create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/public/js/machine-pool-shared.js

@@ -0,0 +1,436 @@
+// public/js/machine-pool-shared.js — WP-6 (docs/machine-pool-picker-pairing-dashboard-2026-10-24.html
+// §5 D-1/D-2/D-3/D-4/D-9/D-12, P-7, §6.4 client block, §8 WP-6).
+//
+// ONE copy of every DOM-free machine-pool presenter the desktop and the phone both need. It is a
+// classic script (no module system, no bundler) and it is loaded by BOTH pages:
+//
+//   desktop  public/index.html   — before js/core/session-commands.js and js/app/machines-page.js
+//   phone    public/m/index.html — before /m/app.js
+//
+// Why a shared file and not two copies: the phone is a second renderer of the same machine pool
+// (ruling: phone = desktop parity), so the ORDER (D-1), the SEARCH TEXT (D-2), the GROUPS (D-3),
+// the LOAD LINE (D-12), the sparkline (AC-5b) and the pairing container (§6.3/D-9) must be the same
+// bytes on both. Anything that touches the DOM, the network, a timer or a clock read stays in the
+// surface that owns it; this file is pure and takes `now` from its caller.
+//
+// Nothing here reads localStorage, sessionStorage or a cookie. Nothing here calls Date.now() on a
+// tested path: every presenter that needs a clock is handed one.
+
+// D-12: the hub re-reads a box's sample at most once per 60 s, so a sample older than three
+// refreshes is LABELLED, never shown as the box's current number.
+var MACHINE_STATS_STALE_MS = 3 * 60000;
+// D-3 "Recent": a box used within the last 14 days.
+var MACHINE_RECENT_MS = 14 * 24 * 60 * 60 * 1000;
+// D-1: while N = 1 + the visible (non-hidden) registry rows is at most MACHINE_PICKER_CARD_LIMIT the
+// picker keeps the one-click card row; above the limit it keeps This Mac + the top three and adds a
+// fifth "All machines (N)…" card (desktop) or a search sheet (phone).
+var MACHINE_PICKER_CARD_LIMIT = 4;
+
+// D-9 verbatim: `ctmpair1:` + base64url(JSON{v,i,n,u,c}).
+var MACHINES_PAGE_PAIR_PREFIX = 'ctmpair1:';
+// RFC 8628 §6.1 (lib/machine-pairing.js CODE_ALPHABET/CODE_LENGTH): the code is 8 characters out of
+// this vowel-free, look-alike-free alphabet, shown as XXXX-XXXX.
+var MACHINES_PAGE_CODE_ALPHABET = 'BCDFGHJKLMNPQRSTVWXZ';
+var MACHINES_PAGE_CODE_LENGTH = 8;
+
+// Machine health one-liners. The phone used to carry its own two copies (phoneMachineHealthLabel /
+// phoneMachineLastSeen) — same wording, so they are this pair now.
+function machineHealthLabel(machine) {
+  var health = String((machine && machine.health) || 'unknown');
+  return health.charAt(0).toUpperCase() + health.slice(1);
+}
+
+// Relative age, owned here so desktop and phone say the same thing (the phone never loads
+// js/core/01-util.js's timeAgo, and its own relativeAgeText is private to m/app.js). Same buckets as
+// timeAgo. `at` is a timestamp or ISO string — 0 means the hub has never seen the box; `now` is
+// injectable for tests.
+function machineAgoText(at, now) {
+  var ms = typeof at === 'string' && at && !/^\d+$/.test(at) ? Date.parse(at) : Number(at);
+  if (!ms || !Number.isFinite(ms)) return 'never seen';
+  // The desktop's own helper when the page has it (same buckets), so the two never drift apart.
+  if (now == null && typeof timeAgo === 'function') return timeAgo(ms);
+  var seconds = Math.floor(((now == null ? Date.now() : Number(now)) - ms) / 1000);
+  if (seconds < 60) return 'just now';
+  var minutes = Math.floor(seconds / 60);
+  if (minutes < 60) return minutes + 'm ago';
+  var hours = Math.floor(minutes / 60);
+  if (hours < 24) return hours + 'h ago';
+  var days = Math.floor(hours / 24);
+  if (days < 30) return days + 'd ago';
+  return Math.floor(days / 30) + 'mo ago';
+}
+
+function machineLastSeenText(machine) {
+  var at = Number((machine && machine.lastSeenAt) || 0);
+  if (!at) return 'never seen';
+  return 'last seen ' + machineAgoText(at);
+}
+
+// AC-5a: reachable is selectable; unknown/unhealthy are disabled; unreachable is absent from the
+// card row (HUB AC-5a). `machineIsOffline` is the popover/sheet half of that rule and is the ONE
+// predicate both apps read.
