToken(
       this.realtimeOptions.accessToken
     );
     if (this.realtimeTokenRefresh) url += "&token_refresh=1";
+    url += "&reject_mode=close";
     return new Promise((resolve, reject) => {
       try {
-        this.realtimeWs = new WebSocket(url);
+        const ws = new WebSocket(url);
+        this.realtimeWs = ws;
         let settled = false;
+        let accepted = false;
+        let rejection = null;
         const connectTimeout = setTimeout(() => {
           if (!settled) {
             settled = true;
@@ -4672,8 +4821,9 @@ var DatabaseAPI = class {
             this.setRealtimeState("disconnected");
             reject(new Error("Connection timeout"));
           }
-        }, 15e3);
-        this.realtimeWs.onopen = () => {
+        }, REALTIME_CONNECT_TIMEOUT_MS);
+        const accept = () => {
+          accepted = true;
           if (!settled) {
             settled = true;
             clearTimeout(connectTimeout);
@@ -4686,15 +4836,28 @@ var DatabaseAPI = class {
           this.resubscribeAll();
           resolve();
         };
-        this.realtimeWs.onmessage = (event) => {
+        ws.onopen = () => {
+          ws.send(JSON.stringify({ type: "ping", timestamp: Date.now() }));
+        };
+        ws.onmessage = (event) => {
+          let msg;
           try {
-            const msg = JSON.parse(event.data);
-            this.handleRealtimeMessage(msg);
+            msg = JSON.parse(event.data);
           } catch {
             this.debugLog("Failed to parse realtime message");
+            return;
           }
+          if (!accepted) {
+            const rejected = toRealtimeRejection(msg);
+            if (rejected) {
+              rejection = rejected;
+              return;
+            }
+            accept();
+          }
+          this.handleRealtimeMessage(msg);
         };
-        this.realtimeWs.onclose = (event) => {
+        ws.onclose = (event) => {
           this.debugLog(
             `Database realtime disconnected (code=${event?.code}, reason=${event?.reason})`
           );
@@ -4703,12 +4866,25 @@ var DatabaseAPI = class {
           this.clearRealtimeAuthRetry();
           const notice = this.realtimeCloseNotice;
           this.realtimeCloseNotice = null;
+          const code = event?.code;
+          if (!accepted && code >= 4e3 && code <= 4999) {
+            const err = rejection ?? new RealtimeConnectionError({
+              code: event.reason || void 0,
+              closeCode: code
+            });
+            if (!settled) {
+              settled = true;
+              clearTimeout(connectTimeout);
+              reject(err);
+            }
+            this.handleRealtimeRejection(err);
+            return;
+          }
           if (!settled) {
             settled = true;
             clearTimeout(connectTimeout);
             reject(new Error("Connection closed during handshake"));
           }
-          const code = event?.code;
           if (this.realtimeOptions && this.realtimeState !== "disconnected" && (code === CLOSE_CODE_MEMBER_REVOKED || code === CLOSE_CODE_TOKEN_EXPIRED && !this.http.canRefreshMemberToken(
             this.realtimeOptions.accessToken
           ))) {
@@ -4726,7 +4902,7 @@ var DatabaseAPI = class {
             this.attemptRealtimeReconnect();
           }
         };
-        this.realtimeWs.onerror = () => {
+        ws.onerror = () => {
           this.debugLog("Database realtime error");
           this.realtimeOnError?.(new Error("WebSocket connection error"));
         };
@@ -4736,6 +4912,21 @@ var DatabaseAPI = class {
       }
     });
   }
+  /**
+   * 서버가 연결을 거부했다(티켓 발급 거부, 또는 reject_mode=close 로 받은 업그레이드 거부). cb.realtime 과 같은 규칙이다 —
+   * 다시 해서 될 거부(`retryable`: 일시 장애, 속도 제한, 동시접속 한도, 만료된 티켓)는 서버가 알려 준 시각(`retryAfterMs`)
+   * 이후로 재연결을 이어 가고, 아니면(자격증명, 멤버 폐기, 할당량) 멈추고 `onRealtimeError` 로 알린다. 재시도를 다 써도
+   * 거부되면 마지막 거부를 알린다.
