@cotal-ai/core 0.17.0 → 0.19.0

package/dist/endpoint-epname.js

@@ -0,0 +1,273 @@
+/**
+ * `epname` — the durable name claim (SPEC §13.4; the closed machine).
+ *
+ * A name is an identity that outlives the process holding it. The row answers three questions that
+ * a live process cannot answer about itself: who holds this name, which lifecycle it names, and
+ * WHICH INCARNATION owns the handle table for it. The third is the one that keeps being got wrong,
+ * because it is the only one whose answer is invisible from the row's own subject.
+ *
+ * TWO RULES THAT COST MORE THAN THEY LOOK.
+ *
+ * `runtimeOwner` IS MOVED, NOT DERIVED. It is written at `launching → live` from the executor that
+ * made the spawn call — recorded at the moment it becomes true rather than reconstructed later —
+ * and every subsequent edge CARRIES it. It is deliberately never re-derived from a slot row,
+ * because user mode has no slot row at all, so a derivation is unevaluable on a supported path,
+ * and an unevaluable predicate is one that either refuses forever or falls back to absence.
+ * `instanceId` alone will not do: an identity is not an incarnation, and a restarted process with
+ * the same id has an empty handle table, which is the absence of knowledge rather than knowledge
+ * of absence.
+ *
+ * `draining` HAS EXACTLY ONE EXIT, AND IT IS THE OPERATOR. The ordinary edge required its actor to
+ * be the row's `runtimeOwner` attesting that the runtime is gone. That actor cannot exist: an owner
+ * still alive has no queryable per-attempt handle to attest about, and a restarted one is a
+ * different incarnation. The edge was satisfiable only by the party least entitled to satisfy it,
+ * so it is removed rather than weakened — and `draining` is a state an operator clears by hand
+ * until a durable runtime-attempt token exists. That cost is real and is recorded rather than
+ * hidden inside a predicate that reads as satisfiable.
+ */
+import { EpEnvelopeError } from "./endpoint-error.js";
+function fail(message) {
+    throw new EpEnvelopeError("bad-request", `epname: ${message}`);
+}
+const BASE = ["v", "ts", "state", "claimant"];
+/** The COMPLETE legal field set per state. § S2's variants are per-state for the reason § S1's are:
+ *  a single broad object with everything optional cannot say that `executor` is present IFF a launch
+ *  is in flight, and "present iff" is the only form in which that field is useful. */
+const STATE_FIELDS = {
+    claimed: BASE,
+    launching: [...BASE, "lifecycleUid", "launchAttemptId", "executor"],
+    live: [...BASE, "lifecycleUid", "runtimeOwner"],
+    preserved: [...BASE, "lifecycleUid", "runtimeOwner"],
+    relaunching: [...BASE, "lifecycleUid", "launchAttemptId", "executor"],
+    draining: [...BASE, "lifecycleUid", "runtimeOwner", "enteredAt"],
+    released: BASE,
+};
+function parseIncarnation(v, what) {
+    if (typeof v !== "object" || v === null || Array.isArray(v))
+        fail(`\`${what}\` must be an object`);
+    const o = v;
+    const extra = Object.keys(o).filter((k) => k !== "instanceId" && k !== "processEpoch");
+    if (extra.length > 0)
+        fail(`unknown field(s) on \`${what}\`: ${extra.join(", ")}`);
+    if (typeof o.instanceId !== "string" || o.instanceId.length === 0)
+        fail(`\`${what}.instanceId\` must be a non-empty string`);
+    if (typeof o.processEpoch !== "number" || !Number.isSafeInteger(o.processEpoch) || o.processEpoch < 0)
+        fail(`\`${what}.processEpoch\` must be a non-negative safe integer — an incarnation, not an identity`);
+    return { instanceId: o.instanceId, processEpoch: o.processEpoch };
+}
+function parseClaimant(v) {
+    if (typeof v !== "object" || v === null || Array.isArray(v))
+        fail("`claimant` must be an object");
+    const o = v;
+    const legal = {
+        action: ["kind", "goalId", "gen"],
+        direct: ["kind", "instanceId", "processEpoch", "opId"],
+        incumbent: ["kind", "backfillId"],
+    };
+    const kind = o.kind;
+    // `Object.hasOwn`, not `in` — see the state check below.
