cursedbelt 0.0.0 → 2.3.0

package/dist/client/stream/appStream.js

@@ -0,0 +1,184 @@
+/**
+ * The MULTIPLEXED app stream host (D28) — one live connection per app, however
+ * many instances it composes.
+ *
+ * ## Why this exists
+ *
+ * `createInstanceStreamHost` opens one SSE connection per instance, and that was
+ * fine until an app had several. A browser allows **six concurrent connections
+ * per origin** over HTTP/1.1 and an SSE connection is long-lived, so the budget
+ * is consumed at `instances × open tabs`. Worse than the ceiling is its shape:
+ * once it is exhausted, ordinary `fetch`es queue behind the streams, so the app
+ * does not report an error — it **hangs**. Measured in the browser gate before
+ * this landed: three instances across two tabs passed, four hung, deterministically
+ * in both directions. The studio's whole premise is composing instances, so an
+ * app a customer builds from six of them exhausted the budget in a SINGLE tab.
+ *
+ * This host opens `/api/core/stream?instances=a,b,c` once. The server tags each
+ * instance-scoped frame with `instance: <id>` (`encodeSseFrame`) and this host
+ * routes it to that instance's runtime; an untagged frame is app-wide and goes
+ * to every instance. **Connection count is now a constant — one — and no longer
+ * a function of the manifest.**
+ *
+ * ## Two properties that are not obvious
+ *
+ * **The runtimes are built HERE, not passed in.** That is what makes a full
+ * `unmount()` → `start()` cycle work: an `InstanceRuntime` is single-use by
+ * design (`onUnmount` is terminal and `onLoad` after it is a recorded lifecycle
+ * error), so a host that held one forever could never restart. React's
+ * `StrictMode` performs exactly that cycle on every mount in development, which
+ * means a host without this property leaves a dev app with no live stream at all
+ * — a defect that never shows up in a production bundle and therefore never
+ * shows up in a browser gate.
+ *
+ * **`start()` is ONE memoized promise, not a per-instance race.** `CCAppShell`
+ * calls `start()` on every binding and awaits them together; every call resolves
+ * the same promise, which runs all the ordered lifecycle hooks and only then
+ * opens the socket. Opening on the first binding's start instead would let
+ * frames arrive for an instance whose intake is not subscribed yet — a change
+ * the ledger silently never records.
+ */
+import { createInstanceRuntime, } from '../../core/wire/wireHub';
+import { openCcEventSource, } from './ccEventSource';
+import { applyStreamFrame, defaultCdcChannels, } from './instanceStream';
+/**
+ * Build the multiplexed URL. Ids go through `encodeURIComponent` individually
+ * rather than the whole list, because the comma is the separator the server
+ * splits on and encoding it would make every id a single unknown instance.
+ */
+export const appStreamUrl = (base, instanceIds) => instanceIds.length === 0 ? base : `${base}?instances=${instanceIds.map(encodeURIComponent).join(',')}`;
+export function createAppStreamHost(options) {
+    const channelsForCdc = options.channelsForCdc ?? defaultCdcChannels;
+    const open = options.openStream ?? openCcEventSource;
+    const base = options.url ?? '/api/core/stream';
+    const url = appStreamUrl(base, options.instances.map((instance) => instance.id));
+    /** Live runtimes, keyed by instance id. Rebuilt on each start cycle. */
+    let runtimes = new Map();
+    let source = null;
+    let starting = null;
+    let mounted = 0;
+    let status = 'closed';
+    /**
+     * Route one frame.
+     *
+     * **A frame is applied ONCE, not once per instance, and that is correct rather
+     * than a shortcut.** `WireHub.emit` is app-global: every instance whose intake
+     * channels include the emitted channel is already subscribed to it, so the hub
+     * does the per-instance fan-out. Re-emitting per runtime would publish N
+     * identical envelopes onto one channel — settle damping would swallow them, so
+     * it would cost work and prove nothing. This is exactly what N separate
+     * per-instance streams did: each received only its own instance's frames and
+     * each emitted onto the same shared hub.
+     */
+    const handle = (event) => {
+        if (event.instanceId !== undefined) {