+   */
+  handleRealtimeRejection(err) {
+    if (!this.realtimeOptions || this.realtimeState === "disconnected") return;
+    if (err.retryable) {
+      this.attemptRealtimeReconnect(err);
+      return;
+    }
+    this.setRealtimeState("disconnected");
+    this.realtimeOnError?.(err);
+  }
   /**
    * 서버에 subscribe 메시지를 보내고 서버 subscription_id를 반환하는 Promise
    */
@@ -4908,21 +5099,25 @@ var DatabaseAPI = class {
         break;
     }
   }
-  attemptRealtimeReconnect() {
+  /**
+   * 지수 백오프로 다시 붙는다. cause 는 이번 시도를 끝낸 서버의 거부다 — 알려 준 재시도 시각(`retryAfterMs`)보다 일찍 다시
+   * 하지 않고, 재시도를 다 쓰면 일반 오류 대신 그 거부를 알린다.
+   */
+  attemptRealtimeReconnect(cause) {
     const maxRetries = this.realtimeOptions?.maxRetries ?? 5;
     const retryInterval = this.realtimeOptions?.retryInterval ?? 1e3;
     if (this.realtimeRetryCount >= maxRetries) {
       this.setRealtimeState("disconnected");
       this.realtimeOnError?.(
-        new Error("Realtime connection lost. Max retries exceeded.")
+        cause ?? new Error("Realtime connection lost. Max retries exceeded.")
       );
       return;
     }
     this.setRealtimeState("connecting");
     this.realtimeRetryCount++;
-    const delay = Math.min(
-      retryInterval * 2 ** (this.realtimeRetryCount - 1),
-      3e4
+    const delay = Math.max(
+      Math.min(retryInterval * 2 ** (this.realtimeRetryCount - 1), 3e4),
+      cause?.retryAfterMs ?? 0
     );
     this.debugLog(
       `Reconnecting in ${delay}ms (attempt ${this.realtimeRetryCount}/${maxRetries})`
@@ -5213,7 +5408,7 @@ var EndpointAPI = class {
       );
     }
     const baseUrl = this.http.getBaseUrl().replace(/\/+$/, "");
-    const ticketUrl = `${baseUrl}/v1/proxy/${encodeURIComponent(label)}/ws-ticket`;
+    const ticketUrl2 = `${baseUrl}/v1/proxy/${encodeURIComponent(label)}/ws-ticket`;
     const ticketHeaders = new Headers();
     const pk = this.http.getPublicKey();
     if (!pk) {
@@ -5222,7 +5417,7 @@ var EndpointAPI = class {
       );
     }
     ticketHeaders.set("X-Public-Key", pk);
-    const ticketRes = await fetch(ticketUrl, {
+    const ticketRes = await fetch(ticketUrl2, {
       method: "POST",
       headers: ticketHeaders,
       signal: opts.signal
@@ -5920,20 +6115,54 @@ var GameRoom = class {
    * 게임 서버에 연결
    */
   connect(roomId) {
-    return new Promise((resolve, reject) => {
-      if (this.ws?.readyState === WebSocket.OPEN) {
-        resolve();
-        return;
-      }
-      if (!this.config.appId) {
-        reject(
-          new Error(
-            "cb.game: appId is required to connect. Pass it to `new ConnectBase({ appId })` or per-client via `cb.game.createClient({ appId, clientId })`."
-          )
-        );
-        return;
+    if (this.ws?.readyState === WebSocket.OPEN) {
+      return Promise.resolve();
+    }
+    if (!this.config.appId) {
+      return Promise.reject(
+        new Error(
+          "cb.game: appId is required to connect. Pass it to `new ConnectBase({ appId })` or per-client via `cb.game.createClient({ appId, clientId })`."
+        )
+      );
+    }
+    if (!this.config.clientId) {
+      return Promise.reject(
+        new Error(
+          "cb.game: clientId is required to build a game connection URL. Pass it via `cb.game.createClient({ appId, clientId })`."
+        )
+      );
+    }
+    return this.connectionTicket().then(
+      (ticket) => this.openSocket(roomId, ticket)
+    );
+  }
+  /**
+   * 연결 시도 한 번에 쓸 1회용 티켓을 받는다(core/ws-ticket.ts). 브라우저 WebSocket 은 헤더를 못 붙여 예전에는 멤버
+   * 토큰(`?token=`)과 공개 키(`?public_key=`)를 URL 에 실었다 — 이제 헤더로 티켓을 받아 `?ticket=` 만 싣는다. 서버가
+   * 티켓을 모르거나(구버전) 잠시 못 주면 null 이고 예전처럼 붙는다. 발급이 자격증명을 거부하면 {@link GameError} 로 던진다.
