diff --git a/AGENTS.md b/AGENTS.md
index 00076ca1..1870f631 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -60,7 +60,7 @@ The invariant index — what must stay true. Full narrative and rationale live i
 11. **Hasura-style access control: fail-closed (security)** — `policy.IsAdmin` (role == `admin_role`, **exact case-sensitive**, default `"admin"`) is the single admin check, shared by `Evaluate`/`ResolveRole`/`Validate`/the `/v1/ops` gate/`RoleAllowed`. Empty/absent role matches nothing (no `"*"` wildcard); `Validate` rejects empty role keys; a `nil` policy (deleted) denies **everyone incl. admin** via a role — a total lockout for token-based callers, so bootstrap from the policy file, never an implicit admin grant (**exception:** the operator key's `auth.IsOperator` bit passes the `/v1/ops` gate even under a `nil` policy — a deliberate break-glass restore over HTTP, see #7). `default_role` is the one sanctioned roleless exception (`ResolveRole` maps empty → it pre-eval); `default_role == admin_role` is permitted but dev-only and loudly warned (`policy.DefaultRoleGrantsAdmin`). Preserve when touching `internal/policy` (policy twin of #13; see #159). Detail: architecture.md § `policy/`.
 12. **Structured queries: column authz fail-closed (security)** — `POST /v1/query?table={table}`: typed AST validated against schema, permission-enforced, timestamp-bucketed for cache, `DefaultMaxRows` (10,000) cap. Every column reference — projection, aggregation args, `filters`, `group_by`, `order_by`, `time_range` — is authorized inside `query.Build` (the single chokepoint that enumerates them all), so no clause can skip the role's `allow_columns`/`deny_columns` check (#223). A `select_all` read by a *column-restricted* role expands to its allowed columns via `policy.AllowedProjection`, never a bare `SELECT *`; *unrestricted*/admin roles keep `SELECT *` (`policy.RestrictsColumns` decides). Omitting `columns` selects nothing (`ErrEmptyProjection` → `200 []`); `["*"]` is the literal column `*` (schema-gated, not a wildcard); a table-granted role with no readable columns fails closed (`ErrNoReadableColumns` → `403`). Structured and live-stream (`stream.filterColumns`) reads share the one per-column decision `policy.IsColumnAllowed`, so column visibility can't drift. Row visibility has the same one-source guarantee (#319): `Evaluate` resolves a role's row-`filter` once (`resolvePredicates`), and both surfaces consume that single resolution — the query path renders it to SQL (`predicatesToSQL`), the stream evaluates it in memory per subscriber (`ResolvedPermissions.RowVisible`, whose type-aware comparison fails closed on anything it can't prove about the ingested payload — `policy.ColumnSpec`, with `DateTime`/`DateTime64` operands compared as instants through the ingest grammar (`discovery.Column.TimeParser`) and claim constants rendered canonically and digit-exact by the one shared rule `policy.CanonicalScalar` (#457 — which also refuses a float64 at/past 2^53 rather than match a neighboring ID, and whose ok=false — an absent claim, a structured value, no canonical form — makes the predicate match no rows on BOTH surfaces: `1 = 0` in SQL, every row withheld in memory); numeric comparison runs in the column's STORAGE domain (`policy.NumericSpec`, classified by `discovery.NumericStorageOf` — Float width rounding, Decimal scale truncation, integer exactness, both operands narrowed as ClickHouse narrows stored value and bound constant, out-of-range operands refused rather than modeled; the `tests/integration` differential oracle holds in-range verdicts equal to a live ClickHouse's and the never-admit-where-SQL-hides direction for the refused out-of-range ones); an event whose insert later fails into the DLQ is the one residual payload-vs-stored asymmetry, documented in the access-control enforcement caution) — so row visibility can't drift either. Preserve when touching `internal/query` or the structured-query handler. Detail: architecture.md § `query/`.
 13. **Named query pipes: fail-closed (security)** — pre-defined SQL templates (Tinybird-style) with param binding + caching; `GET/POST /v1/pipes/{name}` sit outside `RequireAdmin`, so per-pipe `allowed_roles` is the *only* execute-path gate, via `policy.RoleAllowed`: exact allowlist membership (no `"*"`), admin always passes, empty/absent role and empty-string entries authorize nobody, and no `allowed_roles` → admin-only. Preserve and exercise via `testutil.RunRoleMatrix` / `StandardRoleMatrix` (see #159). Detail: architecture.md § `pipes/`.
-14. **TypeScript SDK** — `@wavehouse/sdk`: zero-dep client, typed query builder, real-time SSE, live queries (incrementable/decomposable/poll aggregation), codegen CLI. The canonical client (see §SDK Sync).
+14. **TypeScript SDK** — `@wavehouse/sdk`: typed query builder, real-time SSE over `fetch`, live queries (incrementable/decomposable/poll aggregation), codegen CLI. Exactly one runtime dependency — `eventsource-parser` (SSE framing, itself dependency-free); adding a second needs the same scrutiny the first got. The canonical client (see §SDK Sync).
 15. **Observability invariants** — stdout always 100% (sampling is OTLP-push-only); WARN+ERROR always export at 100% (a non-configurable floor — don't expose it); gRPC OTel exporters dial lazily so an unreachable collector never blocks startup; the OTel Prometheus exporter uses a **private** `prometheus.Registry`. The OTLP endpoint/TLS/custom-CA/mTLS/headers are delegated to the OpenTelemetry SDK's standard `OTEL_EXPORTER_OTLP_*` env vars — `InitProvider` passes **no** endpoint/header options. Known gap, intentionally not patched in WaveHouse app code: the pinned gRPC logs exporter (`otlploggrpc` v0.19/v0.20) ignores the env TLS-cert vars, so a custom/private CA and mutual TLS apply to traces/metrics but **not** the logs signal (public-CA/system-roots TLS and plaintext still work for logs) — upstream bug open-telemetry/opentelemetry-go#6661. A malformed `OTEL_EXPORTER_OTLP_HEADERS` is logged and skipped by the SDK (fail-soft), not fatal. Preserve when touching the logger/sampler/provider. Detail: architecture.md § `observability/`.
 16. **Bearer-token-only CORS posture (security)** — Bearer JWT on every request, no cookies/sessions; `corsMiddleware` deliberately **never** emits `Access-Control-Allow-Credentials` (not needed, and `*` + credentials is a spec violation browsers reject). `cors_allowed_origins` controls who can *read* responses, not cookie scope; CSRF protection is structural. Don't reintroduce cookie auth or `Allow-Credentials` without a design discussion — answers GitHub #29/#30. Code: `internal/api/router.go`.
 17. **Non-fatal boot** — schema-discovery failure on boot is non-fatal: `cmd/wavehouse` records an `api.BootState`, binds `:8080`, serves 503 on `/livez`/`/readyz` with the diagnostic, and retries via `SchemaRegistry.RetryRefresh` (backoff 2s → 60s). Bounds supervisor restart loops.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b36478e2..52b186bd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,7 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- **HTTP customization for the SDK — `options.headers`, `options.fetchOptions`, and `options.fetch`** (`clients/ts/src/types.ts`, `clients/ts/src/client.ts`, `clients/ts/src/http.ts`, `clients/ts/src/index.ts`, `clients/ts/src/client.test.ts`, `docs/src/content/docs/sdk/index.mdx`): closes #269. `ClientOptions` exposed only `maxRetries`, so a WaveHouse behind a header-gated proxy (Cloudflare Access, an mTLS sidecar, an auth gateway) or a cookie-authenticated origin was unreachable from the SDK — a defense-in-depth gate forced consumers off the client entirely. Three knobs land together, shaped after the conventions in Supabase's, OpenAI's, and Anthropic's clients rather than invented here. **`headers`** adds static headers to every REST request; names match case-insensitively as HTTP requires, and they apply *underneath* the SDK's own — `auth` keeps `Authorization`, and a request's `Content-Type`/`Accept` can't be displaced by a global one, since a header joined rather than replaced is how you ship `Content-Type: application/json, image/png`. **`fetchOptions`** merges extra `RequestInit` fields (`credentials: "include"` for the cookie case, `mode`, `cache`, or a runtime extension like Next.js's `next: { tags }`); the fields the SDK controls — `method`, `headers`, `body`, `signal` — always win, so it cannot corrupt the request. **`fetch`** replaces the HTTP implementation outright. All three are REST-only: `.stream()` and `.liveQuery()`'s live connection go through `EventSource`, which accepts neither headers nor a `fetch`, so a header-gated deployment can query but not stream until #203 changes that transport — stated plainly in the docs rather than left implicit, since the equivalent gap in Supabase's realtime client was found the hard way by a user whose RLS policies silently stopped matching. `.liveQuery()`'s initial backfill is an ordinary REST call and *is* covered. Per-call overrides and dynamic header callbacks are deliberately deferred to #459; the per-call slot (`.fetch(opts)`) already exists, so adding them later is additive. The exported `FetchLike` matches the standard `fetch` signature, written out rather than as `typeof fetch` because that resolves differently depending on whether the consumer's TypeScript `lib` includes DOM — the same fragility behind Supabase's long tail of `node-fetch` resolution issues. `options.fetch` accepts any `fetch`-compatible function (exported as the `FetchLike` type) and is used for every request, retries included, so middleware sees each attempt. The motivating case is a runtime bug consumers can't fix themselves: undici 8.8.0–8.9.0 stalls a request before it goes out when a keep-alive socket is reused while the event loop is idle ([nodejs/undici#5600](https://github.com/nodejs/undici/issues/5600), fixed in 8.10.0), and Node 26 bundles 8.9.0 — so calls that should take milliseconds don't, with no recourse inside the SDK. Severity varies with the runtime and the idle gap: the upstream report measured ~450–465 ms, and our own runs against an instant-answering server have ranged from ~100 ms to tens of seconds. Upgrading undici is the real fix, and `options.fetch` is how you get it without waiting for a new runtime: install undici yourself and route through it, passing its dispatcher **explicitly**. That last part is load-bearing and not obvious — undici keeps its connection pool on a shared `globalThis` symbol claimed by whichever copy loads first (Node claims it for the bundled copy on the first built-in `fetch` call, not at startup), so calling an installed 8.10.0's `fetch` without a `dispatcher` resolves whatever is on that symbol and can still stall through the bundled 8.9.0's pool. Measured with both copies loaded, 1.5 s idle gaps against a 10 ms server: `21, 1514, 1495, 583 ms` with an implied dispatcher versus `17, 14, 12, 13 ms` with an explicit `new Agent()`. (Tuning `keepAliveTimeout` is *not* a workaround — measured, it changes nothing, because the retirement timer is starved by the same idle event loop; `new Agent({ pipelining: 0 })` does work for anyone pinned to an affected version, at a connection per request.) The same hook covers the ordinary reasons an SDK grows one: proxies, client certificates, tracing or circuit-breaker middleware, and mocking HTTP in a consumer's own tests without monkey-patching a global. `fetch` stays optional all the way through to the internal `HttpContext` rather than being defaulted at construction, so the default path still calls the global directly — that keeps it late-bound (replacing `globalThis.fetch` after a client exists still works, which is what `vi.stubGlobal` does) and avoids invoking a detached `fetch` reference, which is not universally safe; both properties are pinned by tests. Only the SSE transport is exempt: the live connection behind `.stream()`/`.liveQuery()` goes through `EventSource`, which this does not replace — but `.liveQuery()`'s initial backfill is an ordinary request and does go through the supplied function. Implementations shipping their own request/response declarations (undici, `node-fetch`) need casts on the URL argument, the init, and the return value, since those types are separate from the ones behind the global `fetch`; the narrow documented runtime contract is what makes them safe — a string URL and plain `RequestInit` in, and only `.ok`/`.headers` plus `.text()` on success and `.status`/`.statusText`/`.json()` on a non-`ok` response read back. Abort handling is part of that contract: `ABORTED` requires a `DOMException` named `AbortError` (platform `fetch` and undici), and any other rejection is retried as `NETWORK_ERROR`.
+- **HTTP customization for the SDK — `options.headers`, `options.fetchOptions`, and `options.fetch`** (`clients/ts/src/types.ts`, `clients/ts/src/client.ts`, `clients/ts/src/http.ts`, `clients/ts/src/index.ts`, `clients/ts/src/client.test.ts`, `docs/src/content/docs/sdk/index.mdx`): closes #269. `ClientOptions` exposed only `maxRetries`, so a WaveHouse behind a header-gated proxy (Cloudflare Access, an mTLS sidecar, an auth gateway) or a cookie-authenticated origin was unreachable from the SDK — a defense-in-depth gate forced consumers off the client entirely. Three knobs land together, shaped after the conventions in Supabase's, OpenAI's, and Anthropic's clients rather than invented here. **`headers`** adds static headers to every REST request; names match case-insensitively as HTTP requires, and they apply *underneath* the SDK's own — `auth` keeps `Authorization`, and a request's `Content-Type`/`Accept` can't be displaced by a global one, since a header joined rather than replaced is how you ship `Content-Type: application/json, image/png`. **`fetchOptions`** merges extra `RequestInit` fields (`credentials: "include"` for the cookie case, `mode`, `cache`, or a runtime extension like Next.js's `next: { tags }`); the fields the SDK controls — `method`, `headers`, `body`, `signal` — always win, so it cannot corrupt the request. **`fetch`** replaces the HTTP implementation outright. All three shipped REST-only, because `.stream()` went through `EventSource`, which accepts neither headers nor a `fetch`; **#203 closed that gap within this same unreleased cycle**, so as released they apply to streaming too — see the entry above for the streaming contract they carry. `.liveQuery()`'s initial backfill is an ordinary REST call and *is* covered. Per-call overrides and dynamic header callbacks are deliberately deferred to #459; the per-call slot (`.fetch(opts)`) already exists, so adding them later is additive. The exported `FetchLike` is written out rather than spelled `typeof fetch`, because that resolves differently depending on whether the consumer's TypeScript `lib` includes DOM — the same fragility behind Supabase's long tail of `node-fetch` resolution issues. (Its URL parameter narrows further in the BREAKING entry below, so it is deliberately *not* the standard signature.) `options.fetch` accepts any `fetch`-compatible function (exported as the `FetchLike` type) and is used for every request, retries included, so middleware sees each attempt. The motivating case is a runtime bug consumers can't fix themselves: undici 8.8.0–8.9.0 stalls a request before it goes out when a keep-alive socket is reused while the event loop is idle ([nodejs/undici#5600](https://github.com/nodejs/undici/issues/5600), fixed in 8.10.0), and Node 26 bundles 8.9.0 — so calls that should take milliseconds don't, with no recourse inside the SDK. Severity varies with the runtime and the idle gap: the upstream report measured ~450–465 ms, and our own runs against an instant-answering server have ranged from ~100 ms to tens of seconds. Upgrading undici is the real fix, and `options.fetch` is how you get it without waiting for a new runtime: install undici yourself and route through it, passing its dispatcher **explicitly**. That last part is load-bearing and not obvious — undici keeps its connection pool on a shared `globalThis` symbol claimed by whichever copy loads first (Node claims it for the bundled copy on the first built-in `fetch` call, not at startup), so calling an installed 8.10.0's `fetch` without a `dispatcher` resolves whatever is on that symbol and can still stall through the bundled 8.9.0's pool. Measured with both copies loaded, 1.5 s idle gaps against a 10 ms server: `21, 1514, 1495, 583 ms` with an implied dispatcher versus `17, 14, 12, 13 ms` with an explicit `new Agent()`. (Tuning `keepAliveTimeout` is *not* a workaround — measured, it changes nothing, because the retirement timer is starved by the same idle event loop; `new Agent({ pipelining: 0 })` does work for anyone pinned to an affected version, at a connection per request.) The same hook covers the ordinary reasons an SDK grows one: proxies, client certificates, tracing or circuit-breaker middleware, and mocking HTTP in a consumer's own tests without monkey-patching a global. `fetch` stays optional all the way through to the internal `HttpContext` rather than being defaulted at construction, so the default path still calls the global directly — that keeps it late-bound (replacing `globalThis.fetch` after a client exists still works, which is what `vi.stubGlobal` does) and avoids invoking a detached `fetch` reference, which is not universally safe; both properties are pinned by tests. Implementations shipping their own request/response declarations (undici, `node-fetch`) need casts on the init and the return value, since those types are separate from the ones behind the global `fetch`; the narrow documented runtime contract is what makes them safe — a string URL and plain `RequestInit` in, and only `.ok`/`.headers` plus `.text()` on success and `.status`/`.statusText`/`.json()` on a non-`ok` response read back. Abort handling is part of that contract: a rejection is reported as `ABORTED` whenever the `AbortSignal` you passed has been aborted, decided from the signal rather than the rejection's type, so `AbortSignal.timeout()` and `node-fetch` behave the same as the platform `fetch`.
 
 - **Non-JWT operator key for full-access admin + break-glass recovery** (`internal/auth/auth.go`, `internal/auth/context.go`, `internal/auth/auth_test.go`, `internal/api/router.go`, `internal/api/router_test.go`, `internal/config/config.go`, `internal/config/config_test.go`, `cmd/wavehouse/main.go`, `config.yaml`, `deployments/compose/standalone.yaml`, `tests/e2e/fixtures/config.yaml`, `docs/src/content/docs/configuration.mdx`, `docs/src/content/docs/access-control.mdx`, `docs/src/content/docs/api.md`, `docs/src/content/docs/deployment.md`, `docs/src/content/docs/development.md`, `docs/src/content/docs/architecture.md`, `docs/src/content/docs/reverse-proxy.mdx`, `AGENTS.md`, `SECURITY.md`): closes #240; partially advances the auth-hardening epic [#228](https://github.com/Wave-RF/WaveHouse/issues/228) and the management/data-plane split [#359](https://github.com/Wave-RF/WaveHouse/issues/359). Adds an optional `auth.operator_key` (`WH_AUTH_OPERATOR_KEY`): a request presenting it — via an `Authorization: Operator <key>` header (forwarded verbatim by proxies, no collision with Bearer JWTs) or the `X-Operator-Key` alias — is authorized as a full-access platform operator — the whole data plane *and* the `/v1/ops/*` management surface — without minting a JWT and independently of the token verifier, giving the person running the deployment a role-free credential for bootstrap and break-glass. The middleware checks it before the Bearer token with a constant-time comparison (`crypto/subtle`) and stamps two things into the request context: the live `admin_role` (so the policy evaluator's admin bypass grants unrestricted data-plane access while a policy exists) and a platform-operator bit that `RequireAdmin` honors **even when the policy is `nil`/deleted** — the one HTTP path that can restore a wiped policy, which previously required SSH access and a reboot. Empty (the default) disables it, so existing deployments are unchanged; treat it as an admin secret (load from a secret store, serve only over TLS). A successful operator authentication is audit-logged at `INFO`; a request presenting a *non-matching* operator key is logged at `WARN` and counted by a new `wavehouse_auth_operator_key_failures_total` counter (a probing/brute-force signal on the most privileged credential in the system) before falling through to the normal token/default path — the middleware still never rejects. The `Authorization` auth-scheme is matched case-insensitively (RFC 7235) via a shared `authScheme` helper, which also makes the existing `Bearer` JWT scheme case-insensitive (previously it required the canonical `Bearer` casing). Explicitly out of scope, tracked in #359: scoping the operator credential to the management surface only, and capability-scoped admin permissions.
 - **Missing-dedupe-id observability + optional strict mode** (`internal/api/ingest.go`, `internal/api/ingest_test.go`, `internal/config/config.go`, `cmd/wavehouse/main.go`, `config.yaml`, `deployments/compose/standalone.yaml`, `docs/src/content/docs/configuration.mdx`, `docs/src/content/docs/api.md`, `docs/src/content/docs/architecture.md`): closes #219. With dedupe enabled, a row missing the configured `id_field` can't be deduped — previously it was published with idempotency silently disabled and *no* log or metric, so a producer bug that dropped the id turned off the guarantee for those rows unnoticed. Now every such row is logged at `WARN` and counted by a new `wavehouse_ingest_dedupe_missing_id_total` counter (labeled by `table`), making the loss observable server-side. A new opt-in `dedupe.require_id` (`WH_DEDUPE_REQUIRE_ID`, default `false`) turns that signal into enforcement: a row missing the id is rejected (`400` for a single insert; a per-record failure in a batch) instead of published — a tripwire for producers that must guarantee the id (complements the client-side [#202](https://github.com/Wave-RF/WaveHouse/issues/202)). Default behavior is unchanged.
@@ -23,10 +23,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Site header override — a top-level "Docs" nav link, the search box kept expanded, and a splash-width header** (`docs/src/components/Header.astro` (new), `docs/src/components/Logo.astro` (new), `docs/src/components/WaveMark.astro` (deleted), `docs/src/components/SiteTitle.astro`, `docs/src/components/Footer.astro`, `docs/src/assets/branding/lockup-themed.svg` (new), `docs/src/config/sidebar.ts`, `docs/src/env.d.ts`, `docs/src/styles/global.css`, `docs/scripts/branding/generate.sh`, `docs/astro.config.mjs`): Starlight has no config hook for header links, so we override its `Header` component through the sanctioned `components` map. The custom header re-renders every built-in control (SiteTitle, Search, ThemeSelect, SocialIcons, LanguageSelect) through its `virtual:starlight/components/*` import — so their overrides and Pagefind search keep working untouched — and adds a `<nav>` with a single top-level **Docs** link (→ `/getting-started`), the way into the doc tree from the sidebar-less splash homepage. The link target lives in a new `headerNav` in `sidebar.ts`, colocated with the sidebar as one navigation source of truth, and the nav is hidden below the `md` (50rem) breakpoint where, on doc pages, the sidebar drawer already carries navigation (on the drawerless splash, the hero CTAs carry it) — the mobile bar keeps the full lockup + search button so it doesn't read as empty. Search keeps Starlight's expanded "Search … ⌘K" box on every page at ≥50rem (including the splash) so the keyboard shortcut stays discoverable, and the primary-nav "Docs" link is baseline-aligned to the WaveHouse wordmark. The logo is a reusable `Logo.astro` that inlines ONE themeable lockup SVG (`lockup-themed.svg`, derived from the brand kit by `generate.sh`): the mark takes `currentColor`/`--wh-accent` and the wordmark `--wh-ink`, so it themes light↔dark purely from CSS — no pre-baked image variants and no four-image download — rendering the full lockup at every width (the mark-only collapse below 30rem left the mobile header and footer looking bare; the lockup is ~8.3rem wide at header size, fitting even a 320px bar), with `SiteTitle.astro` reduced to a thin home-link wrapper and the footer brand block reusing the same `<Logo/>` (labelled via a `title` prop) so header and footer render one wordmark; the lockup now covers every logo use, so the standalone-mark `WaveMark.astro` component is deleted. The generated `lockup-themed.svg` ships without its former leading comment: XML forbids `--` inside comments (as in `--wh-ink`), so the comment made browsers/GitHub reject the standalone file (PR #368 review) — the generated/do-not-hand-edit note lives in `Logo.astro` instead. Because the wordmark is now real inline SVG, `Header.astro` aligns "Docs" to it with `align-items: baseline` plus one documented geometry ratio instead of a hand-tuned pixel nudge, so alignment can't drift when fonts or sizes change. On the splash homepage the header's inner content is held in a centered 68rem column (deliberately narrower than the hero's 80rem band — the inset look settled in review), while doc pages stay full-bleed; since the header is preserved across view-transitions, that width now tweens between the two states (a global `.wh-header` rule in `global.css`, since the selector needs `body:has(.wh-hero)` — outside any component's scope — and must stay applied to the persisted header to tween) rather than snapping. `env.d.ts` gains type declarations for the built-in component modules the override re-renders so `astro check` passes.
 
+### Fixed
+
+- **A cancelled REST request could throw instead of returning `ABORTED`** (`clients/ts/src/http.ts`, `clients/ts/src/http.test.ts`, `clients/ts/src/types.ts`, `docs/src/content/docs/sdk/index.mdx`): found by review while checking a sentence about `ABORTED` on #470. The retry backoff in the network-error path is the one `sleep` that runs *inside* `request()`'s catch block, so its rejection had no handler and escaped as a raw `DOMException` — the two sleeps in the `try` are caught and converted. Nothing wraps `request()`, so it surfaced to the caller as an unhandled rejection, breaking the SDK's "never throws" contract on the REST path and making the `AbortController` example in the SDK reference (a 5s timeout against an unreachable server) demonstrate a branch that could not be taken. Reachable with the default `maxRetries: 2` and any `AbortSignal`. Abort is now also classified from **the signal** rather than the rejection's type: keying off the error alone meant an implementation throwing something other than a `DOMException` named `AbortError` — `AbortSignal.timeout()` raises a `TimeoutError`, `node-fetch` its own class — was reported as `NETWORK_ERROR` at `maxRetries: 0` but `ABORTED` at `2`, since only the second had a backoff left for the sleep to notice the signal. Same abort, different code, depending on a retry setting. Both directions are pinned by tests.
+
 ### Changed
 
 - **BREAKING (API): every admin-gated endpoint now lives under one `/v1/ops/*` prefix** (`internal/api/router.go`, `internal/api/errors.go`, `clients/ts/src/{sql,policy,pipes,schema,dlq,table,cli/codegen}.ts`, docs throughout, plus tests in `internal/api`, `tests/integration`, `tests/e2e/sdk`, and the SDK): the admin surface was split across two shapes — the `/v1/admin/*` subtree (raw SQL, policy CRUD, pipes CRUD) plus three individually-gated top-level routes (`GET /v1/schema`, `POST /v1/schema/refresh`, `GET /v1/dlq/stats`) — so the path alone couldn't tell you what the `RequireAdmin` gate covered. All of them merge into a single `/v1/ops` subtree behind one tree-level gate: `/v1/admin/{query,policy,pipes…}` → `/v1/ops/{query,policy,pipes…}`, `/v1/schema[/refresh]` → `/v1/ops/schema[/refresh]`, `/v1/dlq/stats` → `/v1/ops/dlq/stats`. The gate itself is unchanged (`policy.AdminRole`, operator-key break-glass included). No aliases are kept for the old paths (pre-1.0; the SDK's path constants are updated in the same change, so its method surface — `wh.sql`, `wh.policy`, `wh.pipes`, `wh.schema`, `wh.dlq` — is unaffected). If you fenced `/v1/admin/` at your reverse proxy or ingress (deny rule, IP allowlist, internal-only listener), that rule silently stops matching after this rename — move it to `/v1/ops/` (see `docs/src/content/docs/reverse-proxy.mdx` §"Fencing the admin surface"). One observable log change: an authorization denial on the former top-level schema route now records the tree pattern `route:"/v1/ops/*"` (as `/v1/admin/*` denials always did) instead of the full route template — the `gate:"admin"` attribute already identifies the check. The docs pass riding along also closed accuracy gaps surfaced in review: `reverse-proxy.mdx`'s body-cap table is relabeled by body shape instead of a control/data-plane split that clashed with the ops naming, the `RequireAdmin` denial contract now reads 401-for-a-present-but-invalid-token vs 403-for-a-non-admin-role everywhere it's described (`api.md`, `architecture.md`, `sdk/queries.md`), and the `gh attestation verify` examples in `deployment.md` and `SECURITY.md` pin `--signer-workflow` to the workflow that publishes the artifact, since `--repo` alone accepts an attestation from any workflow in the repo.
 