+    if (typeof kind !== "string" || !Object.hasOwn(legal, kind))
+        fail(`unknown claimant kind ${JSON.stringify(kind)} — the legal set is action|direct|incumbent`);
+    const extra = Object.keys(o).filter((k) => !legal[kind].includes(k));
+    if (extra.length > 0)
+        fail(`unknown field(s) on a ${kind} claimant: ${extra.join(", ")}`);
+    const missing = legal[kind].filter((k) => !(k in o));
+    if (missing.length > 0)
+        fail(`a ${kind} claimant is missing: ${missing.join(", ")}`);
+    if (kind === "action") {
+        if (typeof o.goalId !== "string" || o.goalId.length === 0)
+            fail("`claimant.goalId` must be a non-empty string");
+        if (typeof o.gen !== "number" || !Number.isSafeInteger(o.gen))
+            fail("`claimant.gen` must be a safe integer");
+        return { kind: "action", goalId: o.goalId, gen: o.gen };
+    }
+    if (kind === "direct") {
+        if (typeof o.opId !== "string" || o.opId.length === 0)
+            fail("`claimant.opId` must be a non-empty string");
+        const inc = parseIncarnation({ instanceId: o.instanceId, processEpoch: o.processEpoch }, "claimant");
+        return { kind: "direct", instanceId: inc.instanceId, processEpoch: inc.processEpoch, opId: o.opId };
+    }
+    if (typeof o.backfillId !== "string" || o.backfillId.length === 0)
+        fail("`claimant.backfillId` must be a non-empty string");
+    return { kind: "incumbent", backfillId: o.backfillId };
+}
+/** Parse a row from CURRENT BYTES with no knowledge of history — which is the property that makes a
+ *  sweeper able to act on a row it did not write. */
+export function parseEpName(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        fail("row must be a JSON object");
+    const o = value;
+    const state = o.state;
+    // `Object.hasOwn`, NOT `in`: the `in` operator walks the PROTOTYPE CHAIN, so a row whose
+    // discriminant is `toString`, `constructor` or `hasOwnProperty` passed this test and then
+    // crashed with an uncontrolled TypeError instead of the declared bad-request refusal. An
+    // attacker-supplied string reaching a plain-object lookup is exactly where that matters.
+    if (typeof state !== "string" || !Object.hasOwn(STATE_FIELDS, state))
+        fail(`unknown state ${JSON.stringify(state)} — the legal set is ${Object.keys(STATE_FIELDS).join("|")}`);
+    const s = state;
+    const legal = STATE_FIELDS[s];
+    const unknown = Object.keys(o).filter((k) => !legal.includes(k));
+    if (unknown.length > 0)
+        fail(`unknown field(s) for state ${s}: ${unknown.join(", ")} — each state names the COMPLETE legal set`);
+    const missing = legal.filter((k) => !(k in o));
+    if (missing.length > 0)
+        fail(`state ${s} is missing required field(s): ${missing.join(", ")}`);
+    if (o.v !== 1)
+        fail("`v` must be exactly 1");
+    if (typeof o.ts !== "number" || !Number.isSafeInteger(o.ts))
+        fail("`ts` must be a safe integer");
+    // `claimant` is NON-NULL in every state but `released`. A `live` row with a null claimant cannot
+    // support the identity checks every release depends on, so admitting one moves the failure to
+    // whichever release reads it next — far from the write that caused it.
+    const row = { v: 1, ts: o.ts, state: s, claimant: null };
+    if (s === "released") {
+        if (o.claimant !== null)
+            fail("`released` REQUIRES a null `claimant` — the name is unheld");
+    }
+    else {
+        if (o.claimant === null)
+            fail(`state ${s} REQUIRES a non-null \`claimant\`: a held name with no holder cannot answer the identity check every release makes`);
+        row.claimant = parseClaimant(o.claimant);
+    }
+    if (legal.includes("lifecycleUid")) {
+        if (typeof o.lifecycleUid !== "string" || o.lifecycleUid.length === 0)
+            fail("`lifecycleUid` must be a non-empty string");
+        row.lifecycleUid = o.lifecycleUid;
+    }
+    if (legal.includes("launchAttemptId")) {
+        if (typeof o.launchAttemptId !== "string" || o.launchAttemptId.length === 0)
+            fail("`launchAttemptId` must be a non-empty string");
+        row.launchAttemptId = o.launchAttemptId;
+    }
+    if (legal.includes("executor"))
+        row.executor = parseIncarnation(o.executor, "executor");
+    if (legal.includes("runtimeOwner"))
+        row.runtimeOwner = parseIncarnation(o.runtimeOwner, "runtimeOwner");
+    if (legal.includes("enteredAt")) {
+        if (typeof o.enteredAt !== "number" || !Number.isSafeInteger(o.enteredAt))
+            fail("`enteredAt` must be a safe integer");
+        row.enteredAt = o.enteredAt;
+    }
+    return row;
+}
+/** The § S2 edge table. Every legal transition, and nothing else.
+ *
+ *  `live → relaunching` IS ABSENT ON PURPOSE. Round 11 had it, and it reused ONE state for both a
+ *  running agent and a stopped one: the holder could rotate the nonce and spawn a second process,
+ *  and a crash after the spawn call was byte-identical to the state before it. Both are exactly
+ *  what `launching` exists to prevent, reintroduced one level down. Ordinary `live` authorizes NO
+ *  relaunch; only `preserved` does.
+ *
+ *  `draining → released` carries EXACTLY ONE actor, the operator. See the module header. */
+const EDGES = [
+    { from: "—", to: "claimed", actors: ["allocator"] },
+    { from: "released", to: "claimed", actors: ["allocator"] },
+    { from: "claimed", to: "launching", actors: ["claimant"] },
+    { from: "launching", to: "live", actors: ["claimant"] },
+    { from: "live", to: "preserved", actors: ["holder"] },
+    { from: "preserved", to: "relaunching", actors: ["holder"] },
+    { from: "relaunching", to: "live", actors: ["holder"] },
+    { from: "claimed", to: "released", actors: ["claimant", "sweeper"] },
+    { from: "launching", to: "draining", actors: ["sweeper"] },
+    { from: "live", to: "draining", actors: ["sweeper"] },
+    { from: "preserved", to: "draining", actors: ["sweeper"] },
+    { from: "relaunching", to: "draining", actors: ["sweeper"] },
+    { from: "draining", to: "released", actors: ["operator"] },
+    { from: "—", to: "live", actors: ["cutover"] },
+];
+function sameInc(a, b) {
+    if (a === undefined && b === undefined)
+        return true;
+    if (a === undefined || b === undefined)
+        return false;
+    return a.instanceId === b.instanceId && a.processEpoch === b.processEpoch;
+}
+function sameClaimant(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+/**
+ * Validate a transition against § S2. `prev` is `null` for the two creation edges.