+   */
+  async connectionTicket() {
+    const { accessToken, publicKey, appId, gameServerUrl } = this.config;
+    if (!accessToken && !publicKey || !appId || !gameServerUrl) return null;
+    try {
+      return await fetchWsTicket(
+        ticketUrl(
+          gameServerUrl,
+          `/v1/game/${encodeURIComponent(appId)}/ws-ticket`
+        ),
+        "game.ws",
+        accessToken ? { kind: "access_token", value: accessToken } : { kind: "public_key", value: publicKey }
+      );
+    } catch (e) {
+      if (e instanceof WsTicketError) {
+        throw new GameError({ code: e.code, message: e.message });
       }
-      const url = this.buildConnectionUrl(roomId);
+      throw e;
+    }
+  }
+  openSocket(roomId, ticket) {
+    return new Promise((resolve, reject) => {
+      const url = this.buildConnectionUrl(roomId, ticket);
       this.ws = new WebSocket(url);
       const onOpen = () => {
         this._isConnected = true;
@@ -6189,7 +6418,7 @@ var GameRoom = class {
     });
   }
   // Private methods
-  buildConnectionUrl(roomId) {
+  buildConnectionUrl(roomId, ticket) {
     const baseUrl = this.config.gameServerUrl;
     const wsUrl = baseUrl.replace(/^http/, "ws");
     const params = new URLSearchParams();
@@ -6202,11 +6431,15 @@ var GameRoom = class {
     if (roomId) {
       params.set("room_id", roomId);
     }
-    if (this.config.publicKey) {
-      params.set("public_key", this.config.publicKey);
-    }
-    if (this.config.accessToken) {
-      params.set("token", this.config.accessToken);
+    if (ticket) {
+      params.set("ticket", ticket);
+    } else {
+      if (this.config.publicKey) {
+        params.set("public_key", this.config.publicKey);
+      }
+      if (this.config.accessToken) {
+        params.set("token", this.config.accessToken);
+      }
     }
     if (!this.config.appId) {
       throw new Error(
@@ -10063,7 +10296,14 @@ var ConnectCancelledError = class extends Error {
   }
 };
 var MAX_HANDSHAKE_RETRIES = 2;
-var RETRY_IN_CONNECT_CODES = /* @__PURE__ */ new Set(["rate_limited", "auth_unavailable"]);
+var RETRY_IN_CONNECT_CODES = /* @__PURE__ */ new Set([
+  "rate_limited",
+  "auth_unavailable",
+  // 1회용 티켓이 업그레이드에서 거부됐다(만료, 이미 쓰임, 저장소 일시 장애). 다음 시도는 새 티켓을 받거나, 저장소가
+  // 없으면 예전 방식으로 붙는다(core/ws-ticket.ts).
+  "invalid_ws_ticket",
+  "ws_ticket_unavailable"
+]);
 var CONNECTION_TOKEN_MIN_VALIDITY_SEC = 600;
 var CONNECT_TOKEN_MIN_VALIDITY_SEC = 60;
 var AUTH_REFRESH_RETRY_MS = 3e4;
@@ -11178,7 +11418,10 @@ var RealtimeAPI = class {
       for (let attempt = 1; ; attempt++) {
         try {
           await this.prepareConnectToken();
-          await this.doConnect(Math.max(deadline - Date.now(), 1));
+          const ticket = await this.connectTicket(
+            Math.max(deadline - Date.now(), 1)
+          );
+          await this.doConnect(Math.max(deadline - Date.now(), 1), ticket);
           return;
         } catch (e) {
           let wait = null;
@@ -11221,7 +11464,39 @@ var RealtimeAPI = class {
       this.initialConnecting = false;
     }
   }
-  async doConnect(timeoutMs = this.options.timeout) {
+  /**
+   * 연결 시도 한 번에 쓸 1회용 티켓을 받는다(core/ws-ticket.ts). 브라우저 WebSocket 은 헤더를 못 붙여 예전에는 멤버
+   * 토큰과 공개 키를 URL 에 실었다 — 이제 헤더로 티켓을 받아 `?ticket=` 만 싣는다. 티켓은 한 번만 쓰이므로 시도마다
+   * 새로 받는다.
+   *
+   * 서버가 티켓을 모르거나(구버전) 잠시 못 주면 null 이고, doConnect 가 예전처럼 자격증명을 URL 에 싣는다. 발급이
+   * 자격증명을 거부하면 업그레이드 거부와 같은 {@link RealtimeConnectionError} 로 던진다 — 재시도 규칙이 같다.