+- **BREAKING (SDK): streaming moves from `EventSource` to `fetch`, so the JWT rides in a header instead of `?token=`** (`clients/ts/src/stream/sse.ts`, `clients/ts/src/stream/sse.test.ts`, `clients/ts/src/client.ts`, `clients/ts/src/http.ts`, `clients/ts/src/types.ts`, `clients/ts/package.json`, `tests/e2e/sdk/vitest.config.ts`, `tests/e2e/sdk/package.json`, `tests/e2e/sdk/polyfills.ts` (deleted), `tests/e2e/sdk/streaming.test.ts`, `clients/ts/src/stream/live-query.ts`, `clients/ts/src/stream/live-query.test.ts` (new), `clients/ts/src/client.test.ts`, `clients/ts/src/http.test.ts`, `pnpm-lock.yaml`, `internal/api/stream.go` (comment only), `docs/src/content/docs/sdk/index.mdx`, `docs/src/content/docs/sdk/streaming.md`, `docs/src/content/docs/sdk/reference.md`, `docs/src/content/docs/sdk/queries.md`, `docs/src/content/docs/api.md`, `docs/src/content/docs/reverse-proxy.mdx`, and the six places the zero-dependency claim was retired — `README.md`, `clients/ts/README.md`, `AGENTS.md` (invariant 14), `docs/src/content/docs/index.mdx`, `docs/src/content/docs/getting-started.md`, `docs/src/content/docs/why-wavehouse.md`): advances #203 — tasks 1 and 2 of 3; #468 tracks retiring `?token=` server-side, which closes it. `.stream()` and `.liveQuery()`'s live connection used the browser `EventSource` API, which cannot set request headers — so the JWT travelled as `?token=<jwt>` in the request URI, past every proxy, CDN, and load balancer in front of WaveHouse, each free to log it. The server has always preferred an `Authorization` header (`internal/auth/auth.go`) and its CORS preflight has allow-listed both `Authorization` and `Last-Event-ID` since #215, so nothing changes server-side: `?token=` remains accepted for clients that genuinely can't set headers. **Deprecating it is #203's third task and is deliberately not done here** — this PR does not close that issue. The server keeps accepting the parameter, and #468 tracks retiring it: a `wavehouse_auth_query_token_total` counter and `Deprecation`/`Sunset` headers first, so an operator can see whether anything still depends on it before the fallback is removed. The transport now issues an ordinary `fetch` and parses `text/event-stream` off the response body, which means it owns what `EventSource` used to provide — framing, reconnection, and `Last-Event-ID` resumption. Reconnect uses **jittered** exponential backoff capped at 30s, reset only once a connection has *held* for a few seconds — resetting on any connection that merely opened lets a server accepting and instantly closing (slow-consumer eviction, a half-broken upstream) pin the client at sub-second retries, measured at 8 attempts in 6s and ~4× more aggressive than the fixed ~3s delay `EventSource` used; the jitter is the deliberate difference from `http.ts`'s REST backoff, because every subscriber to a dropped stream re-dials at the same instant and a fixed schedule synchronizes the fleet into a thundering herd against a server that is already unwell. A `4xx` is terminal — repeating the request usually won't talk round whatever rejected it, the exception being a `429` or `408` from a fronting rate limiter, which is transient even though the stream still ends ([#469](https://github.com/Wave-RF/WaveHouse/issues/469)) — and errors now carry the real status and message, so a fronting gateway's `401` arrives as `HTTP_401` instead of what the old transport made of it: a status-free `closed` with no `error` callback at all. That visibility has a limit worth stating, because it is weakest in the deployment this feature is for: a browser stream going cross-origin sees the status only if the rejection itself passes CORS *and* the gateway answered whatever preflight the request triggers — `Authorization`, configured `headers`, or `Last-Event-ID` once the stream resumes, so an uncredentialed stream is not exempt — since a rejected preflight or a missing `Access-Control-Allow-Origin` is a bare network error either way — indistinguishable from a drop, and retried. WaveHouse itself raises only a `400`, and only on the stream route, for a missing or empty `table`; a `404` or `405` means the request never reached that route at all, most often a `baseURL` path prefix the proxy didn't strip. It does not reject a stream for authentication, which is consequence (1) below and the reason this PR does not close #239. Three consequences worth calling out. **(1) `auth` is now invoked per connection attempt** rather than once and baked into a URL: previously a stream that outlived its token reconnected forever with the expired one, and because `/v1/stream` never rejects a caller *for authentication* — it resolves them to `default_role` — the stream stayed open and silently served a reduced view instead of failing. That also makes this a prerequisite for #239 (enforcing token expiry on long-lived streams), which would turn the old behavior into a hard break. A token provider that *throws* is treated as transient and retried (`SSE_AUTH_ERROR`) rather than terminating an otherwise healthy stream — the tradeoff that per-attempt auth forces. **(2) The last non-empty event id is retained** for resumption: the hub emits a blank `id:` line for passthrough payloads (`internal/stream/hub.go`), and per the SSE spec an empty `id` field *clears* the last-event-id, so a spec-faithful client would silently discard its resumption point mid-stream and re-open from the beginning. **(3) The Node `EventSource` polyfill requirement is gone** — streaming uses the same `fetch`/`ReadableStream` globals as the rest of the SDK, so `globalThis.EventSource = …` is no longer needed, and the e2e suite's `polyfills.ts` and `eventsource` devDependency are deleted. Framing is parsed by `eventsource-parser` (`^3.1.0`; MIT, zero transitive dependencies, npm provenance-attested, and dual CJS/ESM so it composes with the SDK's `dist/index.cjs`). The range stops below 4.0.0, which is ESM-only and would break that CJS build; a caret rather than an exact pin because pinning in a *published* library duplicates the package in any consumer tree already resolving a 3.x and freezes them out of patch and security releases until we cut one, while our own lockfile still governs CI, the SDK's first runtime dependency, costing ~3.3 KB minified / ~1.4 KB gzipped in the CDN IIFE bundle (measured by bundling the parser alone; the SDK's own IIFE grew more than that, but the rest is the transport rewrite). Renting it rather than hand-rolling is a deliberate call: the correct parser is ~440 lines, and the parts that matter — reassembling a frame split across chunk boundaries without quadratic recopying, disambiguating a trailing `\r` at a chunk boundary between a bare-CR terminator and half a split `\r\n`, and capping buffered input against a malformed or hostile stream — are exactly what a naive implementation gets wrong, and are unavoidable even though we control the server, since HTTP/2 and intermediaries re-chunk freely. The buffer cap is set explicitly to 16 MiB (the parser defaults to unbounded). The transport also keeps ownership of two `RequestInit` fields that `fetchOptions` controls on the REST path, because on a stream they are correctness rather than preference, and constrains a third without owning it: `cache: "no-store"` **as an init field, never a `Cache-Control` header** (the header form isn't in the server's fixed `Access-Control-Allow-Headers`, so it would fail every cross-origin preflight); `redirect`, which is `"manual"` — refused, surfaced as a terminal `SSE_REDIRECT` — **only when the request carries a credential**, and `"follow"` otherwise. Platforms strip `Authorization` on a cross-origin redirect ([whatwg/fetch#1544](https://github.com/whatwg/fetch/pull/1544), the mitigation for the class of bug behind [CVE-2022-1650](https://github.com/advisories/GHSA-6h5x-7c5m-7cr7)) while forwarding other headers intact, so a credentialed hop either silently downgrades the stream to the default role — this endpoint answers an unauthenticated caller rather than rejecting them — or hands a configured proxy secret to whatever the redirect names. Refusing costs nothing there, because following would never have produced an *authenticated* stream anyway. Without either, redirects are followed normally, so CDN canonicalization, geo/LB indirection, and an http→https upgrade all work — note the test is that concrete pair rather than "is this authenticated", so cookies are not covered — a cookie is re-derived from the store at each hop rather than carried, so under the default `same-origin` credentials mode a redirect keeps the stream authenticated only while the hop stays inside both the request's *origin* and the cookie's `Path`, and a hop outside either (a subdomain redirect, an http→https upgrade, a same-origin rewrite off the cookie's `Path`) leaves it silently unauthenticated; with `credentials: "include"` the origin half is replaced rather than lifted — ordinary cookie scoping decides, so a cookie crosses a CORS-allowed cross-origin hop only if its own `Domain` covers the target, and a host-only cookie (the default) does not ([#478](https://github.com/Wave-RF/WaveHouse/issues/478)); `options.fetch` can override `redirect` for anyone who needs the credentialed case followed regardless. `manual` rather than `error` so the outcome stays inspectable: `error` rejects with a bare `TypeError` indistinguishable from a connection failure, which the reconnect loop would retry forever against a redirect that is never going to stop happening. A `200` whose `Content-Type` is not `text/event-stream` is likewise refused (`SSE_BAD_CONTENT_TYPE`), matching what `EventSource` did: an auth gateway answering with its login page would otherwise leave the parser chewing HTML and the stream permanently "live" and silent, indistinguishable from a quiet table; and `credentials`, honored in browsers and dropped elsewhere because some runtimes (Cloudflare Workers) throw if it is set at all. **A subscriber callback that throws is isolated and logged rather than ending the stream** — but the exception is not routed to your `error` callback, so a handler that swallows its own failures fails silently. Four paths sit outside that guard, all tracked in [#473](https://github.com/Wave-RF/WaveHouse/issues/473). **(a)** The first synchronous `status` call — the one `.subscribe()` makes, and the one `liveQuery()` makes internally on your behalf — is unguarded, so the throw propagates back out of the call you made: out of `.subscribe()` with the subscriber already registered and no unsubscribe function returned, and out of `liveQuery()` with no handle returned at all, no backfill started, and the stream it had just opened left running, with nothing referencing it — and because the backfill never ran, the buffering phase never ends either, so `next()` is never called at all and every event accumulates in an unreachable buffer, with `opts.signal` the only way to stop it. **(b)** Delivery to *other* consumers stops at the one that threw; for a concurrent `for await` the event is dropped rather than queued, since the fan-out runs before the event reaches a waiter or the buffer, and a throw on the terminal `closed` status additionally leaves the iterator un-terminated, so it waits forever until something calls `.close()`. **(c)** A throwing `status` handler subscribed ahead of `.connected()` makes that promise time out against a stream that is already `live`. **(d)** A throw from `initial()` or from `next()` during `liveQuery()`'s backfill flush is absorbed by the backfill's own error path, which discards the buffered events — all of them for an `initial()` throw, which happens before the flush starts, and the remainder for a `next()` throw mid-flush. A backfill that returns an error `Result` drops them too. **Migration:** none for SDK consumers on the default transport — `.stream()` and `.liveQuery()` are unchanged. Remove any `globalThis.EventSource` polyfill and the `eventsource` dependency. Deployments whose proxy strips `Authorization` on `/v1/stream`, or redirects that path, must fix the proxy; both previously "worked" by accident.
+
+- **BREAKING (SDK): `options.fetch`, `options.headers`, and `options.fetchOptions` now reach the streaming transport, and `FetchLike` narrows its URL parameter** (`clients/ts/src/types.ts`, `clients/ts/src/http.ts`, `clients/ts/src/stream/sse.ts`, `docs/src/content/docs/sdk/index.mdx`): the carve-out documented in #456 is closed — all three knobs apply to `.stream()` and `.liveQuery()`, not just REST, which is what makes a header-gated origin streamable and completes #269's story to the extent CORS allows (WaveHouse's own preflight advertises a fixed header set, so custom headers reach it cross-origin only behind a proxy that terminates the preflight; server-side callers never preflight). `mergeHeaders` is shared between the two paths rather than duplicated, so header precedence has one definition: the SDK's own headers outrank configured ones, and `auth` keeps `Authorization`. Two breaking details. **`FetchLike`'s first parameter narrows from `string | URL | Request` to `string`.** Because function parameters are contravariant, narrowing it *widens* the set of assignable implementations — the global `fetch` still fits, and so now does hand-written `(url: string, init?: RequestInit) => Promise<Response>` middleware, which the wider spelling rejected at compile time. That was the stated intent when the type shipped; the published signature didn't match it. Only code that *imported* `FetchLike` and called through it with a `URL` or `Request` breaks. **And the runtime contract widens:** streaming reads the response as it arrives via `.body.getReader()`, where REST only ever calls `.text()`. An `options.fetch` that buffers the response — or clones it to log the body, the most common wrapper anyone writes — satisfies every REST call and then hangs forever on a stream that never ends. This cannot be expressed in the type, since `Response.body` is legitimately nullable. A response *returned* with an absent or already-consumed body fails fast with `SSE_NO_STREAM_BODY`; a wrapper that `await`s the body before returning hangs inside the caller's own function, where the SDK never regains control to report anything — so the guard narrows the trap rather than closing it, and the contract is documented on `FetchLike`. Tightened hours after `options.fetch` merged and before it has appeared in any release, precisely because nobody has yet written a non-streaming implementation against the narrower promise.
+
 - **BREAKING (SDK): `PipeRef.fetch` no longer accepts a `limit` it silently ignored** (`clients/ts/src/pipes.ts`, `clients/ts/src/client.test.ts`, `docs/src/content/docs/sdk/pipes.md`, `docs/src/content/docs/sdk/reference.md`): closes #464, raised by CodeRabbit on #456. It took the same per-call options type as the query builder — which carries `limit` — but forwarded only `signal`, so `wh.pipe('top_pages').fetch({ limit: 10 })` type-checked, ran, and quietly returned whatever the pipe's SQL returned. `QueryBuilder.fetch` and `TableRef.fetch` both honour `limit`, so the inconsistency sat inside one shared type. There is nothing to forward: the endpoint binds the request body as the pipe's *parameters* (`internal/api/pipes.go` → `pipes.BindParams`), and a key the SQL doesn't declare is ignored, so a client-side row cap is not something the pipes surface offers. The parameter is now a dedicated `PipeRequestOptions` (exported) declaring `signal?: AbortSignal` and `limit?: never`, making the dead option a compile error rather than a silent no-op. `never` rather than simply omitting `limit`, because omitting it only rejects fresh object literals — TypeScript's excess-property check doesn't apply to a *variable*, so a shared `const opts: RequestOptions` carrying a limit would still have passed and still been dropped, which is the defect rather than a narrower version of it. Both cases are pinned by `@ts-expect-error` tests. **Note the collateral effect**, which is the half most consumers will actually meet: a value *declared* `RequestOptions` no longer assigns to a pipe `.fetch()` at all, even when it carries no limit at runtime, because the declared type permits one and assignability is decided on the type. Type a shared options object as `PipeRequestOptions` — the table and query-builder `.fetch()` accept it too, so it works everywhere — or inline `{ signal }` at the pipe call. Structural wrappers are unaffected: method parameters compare bivariantly, so an `interface Fetchable { fetch(opts?: RequestOptions): … }` is still satisfied by `PipeRef`. **Migration:** declare a `{{limit}}` parameter in the pipe's SQL and pass it as a pipe parameter — `wh.pipe(name, { limit })` — which is what the docs already showed. Pre-existing rather than introduced by #456, folded in there because that PR renames the type in question.
 
 - **BREAKING (SDK): `FetchOptions` is renamed `RequestOptions`** (`clients/ts/src/types.ts`, `clients/ts/src/index.ts`, `clients/ts/src/query-builder.ts`, `clients/ts/src/table.ts`, `clients/ts/src/pipes.ts`): the per-call options type accepted by `.fetch()`. The old name collided conceptually with the new `options.fetchOptions` — which, following OpenAI, Anthropic, and the wider ecosystem, means "extra `RequestInit` fields", not "options for our `.fetch()` method". Shipping both would have left `FetchOptions` and `fetchOptions` in the same SDK one capital letter apart, meaning unrelated things. `RequestOptions` is what Anthropic's SDK calls the identical concept. No deprecated alias: the type is unreferenced by anything consuming the pre-1.0 package, and keeping it would preserve exactly the ambiguity the rename removes. Renaming the import is the whole migration for this entry — note the separate `PipeRef.fetch` narrowing above, which is a behavioural break in the same file. The module-private `RequestOptions` in `http.ts` — the internal request descriptor — becomes `RequestSpec` to free the name.
@@ -127,7 +135,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- **Browser-first SDK distribution: an IIFE global build, CDN entry points, a `wavehouse-codegen` bin, and a Node 18 floor** (`clients/ts/tsup.config.ts`, `clients/ts/package.json`, `clients/ts/README.md`, `docs/src/content/docs/sdk.md`, `docs/src/content/docs/development.md`, `pnpm-workspace.yaml`): `@wavehouse/sdk` already shipped browser-ready ESM/CJS (zero deps, native `fetch`/`EventSource`) but documented only the `npm install` + bundler path. The build now also emits a minified, self-contained **IIFE bundle** (`dist/index.global.js`) that defines a `WaveHouse` global, wired to new `unpkg`/`jsdelivr` package fields — so `<script src="https://cdn.jsdelivr.net/npm/@wavehouse/sdk"></script>` then `WaveHouse.createClient({ … })` works on a no-build, FTP-deployed page — and the SDK README + `sdk.md` gain a "No build step (CDN)" section covering both the ESM-CDN (`<script type="module">` + esm.sh) and global forms. The codegen CLI now ships as a **`wavehouse-codegen` bin** (bundled to `dist/cli/codegen.js`, shebang preserved); consumers run `npx wavehouse-codegen` instead of the prior `npm run codegen` / `tsx src/cli/codegen.ts`, which only worked inside this repo since `files` ships `dist/` only. `engines.node` is relaxed from `>=22` to `>=18` — the runtime needs only `fetch` (stable since Node 18); streaming under Node < 22 still uses the SDK's existing "provide an `EventSource` polyfill" prompt — so the published package no longer warns or fails to install in projects on Node 18/20. **(Superseded, still unreleased — the floor returns to `>=22`; see the `### Changed` entry above. Nothing ever tested 18, and 18/20 have since reached upstream EOL.)** `tsup.config.ts` becomes an array of three build targets and `dist/` is cleaned by the `build` npm script rather than tsup's `clean`, so the configs can't race wiping each other's output. The SDK docs' CDN section documents version resolution (a bare URL serves the latest published release; version pins, `@N` ranges, and the `dev` channel), and `development.md` gains a **Releasing the SDK** section covering the dev-snapshot vs. `sdk-v*`/`latest` publish flow and the first-release `latest` promotion.
+- **Browser-first SDK distribution: an IIFE global build, CDN entry points, a `wavehouse-codegen` bin, and a Node 18 floor** (`clients/ts/tsup.config.ts`, `clients/ts/package.json`, `clients/ts/README.md`, `docs/src/content/docs/sdk.md`, `docs/src/content/docs/development.md`, `pnpm-workspace.yaml`): `@wavehouse/sdk` already shipped browser-ready ESM/CJS (at that point dependency-free, on native `fetch`/`EventSource`) but documented only the `npm install` + bundler path. The build now also emits a minified, self-contained **IIFE bundle** (`dist/index.global.js`) that defines a `WaveHouse` global, wired to new `unpkg`/`jsdelivr` package fields — so `<script src="https://cdn.jsdelivr.net/npm/@wavehouse/sdk"></script>` then `WaveHouse.createClient({ … })` works on a no-build, FTP-deployed page — and the SDK README + `sdk.md` gain a "No build step (CDN)" section covering both the ESM-CDN (`<script type="module">` + esm.sh) and global forms. The codegen CLI now ships as a **`wavehouse-codegen` bin** (bundled to `dist/cli/codegen.js`, shebang preserved); consumers run `npx wavehouse-codegen` instead of the prior `npm run codegen` / `tsx src/cli/codegen.ts`, which only worked inside this repo since `files` ships `dist/` only. `engines.node` is relaxed from `>=22` to `>=18` — the runtime needs only `fetch` (stable since Node 18); streaming under Node < 22 at that point still used the SDK's existing "provide an `EventSource` polyfill" prompt — so the published package no longer warns or fails to install in projects on Node 18/20. **(Superseded, still unreleased — the floor returns to `>=22`; see the `### Changed` entry above. Nothing ever tested 18, and 18/20 have since reached upstream EOL.)** `tsup.config.ts` becomes an array of three build targets and `dist/` is cleaned by the `build` npm script rather than tsup's `clean`, so the configs can't race wiping each other's output. The SDK docs' CDN section documents version resolution (a bare URL serves the latest published release; version pins, `@N` ranges, and the `dev` channel), and `development.md` gains a **Releasing the SDK** section covering the dev-snapshot vs. `sdk-v*`/`latest` publish flow and the first-release `latest` promotion.
 
 - **Forgiving multi-format ingest on `POST /v1/ingest` (single object, JSON array, or NDJSON), plus SDK `insert([...])` / `insertNDJSON()`** (`internal/api/ingest.go`, `internal/api/record_reader.go` (new), `internal/api/ingest_test.go`, `clients/ts/src/{http,types,table,index}.ts`, `clients/ts/src/{http,table}.test.ts`, `tests/e2e/sdk/ndjson.test.ts` (new), `tests/e2e/sdk/tables.ts`, `docs/src/content/docs/{api,sdk}.md`, `AGENTS.md`): closes #195 (part of #194). The ingest endpoint now accepts a single flat JSON object, a **JSON array** of objects (any length, even one), or an **NDJSON** batch — the format is auto-detected from the body, with `Content-Type` only a hint (the first non-whitespace byte decides; an explicit `application/x-ndjson` selects line-framing unless the body starts with `[`). Each record is validated, authorized, deduplicated, and published independently, so one malformed or rejected record never blocks the rest of the batch; a batch (array/NDJSON) returns a per-record summary `{total, succeeded, failed, duplicates, results:[{index, ok|duplicate|error}]}` with `200` whenever the body was readable (branch on `failed`/`results`, not the status), while a lone object keeps its `{"ok":true}` / `{"duplicate":true}` response byte-for-byte. Whole-request conditions abort with a non-`200`: a table-level `insert` denial (`403`, checked once up front), a JSON-array syntax error or oversized NDJSON line (`400`), the new 16 MiB body cap (`413`, parity with `/v1/ops/query`), backpressure (`503` + `Retry-After`), and publish/dedup-backend errors (`500`). Formats sit behind a pull-based `recordReader` seam (object / array / line readers + a content sniffer) so CSV and response-streaming can drop in later without reworking the handler; per-record vs whole-request handling stays in the shared `processRecord` helper.
   - **SDK.** `from(t).insert(rows[])` now serializes to a **single** NDJSON request instead of firing one unbounded concurrent POST per row (which also silently returned only the first error). Per-record outcomes surface on `InsertResult` (`total`/`succeeded`/`failed`/`duplicates`/`results`), and `ok` is `true` only when every record succeeded; the call's top-level `error` is reserved for whole-request failures. A new `from(t).insertNDJSON(source)` sends NDJSON you already have (`string` / `Uint8Array` / `Blob`/`File` / `ReadableStream`). An empty array is a no-op (no request). New exported types `InsertRecordResult` and `NDJSONSource`.
@@ -186,7 +194,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **BREAKING: `POST /v1/ops/query` is now a thin HTTP proxy to ClickHouse, not a `clickhouse-go` Query/Exec wrapper** (`internal/api/query.go`, `internal/api/query_test.go`, `internal/api/clickhouse_exec.go` (new), `internal/api/clickhouse_exec_test.go` (new), `cmd/wavehouse/main.go`, `clients/ts/src/sql.ts`, `clients/ts/src/client.ts`, `clients/ts/src/namespaces.test.ts`, `tests/integration/query_test.go`, `docs/src/content/docs/api.md`, `docs/src/content/docs/architecture.md`). The handler now POSTs the SQL string verbatim to `<scheme>://<host>:<http_port>/?default_format=JSON&date_time_output_format=iso&database=<db>` with `X-ClickHouse-User` / `X-ClickHouse-Key` auth headers (matching the ingest worker's convention), reads ClickHouse's response, and forwards just the `data` array (or `[]` for mutations that return an empty body, or a JSON error envelope of shape `{"error":"<trimmed ClickHouse message>"}` for non-200 responses — the upstream plain-text body is wrapped inside the standard error envelope, not forwarded raw). Closes the `isMutation` / `mutationVerbs` / `containsMutationVerbAtTopLevel` / `stripLeadingSQLComments` / `transformRow` ~150-LOC machinery that lived in `query.go` to classify verbs and route between `driver.Exec` and `driver.Query`. Those primitives are still needed by the structured-query and pipes handlers (clickhouse-go's native Query() errors on no-result-set statements), so they moved into a new `internal/api/clickhouse_exec.go` and are called via `executeCHQuery(ctx, conn, sql, params)` — pipes and structured-query no longer instantiate a temporary `QueryHandler` just to borrow `executeQuery`. Three wins: (a) any ClickHouse-accepted SQL works, including multi-statement input (`SELECT 1; TRUNCATE t`) and arbitrary DDL/DML/SYSTEM verbs (current and future) without WaveHouse code changes; (b) ClickHouse's own error messages reach the admin verbatim — what they want from an escape hatch; (c) the handler is ~50 LOC of forward-and-shape-response with no SQL-parsing surface. **Breaking implications:** the request body no longer accepts a `params` array (ClickHouse's HTTP interface uses named `{name:Type}` binding, not positional `?`). Inline literals into the SQL string, or use the structured query endpoint for safe binding from user inputs. The TypeScript SDK's `sql()` method drops its `params?: unknown[]` argument; callers of `client.sql(sql, params)` need to inline. `NewQueryHandler` signature changes from `(driver.Conn)` to `(endpoint, username, password, database string)`. The response also gains a `Cache-Control: no-store` header so no downstream layer caches raw-SQL results. New tests in `clickhouse_exec_test.go` keep `isMutation` + Exec/Query routing + the `transformRow` UUID/time conversions covered for the structured-query and pipes paths that still need them; new tests in `query_test.go` pin the proxy contract (SQL forwarded verbatim, data array extracted, empty-body → `[]`, ClickHouse error forwarded, security headers set on every response path, request context cancel propagates).
 - **`POST /v1/ops/query` no longer caches, singleflights, or bypasses cache for mutations** (`internal/api/query.go`, `internal/api/query_test.go`, `internal/api/cache_key.go` (new), `internal/api/cache_key_test.go` (new), `cmd/wavehouse/main.go`, `docs/src/content/docs/api.md`, `docs/src/content/docs/architecture.md`). **Note (largely superseded — see the HTTP-proxy entry above):** the structural details below (`QueryHandler` struct shape, `NewQueryHandler(conn)` signature, in-handler verb classifier, `X-Cache: MISS` header) describe the state immediately after the cache-strip commit. The subsequent HTTP-proxy refactor changed `NewQueryHandler` to `(endpoint, username, password, database string)`, dropped the `driver.Conn` field, moved the verb classifier to `internal/api/clickhouse_exec.go` for the structured-query/pipes consumers that still need it, and uses `Cache-Control: no-store` in place of `X-Cache`. The cache-strip motivation below still stands; the historical implementation specifics follow. With the endpoint now an admin-only escape hatch (see the Security entry below), the L1/L2 + singleflight + mutation-cache-bypass machinery added in the original raw-SQL handler is dead weight: admin calls are infrequent, often mutations, often one-shot, so the cache hit rate is effectively zero and singleflight has no concurrent-request herd to collapse. `QueryHandler` shrinks to `{ CHConn driver.Conn }`; `Handle` is parse → executeQuery → marshal → write. `NewQueryHandler(conn)` is the new signature (was `NewQueryHandler(conn, *cache.TieredCache, time.Duration)`). The `X-Cache: HIT/MISS` response header is gone from this endpoint — every response is a fresh ClickHouse round-trip, no header needed to disambiguate. The verb-classification machinery (`isMutation`, `mutationVerbs`, the comment-aware CTE parser) STAYS; it's correctness, not performance — clickhouse-go's `driver.Query()` errors on statements that return no result set, so we still route mutations through `driver.Exec`. The shared `queryCacheKey` helper moved to a new `internal/api/cache_key.go` since it's now consumed only by the structured query (`/v1/tables/{table}/query`) and pipes (`/v1/pipes/{name}`) handlers, which keep their caching + singleflight intact — those are the high-QPS read paths where the machinery earns its keep. Two now-obsolete tests removed: `TestQueryCacheKey_Deterministic` (moved to a fresh `cache_key_test.go` since the helper still has callers) and `TestQueryHandler_MutationBypassesCache` (no cache to bypass). The mutation-routing tests (`TestExecuteQuery_MutationRoutesToExec`, `TestExecuteQuery_SelectRoutesToQuery`) stay — they pin the still-required Exec-vs-Query classification.
 - **JWT auth middleware polish from PR review** (`internal/auth/auth.go`, `internal/auth/auth_test.go`, `docs/src/content/docs/api.md`, `docs/src/content/docs/sdk.md`): docs + test follow-ups from review of the RBAC work; no behavior change.
-  - Documented that the `Authorization` header takes precedence over the `?token=` query param: the query param is only a fallback for header-less clients (browser `EventSource`), so a token in that more log-leakable URL never overrides an explicit header credential, and it is stripped from the URL after extraction (`api.md`). `sdk.md` gains a "How the token is transmitted" note — header on REST, `?token=` on SSE, server prefers the header when both are present.
+  - Documented that the `Authorization` header takes precedence over the `?token=` query param: the query param is only a fallback for header-less clients (browser `EventSource`), so a token in that more log-leakable URL never overrides an explicit header credential, and it is stripped from the URL after extraction (`api.md`). `sdk.md` gains a "How the token is transmitted" note — header on REST, `?token=` on SSE at that point, server prefers the header when both are present. The SDK's stream transport sends the header too as of the streaming entry above; the token is no longer placed in the URL.
   - Replaced the parse-path TODO with an in-code comment: the middleware returns no error by design (authentication is decoupled from authorization). A failed/invalid/expired parse — and the effectively-unreachable non-`MapClaims` branch — all fall through to the single fail-safe that records the token error via `WithAuthError`, leaving the request roleless for a downstream gate to surface as `401` vs `403`.
   - Added `TestMiddleware_JWKSEmptyKeySet_TokenDoesNotAuthenticate`: an empty `{"keys":[]}` set constructs at boot but validates no token at request time, so every token falls back to the roleless `default_role` (fail-closed). It signs an EdDSA token so the token passes the JWKS algorithm allowlist and actually reaches the empty key set, rather than being rejected by the alg gate first.
 
