@cortexkit/subc-client 0.5.0 → 0.8.1

package/src/client.ts

@@ -37,6 +37,8 @@ import {
   SocketWriteNotQueuedError,
   SocketWriteQueuedError,
   SubcSocket,
+  writeBorrowed,
+  writeTrackedBorrowed,
 } from "./socket.js";
 
 const debug = debuglog("subc-client");
@@ -54,6 +56,7 @@ const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
 // NOT a deadline extension: an absent reply still settles right after the check
 // phase. Capped so it can never approach BODY_READ_TIMEOUT_MS.
 const TIMEOUT_ARBITRATION_GRACE_MS = 50;
+const LIVENESS_PROBE_WINDOW_MS = 2000;
 // Internal marker set as the `code` on the SubcError a request-deadline timeout
 // rejects with, so the managed classifier can tell a deadline (reply may simply
 // not have been read in time) from an actual connection drop. Never surfaced to
@@ -210,13 +213,14 @@ export class SubcCallError extends Error {
 /**
  * A live subscription to a provider's event stream, riding a single held-open
  * request. `onEvent` fires for each StreamData frame; `closed` resolves when the
- * provider ends the stream (StreamEnd) and rejects on an Error terminal or a route
- * GOODBYE. `unsubscribe` cancels the held-open request so the provider unwinds.
+ * provider ends the stream (StreamEnd) or the consumer unsubscribes, and rejects on
+ * an Error terminal or a route GOODBYE. `unsubscribe` cancels the held-open request
+ * so the provider unwinds.
  */
 export interface Subscription {
   /** Cancel the subscription: sends Cancel on the held-open request; idempotent. */
   unsubscribe(): void;
-  /** Resolves on StreamEnd; rejects on an Error terminal or route close. */
+  /** Resolves on StreamEnd or local unsubscribe; rejects on an Error terminal or route close. */
   readonly closed: Promise<void>;
 }
 
@@ -257,6 +261,15 @@ export interface ConnectOptions {
   reconnectBackoff?: ReconnectBackoff;
   /** Injectable sleep for timer-free reconnect tests. */
   sleep?: (ms: number) => Promise<void>;
+  /**
+   * Window the post-deadline liveness probe waits for ANY inbound frame after
+   * sending its channel-0 Ping before convicting the socket as half-open.
+   * Genuine event-loop starvation self-protects at any setting: a loop starved
+   * enough to delay the probe's check also delays the read loop, and when it
+   * wakes the buffered Pong dispatches first. Exposed for deterministic tests.
+   */
+  livenessProbeWindowMs?: number;
+
   /**
    * Hard cap on the timeout-arbitration grace window (see
    * TIMEOUT_ARBITRATION_GRACE_MS). A reply whose bytes are actively arriving when
@@ -265,6 +278,26 @@ export interface ConnectOptions {
    * exposed mainly so tests can prove the arbitration deterministically.
    */
   timeoutArbitrationGraceMs?: number;
+  /**
+   * Observer for daemon-originated channel-0 control pushes (`route.closing`,
+   * `route.closed`, and any op added later). Purely advisory: the daemon's
+   * load-bearing route-death signal remains the GOODBYE frame, and nothing in
+   * the client's own route lifecycle consumes these. The contract is the wire
+   * contract verbatim -- unrecognized ops still arrive here (callers ignore
+   * what they don't know, per the MUST-ignore clause), a push that fails to
+   * parse as JSON is dropped without surfacing, and an observer throw is
+   * swallowed like every other caller callback so it cannot fail the read loop
+   * or unrelated requests.
+   */
+  onControlPush?: (push: ControlPush) => void;
+}
+
+/** A parsed daemon-originated channel-0 control push. */
+export interface ControlPush {
+  /** The push discriminator, e.g. "route.closing" | "route.closed". */
+  op: string;
+  /** The full parsed body, `op` included, for op-specific fields. */
+  body: Record<string, unknown>;
 }
 
 interface NormalizedConnectOptions {
@@ -275,6 +308,8 @@ interface NormalizedConnectOptions {
   reconnectBackoff: ReconnectBackoff;
   sleep: (ms: number) => Promise<void>;
   timeoutArbitrationGraceMs: number;
+  livenessProbeWindowMs: number;
+  onControlPush?: (push: ControlPush) => void;
 }
 