+   */
+  async connectTicket(timeoutMs) {
+    const accessToken = this.options.accessToken;
+    const publicKey = accessToken ? void 0 : this.http.getPublicKey();
+    if (!accessToken && !publicKey) return null;
+    try {
+      return await fetchWsTicket(
+        ticketUrl(this.socketUrl, "/v1/realtime/ws-ticket"),
+        "socket.realtime",
+        accessToken ? { kind: "access_token", value: accessToken } : { kind: "public_key", value: publicKey },
+        { timeoutMs }
+      );
+    } catch (e) {
+      if (e instanceof WsTicketError) {
+        this.log(`WebSocket ticket rejected: ${e.code} (${e.status})`);
+        throw new RealtimeConnectionError({
+          code: e.code,
+          message: e.message,
+          closeCode: 4e3 + e.status,
+          retryAfterMs: e.retryAfterMs
+        });
+      }
+      throw e;
+    }
+  }
+  async doConnect(timeoutMs = this.options.timeout, ticket = null) {
     return new Promise((resolve, reject) => {
       this.state = "connecting";
       this.notifyStateChange();
@@ -11230,9 +11505,10 @@ var RealtimeAPI = class {
       const usingDirect = !!directWsBase;
       const wsUrl = (directWsBase ?? this.socketUrl).replace(/^http/, "ws");
       let url;
+      const auth = ticket ? `ticket=${encodeURIComponent(ticket)}` : void 0;
       this.tokenRefreshNegotiated = false;
       if (this.options.accessToken) {
-        url = `${wsUrl}/v1/realtime/auth?access_token=${encodeURIComponent(this.options.accessToken)}&client_id=${this.clientId}`;
+        url = `${wsUrl}/v1/realtime/auth?${auth ?? `access_token=${encodeURIComponent(this.options.accessToken)}`}&client_id=${this.clientId}`;
         if (this.http.canRefreshMemberToken(this.options.accessToken)) {
           this.tokenRefreshNegotiated = true;
           url += "&token_refresh=1";
@@ -11248,7 +11524,7 @@ var RealtimeAPI = class {
           reject(error);
           return;
         }
-        url = `${wsUrl}/v1/realtime/auth?public_key=${encodeURIComponent(publicKey)}&client_id=${this.clientId}`;
+        url = `${wsUrl}/v1/realtime/auth?${auth ?? `public_key=${encodeURIComponent(publicKey)}`}&client_id=${this.clientId}`;
         this.log("Using API Key authentication");
       }
       if (this.userId) {
@@ -11728,7 +12004,9 @@ var RealtimeAPI = class {
         try {
           await this.prepareConnectToken();
           if (this.state !== "reconnecting") return;
-          await this.doConnect();
+          const ticket = await this.connectTicket(this.options.timeout);
+          if (this.state !== "reconnecting") return;
+          await this.doConnect(void 0, ticket);
           this.log("Reconnected successfully, restoring subscriptions...");
           const snapshot = this.pendingRestore;
           this.pendingRestore = null;
@@ -13331,8 +13609,8 @@ var SupportAPI = class {
   }
 };
 function detectSdkVersion() {
-  if ("6.13.0") {
-    return "6.13.0";
+  if ("6.15.0") {
+    return "6.15.0";
   }
   return "unknown";
 }
@@ -14301,9 +14579,35 @@ var WebRTCAPI = class _WebRTCAPI {
     }
     return this.connectWebSocket();
   }
-  connectWebSocket() {
+  async connectWebSocket() {
+    const before = this.wsGeneration;
+    const ticket = await this.signalingTicket();
+    if (this.wsGeneration !== before) {
+      throw new Error("\uC5F0\uACB0\uC774 \uCDE8\uC18C\uB418\uC5C8\uC2B5\uB2C8\uB2E4");
+    }
+    return this.openSignalingSocket(ticket);
+  }
+  /**
+   * 연결 시도 한 번에 쓸 1회용 티켓을 받는다(core/ws-ticket.ts). 브라우저 WebSocket 은 헤더를 못 붙여 예전에는 멤버 토큰
+   * (`?access_token=`)과 공개 키(`?public_key=`)를 URL 에 실었다 — 이제 헤더로 티켓을 받아 `?ticket=` 만 싣는다. 서버가
+   * 티켓을 모르거나(구버전) 잠시 못 주면 null 이고 예전처럼 붙는다. 발급이 자격증명을 거부하면 그 이유로 던진다.