@@ -208,7 +216,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - **Config and policy examples in every supported format, plus reference-page chrome odds and ends** (`docs/src/content/docs/{configuration.mdx,access-control.mdx}` (renamed from `.md`), `docs/src/content/docs/{architecture,development,pipes,claude-code}.md`, `docs/src/styles/global.css`): the example config file is now YAML / Environment synced tabs (`syncKey="cfg"`; every `WH_*` name cross-checked against `internal/config/config.go` — the config FILE is YAML-only by struct tags, so no JSON tab there), and the complete policy example is YAML / JSON synced tabs (`syncKey="policy"`; the JSON twin machine-verified equal to the YAML). Code frames that represent real files gained `title=` headers (`config.yaml`, `policy.yaml`, `.env`, `~/.claude.json`, …) and every frame — terminals included — now shows a quiet language badge at its top-right (inside the title bar where one exists; ScrollHints copies `pre[data-language]` up to the frame since CSS `attr()` can't cross elements; plain-text-family frames stay unlabeled, and the badge yields to the hover copy button on headerless frames). A follow-up round, on review feedback: every substantive policy fragment on the access-control page is now a YAML/JSON tab group (7 groups total, each JSON twin machine-parsed equal to its YAML), the configuration tables returned to separate YAML Key / Env Var columns (the stacked merge predated wide-table support; 4-column tables now ride the breakout track), code-format tab groups DOCK onto their code frame (flush bottom edge, shared corner — a floating segmented control above an unrelated box read as disconnected), external-link `↗` markers extend to prose and footer links (absolute http(s) hrefs are off-site by construction), and the diagram zoom chip became a proper masked stroke icon on a translucent blurred chip instead of a `⤢` text glyph. A fifth round (review feedback + an automated content/visual sweep) then: scoped the cluster-stroke padding to diagram scrollers only (on table cards it had opened a page-bg seam between the card border and the header band), cleared the zoom stage's leftover edge-fade attributes on every open (a prior 1:1 pan session painted a phantom fade on the next fitting diagram), settled the docked-group chrome (no `title=`/filename comments inside format tabs — the lead-in prose names the file, the tab names the format; the configuration Environment tab became dotenv-style `ini` so it stops rendering as a titled terminal), added the missing `cfg` tab groups (access-control's policy-bootstrap fragment, pipes' `.sql`-seeding fragment — pipes.md → `.mdx`), pretty-printed the wide single-line JSON wire examples (api.md responses; the SSE `data:` lines deliberately stay wire-accurate single lines and wrap visually), manually wrapped >100ch comment/log lines across deployment/architecture/sdk pages (the WARN/ERROR log examples now break with hanging indents under `wrap=false`), excluded prev/next pagination cards and the footer brand sentence from the external-link `↗` (a second glyph inside the Next card read as broken), and made the slim footer wrap deliberately below ~86rem (links become their own left-aligned row; the squeezed pane can't fit the one-line bar there). A sixth, dedicated pass killed the recurring "shadow with nothing to scroll" artifact by construction rather than by threshold: a WRAPPED code block (`pre.wrap`) can never meaningfully scroll sideways (pre-wrap + break-word guarantee every line fits — anything scrollWidth reports past clientWidth is hanging wrap-point whitespace or zoom/font-timing rounding), so the edge-fade updater now hard-strips both fade attributes from wrapped pres unconditionally; classifications also re-derive once `document.fonts.ready` resolves, so fallback-font metrics can't go stale. Code blocks then adopted the tables' earn-the-width rule (the PR author's "if it's going to wrap anyway, no point being so wide" observation): a block widens only when its longest line actually FITS the wide track (measured batched, nowrap), or when it's `wrap=false` and scrolls — a block whose longest line exceeds even the full pane keeps the prose width instead of stranding two words on a continuation line at maximum width. Long trailing comments that previously forced the wrap moved above their lines across access-control/deployment/development/sdk examples. A dedicated verification agent then proved the artifact dead: 42,696 element scans — 18 pages × 141 widths (320–2560, step 16, resize-triggered re-classification), every tab option clicked at 3 widths, the full zoom lifecycle (fit / 1:1 / pan / toggle-back / next-diagram) on 16 diagrams at 2 widths, soft-navigation chains, and blocked- and delayed-webfont variants — zero violations of the invariant (fade attribute ⇒ real overflow > 12px, and never on a wrapped pre). A seventh round, on CodeRabbit review: code-ONLY tab groups (the YAML/JSON/env switchers) now earn the wide track as a unit — `classifyCode()` previously scanned only direct `.expressive-code` children, so tabbed samples could never receive `data-wh-wide`; digging in exposed a second, older hole — the natural-width probe set `white-space: pre` on the `pre`, but EC applies wrapping on the descendant code spans (`pre.wrap .ec-line .code`), so the probe measured the WRAPPED width and every default-`wrap` block was unwidenable (only `wrap=false` blocks ever took the wide track); the wrap class itself now comes off for the batched measurement, which also lets the long-lined wrap blocks across the api/development/sdk pages widen as the sixth-pass rule always intended (verified: 19 pages × 5 widths, zero overflow / fade-on-wrap / stale-fade violations); all panels are measured (inactive ones get a momentary inline `display:block` — layout never reaches paint mid-batch) and the group pins to its widest panel’s natural width so the frame doesn’t resize across tab switches (groups with prose in any panel keep the reading measure, and a tab switch now refreshes the edge fades — a pre revealed from `hidden` measured 0×0 when fades were last stamped). The bare `table` selector left ScrollHints’ scroller list (after wrapping, tables scroll on their `.wh-table-wrap` — a fade stamped on the non-scrolling `<table>` itself could never clear), the phone Mermaid wrapper-scroller rule extends to `class`/`state` diagrams (they had the 540px no-JS min-width floor without the matching `overflow-x: auto`), and the search-dialog backdrop dropped a reintroduced hand-written `-webkit-backdrop-filter` twin (the same LightningCSS author-managed-prefix trap documented at the glass header — the build emits the twin itself). Bare issue references in prose became links (#97, #223, #224, #279). The mobile icon-only search trigger joins the menu button's circular control family (it rendered as an unstyled square), and external sidebar links (Contributing Guide, Discussions, …) carry a `↗` marker.
-- **SDK docs split into six topic pages, with package-manager-synced install tabs** (`docs/src/content/docs/sdk/{index.mdx,queries.md,streaming.md,pipes.md,admin.md,reference.md}` (new), `docs/src/content/docs/sdk.md` (deleted), `docs/src/config/sidebar.ts`, `docs/src/components/Hero.astro`): the 806-line monolith becomes `/sdk` (overview: install, quick start, client setup, `Result<T>`, section cards) plus `/sdk/{queries,streaming,pipes,admin,reference}`, under a nested "TypeScript SDK" sidebar group (which also keeps the llms.txt page ordering coherent — the LLM outputs read the sidebar). Topic-first URLs are the multi-language plan on record: when a second SDK language lands, the shared usage pages grow `<Tabs syncKey="lang">` code tabs and each language gets its own setup/caveats page, so the topic URLs never churn. Installation became `<Tabs syncKey="pkg">` (pnpm / npm / yarn / bun / deno / CDN), and the landing hero's click-to-copy install chip now follows that synced choice — Starlight persists the selected tab label in `localStorage` under its syncKey, the hero script maps it to the matching one-liner (CDN and anything unknown keep the pnpm default). Every inbound link from other pages already pointed at bare `/sdk` (still the overview); the three intra-page `#streaming` anchors became `/sdk/streaming` links, and `starlight-links-validator` gates the rest. A follow-up adds an "Imports & Runtimes" section to the overview — import-line tabs synced to the same `pkg` choice (the CDN reader sees the esm.sh import everywhere, including a fully-tabbed Quick Start), Node CJS `require()` and the `WaveHouse` IIFE global documented from the shipped exports map, and a verified runtime-support note (streaming needs an `EventSource` polyfill in Node — the global is still flag-gated as of Node 26, checked empirically; non-streaming works on Node 18+). Each topic page points CDN readers at the section.
+- **SDK docs split into six topic pages, with package-manager-synced install tabs** (`docs/src/content/docs/sdk/{index.mdx,queries.md,streaming.md,pipes.md,admin.md,reference.md}` (new), `docs/src/content/docs/sdk.md` (deleted), `docs/src/config/sidebar.ts`, `docs/src/components/Hero.astro`): the 806-line monolith becomes `/sdk` (overview: install, quick start, client setup, `Result<T>`, section cards) plus `/sdk/{queries,streaming,pipes,admin,reference}`, under a nested "TypeScript SDK" sidebar group (which also keeps the llms.txt page ordering coherent — the LLM outputs read the sidebar). Topic-first URLs are the multi-language plan on record: when a second SDK language lands, the shared usage pages grow `<Tabs syncKey="lang">` code tabs and each language gets its own setup/caveats page, so the topic URLs never churn. Installation became `<Tabs syncKey="pkg">` (pnpm / npm / yarn / bun / deno / CDN), and the landing hero's click-to-copy install chip now follows that synced choice — Starlight persists the selected tab label in `localStorage` under its syncKey, the hero script maps it to the matching one-liner (CDN and anything unknown keep the pnpm default). Every inbound link from other pages already pointed at bare `/sdk` (still the overview); the three intra-page `#streaming` anchors became `/sdk/streaming` links, and `starlight-links-validator` gates the rest. A follow-up adds an "Imports & Runtimes" section to the overview — import-line tabs synced to the same `pkg` choice (the CDN reader sees the esm.sh import everywhere, including a fully-tabbed Quick Start), Node CJS `require()` and the `WaveHouse` IIFE global documented from the shipped exports map, and a verified runtime-support note (streaming needed an `EventSource` polyfill in Node at that point — the global was still flag-gated as of Node 26, checked empirically; non-streaming worked on Node 18+). The polyfill requirement is gone as of the `fetch` transport above. Each topic page points CDN readers at the section.
 - **Pre-push CI marker is tree-keyed, not commit-keyed** (`Makefile`, `.githooks/pre-push`, `.claude/hooks/agent-bash-gate.sh`, `AGENTS.md`). The `make ci → git add → git commit → git push` flow no longer false-positive-blocks — committing advances HEAD but doesn't change the tree CI validated. `make ci` writes `tmp/ci-passed-tree-<TREE-SHA>` computed against a throwaway `GIT_INDEX_FILE` (so untracked files are captured without touching the real index); pre-push and the agent-bash-gate resolve each pushed ref's `^{tree}` and match. Skipped on CI runners (they don't push). `review-passed` stays commit-keyed — a new commit needs a new review.
 - **Worktrunk seeds new worktrees from main** (`.config/wt.toml`). Added `wt step copy-ignored` to `post-start` ahead of `make tools`, so `wt switch --create <branch>` copies `.bin/` and the three `node_modules/` trees (~1 GB combined) from main instead of cold-starting `pnpm install --frozen-lockfile` × 3. `[step.copy-ignored] exclude` keeps `tmp/`, `data/`, and vitest's `coverage/` out.
 - **Claude PR review is now manual-only** (`.github/workflows/claude-review.yml`, `AGENTS.md`): dropped the `pull_request` trigger (was firing on opened/synchronize/reopened/ready_for_review) so the workflow only runs on `@claude` or `/review` comments from trusted reviewers, or `workflow_dispatch`. "Claude review" was never a required status check (the ruleset gates on `Admin approval` / `CI` / `PR housekeeping`), so this changes who pays the action budget — every push no longer triggers a review automatically; reviewers explicitly opt in via mention after they've looked at the diff themselves. Falls out: the workflow header's `pull_request_target` OIDC paragraph dropped (only applied to the auto-trigger path), concurrency's `cancel-in-progress` is now unconditionally `false` (manual triggers should always queue, never cancel an in-flight review), the workflow-level `if:` loses its `pull_request` branch + dependabot-author exclusion, and the gate-step `case` drops the `pull_request)` arm + its two `PR_EVENT_*` env vars (`gh pr view --jq .headRefOid` is hoisted out of the case since both remaining paths need it identically). The trust gate stays — it's *more* load-bearing under manual-only, since `issue_comment` runs with full repo secrets and a trusted reviewer commenting `@claude` on a fork PR would otherwise check out untrusted fork code with write tokens. AGENTS.md synced in three places: §"Review Response" step 6 (Claude moved from synchronize-rerun to PR-comment-mention), the review tooling reference table (Claude row now "Manual-only" with "No" in the re-runs column), and §"Repository Automation" §"Code review" entry (rewritten to lead with manual-only).
@@ -469,7 +477,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **`internal/policy/`** package: Policy types, evaluation engine, and NATS KV store.
 - **`internal/pipes/`** package: Named query types and NATS KV store with `.sql` file bootstrap.
 - **`internal/query/`** package: Structured query AST types, SQL builder with schema validation, permission injection, and timestamp bucketing.
-- **TypeScript SDK** (`clients/ts/`): `@wavehouse/sdk` — zero-dependency client with type-safe query builder, real-time SSE streaming, live queries with smart aggregation updates (incrementable/decomposable/poll), and codegen CLI for generating typed interfaces from ClickHouse schemas.
+- **TypeScript SDK** (`clients/ts/`): `@wavehouse/sdk` — client with type-safe query builder, real-time SSE streaming, live queries with smart aggregation updates (incrementable/decomposable/poll), and codegen CLI for generating typed interfaces from ClickHouse schemas.
 - **Schema discovery**: New `internal/discovery/` package introspects ClickHouse `system.columns` to build a live schema registry. Schemas are cached and auto-refreshed on a configurable interval (`schema.refresh_interval` / `WH_SCHEMA_REFRESH_INTERVAL`).
 - **Schema validation**: Ingest payloads are validated against discovered ClickHouse schemas — unknown fields, type mismatches, and non-nullable violations are rejected with descriptive 400 errors.
 - **Schema API endpoints**: `GET /v1/ops/schema` (list all tables), `GET /v1/ops/schema?table={table}` (single table), `POST /v1/ops/schema/refresh` (force refresh).
diff --git a/README.md b/README.md
index 966bc683..cac46f9a 100644
--- a/README.md
+++ b/README.md
@@ -60,7 +60,7 @@ If you're building user-facing analytics, WaveHouse is like **Supabase for Click
 - **Query** — in-process Ristretto cache + `singleflight` coalescing; type-safe structured query AST; Tinybird-style named pipes (parameterized SQL endpoints).
 - **Real-time** — native SSE push, broadcast *before* the ClickHouse flush, with JetStream gap-fill for late/reconnecting clients.
 - **Security** — Hasura-style per-table, per-role column + row policies with JWT claim templating, stored in NATS KV.
-- **Client** — `@wavehouse/sdk`: zero-dependency TypeScript client with query builder, live queries, streaming, and schema codegen.
+- **Client** — `@wavehouse/sdk`: TypeScript client with query builder, live queries, streaming, and schema codegen; one runtime dependency (an SSE frame parser, ~1.4 KB gzipped).
 
 ## 📊 How it compares
 
diff --git a/clients/ts/README.md b/clients/ts/README.md
index 7f2cdbab..f4231767 100644
--- a/clients/ts/README.md
+++ b/clients/ts/README.md
@@ -1,6 +1,6 @@
 # @wavehouse/sdk
 
-Zero-dependency TypeScript client for [WaveHouse](https://github.com/Wave-RF/WaveHouse) — schema-aware real-time API gateway for ClickHouse.
+TypeScript client for [WaveHouse](https://github.com/Wave-RF/WaveHouse) — schema-aware real-time API gateway for ClickHouse. One runtime dependency (`eventsource-parser`, ~1.4 KB gzipped, itself dependency-free).
 
 ## Installation
 
@@ -8,7 +8,7 @@ Zero-dependency TypeScript client for [WaveHouse](https://github.com/Wave-RF/Wav
 npm install @wavehouse/sdk
 ```
 
-Requires Node 22 or newer — the only line this SDK is tested against; Node 18 and 20 are past upstream end-of-life. Browsers need no polyfill, and Node needs an `EventSource` polyfill only for streaming — see [Runtime support](https://wavehouse.dev/sdk/#runtime-support).
+Requires Node 22 or newer — the only line this SDK is tested against; Node 18 and 20 are past upstream end-of-life. Neither browsers nor Node need a polyfill: streaming runs on `fetch`, like the rest of the SDK — see [Runtime support](https://wavehouse.dev/sdk/#runtime-support).
 
 This works in any framework that uses a bundler — React, Vue, Svelte, Angular, Astro, SolidJS, or plain Vite — with `import { createClient } from '@wavehouse/sdk'`.
 
@@ -44,7 +44,7 @@ Pin a version for production (`https://esm.sh/@wavehouse/sdk@0.1.0`). jsDelivr (
 
 **Versioning.** A bare CDN URL serves the latest published **release**; pin for production (`@wavehouse/sdk@0.1.0`) or float on a range (`@0` for the newest 0.x, `@0.1` for 0.1.x). Builds from `main` are published under the `dev` tag — `@wavehouse/sdk@dev` — for trying unreleased changes.
 
-Streaming (`.stream()`) uses the browser's native `EventSource`, so it works in both forms with no polyfill.
+Streaming (`.stream()`) runs on `fetch`, so it works in both forms with no polyfill.
 
 ## Quick Start
 
@@ -131,7 +131,7 @@ const { data } = await wh.from('clicks').select('page').limit(10);
 
 Async request methods return a `Result<T>` object — destructure it as `{ data, error }` — and never throw for anything the server returns. `.stream()` and `.liveQuery()` return controllers instead, reporting failures through the subscriber's `error` callback.
 
-The SDK does throw on caller and environment errors: a non-absolute `baseURL` (REST calls reject with a `TypeError`; streams report `SSE_CONNECT_ERROR`, and despite that error's `retryable: true` the SDK never re-dials the stream itself), `.stream()` / `.liveQuery()` in a runtime with no `EventSource`, and an `auth` callback that rejects — a token-refresh failure propagates out of the REST call.
+The SDK does throw on caller and environment errors: a non-absolute `baseURL` (REST calls reject with a `TypeError`; streams report a terminal `SSE_CONNECT_ERROR`), `.stream()` / `.liveQuery()` in a runtime with no global `fetch` and no `options.fetch`, and an `auth` callback that rejects — a token-refresh failure propagates out of the REST call, and on a stream is reported as a retryable `SSE_AUTH_ERROR`. A dropped stream *is* re-dialed by the SDK, on a jittered backoff; only non-retryable failures end it. One more exception can escape an SDK call, though it is yours rather than ours: a subscriber's `status` handler throwing on the first, synchronous `.subscribe()` / `.liveQuery()` call — see [Error Handling](https://wavehouse.dev/sdk/reference#error-handling).
 
 ```ts
 const { data, error } = await wh.from('clicks').fetch();
diff --git a/clients/ts/package.json b/clients/ts/package.json
index b11bbd13..fbe643bb 100644
--- a/clients/ts/package.json
+++ b/clients/ts/package.json
@@ -40,6 +40,9 @@
     "prepublishOnly": "pnpm run typecheck && pnpm run build",
     "codegen": "tsx src/cli/codegen.ts"
   },
+  "dependencies": {
+    "eventsource-parser": "^3.1.0"
+  },
   "devDependencies": {
     "@types/node": "catalog:",
     "@vitest/coverage-v8": "^4.1.10",
diff --git a/clients/ts/src/client.test.ts b/clients/ts/src/client.test.ts
index 1fc9a22b..88ed7072 100644
--- a/clients/ts/src/client.test.ts
+++ b/clients/ts/src/client.test.ts
@@ -358,3 +358,27 @@ describe("options.fetchOptions", () => {
     });
   });
 });
+
+describe("stream error delivery", () => {
+  it("delivers a start-up failure to a subscriber attached after .stream() returns", async () => {
+    // Regression: the transport used to detect an unresolvable `baseURL`
+    // synchronously inside `connect()`, which runs in the StreamController
+    // constructor — so the error fired before `.stream()` had returned and no
+    // subscriber could ever see it. Every transport-level test attaches its
+    // callbacks before `connect()`, which is exactly why they missed it.
+    const wh = createClient({ baseURL: "not-a-url" });
+    const stream = wh.from("clicks").stream();
+
+    const errors: unknown[] = [];
+    const statuses: string[] = [];
+    stream.subscribe({
+      next: () => {},
+      status: (s) => statuses.push(s),
+      error: (e) => errors.push(e),
+    });
+
+    await vi.waitFor(() => expect(errors).toHaveLength(1));
+    expect((errors[0] as { code: string }).code).toBe("SSE_CONNECT_ERROR");
+    expect(statuses).toContain("closed");
+  });
+});
diff --git a/clients/ts/src/client.ts b/clients/ts/src/client.ts
index 3c26c63d..d29ee640 100644
--- a/clients/ts/src/client.ts
+++ b/clients/ts/src/client.ts
@@ -95,19 +95,14 @@ export class WaveHouseClient<DB extends Database = Database> {
     table: string,
     opts?: StreamOptions,
   ): StreamController<T> {
-    if (typeof EventSource === "undefined") {
-      // TODO: fallback method? polling?
-      throw new Error(
-        "[WaveHouse SDK] Native EventSource is not available in this environment. " +
-          "Please provide a global polyfill (e.g., `globalThis.EventSource = require('eventsource')`).",
-      );
-    }
-
     const transport = new SSETransport<T>({
       baseURL: this._ctx.baseURL,
       table,
       since: opts?.since,
       auth: this._ctx.auth,
+      fetch: this._ctx.options.fetch,
+      headers: this._ctx.options.headers,
+      fetchOptions: this._ctx.options.fetchOptions,
     });
     const controller = new StreamController<T>(transport);
     if (opts?.signal) controller.attachSignal(opts.signal);
diff --git a/clients/ts/src/http.test.ts b/clients/ts/src/http.test.ts
index 2d510dbb..d973d534 100644
--- a/clients/ts/src/http.test.ts
+++ b/clients/ts/src/http.test.ts
@@ -167,6 +167,70 @@ describe("request", () => {
     expect(result.error?.retryable).toBe(false);
   });
 
+  it("returns ABORTED when the abort lands during a retry backoff", async () => {
+    // The existing abort test rejects the *fetch*, which is caught by the
+    // branch at the top of the catch. This one aborts during the backoff that
+    // runs inside that same catch — the one sleep whose rejection had no
+    // handler, so it escaped `request()` as a raw DOMException and reached the
+    // caller as an unhandled rejection instead of the documented Result.
+    fetchSpy.mockRejectedValue(new TypeError("fetch failed"));
+
+    const ac = new AbortController();
+    setTimeout(() => ac.abort(), 20);
+
+    // maxRetries must be > 0 or there is no backoff to abort during —
+    // the default fixture is 0, which returns NETWORK_ERROR on the first pass.
+    const result = await request(makeCtx({ options: { maxRetries: 1 } }), {
+      method: "GET",
+      path: "/health",
+      signal: ac.signal,
+    });
+
+    expect(result.error?.code).toBe("ABORTED");
+    expect(result.error?.retryable).toBe(false);
+  });
+
+  it.each([0, 2])(
+    "reports ABORTED regardless of the rejection type, at maxRetries=%i",
+    async (maxRetries) => {
+      // AbortSignal.timeout() rejects with a TimeoutError, and node-fetch with
+      // its own AbortError class — neither is a DOMException named AbortError.
+      // Keying the check off the error alone made the answer depend on whether
+      // a retry remained for the backoff sleep to notice the signal.
+      const ac = new AbortController();
+      fetchSpy.mockImplementation(async () => {
+        ac.abort();
+        throw new TypeError("fetch failed");
+      });
+
+      const result = await request(makeCtx({ options: { maxRetries } }), {
+        method: "GET",
+        path: "/health",
+        signal: ac.signal,
+      });
+
+      expect(result.error?.code).toBe("ABORTED");
+    },
+  );
+
+  it("retries a middleware's own AbortError when the caller did not cancel", async () => {
+    // An `options.fetch` enforcing a per-attempt deadline aborts an internal
+    // controller and rejects with a real AbortError, while the caller's signal
+    // is untouched. Nobody asked to cancel, so this is transient — matching on
+    // the error type instead of the signal would end the call as ABORTED.
+    fetchSpy
+      .mockRejectedValueOnce(new DOMException("Aborted", "AbortError"))
+      .mockResolvedValueOnce(new Response(JSON.stringify({ ok: true }), { status: 200 }));
+
+    const result = await request<{ ok: boolean }>(makeCtx({ options: { maxRetries: 1 } }), {
+      method: "GET",
+      path: "/health",
+    });
+
+    expect(result.error).toBeNull();
+    expect(fetchSpy).toHaveBeenCalledTimes(2);
+  });
+
   it("appends query params to URL", async () => {
     fetchSpy.mockResolvedValue(new Response(JSON.stringify({}), { status: 200 }));
 
diff --git a/clients/ts/src/http.ts b/clients/ts/src/http.ts
index 905a8556..e6d1edc7 100644
--- a/clients/ts/src/http.ts
+++ b/clients/ts/src/http.ts
@@ -31,8 +31,13 @@ export interface HttpResult<T> {
  * `Authorization` and let the server pick. Canonical casing wins, and values
  * replace rather than append — a header joined instead of replaced is a known
  * way to produce `Content-Type: application/json, image/png`.
+ *
+ * Shared with the SSE transport so both paths resolve `headers` the same way,
+ * rather than growing a second precedence story.
+ *
+ * @internal
  */
-function mergeHeaders(
+export function mergeHeaders(
   base: Record<string, string>,
   extra: Record<string, string> | undefined,
 ): Record<string, string> {
@@ -55,6 +60,15 @@ function mergeHeaders(
   return merged;
 }
 
+/** The documented shape for a cancelled request: a Result, never a throw. */
+function abortedResult<T>(): HttpResult<T> {
+  return {
+    data: null,
+    error: { status: 0, code: "ABORTED", message: "Request aborted", retryable: false },
+    headers: new Headers(),
+  };
+}
+
 /**
  * Internal fetch wrapper with auth injection, retry, backoff, and Retry-After.
  * @internal
@@ -133,18 +147,39 @@ export async function request<T>(ctx: HttpContext, opts: RequestSpec): Promise<H
 
       return { data: null, error, headers: res.headers };
     } catch (e) {
-      // AbortError — return immediately, no retry
-      if (e instanceof DOMException && e.name === "AbortError") {
-        return {
-          data: null,
-          error: { status: 0, code: "ABORTED", message: "Request aborted", retryable: false },
-          headers: new Headers(),
-        };
+      // Classified on the *signal*, never the rejection's type. Keying off the
+      // error made the outcome depend on `maxRetries` — an implementation that
+      // throws something other than a `DOMException` named `AbortError`
+      // (`AbortSignal.timeout()` raises a `TimeoutError`, `node-fetch` its own
+      // class) fell through to NETWORK_ERROR here and was reclassified only if
+      // a retry remained for the backoff to notice the signal.
+      //
+      // Matching on the error would also misread middleware: an `options.fetch`
+      // enforcing its own per-attempt deadline aborts an internal controller
+      // and rejects with a real `AbortError` while the caller's signal is
+      // untouched. Nobody asked to cancel, so that is a transient failure to
+      // retry, not a terminal `ABORTED`.
+      if (opts.signal?.aborted) {
+        return abortedResult<T>();
       }
 
       lastError = networkError(e);
       if (attempt < maxAttempts - 1) {
-        await sleep(backoff(attempt), opts.signal);
+        // This sleep is the one that runs inside the catch, so unlike the two
+        // in the try above, an abort raised *by* the backoff would escape
+        // `request()` as a raw DOMException instead of the documented ABORTED
+        // result — and no caller wraps this, so it would reach the consumer as
+        // an unhandled rejection.
+        try {
+          await sleep(backoff(attempt), opts.signal);
+        } catch (abort) {
+          // Same rule as above, so the two classifications can't drift apart.
+          // `sleep` only rejects when the signal fires, so this always holds.
+          if (opts.signal?.aborted) {
+            return abortedResult<T>();
+          }
+          throw abort;
+        }
       }
     }
   }
diff --git a/clients/ts/src/stream/live-query.test.ts b/clients/ts/src/stream/live-query.test.ts
new file mode 100644
index 00000000..243186e4
--- /dev/null
+++ b/clients/ts/src/stream/live-query.test.ts
@@ -0,0 +1,120 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { createClient } from "../client.js";
+import type { FetchLike, Result, StreamEvent, StreamStatus } from "../types.js";
+
+/**
+ * `liveQuery()` opens the stream and runs the REST backfill in the same tick,
+ * so which of them calls `auth` first decides what a rejecting token provider
+ * looks like to a subscriber — and the two outcomes are documented differently
+ * (`sdk/streaming.md`, "When the backfill doesn't complete"). The ordering is
+ * emergent rather than declared: it holds because `SSETransport._run` yields on
+ * `await Promise.resolve()` while `_runBackfill` reaches `ctx.auth()` with no
+ * intervening await. One added `await` on the REST path would silently swap the
+ * documented cases, so it is pinned here.
+ */
+
+/** Distinguishes the two request paths by URL, since both share one `auth`. */
+function isStreamURL(url: string): boolean {
+  return url.includes("/v1/stream");
+}
+
+function makeFetch(): { impl: FetchLike; urls: string[] } {
+  const urls: string[] = [];
+  const impl: FetchLike = async (url) => {
+    urls.push(url);
+    if (isStreamURL(url)) {
+      // A connection that opens and stays open, like a real stream.
+      return new Response(new ReadableStream<Uint8Array>({ start() {} }), {
+        status: 200,
+        headers: { "Content-Type": "text/event-stream" },
+      });
+    }
+    return new Response(JSON.stringify({ data: [] }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  };
+  return { impl, urls };
+}
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("liveQuery auth ordering", () => {
+  it("spends the first auth() call on the backfill, which never retries it", async () => {
+    const calls: string[] = [];
+    const f = makeFetch();
+
+    const wh = createClient({
+      baseURL: "http://localhost:8080",
+      // Rejects only the first call. If the stream were to win the race, the
+      // stream would absorb the rejection (retryable) and the backfill would
+      // succeed — the opposite of what the docs describe.
+      auth: () => {
+        calls.push("auth");
+        if (calls.length === 1) return Promise.reject(new Error("token endpoint down"));
+        return Promise.resolve("t0ken");
+      },
+      options: { fetch: f.impl, maxRetries: 2 },
+    });
+
+    const initial: Array<Result<Record<string, unknown>[]>> = [];
+    const errors: string[] = [];
+    const statuses: StreamStatus[] = [];
+    const events: StreamEvent<Record<string, unknown>>[] = [];
+
+    const lq = wh
+      .from("clicks")
+      .select("*")
+      .liveQuery({
+        initial: (r) => initial.push(r),
+        next: (e) => events.push(e),
+        status: (s) => statuses.push(s),
+        error: (e) => errors.push(e.code),
+      });
+
+    await vi.waitFor(() => expect(statuses).toContain("live"));
+
+    // The rejection landed on the backfill: it is gone, and gone silently.
+    expect(initial).toHaveLength(0);
+    expect(errors).toHaveLength(0);
+    expect(f.urls.filter((u) => !isStreamURL(u))).toHaveLength(0);
+
+    // The stream got the second call and connected normally.
+    expect(f.urls.filter(isStreamURL)).toHaveLength(1);
+    expect(calls.length).toBeGreaterThanOrEqual(2);
+
+    lq.close();
+  });
+
+  it("reports a persistently rejecting auth on the stream, still never on the backfill", async () => {
+    const f = makeFetch();
+    const wh = createClient({
+      baseURL: "http://localhost:8080",
+      auth: () => Promise.reject(new Error("token endpoint down")),
+      options: { fetch: f.impl },
+    });
+
+    const initial: unknown[] = [];
+    const errors: string[] = [];
+
+    const lq = wh
+      .from("clicks")
+      .select("*")
+      .liveQuery({
+        initial: (r) => initial.push(r),
+        next: () => {},
+        error: (e) => errors.push(e.code),
+      });
+
+    await vi.waitFor(() => expect(errors.length).toBeGreaterThan(0));
+
+    // Every error comes from the stream; the backfill never reports at all.
+    expect(new Set(errors)).toEqual(new Set(["SSE_AUTH_ERROR"]));
+    expect(initial).toHaveLength(0);
+    expect(f.urls).toHaveLength(0);
+
+    lq.close();
+  });
+});
diff --git a/clients/ts/src/stream/live-query.ts b/clients/ts/src/stream/live-query.ts
index 1fd9cc9a..d9eb6794 100644
--- a/clients/ts/src/stream/live-query.ts
+++ b/clients/ts/src/stream/live-query.ts
@@ -61,8 +61,12 @@ export class LiveQuery<T = Record<string, unknown>> {
       }
 