 interface OpenedConnection {
@@ -423,12 +458,18 @@ export class SubcClient {
         // double-execute anything. The cached bind is dead (module restarted and
         // its route-gone GOODBYE raced or was missed); evict it so the retry
         // re-opens the route instead of resending into the same dead channel.
-        if (err.code === "unknown_channel" && !retriedUnknownChannel && !this.closeStarted) {
+        // stale_route_epoch is the same class with a sharper cause (subconscious
+        // issue #39): the channel is known but its epoch was released while this
+        // request was in flight. The daemon's contract for the code is
+        // NOT-FORWARDED — dropped before delivery — so the retry is safe by
+        // construction, and the remedy is identical: evict, re-open, resend once.
+        const deadBindCode = err.code === "unknown_channel" || err.code === "stale_route_epoch";
+        if (deadBindCode && !retriedUnknownChannel && !this.closeStarted) {
           retriedUnknownChannel = true;
           this.evictRouteHandle(routeHandle);
           continue;
         }
-        if (err.code === "unknown_channel" && retriedUnknownChannel) {
+        if (deadBindCode && retriedUnknownChannel) {
           this.evictRouteHandle(routeHandle);
         }
         if (err.kind === "not_sent") {
@@ -445,6 +486,14 @@ export class SubcClient {
           // late under load), so tearing it down would abandon a healthy connection
           // and its other in-flight routes for nothing.
           this.scheduleReconnectAfterDrop(err);
+        } else if (err.kind === "outcome_unknown" && err.code === DEADLINE_NO_DROP_CODE) {
+          // Keeping the socket is only correct when the socket is actually
+          // alive. A HALF-OPEN socket (peer gone with no FIN/RST — the
+          // post-sleep/wake shape) produces the identical observable, and
+          // keeping it pins every future call to a corpse: this exact keep
+          // turned one host sleep into a whole session's tool outage. The
+          // probe supplies the discriminator neither timer can.
+          this.probeLivenessAfterDeadline();
         }
         throw err;
       }
@@ -465,19 +514,23 @@ export class SubcClient {
     const corr = this.allocateCorr();
     const key = pendingKey(handle, corr);
 
+    let subscriptionPending: Pending | null = null;
+    let resolveClosed: (() => void) | null = null;
     const closed = new Promise<void>((resolve, reject) => {
       if (this.closedErr) {
         reject(this.closedErr);
         return;
       }
-      this.pending.set(key, {
+      resolveClosed = resolve;
+      subscriptionPending = {
         handle,
         resolve: () => resolve(),
         reject,
         onProgress: onEvent,
         timer: null,
         subscription: true,
-      });
+      };
+      this.pending.set(key, subscriptionPending);
       const frame = buildFrame(
         FrameType.Request,
         buildFlags(false, priority, false, admission),
@@ -486,7 +539,7 @@ export class SubcClient {
         corr,
         bytes,
       );
-      this.sock.write(encodeFrame(frame), Date.now() + DEFAULT_REQUEST_TIMEOUT_MS).catch((err) => {
+      writeBorrowed(this.sock, encodeFrame(frame), Date.now() + DEFAULT_REQUEST_TIMEOUT_MS).catch((err) => {
         const pending = this.pending.get(key);
         if (pending) this.rejectPending(key, pending, err instanceof Error ? err : new SubcError(String(err)));
       });
@@ -496,7 +549,8 @@ export class SubcClient {
     const unsubscribe = (): void => {
       if (cancelled) return;
       cancelled = true;
-      this.cancel(handle, corr, priority);
+      if (subscriptionPending && resolveClosed) this.settle(key, subscriptionPending, resolveClosed);
+      if (this.isLiveHandle(handle)) this.cancel(handle, corr, priority);
     };
     return { unsubscribe, closed };
   }
@@ -512,7 +566,7 @@ export class SubcClient {
       corr,
       EMPTY_BODY,
     );
-    this.sock.write(encodeFrame(cancel), Date.now() + DEFAULT_REQUEST_TIMEOUT_MS).catch(() => undefined);
+    writeBorrowed(this.sock, encodeFrame(cancel), Date.now() + DEFAULT_REQUEST_TIMEOUT_MS).catch(() => undefined);
   }
 
