@cortexkit/subc-client 0.16.1 → 0.18.0

package/README.md

@@ -78,6 +78,40 @@ fails loud with an `AuthError` rather than connecting insecurely.
 - **Connection-file security.** On unix the file must be owner-only (`0600`); a
   group/world-readable file is rejected, because the key has effectively leaked.
 
+### Launch nonce
+
+A module the daemon spawns proves who it is with a launch nonce. On macOS and
+Linux the daemon hands it over as a pipe at descriptor 3, named by
+`SUBC_LAUNCH_NONCE_FD=3:<inode>`, and during the rollout also as
+`SUBC_LAUNCH_NONCE` (which any same-user process can read with `ps eww`).
+`launchNonce()` is the one reader: it takes the descriptor only when it is a
+pipe with the named inode that holds bytes, reads it to end of file, closes it,
+and caches the value and its source (`fd` or `env`) for the life of the
+process. A named descriptor that is closed, not a pipe, a different pipe, empty
+or malformed throws a `LaunchNonceError` (`NotOpen`, `NotAPipe`, `WrongPipe`,
+`Empty`, `Malformed`), leaves the descriptor as it was, and never falls back to
+the environment copy. The environment copy is read only when
+`SUBC_LAUNCH_NONCE_FD` is absent. `process.env` is never modified.
+
+- `SubcProvider.connect()` sends the nonce in HELLO and rejects with a
+  `SubcProviderError` coded `launch_nonce_unavailable` on a refusal. A declared
+  `manifest.provenance` gets `launch_nonce_source` filled in when unset.
+- `route.open` presents the nonce as consumer identity; a refusal means no
+  identity.
+- Call `launchNonce()` (or connect the provider) before spawning anything: until
+  the first read, descriptor 3 is inheritable. A process spawned afterwards
+  inherits the variable but not the pipe, and its accessor refuses by name.
+- Every copy of this package in a JavaScript realm shares the cache. A worker
+  thread is a separate realm, so read the nonce on the main thread.
+- It relies on the write end of the pipe being closed before the module
+  starts, as the daemon's handoff does. Node and Bun cannot count the bytes
+  waiting in a pipe without reading them, so emptiness is checked with a first
+  read, which returns nothing and consumes nothing at end of file; if a writer
+  still held the pipe open, that read would block instead of reporting
+  `Empty`. (fstat's size is no substitute: macOS reports the waiting bytes for
+  an anonymous pipe, but 0 for a mkfifo pipe, and Linux reports 0 for every
+  pipe.)
+
 ## Testing
 
 ```sh
@@ -100,4 +134,5 @@ package builds the `ck-subc` executable).
 | `src/auth.ts` | HMAC-SHA256 handshake (`computeProof`, constant-time verify) |
 | `src/route-handle.ts` | immutable connection-bound `(channel, epoch)` route identity |
 | `src/client.ts` | `SubcClient`: route handles, channel-0 RPCs, epoch-aware corr-mux |
+| `src/launch-nonce.ts` | the one launch-nonce reader: descriptor 3 or the environment copy, cached |
 | `src/provider.ts` | provider bind publication, epoch validation, and routed serving |

package/dist/client.d.ts

@@ -4,9 +4,10 @@ import { ReverseRequestRegistry, RouteHandle } from "./route-handle.js";
 export declare const DEFAULT_REQUEST_TIMEOUT_MS = 30000;
 export declare const TIMEOUT_ARBITRATION_GRACE_MS = 50;
 export declare const LIVENESS_PROBE_WINDOW_MS = 2000;
-export declare const ROUTE_OPEN_RETRY_DEADLINE_MS = 30000;
+export declare const ROUTE_OPEN_RETRY_DEADLINE_MS = 90000;
+export declare const MAX_ROUTE_OPENS_IN_FLIGHT = 8;
 export declare const SUBC_MODULE_ID_ENV = "SUBC_MODULE_ID";
-export declare const SUBC_LAUNCH_NONCE_ENV = "SUBC_LAUNCH_NONCE";
+export { SUBC_LAUNCH_NONCE_ENV } from "./launch-nonce.js";
 export interface BindIdentity {
     project_root: string;
     harness: string;
@@ -29,7 +30,7 @@ export interface ConsumerIdentity {
     launch_nonce: string;
 }
 export interface RouteOpenOptions {
-    /** Optional override for the consumer identity; by default the SUBC_MODULE_ID and SUBC_LAUNCH_NONCE environment variables are used when both are non-empty. Set null to send route.open without consumer_identity. */
+    /** Optional override for the consumer identity; by default the SUBC_MODULE_ID environment variable and the process's launch nonce (see `launchNonce`) are used when both are non-empty; a refused launch-nonce descriptor counts as no nonce. Set null to send route.open without consumer_identity. */
     consumerIdentity?: ConsumerIdentity | null;
     /**
      * Handlers prepared before route.open. The client derives consumer_capabilities
@@ -116,7 +117,7 @@ export interface ManagedCallOptions extends RequestOptions {
     identity?: BindIdentity;
     /** Defaults to management_surface, matching the store/host management APIs. */
     targetKind?: ManagedRouteKind;
-    /** Optional override for the consumer identity; by default the SUBC_MODULE_ID and SUBC_LAUNCH_NONCE environment variables are used when both are non-empty. Set null to send route.open without consumer_identity. */
+    /** Optional override for the consumer identity; by default the SUBC_MODULE_ID environment variable and the process's launch nonce (see `launchNonce`) are used when both are non-empty; a refused launch-nonce descriptor counts as no nonce. Set null to send route.open without consumer_identity. */
     consumerIdentity?: ConsumerIdentity | null;
     /** Reverse-request handlers used by the managed route and all of its reconnect reopens. */
     reverseRequests?: ReverseRequestRegistry;
@@ -229,12 +230,23 @@ export interface ConnectOptions {
     reconnectBackoff?: ReconnectBackoff;
     /** Injectable sleep for timer-free reconnect tests. */
     sleep?: (ms: number) => Promise<void>;
+    /**
+     * Injectable clock (milliseconds) for the route.open retry deadline. Tests pair
+     * it with `sleep` so a minute-long module restart runs in fake time.