       // Step 4: Deduplicate buffered events against fetched rows.
-      // Use received_timestamp as the dedup boundary: only flush events
-      // that are newer than the latest row in the fetch result.
+      // The boundary is the `received_timestamp` of the *last row returned* —
+      // not the newest, unless the query happens to order ascending. The ways
+      // that misbehaves (and there are three) are enumerated once, in the SDK
+      // docs under Live Queries → How it works; #449 tracks the fix. Stated
+      // there rather than restated here, because this claim has already drifted
+      // out of sync three times across the docs and this comment.
       const rows = result.data;
       let lastTimestamp: string | undefined;
       if (rows.length > 0) {
@@ -70,7 +74,7 @@ export class LiveQuery<T = Record<string, unknown>> {
         lastTimestamp = lastRow?.received_timestamp as string | undefined;
       }
 
-      // Step 5: Flush buffered events that are newer than the fetch.
+      // Step 5: Flush buffered events newer than that boundary.
       this._buffering = false;
       for (const event of this._buffer) {
         if (this._closed) break;
diff --git a/clients/ts/src/stream/sse.test.ts b/clients/ts/src/stream/sse.test.ts
index 4a51e8c7..80622d51 100644
--- a/clients/ts/src/stream/sse.test.ts
+++ b/clients/ts/src/stream/sse.test.ts
@@ -1,98 +1,1156 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { SSETransport } from "./sse.js";
+import type { FetchLike, StreamEvent, StreamStatus, WaveHouseError } from "../types.js";
+import { MAX_BUFFER_CHARS, SSETransport } from "./sse.js";
 
-/** URLs handed to `new EventSource(...)`, newest last. */
-let opened: string[] = [];
+/** One recorded call into the injected fetch. */
+interface Attempt {
+  url: string;
+  init: RequestInit;
+}
 
-class FakeEventSource {
-  static readonly CONNECTING = 0;
-  static readonly OPEN = 1;
-  static readonly CLOSED = 2;
+/**
+ * Headers are always handed to fetch as a plain object by the transport.
+ *
+ * Asserted rather than assumed: a `Headers` instance or an entry array would
+ * cast to an object with no string keys, quietly turning every
+ * `expect(headers[x]).toBeUndefined()` below into a tautology.
+ */
+function headersOf(attempt: Attempt): Record<string, string> {
+  const h = attempt.init.headers ?? {};
+  expect(h).not.toBeInstanceOf(Headers);
+  expect(Array.isArray(h)).toBe(false);
+  return h as Record<string, string>;
+}
 
-  readyState = FakeEventSource.CONNECTING;
-  onopen: (() => void) | null = null;
-  onmessage: ((e: MessageEvent) => void) | null = null;
-  onerror: (() => void) | null = null;
+/**
+ * A response whose body is a stream the test drives frame by frame, standing in
+ * for a connection the server holds open.
+ */
+function streamingResponse(): {
+  res: Response;
+  push: (chunk: string) => void;
+  close: () => void;
+  fail: (reason: Error) => void;
+} {
+  const encoder = new TextEncoder();
+  let ctrl!: ReadableStreamDefaultController<Uint8Array>;
+  const body = new ReadableStream<Uint8Array>({
+    start(c) {
+      ctrl = c;
+    },
+  });
+  return {
+    res: new Response(body, {
+      status: 200,
+      headers: { "Content-Type": "text/event-stream" },
+    }),
+    push: (chunk) => ctrl.enqueue(encoder.encode(chunk)),
+    close: () => ctrl.close(),
+    fail: (reason: Error) => ctrl.error(reason),
+  };
+}
 
-  constructor(url: string) {
-    opened.push(url);
-  }
+/** A scripted fetch: each queued entry answers one connection attempt. */
+function makeFetch() {
+  const attempts: Attempt[] = [];
+  const queue: Array<() => Response> = [];
+  const impl: FetchLike = async (url, init) => {
+    attempts.push({ url, init: init ?? {} });
+    const next = queue.shift();
+    if (!next) return streamingResponse().res; // idle, never-ending
+    return next();
+  };
+  return { impl, attempts, queue };
+}
 
-  close(): void {
-    this.readyState = FakeEventSource.CLOSED;
-  }
+/** Collector wired to a transport's three callbacks. */
+function collect<T>(t: SSETransport<T>) {
+  const events: StreamEvent<T>[] = [];
+  const statuses: StreamStatus[] = [];
+  const errors: WaveHouseError[] = [];
+  t.onEvent = (e) => events.push(e);
+  t.onStatus = (s) => statuses.push(s);
+  t.onError = (e) => errors.push(e);
+  return { events, statuses, errors };
 }
 
-/** Let `connect()`'s async `_doConnect()` reach `new EventSource(...)`. */
+const BASE = "http://localhost:8080";
+
+/** Let the transport's async connect path reach its next await. */
 const flush = () => new Promise((r) => setTimeout(r, 0));
 
-describe("SSETransport URL construction", () => {
-  beforeEach(() => {
-    opened = [];
-    vi.stubGlobal("EventSource", FakeEventSource);
-  });
+const frame = (id: string, payload: unknown) => `id: ${id}\ndata: ${JSON.stringify(payload)}\n\n`;
 
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
+// A failed assertion aborts the test body, so cleanup cannot live at the end of
+// one: leaked fake timers stall every later test that awaits `flush()`, turning
+// a single real failure into a cascade of timeouts that buries it.
+afterEach(() => {
+  vi.useRealTimers();
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
 
-  it("connects at the origin root for a root-hosted base", async () => {
-    new SSETransport({ baseURL: "http://localhost:8080", table: "clicks" }).connect();
-    await flush();
+describe("SSETransport request construction", () => {
+  it("authenticates with a Bearer header and keeps the token out of the URL", async () => {
+    const f = makeFetch();
+    const t = new SSETransport({
+      baseURL: BASE,
+      table: "clicks",
+      auth: () => "jwt-abc",
+      fetch: f.impl,
+    });
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
 
-    expect(opened).toHaveLength(1);
-    const url = new URL(opened[0]);
+    const url = new URL(f.attempts[0].url);
     expect(url.pathname).toBe("/v1/stream");
     expect(url.searchParams.get("table")).toBe("clicks");
+    expect(url.searchParams.get("token")).toBeNull();
+    expect(url.search).not.toContain("jwt-abc");
+    expect(headersOf(f.attempts[0]).Authorization).toBe("Bearer jwt-abc");
+
+    t.disconnect();
   });
 
   it("preserves a base path prefix", async () => {
-    new SSETransport({
+    const f = makeFetch();
+    const t = new SSETransport({
       baseURL: "https://app.example.com/api/warehouse",
       table: "clicks",
-    }).connect();
-    await flush();
+      fetch: f.impl,
+    });
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
 
-    const url = new URL(opened[0]);
-    expect(url.pathname).toBe("/api/warehouse/v1/stream");
-    expect(url.searchParams.get("table")).toBe("clicks");
+    expect(new URL(f.attempts[0].url).pathname).toBe("/api/warehouse/v1/stream");
+    t.disconnect();
   });
 
-  it("preserves the prefix alongside since and token params", async () => {
-    new SSETransport({
-      baseURL: "https://app.example.com/api/warehouse/",
+  it("sets the stream-critical init fields the SDK owns", async () => {
+    const f = makeFetch();
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    const { init } = f.attempts[0];
+    expect(headersOf(f.attempts[0]).Accept).toBe("text/event-stream");
+    // As an init field, never a Cache-Control header — the header form is not
+    // in the server's Access-Control-Allow-Headers and would fail preflight.
+    expect(init.cache).toBe("no-store");
+    expect(headersOf(f.attempts[0])["Cache-Control"]).toBeUndefined();
+    // No credential on this request, so a redirect costs nothing to follow.
+    expect(init.redirect).toBe("follow");
+
+    t.disconnect();
+  });
+
+  it("refuses redirects once a credential is attached", async () => {
+    const f = makeFetch();
+    const t = new SSETransport({
+      baseURL: BASE,
+      table: "clicks",
+      headers: { "CF-Access-Client-Secret": "shh" },
+      fetch: f.impl,
+    });
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    // Configured headers are forwarded across a cross-origin hop even though
+    // Authorization is stripped, so a secret would land wherever it points.
+    expect(f.attempts[0].init.redirect).toBe("manual");
+    t.disconnect();
+  });
+
+  it("neutralizes a body from fetchOptions", async () => {
+    const f = makeFetch();
+    const t = new SSETransport({
+      baseURL: BASE,
       table: "clicks",
-      since: "2024-01-01T00:00:00Z",
-      auth: async () => "my-token",
-    }).connect();
+      fetch: f.impl,
+      fetchOptions: { body: "leaked" },
+    });
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    // A body on a GET makes the real fetch throw, which would read as a network
+    // failure and be retried against a request that can never be built.
+    expect(f.attempts[0].init.body).toBeUndefined();
+    t.disconnect();
+  });
+
+  it("does not set credentials outside a browser, even when configured", async () => {
+    const f = makeFetch();
+    const t = new SSETransport({
+      baseURL: BASE,
+      table: "clicks",
+      fetch: f.impl,
+      fetchOptions: { credentials: "include" },
+    });
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    expect(f.attempts[0].init.credentials).toBeUndefined();
+    t.disconnect();
+  });
+
+  it("merges configured headers but keeps Authorization for auth", async () => {
+    const f = makeFetch();
+    const t = new SSETransport({
+      baseURL: BASE,
+      table: "clicks",
+      auth: () => "real-token",
+      headers: { "CF-Access-Client-Id": "svc", authorization: "Bearer smuggled" },
+      fetch: f.impl,
+    });
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    const headers = headersOf(f.attempts[0]);
+    expect(headers["CF-Access-Client-Id"]).toBe("svc");
+    expect(headers.Authorization).toBe("Bearer real-token");
+    expect(headers.authorization).toBeUndefined();
+
+    t.disconnect();
+  });
+
+  it("passes `since` on the first connect and no Last-Event-ID", async () => {
+    const f = makeFetch();
+    const t = new SSETransport({
+      baseURL: BASE,
+      table: "clicks",
+      since: "2026-08-01T00:00:00Z",
+      fetch: f.impl,
+    });
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    expect(new URL(f.attempts[0].url).searchParams.get("since")).toBe("2026-08-01T00:00:00Z");
+    expect(headersOf(f.attempts[0])["Last-Event-ID"]).toBeUndefined();
+    t.disconnect();
+  });
+
+  it("uses the global fetch when none is configured", async () => {
+    const spy = vi.fn(async () => streamingResponse().res);
+    vi.stubGlobal("fetch", spy);
+    const t = new SSETransport({ baseURL: BASE, table: "clicks" });
+    t.connect();
+    await vi.waitFor(() => expect(spy).toHaveBeenCalledTimes(1));
+    t.disconnect();
+  });
+});
+
+describe("SSETransport framing", () => {
+  it("emits an event per frame", async () => {
+    const f = makeFetch();
+    const conn = streamingResponse();
+    f.queue.push(() => conn.res);
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.statuses).toContain("live"));
+
+    conn.push(
+      frame("2026-08-01T00:00:01Z", {
+        table_name: "clicks",
+        received_timestamp: "2026-08-01T00:00:01Z",
+        data: { a: 1 },
+      }),
+    );
+    await vi.waitFor(() => expect(seen.events).toHaveLength(1));
+
+    expect(seen.events[0]).toEqual({
+      table: "clicks",
+      timestamp: "2026-08-01T00:00:01Z",
+      data: { a: 1 },
+    });
+    t.disconnect();
+  });
+
+  it("ignores comment frames — the connect preamble and keepalives", async () => {
+    const f = makeFetch();
+    const conn = streamingResponse();
+    f.queue.push(() => conn.res);
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.statuses).toContain("live"));
+
+    conn.push(": connected\n\n");
+    conn.push(": keepalive\n\n");
     await flush();
 
-    const url = new URL(opened[0]);
-    expect(url.pathname).toBe("/api/warehouse/v1/stream");
-    expect(url.searchParams.get("since")).toBe("2024-01-01T00:00:00Z");
-    expect(url.searchParams.get("token")).toBe("my-token");
+    expect(seen.events).toHaveLength(0);
+    expect(seen.errors).toHaveLength(0);
+    t.disconnect();
   });
 
-  it("omits the token param when auth resolves empty", async () => {
-    new SSETransport({
-      baseURL: "https://app.example.com/api/warehouse",
+  it("reassembles a frame split across chunk boundaries", async () => {
+    const f = makeFetch();
+    const conn = streamingResponse();
+    f.queue.push(() => conn.res);
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.statuses).toContain("live"));
+
+    // A single frame delivered one character at a time — the boundary case a
+    // naive `prefix + chunk` parser corrupts.
+    const whole = frame("id-1", {
+      table_name: "clicks",
+      received_timestamp: "2026-08-01T00:00:02Z",
+      data: { split: true },
+    });
+    for (const ch of whole) conn.push(ch);
+    await vi.waitFor(() => expect(seen.events).toHaveLength(1));
+
+    expect(seen.events[0].data).toEqual({ split: true });
+    t.disconnect();
+  });
+
+  it("warns on a malformed payload without emitting or erroring", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const f = makeFetch();
+    const conn = streamingResponse();
+    f.queue.push(() => conn.res);
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.statuses).toContain("live"));
+
+    conn.push("id: x\ndata: {not json\n\n");
+    await vi.waitFor(() => expect(warn).toHaveBeenCalled());
+
+    expect(seen.events).toHaveLength(0);
+    expect(seen.errors).toHaveLength(0);
+    t.disconnect();
+  });
+});
+
+describe("SSETransport reconnect and resumption", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  it("resumes from the last non-empty id and re-mints the token", async () => {
+    const f = makeFetch();
+    const first = streamingResponse();
+    const second = streamingResponse();
+    f.queue.push(
+      () => first.res,
+      () => second.res,
+    );
+
+    let issued = 0;
+    const t = new SSETransport({
+      baseURL: BASE,
       table: "clicks",
-      auth: async () => "",
-    }).connect();
+      auth: () => `token-${++issued}`,
+      fetch: f.impl,
+    });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    first.push(
+      frame("2026-08-01T00:00:03Z", {
+        table_name: "clicks",
+        received_timestamp: "2026-08-01T00:00:03Z",
+        data: { n: 1 },
+      }),
+    );
+    await vi.waitFor(() => expect(seen.events).toHaveLength(1));
+
+    // A passthrough payload carries a blank id. Per the SSE spec that clears
+    // the last-event-id, which would silently lose the resumption point.
+    first.push("id: \ndata: {}\n\n");
+    await vi.waitFor(() => expect(seen.events).toHaveLength(2));
+
+    first.close();
+    await vi.advanceTimersByTimeAsync(2000);
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(2));
+
+    expect(headersOf(f.attempts[1])["Last-Event-ID"]).toBe("2026-08-01T00:00:03Z");
+    expect(headersOf(f.attempts[1]).Authorization).toBe("Bearer token-2");
+    expect(seen.statuses).toContain("reconnecting");
+
+    t.disconnect();
+  });
+
+  it("escalates backoff against a server that accepts and instantly closes", async () => {
+    const attempts: number[] = [];
+    // Slow-consumer eviction looks exactly like this: a clean 200 that closes
+    // immediately. Resetting the schedule on any connection that merely opened
+    // would pin the client at sub-second retries forever.
+    const impl: FetchLike = async () => {
+      attempts.push(Date.now());
+      const conn = streamingResponse();
+      conn.push(": connected\n\n");
+      conn.close();
+      return conn.res;
+    };
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: impl });
+    collect(t);
+    t.connect();
+    await vi.advanceTimersByTimeAsync(6_000);
+
+    // Escalating, the cheapest possible schedule is 0.5 + 1 + 2 + 4s, so six
+    // seconds buys at most four attempts. Flat sub-second retries gave eight.
+    expect(attempts.length).toBeGreaterThan(1);
+    expect(attempts.length).toBeLessThanOrEqual(5);
+    // The count alone would also pass on a flat ~1.2s schedule. Jitter spans
+    // [n/2, n) and n doubles, so consecutive gaps cannot overlap and each must
+    // strictly exceed the last.
+    const gaps = attempts.slice(1).map((at, i) => at - attempts[i]);
+    for (let i = 1; i < gaps.length; i++) {
+      expect(gaps[i]).toBeGreaterThan(gaps[i - 1]);
+    }
+
+    t.disconnect();
+  });
+
+  it("honors a server `retry:` as a backoff floor, clamped to the ceiling", async () => {
+    const f = makeFetch();
+    const first = streamingResponse();
+    f.queue.push(() => first.res);
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    // Server-controlled input into client timing, so the clamp matters: an
+    // hour would otherwise strand the stream far past the 30s ceiling.
+    first.push("retry: 3600000\n\n");
+    await vi.advanceTimersByTimeAsync(1);
+    first.close();
+
+    // Well past the un-clamped floor's first attempt, still inside an hour.
+    await vi.advanceTimersByTimeAsync(120_000);
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(2));
+
+    t.disconnect();
+  });
+
+  it("reports an unparseable frame without dropping the connection", async () => {
+    const f = makeFetch();
+    const first = streamingResponse();
+    f.queue.push(() => first.res);
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.statuses).toContain("live"));
+
+    first.push("bogus: x\n\n");
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+    expect(seen.errors[0].code).toBe("SSE_PARSE_ERROR");
+
+    // Documented as reported-and-skipped: one bad frame must not cost the
+    // stream, so the same connection keeps delivering.
+    expect(seen.statuses).not.toContain("reconnecting");
+    first.push(
+      frame("2026-08-01T00:00:11Z", {
+        table_name: "clicks",
+        received_timestamp: "2026-08-01T00:00:11Z",
+        data: { ok: true },
+      }),
+    );
+    await vi.waitFor(() => expect(seen.events).toHaveLength(1));
+    expect(f.attempts).toHaveLength(1);
+
+    t.disconnect();
+  });
+
+  it("honors a `retry:` floor exactly, without jittering below it", async () => {
+    // Deterministic: with random() pinned to 0 the pre-fix code drew the
+    // bottom of [nominal/2, nominal) — half the floor the server asked for.
+    vi.spyOn(Math, "random").mockReturnValue(0);
+    const f = makeFetch();
+    const first = streamingResponse();
+    f.queue.push(() => first.res);
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    first.push("retry: 20000\n\n");
+    await vi.advanceTimersByTimeAsync(1);
+    first.close();
+
+    // Pre-fix this re-dialed at 10s; the floor says 20s.
+    await vi.advanceTimersByTimeAsync(19_999);
+    expect(f.attempts).toHaveLength(1);
+
+    await vi.advanceTimersByTimeAsync(2);
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(2));
+
+    t.disconnect();
+  });
+
+  it("ends the connection on a buffer overflow, with no second error", async () => {
+    const f = makeFetch();
+    const first = streamingResponse();
+    const second = streamingResponse();
+    f.queue.push(
+      () => first.res,
+      () => second.res,
+    );
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    // One unterminated line past the cap. The parser reports the overflow and
+    // terminates itself; feeding it again throws and would surface as a second,
+    // misleading SSE_READ_ERROR blaming the read for a cause already reported.
+    first.push(`data: ${"x".repeat(MAX_BUFFER_CHARS)}`);
+    // Enqueued before the first read completes, because the early return makes
+    // `_pump`'s finally cancel the reader — a later push would throw on a
+    // closed stream. Without the fix the loop feeds this to the terminated
+    // parser, which throws and adds a second, misleading SSE_READ_ERROR.
+    first.push("data: {}\n\n");
+    await vi.waitFor(() => expect(seen.errors.length).toBeGreaterThan(0));
+
+    await vi.advanceTimersByTimeAsync(2000);
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(2));
+
+    // Asserted only after the reconnect, so a second error would have had
+    // every chance to land. Checked before the reconnect this cannot fail.
+    expect(seen.errors.map((e) => e.code)).toEqual(["SSE_PARSE_ERROR"]);
+
+    t.disconnect();
+  });
+
+  it("retries an AbortError from a custom fetch that the SDK did not raise", async () => {
+    const f = makeFetch();
+    // The motivating case: an `options.fetch` enforcing its own per-attempt
+    // deadline aborts an internal controller. The caller never cancelled, so
+    // this is transient — matching on the error type ended the stream
+    // terminally and emitted nothing at all.
+    f.queue.push(() => {
+      throw new DOMException("Aborted", "AbortError");
+    });
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].code).toBe("SSE_NETWORK_ERROR");
+    expect(seen.errors[0].retryable).toBe(true);
+
+    await vi.advanceTimersByTimeAsync(2000);
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(2));
+
+    t.disconnect();
+  });
+
+  it("reports an AbortError raised mid-read instead of swallowing it", async () => {
+    const f = makeFetch();
+    const first = streamingResponse();
+    const second = streamingResponse();
+    f.queue.push(
+      () => first.res,
+      () => second.res,
+    );
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.statuses).toContain("live"));
+
+    // Same rule on the read path: an abort we did not raise is a dropped
+    // connection to report and re-dial, not a silent teardown.
+    first.fail(new DOMException("Aborted", "AbortError"));
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].code).toBe("SSE_READ_ERROR");
+    await vi.advanceTimersByTimeAsync(2000);
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(2));
+
+    t.disconnect();
+  });
+
+  it("reconnects after the body errors mid-read, resuming from the last id", async () => {
+    const f = makeFetch();
+    const first = streamingResponse();
+    const second = streamingResponse();
+    f.queue.push(
+      () => first.res,
+      () => second.res,
+    );
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    first.push(
+      frame("2026-08-01T00:00:09Z", {
+        table_name: "clicks",
+        received_timestamp: "2026-08-01T00:00:09Z",
+        data: { n: 1 },
+      }),
+    );
+    await vi.waitFor(() => expect(seen.events).toHaveLength(1));
+
+    // A reset connection, not a clean close — the read rejects rather than
+    // reporting done, which is the branch that has to tell a genuine failure
+    // apart from an abort before deciding to re-dial.
+    first.fail(new Error("ECONNRESET"));
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].code).toBe("SSE_READ_ERROR");
+    expect(seen.errors[0].retryable).toBe(true);
+
+    await vi.advanceTimersByTimeAsync(2000);
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(2));
+    expect(headersOf(f.attempts[1])["Last-Event-ID"]).toBe("2026-08-01T00:00:09Z");
+
+    t.disconnect();
+  });
+
+  it("stops for good on a 401 rather than retrying a rejected token", async () => {
+    const f = makeFetch();
+    f.queue.push(() => new Response(JSON.stringify({ error: "invalid token" }), { status: 401 }));
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].status).toBe(401);
+    expect(seen.errors[0].message).toBe("invalid token");
+    expect(seen.statuses).toContain("closed");
+
+    await vi.advanceTimersByTimeAsync(60_000);
+    expect(f.attempts).toHaveLength(1);
+  });
+
+  it("retries a 503", async () => {
+    const f = makeFetch();
+    f.queue.push(() => new Response("{}", { status: 503 }));
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].retryable).toBe(true);
+    await vi.advanceTimersByTimeAsync(2000);
+    await vi.waitFor(() => expect(f.attempts.length).toBeGreaterThan(1));
+
+    t.disconnect();
+  });
+
+  it("retries when the connection itself fails", async () => {
+    const f = makeFetch();
+    f.queue.push(() => {
+      throw new TypeError("connect ECONNREFUSED");
+    });
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].code).toBe("SSE_NETWORK_ERROR");
+    await vi.advanceTimersByTimeAsync(2000);
+    await vi.waitFor(() => expect(f.attempts.length).toBeGreaterThan(1));
+
+    t.disconnect();
+  });
+});
+
+describe("SSETransport lifecycle", () => {
+  it("does not leave an unhandled rejection when releasing an errored body", async () => {
+    // Cancelling an errored stream returns a *rejected* promise. Unhandled,
+    // that takes the host process down under Node's default
+    // `--unhandled-rejections=throw` — so a connection reset arriving between
+    // the headers and a terminal branch would kill the consumer's app.
+    const rejections: unknown[] = [];
+    const onRejection = (reason: unknown) => rejections.push(reason);
+    process.on("unhandledRejection", onRejection);
+
+    try {
+      const f = makeFetch();
+      f.queue.push(() => {
+        const conn = streamingResponse();
+        // Wrong content type, so this takes a terminal branch that releases
+        // the body rather than reading it...
+        const res = new Response(conn.res.body, {
+          status: 200,
+          headers: { "Content-Type": "text/html" },
+        });
+        conn.fail(new Error("ECONNRESET")); // ...and the body is already errored.
+        return res;
+      });
+
+      const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+      const seen = collect(t);
+      t.connect();
+      await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+      expect(seen.errors[0].code).toBe("SSE_BAD_CONTENT_TYPE");
+
+      // Unhandled rejections surface a turn after the microtask queue drains.
+      await new Promise((r) => setTimeout(r, 20));
+      expect(rejections).toEqual([]);
+    } finally {
+      process.off("unhandledRejection", onRejection);
+    }
+  });
+
+  it("rejects a response whose body was already consumed", async () => {
+    const f = makeFetch();
+    f.queue.push(() => {
+      const res = new Response("id: x\ndata: {}\n\n", {
+        status: 200,
+        headers: { "Content-Type": "text/event-stream" },
+      });
+      // What a wrapper that read the body before returning hands back. The
+      // body is still non-null — merely locked — so an `if (!body)` guard
+      // sails past it, reports "live", and then throws out of the read loop.
+      res.body?.getReader();
+      return res;
+    });
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].code).toBe("SSE_NO_STREAM_BODY");
+    expect(seen.statuses).not.toContain("live");
+    expect(seen.statuses).toContain("closed");
+  });
+
+  it("rejects a fetch that cannot stream instead of hanging", async () => {
+    const f = makeFetch();
+    // Exactly what a wrapper that buffers or logs the body hands back: the
+    // server's headers intact, the stream itself already consumed.
+    f.queue.push(
+      () =>
+        new Response(null, {
+          status: 200,
+          headers: { "Content-Type": "text/event-stream" },
+        }),
+    );
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].code).toBe("SSE_NO_STREAM_BODY");
+    expect(seen.errors[0].retryable).toBe(false);
+    expect(seen.statuses).toContain("closed");
+  });
+
+  it("emits closed once, however many times disconnect is called", async () => {
+    const f = makeFetch();
+    const t = new SSETransport({ baseURL: "http://x", table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    t.disconnect();
+    t.disconnect();
+    t.disconnect();
+
+    // The emit deliberately bypasses `_emitStatus` (which returns early once
+    // `_closed` is set), so it has to sit inside the teardown guard or every
+    // redundant call re-fires it.
+    expect(seen.statuses.filter((s) => s === "closed")).toHaveLength(1);
+  });
+
+  it("ends the stream on a baseURL that cannot resolve", async () => {
+    vi.useFakeTimers();
+    const f = makeFetch();
+    const t = new SSETransport({ baseURL: "not-a-url", table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].code).toBe("SSE_CONNECT_ERROR");
+    expect(seen.errors[0].retryable).toBe(false);
+    expect(seen.statuses).toContain("closed");
+
+    // Deterministic failure — retrying would only reproduce it.
+    await vi.advanceTimersByTimeAsync(60_000);
+    expect(f.attempts).toHaveLength(0);
+  });
+
+  it("ends the stream on a non-http baseURL scheme", async () => {
+    vi.useFakeTimers();
+    const f = makeFetch();
+    const t = new SSETransport({ baseURL: "ws://localhost:8080", table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].code).toBe("SSE_CONNECT_ERROR");
+    expect(seen.errors[0].message).toContain("http or https");
+    // `fetch` would reject with an opaque failure the loop reads as transient.
+    await vi.advanceTimersByTimeAsync(60_000);
+    expect(f.attempts).toHaveLength(0);
+  });
+
+  it("retries an AbortError from the token provider that the SDK did not raise", async () => {
+    vi.useFakeTimers();
+    const f = makeFetch();
+    let calls = 0;
+    const t = new SSETransport({
+      baseURL: BASE,
+      table: "clicks",
+      auth: () => {
+        calls++;
+        // A refresh call cancelled by its own controller. The SDK never asked
+        // to cancel, so this is transient — matching on the error type instead
+        // of `_closed` ended the stream terminally, and emitted nothing.
+        if (calls === 1) throw new DOMException("Aborted", "AbortError");
+        return "recovered";
+      },
+      fetch: f.impl,
+    });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].code).toBe("SSE_AUTH_ERROR");
+    await vi.advanceTimersByTimeAsync(2000);
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+    expect(headersOf(f.attempts[0]).Authorization).toBe("Bearer recovered");
+
+    t.disconnect();
+  });
+
+  it("keeps retrying when the token provider throws", async () => {
+    vi.useFakeTimers();
+    const f = makeFetch();
+    let calls = 0;
+    const t = new SSETransport({
+      baseURL: BASE,
+      table: "clicks",
+      auth: () => {
+        calls++;
+        if (calls === 1) throw new Error("refresh endpoint down");
+        return "recovered";
+      },
+      fetch: f.impl,
+    });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    // Transient by assumption: `auth` runs per attempt now, so one bad minute
+    // at the token endpoint must not tear down a long-lived stream.
+    expect(seen.errors[0].code).toBe("SSE_AUTH_ERROR");
+    expect(seen.errors[0].retryable).toBe(true);
+    expect(f.attempts).toHaveLength(0);
+
+    await vi.advanceTimersByTimeAsync(2000);
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+    expect(headersOf(f.attempts[0]).Authorization).toBe("Bearer recovered");
+
+    t.disconnect();
+  });
+
+  it("refuses a redirect instead of retrying it forever", async () => {
+    vi.useFakeTimers();
+    const f = makeFetch();
+    // What Node hands back under `redirect: "manual"`; a browser would give an
+    // opaque status-0 response, handled by the same branch.
+    f.queue.push(
+      () => new Response(null, { status: 302, headers: { Location: "https://elsewhere/" } }),
+    );
+
+    const t = new SSETransport({
+      baseURL: BASE,
+      table: "clicks",
+      auth: () => "jwt",
+      fetch: f.impl,
+    });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    // A bearer token alone must make the request credentialed. Asserting only
+    // the resulting error would not pin this: the scripted fetch returns its
+    // 302 regardless of `init.redirect`, so the error fires either way.
+    expect(f.attempts[0].init.redirect).toBe("manual");
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].code).toBe("SSE_REDIRECT");
+    expect(seen.errors[0].retryable).toBe(false);
+    expect(seen.statuses).toContain("closed");
+
+    await vi.advanceTimersByTimeAsync(60_000);
+    expect(f.attempts).toHaveLength(1);
+  });
+
+  it("rejects a 200 that is not an event stream", async () => {
+    vi.useFakeTimers();
+    const f = makeFetch();
+    // An auth gateway answering with its login page: 200, streaming, and
+    // entirely devoid of SSE frames.
+    f.queue.push(
+      () =>
+        new Response("<html>sign in</html>", {
+          status: 200,
+          headers: { "Content-Type": "text/html; charset=utf-8" },
+        }),
+    );
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    expect(seen.errors[0].code).toBe("SSE_BAD_CONTENT_TYPE");
+    expect(seen.errors[0].message).toContain("text/html");
+    expect(seen.statuses).toContain("closed");
+    expect(seen.statuses).not.toContain("live");
+
+    await vi.advanceTimersByTimeAsync(60_000);
+    expect(f.attempts).toHaveLength(1);
+  });
+
+  it("aborts the in-flight request on disconnect", async () => {
+    const f = makeFetch();
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    const signal = f.attempts[0].init.signal as AbortSignal;
+    expect(signal.aborted).toBe(false);
+
+    t.disconnect();
+    expect(signal.aborted).toBe(true);
+    expect(seen.statuses).toContain("closed");
+  });
+
+  it("does not reconnect after disconnect", async () => {
+    vi.useFakeTimers();
+    const f = makeFetch();
+    const conn = streamingResponse();
+    f.queue.push(() => conn.res);
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+
+    t.disconnect();
+    conn.close();
+    await vi.advanceTimersByTimeAsync(60_000);
+
+    expect(f.attempts).toHaveLength(1);
+  });
+
+  it("does not report live for a disconnect that lands mid-handshake", async () => {
+    let settle: ((r: Response) => void) | undefined;
+    const impl: FetchLike = () =>
+      new Promise<Response>((resolve) => {
+        settle = resolve;
+      });
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: impl });
+    const seen = collect(t);
+    t.connect();
+    await vi.waitFor(() => expect(settle).toBeTypeOf("function"));
+
+    // Aborting doesn't retract a Response that is already on its way back, so
+    // the happy-path continuation still runs. Left unguarded it flips a closed
+    // controller to "live" and strands it there — the loop exits without
+    // emitting anything further.
+    t.disconnect();
+    settle?.(streamingResponse().res);
+    await flush();
+
+    expect(seen.statuses).toContain("closed");
+    expect(seen.statuses).not.toContain("live");
+    expect(seen.statuses[seen.statuses.length - 1]).toBe("closed");
+  });
+
+  it("strands no timer when closed from inside the reconnecting handler", async () => {
+    vi.useFakeTimers();
+    // A server that accepts and immediately closes, so the loop reaches its
+    // backoff and emits "reconnecting".
+    const impl: FetchLike = async () => {
+      const conn = streamingResponse();
+      conn.push(": connected\n\n");
+      conn.close();
+      return conn.res;
+    };
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: impl });
+    const seen = collect(t);
+    t.onStatus = (st) => {
+      seen.statuses.push(st);
+      // `_wake` is still null at this instant — the timer does not exist yet —
+      // so a naive implementation installs one nothing can cancel.
+      if (st === "reconnecting") t.disconnect();
+    };
+    t.connect();
+    await vi.waitFor(() => expect(seen.statuses).toContain("reconnecting"));
+    await vi.advanceTimersByTimeAsync(0);
+
+    expect(vi.getTimerCount()).toBe(0);
+    expect(seen.statuses).toContain("closed");
+  });
+
+  it("stops delivering when a subscriber closes from inside its own handler", async () => {
+    const f = makeFetch();
+    const conn = streamingResponse();
+    f.queue.push(() => conn.res);
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    // "Read until I see my event, then stop" — the ordinary pattern, and what
+    // EventSource honored: close() inside a handler ended delivery.
+    t.onEvent = (e) => {
+      seen.events.push(e);
+      t.disconnect();
+    };
+    t.connect();
+    await vi.waitFor(() => expect(seen.statuses).toContain("live"));
+
+    // Both frames arrive in one chunk, as gap-fill replay delivers them, and
+    // the parser dispatches every complete frame in a chunk synchronously.
+    const two =
+      frame("a", { table_name: "clicks", received_timestamp: "a", data: { n: 1 } }) +
+      frame("b", { table_name: "clicks", received_timestamp: "b", data: { n: 2 } });
+    conn.push(two);
     await flush();
 