+function machineIsOffline(machine) {
+  return String((machine && machine.health) || '').trim() !== 'reachable';
+}
+
+function machineIsFavorite(machine) {
+  return !!(machine && (machine.favorite === 1 || machine.favorite === true || Number(machine.favorite) === 1));
+}
+
+// D-4 "hide from picker". Strictly the 1/true spellings: an absent field is visible.
+function machineIsHidden(machine) {
+  return !!(machine && (machine.hidden === 1 || machine.hidden === true || Number(machine.hidden) === 1));
+}
+
+// D-1 order: reachable rows first, then favorite DESC, lastUsedAt DESC, displayName ASC. `hidden`
+// rows (D-4 "hide from picker") are dropped here and nowhere else, so no caller can resurrect one.
+function machinePickerOrder(machines) {
+  var rows = (Array.isArray(machines) ? machines : []).filter(function (m) { return m && m.instanceId && !machineIsHidden(m); });
+  var reachableRank = function (m) { return machineIsOffline(m) ? 1 : 0; };
+  var favorite = function (m) { return machineIsFavorite(m) ? 1 : 0; };
+  var lastUsed = function (m) { return Number((m && m.lastUsedAt) || 0); };
+  var name = function (m) { return String((m && (m.displayName || m.url || m.instanceId)) || ''); };
+  return rows.slice().sort(function (a, b) {
+    return reachableRank(a) - reachableRank(b)
+      || favorite(b) - favorite(a)
+      || lastUsed(b) - lastUsed(a)
+      || name(a).localeCompare(name(b));
+  });
+}
+
+// D-2 search: the fields people actually remember, lowercased and joined with ' '. Always the same
+// six slots in the same order, so a field the hub did not send can never shift the ones after it.
+function machineSearchText(machine) {
+  if (!machine) return '';
+  var sample = machine.stats && machine.stats.sample;
+  var gpu = sample && sample.gpu ? sample.gpu.name : '';
+  return [machine.displayName, machine.hostname, machine.os, machine.arch, machine.url, gpu]
+    .map(function (value) { return String(value == null ? '' : value); })
+    .join(' ')
+    .toLowerCase();
+}
+
+// D-12 load line: 'CPU 12% · 3 running' from the box's newest sample, 'stats stale' once that sample
+// is older than MACHINE_STATS_STALE_MS, '' when the hub holds no sample at all. `now` is passed in
+// by every caller (and by tests), so staleness is never judged against a clock read inside here.
+function machineLoadLine(machine, now) {
+  var stats = (machine && machine.stats) || null;
+  var sample = stats && stats.sample;
+  if (!stats || !sample) return '';
+  var at = Number(now == null ? Date.now() : now);
+  var checkedAt = Number(stats.checkedAt || 0);
+  if (!checkedAt || at - checkedAt > MACHINE_STATS_STALE_MS) return 'stats stale';
+  var parts = [];
+  var cpu = Number(sample.cpuPct);
+  if (sample.cpuPct != null && Number.isFinite(cpu)) parts.push('CPU ' + Math.round(cpu) + '%');
+  var running = sample.tasks ? Number(sample.tasks.running) : NaN;
+  if (sample.tasks && sample.tasks.running != null && Number.isFinite(running)) parts.push(running + ' running');
+  return parts.join(' · ');
+}
+
+// D-3 groups, as bare machine rows (the surface renders them). Favorites and Recent are filtered
+// views of All (a box may legitimately appear in two groups); Offline carries the rows HUB AC-5a
+// keeps out of the card row. `hidden` rows are already gone: machinePickerOrder dropped them.
+function machinePickerGroupRows(machines, now) {
+  var at = Number(now == null ? Date.now() : now);
+  var order = machinePickerOrder(machines);
+  var online = order.filter(function (m) { return !machineIsOffline(m); });
+  var offline = order.filter(function (m) { return machineIsOffline(m); });
+  return [
+    { id: 'favorites', label: 'Favorites', rows: online.filter(machineIsFavorite) },
+    { id: 'recent', label: 'Recent', rows: online.filter(function (m) {
+      var last = Number(m.lastUsedAt || 0);
+      return last > 0 && at - last <= MACHINE_RECENT_MS;
+    }) },
+    { id: 'all', label: 'All', rows: order },
+    { id: 'offline', label: 'Offline', rows: offline },
+  ].filter(function (group) { return group.rows.length > 0; });
+}
+
+// P-7 / §6.2 P-4: the public https origin a phone can actually sign in to. `urls` is the dial list
+// (rev 2); `url` is the legacy single address. A plain-http LAN address is not a passkey origin, so
+// only `https:` counts here.