   /** Poll status or liveness for exactly the supplied route generation. */
@@ -607,7 +661,7 @@ export class SubcClient {
       0n,
       EMPTY_BODY,
     );
-    const write = this.sock.writeTracked(encodeFrame(goodbye), Date.now() + DEFAULT_REQUEST_TIMEOUT_MS);
+    const write = writeTrackedBorrowed(this.sock, encodeFrame(goodbye), Date.now() + DEFAULT_REQUEST_TIMEOUT_MS);
     if (!write.queued && closeOnQueueFailure) this.closeConnectionAfterCleanupFailure();
     write.completed.catch(() => {
       if (closeOnQueueFailure && !write.queued) this.closeConnectionAfterCleanupFailure();
@@ -679,7 +733,7 @@ export class SubcClient {
       };
       pending.timer = setTimeout(() => this.arbitrateTimeout(key, pending, channel, corr, ms), ms);
       this.pending.set(key, pending);
-      this.sock.write(encodeFrame(frame), Date.now() + ms).catch((error) => {
+      writeBorrowed(this.sock, encodeFrame(frame), Date.now() + ms).catch((error) => {
         const current = this.pending.get(key);
         if (current) this.rejectPending(key, current, error instanceof Error ? error : new SubcError(String(error)));
       });
@@ -797,7 +851,7 @@ export class SubcClient {
       };
       pending.timer = setTimeout(() => this.arbitrateTimeout(key, pending, handle.channel, corr, ms), ms);
       this.pending.set(key, pending);
-      const write = this.sock.writeTracked(encodeFrame(frame), Date.now() + ms);
+      const write = writeTrackedBorrowed(this.sock, encodeFrame(frame), Date.now() + ms);
       handedToSocket = write.queued;
       write.completed.catch((error) => {
         const current = this.pending.get(key);
@@ -894,6 +948,98 @@ export class SubcClient {
     }
   }
 
+  // Stamped by dispatch() on every inbound frame; read by the liveness probe.
+  private lastInboundAtMs = 0;
+  // Single-flight guard: overlapping deadline-no-drop settles share one probe.
+  private livenessProbe: Promise<void> | null = null;
+
+  /**
+   * Discriminate event-loop starvation from a half-open socket after a
+   * deadline-no-drop settle. The arbitration deliberately keeps the socket on
+   * that verdict (a late-read reply under load must not cost a healthy
+   * connection), but a half-open socket — peer vanished with no FIN/RST, as
+   * after host sleep/wake — yields the SAME verdict forever, so the keep
+   * becomes a permanent pin to a dead transport. The discriminator is
+   * socket-level liveness evidence: send a channel-0 Ping (the daemon always
+   * answers — subc-core control.rs) and require ANY inbound frame within the
+   * window; the Pong suffices, and a busy socket's other traffic proves the
+   * link just as well. Silence convicts: the socket is failed with a named
+   * cause and closed, so the ordinary drop path (pending rejection now,
+   * reconnect on the next call) takes over.
+   *
+   * Starvation cannot be falsely convicted by a short window: a loop starved
+   * enough to delay the read loop delays this probe's own timer identically,
+   * and when both wake the buffered Pong dispatches before the check runs.
+   *
+   * A PENDING CHANNEL-0 REQUEST SUSPENDS THE PROBE (both at launch and at the
+   * conviction check). The daemon's connection loop handles frames one at a
+   * time, and some channel-0 ops legally park it for seconds — route.open
+   * awaits the module's bind ack inline for up to route_bind_relay_timeout
+   * (~12s in production) — during which OUR Ping sits unread in the daemon's
+   * socket buffer. On an otherwise-quiet connection that silence is fully
+   * explained by our own in-flight control op, and convicting on it would
+   * tear down a healthy connection mid-bind (BROCA's Athena panel flagged
+   * this exact premise; the FIFO fact is verified in subc-core server.rs
+   * connection_loop + control.rs handle_route_open). The client always knows
+   * its own channel-0 pendings, so the gate is local and exact: no probe
+   * while one is in flight, no conviction if one appeared during the window.
+   *
+   * Scope: hooked from the managed-call path only. Control-plane requests
+   * (route.open, catalog.list) are short-lived and their failures already
+   * escalate through reconnect classification; the managed path is where a
+   * plugin lives for hours and where the pin was observed in production.
+   */
+  /** Any in-flight channel-0 request (pendings keyed without a route handle). */
+  private hasControlPending(): boolean {
+    for (const pending of this.pending.values()) {
+      if (pending.handle === null) return true;
+    }
+    return false;
+  }
+
+  private probeLivenessAfterDeadline(): void {
+    if (this.livenessProbe || this.closeStarted || this.closedErr) return;
+    if (this.hasControlPending()) return; // silence would be self-explained; re-armed by the next settle
+    const sock = this.sock;
+    const generation = this.generation;
+    let corr: bigint;
+    try {
+      corr = this.allocateCorr();
+    } catch {
+      return; // allocator exhausted: the next reconnect resets it
+    }
+    const t0 = Date.now();
+    const ping = buildFrame(
+      FrameType.Ping,
+      buildFlags(false, Priority.Interactive, false, AdmissionClass.Normal),
+      0,
+      0,
+      corr,
+      new Uint8Array(),
+    );
+    const probe = (async (): Promise<void> => {
+      // A failed WRITE is not exonerating: swallow it and let the window
+      // check run — a socket that cannot carry a Ping will not produce an
+      // inbound frame either, and conviction is the right verdict.
+      await writeBorrowed(sock, encodeFrame(ping), t0 + this.opts.livenessProbeWindowMs).catch(() => {});
+      await this.opts.sleep(this.opts.livenessProbeWindowMs);
+      if (this.sock !== sock || this.generation !== generation || this.closeStarted) return;
+      if (this.lastInboundAtMs >= t0) return; // link proven — keep the socket
+      // A control op that started during the window explains the silence: the
+      // daemon's read loop may be parked in its inline handler, not dead.
+      if (this.hasControlPending()) return;
+      this.fail(
+        new SocketClosedError(
+          `liveness probe convicted a half-open socket: no inbound frame for ${this.opts.livenessProbeWindowMs}ms after a channel-0 Ping (deadline-no-drop settles preceded this); closing so the next call reconnects`,
+        ),
+      );
+      sock.close();
+    })().finally(() => {
+      this.livenessProbe = null;
+    });
+    this.livenessProbe = probe;
+  }
+
   private async ensureConnectedForManaged(): Promise<void> {
     if (this.closeStarted) throw new SubcError("client closed");
     if (this.reconnecting) await this.reconnecting;
@@ -1026,6 +1172,37 @@ export class SubcClient {
   }
 