+     */
+    now?: () => number;
+    /**
+     * Injectable random source in [0, 1) for route.open retry jitter, so tests can
+     * seed it. Defaults to Math.random.
+     */
+    random?: () => number;
     /**
      * How long managed calls keep retrying route.open in-place on retryable
      * refusals (module_reloading, module_warming, target_unavailable, …) before
-     * settling not_sent. This deadline is the ONLY binder on those retries —
-     * module reloads legitimately take tens of seconds (the daemon's drain alone
-     * defaults to 30s), so the default matches the daemon's drain ceiling.
+     * settling not_sent. This deadline and the call's own timeoutMs (when set) are
+     * the only binders on those retries: a module restart legitimately keeps its
+     * routes refused for about a minute (drain, stop, boot), so the default is
+     * ROUTE_OPEN_RETRY_DEADLINE_MS.
      */
     routeOpenRetryDeadlineMs?: number;
     /**
@@ -305,9 +317,11 @@ export declare class SubcClient {
     private closeStarted;
     private reconnecting;
     private generation;
+    private routeOpenGateInstance;
     private readerActive;
     private constructor();
     get conn(): ConnectionInfo;
+    private get routeOpenGate();
     /** Read the connection file, connect, authenticate, and start the read loop. */
     static connect(opts: ConnectOptions): Promise<SubcClient>;
     /** List modules subc knows about (channel-0 catalog.list). */
@@ -321,8 +335,14 @@ export declare class SubcClient {
     resolveProvider(capability: string): Promise<string>;
     /** Resolve every catalog claimant in deterministic module-id order. */
     resolveProviders(capability: string): Promise<string[]>;
-    /** Open a route and return its connection-bound immutable handle. */
+    /**
+     * Open a route and return its connection-bound immutable handle. At most
+     * MAX_ROUTE_OPENS_IN_FLIGHT opens are outstanding at once; further calls wait
+     * their turn.
+     */
     routeOpen(target: RouteTarget, identity: BindIdentity, opts?: RouteOpenOptions): Promise<RouteHandle>;
+    /** One route.open exchange. The caller holds a route-open gate slot. */
+    private sendRouteOpen;
     /** Send a data-plane request on exactly the supplied route generation. */
     request(handle: RouteHandle, body: unknown, opts?: RequestOptions): Promise<unknown>;
     /**
@@ -382,7 +402,15 @@ export declare class SubcClient {
     private managedRequest;
     private sendManaged;
     private cachedRouteHandle;
+    private awaitOpeningUntil;
     private openCachedRoute;
+    /**
+     * The not_sent error for a route.open whose retry deadline ran out. Its code
+     * and cause are the most recent refusal, as they always were; its message
+     * describes the most informative refusal seen, so a module that was reloading
+     * is not reported as admission pressure on the client's own connection.
