socketduct 0.1.18 → 0.1.19

package/src/reverse/gateway.js

@@ -279,16 +279,16 @@ export class OutboundReverseGateway extends EventEmitter {
             if (detail.gatewayId !== this.#options.gatewayId || detail.generation !== generation) throw fatalError("GATEWAY_REGISTRATION_FAILED")
             if (typeof detail.resumed !== "boolean") throw fatalError("GATEWAY_REGISTRATION_FAILED")
             registered = true
-            const reconnecting = this.#physicalConnects > 0
-            if (reconnecting && this.#streams.size > 0) {
-              if (!detail.resumed) {
-                for (const stream of [...this.#streams.values()]) this.#destroyStream(stream, "RESUME_SESSION_LOST")
-                this.#completePhysical(generation, timer)
-              } else {
-                clearTimeout(timer)
-                this.#resuming = true
-                await this.#sendResumeManifest(generation)
-              }
+            if (detail.resumed) {
+              // A replacement gateway intentionally owns no inherited target
+              // sockets. Its empty manifest makes the hub reset every omitted
+              // retained bridge instead of ever replaying an ambiguous OPEN.
+              clearTimeout(timer)
+              this.#resuming = true
+              await this.#sendResumeManifest(generation)
+            } else if (this.#streams.size > 0) {
+              for (const stream of [...this.#streams.values()]) this.#destroyStream(stream, "RESUME_SESSION_LOST")
+              this.#completePhysical(generation, timer)
             } else {
               this.#completePhysical(generation, timer)
             }

package/src/spool/spool-file.js

@@ -1,4 +1,4 @@
-import {readFileSync, readdirSync, rmSync, statSync} from "node:fs"
+import {readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync} from "node:fs"
 import {appendFile, mkdir, readFile, rename, rm, stat, writeFile} from "node:fs/promises"
 import {join, resolve} from "node:path"
 
@@ -33,6 +33,7 @@ import {join, resolve} from "node:path"
 
 const VALID_SESSION_ID = /^[a-zA-Z0-9_-]{8,}$/
 const MAX_RECOVERY_STATE_BYTES = 16 * 1024
+const MAX_SERIALIZED_CHUNK_OVERHEAD = 64
 
 export class SpoolQuotaError extends Error {
   /**
@@ -112,12 +113,7 @@ export class SessionSpool {
    */
   readRecoveryStateSync(sessionId, ownerId) {
     try {
-      const directory = this.#sessionDirectory(sessionId)
-      const metadataPath = join(directory, "metadata.json")
-      if (statSync(metadataPath).size > MAX_RECOVERY_STATE_BYTES) throw new Error("recovery ownership metadata is oversized")
-      const metadata = JSON.parse(readFileSync(metadataPath, "utf8"))
-      if (metadata?.sessionId !== sessionId || metadata?.ownerId !== ownerId) throw new Error("recovery ownership mismatch")
-      this.#assertMetadataAge(metadata, sessionId)
+      const directory = this.#readRecoveryOwnerSync(sessionId, ownerId)
       const path = join(directory, "recovery.json")
       if (statSync(path).size > MAX_RECOVERY_STATE_BYTES) throw new Error("recovery metadata is oversized")
       const state = JSON.parse(readFileSync(path, "utf8"))
@@ -129,6 +125,97 @@ export class SessionSpool {
     }
   }
 
