typeferry 0.6.0

package/dist/auth/types.d.ts

@@ -0,0 +1,197 @@
+/**
+ * Device information extracted from HTTP request headers.
+ * Used for session tracking and security monitoring.
+ */
+export interface DeviceInfo {
+    /** Client IP address (from x-forwarded-for or socket) */
+    ip?: string;
+    /** Raw user agent string */
+    userAgent?: string;
+    /** Parsed operating system name and version */
+    os?: string;
+    /** Parsed browser name and version */
+    browser?: string;
+    /** Device category */
+    deviceType?: 'mobile' | 'desktop' | 'tablet' | 'unknown';
+}
+/**
+ * Represents a user session with refresh token rotation support.
+ * Sessions belong to a token family for theft detection.
+ */
+export interface Session {
+    /** Unique session identifier */
+    id: string;
+    /** User who owns this session */
+    userId: string;
+    /** Token family for rotation tracking and theft detection */
+    familyId: string;
+    /** Current refresh token value */
+    token: string;
+    /** Unix timestamp (seconds) when session expires */
+    expiration: number;
+    /** Device that created this session */
+    deviceInfo?: DeviceInfo;
+    /** Whether this session has been revoked */
+    isRevoked?: boolean;
+    /** Token that replaced this one after rotation */
+    replacedBy?: string;
+    /** Unix timestamp (ms) when token was last used/rotated (for grace period) */
+    usedAt?: number;
+}
+/**
+ * JWT access token payload structure.
+ * @template TClaims - Additional custom claims to include
+ */
+export interface AccessTokenPayload<TClaims = Record<string, never>> {
+    /** User identifier */
+    userId: string;
+    /** Session identifier for token binding */
+    sessionId: string;
+    /** Issued-at time (Unix timestamp in seconds, server clock) */
+    iat: number;
+    /** Expiration time (Unix timestamp in seconds, server clock) */
+    exp: number;
+    /** Optional custom claims */
+    claims?: TClaims;
+}
+/**
+ * Token pair returned after authentication or refresh.
+ */
+export interface TokenPair {
+    /** Short-lived JWT access token */
+    accessToken: string;
+    /** Long-lived opaque refresh token */
+    refreshToken: string;
+    /** Access token expiration (Unix timestamp in seconds) */
+    exp: number;
+}
+/**
+ * Interface for session storage and management.
+ * Implement this for different storage backends (MongoDB, Redis, etc.)
+ */
+export interface SessionManager {
+    /**
+     * Create a new session for a user.
+     * @param userId - User identifier
+     * @param deviceInfo - Optional device information
+     * @returns Token pair for the new session
+     */
+    createSession(userId: string, deviceInfo?: DeviceInfo): Promise<TokenPair>;
+    /**
+     * Refresh an existing session, rotating the refresh token.
+     * @param refreshToken - Current refresh token
+     * @param deviceInfo - Optional updated device information
+     * @returns New token pair, or null if refresh token is invalid/expired
+     */
+    refreshSession(refreshToken: string, deviceInfo?: DeviceInfo): Promise<TokenPair | null>;
+    /**
+     * Revoke a specific session by ID.
+     * @param sessionId - Session to revoke
+     * @returns Whether the session was found and revoked
+     */
+    revokeSession(sessionId: string): Promise<boolean>;
+    /**
+     * Revoke all sessions in a token family (for theft detection).
+     * @param familyId - Token family to revoke
+     * @returns Number of sessions revoked
+     */
+    revokeFamily(familyId: string): Promise<number>;
+    /**
+     * Get all active sessions for a user.
+     * @param userId - User identifier
+     * @returns Array of active sessions
+     */
+    getUserSessions(userId: string): Promise<Session[]>;
+    /**
+     * Revoke all sessions for a user, optionally keeping one family.
+     * @param userId - User identifier
+     * @param exceptFamilyId - Optional family to preserve (current session)
+     * @returns Number of sessions revoked
+     */
+    revokeAllUserSessions(userId: string, exceptFamilyId?: string): Promise<number>;
+}
+/**
+ * Authentication provider interface.
+ * Implement this to support different authentication methods.
+ * @template TUser - User type returned in auth context
+ */
+export interface AuthProvider<TUser = unknown> {
+    /**
+     * Authenticate a token and return the auth context.
+     * @param token - Token to authenticate
+     * @returns Auth context if valid, null otherwise
+     */
+    authenticate(token: string): Promise<AuthContext<TUser> | null>;
+}
+/**
+ * Authentication context stored in cache and attached to client.
+ * @template TUser - User type
+ */
+export interface AuthContext<TUser = unknown> {
+    /** Full user object */
+    user: TUser;
+    /** User identifier (string representation) */
+    userId: string;
+    /** Session identifier (if using session-based auth) */
+    sessionId?: string;
+}
+/**
+ * Configuration for authentication module.
+ */
+export interface AuthConfig {
+    /** JWT signing secret */
+    secret: string;
+    /** JWT algorithm (default: 'HS256') */
+    algorithm?: 'HS256' | 'HS384' | 'HS512';
+    /** Access token expiry in minutes (default: 15) */
+    accessTokenExpiryMinutes?: number;
+    /** Refresh token expiry in days (default: 14) */
+    refreshTokenExpiryDays?: number;
+    /** Grace period for concurrent refresh requests in seconds (default: 15) */
+    rotationGracePeriodSeconds?: number;
+    /** Rate limiting for login endpoint */
+    loginRateLimit?: {
+        windowMs: number;
+        maxAttempts: number;
+    };
+    /** Rate limiting for refresh endpoint */
+    refreshRateLimit?: {
+        windowMs: number;
+        maxAttempts: number;
+    };
+}
+/**
+ * Cookie configuration options.
+ */
+export interface CookieOptions {
+    /** Cookie name */
+    name: string;
+    /** Cookie max age in days */
+    maxAgeDays: number;
+    /** Whether to set Secure flag (default: true in production) */
+    secure?: boolean;
+    /** SameSite attribute (default: 'Strict') */
+    sameSite?: 'Strict' | 'Lax' | 'None';
+    /** Cookie path (default: '/') */
+    path?: string;
+}
+/**
+ * Configuration for client-side token refresh.
+ */
+export interface TokenRefreshConfig {
+    /** Server method to call for refresh (default: 'auth.refresh') */
+    refreshMethod: string;
+    /** Seconds before expiry to trigger refresh (default: 60) */
+    refreshBeforeExpirySec: number;
+    /** BroadcastChannel name for cross-tab sync */
+    broadcastChannelName?: string;
+}
+/**
+ * Configuration for cross-tab token synchronization.
+ */
+export interface CrossTabSyncConfig {
+    /** BroadcastChannel name */
+    channelName: string;
+    /** Event to emit when token is received from another tab */
+    tokenRefreshedEvent?: string;
+}