+     */
+    private routeOpenRetryExhausted;
     private lastInboundAtMs;
     private livenessProbe;
     /**

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAeA,OAAO,EAA2C,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EACL,cAAc,EAMd,QAAQ,EAGT,MAAM,eAAe,CAAC;AACvB,OAAO,EAKL,sBAAsB,EACtB,WAAW,EAGZ,MAAM,mBAAmB,CAAC;AAc3B,eAAO,MAAM,0BAA0B,QAAS,CAAC;AAWjD,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAsB7C,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAMnD,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AACnD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,eAAe,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,sNAAsN;IACtN,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC3C;;;OAGG;IACH,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,4BAA4B,EAAE,CAAC;IACzC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,yEAAyE;AACzE,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB;IAAE,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEjC,uDAAuD;AACvD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpC;IAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEpC,4EAA4E;AAC5E,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,WAAW,EAAE,mBAAmB,CAAC;IACjC,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC1C,+EAA+E;IAC/E,YAAY,CAAC,EAAE,4BAA4B,EAAE,GAAG,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;IACxC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,sNAAsN;IACtN,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC3C,2FAA2F;IAC3F,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC3C,6EAA6E;IAC7E,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,yBAAyB,EAAE,gBAIvC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,iBAAiB,GAAG,UAAU,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAEpC,QAAQ,CAAC,IAAI,EAAE,iBAAiB;IAEhC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAHf,IAAI,EAAE,iBAAiB,EAChC,OAAO,EAAE,MAAM,EACN,IAAI,CAAC,EAAE,MAAM,YAAA,EACb,KAAK,CAAC,EAAE,OAAO,YAAA;IAM1B;;;;;OAKG;IACH,IAAI,MAAM,IAAI,OAAO,CAEpB;CACF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,kFAAkF;IAClF,WAAW,IAAI,IAAI,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAED,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO;gBARzB,OAAO,EAAE,MAAM,EACN,IAAI,CAAC,EAAE,MAAM,YAAA;IACtB;;;;;OAKG;IACM,MAAM,CAAC,EAAE,OAAO,YAAA;CAI5B;AA6BD,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,wFAAwF;IACxF,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;CAC7C;AAED,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,+EAA+E;AAC/E,MAAM,MAAM,qBAAqB,GAC7B,QAAQ,GACR,SAAS,GACT,SAAS,GACT,OAAO,GACP,mBAAmB,CAAC;AAExB,+DAA+D;AAC/D,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,SAAS,CAAC;AAEjE,8EAA8E;AAC9E,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAErE;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAWvE;AAED,qFAAqF;AACrF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,qBAAqB,CAW/E;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,gBAAgB,GAAG,SAAS,CAGhF;AAwCD,qBAAa,UAAU;IAmBnB,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IApBvB,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6C;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,eAAe,CAAwB;IAC/C,OAAO,CAAC,qBAAqB,CAAK;IAClC,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,UAAU,CAAK;IAKvB,OAAO,CAAC,YAAY,CAAS;IAE7B,OAAO;IAQP,IAAI,IAAI,IAAI,cAAc,CAEzB;IAED,gFAAgF;WACnE,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;IAM/D,8DAA8D;IACxD,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAS7D;;;;;OAKG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAc1D,uEAAuE;IACjE,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAc7D,qEAAqE;IAC/D,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;IA0C/G,0EAA0E;IACpE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqB9F;;;OAGG;IACG,IAAI,CAAC,QAAQ,GAAG,OAAO,EAC3B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,OAAO,EAChB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,QAAQ,CAAC;IAWpB;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;YAKlB,WAAW;IA6DvB,2DAA2D;IAC7D,SAAS,CACP,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,EACpC,IAAI,GAAE,gBAAqB,GAC1B,YAAY;IA+Df;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAmC1B,gEAAgE;IAChE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,QAA+B,GAAG,IAAI;IAa1F,yEAAyE;IACnE,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC;IAgBjF,uDAAuD;IACnD,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAelF,qEAAqE;IAC/D,iBAAiB,CACrB,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,EACxD,QAAQ,EAAE,YAAY,EACtB,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAgBd,+GAA+G;IAC3G,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF,KAAK,IAAI,IAAI;IAMb,OAAO,CAAC,kBAAkB;IAkB1B,OAAO,CAAC,gBAAgB;mBAqBH,cAAc;YAcrB,UAAU;IAQxB,OAAO,CAAC,IAAI;IAqDZ;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;YA2BV,cAAc;IAuB5B,OAAO,CAAC,WAAW;YAyEL,iBAAiB;YAwCjB,eAAe;IA4D7B,OAAO,CAAC,eAAe,CAAK;IAE5B,OAAO,CAAC,aAAa,CAA8B;IAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,0BAA0B;YA2CpB,yBAAyB;IAMvC,OAAO,CAAC,0BAA0B;IASlC,OAAO,CAAC,kBAAkB;YAWZ,kBAAkB;IAsChC,OAAO,CAAC,iBAAiB;YAgBX,kBAAkB;IAkChC,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,qBAAqB;YAIf,QAAQ;IAwBtB,OAAO,CAAC,QAAQ;IAsIhB;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,sBAAsB;YAgEhB,gBAAgB;YAWhB,gBAAgB;IA4B9B,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,oBAAoB;IAM5B,qFAAqF;IACrF,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAED,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,YAAY;IAcpB,OAAO,CAAC,kCAAkC;IAO1C,OAAO,CAAC,MAAM;IAId,8EAA8E;IAC9E,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,SAAS;CAIlB;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAkBlE;AAWD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAS1E;AAED,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAExF;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOzE;AAiBD,2EAA2E;AAC3E,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAYvE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAeA,OAAO,EAA2C,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EACL,cAAc,EAMd,QAAQ,EAGT,MAAM,eAAe,CAAC;AAEvB,OAAO,EAKL,sBAAsB,EACtB,WAAW,EAGZ,MAAM,mBAAmB,CAAC;AAc3B,eAAO,MAAM,0BAA0B,QAAS,CAAC;AAWjD,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAuB7C,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAOnD,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAM3C,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,eAAe,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,wSAAwS;IACxS,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC3C;;;OAGG;IACH,