+  /**
+   * Loads durable chunks synchronously so recovery can fail before network
+   * activity. Ownership, age, encoding, accounting, and configured byte bounds
+   * are all checked before any chunk is returned.
+   * @param {string} sessionId - Stable session identifier.
+   * @param {string} ownerId - Expected spool owner.
+   * @param {number} [acknowledgedSequence] - Omit chunks already covered by durable recovery state.
+   * @param {number} [committedSequence] - Highest chunk boundary committed by durable recovery state.
+   * @returns {SpoolChunk[]} Parsed durable chunks after the acknowledgement.
+   */
+  loadChunksSync(sessionId, ownerId, acknowledgedSequence = 0, committedSequence = undefined) {
+    try {
+      if (!Number.isSafeInteger(acknowledgedSequence) || acknowledgedSequence < 0) throw new Error("recovery acknowledgement is invalid")
+      if (committedSequence !== undefined && (!Number.isSafeInteger(committedSequence) || committedSequence < acknowledgedSequence)) throw new Error("recovery committed sequence is invalid")
+      const directory = this.#readRecoveryOwnerSync(sessionId, ownerId)
+      const chunksPath = join(directory, "chunks.jsonl")
+      if (this.#maxBytes !== undefined) {
+        const serializedLimit = Math.min(Number.MAX_SAFE_INTEGER, Math.max(MAX_RECOVERY_STATE_BYTES, (this.#maxBytes * MAX_SERIALIZED_CHUNK_OVERHEAD) + MAX_RECOVERY_STATE_BYTES))
+        if (statSync(chunksPath).size > serializedLimit) throw new Error("recovery chunk storage is oversized")
+      }
+      const raw = readFileSync(chunksPath, "utf8")
+      /** @type {SpoolChunk[]} */
+      const chunks = []
+      let totalBytes = 0
+      let previousSequence
+      if (raw !== "") {
+        const lines = raw.split("\n")
+        if (lines.at(-1) === "") lines.pop()
+        for (const [index, line] of lines.entries()) {
+          let serialized
+          try {
+            serialized = /** @type {Partial<SerializedChunk>} */ (JSON.parse(line))
+          } catch (error) {
+            const partialTail = index === lines.length - 1 && !raw.endsWith("\n") && committedSequence !== undefined && committedChunksAreCovered(chunks, acknowledgedSequence, committedSequence)
+            if (partialTail) break
+            throw error
+          }
+          if (!Number.isSafeInteger(serialized.sequence) || /** @type {number} */ (serialized.sequence) < 0 || typeof serialized.dataBase64 !== "string") throw new Error("recovery chunk is malformed")
+          const data = Buffer.from(serialized.dataBase64, "base64")
+          if (data.length === 0 || data.toString("base64") !== serialized.dataBase64) throw new Error("recovery chunk encoding is invalid")
+          if (data.length > /** @type {number} */ (serialized.sequence) || (previousSequence !== undefined && serialized.sequence !== previousSequence + data.length)) throw new Error("recovery chunks are not contiguous")
+          previousSequence = /** @type {number} */ (serialized.sequence)
+          totalBytes += data.length
+          if (!Number.isSafeInteger(totalBytes) || (this.#maxBytes !== undefined && totalBytes > this.#maxBytes)) throw new Error("recovery chunks exceed the configured byte limit")
+          chunks.push({sequence: /** @type {number} */ (serialized.sequence), data})
+        }
+      }
+      const usagePath = join(directory, "usage.json")
+      if (statSync(usagePath).size > MAX_RECOVERY_STATE_BYTES) throw new Error("recovery usage metadata is oversized")
+      const usage = JSON.parse(readFileSync(usagePath, "utf8"))
+      if (!Number.isSafeInteger(usage?.totalBytes) || usage.totalBytes < 0) throw new Error("recovery chunk accounting is malformed")
+      if (committedSequence === undefined) {
+        if (usage.totalBytes !== totalBytes) throw new Error("recovery chunk accounting mismatch")
+        this.#usedBytes.set(sessionId, totalBytes)
+        this.#usageLoaded.add(sessionId)
+        return chunks.filter((chunk) => chunk.sequence > acknowledgedSequence)
+      }
+      if (!committedChunksAreCovered(chunks, acknowledgedSequence, committedSequence)) throw new Error("recovery chunks do not cover the committed sequence")
+      const firstAfterAck = chunks.find((chunk) => chunk.sequence > acknowledgedSequence)
+      if (firstAfterAck !== undefined && firstAfterAck.sequence - firstAfterAck.data.length !== acknowledgedSequence) throw new Error("recovery chunks do not start at the acknowledgement")
+      if (firstAfterAck === undefined && chunks.length > 0 && chunks.at(-1)?.sequence !== acknowledgedSequence) throw new Error("recovery acknowledgement is not a chunk boundary")
+      const committed = chunks.filter((chunk) => chunk.sequence > acknowledgedSequence && chunk.sequence <= committedSequence)
+      const committedBytes = committed.reduce((sum, chunk) => sum + chunk.data.length, 0)
+      if (!Number.isSafeInteger(committedBytes) || (this.#maxBytes !== undefined && committedBytes > this.#maxBytes)) throw new Error("recovery chunks exceed the configured byte limit")
+      const repairedChunks = serializeChunks(committed)
+      if (raw !== repairedChunks) writeFileAtomicSync(chunksPath, repairedChunks, {mode: 0o600})
+      if (usage.totalBytes !== committedBytes) writeFileAtomicSync(usagePath, JSON.stringify({totalBytes: committedBytes}) + "\n", {mode: 0o600})
+      this.#usedBytes.set(sessionId, committedBytes)
+      this.#usageLoaded.add(sessionId)
+      return committed
+    } catch (error) {
+      if (error instanceof SpoolQuotaError) throw error
+      throw new Error(`Invalid Socketduct recovery chunks for ${sessionId}`, {cause: error})
+    }
+  }
+
+  /**
+   * @param {string} sessionId - Stable session identifier.
+   * @param {string} ownerId - Expected owner.
+   * @returns {string} Validated session directory.
+   */
+  #readRecoveryOwnerSync(sessionId, ownerId) {
+    const directory = this.#sessionDirectory(sessionId)
+    const metadataPath = join(directory, "metadata.json")
+    if (statSync(metadataPath).size > MAX_RECOVERY_STATE_BYTES) throw new Error("recovery ownership metadata is oversized")
+    const metadata = JSON.parse(readFileSync(metadataPath, "utf8"))
+    if (metadata?.sessionId !== sessionId || metadata?.ownerId !== ownerId) throw new Error("recovery ownership mismatch")
+    this.#assertMetadataAge(metadata, sessionId)
+    return directory
+  }
+
   /**
    * Removes only well-formed, expired session directories beneath the private spool root.
    * @returns {void}
@@ -436,6 +523,48 @@ async function writeFileAtomic(path, contents, options) {
   await rename(tempPath, path)
 }
 