+            // A frame for an instance this host no longer holds is DROPPED rather than
+            // treated as app-wide. It means the server's subscription and ours have
+            // diverged (an instance unmounted mid-stream), and promoting it to
+            // "everyone wants this" is how a port gets marked dirty for a change that
+            // never concerned it.
+            if (!runtimes.has(event.instanceId))
+                return;
+            const instanceId = event.instanceId;
+            applyStreamFrame(event, {
+                hub: options.hub,
+                channelsForCdc,
+                onJob: (job) => options.onJob?.(job, instanceId),
+            });
+            return;
+        }
+        // App-wide — including the tab-broker lock broadcast, which N per-instance
+        // hosts used to publish N copies of for one lock (03 §6.5, V7.9).
+        applyStreamFrame(event, {
+            hub: options.hub,
+            channelsForCdc,
+            onJob: (job) => options.onJob?.(job),
+            sync: options.sync,
+        });
+    };
+    const startAll = async () => {
+        runtimes = new Map(options.instances.map((instance) => [
+            instance.id,
+            createInstanceRuntime({ id: instance.id, hub: options.hub, intakeChannels: instance.intakeChannels }),
+        ]));
+        // Strict order, for every instance, BEFORE the socket opens: intake must be
+        // registered before the first frame can arrive, or the first change lands
+        // with nobody listening and is lost.
+        for (const runtime of runtimes.values())
+            await runtime.onLoad();
+        for (const runtime of runtimes.values())
+            await runtime.onReady();
+        source = open({
+            url,
+            token: options.token,
+            onEvent: handle,
+            onStatus: (next, attempt) => {
+                status = next;
+                options.onStatus?.(next, attempt);
+            },
+        });
+        mounted = runtimes.size;
+    };
+    const closeIfIdle = () => {
+        if (mounted > 0)
+            return;
+        source?.close();
+        source = null;
+        status = 'closed';
+        // Drop the memo so a remount (React StrictMode does one on every mount in
+        // development) builds fresh runtimes and re-opens, instead of no-opping into
+        // an app with no live stream.
+        starting = null;
+        runtimes = new Map();
+    };
+    const host = {
+        get bindings() {
+            return bindings;
+        },
+        url,
+        start() {
+            starting ??= startAll();
+            return starting;
+        },
+        reconnect() {
+            source?.reconnect();
+        },
+        unmount() {
+            for (const runtime of runtimes.values())
+                runtime.onUnmount();
+            mounted = 0;
+            closeIfIdle();
+        },
+        status: () => status,
+        connectionCount: () => (source === null ? 0 : 1),
+    };
+    const bindings = options.instances.map((instance) => ({
+        instanceId: instance.id,
+        start: () => host.start(),
+        reconnect: () => host.reconnect(),
+        suspend() {
+            // The stream and the ledger deliberately SURVIVE a suspend: the whole
+            // point of the two-tier model is that an unrendered instance still learns
+            // about changes (03 §6.2).
+            runtimes.get(instance.id)?.onSuspend();
+        },
+        unmount() {
+            const runtime = runtimes.get(instance.id);
+            if (!runtime)
+                return;
+            runtime.onUnmount();
+            // Routing stops here, but the SUBSCRIPTION does not shrink: re-opening the
+            // socket to drop one id would cost a reconnect (and a gap in every other
+            // instance's frames) to save bytes nobody reads. The stream closes when the
+            // last instance goes, which is the case that actually matters.
+            runtimes.delete(instance.id);
+            mounted -= 1;
+            closeIfIdle();
+        },
+        status: () => status,
+        pullIfDirty: (channel, renderedRev) => runtimes.get(instance.id)?.pullIfDirty(channel, renderedRev),
+        runtime: () => runtimes.get(instance.id) ?? null,
+    }));
+    return host;
+}
+//# sourceMappingURL=appStream.js.map