-    expect(new URL(opened[0]).searchParams.has("token")).toBe(false);
+    expect(seen.events).toHaveLength(1);
+    expect(seen.events[0].data).toEqual({ n: 1 });
+  });
+
+  it("blames the handler, not the frame, when next() throws", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const err = vi.spyOn(console, "error").mockImplementation(() => {});
+    const f = makeFetch();
+    const conn = streamingResponse();
+    f.queue.push(() => conn.res);
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    let first = true;
+    t.onEvent = (e) => {
+      if (first) {
+        first = false;
+        throw new Error("consumer render blew up");
+      }
+      seen.events.push(e);
+    };
+    t.connect();
+    await vi.waitFor(() => expect(seen.statuses).toContain("live"));
+
+    conn.push(frame("id-1", { table_name: "clicks", received_timestamp: "t1", data: { n: 1 } }));
+    await vi.waitFor(() => expect(err).toHaveBeenCalled());
+
+    // A shared catch reported this as "SSE received malformed message",
+    // blaming the server for a well-formed frame the consumer choked on.
+    expect(warn).not.toHaveBeenCalled();
+    expect(err.mock.calls[0][0]).toContain("event handler threw");
+
+    // The property that actually matters: one bad handler call must not cost
+    // the stream. Asserting only the log message pins the symptom, not this.
+    conn.push(frame("id-2", { table_name: "clicks", received_timestamp: "t2", data: { n: 2 } }));
+    await vi.waitFor(() => expect(seen.events).toHaveLength(1));
+    expect(seen.events[0].data).toEqual({ n: 2 });
+
+    t.disconnect();
+    warn.mockRestore();
+    err.mockRestore();
+  });
+
+  it("survives a subscriber whose status handler throws", async () => {
+    const warn = vi.spyOn(console, "error").mockImplementation(() => {});
+    const rejections: unknown[] = [];
+    const onRejection = (r: unknown) => rejections.push(r);
+    process.on("unhandledRejection", onRejection);
+
+    try {
+      const f = makeFetch();
+      const conn = streamingResponse();
+      f.queue.push(() => conn.res);
+
+      const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+      const seen = collect(t);
+      // Unguarded, this unwinds _run into connect()'s terminal handler, which
+      // emits a spurious SSE_CONNECT_ERROR and then calls disconnect() — whose
+      // own onStatus("closed") throws again, out of the .catch(), fatally.
+      t.onStatus = (st) => {
+        seen.statuses.push(st);
+        throw new Error("subscriber blew up");
+      };
+      t.connect();
+      await vi.waitFor(() => expect(seen.statuses).toContain("live"));
+
+      conn.push(frame("id-1", { table_name: "clicks", received_timestamp: "t", data: { n: 1 } }));
+      await vi.waitFor(() => expect(seen.events).toHaveLength(1));
+
+      // The stream is still delivering, and nothing spurious was reported.
+      expect(seen.errors).toHaveLength(0);
+      await new Promise((r) => setTimeout(r, 20));
+      expect(rejections).toEqual([]);
+
+      t.disconnect();
+    } finally {
+      process.off("unhandledRejection", onRejection);
+      warn.mockRestore();
+    }
   });
 
-  it("reports a bad baseURL through onError instead of throwing", async () => {
-    const onError = vi.fn();
-    const t = new SSETransport({ baseURL: "not-a-url", table: "clicks" });
-    t.onError = onError;
+  it("survives a subscriber whose error handler throws", async () => {
+    const warn = vi.spyOn(console, "error").mockImplementation(() => {});
+    const f = makeFetch();
+    f.queue.push(() => new Response(JSON.stringify({ error: "nope" }), { status: 401 }));
+
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    const seen = collect(t);
+    t.onError = (e) => {
+      seen.errors.push(e);
+      throw new Error("subscriber blew up");
+    };
     t.connect();
+    await vi.waitFor(() => expect(seen.errors).toHaveLength(1));
+
+    // A throwing handler must not turn a clean terminal 401 into something else.
+    expect(seen.errors[0].status).toBe(401);
     await flush();
+    expect(seen.errors).toHaveLength(1);
+    warn.mockRestore();
+  });
 
-    expect(opened).toHaveLength(0);
-    expect(onError).toHaveBeenCalledOnce();
-    expect(onError.mock.calls[0][0].code).toBe("SSE_CONNECT_ERROR");
+  it("connect() twice does not start a second reconnect loop", async () => {
+    const f = makeFetch();
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    t.connect();
+    t.connect();
+    await vi.waitFor(() => expect(f.attempts).toHaveLength(1));
+    await flush();
+
+    expect(f.attempts).toHaveLength(1);
+    t.disconnect();
+  });
+
+  it("connect() after disconnect() is inert", async () => {
+    const f = makeFetch();
+    const t = new SSETransport({ baseURL: BASE, table: "clicks", fetch: f.impl });
+    t.disconnect();
+    t.connect();
+    await flush();
+    expect(f.attempts).toHaveLength(0);
   });
 });
diff --git a/clients/ts/src/stream/sse.ts b/clients/ts/src/stream/sse.ts
index 726873f4..4bdd22c4 100644
--- a/clients/ts/src/stream/sse.ts
+++ b/clients/ts/src/stream/sse.ts
@@ -1,4 +1,7 @@
-import type { StreamEvent, StreamStatus, WaveHouseError } from "../types.js";
+import { createParser } from "eventsource-parser";
+import { parseErrorResponse } from "../errors.js";
+import { mergeHeaders } from "../http.js";
+import type { FetchLike, StreamEvent, StreamStatus, WaveHouseError } from "../types.js";
 import { resolveURL } from "../url.js";
 import type { StreamTransport } from "./controller.js";
 
@@ -7,16 +10,114 @@ export interface SSEOptions {
   table: string;
   since?: string;
   auth?: () => Promise<string> | string;
+  fetch?: FetchLike;
+  headers?: Record<string, string>;
+  fetchOptions?: RequestInit;
 }
 
 /** Module-level active SSE connection counter. */
 let activeSSEConnections = 0;
 const SSE_WARN_THRESHOLD = 5;
 
-/** SSE transport. Native EventSource auto-reconnects. */
+/**
+ * Cap on characters the frame parser will buffer before giving up, guarding
+ * against unbounded growth from a malformed or hostile stream. The parser
+ * defaults to unbounded, so this has to be set explicitly. 16 MiB is generous
+ * headroom over the ~1 MiB NATS payload ceiling a single event can carry.
+ *
+ * @internal Exported only so the overflow test can hit the cap exactly; not
+ * re-exported from `index.ts`, so it stays off the public surface.
+ */
+export const MAX_BUFFER_CHARS = 16 * 1024 * 1024;
+
+/** Ceiling for reconnect backoff. */
+const MAX_BACKOFF_MS = 30_000;
+
+/**
+ * How long a connection must stay live before it counts as healthy enough to
+ * reset the backoff. Roughly the fixed delay native `EventSource` used, so a
+ * server that accepts and instantly closes can't be hammered faster than the
+ * transport this replaces.
+ */
+const STABLE_CONNECTION_MS = 3_000;
+
+/**
+ * Delay before reconnect attempt `attempt` (0-based), jittered.
+ *
+ * Unlike the REST backoff in `http.ts`, this one is randomized: REST retries
+ * are spread across independent calls, but every subscriber to a stream that
+ * drops reconnects at the same instant, so a fixed schedule synchronizes the
+ * whole fleet into a thundering herd against a server that is probably already
+ * unwell. Each attempt waits between 50% and 100% of its nominal delay.
+ */
+function backoff(attempt: number, retryFloorMs: number): number {
+  const nominal = Math.max(retryFloorMs, Math.min(1000 * 2 ** attempt, MAX_BACKOFF_MS));
+  // Jitter spans [max(floor, nominal/2), nominal), so a server-requested
+  // `retry:` is honored as the lower bound the SSE spec makes it — jittering
+  // over the whole nominal range could re-dial at half what the server asked.
+  // With no `retry:` (the default) the floor is 0 and this is the full spread.
+  const low = Math.max(retryFloorMs, nominal / 2);
+  return low + Math.random() * (nominal - low);
+}
+
+/**
+ * Hand a response body back to the connection pool on a path that won't read
+ * it. Skipped when locked — `cancel()` throws on a locked stream, and a locked
+ * body was never ours to release anyway.
+ */
+function releaseBody(res: Response): void {
+  // `.catch` is load-bearing, not defensive: cancelling an *errored* stream
+  // returns a rejected promise, and an unhandled rejection takes the host
+  // process down under Node's default `--unhandled-rejections=throw`. A
+  // connection reset between the headers arriving and this call is enough.
+  if (res.body && !res.body.locked) res.body.cancel().catch(() => {});
+}
+
+/** Outcome of one connection attempt, driving the reconnect decision. */
+interface AttemptResult {
+  /** Milliseconds the connection stayed readable; 0 if it never opened. */
+  liveMs: number;
+  /** Stop for good: a bad token or missing table can't be fixed by retrying. */
+  terminal: boolean;
+}
+
+/**
+ * SSE transport over `fetch`.
+ *
+ * Replaces `EventSource`, which cannot set request headers — the reason the JWT
+ * used to ride in `?token=`, where it crossed every intermediary in the request
+ * URI. In exchange for the `Authorization` header this owns what `EventSource`
+ * used to provide: framing, reconnect, and `Last-Event-ID` resumption.
+ */
 export class SSETransport<T = Record<string, unknown>> implements StreamTransport<T> {
   private _opts: SSEOptions;
-  private _es: EventSource | null = null;
+  private _abort: AbortController | null = null;
+  /**
+   * Set by `disconnect()` before it calls `abort()` — both synchronously — so
+   * a rejection caused by our own abort always observes this as `true`. That
+   * makes it a complete and precise test for "did we cause this?", which is
+   * why the catch blocks read it directly instead of matching on the error
+   * type: an `AbortError` we *didn't* raise (a custom `fetch` enforcing a
+   * per-attempt deadline, an `auth()` call cancelled by its own controller) is
+   * a transient failure to re-dial, exactly as on the REST path. Treating one
+   * as a teardown killed the stream permanently, and silently.
+   */
+  private _closed = false;
+  private _started = false;
+  private _counted = false;
+  /**
+   * Most recent non-empty event id, replayed as `Last-Event-ID` on reconnect.
+   *
+   * Deliberately ignores empty ids. The server emits a blank `id:` line for
+   * passthrough payloads, and per the SSE spec an empty `id` field *clears* the
+   * last-event-id — so tracking it faithfully would silently discard the
+   * resumption point mid-stream and re-open from the beginning.
+   */
+  private _lastEventId: string | null = null;
+  /** Reconnect floor most recently requested by the server via `retry:`. */
+  private _retryFloorMs = 0;
+  /** Cuts a reconnect gap short when set — see `_sleep`. */
+  private _wake: (() => void) | null = null;
 
   onEvent: ((event: StreamEvent<T>) => void) | null = null;
   onStatus: ((status: StreamStatus) => void) | null = null;
@@ -27,96 +128,471 @@ export class SSETransport<T = Record<string, unknown>> implements StreamTranspor
   }
 
   connect(): void {
-    if (typeof EventSource === "undefined") {
+    // Idempotent: a second call would leave two reconnect loops racing over one
+    // transport, each re-dialing the other's dropped connection.
+    if (this._closed || this._started) return;
+    this._started = true;
+
+    if (!this._opts.fetch && typeof fetch === "undefined") {
       throw new Error(
-        "[wavehouse] EventSource is not available in this environment. " +
-          "Please provide a global polyfill (e.g., `globalThis.EventSource = require('eventsource')`).",
+        "[wavehouse] global fetch is not available in this environment. " +
+          "Upgrade to Node 22+ or supply one via `options.fetch`.",
+      );
+    }
+
+    activeSSEConnections++;
+    this._counted = true;
+    if (activeSSEConnections > SSE_WARN_THRESHOLD) {
+      console.warn(
+        `[wavehouse] ${activeSSEConnections} SSE connections open. ` +
+          `Browsers limit HTTP/1.1 to 6 connections per domain.`,
       );
     }
 
-    this._doConnect().catch((err) => {
-      this.onError?.({
+    // `_run` resolves rather than rejects on stream failure; this catch is for
+    // a programming error inside the loop itself.
+    this._run().catch((err) => {
+      this._emitError({
         status: 0,
         code: "SSE_CONNECT_ERROR",
         message: err instanceof Error ? err.message : String(err),
-        retryable: true,
+        retryable: false,
       });
+      this.disconnect();
     });
   }
 
   disconnect(): void {
-    if (this._es) {
-      this._es.close();
-      this._es = null;
-      activeSSEConnections = Math.max(0, activeSSEConnections - 1);
+    if (!this._closed) {
+      this._closed = true;
+      this._abort?.abort();
+      this._abort = null;
+      this._wake?.();
+      if (this._counted) {
+        activeSSEConnections = Math.max(0, activeSSEConnections - 1);
+        this._counted = false;
+      }
+      // Same isolation as `_emitStatus`, which this deliberately bypasses:
+      // `_emitStatus` returns early once `_closed` is set, so the terminal
+      // status would never get out. Inside the guard, so a redundant
+      // `disconnect()` is a no-op rather than a second `closed`.
+      try {
+        this.onStatus?.("closed");
+      } catch (e) {
+        console.error("[wavehouse] SSE status handler threw:", e);
+      }
+    }
+  }
+
+  /** Connect/read/reconnect until the stream is closed or hits a terminal error. */
+  private async _run(): Promise<void> {
+    // Yield before the first attempt so a failure that is detectable
+    // synchronously — an unresolvable `baseURL` — still reaches a subscriber.
+    // `connect()` runs inside the StreamController constructor, so anything
+    // emitted before this point fires before `.stream()` has returned and
+    // nobody is listening yet.
+    await Promise.resolve();
+
+    let attempt = 0;
+
+    while (!this._closed) {
+      const { liveMs, terminal } = await this._attempt();
+
+      if (this._closed) return;
+      if (terminal) {
+        this.disconnect();
+        return;
+      }
+
+      // Only a connection that *held* resets the schedule. Resetting on any
+      // connection that merely opened lets a server accepting and immediately
+      // closing (slow-consumer eviction, a half-broken upstream) pin the client
+      // at sub-second retries forever — more aggressive than the ~3s fixed
+      // delay EventSource used, against a server already in trouble.
+      if (liveMs >= STABLE_CONNECTION_MS) attempt = 0;
+
+      this._emitStatus("reconnecting");
+      await this._sleep(backoff(attempt, this._retryFloorMs));
+      attempt++;
     }
-    this.onStatus?.("closed");
   }
 
-  private async _doConnect(): Promise<void> {
+  /** One connection attempt: request, validate, then pump frames until it ends. */
+  private async _attempt(): Promise<AttemptResult> {
+    const ac = new AbortController();
+    this._abort = ac;
+
+    // A URL that won't build is deterministic — every retry produces the same
+    // failure — so it ends the stream rather than looping.
+    let target: string;
+    try {
+      target = this._url();
+    } catch (e) {
+      this._emitError({
+        status: 0,
+        code: "SSE_CONNECT_ERROR",
+        message: e instanceof Error ? e.message : String(e),
+        retryable: false,
+      });
+      return { liveMs: 0, terminal: true };
+    }
+
+    // A token provider that throws is treated as transient, unlike the URL
+    // above: `auth` now runs on every attempt, so a refresh endpoint having a
+    // bad minute would otherwise tear down a healthy long-lived stream.
+    let init: RequestInit;
+    try {
+      init = await this._init(ac.signal);
+    } catch (e) {
+      if (this._closed) return { liveMs: 0, terminal: true };
+      this._emitError({
+        status: 0,
+        code: "SSE_AUTH_ERROR",
+        message: e instanceof Error ? e.message : String(e),
+        retryable: true,
+      });
+      return { liveMs: 0, terminal: false };
+    }
+
+    let res: Response;
+    try {
+      const doFetch = this._opts.fetch;
+      res = doFetch ? await doFetch(target, init) : await fetch(target, init);
+    } catch (e) {
+      if (this._closed) return { liveMs: 0, terminal: true };
+      this._emitError({
+        status: 0,
+        code: "SSE_NETWORK_ERROR",
+        message: e instanceof Error ? e.message : String(e),
+        retryable: true,
+      });
+      return { liveMs: 0, terminal: false };
+    }
+
+    // Redirects are refused, not followed — see `_init`. Surfaced explicitly
+    // because both shapes are otherwise misleading: a browser reports an
+    // opaque status-0 response, and Node hands back the raw 3xx.
+    if (res.type === "opaqueredirect" || (res.status >= 300 && res.status < 400)) {
+      this._emitError({
+        status: res.status,
+        code: "SSE_REDIRECT",
+        message:
+          "The stream endpoint redirected and the SDK did not follow it. Redirects are " +
+          "refused when the request carries a credential — an `auth` token or configured " +
+          "`headers` — because a cross-origin hop strips the Authorization header, and this " +
+          "endpoint answers an unauthenticated caller with a reduced view instead of an " +
+          "error, while forwarding any configured headers to wherever the redirect points. " +
+          "If this request carries neither, `fetch` was left to follow the redirect itself, " +
+          "so arriving here means a response it will not follow (a 304, or a 3xx with no " +
+          "Location header) or an `options.fetch` that returned the redirect verbatim. " +
+          "Either way, set `baseURL` to the final URL; most often this is an http→https " +
+          "upgrade or a canonical-host redirect at a proxy. To follow a credentialed " +
+          "redirect anyway, supply an `options.fetch` that overrides `redirect`.",
+        retryable: false,
+      });
+      releaseBody(res);
+      return { liveMs: 0, terminal: true };
+    }
+
+    if (!res.ok) {
+      const error = await parseErrorResponse(res);
+      this._emitError(error);
+      // 4xx is terminal: whatever rejected this usually won't be talked round
+      // by repeating the request, and native EventSource likewise stops on
+      // non-200. The exception is a 429/408 from a fronting rate limiter, which
+      // is transient even though the stream still ends (#469). Note WaveHouse
+      // doesn't reject here *for authentication* — the endpoint is ungated and
+      // answers a bad token with a reduced view, which is why `auth` is re-read
+      // per attempt (#239 tracks enforcing expiry). The one 4xx it raises itself
+      // is a 400 on this route for a missing or empty `table`
+      // (internal/api/stream.go); a 404/405 means the request missed the route
+      // entirely (router.go's chi handlers), and anything else comes from
+      // something in front — a gateway, or a proxy.
+      return { liveMs: 0, terminal: !error.retryable };
+    }
+
+    // A 200 that isn't an event stream is an intermediary answering for the
+    // server — an auth gateway serving its login page is the common one. Left
+    // unchecked the parser would chew HTML, find no frames, and leave the
+    // stream "live" and permanently silent, indistinguishable from a quiet
+    // table. `EventSource` fails the connection here too.
+    const contentType = res.headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().split(";")[0].trim().startsWith("text/event-stream")) {
+      this._emitError({
+        status: res.status,
+        code: "SSE_BAD_CONTENT_TYPE",
+        message: `Expected \`text/event-stream\`, got \`${contentType || "(none)"}\`. Something between the client and WaveHouse answered this request — an auth gateway's login page is the usual cause.`,
+        retryable: false,
+      });
+      releaseBody(res);
+      return { liveMs: 0, terminal: true };
+    }
+
+    // `options.fetch` only has to stream on this path — every REST call reads
+    // the body with `.text()`. A wrapper that buffers, or clones and logs the
+    // body, satisfies REST and then hangs here forever, so say so instead.
+    // `locked` and `bodyUsed` both matter and neither implies the other: after
+    // `.text()` both are set, but after a bare `getReader()` only `locked` is.
+    const body = res.body;
+    if (!body || typeof body.getReader !== "function" || body.locked || res.bodyUsed) {
+      this._emitError({
+        status: res.status,
+        code: "SSE_NO_STREAM_BODY",
+        message:
+          "Streaming requires a response with a readable body. The configured `options.fetch` " +
+          "returned one whose body is absent or already read — an implementation that buffers " +
+          "or consumes the response cannot be used for `.stream()` or `.liveQuery()`.",
+        retryable: false,
+      });
+      releaseBody(res);
+      return { liveMs: 0, terminal: true };
+    }
+
+    this._emitStatus("live");
+    const openedAt = Date.now();
+    await this._pump(body);
+    return { liveMs: Date.now() - openedAt, terminal: false };
+  }
+
+  /** Resolve the stream URL. Throws on a `baseURL` that isn't a usable http(s) origin. */
+  private _url(): string {
     const url = resolveURL(this._opts.baseURL, "/v1/stream");
+    // Caught here rather than at `fetch`, which reports an unusable scheme as a
+    // generic failure the loop would then retry forever. `baseURL` must be
+    // absolute, so a bare host throws out of `resolveURL` above; this catches
+    // the absolute-but-wrong case, `ws://` being the tempting one for streams.
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      throw new Error(
+        `baseURL must use http or https, got "${url.protocol}". Streaming is plain HTTP — there is no WebSocket endpoint.`,
+      );
+    }
     url.searchParams.set("table", this._opts.table);
     if (this._opts.since) {
       url.searchParams.set("since", this._opts.since);
     }
+    return url.toString();
+  }
 
