sporades 0.9.28 → 0.9.29

package/CHANGES.md

@@ -2,172 +2,25 @@
 
 ## Unreleased - 2026-09-23
 
-Changes since v0.9.26.
-
-### 🚀 Features
-
-- Verify prerender parity and track renderer dependencies in Dev (392b1bf2).
-- Expose deliberate prerender browser handover (daa88f83).
-- Complete ordered prerender placement and diagnostics (d5aa8bbe).
-- Emit one Vite prerender fragment (769f523d).
+Changes since v0.9.28.
 
 ### 🐛 Bug Fixes
 
-- Retain linked package resolution alternatives (68c63e53).
-- Bound dependency polling and observe path accessors (93bca941).
-- Observe custom require.resolve search paths (cdfaacff).
-- Observe package self-reference export targets (0b32dd2b).
-- Share substitution observation for package imports (9536e562).
-- Observe resolution changes inside selected packages (9325e4e6).
-- Observe alternatives to successful renderer imports (6030a36d).
-- Keep declarative shadow hosts within fragment ownership (a4684e8e).
-- Reject inert reserved boundaries in final HTML (7fd93332).
-- Observe nearer manifestless renderer packages (fdced03b).
-- Bound and normalize unknown marker diagnostics (f695fea2).
-- Bound module-scope Annex B wrapper aliases (fe313576).
-- Normalize CommonJS renderer default exports (20d92eb4).
-- Track renderer tsconfig mappings and config inputs (51c875ed).
-- Separate parameter and body environments (da3772a5).
-- Reject synthetic CommonJS wrapper arguments (adbc8ba3).
-- Verify final Vite fragment ownership (ce8a333e).
-- Reject dynamic CommonJS with scope (9183e3c2).
-- Verify dismissal restores the authored DOM (9edefe18).
-- Preserve source import.meta through aliases (ea6f8a2c).
-- Diagnose malformed named marker directives (30083989).
-- Reject shadowed direct-eval call syntax (341c4a49).
-- Preserve author ancestors and implicit wrapper ownership (bb4733a5).
-- Watch successful package-resolution manifests (c8c7070d).
-- Use browser HTML parsing and reject direct CJS eval (75b44468).
-- Watch package-import alias manifests and targets (0ceff350).
-- Observe runtime module resolution attempts (2dd1181c).
-- Reject fragment document-root mutations (525fcd9c).
-- Finalize HTML before output-derived Vite assets (4cb4703c).
-- Detect reserved comments through HTML parsing (b0a753de).
-- Retain all root CommonJS wrapper redeclarations (42f0a7a8).
-- Watch missing computed package export roots (b512d596).
-- Initialize CommonJS source module locations (6631c412).
-- Place fragments after Vite composes deferred tags (95a5fdff).
-- Track failed local imports without duplicate rebuilds (122c92d8).
-- Preserve failure envelopes and diagnose empty configurations (389159b1).
-- Preserve module.require and TypeScript CommonJS semantics (0483d227).
-- Retain worker until private completion is consumed (6db56268).
-- Recover failed renderer builds after package installation (2924c02c).
-- Reject fragment-created ancestors spanning boundary ends (c2678825).
-- Isolate bootstrap completion from renderer progress messages (3a21a2e4).
-- Redact computed runtime dependency diagnostics (9b5c776e).
-- Track attempted CommonJS renderer dependencies before evaluation (f647e116).
-- Reject parser-moved fragment content before publication (688e3ca4).
-- Preserve quoted doctype identifiers during placement (efd3b86f).
-- Reject untrackable runtime require of ESM render dependencies (d09a8737).