+ *
+ * `gateSatisfied` is the caller's attestation that the edge's external precondition holds — the
+ * `goaleff` election won, the process authoritatively quiesced, the executor dead by the gate
+ * predicate, the operator's host-level attestation. It is a REQUIRED argument for the same reason
+ * `terminalExists` is in § S1: a precondition the caller can satisfy by not mentioning it is not a
+ * precondition.
+ */
+export function assertEpNameEdge(prev, next, actor, opts) {
+    const from = prev === null ? "—" : prev.state;
+    const to = next.state;
+    const edge = EDGES.find((e) => e.from === from && e.to === to);
+    if (edge === undefined) {
+        const legal = EDGES.filter((e) => e.from === from).map((e) => e.to);
+        fail(legal.length === 0
+            ? `\`${from}\` has no outgoing edge at all (attempted ${from} → ${to})`
+            : `${from} → ${to} is not a legal edge; from \`${from}\` the legal set is ${legal.join(", ")}`);
+    }
+    // CLOSED AT RUNTIME for the same reason as `goaleff`: an unknown role must be refused, not
+    // silently measured against a list it cannot be in. Here it happens to fail closed via
+    // `includes`, but relying on that is relying on an accident of the check's shape.
+    const ROLES = ["claimant", "holder", "sweeper", "operator", "allocator", "cutover"];
+    if (!ROLES.includes(actor.role))
+        fail(`unknown actor role ${JSON.stringify(actor.role)} — the legal set is ${ROLES.join("|")}`);
+    if (!edge.actors.includes(actor.role))
+        fail(`a ${actor.role} may not take ${from} → ${to}; that edge belongs to: ${edge.actors.join(", ")}`);
+    if (!opts.gateSatisfied)
+        fail(`${from} → ${to} requires its gate to hold FIRST, and the caller did not attest it`);
+    if (actor.role === "holder" && prev !== null && actor.lifecycleUid !== prev.lifecycleUid)
+        fail(`this edge is for the EXACT \`lifecycleUid\` holder only: row ${JSON.stringify(prev.lifecycleUid)}, `
+            + `actor ${JSON.stringify(actor.lifecycleUid)}`);
+    // ---- creation edges ------------------------------------------------------------------------
+    if (prev === null) {
+        if (to === "live") {
+            // The cutover backfill. `runtimeOwner` comes from the incumbent's LIVE gate row, and if no
+            // such row names an incarnation the key is NOT backfilled — it is recorded as a casualty. A
+            // `live` row whose owner is unknown is the row § R15-A exists to forbid, and inventing one
+            // here puts the unevaluable value in the durable record where every later release reads it.
+            if (next.runtimeOwner === undefined)
+                fail("the cutover may not backfill a `live` row without a `runtimeOwner` read from the incumbent's "
+                    + "live gate row — record a cutover CASUALTY instead of inventing an owner");
+            if (next.claimant?.kind !== "incumbent")
+                fail("a cutover backfill claims as `incumbent`; any other claimant kind is a different edge");
+        }
+        return;
+    }
+    // ---- claimant / lifecycle immutability -----------------------------------------------------
+    const reclaim = from === "released" && to === "claimed";
+    const releasing = to === "released";
+    if (!reclaim && !releasing && !sameClaimant(prev.claimant, next.claimant))
+        fail(`\`claimant\` is immutable while a claim is held: ${JSON.stringify(prev.claimant)} → ${JSON.stringify(next.claimant)}`);
+    if (releasing && next.claimant !== null)
+        fail("a release CLEARS `claimant`");
+    if (prev.lifecycleUid !== undefined && next.lifecycleUid !== undefined
+        && prev.lifecycleUid !== next.lifecycleUid)
+        fail(`\`lifecycleUid\` is immutable while a claim is held: ${prev.lifecycleUid} → ${next.lifecycleUid}`);
+    // ---- runtimeOwner: MOVED on the launch-completing edges, CARRIED everywhere else ------------
+    const completesLaunch = (from === "launching" || from === "relaunching") && to === "live";
+    const drainsFromLaunch = (from === "launching" || from === "relaunching") && to === "draining";
+    if (completesLaunch || drainsFromLaunch) {
+        // The FULL incarnation moves, both fields. `instanceId` alone is an identity, and the row would
+        // then name a process rather than the run of it that holds the handle table.
+        if (!sameInc(next.runtimeOwner, prev.executor))
+            fail(`${from} → ${to} MOVES the full \`executor\` into \`runtimeOwner\`: expected `
+                + `${JSON.stringify(prev.executor)}, got ${JSON.stringify(next.runtimeOwner)} — `
+                + `an \`instanceId\` without its \`processEpoch\` is an identity, not the incarnation that holds the handle`);
+        if (next.launchAttemptId !== undefined)
+            fail(`${from} → ${to} CLEARS \`launchAttemptId\``);
+    }
+    else if (to === "draining" || to === "preserved" || to === "live") {
+        // CARRIED, never re-derived. The derivation a reader reaches for is the slot row's
+        // ownerInstanceId, and user mode has no slot row at all — so it is unevaluable on a supported
+        // path, which is the same failure as a predicate whose actor cannot exist.