+function machinePoolOrigin(machine) {
+  var urls = (machine && Array.isArray(machine.urls) ? machine.urls : []).slice();
+  if (machine && machine.url) urls.push(machine.url);
+  for (var i = 0; i < urls.length; i += 1) {
+    var candidate = String(urls[i] == null ? '' : urls[i]).trim().replace(/\/+$/, '');
+    if (/^https:\/\//i.test(candidate)) return candidate;
+  }
+  return '';
+}
+
+// P-7 "Sign in to <member> too": the origin this device has never reached. `origins` is the parsed
+// ctm.pool.origins dial cache ([{ origin, lastSeenAt }]). '' when the member has no https origin or
+// this device has already been there — i.e. only the unvisited members render the row.
+function machinePoolSignInOrigin(machine, origins) {
+  var origin = machinePoolOrigin(machine);
+  if (!origin) return '';
+  var seen = (Array.isArray(origins) ? origins : []).some(function (row) {
+    return row && String(row.origin || '').replace(/\/+$/, '') === origin && Number(row.lastSeenAt || 0) > 0;
+  });
+  return seen ? '' : origin;
+}
+
+// ── AC-5b sparkline ─────────────────────────────────────────────────────────────────────────────
+// ONE <path> per metric. A null sample (a minute the box was off, or the purge gap) CLOSES the run
+// and the next value opens a new one with `M`, so the element count never grows with the data: 1440
+// samples with two gaps is one <path> with three `M` segments.
+function sparklineSvg(values, opts) {
+  var options = opts || {};
+  var width = Number(options.width || 120) || 120;
+  var height = Number(options.height || 28) || 28;
+  var raw = Array.isArray(values) ? values : [];
+  var nums = raw.map(function (value) {
+    if (value == null || value === '') return null;
+    var n = Number(value);
+    return Number.isFinite(n) ? n : null;
+  });
+  var present = nums.filter(function (n) { return n != null; });
+  var open = '<svg class="machine-spark" width="' + width + '" height="' + height
+    + '" viewBox="0 0 ' + width + ' ' + height + '" aria-hidden="true" focusable="false">';
+  if (!present.length) return open + '</svg>';
+  var min = Math.min.apply(null, present);
+  var max = Math.max.apply(null, present);
+  var span = (max - min) || 1;
+  var count = nums.length;
+  var x = function (index) { return count <= 1 ? 0 : (index / (count - 1)) * width; };
+  var y = function (value) { return height - ((value - min) / span) * height; };
+  var d = '';
+  var run = [];
+  var flush = function () {
+    if (!run.length) return;
+    var segment = run.map(function (point, index) {
+      return (index === 0 ? 'M' : 'L') + point[0].toFixed(2) + ' ' + point[1].toFixed(2);
+    }).join(' ');
+    d += (d ? ' ' : '') + segment;
+    run = [];
+  };
+  for (var i = 0; i < count; i += 1) {
+    if (nums[i] == null) { flush(); continue; }
+    run.push([x(i), y(nums[i])]);
+  }
+  flush();
+  // A single point has no line: emit a degenerate segment so the path still exists (never a throw).
+  return open + '<path d="' + (d || ('M0 ' + (height / 2).toFixed(2))) + '"/></svg>';
+}
+
+// ── D-9 pairing container (the member side, client-only) ────────────────────────────────────────
+// §6.3 verbatim: uppercase, then drop every character outside the alphabet — hyphens and spaces are
+// formatting, not content. Mirrors lib/machine-pairing.js normalizeCode.