   private dispatch(frame: Frame): void {
+    // Every dispatched frame proves the socket delivers inbound bytes; the
+    // post-deadline liveness probe reads this stamp. Stamped after readLoop's
+    // generation gate, so a stale socket's late frames never vouch for the
+    // live one.
+    this.lastInboundAtMs = Date.now();
+    if (frame.header.channel === 0 && frame.header.ty === FrameType.Push) {
+      // Daemon-originated control push (route.closing / route.closed / future
+      // ops). Never matches a pending (corr is daemon-chosen), never an error
+      // path: unparseable bodies and absent observers both drop silently per
+      // the wire contract's MUST-ignore clause, and an observer throw is
+      // swallowed for the same reason as onProgress below -- a caller callback
+      // must not fail the read loop.
+      const observer = this.opts.onControlPush;
+      if (observer) {
+        let parsed: ControlPush | null = null;
+        try {
+          const body = this.parseJson(frame) as Record<string, unknown>;
+          if (body && typeof body.op === "string") parsed = { op: body.op, body };
+        } catch {
+          // Unparseable control push: ignored by contract.
+        }
+        if (parsed) {
+          try {
+            observer(parsed);
+          } catch {
+            // Observer's own throw, on its own stack; the stream must survive.
+          }
+        }
+      }
+      return;
+    }
     let handle: RouteHandle | null = null;
     if (frame.header.channel !== 0) {
       handle = this.liveRoutes.get(frame.header.channel) ?? null;
@@ -1039,11 +1216,32 @@ export class SubcClient {
     const pending = this.pending.get(key);
     if (pending) {
       if (pending.acceptFrame && !pending.acceptFrame(frame)) return;
-      switch (frame.header.ty) {
-        case FrameType.Push:
-        case FrameType.StreamData:
-          pending.onProgress?.(frame.body);
-          return;
+        switch (frame.header.ty) {
+          case FrameType.Push:
+          case FrameType.StreamData:
+            // A THROW FROM CALLER CODE MUST NOT REACH THE READ LOOP.
+            //
+            // `onProgress` (and `onEvent`, which is the same slot) is supplied by
+            // the caller and runs INSIDE readLoop's frame dispatch. An escaping
+            // throw unwinds into readLoop's catch, which treats it as a socket
+            // failure: it calls fail(), rejecting EVERY in-flight request on this
+            // connection -- other routes included -- with the caller's own error as
+            // the reported cause, and stops reading. One consumer's bad event
+            // handler therefore drops the whole connection, and the surfaced error
+            // names the handler rather than the transport, so the failure reads as
+            // a subc fault.
+            //
+            // Swallowing is deliberate and is NOT hiding a fault from the caller:
+            // the throw happened in their own callback, on their own stack, where
+            // they are the party able to catch it. What the client owes them is
+            // that the stream and every sibling route keep working.
+            try {
+              pending.onProgress?.(frame.body);
+            } catch {
+              // Swallow the caller's own handler error so one bad callback cannot
+              // abort the read loop or fail unrelated requests. See above.
+            }
+            return;
         case FrameType.Response:
         case FrameType.StreamEnd:
           this.settle(key, pending, () => pending.resolve(frame));
@@ -1064,7 +1262,17 @@ export class SubcClient {
     }
 