+/**
+ * @param {string} path - Path to replace.
+ * @param {string} contents - Complete durable contents.
+ * @param {{mode: number}} options - File mode.
+ * @returns {void}
+ */
+function writeFileAtomicSync(path, contents, options) {
+  const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`
+  writeFileSync(tempPath, contents, {mode: options.mode})
+  renameSync(tempPath, path)
+}
+
+/**
+ * @param {readonly SpoolChunk[]} chunks - Ordered chunks.
+ * @returns {string} JSONL contents.
+ */
+function serializeChunks(chunks) {
+  const lines = chunks.map((chunk) => JSON.stringify(/** @type {SerializedChunk} */ ({
+    sequence: chunk.sequence,
+    dataBase64: chunk.data.toString("base64")
+  })))
+  return lines.length === 0 ? "" : `${lines.join("\n")}\n`
+}
+
+/**
+ * @param {readonly SpoolChunk[]} chunks - Structurally validated physical chunks.
+ * @param {number} acknowledgedSequence - Durable ACK boundary.
+ * @param {number} committedSequence - Durable append boundary.
+ * @returns {boolean} Whether the committed interval is complete and contiguous.
+ */
+function committedChunksAreCovered(chunks, acknowledgedSequence, committedSequence) {
+  if (committedSequence === acknowledgedSequence) return true
+  let sequence = acknowledgedSequence
+  for (const chunk of chunks) {
+    if (chunk.sequence <= acknowledgedSequence) continue
+    if (chunk.sequence > committedSequence) break
+    if (chunk.sequence - chunk.data.length !== sequence) return false
+    sequence = chunk.sequence
+  }
+  return sequence === committedSequence
+}
+
 /**
  * @param {string} directory - directory value.
  * @returns {Promise<void>} - Result value.