package/dist/client/stream/appStream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appStream.js","sourceRoot":"","sources":["../../../src/client/stream/appStream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,qBAAqB,GAItB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAIL,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAEhB,kBAAkB,GAEnB,MAAM,kBAAkB,CAAC;AAuF1B;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,WAA8B,EAAU,EAAE,CACnF,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,cAAc,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAEzG,MAAM,UAAU,mBAAmB,CAAC,OAAyB;IAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,kBAAkB,CAAC;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC/C,MAAM,GAAG,GAAG,YAAY,CACtB,IAAI,EACJ,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACjD,CAAC;IAEF,wEAAwE;IACxE,IAAI,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,MAAM,GAAmB,QAAQ,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,MAAM,MAAM,GAAG,CAAC,KAA4D,EAAQ,EAAE;QACpF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,2EAA2E;YAC3E,wEAAwE;YACxE,mEAAmE;YACnE,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;gBAAE,OAAO;YAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;YACpC,gBAAgB,CAAC,KAAK,EAAE;gBACtB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,cAAc;gBACd,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC;aACjD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,kEAAkE;QAClE,gBAAgB,CAAC,KAAK,EAAE;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,cAAc;YACd,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;QACzC,QAAQ,GAAG,IAAI,GAAG,CAChB,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YAClC,QAAQ,CAAC,EAAE;YACX,qBAAqB,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;SACtG,CAAC,CACH,CAAC;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,qCAAqC;QACrC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;YAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAChE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;YAAE,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAEjE,MAAM,GAAG,IAAI,CAAC;YACZ,GAAG;YACH,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;gBAC1B,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;SACF,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO;QACxB,MAAM,EAAE,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,GAAG,QAAQ,CAAC;QAClB,0EAA0E;QAC1E,6EAA6E;QAC7E,8BAA8B;QAC9B,QAAQ,GAAG,IAAI,CAAC;QAChB,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;IACvB,CAAC,CAAC;IAEF,MAAM,IAAI,GAAkB;QAC1B,IAAI,QAAQ;YACV,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,GAAG;QACH,KAAK;YACH,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,SAAS;YACP,MAAM,EAAE,SAAS,EAAE,CAAC;QACtB,CAAC;QACD,OAAO;YACL,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;gBAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7D,OAAO,GAAG,CAAC,CAAC;YACZ,WAAW,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QACpB,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACjD,CAAC;IAEF,MAAM,QAAQ,GAAgC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACjF,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE;QACzB,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE;QACjC,OAAO;YACL,sEAAsE;YACtE,0EAA0E;YAC1E,2BAA2B;YAC3B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACzC,CAAC;QACD,OAAO;YACL,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,2EAA2E;YAC3E,yEAAyE;YACzE,4EAA4E;YAC5E,+DAA+D;YAC/D,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC,CAAC;YACb,WAAW,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QACpB,WAAW,EAAE,CAAK,OAAe,EAAE,WAAmB,EAA+B,EAAE,CACrF,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAI,OAAO,EAAE,WAAW,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI;KACjD,CAAC,CAAC,CAAC;IAEJ,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/client/stream/ccEventSource.d.ts