-- Preserve foreign-content CDATA during placement (0aa70731).
-- Validate source boundaries and dismiss parsed DOM ranges (054aebb3).
-- Retain CommonJS wrapper values through var declarations (d1154712).
-- Protect prerender boundaries and regenerate public API docs (635070d8).
-- Preserve writable require and bound dynamic imports (9fdf7bf8).
-- Isolate prerender execution and writable module locations (d7e83717).
-- Merge renderer diagnostic aliases (07b0d17f).
-- Apply file URL alias boundaries (5c030678).
-- Redact project-root file URL equality (0f6545e8).
-- Map raw file URL diagnostic aliases (5eb2954d).
-- Bound raw file URL redaction (413ec06d).
-- Bound prerender diagnostic aliases (d290f59d).
-- Redact unresolved external file URLs (6516e18a).
-- Redact unresolved external renderer imports (8891bc7a).
-- Preserve nested prerender diagnostic paths (5f5e3fff).
-- Redact hoisted renderer runtime paths (b520367e).
-- Load plain hoisted prerender modules (4d762255).
-- Reject early prerender worker exit (f5aec1a1).
-- Classify ambiguous renderer modules (a10445fd).
-- Classify package-scoped CommonJS renderers (9c3dff53).
-- Preserve renderer hashbang and directives (95b5807c).
-- Preserve renderer class member names (29810c22).
-- Preserve CommonJS wrapper delete semantics (14da5e3e).
-- Preserve CommonJS wrapper assignments (86d06b58).
-- Resolve renderer lexical bindings accurately (e249665d).
-- Preserve static CommonJS renderer imports (513995da).
-- Preserve nested CTS module locations (ebf0db8f).
-- Treat noscript as raw prerender text (e5ed75f4).
-- Preserve nested CommonJS module locations (5920306e).
-- Track HTML attribute value states (aac17b2e).
-- Return honest renderer transform loaders (dc0f509a).
-- Tokenize less-than text safely (96fc6a42).
-- Fail closed on incomplete prerender HTML (b87c34ad).
-- Discover renderer tsconfig per module (930f3f64).
-- Reject Windows renderer module roots (f5400ef0).
-- Bound malformed prerender HTML scanning (9b25a1c7).
-- Preserve renderer tsconfig authority (c6b965e0).
-- Redact encoded project file URLs (0a184995).
-- Preserve renderer import meta URLs (03df87e1).
-- Replace only HTML prerender markers (5020a1f3).
-- Bound hostile renderer message access (17fc79ed).
-- Preserve HTML offsets during case folding (a6a1bbe8).
-- Contain renderer-owned error details (89f91139).
-- Locate prerender fallback body safely (78bf529c).
-- Redact prerender runtime project paths (556df1d4).
-- Execute prerender bundles without ESM cache growth (62506646).
-
-### 🔧 Improvements
-
-- Expose internal renderer loader mapping (be8d5303).
-
-### 📝 Documentation
-
-- Link canonical module reference and assert parity (fce2ad85).
-- Verify package-import manifest retargeting (91bb7996).
-- Complete canonical client API requirements (8690e560).
-- Specify prerender in canonical configuration reference (0fee4c1e).
-- Expose multipart limits and runtime bounds (#98) (ad023b9e).
+- Evict only on an unanswered ping and document the heartbeat (66f964e0).
+- Ping idle WebSockets so proxy idle timeouts do not strand pages (7ee9c7f8).
+- Start no freshclam after retained-updater cleanup once shutdown began (0185fc01).
+- Close ClamAV refresh shutdown race and recover crashed clamd (6c23b686).
+- Start degraded on stale ClamAV signatures and allow 26h freshness (79dd3ece).
+- Own ClamAV signature refresh in the Capsule runtime (17193be4).
 