-    // EventSource can't set request headers, so the JWT goes in ?token=
-    // (the server also accepts an Authorization header for non-browser clients)
+  /** Build the request init, minting a token for this attempt. */
+  private async _init(signal: AbortSignal): Promise<RequestInit> {
+    const base: Record<string, string> = { Accept: "text/event-stream" };
+
+    // Resolved per attempt, not once per stream: a stream outlives its token,
+    // and a reconnect replaying an expired JWT authenticates as no one — which
+    // this endpoint answers with a silently reduced view, not an error.
     if (this._opts.auth) {
       const token = await this._opts.auth();
       if (token) {
-        url.searchParams.set("token", token);
+        base.Authorization = `Bearer ${token}`;
       }
     }
 
-    activeSSEConnections++;
-    if (activeSSEConnections > SSE_WARN_THRESHOLD) {
-      console.warn(
-        `[wavehouse] ${activeSSEConnections} SSE connections open. ` +
-          `Browsers limit HTTP/1.1 to 6 connections per domain.`,
-      );
+    // Takes precedence over `since` server-side, so the initial window stays on
+    // the URL and resumption rides the header once there's something to resume.
+    if (this._lastEventId) {
+      base["Last-Event-ID"] = this._lastEventId;
     }
 
-    this._es = new EventSource(url.toString());
+    // Anything a redirect target must not be handed: the bearer token, or the
+    // configured headers that carry proxy service-token secrets.
+    const credentialed =
+      base.Authorization !== undefined || Object.keys(this._opts.headers ?? {}).length > 0;
 
-    this._es.onopen = () => {
-      this.onStatus?.("live");
+    const init: RequestInit = {
+      ...this._opts.fetchOptions,
+      method: "GET",
+      headers: mergeHeaders(base, this._opts.headers),
+      signal,
+      // Owned by the SDK rather than left to `fetchOptions`, unlike the REST
+      // path, because on a stream these are correctness rather than preference:
+      //
+      //   cache    — as an init field, not a `Cache-Control` header. The header
+      //              form is not in the server's Access-Control-Allow-Headers,
+      //              so it would fail every cross-origin preflight.
+      //   redirect — followed only when this request carries no credential.
+      //              Platforms strip `Authorization` on a cross-origin redirect
+      //              (whatwg/fetch#1544) and forward other headers intact, so a
+      //              credentialed hop either silently downgrades the stream to
+      //              the default role — this endpoint answers an unauthenticated
+      //              caller rather than rejecting them — or delivers a configured
+      //              secret to whatever the redirect names. Neither is worth a
+      //              convenience. Without either, redirects are followed, so CDN
+      //              canonicalization, geo/LB indirection, and an http→https
+      //              upgrade all just work. The test is deliberately that
+      //              concrete pair and not "is this authenticated": cookies do
+      //              not appear in it. A cookie is re-derived per
+      //              destination rather than carried, so under the default
+      //              same-origin credentials mode it survives a redirect only
+      //              while the hop stays inside both the request's origin and
+      //              the cookie's Path; outside either the stream is
+      //              silently unauthed. See #478 and the SDK guide under
+      //              "Supplying your own fetch".
+      //              `manual` over `error` for the credentialed case so the
+      //              outcome stays inspectable: `error` rejects with a bare
+      //              TypeError indistinguishable from a connection failure, which
+      //              the loop above would retry forever against a redirect that
+      //              is never going to stop happening.
+      cache: "no-store",
+      redirect: credentialed ? "manual" : "follow",
+      // Neutralized like the REST path does, and for a sharper reason here: a
+      // body on a GET makes `fetch` throw, which reads as a network failure and
+      // would be retried forever against a request that can never be built.
+      body: undefined,
     };
 
-    this._es.onmessage = (e) => {
-      try {
-        const msg = JSON.parse(e.data as string) as {
-          table_name: string;
-          received_timestamp: string;
-          data: T;
-        };
-        const event: StreamEvent<T> = {
-          table: msg.table_name,
-          timestamp: msg.received_timestamp,
-          data: msg.data,
-        };
-        this.onEvent?.(event);
-      } catch {
-        console.warn("[wavehouse] SSE received malformed message:", e.data);
-        // ignore malformed messages
-      }
-    };
+    // Only browsers get `credentials`: some runtimes (Cloudflare Workers) throw
+    // outright if it is present. Inside a browser an explicit value from
+    // `fetchOptions` survives, which is how a cookie-authenticated origin opts
+    // into `include`.
+    if (!("window" in globalThis)) {
+      delete init.credentials;
+    }
 
-    this._es.onerror = () => {
-      if (this._es?.readyState === EventSource.CONNECTING) {
-        this.onStatus?.("reconnecting");
-      } else if (this._es?.readyState === EventSource.CLOSED) {
-        this.onStatus?.("closed");
-      } else if (this._es?.readyState === EventSource.OPEN) {
-        this.onStatus?.("live");
-      } else {
-        this.onError?.({
+    return init;
+  }
+
+  /** Decode and parse frames until the stream ends, aborts, or errors. */
+  private async _pump(body: ReadableStream<Uint8Array>): Promise<void> {
+    // Set when the parser reports a buffer overflow: it is terminated at that
+    // point, so the read loop must stop rather than feed it again.
+    let overflowed = false;
+    const parser = createParser({
+      onEvent: (msg) => {
+        if (msg.id) this._lastEventId = msg.id;
+        if (!msg.data) return;
+        this._dispatch(msg.data);
+      },
+      onRetry: (ms) => {
+        this._retryFloorMs = Math.min(Math.max(ms, 0), MAX_BACKOFF_MS);
+      },
+      onError: (err) => {
+        if (err.type === "max-buffer-size-exceeded") overflowed = true;
+        this._emitError({
           status: 0,
-          code: "SSE_ERROR",
-          message: "SSE connection error",
+          code: "SSE_PARSE_ERROR",
+          message: err.message,
           retryable: true,
         });
+      },
+      maxBufferSize: MAX_BUFFER_CHARS,
+    });
+
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+
+    try {
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) return;
+        parser.feed(decoder.decode(value, { stream: true }));
+        // End the connection on the overflow we just reported, instead of
+        // feeding a terminated parser and re-reporting it as a read failure.
+        if (overflowed) return;
       }
-    };
+    } catch (e) {
+      if (this._closed) return;
+      this._emitError({
+        status: 0,
+        code: "SSE_READ_ERROR",
+        message: e instanceof Error ? e.message : String(e),
+        retryable: true,
+      });
+    } finally {
+      reader.cancel().catch(() => {
+        // Already torn down — nothing left to release.
+      });
+    }
+  }
+
+  /**
+   * Turn one frame's `data` into a StreamEvent.
+   *
+   * Guarded like `_emitError` and `_emitStatus`: `parser.feed()` dispatches
+   * every complete frame in a chunk synchronously, so a subscriber that closes
+   * from inside its own `next` — "read until I see my event, then stop" —
+   * would otherwise keep receiving the rest of that chunk. `EventSource` ended
+   * delivery on `close()`, and gap-fill replay routinely lands many frames in
+   * one chunk.
+   */
+  private _dispatch(data: string): void {
+    if (this._closed) return;
+
+    // Two failures with one culprit each, so they are caught separately: a
+    // shared catch blamed the server's frame for an exception thrown by the
+    // consumer's own handler, pointing a debugging reader at the wrong side.
+    let event: StreamEvent<T>;
+    try {
+      const msg = JSON.parse(data) as {
+        table_name: string;
+        received_timestamp: string;
+        data: T;
+      };
+      event = { table: msg.table_name, timestamp: msg.received_timestamp, data: msg.data };
+    } catch {
+      console.warn("[wavehouse] SSE received malformed message:", data);
+      return; // ignore malformed messages
+    }
+
+    try {
+      this.onEvent?.(event);
+    } catch (e) {
+      console.error("[wavehouse] SSE event handler threw:", e);
+    }
+  }
+
+  /** Suppress callbacks that race a `disconnect()`. */
+  private _emitError(error: WaveHouseError): void {
+    if (this._closed) return;
+    // Guarded like `_dispatch`: a subscriber that throws must not take the
+    // transport with it. Unguarded, the throw unwinds `_run` into `connect()`'s
+    // terminal handler, which reports a spurious SSE_CONNECT_ERROR and then
+    // calls `disconnect()` — whose own `onStatus("closed")` throws again, this
+    // time out of the `.catch()`, as a process-fatal unhandled rejection.
+    // `EventSource` isolated a throwing handler and kept streaming. Note this
+    // protects the transport, not the fan-out: StreamController still stops
+    // delivering to later subscribers when an earlier one throws (#473).
+    try {
+      this.onError?.(error);
+    } catch (e) {
+      console.error("[wavehouse] SSE error handler threw:", e);
+    }
+  }
+
+  /**
+   * Same guard for status. Aborting does not retract an already-resolved
+   * `Response`, so a `disconnect()` landing between the fetch settling and the
+   * "live" below would otherwise flip a closed controller back to live — and it
+   * stays there, since the loop then exits without emitting anything further.
+   * `disconnect()` calls `onStatus` directly; that terminal "closed" is the one
+   * status that must always get through.
+   */
+  private _emitStatus(status: StreamStatus): void {
+    if (this._closed) return;
+    try {
+      this.onStatus?.(status);
+    } catch (e) {
+      console.error("[wavehouse] SSE status handler threw:", e);
+    }
+  }
+
+  /** Wait out a reconnect gap, cut short by `disconnect()`. */
+  private _sleep(ms: number): Promise<void> {
+    // `_wake` only cuts a gap short once the timer exists. A `disconnect()`
+    // raised synchronously from the "reconnecting" status callback runs a line
+    // earlier than that, so without this the loop would install a timer nobody
+    // can cancel and hold the event loop open for the whole backoff — the one
+    // hole in the `_wake` machinery.
+    if (this._closed) return Promise.resolve();
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        this._wake = null;
+        resolve();
+      }, ms);
+      this._wake = () => {
+        clearTimeout(timer);
+        this._wake = null;
+        resolve();
+      };
+    });
   }
 }
diff --git a/clients/ts/src/types.ts b/clients/ts/src/types.ts
index a77b9685..740ce0d8 100644
--- a/clients/ts/src/types.ts
+++ b/clients/ts/src/types.ts
@@ -10,9 +10,15 @@ export type Database = Record<string, Record<string, unknown>>;
 // --- Result types ---
 
 /**
- * Discriminated union for all async SDK operations. Never throws for anything
- * the server returns — caller and environment errors (a non-absolute `baseURL`,
- * a missing `EventSource`, a rejecting `auth` callback) do throw.
+ * Discriminated union for the async SDK calls that return one. Never throws for
+ * anything the server returns; a non-absolute `baseURL` and a rejecting `auth`
+ * callback do throw, while a runtime with no `fetch` at all surfaces instead as
+ * a retried `NETWORK_ERROR` result.
+ *
+ * `.stream()` and `.liveQuery()` return no `Result` and report the same three
+ * differently: a non-absolute `baseURL` reaches the subscriber's `error`
+ * callback as a terminal `SSE_CONNECT_ERROR`, a rejecting `auth` as a retryable
+ * `SSE_AUTH_ERROR`, and only a missing `fetch` throws from the call itself.
  *
  * Discriminated on `ok`: `if (result.ok)` narrows to the success arm (and tells
  * the compiler `data` is present), while `error` is always available for
@@ -87,26 +93,44 @@ export interface ClientConfig<_DB extends Database = Database> {
  * depending on whether the consumer's TypeScript `lib` includes DOM — the same
  * signature either way, but stable across configurations.
  *
- * In practice the SDK only ever calls it with a string URL, and reads `.ok` and
- * `.headers` always, `.text()` on success, and `.status`, `.statusText` plus
- * `.json()` when the response is not `ok`. A rejection becomes a
- * `NETWORK_ERROR` result and is retried with backoff — except a `DOMException`
- * named `AbortError` (what the platform `fetch` and undici throw on abort),
- * which becomes `ABORTED` and is not retried. Implementations that reject with
- * some other abort error, such as `node-fetch`, are retried instead.
+ * The parameter is `string` rather than `typeof fetch`'s wider union because a
+ * string URL is all the SDK ever passes. Since parameters are contravariant,
+ * narrowing it *widens* what can be assigned: the global `fetch` still fits, and
+ * so does hand-written `(url: string, init?: RequestInit) => Promise<Response>`
+ * middleware, which the wider spelling rejects at compile time.
+ *
+ * On REST the SDK reads `.ok` and `.headers` always, `.text()` on success, and
+ * `.status`, `.statusText` plus `.json()` when the response is not `ok`. A
+ * rejection becomes a `NETWORK_ERROR` result and is retried with backoff —
+ * unless the `AbortSignal` you passed has been aborted, in which case the
+ * result is `ABORTED` and nothing is retried. That is decided from the signal
+ * rather than the rejection's type, so an implementation that throws something
+ * other than a `DOMException` named `AbortError` — `AbortSignal.timeout()`,
+ * `node-fetch` — is reported the same way.
+ *
+ * **Streaming needs more.** `.stream()` and `.liveQuery()` read the response as
+ * it arrives, via `.body.getReader()`, so an implementation used with them must
+ * return a response carrying a live `ReadableStream` — something the type cannot
+ * enforce, since `Response.body` is legitimately nullable. A response handed
+ * back with an absent or already-consumed body fails fast with
+ * `SSE_NO_STREAM_BODY`. What the SDK *cannot* rescue is an implementation that
+ * awaits the body before returning — `await res.text()`, or the
+ * `res.clone().text()` a logging wrapper reaches for — because on a stream that
+ * never ends, that never resolves and your function never returns. Both satisfy
+ * every REST call, which is what makes the trap easy to walk into.
  *
  * Implementations shipping their own request/response declarations (undici,
- * `node-fetch`) need casts on the URL, the init and the return value, since
- * those types are separate from the ones behind your global `fetch`; the
- * narrow runtime contract above is what makes them safe.
+ * `node-fetch`) need casts on the init and the return value, since those types
+ * are separate from the ones behind your global `fetch`; the narrow runtime
+ * contract above is what makes them safe.
  */
-export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 
 export interface ClientOptions {
   /** Maximum retry attempts for failed requests. Default: 2. */
   maxRetries?: number;
   /**
-   * HTTP implementation used for every REST request (SSE streams excluded).
+   * HTTP implementation used for every request, REST and streaming alike.
    * Defaults to the global `fetch`.
    *
    * Provide one to route through a proxy, attach client certificates, add
@@ -125,19 +149,18 @@ export interface ClientOptions {
    *   baseURL,
    *   options: {
    *     fetch: (url, init) =>
-   *       undiciFetch(url as string, { ...init, dispatcher } as never) as unknown as Promise<Response>,
+   *       undiciFetch(url, { ...init, dispatcher } as never) as unknown as Promise<Response>,
    *   },
    * });
    * ```
    *
-   * Only the SSE transport is exempt: the live connection behind `.stream()`
-   * and `.liveQuery()` uses `EventSource`, which this does not replace.
-   * `.liveQuery()`'s initial backfill is an ordinary request and does go
-   * through your function.
+   * `.stream()` and `.liveQuery()` go through it too, which imposes the extra
+   * streaming requirement described on {@link FetchLike} — read that before
+   * supplying a wrapper that touches the response body.
    */
   fetch?: FetchLike;
   /**
-   * Headers added to every REST request (SSE streams excluded) — for a
+   * Headers added to every request, REST and streaming alike — for a
    * header-gated proxy in front of WaveHouse, such as a Cloudflare Access
    * service token.
    *
@@ -146,16 +169,44 @@ export interface ClientOptions {
    * `Content-Type` and `Accept` a given request needs are not overridable
    * here — a global `Content-Type` that outranked the request's own is a
    * documented way to break uploads.
+   *
+   * In a browser these are subject to CORS: a header outside the safelist adds
+   * it to the preflight, which the origin must allow. WaveHouse's own CORS
+   * advertises a fixed set, so custom headers reach it cross-origin only when
+   * a proxy in front terminates the preflight — which is the deployment they
+   * exist for. Server-side callers never preflight.
    */
   headers?: Record<string, string>;
   /**
-   * Extra `RequestInit` fields merged into every REST request — `credentials`
-   * for a cookie-authenticated origin, `mode`, `cache`, `keepalive`, or a
+   * Extra `RequestInit` fields merged into every request — `credentials` for a
+   * cookie-authenticated origin, `mode`, `cache`, `keepalive`, or a
    * runtime-specific extension such as Next.js's `next: { tags }`.
    *
    * Fields the SDK controls (`method`, `headers`, `body`, `signal`) always
    * win, so this cannot corrupt the request itself. Non-standard fields may
    * need a cast, since `RequestInit` only declares the standard ones.
+   *
+   * The streaming transport additionally owns `cache` and `redirect`, where the
+   * values are load-bearing rather than preference: a `Cache-Control` header
+   * would fail cross-origin preflight, and following a redirect would strip the
+   * `Authorization` header on a cross-origin hop and silently downgrade the
+   * stream to the default role instead of failing. So a request carrying an
+   * `auth` token, or configured `headers` that may hold a proxy secret, refuses
+   * redirects (`SSE_REDIRECT`); without either it follows them, so CDN
+   * canonicalization and an http→https upgrade still work. Note the test is
+   * that concrete pair, not "is this authenticated" — **cookies are invisible
+   * to it**. A cookie is re-derived from the cookie store at each hop rather
+   * than carried, so under the default `same-origin` credentials mode a
+   * redirect keeps the stream authenticated only while the hop stays inside
+   * both the request's origin and the cookie's `Path`; a hop outside either
+   * arrives with no cookie and gets a `default_role` view rather than an error.
+   * With `credentials: "include"` the origin half is replaced rather than
+   * lifted: ordinary cookie scoping decides, so the cookie crosses a
+   * CORS-allowed cross-origin hop only if its own `Domain` covers the target —
+   * a host-only cookie, the default, still stops at its host. Spelled out
+   * under "Supplying your own `fetch`" in the SDK guide; see #478.
+   * `credentials` itself is honored in browsers and dropped elsewhere, since
+   * some runtimes throw if it is set.
    */
   fetchOptions?: RequestInit;
 }
diff --git a/docs/src/content/docs/api.md b/docs/src/content/docs/api.md
index 52c6416f..c2c60fd3 100644
--- a/docs/src/content/docs/api.md
+++ b/docs/src/content/docs/api.md
@@ -23,7 +23,9 @@ For SSE connections where custom headers are not possible, you can pass the toke
 GET /v1/stream?token=<jwt>
 ```
 
-The `Authorization` header takes precedence when both are provided: the `?token=` query parameter is only a fallback for clients that can't set headers (browser `EventSource`), so a token in the more log-leakable URL never overrides an explicit header credential. A `?token=` is stripped from the URL after extraction whichever credential wins, so it stays out of WaveHouse's own logs — but it has already crossed the wire in the request URI, so redact query strings at any proxy, CDN, or load balancer in front.
+The `Authorization` header takes precedence when both are provided: the `?token=` query parameter is only a fallback for clients that can't set headers — a hand-rolled browser `EventSource`, for instance — so a token in the more log-leakable URL never overrides an explicit header credential. A `?token=` is stripped from the URL after extraction whichever credential wins, so it stays out of WaveHouse's own logs — but it has already crossed the wire in the request URI, so redact query strings at any proxy, CDN, or load balancer in front.
+
+Prefer the header wherever you can. The TypeScript SDK streams over `fetch` and always uses `Authorization`, on browsers and servers alike; the query parameter exists for clients that have no other option.
 
 **Authentication is decoupled from authorization.** A request with **no token**, or an **invalid/expired/malformed** one, is *not* rejected outright — it falls back to an empty role that resolves to the policy `default_role`, and authorization is decided downstream. Because the bad-token reason is remembered, a request that is then denied for lacking permission fails loud (`401` "invalid/expired token") instead of a bare `403`. Elevated access requires a valid token whose role is granted (or equals the `admin_role`). A `403` body has two forms: a request that resolves to **no role at all** (no token and no `default_role` configured) returns `{"error":"forbidden: request has no role and no public default_role is configured"}`, while a request carrying a concrete-but-unauthorized role returns the bare `{"error":"forbidden"}` shown in the tables below.
 
@@ -583,10 +585,10 @@ Row values of top-level `DateTime`/`DateTime64` columns inside `data` arrive in
 
 **Note:** When access control policies are active, streamed events are filtered per the caller's role: tables without `select` permission are skipped, denied columns are removed from each event, and the role's [row-level `filter`](/access-control#row-level-security) is evaluated per subscriber against the caller's JWT claims — supplied by the connection's token (the `Authorization` header, or the `?token=` fallback above), with replayed gap-fill events filtered the same way. For a filter constant the query path's SQL also accepts ([the enforcement caution](/access-control#where-each-rule-is-enforced) gives per-type guidance), a connection is never delivered a row the query path would hide for that role — every comparison the stream can't prove fails closed and withholds the row instead. Numeric comparisons run in the column's storage domain — both operands narrowed the way ClickHouse narrows the stored value and the bound constant — so columns that narrow on insert (`Float32`/`Float64` width, a `Decimal`'s scale) agree with the query path too; the residual payload-vs-stored case is an event whose insert later fails into the DLQ, which the caution documents. The connection's claims are captured once, when the stream is established — a policy change applies from the next live event (an in-flight gap-fill finishes under the policy snapshot taken when the stream opened), but an expired token or changed claims take effect only when the client reconnects.
 
-**CORS:** `/v1/stream` honors the `server.cors_allowed_origins` allowlist like every endpoint, so a browser `EventSource` from an allowed origin connects normally. `Last-Event-ID` is allow-listed in the CORS preflight so fetch-based clients can resume cross-origin.
+**CORS:** `/v1/stream` honors the `server.cors_allowed_origins` allowlist like every endpoint. Note that a **header-authenticated stream preflights before it connects** — `Authorization` is not CORS-safelisted — where a bare `EventSource` never preflighted at all: its request is not a `fetch()`, so Fetch's unsafe-request flag is never set and `Last-Event-ID` rides on the plain `GET`. Both headers are allow-listed, so an allowed origin connects *and* resumes cross-origin.
 
 :::caution[Behind a proxy: disable response buffering]
-SSE needs one bit of proxy configuration: disable response buffering, or the proxy holds events until a buffer fills and clients receive nothing in real time. Idle timeouts are handled for you — the `:` keepalive comment above keeps a quiet stream alive under typical proxy/tunnel idle windows ([#226](https://github.com/Wave-RF/WaveHouse/issues/226)), so raising the idle/read timeout is now optional. Browser `EventSource` still auto-reconnects (resuming via `Last-Event-ID`) if a connection drops. See [Behind a reverse proxy → Server-Sent Events](/reverse-proxy#server-sent-events-sse) for nginx/Caddy/Cloudflare specifics.
+SSE needs one bit of proxy configuration: disable response buffering, or the proxy holds events until a buffer fills and clients receive nothing in real time. Idle timeouts are handled for you — the `:` keepalive comment above keeps a quiet stream alive under typical proxy/tunnel idle windows ([#226](https://github.com/Wave-RF/WaveHouse/issues/226)), so raising the idle/read timeout is now optional. The TypeScript SDK's stream transport and browser `EventSource` both auto-reconnect (resuming via `Last-Event-ID`) if a connection drops. See [Behind a reverse proxy → Server-Sent Events](/reverse-proxy#server-sent-events-sse) for nginx/Caddy/Cloudflare specifics.
 :::
 
 **curl example:**
diff --git a/docs/src/content/docs/getting-started.md b/docs/src/content/docs/getting-started.md
index 17d02c46..8b368d8f 100644
--- a/docs/src/content/docs/getting-started.md
+++ b/docs/src/content/docs/getting-started.md
@@ -105,7 +105,7 @@ The handful of things that most often trip up a first session — each is expect
 
 - **[Architecture](/architecture)** — how ingest, query, cache, and streaming fit together.
 - **[API Reference](/api)** — every endpoint, request/response shape, and error code.
-- **[TypeScript SDK](/sdk)** — zero-dependency client with query builder, live queries, and codegen.
+- **[TypeScript SDK](/sdk)** — client with query builder, live queries, and codegen; one runtime dependency.
 - **[Configuration](/configuration)** — full YAML + environment variable reference.
 - **[Deployment](/deployment)** — Docker images, releases, health checks.
 - **[Development](/development)** — building from source, running tests, hot-reload workflow.
diff --git a/docs/src/content/docs/index.mdx b/docs/src/content/docs/index.mdx
index b10e97b1..1c516441 100644
--- a/docs/src/content/docs/index.mdx
+++ b/docs/src/content/docs/index.mdx
@@ -96,7 +96,7 @@ If you're building user-facing analytics, **WaveHouse is like Supabase for Click
   Per-table, per-role column and row-level policies with JWT claim templating. Stored in NATS KV with file-based bootstrap and cluster sync.
  </Card>
  <Card title="TypeScript SDK" icon="seti:typescript">
-  `@wavehouse/sdk` — zero-dependency client with type-safe query builder, live queries, real-time streaming, and codegen from your schemas.
+  `@wavehouse/sdk` — a type-safe query builder, live queries, real-time streaming, and codegen from your schemas, with one runtime dependency of ~1.4 KB gzipped.
  </Card>
 </CardGrid>
 
@@ -104,7 +104,7 @@ If you're building user-facing analytics, **WaveHouse is like Supabase for Click
 
 ## Query it like a database. Subscribe to it like a socket.
 
-The zero-dependency [TypeScript SDK](/sdk) wraps the whole surface — typed inserts, a chainable query builder, and live queries that backfill history before streaming:
+The [TypeScript SDK](/sdk) wraps the whole surface — typed inserts, a chainable query builder, and live queries that backfill history before streaming:
 
 <Tabs>
  <TabItem label="Ingest">
@@ -130,7 +130,7 @@ The zero-dependency [TypeScript SDK](/sdk) wraps the whole surface — typed ins
  </TabItem>
  <TabItem label="Live updates">
   ```ts
-  // Historical backfill + real-time stream, deduplicated at the seam.
+  // Historical backfill, then the live stream.
   const lq = wh.from('clicks')
     .selectAll()
     .where('page', '=', '/home')
diff --git a/docs/src/content/docs/reverse-proxy.mdx b/docs/src/content/docs/reverse-proxy.mdx
index 08da9166..240ea868 100644
--- a/docs/src/content/docs/reverse-proxy.mdx
+++ b/docs/src/content/docs/reverse-proxy.mdx
@@ -132,13 +132,16 @@ Raising the proxy's read/idle timeout for `/v1/stream` is therefore no longer re
 - **Cloudflare** — the edge idle timeout isn't configurable on standard plans; the keepalive is what keeps a quiet stream alive.
 - **Envoy / Istio** — the default **15s route timeout is a total cap, not an idle timeout**, so a keepalive can't help: set the route `timeout: 0` for `/v1/stream` regardless of the keepalive.
 
-### 3. Forward the token, `since`, and `Last-Event-ID`
+### 3. Forward the credential, `since`, and `Last-Event-ID` — and don't redirect
 
-A browser `EventSource` can't set request headers, so the JWT can be passed as a query parameter: `GET /v1/stream?token=<jwt>` (it's stripped after extraction — whichever credential wins — so it stays out of WaveHouse's own logs, but it has already crossed your proxy in the URI, hence the third bullet below; an `Authorization` header still takes precedence). Make sure your proxy:
+The SDK streams over `fetch` and sends the JWT as an `Authorization` header, the same as on every other request. A client that can't set headers — a hand-rolled browser `EventSource`, say — can still pass it as `GET /v1/stream?token=<jwt>` (it's stripped after extraction, whichever credential wins, so it stays out of WaveHouse's own logs; an `Authorization` header always takes precedence). Make sure your proxy:
 
-- forwards the query string (`token`, `since`) — most do by default;
+- forwards the `Authorization` request header — check this first if streams authenticate from `curl` but not through the proxy;
+- **allows `Authorization` (and `Last-Event-ID`) on `OPTIONS /v1/stream`, if the proxy answers CORS itself.** `Authorization` is not CORS-safelisted, so a credentialed cross-origin browser stream now preflights *before it connects* — where a bare `EventSource` never preflighted at all, its request not being a `fetch()`. An **uncredentialed** stream preflights from the first reconnect *after it has received an event* — the resumption header only exists once there is an id to resume from — because `Last-Event-ID` isn't safelisted either. Reject the preflight and a credentialed stream never opens; reject it on the resumption path and the stream is dead from its first drop onward — the id is never cleared, so every attempt re-sends `Last-Event-ID`, fails the same preflight before the request goes out, and re-dials forever without getting back on ([#471](https://github.com/Wave-RF/WaveHouse/issues/471)). WaveHouse's own CORS already allow-lists both;
+- forwards the query string (`since`, and `token` if any client still uses it) — most do by default;
 - forwards the `Last-Event-ID` request header so reconnects resume from the right point (it's already allow-listed in WaveHouse's CORS preflight);
-- does not log the full URL with `token` in it.
+- does not redirect `/v1/stream` for authenticated clients. The SDK's streaming transport refuses a redirect on any stream carrying a credential (an `auth` token or `options.headers`), because a cross-origin hop strips `Authorization` — and this endpoint answers an unauthenticated caller with a reduced view rather than an error — while forwarding your other headers to wherever it points. An uncredentialed stream follows redirects normally;
+- does not log the full URL, for any client still sending `token` in it.
 