+function machinesNormalizeCode(value) {
+  var out = '';
+  var raw = String(value == null ? '' : value).toUpperCase();
+  for (var i = 0; i < raw.length; i += 1) {
+    if (MACHINES_PAGE_CODE_ALPHABET.indexOf(raw.charAt(i)) !== -1) out += raw.charAt(i);
+  }
+  return out;
+}
+
+function machinesFormatCode(value) {
+  var code = machinesNormalizeCode(value);
+  if (code.length !== MACHINES_PAGE_CODE_LENGTH) return code;
+  return code.slice(0, 4) + '-' + code.slice(4);
+}
+
+// base64url -> UTF-8. atob() is the browser's decoder; the escape/decodeURIComponent pair is the
+// standard way to recover the UTF-8 bytes it produced (and both exist in a bare vm realm, unlike
+// TextDecoder).
+function machinesBase64UrlDecode(text) {
+  var padded = String(text || '').replace(/-/g, '+').replace(/_/g, '/');
+  while (padded.length % 4) padded += '=';
+  var binary = atob(padded);
+  return decodeURIComponent(escape(binary));
+}
+
+// D-9: A hand-edited or truncated string is null, never a throw, so the dialog can render its
+// refusal. One copy: the desktop Add dialog and the phone Add sheet both read this.
+function decodePairingStringClient(value) {
+  var raw = String(value == null ? '' : value).trim();
+  if (raw.indexOf(MACHINES_PAGE_PAIR_PREFIX) !== 0) return null;
+  var parsed = null;
+  try {
+    parsed = JSON.parse(machinesBase64UrlDecode(raw.slice(MACHINES_PAGE_PAIR_PREFIX.length)));
+  } catch (error) {
+    return null; // expected: a corrupted container is a client error, not a fault to report
+  }
+  if (!parsed || typeof parsed !== 'object' || parsed.v !== 1) return null;
+  var code = machinesNormalizeCode(parsed.c);
+  if (code.length !== MACHINES_PAGE_CODE_LENGTH) return null;
+  var urls = (Array.isArray(parsed.u) ? parsed.u : [])
+    .map(function (url) { return String(url == null ? '' : url).trim().replace(/\/+$/, ''); })
+    .filter(Boolean);
+  var instanceId = String(parsed.i || '').trim();
+  if (!instanceId && !urls.length) return null;
+  return {
+    version: 1,
+    instanceId: instanceId,
+    displayName: String(parsed.n || ''),
+    urls: urls,
+    code: code,
+    codeDisplay: machinesFormatCode(code),
+  };
+}
+
+// What an Add dialog shows while the user pastes (AC-5c): the box's OWN name (`n`) and its first
+// candidate address (`u[0]`) BEFORE Confirm is enabled; a string that does not decode is refused
+// with the same wording the server uses. Shared, so the phone refuses exactly what the desktop does.
+function machinesAddPreview(pairingText, codeText, urlText) {
+  var raw = String(pairingText == null ? '' : pairingText).trim();
+  if (raw) {
+    var parsed = decodePairingStringClient(raw);
+    if (!parsed) {
+      return { ok: false, mode: 'string', message: 'pairing_string_invalid', name: '', url: '', code: '' };
+    }
+    return {
+      ok: true,
+      mode: 'string',
+      message: '',
+      name: parsed.displayName || parsed.instanceId || '',
+      url: parsed.urls[0] || '',
+      code: parsed.codeDisplay,
+      instanceId: parsed.instanceId,
+      pairingString: raw,
+    };
+  }
+  var code = machinesNormalizeCode(codeText);
+  var url = String(urlText == null ? '' : urlText).trim().replace(/\/+$/, '');
+  if (!code && !url) {
+    return { ok: false, mode: 'manual', message: '', name: '', url: '', code: '' };
+  }
+  if (code.length !== MACHINES_PAGE_CODE_LENGTH) {
+    return { ok: false, mode: 'manual', message: 'pairing_code_invalid', name: '', url: url, code: code };
+  }
+  if (!/^https?:\/\/.+/i.test(url)) {
+    return { ok: false, mode: 'manual', message: 'address_required', name: '', url: url, code: code };
+  }
+  // There is no pre-join name over code + address: the box does not answer its identity until it is
+  // dialled with a credential, and there is no server probe route to ask earlier.
+  return { ok: false, mode: 'manual', message: '', name: '', url: url, code: code, addressOnly: true };
+}
+
+// ── card fact formatters ────────────────────────────────────────────────────────────────────────
+// The Machines page on both apps renders the same facts from the same sample; these are that
+// rendering. They were two copies (machinesCpuSeries/machinesFormatBytes/… in machines-page.js and
+// again in the phone card) — this is the one copy, and both surfaces delegate to it.