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,4BAA4B,EAAE,CAAC;IACzC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,yEAAyE;AACzE,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB;IAAE,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEjC,uDAAuD;AACvD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpC;IAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEpC,4EAA4E;AAC5E,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,WAAW,EAAE,mBAAmB,CAAC;IACjC,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC1C,+EAA+E;IAC/E,YAAY,CAAC,EAAE,4BAA4B,EAAE,GAAG,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;IACxC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,wSAAwS;IACxS,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC3C,2FAA2F;IAC3F,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC3C,6EAA6E;IAC7E,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,yBAAyB,EAAE,gBAIvC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,iBAAiB,GAAG,UAAU,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAEpC,QAAQ,CAAC,IAAI,EAAE,iBAAiB;IAEhC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAHf,IAAI,EAAE,iBAAiB,EAChC,OAAO,EAAE,MAAM,EACN,IAAI,CAAC,EAAE,MAAM,YAAA,EACb,KAAK,CAAC,EAAE,OAAO,YAAA;IAM1B;;;;;OAKG;IACH,IAAI,MAAM,IAAI,OAAO,CAEpB;CACF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,kFAAkF;IAClF,WAAW,IAAI,IAAI,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAED,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO;gBARzB,OAAO,EAAE,MAAM,EACN,IAAI,CAAC,EAAE,MAAM,YAAA;IACtB;;;;;OAKG;IACM,MAAM,CAAC,EAAE,OAAO,YAAA;CAI5B;AA6BD,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,wFAAwF;IACxF,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;CAC7C;AAED,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,+EAA+E;AAC/E,MAAM,MAAM,qBAAqB,GAC7B,QAAQ,GACR,SAAS,GACT,SAAS,GACT,OAAO,GACP,mBAAmB,CAAC;AAExB,+DAA+D;AAC/D,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,SAAS,CAAC;AAEjE,8EAA8E;AAC9E,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAErE;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAWvE;AAED,qFAAqF;AACrF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,qBAAqB,CAW/E;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,gBAAgB,GAAG,SAAS,CAGhF;AAsHD,qBAAa,UAAU;IAoBnB,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IArBvB,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6C;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,eAAe,CAAwB;IAC/C,OAAO,CAAC,qBAAqB,CAAK;IAClC,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,qBAAqB,CAA4B;IAKzD,OAAO,CAAC,YAAY,CAAS;IAE7B,OAAO;IAQP,IAAI,IAAI,IAAI,cAAc,CAEzB;IAID,OAAO,KAAK,aAAa,GAExB;IAED,gFAAgF;WACnE,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;IAM/D,8DAA8D;IACxD,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAS7D;;;;;OAKG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAc1D,uEAAuE;IACjE,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAc7D;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;IAU/G,wEAAwE;YAC1D,aAAa;IA8C3B,0EAA0E;IACpE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqB9F;;;OAGG;IACG,IAAI,CAAC,QAAQ,GAAG,OAAO,EAC3B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,OAAO,EAChB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,QAAQ,CAAC;IAWpB;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;YAKlB,WAAW;IA6DvB,2DAA2D;IAC7D,SAAS,CACP,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,EACpC,IAAI,GAAE,gBAAqB,GAC1B,YAAY;IA+Df;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAmC1B,gEAAgE;IAChE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,QAA+B,GAAG,IAAI;IAa1F,yEAAyE;IACnE,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC;IAgBjF,uDAAuD;IACnD,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAelF,qEAAqE;IAC/D,iBAAiB,CACrB,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,EACxD,QAAQ,EAAE,YAAY,EACtB,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAgBd,+GAA+G;IAC3G,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF,KAAK,IAAI,IAAI;IAMb,OAAO,CAAC,kBAAkB;IAkB1B,OAAO,CAAC,gBAAgB;mBAqBH,cAAc;YAcrB,UAAU;IAQxB,OAAO,CAAC,IAAI;IAqDZ;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;YA2BV,cAAc;IAuB5B,OAAO,CAAC,WAAW;YAyEL,iBAAiB;IAmD/B,OAAO,CAAC,iBAAiB;YAmBX,eAAe;IA4E7B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAiB/B,OAAO,CAAC,eAAe,CAAK;IAE5B,OAAO,CAAC,aAAa,CAA8B;IAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,0BAA0B;YA2CpB,yBAAyB;IAMvC,OAAO,CAAC,0BAA0B;IASlC,OAAO,CAAC,kBAAkB;YAWZ,kBAAkB;IAsChC,OAAO,CAAC,iBAAiB;YAgBX,kBAAkB;IAkChC,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,qBAAqB;YAIf,QAAQ;IAwBtB,OAAO,CAAC,QAAQ;IAsIhB;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,sBAAsB;YAgEhB,gBAAgB;YAWhB,gBAAgB;IA4B9B,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,oBAAoB;IAM5B,qFAAqF;IACrF,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAED,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,YAAY;IAcpB,OAAO,CAAC,kCAAkC;IAO1C,OAAO,CAAC,MAAM;IAId,8EAA8E;IAC9E,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,SAAS;CAIlB;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAkBlE;AAWD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAS1E;AAqDD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAExF;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOzE;AAmBD,2EAA2E;AAC3E,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAYvE"}

package/dist/client.js

@@ -13,6 +13,7 @@ import { debuglog } from "node:util";
 import { AuthError, authenticateClient } from "./auth.js";
 import { ConnectionFileError, readConnectionFile } from "./connection-file.js";
 import { AdmissionClass, buildFrame, buildFlags, encodeFrame, FrameType, hasBinary, Priority, } from "./envelope.js";
+import { launchNonceOrUndefined } from "./launch-nonce.js";
 import { belongsToConnection, createRouteHandle, newConnectionToken, reverseRequestHandler, ReverseRequestRegistry, sameRouteHandle, StaleRouteHandleError, } from "./route-handle.js";
 import { SocketClosedError, SocketTimeoutError, SocketWriteNotQueuedError, SocketWriteQueuedError, SubcSocket, writeBorrowed, writeTrackedBorrowed, } from "./socket.js";
 const debug = debuglog("subc-client");
@@ -44,21 +45,29 @@ const DEADLINE_NO_DROP_CODE = "deadline_exceeded_no_drop_observed";
 // A retryable route.open rejection (target booting / reloading / momentarily
 // absent) is retried in-place against the same connection up to this deadline
 // before it is surfaced as not_sent. Mirrors subc-client-rs
-// DEFAULT_ROUTE_RETRY_DEADLINE so a target that is briefly unavailable at daemon
-// restart recovers without a misleading terminal error.