+   */
+  async signalingTicket() {
+    const accessToken = this.http.getAccessToken();
+    const publicKey = accessToken ? void 0 : this.http.getPublicKey();
+    if (!accessToken && !publicKey || !this.appId) return null;
+    return fetchWsTicket(
+      ticketUrl(
+        this.webrtcUrl,
+        `/v1/apps/${encodeURIComponent(this.appId)}/signaling/ws-ticket`
+      ),
+      "webrtc.signaling",
+      accessToken ? { kind: "access_token", value: accessToken } : { kind: "public_key", value: publicKey }
+    );
+  }
+  openSignalingSocket(ticket) {
     return new Promise((resolve, reject) => {
-      const wsUrl = this.buildWebSocketUrl();
+      const wsUrl = this.buildWebSocketUrl(ticket);
       const generation = ++this.wsGeneration;
       const ws = new WebSocket(wsUrl);
       this.ws = ws;
@@ -14372,12 +14676,14 @@ var WebRTCAPI = class _WebRTCAPI {
     ws.onerror = null;
     ws.onclose = null;
   }
-  buildWebSocketUrl() {
+  buildWebSocketUrl(ticket = null) {
     const wsBase = this.webrtcUrl.replace("https://", "wss://").replace("http://", "ws://");
     const publicKey = this.http.getPublicKey();
     const accessToken = this.http.getAccessToken();
     let authParam = "";
-    if (accessToken) {
+    if (ticket) {
+      authParam = `ticket=${encodeURIComponent(ticket)}`;
+    } else if (accessToken) {
       authParam = `access_token=${encodeURIComponent(accessToken)}`;
     } else if (publicKey) {
       authParam = `public_key=${encodeURIComponent(publicKey)}`;
@@ -15035,11 +15341,35 @@ var WebSocketTransport = class {
     this.onClose = onClose;
     this.onError = onError;
   }
-  connect() {
+  async connect() {
+    const ticket = await this.connectionTicket();
+    return this.openSocket(ticket);
+  }
+  /**
+   * 연결 시도 한 번에 쓸 1회용 티켓(core/ws-ticket.ts). 서버가 티켓을 모르거나(구버전) 잠시 못 주면 null 이고 예전처럼
+   * 자격증명을 URL 에 싣는다. 발급이 자격증명을 거부하면 {@link GameError} 로 던진다.
+   */
+  async connectionTicket() {
+    const { accessToken, publicKey, appId } = this.config;
+    if (!accessToken && !publicKey || !appId) return null;
+    const baseUrl = this.config.gameServerUrl || "wss://game.connectbase.world";
+    try {
+      return await fetchWsTicket(
+        ticketUrl(baseUrl, `/v1/game/${encodeURIComponent(appId)}/ws-ticket`),
+        "game.ws",
+        accessToken ? { kind: "access_token", value: accessToken } : { kind: "public_key", value: publicKey }
+      );
+    } catch (e) {
+      if (e instanceof WsTicketError) {
+        throw new GameError({ code: e.code, message: e.message });
+      }
+      throw e;
+    }
+  }
+  openSocket(ticket) {
     return new Promise((resolve, reject) => {
-      const url = this.buildUrl();
       try {
-        this.ws = new WebSocket(url);
+        this.ws = new WebSocket(this.buildUrl(ticket));
         this.ws.binaryType = "arraybuffer";
       } catch (error) {
         reject(error);
@@ -15069,16 +15399,20 @@ var WebSocketTransport = class {
       this.ws.addEventListener("message", onMessage);
     });
   }
-  buildUrl() {
+  buildUrl(ticket = null) {
     const baseUrl = this.config.gameServerUrl || "wss://game.connectbase.world";
     const wsUrl = baseUrl.replace(/^http/, "ws");
     const params = new URLSearchParams();
     params.set("client_id", requireClientId(this.config.clientId));
-    if (this.config.publicKey) {
-      params.set("public_key", this.config.publicKey);
-    }
-    if (this.config.accessToken) {
-      params.set("token", this.config.accessToken);
+    if (ticket) {
+      params.set("ticket", ticket);
+    } else {
+      if (this.config.publicKey) {
+        params.set("public_key", this.config.publicKey);
+      }
+      if (this.config.accessToken) {
+        params.set("token", this.config.accessToken);
+      }
     }
     if (!this.config.appId) {
       throw new Error(
@@ -15758,6 +16092,7 @@ var index_default = ConnectBase;
   RolesAPI,
   SessionManager,
   VideoProcessingError,
+  WsTicketError,
   detectInAppBrowser,
   escapeToExternalBrowser,
   isWebTransportSupported,