 ### 🧪 Tests
 
-- Cover Hosted and Container warning envelopes (0e4bd01a).
-- Merge file URL alias collisions (d1a26a5e).
-- Redact bare project-root file URLs (6283b5d9).
-- Redact project-root file URL equality (848d96c9).
-- Redact contained and mixed-case file URLs (c242cc3b).
-- Preserve sibling file URL prefixes (5495bdfa).
-- Bound prerender diagnostic root aliases (fbb5c3b1).
-- Redact unresolved external file URLs (004832b6).
-- Redact unresolved external renderer imports (b7c7dabb).
-- Preserve nested prerender diagnostic context (4b42f056).
-- Redact hoisted prerender runtime paths (11b1d918).
-- Cover prerender namespace and worker outcomes (2936ae6e).
-- Fail closed when prerender worker exits (08a703cc).
-- Detect ambiguous renderer module formats (af1963c3).
-- Preserve renderer hashbang and directives (2008d12c).
-- Preserve non-computed renderer member names (a11d2822).
-- Preserve CommonJS wrapper delete semantics (9ef87b2e).
-- Preserve CommonJS wrapper write targets (1de31e18).
-- Preserve renderer lexical shadowing (9452a5cb).
-- Preserve static renderer requires and cache bounds (f572e4ff).
-- Preserve nested CTS renderer paths (3bb7d4a8).
-- Ignore prerender markers inside noscript (f7172af4).
-- Preserve nested CommonJS renderer paths (d40f2302).
-- Specify renderer output loader mapping (cdcd65b2).
-- Tokenize prose and HTML declarations safely (0e71c4e6).
-- Prove extended TSX renderer config (a4da6b3f).
-- Preserve less-than text during marker scanning (3481ad1e).
-- Reject unterminated prerender HTML tags (fdcc0c5f).
-- Discover extended renderer tsconfig (21bc1984).
-- Reject Windows renderer module paths (0f4ea77f).
-- Bound malformed HTML comment recovery (644acc13).
-- Preserve renderer tsconfig semantics (4d1e98a9).
-- Redact encoded renderer file URLs (59c22625).
-- Preserve transitive renderer import meta URL (fad9ea03).
-- Ignore prerender marker text in raw HTML (4d2948d4).
-- Contain hostile renderer message access (d74c1372).
-- Cover Unicode-safe prerender body offsets (77d2d1c4).
-- Reject renderer-owned structured errors (589ab6e9).
-- Cover HTML-aware prerender fallback placement (93a48e19).
-- Cover prerender runtime path redaction (5e2dadb4).
-- Cover prerender execution edge cases (6667a916).
-- Specify one Vite prerender fragment (69ea0c58).
+- Buffer raw WebSocket frames across TCP chunks (e07288dd).
+- Describe the ClamAV freshness gate without a fixed age (b180ac1a).
 
 ### 📦 Packaging
 
-- Install local deps (fd0cf1d6).
-- Include regenerated prerender declaration map (a655d0fc).
-- Specialize package-scoped CommonJS helpers (de79f9ba).
+- Regenerate runtime artifacts for the WebSocket heartbeat (d0b1193b).
 
 ## v0.9.11 - 2026-09-02
 
@@ -269,3 +122,4 @@ generated artifacts, and documentation.
 
 
 
+

package/bin/sporades-host-helper.js

@@ -42692,6 +42692,10 @@ var bash52CommandVocabulary = Object.freeze([
   "}"
 ]);
 var bashCommandNames = new Set(bash52CommandVocabulary);
+var clamavSignatureMaxAgeMs = 26 * 60 * 60 * 1e3;
+var clamavRefreshIntervalMs = 60 * 60 * 1e3;
+var clamavRefreshRetryMs = 15 * 60 * 1e3;
+var clamavRefreshTimeoutMs = 5 * 60 * 1e3;
 
 // src/teams-runtime.ts
 var TEAM_JOIN_LINK_DEFAULT_TTL_SECONDS = 60 * 60 * 24;
@@ -42985,7 +42989,7 @@ var MutationExecutionStorage = process.getBuiltinModule("node:async_hooks").Asyn
 var mutationExecution = new MutationExecutionStorage();
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.28";
+var CLI_VERSION = "0.9.29";
 
