Keeps one session's event stream open for the session's life and delivers every event to a sink.
The stream is a long-lived subscription that ends when the transport recycles its connection (token
refresh, network blip) — and delivery has no replay, so an event published during the gap is gone.
The hub therefore, on every re-subscribe: opens the new subscription FIRST (so nothing published
from now on is missed), THEN reads the verification status once, and if the person verified while the
hub was away, delivers the identity.verified event it missed (marked Recovered).
Reconnects are capped: a stream that keeps failing is given up on (once, loudly) rather than retried
forever; a stream that stayed up long enough counts as healthy and resets the cap.
Framework-agnostic and clock-driven by setTimeout, so tests drive it with fake timers.
Keeps one session's event stream open for the session's life and delivers every event to a sink.
The stream is a long-lived subscription that ends when the transport recycles its connection (token refresh, network blip) — and delivery has no replay, so an event published during the gap is gone. The hub therefore, on every re-subscribe: opens the new subscription FIRST (so nothing published from now on is missed), THEN reads the verification status once, and if the person verified while the hub was away, delivers the
identity.verifiedevent it missed (markedRecovered).Reconnects are capped: a stream that keeps failing is given up on (once, loudly) rather than retried forever; a stream that stayed up long enough counts as healthy and resets the cap.
Framework-agnostic and clock-driven by
setTimeout, so tests drive it with fake timers.