 ## Idle timeouts by provider
 
@@ -174,7 +177,7 @@ Linux's [`tcp_keepalive_time`](https://man7.org/linux/man-pages/man7/tcp.7.html)
 
 ### Absolute / total-duration caps — a keepalive does **not** help
 
-These limit the *whole* request regardless of traffic, so no keepalive extends them. You must raise the cap or have the client reconnect (browser `EventSource` does this automatically, resuming via `Last-Event-ID`).
+These limit the *whole* request regardless of traffic, so no keepalive extends them. You must raise the cap or have the client reconnect — the SDK's stream transport and browser `EventSource` both do this automatically, resuming via `Last-Event-ID`.
 
 | Layer | Cap | What to do | Source |
 | --- | --- | --- | --- |
diff --git a/docs/src/content/docs/sdk/index.mdx b/docs/src/content/docs/sdk/index.mdx
index 78ccd1d8..2b08bcd1 100644
--- a/docs/src/content/docs/sdk/index.mdx
+++ b/docs/src/content/docs/sdk/index.mdx
@@ -1,11 +1,11 @@
 ---
 title: "TypeScript SDK"
-description: "Zero-dependency client SDK — query builder, real-time streaming, codegen."
+description: "Client SDK — query builder, real-time streaming, codegen."
 ---
 
 import { Tabs, TabItem, LinkCard, CardGrid } from "@astrojs/starlight/components";
 
-`@wavehouse/sdk` — Zero-dependency TypeScript client for WaveHouse.
+`@wavehouse/sdk` — TypeScript client for WaveHouse. One runtime dependency: `eventsource-parser` (~1.4 KB gzipped, itself dependency-free), which frames the SSE stream.
 
 ## Installation
 
@@ -54,8 +54,8 @@ import { Tabs, TabItem, LinkCard, CardGrid } from "@astrojs/starlight/components
     pages that can't use ES modules, the bundled IIFE build at
     `https://cdn.jsdelivr.net/npm/@wavehouse/sdk` exposes a `WaveHouse` global
     (`WaveHouse.createClient({ … })`) for a classic `<script src>` tag.
-    Streaming uses the browser's native `EventSource`, so it needs no polyfill
-    either way. A bare CDN URL tracks the latest published release; use a
+    Streaming runs on `fetch`, so it needs no polyfill either way. A bare CDN
+    URL tracks the latest published release; use a
     range (`@0`, `@0.1`) to float within a major or minor, or the `@dev` tag
     for unreleased builds from `main` (see
     [Releasing the SDK](/development#releasing-the-sdk)).
@@ -142,25 +142,15 @@ fields in `package.json`:
 ### Runtime support
 
 **Browsers** — all SDK features work natively. `fetch`, `AbortController`,
-and `EventSource` are built into every modern browser; no polyfills are
+and `ReadableStream` are built into every modern browser; no polyfills are
 required.
 
-**Node.js** — non-streaming features (`wh.from().fetch()`, `.insert()`,
-`.sql()`, pipes, admin) work in Node 22 and later (the package's minimum,
-per `engines.node`). 22 is the only line we test against, and older
-releases are past end-of-life upstream. Streaming (`.stream()`,
-`.liveQuery()`) uses `EventSource`, which is **not** a default global in
-Node. The SDK feature-detects with `typeof EventSource === "undefined"`
-and throws a descriptive error if it is absent. To use streaming in Node
-you must polyfill before calling any stream method:
-
-```js
-import { EventSource } from 'eventsource'; // npm install eventsource
-globalThis.EventSource = EventSource;
-```
-
-`--experimental-eventsource` (available in recent Node releases) also
-satisfies the check when passed on the command line.
+**Node.js** — every feature, streaming included, works in Node 22 and later
+(the package's minimum, per `engines.node`). 22 is the only line we test
+against, and older releases are past end-of-life upstream. Streaming runs on
+the same `fetch` and `ReadableStream` globals as the rest of the SDK, so it
+needs **no `EventSource` polyfill** — earlier versions did, and that
+requirement is gone.
 
 ## Quick Start
 
@@ -326,19 +316,21 @@ const wh = createClient<Database>({
 |-------|------|---------|-------------|
 | `baseURL` | `string` | — | WaveHouse server URL, optionally including a path prefix (required) |
 | `auth` | `() => Promise<string> \| string` | — | Token provider. Omit for public access |
-| `options.maxRetries` | `number` | `2` | Retry attempts for failed/5xx requests |
-| `options.headers` | `Record<string, string>` | — | Headers added to every REST request ([details](#custom-headers)) |
-| `options.fetchOptions` | `RequestInit` | — | Extra `RequestInit` fields merged into every REST request ([details](#extra-requestinit-fields)) |
-| `options.fetch` | `FetchLike` | global `fetch` | HTTP implementation for every REST request ([details](#supplying-your-own-fetch)) |
+| `options.maxRetries` | `number` | `2` | Retry attempts for failed/5xx **REST** requests; stream reconnects are unbounded ([details](/sdk/streaming#transport-behavior)) |
+| `options.headers` | `Record<string, string>` | — | Headers added to every request ([details](#custom-headers)) |
+| `options.fetchOptions` | `RequestInit` | — | Extra `RequestInit` fields merged into every request ([details](#extra-requestinit-fields)) |
+| `options.fetch` | `FetchLike` | global `fetch` | HTTP implementation for every request ([details](#supplying-your-own-fetch)) |
+
+:::note[How the token is transmitted]
+The SDK attaches your `auth` token as an `Authorization: Bearer` header on every request, streaming included. It is re-read on each connection attempt, so a stream that outlives its token reconnects with a fresh one instead of replaying an expired credential.
 
-:::caution[These three apply to REST only]
-`headers`, `fetchOptions`, and `fetch` do **not** reach the streaming transport. `.stream()` and `.liveQuery()`'s live connection go through `EventSource`, which accepts neither custom headers nor a `fetch` — which is why the token rides in `?token=` there. If WaveHouse sits behind a header-gated proxy, REST works and streaming does not; follow [#203](https://github.com/Wave-RF/WaveHouse/issues/203) for that. (`.liveQuery()`'s initial backfill is an ordinary REST call and *is* covered.)
+The token is never placed in the URL. The server still accepts a `?token=` query parameter for clients that cannot set headers — see [API Reference — Authentication](/api#authentication) — but the SDK does not use it, so it never reaches a proxy or CDN access log.
 :::
 
-:::note[How the token is transmitted]
-The SDK attaches your `auth` token as an `Authorization: Bearer` header on REST calls, and — because the browser `EventSource` API can't set headers — as a `?token=` query parameter on streaming connections. When both are present the server prefers the header, and it strips `?token=` from the request URL either way — so an unused credential can't survive into a later handler's log line, and the token stays out of **WaveHouse's own** logs.
+:::caution[Streaming asks more of a custom `fetch`]
+`.stream()` and `.liveQuery()` read the response as it arrives, so an `options.fetch` used with them must return a response with a live streaming body. A response handed back with an absent or already-consumed body fails fast with `SSE_NO_STREAM_BODY`. What the SDK cannot rescue is a wrapper that *awaits* the body before returning — `await res.text()`, or the `res.clone().text()` a logging wrapper reaches for — because on a stream that never ends it never resolves and your function never returns. Both satisfy every REST call, which is what makes the trap easy to walk into.
 
-That strip can't reach anything upstream, though: the token is in the request URI on the wire, so any proxy, CDN, or load balancer in front of WaveHouse records it in access logs unless you redact query strings there.
+`options.headers` is also subject to CORS in a browser: a header outside the safelist joins the preflight, which the origin has to allow. WaveHouse advertises a fixed set, so custom headers reach it cross-origin only when a proxy in front terminates the preflight — the deployment they exist for. Server-side callers never preflight.
 :::
 
 #### Serving under a path prefix
@@ -351,13 +343,13 @@ const wh = createClient({ baseURL: 'https://app.example.com/api/warehouse' });
 // streams  → https://app.example.com/api/warehouse/v1/stream
 ```
 
-Trailing slashes on `baseURL` are optional, but it must be **absolute** — scheme and host included. A same-origin relative path like `/api/warehouse` makes every REST call reject with a `TypeError` instead of returning a `Result`, and surfaces on a stream as an `SSE_CONNECT_ERROR` to the subscriber's `error` callback — so build an absolute one: `` `${location.origin}/api/warehouse` ``.
+Trailing slashes on `baseURL` are optional, but it must be **absolute** — scheme and host included — and the scheme must be `http` or `https`. A same-origin relative path like `/api/warehouse` makes every REST call reject with a `TypeError` instead of returning a `Result`, and surfaces on a stream as an `SSE_CONNECT_ERROR` to the subscriber's `error` callback — so build an absolute one: `` `${location.origin}/api/warehouse` ``. A `ws://`/`wss://` base ends the stream with the same error: streaming is plain HTTP, and there is no WebSocket endpoint.
 
 The proxy in front must **strip** the prefix before forwarding, since WaveHouse itself always serves at `/v1/…` — see [Behind a reverse proxy → Path prefixes](/reverse-proxy#path-prefixes).
 
 ### Custom headers
 
-`options.headers` adds headers to every REST request — the usual reason being a
+`options.headers` adds headers to every request, streaming included — the usual reason being a
 header-gated proxy in front of WaveHouse, such as a Cloudflare Access service
 token:
 
@@ -402,14 +394,14 @@ tracked in [#459](https://github.com/Wave-RF/WaveHouse/issues/459).
 
 ### Extra `RequestInit` fields
 
-`options.fetchOptions` is merged into the `RequestInit` of every REST request —
+`options.fetchOptions` is merged into the `RequestInit` of every request, streaming included —
 for settings that aren't headers and don't warrant replacing the whole
 transport:
 
 ```ts
 const wh = createClient({
   baseURL: 'https://wavehouse.example.com',
-  options: { fetchOptions: { cache: 'no-store', keepalive: true } },
+  options: { fetchOptions: { cache: 'no-store', mode: 'cors' } },
 });
 ```
 
@@ -419,6 +411,18 @@ It carries any `RequestInit` field — `mode`, `cache`, `keepalive`,
 extensions need a cast; the standard fields are declared on `RequestInit`
 already.
 
+:::caution[Two of those fields don't apply to streams]
+On `.stream()` and `.liveQuery()`'s live connection the transport keeps `cache`
+and `redirect` for itself, because there they're correctness rather than
+preference. It constrains one more without owning it: `credentials` stays yours,
+forwarded in a browser and dropped elsewhere because some runtimes throw if it
+is set at all. See [Supplying your own fetch](#supplying-your-own-fetch) for
+what each is set to and why.
+
+Everything else reaches streams normally — including `mode` from the example
+above. Only `cache` is different there: on a stream it is already `no-store`.
+:::
+
 :::note[`credentials: 'include'` needs a proxy that owns CORS]
 Sending cookies cross-origin is a common reason to reach for this, but it can't
 work against WaveHouse's own CORS: it deliberately never emits
@@ -458,25 +462,77 @@ const wh = createClient({
 Retries go through the same function, so middleware sees every attempt.
 
 The SDK always calls your function with a **string** URL and a plain
-`RequestInit`. Off the response it reads `.ok` and `.headers` always, `.text()`
-on success, and `.status`, `.statusText` plus `.json()` when the response is not
-`ok` — so a hand-rolled response object needs all six. If your function
-rejects, the request becomes a `NETWORK_ERROR` result and is retried with
-backoff; the one exception is a `DOMException` named `AbortError` — what the
-platform `fetch` and undici throw on abort — which becomes `ABORTED` and is not
-retried. An implementation that signals abort some other way (`node-fetch`
-throws its own `AbortError` class) gets retried instead.
-
-The option's type is exported as `FetchLike`. It matches the standard `fetch`
-signature — written out rather than as `typeof fetch`, which resolves
-differently depending on whether your TypeScript `lib` includes DOM. Let
-TypeScript infer your parameters (`(url, init) => …`) and it fits without
-annotation.
-
-Only the SSE transport is exempt: the live connection behind `.stream()` and
-`.liveQuery()` uses `EventSource`, which this does not replace. `.liveQuery()`'s
-[initial backfill](/sdk/streaming#live-queries) is an ordinary request and *does*
-go through your function.
+`RequestInit`. Off the response the **REST path** reads `.ok` and `.headers`
+always, `.text()` on success, and `.status`, `.statusText` plus `.json()` when
+the response is not `ok` — so a hand-rolled response object needs all six there.
+A stub used with `.stream()` or `.liveQuery()` needs a different set: `.ok`,
+`.status`, `.type` (checked for `opaqueredirect`), `.headers` carrying
+`content-type: text/event-stream`, and a live, unread `.body` — plus
+`.statusText` and `.json()` if your stub ever answers a stream with a non-`ok`
+response, which goes through the same error parsing as REST. `.text()` is never
+called on a stream.
+
+**On REST**, if your function rejects, the request becomes a `NETWORK_ERROR`
+result and is retried with backoff — unless the `AbortSignal` you passed has
+been aborted, in which case the result is `ABORTED` and nothing is retried.
+That's decided from the signal rather than from what your function threw, so an
+implementation that signals abort some other way — `AbortSignal.timeout()`
+raises a `TimeoutError`, `node-fetch` its own `AbortError` class — is reported
+the same way.
+On a stream the same rejection is reported to the subscriber as
+`SSE_NETWORK_ERROR` and re-dialed — including an `AbortError`, since the stream
+transport applies the same rule: only an abort *it* raised, via `.close()`,
+ends the stream. See [Error Handling](/sdk/reference#error-handling).
+
+The option's type is exported as `FetchLike`. It is written out rather than as
+`typeof fetch`, which resolves differently depending on whether your TypeScript
+`lib` includes DOM. Its URL parameter is `string` — all the SDK ever passes —
+which, because function parameters are contravariant, accepts *more*
+implementations than the wider spelling would: the global `fetch` fits, and so
+does hand-written `(url: string, init?: RequestInit) => Promise<Response>`
+middleware. Let TypeScript infer your parameters (`(url, init) => …`) and it
+fits without annotation.
+
+Streaming goes through your function too. That comes with the extra requirement
+described above — the response must carry a live streaming body — and the
+streaming transport keeps ownership of two `RequestInit` fields where the
+value is load-bearing rather than a preference: `cache` (as an init field; a
+`Cache-Control` header would fail cross-origin preflight) and `redirect`. It
+constrains one more without owning it: `credentials` stays yours, forwarded in a
+browser and dropped elsewhere, because some runtimes throw if it is set at
+all.
+
+`redirect` depends on whether the request carries a credential. With one — an
+`auth` token or configured `headers` — a redirect is refused and reported as
+`SSE_REDIRECT`, because a cross-origin hop strips `Authorization` (which this
+endpoint answers with a silently reduced view rather than an error) while
+forwarding your other headers to wherever the redirect points. Without either,
+redirects are followed normally, so CDN canonicalization, geo/LB indirection,
+and an http→https upgrade all work. The test is that concrete pair rather than
+"is this request authenticated", and **cookies are not part of it**. A cookie
+isn't stripped the way `Authorization` is — it is re-derived from the cookie
+store at each hop, so a redirect carries it only while the hop stays inside
+**both** the request's origin and the cookie's own `Path`. Leaving either loses
+it. The origin half is the one no cookie attribute can override: under the
+default `same-origin` credentials mode the browser attaches nothing once a
+redirect goes cross-origin, whatever the `Domain` — so `app.example.com` →
+`api.example.com` on a shared `Domain=example.com` session cookie loses it, and
+so does an http→https upgrade, which is cross-origin by scheme and port. A
+same-origin rewrite from `/v1/stream` to `/stream` under a `Path=/v1` cookie
+loses it the other way. This endpoint answers a cookieless request with a
+reduced view rather than an error
+([#478](https://github.com/Wave-RF/WaveHouse/issues/478)). Going cross-origin
+with `credentials: "include"` usually fails earlier and louder instead: WaveHouse
+never sends `Access-Control-Allow-Credentials`, so against it the browser blocks
+the response outright. Behind a proxy that owns CORS and does allow credentials
+the hop succeeds — and then ordinary cookie scoping decides. `include` *replaces*
+the origin rule rather than lifting it: the cookie crosses only if its own
+`Domain` covers the target, so a host-only cookie — what you get with no `Domain`
+attribute — still stops at its host. If
+you need to follow a credentialed redirect anyway, supply an `options.fetch`
+that overrides `redirect`. A `200` that isn't `text/event-stream` is refused too
+(`SSE_BAD_CONTENT_TYPE`), so an auth gateway's login page fails loudly instead
+of leaving the stream connected and permanently silent.
 
 #### Swapping in undici
 
@@ -505,7 +561,7 @@ const wh = createClient({
   baseURL: 'https://wavehouse.example.com',
   options: {
     fetch: (url, init) =>
-      undiciFetch(url as string, { ...init, dispatcher } as never) as unknown as Promise<Response>,
+      undiciFetch(url, { ...init, dispatcher } as never) as unknown as Promise<Response>,
   },
 });
 ```
@@ -536,17 +592,16 @@ symbol at all. An explicit `setGlobalDispatcher` call (below) wins the other
 way round — it overwrites the symbol after the first copy claimed it.
 :::
 
-All three casts are load-bearing, for one underlying reason: undici declares its
-own request/response types, separate from the ones behind your global `fetch`,
-so the two aren't structurally assignable. `url as string` is needed because
-`FetchLike` accepts the full `fetch` input union while undici's `RequestInfo`
-names its *own* `Request`; `{ ...init, dispatcher } as never` covers the same
-split on `RequestInit`, which differs on `body` and `headers` (`never` is
-assignable to either spelling, so one snippet compiles whether or not your `lib`
-includes DOM); and the return cast handles the `Response` mismatch. They're safe because
-of the narrow runtime contract above — a string URL and a plain `RequestInit`
-in, six members read back. `undici` is a dependency you add; the SDK itself
-stays dependency-free.
+Both casts are load-bearing, for one underlying reason: undici declares its own
+request/response types, separate from the ones behind your global `fetch`, so
+the two aren't structurally assignable. `{ ...init, dispatcher } as never`
+covers the split on `RequestInit`, which differs on `body` and `headers`
+(`never` is assignable to either spelling, so one snippet compiles whether or
+not your `lib` includes DOM); and the return cast handles the `Response`
+mismatch. The URL needs no cast — `FetchLike` declares it as `string`, which
+undici's `RequestInfo` accepts. They're safe because of the narrow runtime
+contract above — a string URL and a plain `RequestInit` in, and only the
+response members enumerated above read back. `undici` is a dependency you add on top of the SDK's single ~1.4 KB one.
 
 If you're genuinely pinned to an affected undici, the same snippet fixes it —
 your pinned version, with a dispatcher that never reuses a keep-alive socket:
diff --git a/docs/src/content/docs/sdk/queries.md b/docs/src/content/docs/sdk/queries.md
index 5d086479..b8b779b6 100644
--- a/docs/src/content/docs/sdk/queries.md
+++ b/docs/src/content/docs/sdk/queries.md
@@ -155,7 +155,7 @@ clicks.select('page').where('score', '>', 10).where('page', 'like', '/home%')
 | `'<'` | `lt` | Less than |
 | `'<='` | `lte` | Less than or equal |
 | `'in'` | `in` | Value in array |
-| `'like'` | `like` | SQL LIKE pattern |
+| `'like'` | `like` | SQL LIKE pattern. Case-**sensitive** on `/v1/query`; the client-side filter used by `.stream()` / `.liveQuery()` matches case-**insensitively** |
 | `'not_like'` | — | SQL NOT LIKE — **client-side only** (live-query / stream filtering); the `/v1/query` backend rejects it |
 
 #### Aggregations
diff --git a/docs/src/content/docs/sdk/reference.md b/docs/src/content/docs/sdk/reference.md
index 97806c4c..121c505e 100644
--- a/docs/src/content/docs/sdk/reference.md
+++ b/docs/src/content/docs/sdk/reference.md
@@ -25,22 +25,53 @@ if (error?.code === 'ABORTED') {
 
 ## Error Handling
 
-The SDK **never throws** for anything the server returns — all API errors come back in `Result.error`. It does throw on caller and environment errors: a non-absolute `baseURL` (REST calls reject with a `TypeError`; streams report `SSE_CONNECT_ERROR` to the subscriber's `error` callback — see [Serving under a path prefix](/sdk#serving-under-a-path-prefix)), `.stream()` / `.liveQuery()` in a runtime with no `EventSource` (see [Runtime support](/sdk#runtime-support)), and an `auth` callback that rejects — a token-refresh failure propagates out of the REST call, and surfaces on a stream as `SSE_CONNECT_ERROR`.
+The SDK **never throws** for anything the server returns — all API errors come back in `Result.error`. It does throw on caller and environment errors: a non-absolute `baseURL` (REST calls reject with a `TypeError`; streams report `SSE_CONNECT_ERROR` to the subscriber's `error` callback — see [Serving under a path prefix](/sdk#serving-under-a-path-prefix)), `.stream()` / `.liveQuery()` in a runtime with no global `fetch` and no `options.fetch` (see [Runtime support](/sdk#runtime-support)), and an `auth` callback that rejects — a token-refresh failure propagates out of the REST call, and on a stream is reported as a retryable `SSE_AUTH_ERROR`. One more exception escapes an SDK call synchronously, though it is yours rather than ours: your own `status` handler throwing on the first `.subscribe()` or `.liveQuery()`, described under *If your own callback throws* below.
 
 | Status | Code | Retryable | Description |
 |--------|------|-----------|-------------|
 | 400 | `HTTP_400` | No | Bad request (validation, missing fields) |
-| 401 | `HTTP_401` | No | Missing or invalid JWT |
+| 401 | `HTTP_401` | No | On REST, a present-but-invalid or expired JWT that a gate then denied. **WaveHouse itself** never returns `401` for a *missing* token — that resolves to `default_role`, and a denial is `403`. On a stream it is always from something in front, since `/v1/stream` is ungated |
 | 403 | `HTTP_403` | No | Insufficient permissions |
 | 404 | `HTTP_404` | No | Table or pipe not found |
 | 500 | `HTTP_500` | Yes | Server error (retried per `maxRetries`) |
 | 503 | `HTTP_503` | Yes | Service unavailable (auto-retries with `Retry-After`) |
 | 0 | `NETWORK_ERROR` | Yes | Network failure (retried with exponential backoff) |
 | 0 | `ABORTED` | No | Request canceled via `AbortSignal` |
-| 0 | `SSE_CONNECT_ERROR` | Yes | Stream failed to connect (e.g. a non-absolute `baseURL`) |
-| 0 | `SSE_ERROR` | Yes | Stream connection error |
+| 0 | `SSE_CONNECT_ERROR` | No | Stream could not be started (e.g. a non-absolute `baseURL`) |
+| 0 | `SSE_AUTH_ERROR` | Yes | The `auth` callback threw while minting a token for an attempt |
+| 0 | `SSE_NETWORK_ERROR` | Yes | Stream request failed to reach the server |
+| 0 | `SSE_READ_ERROR` | Yes | Stream was interrupted mid-read |
+| 0 | `SSE_PARSE_ERROR` | Yes (usually nothing to re-dial) | Unparseable frame — reported and skipped, the connection continues. The buffer cap reports here too, then ends the connection (see below) |
+| *(response status)* | `SSE_NO_STREAM_BODY` | No | A configured `options.fetch` returned a response with no readable body |
+| *(0 in a browser, the 3xx in Node)* | `SSE_REDIRECT` | No | The stream endpoint redirected; point `baseURL` at the final URL |
+| *(response status)* | `SSE_BAD_CONTENT_TYPE` | No | A `200` that wasn't `text/event-stream` — usually a gateway's login page |
+| *(response status)* | `HTTP_4xx` / `HTTP_5xx` | Per status | The stream request was rejected — same codes as REST |
 
-The two `SSE_*` codes arrive on the subscriber's `error` callback rather than in a `Result.error`, since a stream has no single result to carry them. Their `retryable: true` is advisory: unlike the REST codes above, the SDK never re-dials a stream itself. After the connection is open, drops surface through the `status` callback (`reconnecting` → `live`, or `closed`) while the native `EventSource` re-dials on its own; `SSE_ERROR` is a defensive fallback for a transport left in an unexpected state. A failure *before* the `EventSource` is constructed — a non-absolute `baseURL`, a rejecting `auth` callback — is terminal (`SSE_CONNECT_ERROR`), so fix the cause and start a new stream.
+The `SSE_*` codes arrive on the subscriber's `error` callback rather than in a `Result.error`, since a stream has no single result to carry them. Both transports act on `retryable`; what differs is when the error reaches you. All four combinations, with the two exceptions noted under the table:
+
+| | Retryable | Not retryable |
+|---|---|---|
+| **REST** | retried up to `maxRetries`, then returned — the flag records what was already tried | returned on the first attempt, no backoff (every `4xx`) |
+| **Stream** | reported *before* the transport re-dials, which it does indefinitely | reported once; the stream closes and stays closed |
+
+On REST, `ABORTED` is the one error raised *by* a backoff rather than by an attempt: aborting during a retry sleep ends the call immediately with `ABORTED` instead of waiting the delay out. On a stream, `SSE_PARSE_ERROR` is flagged retryable, but an ordinary bad frame is skipped in place — no re-dial, no close. The one that *does* re-dial is the buffer-cap overflow described below.
+
+On a stream, a retryable failure is re-dialed on a jittered exponential backoff (capped at 30s, and reset only once a connection has held for a few seconds — so a server that accepts and instantly closes still backs off), with the `status` callback moving `reconnecting` → `live`.
+
+Rejected requests surface the real status and message rather than an opaque connection failure — in a browser going cross-origin, though, only when the rejection passes CORS and the gateway answered whatever preflight the request triggers — `Authorization`, configured `headers`, or `Last-Event-ID` once the stream resumes; a rejected preflight or a response without `Access-Control-Allow-Origin` reaches you as a retryable network error instead — indistinguishable from a drop, and retried. Any `4xx` ends the stream, since repeating the request won't usually talk whatever rejected it round — the exception being a `429` or `408` from a fronting rate limiter, which is transient even though the stream still ends, so catch it and open a new one after a delay ([#469](https://github.com/Wave-RF/WaveHouse/issues/469)). Note that **WaveHouse never rejects a stream for authentication**: `/v1/stream` is ungated, so an expired or missing token resolves to `default_role` and you get a `200` with a filtered view, not a `401`. The one 4xx it raises itself is `400` for a missing or empty `table`, and only on the stream route: a `404` or `405` means the request never reached that route, most often a `baseURL` path prefix your proxy didn't strip. Any other 4xx comes from something in front — an auth gateway, a proxy. That silent-downgrade behavior is exactly why `auth` is re-read on every connection attempt, and [#239](https://github.com/Wave-RF/WaveHouse/issues/239) tracks enforcing expiry server-side. `SSE_CONNECT_ERROR` and `SSE_NO_STREAM_BODY` are configuration faults, so fix the cause and start a new stream.
+
+`SSE_PARSE_ERROR` is the one code that isn't a connection outcome: it's reported and *skipped*, and the connection keeps reading — one bad frame shouldn't cost you the stream. For an ordinary bad frame its `retryable: true` is therefore vestigial — nothing is re-dialed. Two exceptions, one to each half of that reported-and-skipped rule. A frame whose `data` isn't valid JSON is skipped but never *reported* — `console.warn` and dropped, with no `error` callback. The parser's 16 MiB buffer cap is reported but not *skipped*: an overflow terminates the parser, so the transport stops reading and reconnects rather than feeding it again.
+
+**If your own callback throws.** For anything delivered *through the transport* — `next`, `status`, or `error` — a throw never ends the stream: it is isolated and logged to the console, and never routed to your `error` callback, so a handler that swallows its own failures fails silently.
+
+**Wrap your handler bodies in your own `try`/`catch`.** That isolation is a backstop against one bad callback killing the connection, not a promise that throwing is harmless. Four paths sit outside it, all tracked in [#473](https://github.com/Wave-RF/WaveHouse/issues/473):
+
+- **The first `status` call** — `.subscribe()`'s, and the one `liveQuery()` makes internally on your behalf. It fires synchronously with the current state before the transport is involved, and is unguarded, so the throw propagates back out of the call *you* made, unlogged. Out of `.subscribe()` that leaves your subscriber registered with no unsubscribe function returned. Out of `liveQuery()` it is worse: you get no handle at all, so there is nothing to `.close()`; the backfill never starts, so `initial()` is never called; and the stream opened a moment earlier keeps running — connected, reconnecting on its own — with nothing referencing it. Because the backfill never ran, the buffering phase also never ends — your `next()` is never called at all, and every event the stream receives is appended to a buffer you have no way to reach. Passing `opts.signal` is the only way to stop it. Since this call always happens, it is the *first* thing a throwing `status` handler does.
+- **Delivery to other consumers stops at the one that threw** — later subscribers and any concurrent `for await`. For the iterator the event is *dropped*, not queued, because the fan-out runs before the event is handed to a waiter or buffered. And if the throw lands on the terminal `closed` status, the iterator is never marked done either, so a `for await` waits forever against a dead stream until something calls `.close()`. Order-dependent and invisible.
+- **A throwing `status` handler subscribed before `.connected()`** makes that promise reject with its timeout error against a stream that is already `live`, because the throw aborts the fan-out before `connected()`'s internal watcher is reached.
+- **Inside `liveQuery()`**, a throw from `initial()`, or from `next()` during the backfill flush, is absorbed by the backfill's own error path, with no log and no signal. The cost differs: `initial()` throws *before* the flush starts, so every buffered event is lost, while a `next()` throw mid-flush loses only the remainder. Either way, later live events reach `next()` as normal, with a further throw isolated and logged.
+
+`SSE_AUTH_ERROR` is the one caller-side failure that isn't terminal. A rejecting `auth` callback propagates out of a REST call, but on a stream — where `auth` is invoked on every connection attempt rather than once per stream — a token endpoint having a bad minute is treated as transient and retried, rather than tearing down a stream that is otherwise healthy.
 