 // src/cli/schedule-inspection-envelope.ts
 var SCHEDULE_DIAGNOSTIC_FIELDS = /* @__PURE__ */ new Set([

package/bin/sporades.js

@@ -106223,9 +106223,10 @@ async function contentPolicyOutcome(row, bytes) {
   if (bytes.subarray(0, 5).toString("ascii") === "%PDF-") return await validatePdfIngress(bytes) && /\.pdf$/.test(name2) && type === "application/pdf" ? "clean" : "rejected";
   return safeUntrustedText(bytes) && /\.txt$/.test(name2) && type === "text/plain" ? "clean" : "rejected";
 }
+var clamavSignatureMaxAgeMs = 26 * 60 * 60 * 1e3;
 function isCurrentClamavSignature(signature, now2 = Date.now()) {
   const builtAt = Date.parse(signature?.updatedAt);
-  return Boolean(signature) && typeof signature?.version === "string" && /^daily:\d{1,12}$/.test(signature.version) && Number.isFinite(builtAt) && builtAt <= now2 && now2 - builtAt <= 24 * 60 * 60 * 1e3;
+  return Boolean(signature) && typeof signature?.version === "string" && /^daily:\d{1,12}$/.test(signature.version) && Number.isFinite(builtAt) && builtAt <= now2 && now2 - builtAt <= clamavSignatureMaxAgeMs;
 }
 function collectBoundedToolOutput(child, timeoutMs, maximumBytes = 8192) {
   return new Promise((resolve) => {
@@ -106529,6 +106530,108 @@ async function stopOwnedClamavChildren(database) {
   });
   if (failures.length) throw new AggregateError(failures, "ClamAV child cleanup failed.");
 }
+var clamavBootRetryDelaysMs = [5e3, 15e3];
+var clamavRefreshIntervalMs = 60 * 60 * 1e3;
+var clamavRefreshRetryMs = 15 * 60 * 1e3;
+var clamavRefreshTimeoutMs = 5 * 60 * 1e3;
+function clamavSpawn(database, command, args) {
+  return database.__clamavTest?.spawn ? database.__clamavTest.spawn(command, args) : childProcess.spawn(command, args, { stdio: "ignore" });
+}
+function clamavSchedule(database, callback, delayMs) {
+  if (database.__clamavTest?.schedule) return database.__clamavTest.schedule(callback, delayMs);
+  const timer = setTimeout(callback, delayMs);
+  timer.unref?.();
+  return () => clearTimeout(timer);
+}
+async function runFreshclam(database, deadline) {
+  const retained = database.__clamavUpdateProcess;
+  if (retained) {
+    await terminateChild(retained, clamavTerminateTimeout(database), database);
+    unobserveClamavChild(database, retained);
+    if (database.__clamavUpdateProcess === retained) database.__clamavUpdateProcess = null;
+    if (database.__clamavRefreshStopped) return false;
+  }
+  if (clamavRemaining(database, deadline) <= 0) return false;
+  const update = clamavSpawn(database, "/usr/bin/freshclam", ["--config-file=/etc/clamav/freshclam.conf"]);
+  database.__clamavUpdateProcess = update;
+  const completed = await waitForChild(update, clamavRemaining(database, deadline));
+  if (!completed) await terminateChild(update, Math.min(clamavTerminateTimeout(database), clamavRemaining(database, deadline)), database);
+  if (database.__clamavUpdateProcess === update) database.__clamavUpdateProcess = null;
+  return completed;
+}
+function nextClamavRefreshDelay(database, signature, refreshed) {
+  if (!refreshed) return clamavRefreshRetryMs;
+  const expiresIn = Date.parse(signature?.updatedAt) + clamavSignatureMaxAgeMs - clamavNow(database);
+  return Math.max(1e3, Math.min(clamavRefreshIntervalMs, expiresIn + 1e3));
+}
+async function startClamd(database, deadline) {
+  if (clamavRemaining(database, deadline) <= 0) return false;
+  const daemon = clamavSpawn(database, "/usr/sbin/clamd", ["--foreground", "--config-file=/etc/clamav/clamd.conf"]);
+  database.__clamavProcess = daemon;
