WebSocket client 0.1.0

The first public release of the HostLoom WebSocket client. @hostloom/websocket-client brings the gateway's JSON-v1 request and subscription protocol to browser applications as a dependency-free ESM package with TypeScript declarations. A connection becomes ready only after protocol negotiation and a valid welcome; requests carry their own stream identifiers, correlate responses, support cancellation, and report remote faults through typed errors. Subscriptions manage event credit, acknowledgements, and terminal cleanup, while separate subscriptions to the same topic and key keep independent lifetimes.

Automatic reconnect is opt-in. It uses jittered exponential backoff, can refresh browser credentials after a policy close, and resubscribes logical subscriptions on a replacement session. Pending requests fail on connection loss and are never replayed. Subscriptions are live: acknowledgements record progress in the current session and do not recover events missed during a disconnect. Applications that need to rebuild their view must use their snapshot or version contract.

This release publishes @hostloom/websocket-client for the first time. Its version and websocket-client-vX.Y.Z tags are independent of the HostLoom .NET packages. The browser client supports hostloom.json.v1; application payload bytes remain opaque, with helpers for applications that encode them as UTF-8 JSON.

Added

• Dependency-free ESM output and TypeScript declarations for the connection, request, subscription, and frame APIs.
• Strict JSON-v1 encoding and decoding, direction-aware frame validation, and conformance against the gateway's shared protocol fixtures. Stream, session, and event identifiers use 32 lowercase hexadecimal digits; dashed and uppercase spellings are rejected. newStreamId() allocates an identifier, streamIdFactory supplies a custom allocator, and HOSTLOOM_SESSION_STREAM names the all-zero identifier reserved for welcome.
• An injectable HostLoomConnection with validated negotiation, connection-state and server-frame observers, explicit close, and manual reconnect.
• Correlated requests with gateway timeout settings, AbortSignal cancellation, welcome-advertised concurrency limits, and typed remote faults.
• Credit-managed subscriptions with bounded event buffering before a listener attaches, automatic replenishment, acknowledgements, unsubscription, and terminal fault handling. Multiple subscriptions to the same topic and key remain independent.
• Opt-in reconnect with jittered exponential backoff, credential refresh, and logical subscription recovery without request or event replay.
• Application ping and pong frames for connection liveness and round-trip timing.

Fixed

• Credential refresh results from an ended reconnect cycle are ignored. A manual close made by a connected-state observer remains terminal instead of resubscribing on a closing socket.
• JSON-v1 integer bounds and Base64 syntax are checked before client frames are sent or server frames are delivered. Payload bytes do not have to contain JSON.
• Outgoing messages enforce the welcome-advertised UTF-8 size limit; an oversized message raises a typed error reporting the actual and allowed sizes.
• Acknowledgements during reconnect are safe no-ops, and other invalid subscription lifecycle operations report a typed subscription-state error. Unowned subscription frames trigger one cleanup unsubscribe; subscriptions created through the low-level API remain caller-owned.
• A connect() called during a caller-requested close waits for the close event and opens one replacement socket. Repeated calls share the pending promise, and protocol-failure closes remain terminal.