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":""}

package/dist/client/call-method-proxy.d.ts

@@ -0,0 +1,2 @@
+import type { Client, ProxyMethodCall } from './client.js';
+export declare function callMethodProxy(client: Client, path?: string): ProxyMethodCall;

package/dist/client/call-method-proxy.js

@@ -0,0 +1,22 @@
+/**
+ * Properties that must return primitive-producing functions to prevent
+ * "Cannot convert object to primitive value" when the proxy is coerced
+ * (e.g. string concatenation, JSON.stringify, devtools inspection).
+ */
+const COERCION_PROPS = new Set(['toString', 'valueOf', 'toJSON']);
+export function callMethodProxy(client, path = '') {
+    return new Proxy(function () { }, {
+        get(_, prop) {
+            if (typeof prop === 'symbol')
+                return undefined;
+            if (COERCION_PROPS.has(prop))
+                return () => path;
+            const newPath = path ? `${path}.${prop}` : prop;
+            return callMethodProxy(client, newPath);
+        },
+        apply(_, __, args) {
+            return client.call(path, ...args);
+        },
+    });
+}
+//# sourceMappingURL=call-method-proxy.js.map

package/dist/client/call-method-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-method-proxy.js","sourceRoot":"","sources":["../../src/client/call-method-proxy.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAA;AAEjE,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAI,GAAG,EAAE;IACvD,OAAO,IAAI,KAAK,CAAC,cAAa,CAAoB,EAAE;QAClD,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YAC9C,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,EAAE,CAAC,IAAI,CAAA;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;YAC/C,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACzC,CAAC;QACD,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI;YACf,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAA;QACnC,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/client/client-channel.d.ts