-// Sized against the daemon's route.bind relay timeout (12s default): a single
-// load-stalled bind relay consumes ~12s of this budget before the daemon even
-// rejects with module_timeout, so the deadline must leave room for MULTIPLE
-// full relay waits or one slow bind exhausts the whole retry clock. 30s allows
-// ~2 full relay timeouts plus backoff before surfacing not_sent.
-export const ROUTE_OPEN_RETRY_DEADLINE_MS = 30_000;
+// DEFAULT_ROUTE_RETRY_DEADLINE so a target that is unavailable while it restarts
+// recovers without a misleading terminal error.
+// Sized against a real module restart, not a single bind: the daemon drains the
+// module's routes (up to 30s), waits for the old process to stop (up to its stop
+// budget, 25s by default), then boots the new one. A measured prefrontal-core
+// restart kept route.open refused for 62.5s end to end, which a 30s budget gave
+// up on halfway through. 90s covers that window with room for a slow boot. A
+// call that sets its own timeoutMs still stops retrying at that timeout.
+export const ROUTE_OPEN_RETRY_DEADLINE_MS = 90_000;
+// The most route.open requests this client keeps outstanding on one connection.
+// Mirrors the daemon's MAX_PENDING_ROUTE_OPENS_PER_CONNECTION
+// (crates/subc-daemon/src/server.rs): the daemon refuses every open beyond that
+// many with a retryable target_unavailable, so sending more at once only
+// manufactures refusals. Extra opens wait here, first come first served, and the
+// wait counts against the same retry deadline as the refusals do.
+export const MAX_ROUTE_OPENS_IN_FLIGHT = 8;
 // Once a header arrives, its body must follow promptly; bound it so a truncated
 // frame cannot wedge the read loop forever.
 const BODY_READ_TIMEOUT_MS = 30_000;
 const EMPTY_BODY = new Uint8Array(0);
 const DEFAULT_MANAGED_TARGET_KIND = "management_surface";
 export const SUBC_MODULE_ID_ENV = "SUBC_MODULE_ID";
-export const SUBC_LAUNCH_NONCE_ENV = "SUBC_LAUNCH_NONCE";
+export { SUBC_LAUNCH_NONCE_ENV } from "./launch-nonce.js";
 export const DEFAULT_RECONNECT_BACKOFF = {
     baseMs: 100,
     capMs: 2_000,
@@ -161,6 +170,85 @@ export function routeCloseReason(push) {
         return undefined;
     return parseRouteCloseReason(push.body.reason);
 }
+/**
+ * First-come-first-served limit on the route.open requests one client has
+ * outstanding. A slot is held from just before the open is written until its
+ * answer, or its failure, settles. The client holds one connection at a time,
+ * and replacing it fails every open still in flight on the old one, so one gate
+ * per client is a per-connection limit.
+ */
+class RouteOpenGate {
+    limit;
+    inFlight = 0;
+    waiters = [];
+    constructor(limit) {
+        this.limit = limit;
+    }
+    /**
+     * Resolve with a release function once a slot is free, or with null when
+     * `timeoutMs` passes first. Without a timeout the caller waits until a slot
+     * frees, which happens as each open in flight settles.
+     */
+    acquire(timeoutMs) {
+        if (this.inFlight < this.limit && this.waiters.length === 0) {
+            this.inFlight += 1;
+            return Promise.resolve(this.releaser());
+        }
+        if (timeoutMs !== undefined && timeoutMs <= 0)
+            return Promise.resolve(null);
+        return new Promise((resolve) => {
+            let timer;
+            const waiter = (release) => {
+                if (timer !== undefined)
+                    clearTimeout(timer);
+                resolve(release);
+            };
+            this.waiters.push(waiter);
+            if (timeoutMs !== undefined) {
+                timer = setTimeout(() => {
+                    const index = this.waiters.indexOf(waiter);
+                    if (index === -1)
+                        return;
+                    this.waiters.splice(index, 1);
+                    resolve(null);
+                }, timeoutMs);
+            }
+        });
+    }
+    releaser() {
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            // Hand the slot straight to the oldest waiter, so a newcomer cannot take
+            // it between this release and that waiter resuming.