package/tensorbuzz.yml

@@ -1,9 +1,10 @@
+dependency_roots:
+  - path: .
 before_install:
   - curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
   - sudo apt-get install -y docker.io nodejs
 before_script:
   - node --version
-  - npm ci
 environment:
   DOCKER_HOST: "tcp://docker_server:2375"
 services:

package/test/e2e/reverse-client-recovery-process.test.js

@@ -0,0 +1,170 @@
+/* eslint-disable jsdoc/require-returns */
+import assert from "node:assert/strict"
+import {fork} from "node:child_process"
+import {once} from "node:events"
+import {mkdtemp, readFile, rm} from "node:fs/promises"
+import {createServer} from "node:net"
+import {tmpdir} from "node:os"
+import {join} from "node:path"
+import test from "node:test"
+
+import {StaticTokenStore} from "../../src/auth/static-token-store.js"
+import {OutboundReverseGateway, startReverseGatewayHub} from "../../src/reverse/index.js"
+import {generateTestCertificates} from "../helpers/tls-certificates.js"
+
+/** @typedef {{gatewayId: string, connectionId: string, hubPort: number, token: string, caFile: string, spoolDirectory: string, identifier: string, sessionName: string, targetPort: number, initialGeneration: number, phase: string}} RecoveryFixtureConfiguration */
+
+/** @param {import('node:net').Server} server - Server. */
+async function listen(server) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(undefined) })
+  })
+  const address = server.address()
+  assert(address !== null && typeof address !== "string")
+  return address.port
+}
+
+/**
+ * @param {() => boolean} predicate - Completion predicate.
+ * @param {string} label - Timeout label.
+ */
+async function waitUntil(predicate, label) {
+  const deadline = Date.now() + 8_000
+  while (!predicate()) {
+    if (Date.now() >= deadline) throw new Error(`Timed out: ${label}`)
+    await new Promise((resolve) => setTimeout(resolve, 10))
+  }
+}
+
+/** @param {RecoveryFixtureConfiguration} configuration - Child configuration. */
+function startClient(configuration) {
+  const child = fork("test/fixtures/reverse-client-recovery.mjs", [], {
+    cwd: process.cwd(),
+    env: {...process.env, SOCKETDUCT_RECOVERY_FIXTURE: JSON.stringify(configuration)},
+    stdio: ["ignore", "pipe", "pipe", "ipc"]
+  })
+  /** @type {Record<string, unknown>[]} */
+  const messages = []
+  let stderr = ""
+  child.on("message", (message) => messages.push(/** @type {Record<string, unknown>} */ (message)))
+  child.stderr?.on("data", (chunk) => { stderr += chunk.toString() })
+  return {child, messages, stderr: () => stderr}
+}
+
+/**
+ * @param {ReturnType<typeof startClient>} processState - Child and captured messages.
+ * @param {string} type - Expected message type.
+ */
+async function waitForMessage(processState, type) {
+  await waitUntil(() => processState.messages.some((message) => message.type === type) || processState.child.exitCode !== null, `child message ${type}`)
+  const message = processState.messages.find((candidate) => candidate.type === type)
+  if (message === undefined) throw new Error(`Child exited before ${type}: ${processState.stderr()}`)
+  return message
+}
+
+test("SIGKILLed reverse client process recovers its durable stream while hub gateway and target survive", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-client-process-recovery-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const spoolDirectory = join(root, "client-spool")
+  let targetAccepts = 0
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket
+  const targetSockets = new Set()
+  /** @type {Buffer[]} */
+  const targetReceived = []
+  const target = createServer((socket) => {
+    targetAccepts += 1
+    targetSocket = socket
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+    socket.on("data", (chunk) => targetReceived.push(Buffer.from(chunk)))
+  })
+  const targetPort = await listen(target)
+  t.after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
+
+  const hub = await startReverseGatewayHub({
+    tokens: new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-process-token"}]),
+    tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