@@ -0,0 +1,43 @@
+import EventEmitter2 from '../utils/event-emitter.js';
+import type { AnyFunction } from '../utils/index.js';
+import type { Client } from './client.js';
+export declare class ClientChannel extends EventEmitter2 {
+    client: Client;
+    name: string;
+    events: Set<string>;
+    _events?: Record<string, AnyFunction | AnyFunction[]>;
+    constructor(name: string);
+    setClient(client: Client): void;
+    private pendingSubscriptions;
+    private subscribeDebounceTimeout?;
+    /**
+     * Commits batched subscription requests via RPC.
+     * Emits `{}` (not null) on failure so downstream `result[event]`
+     * lookups don't crash with "Cannot read properties of null".
+     */
+    commitPendingSubscriptions(): Promise<void>;
+    subscribe(event: string | string[]): Promise<any>;
+    private pendingUnsubscriptions;
+    private unsubscribeDebounceTimeout?;
+    commitPendingUnsubscriptions(): Promise<void>;
+    unsubscribe(event: string | string[]): Promise<any>;
+    resubscribe(): Promise<any>;
+    /**
+     * Wait for an event to fire asynchronously.
+     *
+     * Returns true if no params are sent.
+     */
+    wait(event: string, callback?: (...data: any) => any): Promise<any | any[]>;
+    /**
+     * Returns true if the event was not fired within a given timeout.
+     */
+    timeout(event: string, timeoutMs?: number): Promise<unknown>;
+    iterator(event: string): {
+        [Symbol.asyncIterator](): any;
+        next(): Promise<unknown>;
+        return(): {
+            done: boolean;
+        };
+        throw(error: unknown): Promise<never>;
+    };
+}