+        if (!sameInc(prev.runtimeOwner, next.runtimeOwner))
+            fail(`${from} → ${to} CARRIES \`runtimeOwner\` unchanged (${JSON.stringify(prev.runtimeOwner)} → `
+                + `${JSON.stringify(next.runtimeOwner)}) — it is installed once, when the spawn call returns, and never re-derived`);
+    }
+    if (to === "draining" && next.enteredAt === undefined)
+        fail("`draining` SETS `enteredAt`");
+    if (from === "draining" && to === "released") {
+        if (next.lifecycleUid !== undefined || next.runtimeOwner !== undefined || next.enteredAt !== undefined)
+            fail("the operator edge CLEARS `lifecycleUid`, `runtimeOwner` and `enteredAt`");
+    }
+}
+//# sourceMappingURL=endpoint-epname.js.map

package/dist/endpoint-epname.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-epname.js","sourceRoot":"","sources":["../src/endpoint-epname.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAmCtD,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,WAAW,OAAO,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AACvD;;sFAEsF;AACtF,MAAM,YAAY,GAA2C;IAC3D,OAAO,EAAE,IAAI;IACb,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,UAAU,CAAC;IACnE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,cAAc,EAAE,cAAc,CAAC;IAC/C,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,cAAc,EAAE,cAAc,CAAC;IACpD,WAAW,EAAE,CAAC,GAAG,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,UAAU,CAAC;IACrE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,CAAC;IAChE,QAAQ,EAAE,IAAI;CACf,CAAC;AAEF,SAAS,gBAAgB,CAAC,CAAU,EAAE,IAAY;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,KAAK,IAAI,sBAAsB,CAAC,CAAC;IACnG,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,cAAc,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,yBAAyB,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC/D,IAAI,CAAC,KAAK,IAAI,0CAA0C,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,GAAG,CAAC;QACnG,IAAI,CAAC,KAAK,IAAI,uFAAuF,CAAC,CAAC;IACzG,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAClG,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,MAAM,KAAK,GAAsC;QAC/C,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;QACjC,MAAM,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,CAAC;QACtD,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;KAClC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,yDAAyD;IACzD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;QACzD,IAAI,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,yBAAyB,IAAI,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,KAAK,IAAI,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAChH,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAC7G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC1G,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC,CAAC;QACrG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC/D,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;AACzD,CAAC;AAED;qDACqD;AACrD,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,KAAgC,CAAC;IAE3C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACxB,yFAAyF;IACzF,0FAA0F;IAC1F,yFAAyF;IACzF,yFAAyF;IACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC;QAClE,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3G,MAAM,CAAC,GAAG,KAAoB,CAAC;IAE/B,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,IAAI,CAAC,8BAA8B,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,IAAI,CAAC,SAAS,CAAC,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEzE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAEjG,iGAAiG;IACjG,8FAA8F;IAC9F,uEAAuE;IACvE,MAAM,GAAG,GAAc,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;YAAE,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;YACrB,IAAI,CAAC,SAAS,CAAC,oHAAoH,CAAC,CAAC;QACvI,GAAG,CAAC,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YACnE,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACpD,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YACzE,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,GAAG,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,GAAG,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,GAAG,CAAC,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACxG,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC7C,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAKD;;;;;;;;4FAQ4F;AAC5F,MAAM,KAAK,GAAoB;IAC7B,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;IACnD,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;IAC1D,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;IAC1D,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;IACvD,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;IACrD,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC5D,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;IACvD,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE;IACpE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE;IAC1D,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE;IACrD,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE;IAC1D,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE;IAC5D,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;IAC1D,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE;CAC/C,CAAC;AAEF,SAAS,OAAO,CAAC,CAAgC,EAAE,CAAgC;IACjF,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,CAAC;AAC5E,CAAC;AACD,SAAS,YAAY,CAAC,CAAwB,EAAE,CAAwB;IACtE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAsB,EACtB,IAAe,EACf,KAAkB,EAClB,IAAgC;IAEhC,MAAM,IAAI,GAAsB,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IACjE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IAEtB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,CAAC,KAAK,IAAI,6CAA6C,IAAI,MAAM,EAAE,GAAG;YACvE,CAAC,CAAC,GAAG,IAAI,MAAM,EAAE,gCAAgC,IAAI,uBAAuB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,2FAA2F;IAC3F,uFAAuF;IACvF,kFAAkF;IAClF,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAE,KAA2B,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACnC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,iBAAiB,IAAI,MAAM,EAAE,2BAA2B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxG,IAAI,CAAC,IAAI,CAAC,aAAa;QACrB,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