+  observeClamavChild(database, daemon);
+  if (await waitForClamavReadiness(database, daemon, deadline, "/tmp/sporades-clamd.sock")) {
+    database.clamavReady = true;
+    return true;
+  }
+  await stopOwnedClamavChildren(database);
+  return false;
+}
+async function refreshClamavSignatures(database) {
+  const deadline = clamavNow(database) + clamavRefreshTimeoutMs;
+  const refreshed = await runFreshclam(database, deadline);
+  if (database.__clamavRefreshStopped) return clamavRefreshRetryMs;
+  const signature = await verifiedClamavSignature(database, deadline);
+  if (database.__clamavRefreshStopped) return clamavRefreshRetryMs;
+  if (!isCurrentClamavSignature(signature, clamavNow(database))) {
+    database.clamavReady = false;
+    await emitClamavRefreshWarning(database, "CLAMAV_SIGNATURE_STALE_AFTER_REFRESH");
+    return clamavRefreshRetryMs;
+  }
+  const crashed = database.__clamavProcess;
+  if (crashed && clamavChildTerminated(crashed)) {
+    unobserveClamavChild(database, crashed);
+    database.__clamavProcess = null;
+    await emitClamavRefreshWarning(database, "CLAMAV_DAEMON_EXITED");
+    if (database.__clamavRefreshStopped) return clamavRefreshRetryMs;
+  }
+  if (!database.__clamavProcess) {
+    const started = await startClamd(database, clamavNow(database) + (database.__clamavTest?.startupTimeoutMs ?? 12e4));
+    if (database.__clamavRefreshStopped) return clamavRefreshRetryMs;
+    if (!started) {
+      await emitClamavRefreshWarning(database, "CLAMAV_DAEMON_START_FAILED");
+      return clamavRefreshRetryMs;
+    }
+    return nextClamavRefreshDelay(database, signature, refreshed);
+  }
+  if (await loadedClamavSignatureVersion(database) !== signature.version) await clamavSocketCommand(database, Buffer.from("zRELOAD\0"), 64);
+  if (!refreshed) await emitClamavRefreshWarning(database, "CLAMAV_SIGNATURE_REFRESH_FAILED");
+  return nextClamavRefreshDelay(database, signature, refreshed);
+}
+async function emitClamavRefreshWarning(database, code) {
+  try {
+    await database.log?.emit?.({ category: "platform", event: "file.inspection.signature-refresh-failed", level: "warn", message: "ClamAV signature refresh did not leave file inspection ready", data: { schema: "v1", outcome: "failed", code } });
+  } catch {
+  }
+}
+function scheduleClamavRefresh(database, delayMs) {
+  if (database.__clamavRefreshStopped) return;
+  database.__clamavRefreshCancel = clamavSchedule(database, () => {
+    database.__clamavRefreshCancel = null;
+    const pending = refreshClamavSignatures(database).catch(async () => {
+      await emitClamavRefreshWarning(database, "CLAMAV_SIGNATURE_REFRESH_FAILED");
+      return clamavRefreshRetryMs;
+    }).then((nextDelayMs) => {
+      if (database.__clamavRefreshPending === pending) database.__clamavRefreshPending = null;
+      scheduleClamavRefresh(database, nextDelayMs);
+    });
+    database.__clamavRefreshPending = pending;
+  }, delayMs);
+}
+function stopClamavRefresh(database) {
+  database.__clamavRefreshStopped = true;
+  database.__clamavRefreshCancel?.();
+  database.__clamavRefreshCancel = null;
+}
 async function initializeClamavRuntime(database) {
   const required = database.endpoints?.some((endpoint) => endpoint?.options?.body?.multipart?.inspection?.requiredInspectors?.includes("clamav"));
   database.clamavRequired = Boolean(required);
@@ -106540,43 +106643,46 @@ async function initializeClamavRuntime(database) {
     database.clamavReady = await waitForClamavReadiness(database, database.__clamavDevSidecar.process, deadline, database.__clamavDevSidecar.socketPath);