@@ -0,0 +1,98 @@
+/**
+ * The client half of the server push tier (03 §3.2, §6.5).
+ *
+ * `EventSource` already reconnects — so why not use it? Because its reconnect is
+ * a FIXED interval taken from the server's `retry:` hint, and a fixed interval
+ * across N tabs is precisely the synchronized stampede J5-2 rules out: a server
+ * restart or a laptop resume wakes every tab at once and they all retry in the
+ * same millisecond, then again in the same millisecond. The reconnect law is
+ * `delay = random(0, min(cap, base·2^attempt))` — full jitter — and the only way
+ * to apply it is to own the loop.
+ *
+ * What this owns, and `EventSource` does not:
+ *
+ *   * **Jittered backoff** with a stability reset, so a flaky link does not
+ *     inherit yesterday's backoff (`createReconnectSchedule`).
+ *   * **Auth headers.** `EventSource` cannot set them; the framework's SSE
+ *     routes accept a cookie for exactly that reason, but a token-only client
+ *     (a native shell, a test) needs the header path. The token may be a GETTER,
+ *     read at each connection attempt — a stream opened before sign-in must be
+ *     able to present the session it did not have when it started, and a static
+ *     string captured at construction is the same stale closure the session
+ *     store exists to prevent on the fetch client (02 §5).
+ *   * **A single abort path.** Closing cancels the in-flight read, the pending
+ *     retry timer and the reader together — a half-closed stream that keeps
+ *     retrying is the leak this shape prevents.
+ */
+import { type ReconnectSchedule } from '../../core/net/reconnectSchedule';
+/** One decoded SSE frame. */
+export interface CcStreamEvent {
+    /** The `event:` name — `cdc`, `job`, `lifecycle`, `state`, `ready`, `overflow`. */
+    event: string;
+    data: unknown;
+    /**
+     * The instance this frame belongs to, from the server's `instance:` field
+     * line (`encodeSseFrame`). Absent ⇒ APP-WIDE: a lock broadcast, a redeploy, a
+     * usage limit — something every instance must see.
+     *
+     * This is what makes one connection able to serve N instances (D28). Read it
+     * before routing: a frame delivered to the wrong instance's ledger marks a
+     * port dirty that did not change, and a frame delivered to none is a change
+     * the app never learns about.
+     */
+    instanceId?: string;
+}
+export type CcStreamStatus = 'connecting' | 'open' | 'reconnecting' | 'closed';
+/**
+ * The bearer token an SSE connection presents — a value, or a getter read at
+ * every connection attempt. Prefer the getter in any app that can sign in
+ * mid-session: the stream opens at mount, and the session usually arrives later.
+ */
+export type CcStreamToken = string | (() => string | null | undefined);
+export interface CcEventSourceOptions {
+    url: string;
+    /** Bearer token presented on each (re)connection. */
+    token?: CcStreamToken;
+    onEvent(event: CcStreamEvent): void;
+    onStatus?(status: CcStreamStatus, attempt: number): void;
+    /** Injected for tests. Defaults to global `fetch`. */
+    fetchImpl?: typeof fetch;
+    /** Injected for tests. Defaults to the jittered schedule (03 §6.5). */
+    schedule?: ReconnectSchedule;
+    /** Timer seam for tests. */
+    setTimeoutFn?: (fn: () => void, ms: number) => unknown;
+    clearTimeoutFn?: (handle: unknown) => void;
+}
+export interface CcEventSource {
+    status(): CcStreamStatus;
+    /** Reconnect attempts since the last stable connection. */
+    attempt(): number;
+    /**
+     * Drop the current connection and re-open immediately, resetting the backoff.
+     *
+     * This is the CREDENTIAL-CHANGE path, not a retry: signing in (or out) changes
+     * which tenant's records the server is willing to push, and the server decides
+     * that once, at connect. Without an explicit re-open, a tab that signed in
+     * after mount keeps the anonymous stream it opened and silently receives no
+     * tenant-scoped CDC — the failure this method exists to make impossible.
+     * No-ops after `close()`.
+     */
+    reconnect(): void;
+    /** Stop for good. Idempotent; cancels the reader AND any pending retry. */
+    close(): void;
+}
+/**
+ * Split an SSE byte stream into frames.
+ *
+ * Frames are separated by a blank line, and a frame may arrive split across
+ * chunk boundaries — which is why the buffer lives outside the read loop.
+ * Comment lines (`: keep-alive`) and the `retry:` hint are consumed and
+ * discarded here: the heartbeat exists to keep proxies honest, and waking a
+ * client handler for it would make every consumer filter it out.
+ */
+export declare const parseSseFrames: (buffer: string) => {
+    frames: CcStreamEvent[];
+    rest: string;
+};
+export declare function openCcEventSource(options: CcEventSourceOptions): CcEventSource;
+//# sourceMappingURL=ccEventSource.d.ts.map