,oEAAoE,CAAC,CAAC;IAE5F,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACtF,IAAI,CAAC,gEAAgE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI;cACrG,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAEtD,+FAA+F;IAC/F,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAClB,2FAA2F;YAC3F,4FAA4F;YAC5F,2FAA2F;YAC3F,4FAA4F;YAC5F,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;gBACjC,IAAI,CAAC,+FAA+F;sBAC/F,yEAAyE,CAAC,CAAC;YAClF,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,WAAW;gBACrC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QAClG,CAAC;QACD,OAAO;IACT,CAAC;IAED,+FAA+F;IAC/F,MAAM,OAAO,GAAG,IAAI,KAAK,UAAU,IAAI,EAAE,KAAK,SAAS,CAAC;IACxD,MAAM,SAAS,GAAG,EAAE,KAAK,UAAU,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;QACvE,IAAI,CAAC,oDAAoD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/H,IAAI,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;WAC/D,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QAC5C,IAAI,CAAC,wDAAwD,IAAI,CAAC,YAAY,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAE3G,gGAAgG;IAChG,MAAM,eAAe,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,aAAa,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;IAC1F,MAAM,gBAAgB,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,aAAa,CAAC,IAAI,EAAE,KAAK,UAAU,CAAC;IAC/F,IAAI,eAAe,IAAI,gBAAgB,EAAE,CAAC;QACxC,gGAAgG;QAChG,6EAA6E;QAC7E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC;YAC5C,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,+DAA+D;kBAC9E,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK;kBAC/E,0GAA0G,CAAC,CAAC;QACnH,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YACpC,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QACpE,mFAAmF;QACnF,8FAA8F;QAC9F,2EAA2E;QAC3E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC;YAChD,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK;kBAC7F,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,6EAA6E,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,EAAE,KAAK,UAAU,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC3F,IAAI,IAAI,KAAK,UAAU,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YACpG,IAAI,CAAC,yEAAyE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}

package/dist/endpoint-error.d.ts

@@ -15,11 +15,164 @@ export interface EpErrorDetail {
     kind: string;
     [key: string]: unknown;
 }
+/**
+ * `details[].kind` for a refusal raised because a responder ANSWERED but was not the incarnation
+ * this handle resolved against (§13.2): `failed-precondition` for a DIFFERENT instance, `expired`
+ * for the SAME instance at another EPOCH. It marks what the code alone cannot say — **the request
+ * drew an attributed reply from a live responder** — which rules out the reading "the incarnation
+ * is gone, resolve again". The reply may be a refusal or a result and the marker does not say
+ * which, so a retry here is a SECOND ATTEMPT that may duplicate an effect, never a repair.
+ */
+export declare const EP_UNBOUND_RESPONDER = "ai.cotal.ep.unbound-responder";
+/** The {@link EP_UNBOUND_RESPONDER} payload. Two producers: the describe-bound currency check (a
+ *  DIFFERENT instance) sets `answeredBy`/`boundTo`; the stale-epoch refusal (the SAME instance at
+ *  another epoch) sets `answeredEpoch`/`heldEpoch` and says in `reference` which epoch `heldEpoch`
+ *  is — `bind`, this caller's own resolve (so the handle is the stale side), or `registry`, the
+ *  responder's current registered epoch (so a responder behind it is superseded and still
+ *  answering). `boundTo` is set only where a bind exists. */
+export interface EpUnboundResponderDetail extends EpErrorDetail {
+    kind: typeof EP_UNBOUND_RESPONDER;
+    endpoint: string;
+    command: string;
+    /** The instance whose attributed reply was refused. */
+    answeredBy: string;
+    /** The instance this handle resolved against; absent when the caller holds no bind. */
+    boundTo?: string;
+    answeredEpoch?: number;
+    heldEpoch?: number;
+    reference?: "bind" | "registry";
+    /** Whether the call addressed one instance (`inst` rail) rather than the class queue. */
+    pinned: boolean;
+}
+/** True iff `e` carries the {@link EP_UNBOUND_RESPONDER} marker: a responder ANSWERED the request
+ *  (an attributed reply, which may be a refusal or a result), so retrying it is a second attempt
+ *  that may duplicate an effect, not a repair. */
+export declare function respondedButUnbound(e: unknown): boolean;
+/**
+ * `details[].kind` for a refusal raised because NO VALID REPLY REACHED THE CALLER: no responder on
+ * the subject, or the deadline elapsed with nothing attributed to the request's nonce. A frame that
+ * fails the request binding is dropped and is not an answer, so the marker means nothing
+ * ATTRIBUTABLE arrived, not that no bytes did. `unavailable`/`deadline-exceeded` alone is not
+ * evidence of silence — the same codes are raised where something did answer, or where a
+ * caller-side read failed after the describe — so a consumer stating a reachability verdict keys on
+ * this marker, never on the code.
+ */
+export declare const EP_UNANSWERED = "ai.cotal.ep.unanswered";
+/** The {@link EP_UNANSWERED} payload: the call that drew no reply. */
+export interface EpUnansweredDetail extends EpErrorDetail {
+    kind: typeof EP_UNANSWERED;
+    endpoint: string;
+    command: string;
+}
+/** True iff `e` carries the {@link EP_UNANSWERED} marker: no valid reply reached the caller (no
+ *  responder, or the deadline elapsed with nothing attributed to the request). */
+export declare function unansweredRequest(e: unknown): boolean;
+/**
+ * `details[].kind` for a refusal raised because a caller-side read of the SERVICE REGISTRY failed
+ * or did not settle: the scatter's freeze (§13.5) or its mandatory reconcile. It marks the failure
+ * as the caller's own, establishing NOTHING about the responders — the freeze fails before any
+ * request goes out, and the reconcile fails after the gather, where members may all have answered
+ * and their replies simply could not be classified. A consumer must not read it as their silence.