     if (frame.header.ty === FrameType.Goodbye && handle) {
-      this.failHandle(handle, new SubcError("route closed by subc (GOODBYE)"));
+      // Carries `route_closed` like the other two route-close sites (closeRoute,
+      // late route.open). It was the only one without a code, so a consumer
+      // branching on `route_closed` to recognise a gone route saw this one as an
+      // uncoded generic failure and fell through to whatever its default was.
+      //
+      // THE CODE MUST NOT MAKE THIS RETRYABLE. A GOODBYE arriving mid-request
+      // means the request was already forwarded and the module may have run it,
+      // so it stays kind=outcome_unknown -- the same class as a mid-flight socket
+      // drop, and never the not_sent/unknown_channel class that call() retries.
+      // The code says WHICH route ended, not that it is safe to send again.
+      this.failHandle(handle, new SubcError("route closed by subc (GOODBYE)", "route_closed"));
       if (this.liveRoutes.get(handle.channel) === handle) this.liveRoutes.delete(handle.channel);
       this.evictRouteHandle(handle);
       return;
@@ -1202,11 +1410,12 @@ export class SubcClient {
   }
 
   private encode(value: unknown): Uint8Array {
-    return new Uint8Array(Buffer.from(JSON.stringify(value), "utf8"));
+    return Buffer.from(JSON.stringify(value), "utf8");
   }
 
   private parseJson(frame: Frame): unknown {
-    return JSON.parse(Buffer.from(frame.body).toString("utf8"));
+    const b = frame.body;
+    return JSON.parse(Buffer.from(b.buffer, b.byteOffset, b.byteLength).toString("utf8"));
   }
 }
 
@@ -1246,6 +1455,7 @@ export function isRetryableRouteOpenCode(code: string | undefined): boolean {
   return (
     code === "unknown_module" ||
     code === "module_reloading" ||
+    code === "module_warming" ||
     code === "target_unavailable" ||
     code === "module_timeout"
   );
@@ -1269,6 +1479,8 @@ function normalizeConnectOptions(opts: ConnectOptions): NormalizedConnectOptions
     reconnectBackoff: opts.reconnectBackoff ?? DEFAULT_RECONNECT_BACKOFF,
     sleep: opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
     timeoutArbitrationGraceMs: opts.timeoutArbitrationGraceMs ?? TIMEOUT_ARBITRATION_GRACE_MS,
+    livenessProbeWindowMs: opts.livenessProbeWindowMs ?? LIVENESS_PROBE_WINDOW_MS,
+    onControlPush: opts.onControlPush,
   };
 }
 

package/src/connection-file.ts

@@ -31,9 +31,14 @@ export interface ConnectionInfo {
 export class ConnectionFileError extends Error {}
 
 function toBytes(value: unknown, field: string): Uint8Array {
-  if (!Array.isArray(value) || value.some((n) => typeof n !== "number")) {
+  if (!Array.isArray(value)) {
     throw new ConnectionFileError(`connection file field '${field}' must be a JSON array of bytes`);
   }
+  for (const byte of value) {
+    if (typeof byte !== "number" || !Number.isInteger(byte) || byte < 0 || byte > 255) {
+      throw new ConnectionFileError(`connection file field '${field}' has invalid byte ${String(byte)}`);
+    }
+  }
   return Uint8Array.from(value as number[]);
 }
 