package/dist/client/stream/ccEventSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ccEventSource.d.ts","sourceRoot":"","sources":["../../../src/client/stream/ccEventSource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA2B,KAAK,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAEnG,6BAA6B;AAC7B,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEvE,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACzD,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,4BAA4B;IAC5B,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IACvD,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,IAAI,cAAc,CAAC;IACzB,2DAA2D;IAC3D,OAAO,IAAI,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,SAAS,IAAI,IAAI,CAAC;IAClB,2EAA2E;IAC3E,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,KAAG;IAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAoCtF,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA8G9E"}

package/dist/client/stream/ccEventSource.js

@@ -0,0 +1,188 @@
+/**
+ * The client half of the server push tier (03 §3.2, §6.5).
+ *
+ * `EventSource` already reconnects — so why not use it? Because its reconnect is
+ * a FIXED interval taken from the server's `retry:` hint, and a fixed interval
+ * across N tabs is precisely the synchronized stampede J5-2 rules out: a server
+ * restart or a laptop resume wakes every tab at once and they all retry in the
+ * same millisecond, then again in the same millisecond. The reconnect law is
+ * `delay = random(0, min(cap, base·2^attempt))` — full jitter — and the only way
+ * to apply it is to own the loop.
+ *
+ * What this owns, and `EventSource` does not:
+ *
+ *   * **Jittered backoff** with a stability reset, so a flaky link does not
+ *     inherit yesterday's backoff (`createReconnectSchedule`).
+ *   * **Auth headers.** `EventSource` cannot set them; the framework's SSE
+ *     routes accept a cookie for exactly that reason, but a token-only client
+ *     (a native shell, a test) needs the header path. The token may be a GETTER,
+ *     read at each connection attempt — a stream opened before sign-in must be
+ *     able to present the session it did not have when it started, and a static
+ *     string captured at construction is the same stale closure the session
+ *     store exists to prevent on the fetch client (02 §5).
+ *   * **A single abort path.** Closing cancels the in-flight read, the pending
+ *     retry timer and the reader together — a half-closed stream that keeps
+ *     retrying is the leak this shape prevents.
+ */
+import { createReconnectSchedule } from '../../core/net/reconnectSchedule';
+/**
+ * Split an SSE byte stream into frames.
+ *
+ * Frames are separated by a blank line, and a frame may arrive split across
+ * chunk boundaries — which is why the buffer lives outside the read loop.
+ * Comment lines (`: keep-alive`) and the `retry:` hint are consumed and
+ * discarded here: the heartbeat exists to keep proxies honest, and waking a
+ * client handler for it would make every consumer filter it out.
+ */
+export const parseSseFrames = (buffer) => {
+    const frames = [];
+    let rest = buffer;
+    for (;;) {
+        const boundary = rest.indexOf('\n\n');
+        if (boundary === -1)
+            break;
+        const raw = rest.slice(0, boundary);
+        rest = rest.slice(boundary + 2);
+        let event = 'message';
+        let instanceId;
+        const dataLines = [];
+        for (const line of raw.split('\n')) {
+            if (line.startsWith(':'))
+                continue;
+            if (line.startsWith('event:'))
+                event = line.slice('event:'.length).trim();
+            // The multiplexing tag (D28). An unknown field is legal SSE and ignorable,
+            // which is exactly why the server can add it without breaking any other
+            // reader — but THIS reader is the one that has to route by it.
+            else if (line.startsWith('instance:'))
+                instanceId = line.slice('instance:'.length).trim() || undefined;
+            else if (line.startsWith('data:'))
+                dataLines.push(line.slice('data:'.length).trim());
+        }
+        if (dataLines.length === 0)
+            continue;
+        const payload = dataLines.join('\n');
+        let data = payload;
+        try {
+            data = JSON.parse(payload);
+        }
+        catch {
+            // A non-JSON frame is delivered as its raw text rather than dropped: the
+            // consumer knows its own protocol better than this parser does.
+        }
+        frames.push(instanceId === undefined ? { event, data } : { event, data, instanceId });
+    }
+    return { frames, rest };
+};
+export function openCcEventSource(options) {
+    const doFetch = options.fetchImpl ?? fetch;
+    const schedule = options.schedule ?? createReconnectSchedule();
+    const setTimeoutFn = options.setTimeoutFn ?? ((fn, ms) => setTimeout(fn, ms));
+    const clearTimeoutFn = options.clearTimeoutFn ?? ((handle) => clearTimeout(handle));
+    let status = 'connecting';
+    let closed = false;
+    let controller = null;
+    let retryTimer = null;
+    /**
+     * Bumped by `reconnect()`. A connection attempt that outlives its generation
+     * (its abort raced a credential change) must not schedule a retry of its own —
+     * otherwise one sign-in leaves two live readers on the same stream.
+     */
+    let generation = 0;
+    const setStatus = (next) => {
+        status = next;
+        options.onStatus?.(next, schedule.attempt());
+    };
+    /** The token as of NOW — never as of construction. */
+    const currentToken = () => {
+        const token = typeof options.token === 'function' ? options.token() : options.token;
+        return token === null || token === '' ? undefined : token;
+    };
+    const scheduleRetry = () => {
+        if (closed)
+            return;
+        setStatus('reconnecting');
+        retryTimer = setTimeoutFn(() => {
+            retryTimer = null;
+            void connect();
+        }, schedule.nextDelayMs());
+    };
+    const connect = async () => {
+        if (closed)
+            return;
+        const mine = generation;
+        controller = new AbortController();
+        const openedAt = Date.now();
+        try {
+            const token = currentToken();
+            const response = await doFetch(options.url, {
+                headers: {
+                    accept: 'text/event-stream',
+                    ...(token ? { authorization: `Bearer ${token}` } : {}),
+                },
+                signal: controller.signal,
+            });
+            if (!response.ok || !response.body) {
+                if (mine === generation)
+                    scheduleRetry();
+                return;
+            }
+            setStatus('open');
+            const reader = response.body.getReader();
+            const decoder = new TextDecoder();
+            let buffer = '';
+            for (;;) {
+                const { value, done } = await reader.read();
+                if (done)
+                    break;
+                buffer += decoder.decode(value, { stream: true });
+                const parsed = parseSseFrames(buffer);
+                buffer = parsed.rest;
+                for (const frame of parsed.frames)
+                    options.onEvent(frame);
+            }
+        }
+        catch {
+            // An abort from close() is indistinguishable here from a network drop;
+            // the `closed` check below is what separates them.
+        }
+        if (closed || mine !== generation)
+            return;
+        // Reset the backoff only after a genuinely stable connection, so a link
+        // that flaps every two seconds keeps escalating instead of hammering.
+        schedule.onConnected(Date.now() - openedAt);
+        scheduleRetry();
+    };
+    void connect();
+    return {
+        status: () => status,
+        attempt: () => schedule.attempt(),
+        reconnect() {
+            if (closed)
+                return;
+            generation += 1;
+            if (retryTimer !== null)
+                clearTimeoutFn(retryTimer);
+            retryTimer = null;
+            controller?.abort();
+            controller = null;
+            // A credential change is not a failure, so it starts from a clean backoff:
+            // making a sign-in wait out the previous outage's delay is how a freshly
+            // authenticated tab sits there not updating for thirty seconds.
+            schedule.reset();
+            setStatus('connecting');
+            void connect();
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            if (retryTimer !== null)
+                clearTimeoutFn(retryTimer);
+            retryTimer = null;
+            controller?.abort();
+            setStatus('closed');
+        },
+    };
+}
+//# sourceMappingURL=ccEventSource.js.map