+ */
+export declare const EP_REGISTRY_READ_FAILED = "ai.cotal.ep.registry-read-failed";
+/** The {@link EP_REGISTRY_READ_FAILED} payload: the call whose registry read failed. */
+export interface EpRegistryReadFailedDetail extends EpErrorDetail {
+    kind: typeof EP_REGISTRY_READ_FAILED;
+    endpoint: string;
+    command: string;
+}
+/** True iff `e` carries the {@link EP_REGISTRY_READ_FAILED} marker: a caller-side registry read
+ *  failed; the responders were not the failure. */
+export declare function registryReadFailed(e: unknown): boolean;
+/**
+ * `details[].kind` for a refusal raised by the RESPONDER because the request declared a bound
+ * incarnation (`bind`, §13.3) that is not this instance: `failed-precondition` for a different
+ * instance, `expired` for the same instance at another epoch. It marks what no caller-side check
+ * can establish: **the command did not run, and no effect of it exists.**
+ *
+ * Set before the handler, before args validation, and before any seam that can consume a one-use
+ * proof, by the only party that knows which incarnation it is. {@link EP_UNBOUND_RESPONDER} is
+ * raised by the CALLER on the reply, after the responder has already acted — a report, not a
+ * guard. So a caller holding THIS marker may re-resolve and re-issue without risking a duplicate,
+ * which is exactly what a caller holding that one must not do.
+ */
+export declare const EP_BIND_REFUSED = "ai.cotal.ep.bind-refused";
+/** The {@link EP_BIND_REFUSED} payload: the incarnation the caller bound, and the one that
+ *  refused. Both ids are stated because either field alone can be the mismatching one — a
+ *  different instance, or the same instance at any other epoch — and the reader needs to see
+ *  which. */
+export interface EpBindRefusedDetail extends EpErrorDetail {
+    kind: typeof EP_BIND_REFUSED;
+    endpoint: string;
+    command: string;
+    /** What the request's `bind` block declared. */
+    boundTo: {
+        instanceId: string;
+        epoch: number;
+    };
+    /** The refusing instance's own identity. */
+    servedBy: {
+        instanceId: string;
+        epoch: number;
+    };
+}
+/** True iff an `EpError` CARRIES the {@link EP_BIND_REFUSED} marker, saying nothing about whether
+ *  the marker is believable. It is the claim's presence, not its acceptance.
+ *
+ *  The two questions come apart, and conflating them is what this pair exists to prevent. Whether a
+ *  caller may ACT on a bind refusal — re-issue a command it would otherwise never repeat — needs
+ *  the marker AND an explicit `not-executed`, which is {@link replyRefusedBeforeEffect}. Whether a
+ *  reply is CHECKED for self-consistency needs only the claim, because the contradiction being
+ *  checked is between the reply's BODY and the subject the broker pinned, and that is a
+ *  contradiction whatever the outcome field says — or does not say.
+ *
+ *  Gating the checks on the stronger predicate meant a reply could skip them by OMITTING a field,
+ *  so the least credible shape drew the least scrutiny. */
+export declare function bindRefusalMarked(e: EpError | undefined): boolean;
+/** True iff an `EpError` carries the {@link EP_BIND_REFUSED} marker: a responder refused BEFORE
+ *  executing, because it is not the incarnation the caller bound — the command did not run.
+ *
+ *  It takes an `EpError` and not a thrown value, unlike its sibling predicates, because this
+ *  refusal never arrives as a throw: it is the responder's own application-level failure and
+ *  those ride the reply (§13.5). A consumer reads it off `reply.error`.
+ *
+ *  A REPLY THAT CONTRADICTS ITSELF IS NOT A REFUSAL. The marker IS the assertion that the command
+ *  did not run, and {@link EpError.outcome} says a responder refusing before dispatch MUST carry
+ *  `not-executed` — but {@link EpBindRefusedDetail} carries no outcome of its own, so nothing in the
+ *  type stops a reply pairing the marker with `executed`. That combination is not merely odd: the
+ *  only consumer of this predicate re-issues a command **without** the {@link isRepeatSafeCommand}
+ *  gate, on the strength of the marker, so resolving the contradiction toward "refused" re-sends a
+ *  command the reply just said had ALREADY RUN. A present outcome that disagrees therefore wins, and
+ *  the reply is not read as a refusal.
+ *
+ *  AN ABSENT OUTCOME IS NOT A REFUSAL EITHER, and it is the same answer as `unknown` because the
+ *  spec says they are the same value: SPEC 1510, "an error reply that omits `outcome` MUST be read
+ *  as `unknown`". An earlier revision accepted absence, on the argument that a responder too old to
+ *  know the field emits exactly that and refusing it would stop core repairing splits for a third
+ *  party that is otherwise behaving. That argument does not survive SPEC 2271: a client MUST NOT
+ *  automatically re-issue a command declared `write` after any outcome that does not prove
+ *  non-execution, whatever `id` the re-issue carries, and `unknown` proves nothing. Since this
+ *  predicate is what licenses a re-issue that SKIPS {@link isRepeatSafeCommand}, accepting absence
+ *  made core re-issue writes on an outcome the spec says is `unknown`.