+function machineHistoryRows(history) {
+  if (Array.isArray(history)) return history;
+  if (history && Array.isArray(history.samples)) return history.samples;
+  return [];
+}
+
+function machineCpuSeries(history) {
+  return machineHistoryRows(history).map(function (sample) {
+    if (!sample || sample.cpuPct == null) return null;
+    var value = Number(sample.cpuPct);
+    return Number.isFinite(value) ? value : null;
+  });
+}
+
+function machineMemSeries(history) {
+  return machineHistoryRows(history).map(function (sample) {
+    if (!sample) return null;
+    var used = Number(sample.memUsedBytes);
+    var total = Number(sample.memTotalBytes);
+    if (!Number.isFinite(used) || !Number.isFinite(total) || total <= 0) return null;
+    return (used / total) * 100;
+  });
+}
+
+function machineLastValue(series) {
+  if (!Array.isArray(series)) return null;
+  for (var i = series.length - 1; i >= 0; i -= 1) {
+    if (series[i] != null) return series[i];
+  }
+  return null;
+}
+
+function machineFormatBytes(value) {
+  var bytes = Number(value);
+  if (!Number.isFinite(bytes) || bytes <= 0) return '';
+  var units = ['B', 'KB', 'MB', 'GB', 'TB'];
+  var index = 0;
+  var scaled = bytes;
+  while (scaled >= 1024 && index < units.length - 1) { scaled /= 1024; index += 1; }
+  return (scaled >= 10 || index === 0 ? Math.round(scaled) : scaled.toFixed(1)) + ' ' + units[index];
+}
+
+function machineFormatPct(value) {
+  // No sample is no number: Number(null) is 0, which would paint a fake "0%".
+  if (value == null || value === '') return '';
+  var n = Number(value);
+  if (!Number.isFinite(n)) return '';
+  return Math.round(n) + '%';
+}
+
+// WP-4: a reachable box whose Claude/Codex CLI is signed out says so on its card. Same labels on both
+// surfaces.
+var MACHINE_AGENT_LABELS = { claude: 'Claude', codex: 'Codex' };
+
+function machineAgentText(agents) {
+  if (!agents || typeof agents !== 'object') return '';
+  var parts = [];
+  ['claude', 'codex'].forEach(function (key) {
+    var state = String(agents[key] || '');
+    if (state === 'signed_in') parts.push(MACHINE_AGENT_LABELS[key] + ' signed in');
+    else if (state === 'signed_out') parts.push(MACHINE_AGENT_LABELS[key] + ' signed out');
+  });
+  return parts.join(' · ');
+}
+
+function machineTaskLine(tasks) {
+  if (!tasks || typeof tasks !== 'object') return '';
+  var parts = [];
+  if (tasks.running != null) parts.push((Number(tasks.running) || 0) + ' running');
+  if (tasks.needsYou != null) parts.push((Number(tasks.needsYou) || 0) + ' needs you');
+  if (tasks.idle != null) parts.push((Number(tasks.idle) || 0) + ' idle');
+  return parts.join(' · ');
+}
+
+function machineGpuText(gpu) {
+  if (!gpu || typeof gpu !== 'object') return '';
+  var parts = [String(gpu.name || 'GPU')];
+  if (gpu.utilPct != null) parts.push(Math.round(Number(gpu.utilPct)) + '%');
+  if (gpu.tempC != null) parts.push(Math.round(Number(gpu.tempC)) + '°C');
+  if (gpu.powerW != null) parts.push(Math.round(Number(gpu.powerW)) + 'W');
+  return parts.join(' · ');
+}
+
+if (typeof module === 'object' && module.exports) {
+  module.exports = {
+    MACHINE_STATS_STALE_MS: MACHINE_STATS_STALE_MS,
+    MACHINE_RECENT_MS: MACHINE_RECENT_MS,
+    MACHINE_PICKER_CARD_LIMIT: MACHINE_PICKER_CARD_LIMIT,
+    MACHINES_PAGE_PAIR_PREFIX: MACHINES_PAGE_PAIR_PREFIX,
+    MACHINES_PAGE_CODE_ALPHABET: MACHINES_PAGE_CODE_ALPHABET,
+    MACHINES_PAGE_CODE_LENGTH: MACHINES_PAGE_CODE_LENGTH,
+    machineHealthLabel: machineHealthLabel,
+    machineAgoText: machineAgoText,
+    machineLastSeenText: machineLastSeenText,
+    machineIsOffline: machineIsOffline,
+    machineIsFavorite: machineIsFavorite,
+    machineIsHidden: machineIsHidden,
+    machinePickerOrder: machinePickerOrder,
+    machineSearchText: machineSearchText,
+    machineLoadLine: machineLoadLine,