package/dist/client/client-channel.js

@@ -0,0 +1,148 @@
+import { isEmpty } from '../utils/lodash.js';
+import EventEmitter2 from '../utils/event-emitter.js';
+import { TypeFerryEvents, createIterator, Methods } from '../utils/index.js';
+import { LogLevel } from './logger.js';
+export class ClientChannel extends EventEmitter2 {
+    client;
+    name;
+    events = new Set();
+    constructor(name) {
+        super({
+            maxListeners: 512,
+        });
+        if (typeof name !== 'string' || !name)
+            throw new Error('the channel name needs to be a string');
+        this.name = name;
+    }
+    setClient(client) {
+        this.client = client;
+    }
+    pendingSubscriptions = new Set();
+    subscribeDebounceTimeout;
+    /**
+     * Commits batched subscription requests via RPC.
+     * Emits `{}` (not null) on failure so downstream `result[event]`
+     * lookups don't crash with "Cannot read properties of null".
+     */
+    async commitPendingSubscriptions() {
+        const channel = this.name;
+        const allEvents = Array.from(this.pendingSubscriptions);
+        this.pendingSubscriptions.clear();
+        if (!isEmpty(allEvents)) {
+            let result = {};
+            try {
+                result =
+                    (await this.client.call(Methods.RPC_ON, {
+                        events: allEvents,
+                        channel,
+                    })) ?? {};
+            }
+            catch {
+                result = {};
+            }
+            this.emit(TypeFerryEvents.COMMIT_PENDING_SUBSCRIPTIONS, result);
+        }
+    }
+    async subscribe(event) {
+        const events = Array.isArray(event) ? event : [event];
+        if (isEmpty(events))
+            return {};
+        for (const event of events) {
+            this.events.add(event);
+            this.pendingSubscriptions.add(event);
+        }
+        if (this.subscribeDebounceTimeout) {
+            clearTimeout(this.subscribeDebounceTimeout);
+        }
+        this.subscribeDebounceTimeout = setTimeout(this.commitPendingSubscriptions.bind(this), 100);
+        try {
+            // Wait longer (15s) during reconnection when network may be slow
+            const [result] = await this.waitFor(TypeFerryEvents.COMMIT_PENDING_SUBSCRIPTIONS, 15000);
+            return result;
+        }
+        catch (error) {
+            this.client.logger.subscription(LogLevel.ERROR, 'Failed to commit subscriptions', { channel: this.name, events: Array.from(this.events) }, error);
+            return {};
+        }
+    }
+    pendingUnsubscriptions = new Set();
+    unsubscribeDebounceTimeout;
+    async commitPendingUnsubscriptions() {
+        const channel = this.name;
+        const allEvents = Array.from(this.pendingUnsubscriptions);
+        this.pendingUnsubscriptions.clear();
+        if (!isEmpty(allEvents)) {
+            let result = null;
+            try {
+                result = await this.client.call(Methods.RPC_OFF, {
+                    events: allEvents,
+                    channel,
+                });
+            }
+            catch {
+                result = {};
+            }
+            this.emit(TypeFerryEvents.COMMIT_PENDING_UNSUBSCRIPTIONS, result);
+        }
+    }
+    async unsubscribe(event) {
+        const events = Array.isArray(event) ? event : [event];
+        if (isEmpty(events))
+            return {};
+        for (const event of events) {
+            this.events.delete(event);
+            this.pendingUnsubscriptions.add(event);
+        }
+        if (this.unsubscribeDebounceTimeout) {
+            clearTimeout(this.unsubscribeDebounceTimeout);
+        }
+        this.unsubscribeDebounceTimeout = setTimeout(this.commitPendingUnsubscriptions.bind(this), 100);
+        try {
+            // Wait longer (15s) during reconnection when network may be slow
+            const [result] = await this.waitFor(TypeFerryEvents.COMMIT_PENDING_UNSUBSCRIPTIONS, 15000);
+            return result;
+        }
+        catch (error) {
+            this.client.logger.subscription(LogLevel.ERROR, 'Failed to commit unsubscriptions', { channel: this.name, events: Array.from(this.events) }, error);
+            return {};
+        }
+    }
+    async resubscribe() {
+        return this.subscribe(Array.from(this.events));
+    }
+    /**
+     * Wait for an event to fire asynchronously.
+     *
+     * Returns true if no params are sent.
+     */
+    wait(event, callback) {
+        return new Promise(resolve => {
+            this.once(event, function (data = true) {
+                if (callback) {
+                    resolve(callback(data));
+                }
+                else {
+                    resolve(data);
+                }
+            });
+        });
+    }
+    /**
+     * Returns true if the event was not fired within a given timeout.
+     */
+    timeout(event, timeoutMs = 1000) {
+        return new Promise(resolve => {
+            const timeout = setTimeout(() => resolve(true), timeoutMs);
+            this.wait(event).then(res => {
+                if (timeout) {
+                    clearTimeout(timeout);
+                }
+                resolve(false);
+            });
+        });
+    }
+    iterator(event) {
+        return createIterator(this, event);
+    }
+}
+//# sourceMappingURL=client-channel.js.map