+ *
+ *  The cost is real and it is bounded: a responder that omits the field no longer has its splits
+ *  repaired. That responder is already non-conforming, because §13.3 requires a refusal raised
+ *  before dispatch to carry `not-executed`, so what it loses is a repair it was never owed. This
+ *  endpoint's own responder sets the field, so conforming deployments are unaffected. */
+export declare function replyRefusedBeforeEffect(e: EpError | undefined): boolean;
+/** §13.3 **Effect outcome**: whether the command's effect occurred. Emitted by the RESPONDER,
+ *  which is the only party that knows. An omitted `outcome` MUST be read as `unknown`, so absence
+ *  is never evidence of non-execution. */
+export type EpEffectOutcome = "executed" | "not-executed" | "unknown";
 /** The `EndpointReply.error` shape. */
 export interface EpError {
     code: string;
     message: string;
     details?: EpErrorDetail[];
+    /** §13.3. A responder refusing BEFORE dispatching to the handler MUST carry `not-executed`;
+     *  one refusing AFTER the handler ran MUST carry `executed`; one that cannot tell MUST carry
+     *  `unknown` rather than guess. Absent on a caller-raised refusal, which is not a reply. */
+    outcome?: EpEffectOutcome;
 }
 /** A consuming-boundary rejection: the catalog code plus a human message. Boundaries convert it
  *  to an `EndpointReply` error via {@link EpEnvelopeError.toEpError} (or, on reply-less planes,
@@ -27,7 +180,8 @@ export interface EpError {
 export declare class EpEnvelopeError extends Error {
     readonly code: EpErrorCode;
     readonly details?: EpErrorDetail[] | undefined;
-    constructor(code: EpErrorCode, message: string, details?: EpErrorDetail[] | undefined);
+    readonly outcome?: EpEffectOutcome | undefined;
+    constructor(code: EpErrorCode, message: string, details?: EpErrorDetail[] | undefined, outcome?: EpEffectOutcome | undefined);
     toEpError(): EpError;
 }
 //# sourceMappingURL=endpoint-error.d.ts.map

package/dist/endpoint-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-error.d.ts","sourceRoot":"","sources":["../src/endpoint-error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;mDACmD;AACnD,eAAO,MAAM,cAAc,0XAMhB,CAAC;AACZ,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,uCAAuC;AACvC,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;qEAEqE;AACrE,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW;IAAmB,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE;gBAAtE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAW,OAAO,CAAC,EAAE,aAAa,EAAE,YAAA;IAI3F,SAAS,IAAI,OAAO;CAGrB"}
+{"version":3,"file":"endpoint-error.d.ts","sourceRoot":"","sources":["../src/endpoint-error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;mDACmD;AACnD,eAAO,MAAM,cAAc,0XAMhB,CAAC;AACZ,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,kCAAkC,CAAC;AAEpE;;;;;6DAK6D;AAC7D,MAAM,WAAW,wBAAyB,SAAQ,aAAa;IAC7D,IAAI,EAAE,OAAO,oBAAoB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAChC,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;kDAEkD;AAClD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAEvD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,2BAA2B,CAAC;AAEtD,sEAAsE;AACtE,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,IAAI,EAAE,OAAO,aAAa,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;kFACkF;AAClF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAErD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E,wFAAwF;AACxF,MAAM,WAAW,0BAA2B,SAAQ,aAAa;IAC/D,IAAI,EAAE,OAAO,uBAAuB,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;mDACmD;AACnD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAE1D;;;aAGa;AACb,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,IAAI,EAAE,OAAO,eAAe,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,4CAA4C;IAC5C,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACjD;AAED;;;;;;;;;;;2DAW2D;AAC3D,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAEjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yFA6ByF;AACzF,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAGxE;AAED;;0CAE0C;AAC1C,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC;AAEtE,uCAAuC;AACvC,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B;;gGAE4F;IAC5F,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED;;qEAEqE;AACrE,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW;IAAmB,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe;gBADzB,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAW,OAAO,CAAC,EAAE,aAAa,EAAE,YAAA,EACtE,OAAO,CAAC,EAAE,eAAe,YAAA;IAI9C,SAAS,IAAI,OAAO;CAOrB"}

package/dist/endpoint-error.js

@@ -15,20 +15,132 @@ export const EP_ERROR_CODES = Object.freeze([
     "deadline-exceeded", "cancelled", "expired", "unavailable", "unimplemented",
     "resource-exhausted", "internal",
 ]);
+/**
+ * `details[].kind` for a refusal raised because a responder ANSWERED but was not the incarnation
+ * this handle resolved against (§13.2): `failed-precondition` for a DIFFERENT instance, `expired`
+ * for the SAME instance at another EPOCH. It marks what the code alone cannot say — **the request
+ * drew an attributed reply from a live responder** — which rules out the reading "the incarnation
+ * is gone, resolve again". The reply may be a refusal or a result and the marker does not say
+ * which, so a retry here is a SECOND ATTEMPT that may duplicate an effect, never a repair.