+            const next = this.waiters.shift();
+            if (next)
+                next(this.releaser());
+            else
+                this.inFlight -= 1;
+        };
+    }
+}
+/**
+ * The route.open refusals one retry loop has seen: the most recent one, and the
+ * one that best explains why the target was unreachable. When the deadline runs
+ * out, the error describes the best one. After a module restart the most recent
+ * refusal is often admission pressure ("8 binds in flight"), which points a
+ * reader at the client's concurrency when the module was simply down.
+ */
+class RouteOpenRefusals {
+    best;
+    last;
+    record(refusal) {
+        this.last = refusal;
+        // At equal rank the newer refusal wins: it describes the target's latest state.
+        if (!this.best || routeOpenRefusalRank(refusal) >= routeOpenRefusalRank(this.best)) {
+            this.best = refusal;
+        }
+    }
+}
 export class SubcClient {
     sock;
     currentConn;
@@ -176,6 +264,7 @@ export class SubcClient {
     closeStarted = false;
     reconnecting = null;
     generation = 1;
+    routeOpenGateInstance;
     // True while the read loop is actively reading/dispatching a frame off the
     // current socket (between reading a header and finishing its dispatch). The
     // timeout arbitration reads it to decide whether a just-fired timeout should
@@ -190,6 +279,11 @@ export class SubcClient {
     get conn() {
         return this.currentConn;
     }
+    // Created on first use, so a client assembled without running its constructor
+    // (as the unit tests do) still paces its route.opens.
+    get routeOpenGate() {
+        return (this.routeOpenGateInstance ??= new RouteOpenGate(MAX_ROUTE_OPENS_IN_FLIGHT));
+    }
     /** Read the connection file, connect, authenticate, and start the read loop. */
     static async connect(opts) {
         const normalized = normalizeConnectOptions(opts);
@@ -230,8 +324,23 @@ export class SubcClient {
             .map((module) => module.module_id)
             .sort();
     }
-    /** Open a route and return its connection-bound immutable handle. */
+    /**
+     * Open a route and return its connection-bound immutable handle. At most
+     * MAX_ROUTE_OPENS_IN_FLIGHT opens are outstanding at once; further calls wait
+     * their turn.
+     */
     async routeOpen(target, identity, opts = {}) {
+        // Without a timeout the gate always grants a slot eventually.
+        const release = (await this.routeOpenGate.acquire());
+        try {
+            return await this.sendRouteOpen(target, identity, opts);
+        }
+        finally {
+            release();
+        }
+    }
+    /** One route.open exchange. The caller holds a route-open gate slot. */
+    async sendRouteOpen(target, identity, opts = {}) {
         const consumerIdentity = routeOpenConsumerIdentity(opts);
         const reverseRequests = opts.reverseRequests ?? new ReverseRequestRegistry();
         reverseRequests.seal();
@@ -741,17 +850,41 @@ export class SubcClient {
         }
         if (cached.handle && this.isLiveHandle(cached.handle))
             return cached.handle;
+        // The retries end at the retry deadline or at the call's own timeoutMs,
+        // whichever comes first. Without timeoutMs the call has no overall deadline
+        // here: the default request timeout bounds only the response wait.
+        const startedAt = this.opts.now();
+        const callDeadline = opts.timeoutMs === undefined ? undefined : startedAt + opts.timeoutMs;
         if (!cached.opening) {
-            cached.opening = this.openCachedRoute(cached).finally(() => {
+            const retryDeadline = startedAt + this.opts.routeOpenRetryDeadlineMs;
+            const deadline = callDeadline === undefined ? retryDeadline : Math.min(retryDeadline, callDeadline);
+            cached.opening = this.openCachedRoute(cached, deadline).finally(() => {
                 cached.opening = null;
             });
+            return cached.opening;
         }
-        return cached.opening;
+        // Another call is already opening this route, on its own deadline. Share its
+        // result, but never wait past this call's own timeout for it.
+        if (callDeadline === undefined)
+            return cached.opening;
+        return this.awaitOpeningUntil(cached.opening, callDeadline);
+    }
+    awaitOpeningUntil(opening, deadline) {
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => reject(this.notSentCallError("call deadline elapsed waiting for another call's route.open")), Math.max(0, deadline - this.opts.now()));
+            opening.then((handle) => {
+                clearTimeout(timer);
+                resolve(handle);
+            }, (error) => {
+                clearTimeout(timer);
+                reject(error);
+            });
+        });
     }
-    async openCachedRoute(cached) {
-        const routeRetryDeadline = Date.now() + this.opts.routeOpenRetryDeadlineMs;
+    async openCachedRoute(cached, deadline) {
         let routeRetryDelay = this.opts.reconnectBackoff.baseMs;
         let routeRetryAttempt = 0;
+        const refusals = new RouteOpenRefusals();
         for (;;) {
             if (cached.closed)
                 throw this.routeClosedDuringOpen();
@@ -763,11 +896,27 @@ export class SubcClient {
             }
             if (cached.handle && this.isLiveHandle(cached.handle))
                 return cached.handle;
+            // Waiting for a free slot spends the same deadline as retrying refusals.