package/dist/client/stream/ccEventSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ccEventSource.js","sourceRoot":"","sources":["../../../src/client/stream/ccEventSource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,uBAAuB,EAA0B,MAAM,kCAAkC,CAAC;AA+DnG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAA6C,EAAE;IAC1F,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,IAAI,IAAI,GAAG,MAAM,CAAC;IAElB,SAAS,CAAC;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,CAAC,CAAC;YAAE,MAAM;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAEhC,IAAI,KAAK,GAAG,SAAS,CAAC;QACtB,IAAI,UAA8B,CAAC;QACnC,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACnC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1E,2EAA2E;YAC3E,wEAAwE;YACxE,+DAA+D;iBAC1D,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;gBAAE,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;iBAClG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAErC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,GAAY,OAAO,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,gEAAgE;QAClE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,OAA6B;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,uBAAuB,EAAE,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAuC,CAAC,CAAC,CAAC;IAErH,IAAI,MAAM,GAAmB,YAAY,CAAC;IAC1C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,UAAU,GAA2B,IAAI,CAAC;IAC9C,IAAI,UAAU,GAAY,IAAI,CAAC;IAC/B;;;;OAIG;IACH,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,MAAM,SAAS,GAAG,CAAC,IAAoB,EAAQ,EAAE;QAC/C,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,sDAAsD;IACtD,MAAM,YAAY,GAAG,GAAuB,EAAE;QAC5C,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACpF,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,GAAS,EAAE;QAC/B,IAAI,MAAM;YAAE,OAAO;QACnB,SAAS,CAAC,cAAc,CAAC,CAAC;QAC1B,UAAU,GAAG,YAAY,CAAC,GAAG,EAAE;YAC7B,UAAU,GAAG,IAAI,CAAC;YAClB,KAAK,OAAO,EAAE,CAAC;QACjB,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,IAAI,GAAG,UAAU,CAAC;QACxB,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1C,OAAO,EAAE;oBACP,MAAM,EAAE,mBAAmB;oBAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD;gBACD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,IAAI,KAAK,UAAU;oBAAE,aAAa,EAAE,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,SAAS,CAAC,MAAM,CAAC,CAAC;YAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,SAAS,CAAC;gBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBACtC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;gBACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,mDAAmD;QACrD,CAAC;QAED,IAAI,MAAM,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO;QAC1C,wEAAwE;QACxE,sEAAsE;QACtE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC5C,aAAa,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,KAAK,OAAO,EAAE,CAAC;IAEf,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QACpB,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE;QACjC,SAAS;YACP,IAAI,MAAM;gBAAE,OAAO;YACnB,UAAU,IAAI,CAAC,CAAC;YAChB,IAAI,UAAU,KAAK,IAAI;gBAAE,cAAc,CAAC,UAAU,CAAC,CAAC;YACpD,UAAU,GAAG,IAAI,CAAC;YAClB,UAAU,EAAE,KAAK,EAAE,CAAC;YACpB,UAAU,GAAG,IAAI,CAAC;YAClB,2EAA2E;YAC3E,yEAAyE;YACzE,gEAAgE;YAChE,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,SAAS,CAAC,YAAY,CAAC,CAAC;YACxB,KAAK,OAAO,EAAE,CAAC;QACjB,CAAC;QACD,KAAK;YACH,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,UAAU,KAAK,IAAI;gBAAE,cAAc,CAAC,UAAU,CAAC,CAAC;YACpD,UAAU,GAAG,IAAI,CAAC;YAClB,UAAU,EAAE,KAAK,EAAE,CAAC;YACpB,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/stream/index.d.ts