+    authorizeGateway: () => true,
+    authorizeClientGateway: () => true,
+    authorizeOpen: () => true,
+    resumeWindowMs: 4_000
+  })
+  t.after(() => hub.close())
+  const gateway = new OutboundReverseGateway({
+    gatewayId: "o2",
+    connectionId: "process_recovery_gateway",
+    hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"},
+    tls: {caFile: certificates.caCertFile, servername: "localhost"},
+    spoolDirectory: join(root, "gateway-spool"),
+    authorizeTarget: () => true,
+    reconnectDelayMs: 10,
+    maxReconnectDelayMs: 20
+  })
+  t.after(() => gateway.close())
+  await gateway.start()
+
+  const configuration = {
+    gatewayId: "o2",
+    connectionId: "process_recovery_client",
+    hubPort: hub.port,
+    token: "client-process-token",
+    caFile: certificates.caCertFile,
+    spoolDirectory,
+    identifier: "process_recovery_stream",
+    sessionName: "durable-process-stream",
+    targetPort,
+    initialGeneration: 100
+  }
+  const original = startClient({...configuration, phase: "original"})
+  t.after(() => { if (original.child.exitCode === null) original.child.kill("SIGKILL") })
+  const connected = await waitForMessage(original, "connected")
+  original.child.send({type: "write", payload: Buffer.from("before-kill").toString("base64")})
+  await waitForMessage(original, "written")
+  await waitUntil(() => Buffer.concat(targetReceived).toString() === "before-kill", "original target request")
+  assert.equal(targetAccepts, 1)
+  assert(targetSocket !== undefined)
+
+  original.child.send({type: "hold-next-data"})
+  await waitForMessage(original, "data-hold-armed")
+  original.child.send({type: "write", payload: Buffer.from("during-kill").toString("base64")})
+  await waitForMessage(original, "data-held")
+  await waitUntil(() => original.messages.filter((message) => message.type === "written").length === 2, "durably spooled held request")
+  assert.equal(Buffer.concat(targetReceived).toString(), "before-kill")
+
+  const replayedTargetBytes = Buffer.from("accepted-but-not-durably-acked")
+  original.child.send({type: "observe-buffer", bytes: replayedTargetBytes.length})
+  targetSocket.write(replayedTargetBytes)
+  await waitForMessage(original, "buffered")
+  original.child.send({type: "report-acks"})
+  const acknowledgements = await waitForMessage(original, "acks")
+  assert.equal(acknowledgements.ackFrames, 0, "unread process-local bytes must not be durably acknowledged")
+  await waitUntil(() => gateway.status().spoolBytes === replayedTargetBytes.length, "gateway retains unacknowledged target bytes")
+  const originalExit = once(original.child, "exit")
+  original.child.kill("SIGKILL")
+  await originalExit
+
+  const replacement = startClient({...configuration, phase: "replacement"})
+  t.after(() => { if (replacement.child.exitCode === null) replacement.child.kill("SIGKILL") })
+  const recovered = await waitForMessage(replacement, "recovered")
+  const replay = await waitForMessage(replacement, "data")
+  assert.equal(Buffer.from(/** @type {string} */ (replay.payload), "base64").toString(), replayedTargetBytes.toString())
+  assert.equal(recovered.openFrames, 0)
+  assert(/** @type {number} */ (recovered.generation) > /** @type {number} */ (connected.generation))
+  assert.equal(targetAccepts, 1)
+  await waitUntil(() => Buffer.concat(targetReceived).toString() === "before-killduring-kill", "replay strictly above gateway high-water")
+
+  replacement.child.send({type: "write", payload: Buffer.from("after-kill").toString("base64")})
+  await waitForMessage(replacement, "written")
+  await waitUntil(() => Buffer.concat(targetReceived).toString() === "before-killduring-killafter-kill", "recovered target request")
+  assert.equal(targetAccepts, 1)
+  const persisted = await readFile(join(spoolDirectory, configuration.identifier, "recovery.json"), "utf8")
+  assert.doesNotMatch(persisted, /client-process-token|gateway-token/)
+
+  const replacementExit = once(replacement.child, "exit")
+  replacement.child.send({type: "close"})
+  await replacementExit
+  assert.equal(replacement.child.exitCode, 0, replacement.stderr())
+})