package/dist/client/client-channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-channel.js","sourceRoot":"","sources":["../../src/client/client-channel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACzC,OAAO,aAAa,MAAM,wBAAwB,CAAA;AAGlD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAEnE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAEnC,MAAM,OAAO,aAAc,SAAQ,aAAa;IAC9C,MAAM,CAAQ;IACd,IAAI,CAAQ;IACZ,MAAM,GAAgB,IAAI,GAAG,EAAE,CAAA;IAK/B,YAAY,IAAY;QACtB,KAAK,CAAC;YACJ,YAAY,EAAE,GAAG;SAClB,CAAC,CAAA;QAEF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;YACnC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAE1D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IACO,oBAAoB,GAAgB,IAAI,GAAG,EAAE,CAAA;IAC7C,wBAAwB,CAAiB;IAEjD;;;;OAIG;IACH,KAAK,CAAC,0BAA0B;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAA;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QACvD,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAA;QAEjC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxB,IAAI,MAAM,GAA4B,EAAE,CAAA;YACxC,IAAI,CAAC;gBACH,MAAM;oBACJ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;wBACtC,MAAM,EAAE,SAAS;wBACjB,OAAO;qBACR,CAAC,CAAC,IAAI,EAAE,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,CAAA;YACb,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAwB;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAErD,IAAI,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAA;QAE9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACtC,CAAC;QAED,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAClC,YAAY,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAC7C,CAAC;QAED,IAAI,CAAC,wBAAwB,GAAG,UAAU,CACxC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAC1C,GAAG,CACJ,CAAA;QAED,IAAI,CAAC;YACH,iEAAiE;YACjE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,eAAe,CAAC,4BAA4B,EAC5C,KAAK,CACN,CAAA;YAED,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAC7B,QAAQ,CAAC,KAAK,EACd,gCAAgC,EAChC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EACvD,KAAc,CACf,CAAA;YACD,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAEO,sBAAsB,GAAgB,IAAI,GAAG,EAAE,CAAA;IAC/C,0BAA0B,CAAiB;IAEnD,KAAK,CAAC,4BAA4B;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAA;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;QACzD,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAA;QAEnC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxB,IAAI,MAAM,GAAG,IAAI,CAAA;YAEjB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;oBAC/C,MAAM,EAAE,SAAS;oBACjB,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,CAAA;YACb,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAA;QACnE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAwB;QACxC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAErD,IAAI,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAA;QAE9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACxC,CAAC;QAED,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACpC,YAAY,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,CAAC,0BAA0B,GAAG,UAAU,CAC1C,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5C,GAAG,CACJ,CAAA;QAED,IAAI,CAAC;YACH,iEAAiE;YACjE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,eAAe,CAAC,8BAA8B,EAC9C,KAAK,CACN,CAAA;YAED,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAC7B,QAAQ,CAAC,KAAK,EACd,kCAAkC,EAClC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EACvD,KAAc,CACf,CAAA;YACD,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IAChD,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,KAAa,EAAE,QAAgC;QAClD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;YAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,IAAI,GAAG,IAAI;gBACpC,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;gBACzB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,CAAA;gBACf,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,KAAa,EAAE,SAAS,GAAG,IAAI;QACrC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;YAC3B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAA;YAE1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAC1B,IAAI,OAAO,EAAE,CAAC;oBACZ,YAAY,CAAC,OAAO,CAAC,CAAA;gBACvB,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,OAAO,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACpC,CAAC;CACF"}

package/dist/client/client-http.d.ts

@@ -0,0 +1,27 @@
+import type { Client } from './client.js';
+type Resolve<T = unknown> = (value: T) => void;
+type Reject = (reason?: unknown) => void;
+/**
+ * Preserves an unsuccessful HTTP response status across the RPC boundary.
+ */
+export declare class ClientHttpResponseError extends Error {
+    readonly status: number;
+    /**
+     * Creates a transport error without discarding the response status.
+     */
+    constructor(status: number, statusText: string, responseBody: string);
+}
+/**
+ * Owns cookie-bearing HTTP RPC requests for one TypeFerry client.
+ */
+export declare class ClientHttp {
+    client: Client;
+    protocol: string;
+    host: string;
+    uri: string;
+    constructor(client: Client);
+    /** Strip sensitive keys (refresh tokens) from context before sending over the wire. */
+    private stripSensitiveKeys;
+    request(payload: Record<string, any>, resolve: Resolve, reject: Reject): Promise<void>;
+}
+export {};