+            const release = await this.routeOpenGate.acquire(Math.max(0, deadline - this.opts.now()));
+            if (!release)
+                throw this.routeOpenRetryExhausted(cached.moduleId, routeRetryAttempt, refusals);
+            let outcome;
             try {
-                const handle = await this.routeOpen(cached.target, cached.identity, {
-                    consumerIdentity: cached.consumerIdentity ?? null,
-                    reverseRequests: cached.reverseRequests,
-                });
+                outcome = {
+                    handle: await this.sendRouteOpen(cached.target, cached.identity, {
+                        consumerIdentity: cached.consumerIdentity ?? null,
+                        reverseRequests: cached.reverseRequests,
+                    }),
+                };
+            }
+            catch (error) {
+                outcome = { error };
+            }
+            finally {
+                release();
+            }
+            if ("handle" in outcome) {
+                const { handle } = outcome;
                 if (cached.closed) {
                     this.liveRoutes.delete(handle.channel);
                     this.sendRouteGoodbye(handle);
@@ -776,37 +925,55 @@ export class SubcClient {
                 cached.handle = handle;
                 return handle;
             }
-            catch (error) {
-                if (error instanceof SubcCallError && error.code === "route_closed")
-                    throw error;
-                if (!this.closeStarted && isConsumerReconnectTransient(error)) {
-                    try {
-                        await this.reconnectAfterDrop(error);
-                    }
-                    catch (reconnectError) {
-                        throw this.notSentRecoveryError("route.open was not sent and reconnect failed", reconnectError);
-                    }
-                    continue;
+            const { error } = outcome;
+            if (error instanceof SubcCallError && error.code === "route_closed")
+                throw error;
+            if (!this.closeStarted && isConsumerReconnectTransient(error)) {
+                try {
+                    await this.reconnectAfterDrop(error);
                 }
-                if (!this.closeStarted && error instanceof SubcError && isRetryableRouteOpenCode(error.code)) {
-                    // The deadline is the ONLY binder here. An attempt cap used to share
-                    // this condition, and because the capped backoff sums to ~3.1s it
-                    // strictly dominated the 30s deadline — the advertised reload
-                    // patience was never delivered, so every module restart whose reload
-                    // exceeded ~3s failed managed callers with module_reloading. Module
-                    // reloads legitimately take tens of seconds (drain alone defaults to
-                    // 30s); the backoff cap below bounds retry pressure instead.
-                    routeRetryAttempt += 1;
-                    if (Date.now() < routeRetryDeadline) {
-                        await this.opts.sleep(routeRetryDelay);
-                        routeRetryDelay = Math.min(routeRetryDelay * 2, this.opts.reconnectBackoff.capMs);
-                        continue;
-                    }
-                    throw this.notSentCallError(`route.open failed for module ${cached.moduleId}: ${error.code} (retry deadline exhausted after ${routeRetryAttempt} attempts)`, error);
+                catch (reconnectError) {
+                    throw this.notSentRecoveryError("route.open was not sent and reconnect failed", reconnectError);
                 }
-                throw this.terminalCallError(`route.open failed for module ${cached.moduleId}`, error);
+                continue;
             }
+            if (!this.closeStarted && error instanceof SubcError && isRetryableRouteOpenCode(error.code)) {
+                // The deadline is the ONLY binder here. An attempt cap used to share
+                // this condition, and because the capped backoff sums to ~3.1s it
+                // strictly dominated the deadline — the advertised reload patience was
+                // never delivered, so every module restart whose reload exceeded ~3s
+                // failed managed callers with module_reloading. A restart legitimately
+                // keeps routes refused for about a minute; the backoff cap below bounds
+                // retry pressure instead.
+                routeRetryAttempt += 1;
+                refusals.record(error);
+                const remaining = deadline - this.opts.now();
+                if (remaining > 0) {
+                    // Every route on a connection is closed together when its module
+                    // drains, so without jitter they all retry in lock step and arrive at
+                    // the daemon as one burst each round.
+                    await this.opts.sleep(Math.min(equalJitter(routeRetryDelay, this.opts.random), remaining));
+                    routeRetryDelay = Math.min(routeRetryDelay * 2, this.opts.reconnectBackoff.capMs);
+                    continue;
+                }
+                throw this.routeOpenRetryExhausted(cached.moduleId, routeRetryAttempt, refusals);
+            }
+            throw this.terminalCallError(`route.open failed for module ${cached.moduleId}`, error);
+        }
+    }
+    /**
+     * The not_sent error for a route.open whose retry deadline ran out. Its code
+     * and cause are the most recent refusal, as they always were; its message
+     * describes the most informative refusal seen, so a module that was reloading
+     * is not reported as admission pressure on the client's own connection.