+    machinePickerGroupRows: machinePickerGroupRows,
+    machinePoolOrigin: machinePoolOrigin,
+    machinePoolSignInOrigin: machinePoolSignInOrigin,
+    sparklineSvg: sparklineSvg,
+    machinesNormalizeCode: machinesNormalizeCode,
+    machinesFormatCode: machinesFormatCode,
+    machinesBase64UrlDecode: machinesBase64UrlDecode,
+    decodePairingStringClient: decodePairingStringClient,
+    machinesAddPreview: machinesAddPreview,
+    MACHINE_AGENT_LABELS: MACHINE_AGENT_LABELS,
+    machineHistoryRows: machineHistoryRows,
+    machineCpuSeries: machineCpuSeries,
+    machineMemSeries: machineMemSeries,
+    machineLastValue: machineLastValue,
+    machineFormatBytes: machineFormatBytes,
+    machineFormatPct: machineFormatPct,
+    machineAgentText: machineAgentText,
+    machineTaskLine: machineTaskLine,
+    machineGpuText: machineGpuText,
+  };
+}

package/template/coding-task-manager/public/js/private-state-scope.js

@@ -11,6 +11,11 @@
   const MAX_ID_LENGTH = 160;
   const MAX_NAME_LENGTH = 256;
   const MAX_ORIGIN_LENGTH = 2048;
+  // Every identity read gets a deadline that cancels the request (D-1). The
+  // value must exceed the slowest bounded server path on these routes — the ps
+  // snapshot cap of 5000 ms (PS_SNAPSHOT_TIMEOUT_MS, lib/walle-supervisor.js:183)
+  // — 2 × PS_SNAPSHOT_TIMEOUT_MS, and well under the 60 s test timeout.
+  const PRIVATE_SCOPE_READ_TIMEOUT_MS = 10000;
 
   function object(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -98,6 +103,17 @@
     const subtle = options.crypto && options.crypto.subtle;
     const storage = options.storage || null;
     const callback = typeof options.onStateChange === 'function' ? options.onStateChange : null;
+    // Production passes neither option. Tests inject a short readTimeoutMs, and
+    // an AbortSignal-like object with .timeout(ms) when the runtime lacks one.
+    const readTimeoutMs = Number.isFinite(options.readTimeoutMs) && options.readTimeoutMs > 0
+      ? options.readTimeoutMs : PRIVATE_SCOPE_READ_TIMEOUT_MS;
+    const abortSignalApi = options.AbortSignal
+      || (typeof globalThis !== 'undefined' ? globalThis.AbortSignal : null);
+    function readSignal() {
+      // No AbortSignal.timeout in this runtime: send no signal rather than throw.
+      if (!abortSignalApi || typeof abortSignalApi.timeout !== 'function') return null;
+      return abortSignalApi.timeout(readTimeoutMs);
+    }
     let epoch = 0;
     let ready = false;
     let lease = null;
@@ -163,7 +179,13 @@
       if (typeof fetcher !== 'function') throw { code: failureCode };
       let response;
       try {
-        response = await fetcher(path, { method: 'GET', credentials: 'same-origin', cache: 'no-store' });
+        const signal = readSignal();
+        response = await fetcher(path, {
+          method: 'GET',
+          credentials: 'same-origin',
+          cache: 'no-store',
+          ...(signal ? { signal } : {}),
+        });
       } catch (error) {
         // An explicit configuration-error discriminator is not a network outage:
         // pass its specific typed code through with NO HTTP status, so it stays
@@ -186,7 +208,13 @@
       let payload;
       try {
         payload = await response.json();
-      } catch {
+      } catch (error) {
+        // The same signal covers the body read, so an aborted body is a
+        // transport failure: report it as "no response" (0), exactly like a
+        // rejected fetch. Any other body failure stays status-less/non-transport.
+        if (error && (error.name === 'TimeoutError' || error.name === 'AbortError')) {
+          throw { code: failureCode, status: 0 };
+        }
         throw { code: failureCode };
       }
       if (!stillCurrent()) return null;
@@ -436,5 +464,5 @@
     });
   }
 
-  return { createPrivateStateScope };
+  return { createPrivateStateScope, PRIVATE_SCOPE_READ_TIMEOUT_MS };
 });