package/dist/client/client-http.js

@@ -0,0 +1,106 @@
+import { EJSON } from '../ejson/index.js';
+import { CLIENT_ID_HEADER_KEY, ClientEvents, PayloadType, Presentation, TOKEN_HEADER_KEY, } from '../utils/index.js';
+import { LogLevel } from './logger.js';
+/**
+ * Preserves an unsuccessful HTTP response status across the RPC boundary.
+ */
+export class ClientHttpResponseError extends Error {
+    status;
+    /**
+     * Creates a transport error without discarding the response status.
+     */
+    constructor(status, statusText, responseBody) {
+        super(`${status} ${statusText}: ${JSON.stringify(responseBody)}`);
+        this.name = 'ClientHttpResponseError';
+        this.status = status;
+    }
+}
+/**
+ * Owns cookie-bearing HTTP RPC requests for one TypeFerry client.
+ */
+export class ClientHttp {
+    client;
+    protocol;
+    host;
+    uri;
+    constructor(client) {
+        this.client = client;
+        this.protocol = this.client.options.secure ? `https://` : `http://`;
+        /**
+         * HTTP port for cookie-bearing requests (login, refresh).
+         *
+         * When `httpPort` is explicitly present in options (even if undefined),
+         * use the page's own origin so cookies stay same-origin. In dev this
+             * routes through Vite's proxy which forwards to the TypeFerry server.
+         */
+        const hasHttpPort = 'httpPort' in this.client.options;
+        if (hasHttpPort && !this.client.options.httpPort) {
+            // Use page origin (same-origin cookies via Vite proxy in dev)
+            this.host =
+                typeof window !== 'undefined'
+                    ? window.location.origin
+                    : `${this.protocol}${this.client.options.host}`;
+        }
+        else {
+            const port = this.client.options.httpPort ?? this.client.options.port;
+            this.host = port
+                ? `${this.protocol}${this.client.options.host}:${port}`
+                : `${this.protocol}${this.client.options.host}`;
+        }
+        this.uri = `${this.host}/__h`;
+    }
+    /** Strip sensitive keys (refresh tokens) from context before sending over the wire. */
+    stripSensitiveKeys(context) {
+        const { refreshToken: _, ...safe } = context;
+        return safe;
+    }
+    async request(payload, resolve, reject) {
+        try {
+            // @ts-ignore
+            const data = await fetch(this.uri, {
+                method: 'POST',
+                headers: {
+                    [CLIENT_ID_HEADER_KEY]: this.client.uuid,
+                    Accept: 'text/plain, */*',
+                    'Content-Type': 'text/plain',
+                    ...(this.client.context.token
+                        ? { [TOKEN_HEADER_KEY]: this.client.context.token }
+                        : {}),
+                },
+                credentials: 'include',
+                body: EJSON.stringify({
+                    context: this.stripSensitiveKeys(this.client.context),
+                    payload,
+                }),
+            });
+            if (data.status !== 200) {
+                const errorText = await data.text();
+                const error = new ClientHttpResponseError(data.status, data.statusText, errorText);
+                this.client.logger.method(LogLevel.ERROR, 'HTTP request failed', {
+                    status: data.status,
+                    statusText: data.statusText,
+                    method: payload.method,
+                    uri: this.uri,
+                }, error);
+                return reject(error);
+            }
+            if (!resolve) {
+                return;
+            }
+            const response = await data.text();
+            const decoded = Presentation.decode(response);
+            this.client.emit(ClientEvents.INBOUND_MESSAGE, decoded);
+            if (decoded.type === PayloadType.ERROR)
+                return reject(decoded);
+            resolve(decoded.result);
+        }
+        catch (error) {
+            this.client.logger.method(LogLevel.ERROR, 'HTTP request error', {
+                method: payload.method,
+                uri: this.uri,
+            }, error);
+            return reject(error);
+        }
+    }
+}
+//# sourceMappingURL=client-http.js.map

package/dist/client/client-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-http.js","sourceRoot":"","sources":["../../src/client/client-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,gBAAgB,GACjB,MAAM,UAAU,CAAA;AAEjB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAKnC;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,MAAM,CAAQ;IAEvB;;OAEG;IACH,YAAY,MAAc,EAAE,UAAkB,EAAE,YAAoB;QAClE,KAAK,CAAC,GAAG,MAAM,IAAI,UAAU,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QACjE,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,UAAU;IACrB,MAAM,CAAQ;IACd,QAAQ,CAAQ;IAChB,IAAI,CAAQ;IACZ,GAAG,CAAQ;IAEX,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QAEnE;;;;;;WAMG;QACH,MAAM,WAAW,GAAG,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAA;QACrD,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjD,8DAA8D;YAC9D,IAAI,CAAC,IAAI;gBACP,OAAO,MAAM,KAAK,WAAW;oBAC3B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;oBACxB,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAA;YACrE,IAAI,CAAC,IAAI,GAAG,IAAI;gBACd,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE;gBACvD,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QACnD,CAAC;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAA;IAC/B,CAAC;IAED,uFAAuF;IAC/E,kBAAkB,CACxB,OAAgC;QAEhC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;QAC5C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAA4B,EAC5B,OAAgB,EAChB,MAAc;QAEd,IAAI,CAAC;YACH,aAAa;YACb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;oBACxC,MAAM,EAAE,iBAAiB;oBACzB,cAAc,EAAE,YAAY;oBAC5B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK;wBAC3B,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE;wBACnD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,WAAW,EAAE,SAAS;gBACtB,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC;oBACpB,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;oBACrD,OAAO;iBACR,CAAC;aACH,CAAC,CAAA;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBACnC,MAAM,KAAK,GAAG,IAAI,uBAAuB,CACvC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,UAAU,EACf,SAAS,CACV,CAAA;gBAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACvB,QAAQ,CAAC,KAAK,EACd,qBAAqB,EACrB;oBACE,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,EACD,KAAK,CACN,CAAA;gBAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAM;YACR,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAElC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAE7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;YAEvD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;YAE9D,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACvB,QAAQ,CAAC,KAAK,EACd,oBAAoB,EACpB;gBACE,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,EACD,KAAc,CACf,CAAA;YAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;CACF"}