@@ -0,0 +1,4 @@
+export * from './appStream';
+export * from './ccEventSource';
+export * from './instanceStream';
+//# sourceMappingURL=index.d.ts.map

package/dist/client/stream/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/stream/index.ts"],"names":[],"mappings":"AAGA,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC"}

package/dist/client/stream/index.js

@@ -0,0 +1,7 @@
+// The client half of the server push tier (03 §3.2, §6.2, §6.5): the jittered
+// SSE client `EventSource` cannot be, and the per-instance lifecycle host that
+// feeds the dirty ledger from it.
+export * from './appStream';
+export * from './ccEventSource';
+export * from './instanceStream';
+//# sourceMappingURL=index.js.map

package/dist/client/stream/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/client/stream/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,+EAA+E;AAC/E,kCAAkC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC"}

package/dist/client/stream/instanceStream.d.ts

@@ -0,0 +1,127 @@
+/**
+ * The per-instance lifecycle host (03 §6.2) — where the server's push meets the
+ * client's dirty ledger.
+ *
+ * 🔴 **An app with more than one instance wants `createAppStreamHost`
+ * (`./appStream`), not N of these.** One SSE connection per instance exhausts
+ * the browser's six-concurrent-connections-per-origin budget at
+ * `instances × open tabs`, and because ordinary `fetch`es queue behind the
+ * long-lived streams, the symptom is a HANGING TAB rather than a failed
+ * connection (D28). This host remains correct and is the right shape for a
+ * single-instance surface — an embedded widget, a native shell, the V7 reconnect
+ * probe — and it shares its frame routing with the multiplexed host below so the
+ * two cannot drift.
+ *
+ * `createInstanceRuntime` already models the two-tier subscription law: an
+ * instance-level intake that writes only `{dirty, lastRev}` (never a payload
+ * copy — R-4), and pane-level listeners that tear down at pane unmount (J3-3).
+ * What was missing was the thing that DRIVES it: nothing ran the ordered
+ * lifecycle hooks, and nothing fed the ledger from the server, so a ledger could
+ * only ever reflect changes the same tab made.
+ *
+ * This binds the three together:
+ *
+ *   * ordered hooks — `onLoad` → `onReady` before any view renders, `onSuspend`
+ *     idempotent, `onUnmount` exactly once (V7.7 asserts all three);
+ *   * one live stream per instance, opened at `onReady` and closed at
+ *     `onUnmount`, reconnecting on the jittered schedule (03 §6.5);
+ *   * CDC frames marking channels dirty, so a pane that mounts later pulls the
+ *     change it slept through.
+ *
+ * A `lifecycle` frame carrying `VAULT_LOCKED` is re-broadcast on the
+ * `ContextSyncBroker` rather than handled locally: a lock concerns every tab,
+ * and one tab locking must lock them all (V7.9).
+ */
+import { type InstanceRuntime, type WireEnvelope, type WireHub } from '../../core/wire/wireHub';
+import type { ContextSyncBroker } from '../contextSyncBroker';
+import { type CcStreamEvent, type CcStreamStatus, type CcStreamToken, openCcEventSource } from './ccEventSource';
+/** The CDC payload the server publishes (mirror of `CdcPushPayload`). */
+export interface CdcFrame {
+    domain: string;
+    table: string;
+    op: 'insert' | 'update' | 'delete';
+    rowId: string;
+    rev: number;
+    at: string;
+}
+export interface InstanceStreamOptions {
+    runtime: InstanceRuntime;
+    hub: WireHub;
+    /** Usually `/api/instance/<id>/stream`. */
+    url: string;
+    /**
+     * The session this stream presents. Pass the session store's `token` GETTER in
+     * any app that can sign in: the stream opens at mount, the session arrives
+     * later, and the server decides which tenant's CDC records you may see once,
+     * at connect. A stream that opened anonymously receives NO tenant-scoped
+     * frames — which is every frame a real write produces (`bridgeCdcToPush`).
+     */
+    token?: CcStreamToken;
+    /**
+     * Maps a CDC record to the wire channels it invalidates. A host that knows
+     * its own table→port mapping supplies it; the default marks a channel named
+     * `cdc:<domain>.<table>`, which is enough for a pane that subscribes by table.
+     */
+    channelsForCdc?: (frame: CdcFrame) => readonly string[];
+    /** Re-broadcasts `VAULT_LOCKED` across tabs. */
+    sync?: ContextSyncBroker;
+    onStatus?(status: CcStreamStatus, attempt: number): void;
+    /** Job completion notifications, for a progress surface. */
+    onJob?(job: {
+        jobId: string;
+        ok: boolean;
+        error?: string;
+    }): void;
+    /** Seam for tests. */
+    openStream?: typeof openCcEventSource;
+}
+export interface InstanceStreamHost {
+    /** Run `onLoad` → `onReady` and open the stream. Idempotent. */
+    start(): Promise<void>;
+    /**
+     * Re-open the stream with the session as it is NOW — call it whenever the
+     * session changes (sign-in, refresh, sign-out). A no-op before `start()` and
+     * after `unmount()`.
+     */
+    reconnect(): void;
+    /** Leave the view: abort view-scoped work. Intake and ledger persist. */
+    suspend(): void;
+    /** Remove the instance: close the stream, unsubscribe intake, abort everything. */
+    unmount(): void;
+    status(): CcStreamStatus;
+    /** Pane mount: pull the retained envelope iff the ledger is ahead. */
+    pullIfDirty<T>(channel: string, renderedRev: number): WireEnvelope<T> | undefined;
+}
+/**
+ * The default CDC wire-channel name for a write to a domain table:
+ * `cdc:<domain>.<table>`. This is the ONE place the convention lives — the
+ * `engineResources` channel literals and their parity gate (06 §2) both resolve
+ * through it, so a rename here cannot drift a subscribing view's channel silently.
+ */
+export declare const cdcChannelName: (domain: string, table: string) => string;
+/** A job's terminal result, as the stream reports it. */
+export interface StreamJobResult {
+    jobId: string;
+    ok: boolean;
+    error?: string;
+}
+export declare const defaultCdcChannels: (frame: CdcFrame) => readonly string[];
+/** What a decoded frame is applied to. Shared by the single and multiplexed hosts. */
+export interface StreamFrameTarget {
+    hub: WireHub;
+    channelsForCdc: (frame: CdcFrame) => readonly string[];
+    onJob?(job: StreamJobResult): void;
+    sync?: ContextSyncBroker;
+}
+/**
+ * Apply ONE decoded frame to one target.
+ *
+ * Extracted so the per-instance host and the multiplexed app host (D28) cannot
+ * drift: a rule about what a `cdc` frame does to the hub, or what a
+ * `VAULT_LOCKED` lifecycle frame does to the tab broker, must have exactly one
+ * implementation or the two transports will eventually disagree about the same
+ * bytes.
+ */
+export declare const applyStreamFrame: (event: CcStreamEvent, target: StreamFrameTarget) => void;
+export declare function createInstanceStreamHost(options: InstanceStreamOptions): InstanceStreamHost;
+//# sourceMappingURL=instanceStream.d.ts.map