package/src/envelope.ts

@@ -122,6 +122,59 @@ export class DecodeError extends Error {
   }
 }
 
+function validateHeaderFields(header: EnvelopeHeader): void {
+  // Apply wire-width coercions in serialization order before semantic validation.
+  // This preserves encodeHeader's modulo behavior and its early conversion errors.
+  const len = header.len >>> 0;
+  const ver = (header.ver >>> 0) & 0xff;
+  const typeByte = (header.ty >>> 0) & 0xff;
+  const flags = (header.flags >>> 0) & 0xff;
+  const channel = (header.channel >>> 0) & 0xffff;
+  const epoch = header.epoch >>> 0;
+  void BigInt.asUintN(64, header.corr);
+
+  if (ver !== PROTOCOL_VERSION) throw new DecodeError(`unsupported envelope version ${ver}`, "unsupported_version");
+  if (typeByte > FRAME_TYPE_MAX) throw new DecodeError(`unknown frame type byte ${typeByte}`, "unknown_frame_type");
+  const ty = typeByte as FrameType;
+  if ((flags & FLAG_RESERVED_MASK) !== 0) {
+    throw new DecodeError(
+      `reserved flag bits set in flags 0b${flags.toString(2).padStart(8, "0")}`,
+      "reserved_flag_bits",
+    );
+  }
+  if (((flags & FLAG_PRIORITY_MASK) >> FLAG_PRIORITY_SHIFT) === 0b11) {
+    throw new DecodeError(
+      `reserved priority bits set in flags 0b${flags.toString(2).padStart(8, "0")}`,
+      "reserved_priority_bits",
+    );
+  }
+  const admission = (flags & FLAG_ADMISSION_MASK) >> FLAG_ADMISSION_SHIFT;
+  if (admission === 0b11) {
+    throw new DecodeError(
+      `reserved admission class set in flags 0b${flags.toString(2).padStart(8, "0")}`,
+      "reserved_admission_class",
+    );
+  }
+  if (admission === AdmissionClass.Sheddable && ty !== FrameType.Push && ty !== FrameType.StreamData) {
+    throw new DecodeError(
+      `SHEDDABLE admission class is illegal on ${FrameType[ty]} in flags 0b${flags.toString(2).padStart(8, "0")}`,
+      "sheddable_illegal_frame_type",
+    );
+  }
+  if (channel === 0 && epoch !== 0) {
+    throw new DecodeError(
+      `control channel carried nonzero epoch ${epoch}`,
+      "nonzero_epoch_on_control_channel",
+    );
+  }
+  if (isPureHeader(ty) && len !== 0) {
+    throw new DecodeError(
+      `pure-header frame ${FrameType[ty]} declared non-zero body length ${len}`,
+      "pure_header_frame_with_body",
+    );
+  }
+}
+
 /** Decode and validate a header from the front of `bytes`. */
 export function decodeHeader(bytes: Uint8Array): EnvelopeHeader {
   if (bytes.length < FROZEN_PREFIX_LEN) {
@@ -210,7 +263,7 @@ export function buildFrameWithVersion(
     throw new DecodeError(`frame body ${body.length} exceeds max ${MAX_FRAME_BODY_LEN}`, "frame_body_too_large");
   }
   const header = { len: body.length, ver, ty, flags, channel, epoch, corr };
-  decodeHeader(encodeHeader(header));
+  validateHeaderFields(header);
   return { header, body };
 }
 

package/src/index.ts

@@ -16,6 +16,7 @@ export {
   type RequestOptions,
   type ManagedCallOptions,
   type ConnectOptions,
+  type ControlPush,
   type ReconnectBackoff,
   type SubcCallErrorKind,
   type SubscribeOptions,
@@ -70,19 +71,16 @@ export {
   type BindDecision,
   type Principal,
   type BindingsInput,
-  type CircuitBreakerInput,
   type Concurrency,
   type ConsumerRoleInput,
   type ExecutionMode,
   type IdentityBindingInput,
   type IdentityScope,
   type InternalTransport,
-  type LeaseScope,
   type ManagementOperationInput,
   type ManagementOperationKind,
   type ManagementSurfaceManifestOptions,
   type ManifestInput,
-  type ModelPolicyInput,
   type ModuleHelloAckBody,
   type ObservabilityKind,
   type ObservabilitySurfaceInput,
@@ -95,12 +93,10 @@ export {
   type ProviderHealthHandler,
   type ProviderRoleInput,
   type RouteBindRequest,
-  type ScheduledTaskInput,
   type StorageBindingInput,
   type StorageKind,
   type StorageScope,
   type SubcProviderConnectOptions,
-  type TaskEligibilityInput,
   type ToolInput,
   type TrustTier,
   type VaultGrantInput,