package/dist/client/client-socket.d.ts

@@ -0,0 +1,85 @@
+import EventEmitter2 from '../utils/event-emitter.js';
+import type { Client, WebSocketOptions } from './client.js';
+/**
+ * Native WebSocket transport for the TypeFerry client.
+ *
+ * Replaces Socket.IO with the browser's built-in WebSocket API. RPC calls
+ * are correlated via UUID — the client generates an `id` per call and the
+ * server echoes it back in the response.
+ *
+ * Reconnection uses exponential backoff (500ms → 10s, 10 attempts, 0.5
+ * jitter) matching the previous Socket.IO configuration.
+ */
+export declare class ClientSocket extends EventEmitter2 {
+    client: Client;
+    socket: WebSocket | undefined;
+    protocol: string;
+    uri: string;
+    stopped: boolean;
+    connecting: boolean;
+    options: WebSocketOptions;
+    /** UUID-keyed map of in-flight RPC calls awaiting responses. */
+    private pending;
+    private reconnectAttempt;
+    private reconnectTimer;
+    /** Prevents infinite loop between scheduleReconnect and VisibilityManager. */
+    private exhaustedReconnect;
+    get ready(): boolean;
+    constructor(client: Client, options?: WebSocketOptions);
+    /**
+     * Opens a socket immediately and supersedes any scheduled backoff attempt.
+     */
+    connect(): void;
+    /**
+     * Builds the WebSocket URL with auth data as query parameters and opens
+     * a new connection. Query params mirror the old `socket.handshake.auth`.
+     */
+    private createSocket;
+    close(): Promise<void>;
+    /**
+     * Sends a fire-and-forget RPC message (void call).
+     * @param data - Object containing `method` and optional `params`
+     */
+    send(_event: string, data: {
+        method: string;
+        params?: unknown;
+    }): void;
+    /**
+     * Sends an RPC call and returns a promise that resolves when the server
+     * responds with a correlated `{ t: "rpc:res", id }` message.
+     *
+     * Uses UUID-based request correlation instead of Socket.IO acknowledgments.
+     */
+    emitWithAck<T>(_event: string, data: {
+        method: string;
+        params?: unknown;
+    }, timeout?: number): Promise<T>;
+    private handleMessage;
+    /**
+     * Resolves or rejects the pending RPC call matching the response `id`.
+     */
+    private handleRpcResponse;
+    /** Handles subscription events from the server. */
+    private handleTypedEvent;
+    /** Handles authentication result from the server. */
+    private handleTypedAuth;
+    private handleOpen;
+    private handleClose;
+    private handleSocketError;
+    /**
+     * Schedules a reconnection attempt with exponential backoff and jitter.
+     * After exhausting all attempts, delegates to VisibilityManager for a
+     * full reconnect (token refresh + new socket). Stops after one
+     * VisibilityManager cycle to prevent infinite loops when the server
+     * is unreachable.
+     */
+    private scheduleReconnect;
+    clearReconnectTimer(): void;
+    /** Rejects all in-flight RPC calls on unexpected disconnect. */
+    private rejectAllPending;
+    /**
+     * Clears all in-flight RPC calls without rejecting during intentional close.
+     * Prevents unhandled rejections when callers don't `.catch()` abandoned calls.
+     */
+    private clearAllPending;
+}