     return database.clamavReady;
   }
-  if (database.__clamavTest) {
+  if (database.__clamavTest && !database.__clamavTest.managed) {
     database.clamavReady = Boolean(await currentLoadedClamavSignature(database, deadline));
     return database.clamavReady;
   }
-  if (process.env.SPORADES_CLAMAV_MANAGED !== "1") return false;
-  try {
+  if (!database.__clamavTest && process.env.SPORADES_CLAMAV_MANAGED !== "1") return false;
+  if (!database.__clamavTest) try {
     fs.mkdirSync("/app/data/clamav", { recursive: true });
     fs.mkdirSync("/tmp/sporades-clamav", { recursive: true });
   } catch {
     return false;
   }
-  if (clamavRemaining(database, deadline) <= 0) return false;
-  const update = childProcess.spawn("/usr/bin/freshclam", ["--config-file=/etc/clamav/freshclam.conf"], { stdio: "ignore" });
-  database.__clamavUpdateProcess = update;
-  const updateCompleted = await waitForChild(update, clamavRemaining(database, deadline));
-  if (!updateCompleted) await terminateChild(update, Math.min(clamavTerminateTimeout(database), clamavRemaining(database, deadline)), database);
-  database.__clamavUpdateProcess = null;
-  const signature = await verifiedClamavSignature(database, deadline);
-  if (!isCurrentClamavSignature(signature, clamavNow(database))) return false;
-  if (clamavRemaining(database, deadline) <= 0) return false;
-  const daemon = childProcess.spawn("/usr/sbin/clamd", ["--foreground", "--config-file=/etc/clamav/clamd.conf"], { stdio: "ignore" });
-  database.__clamavProcess = daemon;
-  observeClamavChild(database, daemon);
-  if (await waitForClamavReadiness(database, daemon, deadline, "/tmp/sporades-clamd.sock")) {
-    database.clamavReady = true;
-    const updater = childProcess.spawn("/usr/bin/freshclam", ["--daemon", "--foreground=true", "--config-file=/etc/clamav/freshclam.conf"], { stdio: "ignore" });
-    database.__clamavUpdateProcess = updater;
-    observeClamavChild(database, updater);
-    return true;
+  database.__clamavRefreshStopped = false;
+  let refreshed = false;
+  let signature = null;
+  for (let attempt = 0; ; attempt += 1) {
+    refreshed = await runFreshclam(database, deadline);
+    signature = await verifiedClamavSignature(database, deadline);
+    if (isCurrentClamavSignature(signature, clamavNow(database))) break;
+    const delayMs = clamavBootRetryDelaysMs[attempt];
+    if (delayMs === void 0 || clamavRemaining(database, deadline) <= delayMs) {
+      database.clamavReady = false;
+      await emitClamavRefreshWarning(database, "CLAMAV_STARTUP_DEGRADED");
+      scheduleClamavRefresh(database, clamavRefreshRetryMs);
+      return true;
+    }
+    await clamavDelay(database, delayMs);
   }
-  await stopOwnedClamavChildren(database);
-  return false;
+  if (!await startClamd(database, deadline)) return false;
+  scheduleClamavRefresh(database, nextClamavRefreshDelay(database, signature, refreshed));
+  return true;
 }
 async function shutdownClamavRuntime(database) {
   database.clamavReady = false;
-  if (!database.__clamavDevSidecar?.externallyManaged) await stopOwnedClamavChildren(database);
-  else {
+  stopClamavRefresh(database);
+  if (!database.__clamavDevSidecar?.externallyManaged) {
+    await stopOwnedClamavChildren(database);
+    await database.__clamavRefreshPending;
+    if (database.__clamavProcess || database.__clamavUpdateProcess) await stopOwnedClamavChildren(database);
+    database.clamavReady = false;
+  } else {
     unobserveClamavChild(database, database.__clamavDevSidecar.process);