package/test/fixtures/reverse-client-recovery.mjs

@@ -0,0 +1,123 @@
+import {connect as connectTls} from "node:tls"
+
+import {V3FrameType} from "../../src/protocol/v3-frame.js"
+import {ReverseGatewayConnection} from "../../src/reverse/client.js"
+
+const configuration = JSON.parse(process.env.SOCKETDUCT_RECOVERY_FIXTURE ?? "null")
+if (configuration === null) throw new Error("Missing recovery fixture configuration")
+
+let openFrames = 0
+let ackFrames = 0
+let holdNextData = false
+const client = new ReverseGatewayConnection({
+  gatewayId: configuration.gatewayId,
+  connectionId: configuration.connectionId,
+  hub: {host: "127.0.0.1", port: configuration.hubPort, token: configuration.token},
+  tls: {caFile: configuration.caFile, servername: "localhost"},
+  spoolDirectory: configuration.spoolDirectory,
+  initialGeneration: configuration.phase === "replacement" ? 0 : configuration.initialGeneration,
+  reconnectDelayMs: 10,
+  maxReconnectDelayMs: 20,
+  createPhysicalSocket: (options) => {
+    const physical = connectTls({host: options.host, port: options.port, ...options.tls})
+    const write = physical.write.bind(physical)
+    physical.write = ((chunk, ...args) => {
+      if (Buffer.isBuffer(chunk) && chunk.length >= 6 && chunk[5] === V3FrameType.OPEN) openFrames += 1
+      if (Buffer.isBuffer(chunk) && chunk.length >= 6 && chunk[5] === V3FrameType.ACK) ackFrames += 1
+      if (holdNextData && Buffer.isBuffer(chunk) && chunk.length >= 6 && chunk[5] === V3FrameType.DATA) {
+        holdNextData = false
+        report("data-held")
+        return true
+      }
+      return Reflect.apply(write, physical, [chunk, ...args])
+    })
+    return physical
+  }
+})
+
+const streamOptions = {
+  recover: true,
+  identifier: configuration.identifier,
+  sessionName: configuration.sessionName,
+  host: "127.0.0.1",
+  port: configuration.targetPort
+}
+const socket = configuration.phase === "replacement"
+  ? client.registerRecoveredConnection(streamOptions)
+  : undefined
+
+/**
+ * @param {string} type - Parent message type.
+ * @param {Record<string, unknown>} [fields] - Message fields.
+ */
+function report(type, fields = {}) {
+  process.send?.({type, ...fields})
+}
+
+/** @param {import('../../src/client/virtual-socket.js').VirtualSocket} activeSocket - Stream under test. */
+function installSocketEvents(activeSocket) {
+  activeSocket.once("connect", () => report(configuration.phase === "replacement" ? "recovered" : "connected", {
+    generation: client.status().connectionGeneration,
+    openFrames
+  }))
+  activeSocket.on("error", (error) => report("stream-error", {code: error.code ?? "ERROR"}))
+}
+
+let activeSocket = socket
+if (activeSocket !== undefined) {
+  installSocketEvents(activeSocket)
+  activeSocket.on("data", (chunk) => report("data", {payload: Buffer.from(chunk).toString("base64")}))
+  await client.connect()
+} else {
+  await client.connect()
+  activeSocket = client.createConnection({
+    identifier: configuration.identifier,
+    sessionName: configuration.sessionName,
+    host: "127.0.0.1",
+    port: configuration.targetPort
+  })
+  installSocketEvents(activeSocket)
+}
+
+process.on("message", (message) => {
+  if (message?.type === "hold-next-data") {
+    holdNextData = true
+    report("data-hold-armed")
+    return
+  }
+  if (message?.type === "write") {
+    activeSocket.write(Buffer.from(message.payload, "base64"), (error) => report("written", {code: error?.code ?? null}))
+    return
+  }
+  if (message?.type === "observe-buffer") {
+    const timer = setInterval(() => {
+      if (activeSocket.readableLength < message.bytes) return
+      clearInterval(timer)
+      report("buffered", {bytes: activeSocket.readableLength})
+    }, 5)
+    timer.unref?.()
+    return
+  }
+  if (message?.type === "report-acks") {
+    setTimeout(() => report("acks", {ackFrames}), 50)
+    return
+  }
+  if (message?.type === "close") {
+    activeSocket.destroy()
+    void client.close().then(() => process.exit(0), (error) => {
+      report("close-error", {code: error?.code ?? "ERROR"})
+      process.exit(1)
+    })
+  }
+})
+
+process.on("uncaughtException", (error) => {
+  report("fatal", {message: error.message, code: error.code ?? "ERROR"})
+  process.exit(1)
+})
+
+process.on("unhandledRejection", (error) => {
+  const failure = error instanceof Error ? error : new Error(String(error))
+  report("fatal", {message: failure.message, code: failure.code ?? "ERROR"})
+  process.exit(1)
+})