+     */
+    routeOpenRetryExhausted(moduleId, attempts, refusals) {
+        const { best, last } = refusals;
+        if (!best || !last) {
+            return this.notSentCallError(`route.open for module ${moduleId} waited until its deadline for one of ${MAX_ROUTE_OPENS_IN_FLIGHT} route.open slots on this connection`);
         }
+        const recent = last === best ? "" : `; the most recent refusal was ${describeRouteOpenRefusal(last)}`;
+        return new SubcCallError("not_sent", `route.open failed for module ${moduleId}: ${describeRouteOpenRefusal(best)} (retry deadline exhausted after ${attempts} attempts${recent})`, last.code, last);
     }
     // Stamped by dispatch() on every inbound frame; read by the liveness probe.
     lastInboundAtMs = 0;
@@ -1403,6 +1570,55 @@ export function isRetryableRouteOpenCode(code) {
         code === "target_unavailable" ||
         code === "module_timeout");
 }
+/**
+ * "Equal jitter": half the delay is kept and the other half is random, so
+ * retries spread out while still backing off. `random` returns a value in [0, 1).
+ */
+function equalJitter(delayMs, random) {
+    const half = delayMs / 2;
+    return half + random() * half;
+}
+// The daemon's reasons for refusing a route.open because too many binds are
+// already in flight: on the client's connection, or towards the target module
+// (crates/subc-daemon/src/control.rs, route_open_capacity_refusal and
+// route_open_target_capacity_refusal). Both are sent as target_unavailable.
+const ROUTE_OPEN_ADMISSION_PRESSURE_REASONS = new Set(["open_admission_full", "target_binds_full"]);
+// Matches the messages of those same admission-pressure refusals. The daemon
+// currently logs the reason but leaves it out of the refusal's detail, so the
+// message is the only way to recognise them.
+const ROUTE_OPEN_ADMISSION_PRESSURE_MESSAGE = /route\.open binds in flight|route\.bind relays in flight/;
+function refusalReason(refusal) {
+    const detail = refusal.detail;
+    if (typeof detail !== "object" || detail === null || !("reason" in detail))
+        return undefined;
+    const reason = detail.reason;
+    return typeof reason === "string" ? reason : undefined;
+}
+/**
+ * How much a route.open refusal says about why the target was unreachable,
+ * highest first: the module was changing state (reloading or warming); a
+ * delegation was not registered; the daemon was refusing for admission pressure
+ * (too many binds in flight); anything else.
+ */
+function routeOpenRefusalRank(refusal) {
+    if (refusal.code === "module_reloading" || refusal.code === "module_warming")
+        return 3;
+    const reason = refusalReason(refusal);
+    if (refusal.code === "delegation_not_registered" || reason === "delegation_not_registered")
+        return 2;
+    if (refusal.code === "target_unavailable") {
+        const admissionPressure = reason === undefined
+            ? ROUTE_OPEN_ADMISSION_PRESSURE_MESSAGE.test(refusal.message)
+            : ROUTE_OPEN_ADMISSION_PRESSURE_REASONS.has(reason);
+        if (admissionPressure)
+            return 1;
+    }
+    return 0;
+}
+function describeRouteOpenRefusal(refusal) {
+    const reason = refusalReason(refusal);
+    return `${refusal.code ?? "refused"}${reason === undefined ? "" : ` (reason ${reason})`}: ${refusal.message}`;
+}
 export const UNKNOWN_CHANNEL = "unknown_channel";
 export const STALE_ROUTE_EPOCH = "stale_route_epoch";
 /** Whether to evict this route, reopen it, and resend once. A consumer deriving
@@ -1432,6 +1648,8 @@ function normalizeConnectOptions(opts) {
         targetKind: opts.targetKind ?? DEFAULT_MANAGED_TARGET_KIND,
         reconnectBackoff: opts.reconnectBackoff ?? DEFAULT_RECONNECT_BACKOFF,
         sleep: opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
+        now: opts.now ?? Date.now,
+        random: opts.random ?? Math.random,
         routeOpenRetryDeadlineMs: opts.routeOpenRetryDeadlineMs ?? ROUTE_OPEN_RETRY_DEADLINE_MS,
         timeoutArbitrationGraceMs: opts.timeoutArbitrationGraceMs ?? TIMEOUT_ARBITRATION_GRACE_MS,
         livenessProbeWindowMs: opts.livenessProbeWindowMs ?? LIVENESS_PROBE_WINDOW_MS,
@@ -1469,7 +1687,12 @@ function routeOpenConsumerIdentity(opts = {}) {
     if (opts.consumerIdentity !== undefined)
         return opts.consumerIdentity ?? undefined;
     const moduleId = process.env[SUBC_MODULE_ID_ENV];
-    const launchNonce = process.env[SUBC_LAUNCH_NONCE_ENV];
+    // The nonce comes from the one process-wide accessor, never straight from the
+    // environment: the module's HELLO may already have read and closed the
+    // descriptor, and a second reader would find some other file at its number.
+    // A refused descriptor means this process has no identity to present, so the
+    // route opens without one, as the Rust consumer does.
+    const launchNonce = launchNonceOrUndefined()?.value;
     if (!moduleId || !launchNonce)
         return undefined;
     return { module_id: moduleId, launch_nonce: launchNonce };