     database.__clamavProcess = null;
     database.__clamavUpdateProcess = null;
@@ -106584,7 +106690,7 @@ async function shutdownClamavRuntime(database) {
 }
 async function checkClamavRuntime(database) {
   if (!database.clamavRequired) return { ok: true };
-  const children = [database.__clamavDevSidecar?.process, database.__clamavProcess, database.__clamavUpdateProcess];
+  const children = [database.__clamavDevSidecar?.process, database.__clamavProcess];
   for (const child of children) observeClamavChild(database, child);
   if (children.some(clamavChildTerminated)) {
     database.clamavReady = false;
@@ -122065,7 +122171,9 @@ async function runClientAccessKeyOperation(database, auth, message, sessionToken
     };
   }
 }
-function createWebSocketHub(getDatabase, trustedRefresh = null) {
+var WEBSOCKET_HEARTBEAT_MS = 3e4;
+function createWebSocketHub(getDatabase, trustedRefresh = null, options = {}) {
+  const heartbeatMs = options.heartbeatMs ?? WEBSOCKET_HEARTBEAT_MS;
   const clients = /* @__PURE__ */ new Set();
   const journeys = /* @__PURE__ */ new Map();
   const connectionTokens = /* @__PURE__ */ new Map();
@@ -122134,15 +122242,33 @@ function createWebSocketHub(getDatabase, trustedRefresh = null) {
         connectedAt: now2,
         lastSeenAt: now2,
         journey: null,
-        journeySubscriptions: /* @__PURE__ */ new Set()
+        journeySubscriptions: /* @__PURE__ */ new Set(),
+        lastFrameAt: Date.now(),
+        pingSentAt: null,
+        heartbeat: null
       };
       clients.add(client);
+      const unanswered = () => client.pingSentAt !== null && client.lastFrameAt < client.pingSentAt;
+      client.heartbeat = setInterval(() => {
+        if (client.closing || socket.destroyed) return;
+        if (unanswered()) {
+          setImmediate(() => {
+            if (unanswered()) socket.destroy();
+          });
+          return;
+        }
+        client.pingSentAt = Date.now();
+        socket.write(Buffer.from([137, 0]));
+      }, heartbeatMs);
+      client.heartbeat.unref?.();
       socket.on("data", (chunk) => {
+        client.lastFrameAt = Date.now();
         client.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
         client.buffer = Buffer.concat([client.buffer, chunk]);
         drainWebSocketFrames(client, (message) => enqueueClientMessage(client, message));
       });
       const removeClient = () => {
+        clearInterval(client.heartbeat);
         clients.delete(client);
         trustedRefresh?.disconnected(client.id);
         client.subscriptions.clear();
@@ -123265,6 +123391,16 @@ function drainWebSocketFrames(client, onMessage) {
       closeWebSocketClient(client);
       return;
     }
+    if (opcode === 9) {
+      const pong = Buffer.alloc(payload.length);
+      for (let index = 0; index < payload.length; index += 1) {
+        pong[index] = mask ? payload[index] ^ mask[index % 4] : payload[index];
+      }
+      if (!client.closing && !client.socket.destroyed && pong.length < 126) {
+        client.socket.write(Buffer.concat([Buffer.from([138, pong.length]), pong]));
+      }
+      continue;
+    }
     if (opcode !== 1) {
       continue;
     }
@@ -123280,6 +123416,7 @@ function closeWebSocketClient(client) {
     return;
   }
   client.closing = true;
+  clearInterval(client.heartbeat);
   try {
     client.socket.write(Buffer.from([136, 0]), () => {
       client.socket.end();
@@ -131112,7 +131249,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.28";
+var CLI_VERSION = "0.9.29";
 