 ---
 
@@ -87,6 +118,7 @@ createClient<DB>(config) → WaveHouseClient
 
 StreamController (NOT thenable)
 ├── .subscribe({ next, status?, error? }) → unsubscribe()
+├── .connected(timeoutMs?) → Promise<void>
 ├── .close()
 ├── .status → StreamStatus
 └── [Symbol.asyncIterator]() → AsyncIterableIterator<StreamEvent>
diff --git a/docs/src/content/docs/sdk/streaming.md b/docs/src/content/docs/sdk/streaming.md
index ae75721d..e88b1b13 100644
--- a/docs/src/content/docs/sdk/streaming.md
+++ b/docs/src/content/docs/sdk/streaming.md
@@ -11,7 +11,11 @@ Examples import from `@wavehouse/sdk`; using the CDN instead, import from
 
 ## Streaming
 
-Streams use SSE (Server-Sent Events) for both unauthenticated connections and for authenticated ones.
+Streams are Server-Sent Events over `fetch`. The `auth` token rides in an
+`Authorization: Bearer` header — the same as every other request, on browsers
+and servers alike — and is re-read on each connection attempt, so a stream that
+outlives its token picks up a fresh one. Unauthenticated streams work the same
+way, minus the header.
 
 ### `StreamController`
 
@@ -44,6 +48,14 @@ const unsub = stream.subscribe({
 unsub();
 ```
 
+A handler that throws *during delivery* doesn't end the stream; the exception is
+logged and the connection keeps running. But delivery of that event stops at the
+handler that threw — your *later* subscribers, and any concurrent `for await`,
+do not get it. The first `status` call, the synchronous one `.subscribe()` makes
+before returning, isn't caught at all and throws back out at you. Wrap your
+handler bodies in your own `try`/`catch`; see
+[Error Handling](/sdk/reference#error-handling) for the carve-outs.
+
 ### Async Iterator
 
 ```ts
@@ -67,6 +79,31 @@ stream.close();
 
 Current connection status: `'connecting' | 'live' | 'reconnecting' | 'closed'`.
 
+### `.connected(timeoutMs?)` → `Promise<void>`
+
+Resolves once the stream reaches `live`. Rejects if it is already `closed`, if
+it closes before connecting, or after `timeoutMs` (default `5000`). Useful when
+you need the subscription established before doing something that depends on it
+— inserting a row you expect to see come back, for instance.
+
+```ts
+const stream = wh.from('clicks').stream();
+const unsub = stream.subscribe({ next: (e) => console.log(e) });
+await stream.connected();          // wait until the transport is live
+await wh.from('clicks').insert({ page: '/home' });
+```
+
+A *timeout* rejection does **not** stop the transport — reconnection is
+unbounded, so it means "not live yet", not "given up"; call `.close()` if you
+want it to stop. A rejection because the stream closed is different: there the
+transport has already stopped.
+
+One way this rejects against a perfectly healthy stream: if a subscriber you
+registered *before* calling `.connected()` has a `status` handler that throws,
+the throw aborts the fan-out before `connected()`'s internal watcher sees `live`,
+so it times out while `.status` already reads `live`. See
+[Error Handling](/sdk/reference#error-handling).
+
 ### `StreamOptions`
 
 | Field | Type | Description |
@@ -100,14 +137,60 @@ string is read as UTC, an ECMAScript quirk
 
 | Transport | Reconnect | Protocol |
 | --------- | --------- | -------- |
-| SSE | Automatic (native `EventSource` with `Last-Event-ID`) | HTTP/2 recommended |
-<!-- | TBD | Automatic (retries?) | HTTP/2 recommended | -->
-<!-- TODO: Fill in above ^ for SSE fallback, likely polling? -->
+| SSE over `fetch` | Automatic, jittered backoff, resumes via `Last-Event-ID` | HTTP/2 recommended |
 
 :::note[SSE connection limit]
-The SDK warns when more than 5 concurrent SSE connections are open (browser limit per domain).
+The SDK warns above 5 concurrent SSE connections — just under the browser's 6-per-domain limit for HTTP/1.1. HTTP/2 multiplexes over one connection, so the limit doesn't apply there.
+:::
+
+A dropped stream reconnects on a jittered exponential backoff, capped at 30s, and
+resumes with `Last-Event-ID` so the server gap-fills what was missed. The
+schedule resets only after a connection has *held* for a few seconds, so a
+server accepting and immediately closing — slow-consumer eviction, a half-broken
+upstream — can't pin the client at sub-second retries. Reconnection is
+**unbounded**: a stream keeps re-dialing until it hits a terminal error or you
+`close()` it. `options.maxRetries` bounds REST requests only and is never
+consulted here.
+
+:::caution[Resumption is at-least-once, and time-bounded]
+Delivery across a reconnect is **at-least-once**. The `Last-Event-ID` the client
+sends is the last event's `received_timestamp`, and the server replays from that
+instant *inclusively* — so the last event you already saw, and anything sharing
+its timestamp, arrives again. The SDK does not deduplicate live frames —
+`liveQuery()` makes one pass at the backfill seam, and only under an ascending
+order ([#449](https://github.com/Wave-RF/WaveHouse/issues/449)) — so key on
+`timestamp` plus your
+own row identity if duplicates matter.
+
+Replay is also bounded by the server's
+[`mq.gap_window_minutes`](/configuration#message-queue-nats) — 15 minutes by default.
+A drop longer than that resumes with a hole and no signal, because the purged
+messages are simply gone.
 :::
 
+A `4xx` is terminal and surfaces through `error` with the real status code
+rather than an opaque connection failure — in a browser going cross-origin, only
+when the rejection passes CORS and the gateway answered whatever preflight the
+request triggers (`Authorization`, configured `headers`, or `Last-Event-ID` once
+the stream resumes); otherwise it arrives as a retryable network error instead —
+indistinguishable from a drop, and retried. It won't be an *authentication* rejection
+from WaveHouse, which leaves `/v1/stream` ungated and answers an expired token
+with a filtered view rather than a `401`; the only 4xx it raises itself is `400`
+for a missing or empty table name, and only on the stream route — a `404` or
+`405` means the request never reached it, usually a `baseURL` path prefix the
+proxy didn't strip. Anything else means something in front of it (an auth
+gateway, a proxy) turned the request away — and note the
+exception to "retrying wouldn't help": a `429` or `408` from a rate limiter *is*
+transient, but the stream still ends, so catch it and open a new one after a
+delay ([#469](https://github.com/Wave-RF/WaveHouse/issues/469)). See
+[Error Handling](/sdk/reference#error-handling) for every code a stream can
+report and which ones re-dial.
+
+Streams go through `options.fetch`, `options.headers`, and
+`options.fetchOptions` like every other request — which is what lets a stream
+reach a header-gated origin. A custom `fetch` is asked more of on this
+path; see [Supplying your own fetch](/sdk#supplying-your-own-fetch).
+
 ### Server-Side Policy Filtering
 
 Access-control policy applies on the server before anything reaches the client: tables the connection's role can't `select` are skipped, denied columns are stripped from each event, and the role's row-level `filter` is evaluated per subscriber against the connection's JWT claims. A stream on a row-policied table therefore delivers only the rows the policy admits for that connection — and, where the server's in-memory comparison can't prove a match, fewer; see [Access control — where each rule is enforced](/access-control#where-each-rule-is-enforced). Claims are captured when the connection opens: a policy change applies from the next live event (an in-flight gap-fill replay finishes under the policy snapshot taken at connect), while token expiry or claim changes take effect on reconnect.
@@ -127,6 +210,8 @@ const stream = wh.from('clicks')
 
 Supported operators: `=`, `!=`, `>`, `>=`, `<`, `<=`, `in`, `like`, `not_like` — the same `FilterOp` set `.where()` takes everywhere (the SDK maps them to wire tokens such as `eq`/`neq` internally).
 
+Two of them need care, for different reasons. `like` matches **case-insensitively** here, while ClickHouse's `LIKE` on the query path is case-sensitive — so inside a single `liveQuery()` the backfill rows arrive through the server's case-sensitive filter and the live frames through this one, and a pattern like `'/Home%'` can admit live events whose historical counterparts the backfill excluded. `not_like` has no server-side counterpart at all: `/v1/query` rejects it with a `400` (see the operator table in [Queries](/sdk/queries)), so a `liveQuery()` filtered on it gets an error `Result` in `initial()`, drops whatever was buffered during the backfill window, and runs live-only from there.
+
 ---
 
 ## Live Queries
@@ -161,7 +246,7 @@ lq.close();
 interface StreamSubscriber<T> {
   initial?: (result: Result<T[]>) => void; // Historical backfill result
   next: (event: StreamEvent<T>) => void;    // Live events
-  status?: (state: string) => void;         // Connection state changes
+  status?: (state: StreamStatus) => void;   // Connection state changes
   error?: (err: WaveHouseError) => void;    // Errors
 }
 ```
@@ -169,8 +254,69 @@ interface StreamSubscriber<T> {
 ### How it works
 
 1. Opens the stream **immediately** and buffers incoming events.
-2. Runs the `.fetch()` query for historical data, calls `subscriber.initial()` with the result.
-3. Deduplicates buffered events by comparing timestamps against the latest historical timestamp.
+2. Runs the `.fetch()` query for historical data, calls `subscriber.initial()` with the result — unless the fetch itself throws, in which case neither happens (see below).
+3. Deduplicates buffered events against the **last row** of the backfill result — which is the newest only when the query orders ascending. A `desc` query (like the example above) puts the oldest row last, so for live frames the boundary is the oldest timestamp and this step filters nothing. With a `since` gap-fill in flight it works the other way — replay lands in the same buffer, so replayed events at or older than that row are dropped before reaching `next()`. A projection that omits `received_timestamp` skips the pass entirely. Tracked in [#449](https://github.com/Wave-RF/WaveHouse/issues/449).
 4. Flushes remaining buffered events and switches to live mode.
 
-This "stream-first" approach ensures no events are lost between the fetch and stream start.
+This "stream-first" approach is what closes the window between the fetch and the
+stream starting — events arriving during the fetch are buffered rather than
+missed. It holds only when the backfill completes cleanly.
+
+#### When the backfill doesn't complete
+
+Here is how it doesn't, and what each case looks like from your subscriber.
+"Buffered events" means the ones that arrived during the fetch window, which
+step 4 would otherwise have flushed; the column reports how many of them reach
+you.
+
+| What happened | `initial()` | Live events | `error` | Buffered events |
+|---|---|---|---|---|
+| Backfill returns an error `Result` | fires, `result.error` set | delivered | — | none delivered |
+| Your `initial()` throws | fires, then throws | delivered | — | none delivered — the flush never starts |
+| Your `next()` throws during the flush | fires normally | delivered, after the flush stops | — | none after the throw |
+| `auth` rejects, the stream connects anyway | never fires | delivered | — | none delivered |
+| `auth` rejects for a few attempts, then recovers | never fires | delivered once it recovers | `SSE_AUTH_ERROR` per failed attempt | none delivered |
+| `auth` keeps rejecting | never fires | none — never reaches `live` | `SSE_AUTH_ERROR` per attempt | none delivered |
+| Relative `baseURL` | never fires | none — the stream is terminated too | terminal `SSE_CONNECT_ERROR` | none delivered |
+| Your `status` handler throws on the first, synchronous call | never fires | none — buffered where you can't reach them | — | none delivered |
+
+**The `status`-throw row is the odd one out**, and everything below is written
+for the others. It is the one case where the backfill never *starts*: the throw
+escapes `liveQuery()` before the constructor reaches it, so you get no handle
+back, nothing can `.close()` the stream, and — because the buffering phase never
+ends — every event accumulates in an object you have no reference to,
+indefinitely. `next()` is never called at all. Passing `opts.signal` is the only
+way to stop it; not throwing is the fix. Throwing on any *later* `status`
+transition is isolated and logged like `next`. See
+[Error Handling](/sdk/reference#error-handling).
+
+**What to do about the rest.** Check `result.error` inside `initial()`, keep the
+flush handlers total, and — if a missing backfill matters — treat `initial()`
+never firing as its own failure. Where `auth` rejects and the stream connects
+anyway nothing else will tell you, and where the other rows *do* raise an error
+it names `auth` or the URL, never the backfill. Re-run the fetch then; you never
+have to work out which row you hit. Leave it a moment first: events reach a
+stream from the message queue before the ingest worker lands them in ClickHouse,
+and its per-table batcher flushes on size or a deadline with the insert still to
+complete after that (see [Ingest pipeline](/ingest-pipeline)), so an immediate
+re-fetch can miss the newest rows.
+
+**Why `auth` splits the way it does.** The backfill makes the *first* `auth()`
+call and gets exactly one shot — the token is minted above the REST retry loop,
+so a rejection there is never retried and the whole backfill is gone. The stream
+calls `auth()` again on every connection attempt and treats the same rejection as
+transient. That asymmetry is the entire reason a live query can end up running
+normally with no snapshot behind it, and why nothing announces it: `error` never
+fires, and the only trace is that `initial()` didn't. That is the case worth
+guarding against, because it is the one that looks like success.
+
+**What the live stream can lose.** In every row where the backfill runs at all:
+nothing, except in one window — events arriving after the stream goes `live` but
+before the backfill fails are buffered, and the failure discards the buffer. On
+the `auth` rows that window opens only if the rejection arrives *after* the
+connection does: the backfill fails as soon as its own `auth()` call rejects,
+while the stream needs a second `auth()` call resolved **and** a connection
+opened. Which way that goes depends on your token provider, and you don't need to
+know — the recovery above covers both.
+
+Tracked in [#473](https://github.com/Wave-RF/WaveHouse/issues/473).
diff --git a/docs/src/content/docs/why-wavehouse.md b/docs/src/content/docs/why-wavehouse.md
index 70323229..33f06ebc 100644
--- a/docs/src/content/docs/why-wavehouse.md
+++ b/docs/src/content/docs/why-wavehouse.md
@@ -154,7 +154,7 @@ flowchart TB
 | Schema validation | Custom code in ingest API | Built in (discovers `system.columns`) |
 | Row/column access control | Custom middleware or a dedicated service | Built in (Hasura-style, JWT-driven) |
 | Dead letter queue | Custom retry + dead topic on Kafka | Built in (`WAVEHOUSE_DLQ`) |
-| Client SDK | Each team writes one | `@wavehouse/sdk` (TypeScript, zero-dep, codegen) |
+| Client SDK | Each team writes one | `@wavehouse/sdk` (TypeScript, one dependency, codegen) |
 
 The DIY path works — big teams run it — but the ops cost is not small. You're paying for a Kafka cluster (or Confluent bill), a second service you wrote from scratch, and all the debugging hours when the batching consumer stalls at 3 a.m.
 
diff --git a/internal/api/stream.go b/internal/api/stream.go
index 5cf299aa..f8974e0d 100644
--- a/internal/api/stream.go
+++ b/internal/api/stream.go
@@ -80,7 +80,12 @@ func (h *StreamHandler) Handle(w http.ResponseWriter, r *http.Request) {
 
 	// Register for live events before gap-fill so events arriving during replay
 	// buffer in the subscriber queue instead of being missed (an overlap with
-	// replay yields duplicates, deduped client-side by id: — at-least-once).
+	// replay yields duplicates — at-least-once). The TS SDK does *not* dedupe live
+	// frames, and liveQuery's single seam pass does not help here: it compares
+	// live frames against the REST backfill's rows, not against each other, so a
+	// replayed frame and its live twin share a received_timestamp and are kept or
+	// dropped together. A consumer that cares keys on timestamp plus its own row
+	// identity.
 	sub := stream.NewSubscriber(claims, h.Metrics)
 	h.Hub.Add(topic, role, sub)
 	defer h.Hub.Remove(topic, role, sub)
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 36e1a6b4..fa44e175 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -31,6 +31,10 @@ importers:
         version: 18.0.0
 
   clients/ts:
+    dependencies:
+      eventsource-parser:
+        specifier: ^3.1.0
+        version: 3.1.0
     devDependencies:
       '@types/node':
         specifier: 'catalog:'
@@ -139,9 +143,6 @@ importers:
       '@vitest/coverage-v8':
         specifier: ^4.1.10
         version: 4.1.10(vitest@4.1.10)
-      eventsource:
-        specifier: ^4.1.0
-        version: 4.1.0
       typescript:
         specifier: 'catalog:'
         version: 6.0.3
@@ -2637,10 +2638,6 @@ packages:
     resolution: {integrity: sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg==}
     engines: {node: '>=18.0.0'}
 
-  eventsource@4.1.0:
-    resolution: {integrity: sha512-2GuF51iuHX6A9xdTccMTsNb7VO0lHZihApxhvQzJB5A03DvHDd2FQepodbMaztPBmBcE/ox7o2gqaxGhYB9LhQ==}
-    engines: {node: '>=20.0.0'}
-
   expect-type@1.4.0:
     resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
     engines: {node: '>=12.0.0'}
@@ -7028,10 +7025,6 @@ snapshots:
 
   eventsource-parser@3.1.0: {}
 
-  eventsource@4.1.0:
-    dependencies:
-      eventsource-parser: 3.1.0
-
   expect-type@1.4.0: {}
 
   expressive-code@0.44.1:
diff --git a/tests/e2e/sdk/package.json b/tests/e2e/sdk/package.json
index 183dadc2..7570d516 100644
--- a/tests/e2e/sdk/package.json
+++ b/tests/e2e/sdk/package.json
@@ -15,7 +15,6 @@
   "devDependencies": {
     "@types/node": "catalog:",
     "@vitest/coverage-v8": "^4.1.10",
-    "eventsource": "^4.1.0",
     "typescript": "catalog:",
     "vitest": "catalog:"
   }
diff --git a/tests/e2e/sdk/polyfills.ts b/tests/e2e/sdk/polyfills.ts
deleted file mode 100644
index 27249cdb..00000000
--- a/tests/e2e/sdk/polyfills.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import { EventSource } from "eventsource";
-
-// Polyfill EventSource for Node.js so SSE streaming tests work
-if (typeof globalThis.EventSource === "undefined") {
-  (globalThis as any).EventSource = EventSource;
-}
diff --git a/tests/e2e/sdk/streaming.test.ts b/tests/e2e/sdk/streaming.test.ts
index 01af9836..71ed51e6 100644
--- a/tests/e2e/sdk/streaming.test.ts
+++ b/tests/e2e/sdk/streaming.test.ts
@@ -45,9 +45,14 @@ describe("Streaming", () => {
         filter: { duration_ms: { _gt: "100" } },
       },
     };
+    // `anon` deliberately cannot see `payload` here, which is what makes the
+    // Authorization-header test below discriminating: `viewer` keeps the
+    // baseline `["*"]`, so the two roles observe different frames. Role
+    // matching is exact (internal/policy: no "*" any-role wildcard), so this
+    // entry is the only thing `anon` gets on this table.
     publicPolicy.tables[T.events].select = {
       ...(publicPolicy.tables[T.events].select || {}),
-      anon: { allow_columns: ["*"] },
+      anon: { allow_columns: ["event_id", "type", "user_id", "source", "received_timestamp"] },
     };
 
     await admin.policy.set(publicPolicy);
@@ -79,7 +84,7 @@ describe("Streaming", () => {
 
         await stream.connected(5_000);
 
-        await whAuth.from(T.clicks).insert({
+        const publicInsert = await whAuth.from(T.clicks).insert({
           event_id: id,
           page: "/sse-public-test",
           user_id: "public-user",
@@ -87,6 +92,7 @@ describe("Streaming", () => {
           country: "US",
           duration_ms: 99,
         });
+        expect(publicInsert.error).toBeNull();
 
         await waitForCondition(() => receivedEvents.some((e) => e.data?.event_id === id), 10_000);
 
@@ -118,13 +124,14 @@ describe("Streaming", () => {
         });
         await stream.connected(5_000);
 
-        await whAuth.from(T.clicks).insert({
+        const canonInsert = await whAuth.from(T.clicks).insert({
           event_id: id,
           page: "/canonical-ts",
           user_id: "canon-user",
           session_id: "canon-sess",
           received_timestamp: "2026-06-21T06:00:00.123+02:00",
         });
+        expect(canonInsert.error).toBeNull();
 
         await waitForCondition(() => receivedEvents.some((e) => e.data?.event_id === id), 10_000);
         const frame = receivedEvents.find((e) => e.data?.event_id === id);
@@ -149,42 +156,67 @@ describe("Streaming", () => {
       }
     });
 
-    it("receives events after insert (authenticated via ?token=)", async () => {
+    it("streams a column the public role cannot see (Authorization header)", async () => {
+      // The end-to-end proof that the credential move works. It has to be a
+      // column `anon` is denied: `/v1/stream` never rejects a bad or missing
+      // token, it answers with whatever `default_role` may see — so a test
+      // against a table both roles can read fully would pass just as happily
+      // with the header dropped, which is exactly what it is meant to catch.
       const whAuth = dataClient();
-      const receivedEvents: any[] = [];
+      const whPublic = publicClient();
       const id = testId();
 
-      // The SDK should automatically append the JWT as ?token= here
-      const stream = whAuth.from(T.clicks).stream();
+      const authEvents: any[] = [];
+      const anonEvents: any[] = [];
+
+      const authStream = whAuth.from(T.events).stream();
+      const anonStream = whPublic.from(T.events).stream();
+      let unsubAuth: (() => void) | undefined;
+      let unsubAnon: (() => void) | undefined;
 
-      let unsub: (() => void) | undefined;
       try {
-        unsub = stream.subscribe({
-          // initial: (result) => console.log("Initial SSE result:", result),
-          next: (event) => receivedEvents.push(event),
-          // status: (status) => console.log("SSE status:", status),
-          error: (err) => console.error("SSE error:", err),
+        unsubAuth = authStream.subscribe({
+          next: (event) => authEvents.push(event),
+          error: (err) => console.error("authed SSE error:", err),
+        });
+        unsubAnon = anonStream.subscribe({
+          next: (event) => anonEvents.push(event),
+          error: (err) => console.error("anon SSE error:", err),
         });
 
-        await stream.connected(20_000);
+        await authStream.connected(20_000);
+        await anonStream.connected(20_000);
 
-        await whAuth.from(T.clicks).insert({
+        const inserted = await whAuth.from(T.events).insert({
           event_id: id,
-          page: "/sse-auth-test",
+          type: "sse-auth-test",
           user_id: "auth-user",
-          session_id: "sse-sess",
-          country: "US",
-          duration_ms: 99,
+          payload: '{"secret":"viewer-only"}',
+          source: "web",
         });
-
-        await waitForCondition(() => receivedEvents.some((e) => e.data?.event_id === id), 10_000);
-
-        const matchedEvent = receivedEvents.find((e) => e.data?.event_id === id);
-        expect(matchedEvent).toBeDefined();
-        expect(matchedEvent?.data.user_id).toBe("auth-user");
+        // Without this, a failed write shows up as two 10s timeouts blaming
+        // the stream for an event that was never published.
+        expect(inserted.error).toBeNull();
+
+        await waitForCondition(() => authEvents.some((e) => e.data?.event_id === id), 10_000);
+        await waitForCondition(() => anonEvents.some((e) => e.data?.event_id === id), 10_000);
+
+        const authed = authEvents.find((e) => e.data?.event_id === id);
+        const anon = anonEvents.find((e) => e.data?.event_id === id);
+
+        // Authenticated as `viewer` via the header: the restricted column is present.
+        expect(authed?.data.payload).toBe('{"secret":"viewer-only"}');
+        // Same table, same event, no credential: the server projected it away.
+        // If the SDK stopped sending Authorization, the first assertion would
+        // see this frame instead.
+        expect(anon).toBeDefined();
+        expect(anon?.data.payload).toBeUndefined();
+        expect(anon?.data.event_id).toBe(id);
       } finally {
-        if (unsub) unsub();
-        stream.close();
+        if (unsubAuth) unsubAuth();
+        if (unsubAnon) unsubAnon();
+        authStream.close();
+        anonStream.close();
       }
     });
 
@@ -219,8 +251,14 @@ describe("Streaming", () => {
 
         // One row per country; the filter must route each to only its matching subscriber.
         const base = { page: "/scoped", user_id: "u", session_id: "s", duration_ms: 1 };
-        await inserter.from(T.clicks).insert({ ...base, event_id: usId, country: "US" });
-        await inserter.from(T.clicks).insert({ ...base, event_id: caId, country: "CA" });
+        // A failed write would otherwise surface as a stream timeout below,
+        // blaming the subscriber for a row that was never published.
+        for (const row of [
+          { ...base, event_id: usId, country: "US" },
+          { ...base, event_id: caId, country: "CA" },
+        ]) {
+          expect((await inserter.from(T.clicks).insert(row)).error).toBeNull();
+        }
 
         // Each subscriber receives its own country's row.
         await waitForCondition(() => usEvents.some((e) => e.data?.event_id === usId), 10_000);
@@ -233,8 +271,12 @@ describe("Streaming", () => {
         // not just "not yet arrived".
         const usBarrierId = testId();
         const caBarrierId = testId();
-        await inserter.from(T.clicks).insert({ ...base, event_id: usBarrierId, country: "US" });
-        await inserter.from(T.clicks).insert({ ...base, event_id: caBarrierId, country: "CA" });
+        for (const row of [
+          { ...base, event_id: usBarrierId, country: "US" },
+          { ...base, event_id: caBarrierId, country: "CA" },
+        ]) {
+          expect((await inserter.from(T.clicks).insert(row)).error).toBeNull();
+        }
         await waitForCondition(
           () => usEvents.some((e) => e.data?.event_id === usBarrierId),
           10_000,
@@ -280,8 +322,12 @@ describe("Streaming", () => {
         // Below the bound first, above it second: frames on one connection are
         // strictly ordered behind the same subject, so receiving the high row
         // proves the low row was withheld, not merely late.
-        await inserter.from(T.clicks).insert({ ...base, event_id: lowId, duration_ms: 100 });
-        await inserter.from(T.clicks).insert({ ...base, event_id: highId, duration_ms: 250 });
+        for (const row of [
+          { ...base, event_id: lowId, duration_ms: 100 },
+          { ...base, event_id: highId, duration_ms: 250 },
+        ]) {
+          expect((await inserter.from(T.clicks).insert(row)).error).toBeNull();
+        }
 
         await waitForCondition(() => events.some((e) => e.data?.event_id === highId), 10_000);
         expect(events.some((e) => e.data?.event_id === lowId)).toBe(false);
diff --git a/tests/e2e/sdk/vitest.config.ts b/tests/e2e/sdk/vitest.config.ts
index 887926ff..ea363826 100644
--- a/tests/e2e/sdk/vitest.config.ts
+++ b/tests/e2e/sdk/vitest.config.ts
@@ -42,8 +42,9 @@ export default defineConfig({
     // to this dir so the SDK's own *.test.ts unit files under clients/ts/src
     // are NOT pulled into the e2e run.
     include: [`${here}/*.test.ts`],
-    // Absolute (via import.meta.dirname) so they resolve regardless of root/cwd.
-    setupFiles: [path.join(import.meta.dirname, "polyfills.ts")],
+    // Absolute (via import.meta.dirname) so it resolves regardless of root/cwd.
+    // No setupFiles: streaming runs on the SDK's fetch transport, so there is
+    // no longer an EventSource global to polyfill.
     globalSetup: path.join(import.meta.dirname, "setup.ts"),
     testTimeout: 30_000,
     hookTimeout: 120_000,