package/dist/client/stream/instanceStream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instanceStream.d.ts","sourceRoot":"","sources":["../../../src/client/stream/instanceStream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AAEzB,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,eAAe,CAAC;IACzB,GAAG,EAAE,OAAO,CAAC;IACb,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS,MAAM,EAAE,CAAC;IACxD,gDAAgD;IAChD,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,QAAQ,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACzD,4DAA4D;IAC5D,KAAK,CAAC,CAAC,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClE,sBAAsB;IACtB,UAAU,CAAC,EAAE,OAAO,iBAAiB,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB;;;;OAIG;IACH,SAAS,IAAI,IAAI,CAAC;IAClB,yEAAyE;IACzE,OAAO,IAAI,IAAI,CAAC;IAChB,mFAAmF;IACnF,OAAO,IAAI,IAAI,CAAC;IAChB,MAAM,IAAI,cAAc,CAAC;IACzB,sEAAsE;IACtE,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;CACnF;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,KAAG,MAAkC,CAAC;AAElG,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,kBAAkB,GAAI,OAAO,QAAQ,KAAG,SAAS,MAAM,EAAiD,CAAC;AAEtH,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,OAAO,CAAC;IACb,cAAc,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS,MAAM,EAAE,CAAC;IACvD,KAAK,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,aAAa,EAAE,QAAQ,iBAAiB,KAAG,IAyBlF,CAAC;AAEF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,GAAG,kBAAkB,CAmD3F"}