 // src/cli/sporades.ts
 var SUPPORTED_TEMPLATES = new Set(CLIENT_TEMPLATES);

package/dist/cli/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.9.28";
+export declare const CLI_VERSION = "0.9.29";
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli/cli-version.js

@@ -1,3 +1,3 @@
 // Generated by `npm run build` from package.json. Do not edit by hand.
-export const CLI_VERSION = "0.9.28";
+export const CLI_VERSION = "0.9.29";
 //# sourceMappingURL=cli-version.js.map

package/dist/file-ingress-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-ingress-runtime.d.ts","sourceRoot":"","sources":["../src/file-ingress-runtime.ts"],"names":[],"mappings":"AAWA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAWtC,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,WAAoN;AAgrBpR,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,UAAe,oBAoF/E;AAoCD,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,WAW5D;AAmCD,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,WAE/D;AACD,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,WAwB5D;AAMD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,WAmBxD;AAaD,eAAO,MAAM,uBAAuB,mBAElC,CAAC;AAgOH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,WAgDvD;AAmBD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI,EAAE,GAAG,SAAa,WAAgQ;AACvV,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,SAAO;QAA6B,OAAO;YAAU,MAAM;GAAy2B;AA4Hx/B,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,oBASnH;AAOD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,gBAkBjE;AACD,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,UAAU,iBAAuR;AACvV,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,UAAU;;GAA+jB;AAyE5nB,wBAAuB,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,UAAU,UAAO;;;kBAyCrO;AAED,sHAAsH;AACtH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,UAAU,EAAE,UAAU,UAAO;;;;;;;;;;;;;;;;;;;GA4FtM;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,UAAU,cAiBhE;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU;iBAU9G,UAAU,WAAW,UAAU;;;;;;;;;sBAyD1B,UAAU;;;;6BASH,MAAM,WAAW,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBzD;AAED,wGAAwG;AACxG,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,QAEpF;AAED,6FAA6F;AAC7F,wBAAsB,8BAA8B,CAAC,QAAQ,EAAE,UAAU,oBAQxE;AAED,4EAA4E;AAC5E,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAE,UAAe,iBAsChG;AAwCD,wGAAwG;AACxG,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAE,UAAe;;;;;;;;;;IAuB3F"}
+{"version":3,"file":"file-ingress-runtime.d.ts","sourceRoot":"","sources":["../src/file-ingress-runtime.ts"],"names":[],"mappings":"AAWA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAWtC,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,WAAoN;AAgrBpR,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,UAAe,oBAoF/E;AAoCD,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,WAW5D;AAmCD,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,WAE/D;AACD,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,WAwB5D;AAMD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,WAmBxD;AAaD,eAAO,MAAM,uBAAuB,mBAElC,CAAC;AAgOH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,WAgDvD;AAsBD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI,EAAE,GAAG,SAAa,WAAoQ;AAC3V,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,SAAO;QAA6B,OAAO;YAAU,MAAM;GAAy2B;AA4Hx/B,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,oBASnH;AA4DD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,gBAuBjE;AACD,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,UAAU,iBAAse;AACtiB,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,UAAU;;GAA+hB;AAyE5lB,wBAAuB,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,UAAU,UAAO;;;kBAyCrO;AAED,sHAAsH;AACtH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,UAAU,EAAE,UAAU,UAAO;;;;;;;;;;;;;;;;;;;GA4FtM;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,UAAU,cAiBhE;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU;iBAU9G,UAAU,WAAW,UAAU;;;;;;;;;sBAyD1B,UAAU;;;;6BASH,MAAM,WAAW,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBzD;AAED,wGAAwG;AACxG,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,QAEpF;AAED,6FAA6F;AAC7F,wBAAsB,8BAA8B,CAAC,QAAQ,EAAE,UAAU,oBAQxE;AAED,4EAA4E;AAC5E,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAE,UAAe,iBAsChG;AAwCD,wGAAwG;AACxG,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAE,UAAe;;;;;;;;;;IAuB3F"}