+ */
+export const EP_UNBOUND_RESPONDER = "ai.cotal.ep.unbound-responder";
+/** True iff `e` carries the {@link EP_UNBOUND_RESPONDER} marker: a responder ANSWERED the request
+ *  (an attributed reply, which may be a refusal or a result), so retrying it is a second attempt
+ *  that may duplicate an effect, not a repair. */
+export function respondedButUnbound(e) {
+    return e instanceof EpEnvelopeError && (e.details ?? []).some((d) => d.kind === EP_UNBOUND_RESPONDER);
+}
+/**
+ * `details[].kind` for a refusal raised because NO VALID REPLY REACHED THE CALLER: no responder on
+ * the subject, or the deadline elapsed with nothing attributed to the request's nonce. A frame that
+ * fails the request binding is dropped and is not an answer, so the marker means nothing
+ * ATTRIBUTABLE arrived, not that no bytes did. `unavailable`/`deadline-exceeded` alone is not
+ * evidence of silence — the same codes are raised where something did answer, or where a
+ * caller-side read failed after the describe — so a consumer stating a reachability verdict keys on
+ * this marker, never on the code.
+ */
+export const EP_UNANSWERED = "ai.cotal.ep.unanswered";
+/** True iff `e` carries the {@link EP_UNANSWERED} marker: no valid reply reached the caller (no
+ *  responder, or the deadline elapsed with nothing attributed to the request). */
+export function unansweredRequest(e) {
+    return e instanceof EpEnvelopeError && (e.details ?? []).some((d) => d.kind === EP_UNANSWERED);
+}
+/**
+ * `details[].kind` for a refusal raised because a caller-side read of the SERVICE REGISTRY failed
+ * or did not settle: the scatter's freeze (§13.5) or its mandatory reconcile. It marks the failure
+ * as the caller's own, establishing NOTHING about the responders — the freeze fails before any
+ * request goes out, and the reconcile fails after the gather, where members may all have answered
+ * and their replies simply could not be classified. A consumer must not read it as their silence.
+ */
+export const EP_REGISTRY_READ_FAILED = "ai.cotal.ep.registry-read-failed";
+/** True iff `e` carries the {@link EP_REGISTRY_READ_FAILED} marker: a caller-side registry read
+ *  failed; the responders were not the failure. */
+export function registryReadFailed(e) {
+    return e instanceof EpEnvelopeError && (e.details ?? []).some((d) => d.kind === EP_REGISTRY_READ_FAILED);
+}
+/**
+ * `details[].kind` for a refusal raised by the RESPONDER because the request declared a bound
+ * incarnation (`bind`, §13.3) that is not this instance: `failed-precondition` for a different
+ * instance, `expired` for the same instance at another epoch. It marks what no caller-side check
+ * can establish: **the command did not run, and no effect of it exists.**
+ *
+ * Set before the handler, before args validation, and before any seam that can consume a one-use
+ * proof, by the only party that knows which incarnation it is. {@link EP_UNBOUND_RESPONDER} is
+ * raised by the CALLER on the reply, after the responder has already acted — a report, not a
+ * guard. So a caller holding THIS marker may re-resolve and re-issue without risking a duplicate,
+ * which is exactly what a caller holding that one must not do.
+ */
+export const EP_BIND_REFUSED = "ai.cotal.ep.bind-refused";
+/** True iff an `EpError` CARRIES the {@link EP_BIND_REFUSED} marker, saying nothing about whether
+ *  the marker is believable. It is the claim's presence, not its acceptance.
+ *
+ *  The two questions come apart, and conflating them is what this pair exists to prevent. Whether a
+ *  caller may ACT on a bind refusal — re-issue a command it would otherwise never repeat — needs
+ *  the marker AND an explicit `not-executed`, which is {@link replyRefusedBeforeEffect}. Whether a
+ *  reply is CHECKED for self-consistency needs only the claim, because the contradiction being
+ *  checked is between the reply's BODY and the subject the broker pinned, and that is a
+ *  contradiction whatever the outcome field says — or does not say.
+ *
+ *  Gating the checks on the stronger predicate meant a reply could skip them by OMITTING a field,
+ *  so the least credible shape drew the least scrutiny. */
+export function bindRefusalMarked(e) {
+    return (e?.details ?? []).some((d) => d.kind === EP_BIND_REFUSED);
+}
+/** True iff an `EpError` carries the {@link EP_BIND_REFUSED} marker: a responder refused BEFORE
+ *  executing, because it is not the incarnation the caller bound — the command did not run.
+ *
+ *  It takes an `EpError` and not a thrown value, unlike its sibling predicates, because this
+ *  refusal never arrives as a throw: it is the responder's own application-level failure and
+ *  those ride the reply (§13.5). A consumer reads it off `reply.error`.
+ *
+ *  A REPLY THAT CONTRADICTS ITSELF IS NOT A REFUSAL. The marker IS the assertion that the command
+ *  did not run, and {@link EpError.outcome} says a responder refusing before dispatch MUST carry
+ *  `not-executed` — but {@link EpBindRefusedDetail} carries no outcome of its own, so nothing in the
+ *  type stops a reply pairing the marker with `executed`. That combination is not merely odd: the
+ *  only consumer of this predicate re-issues a command **without** the {@link isRepeatSafeCommand}
+ *  gate, on the strength of the marker, so resolving the contradiction toward "refused" re-sends a
+ *  command the reply just said had ALREADY RUN. A present outcome that disagrees therefore wins, and
+ *  the reply is not read as a refusal.
+ *
+ *  AN ABSENT OUTCOME IS NOT A REFUSAL EITHER, and it is the same answer as `unknown` because the
+ *  spec says they are the same value: SPEC 1510, "an error reply that omits `outcome` MUST be read
+ *  as `unknown`". An earlier revision accepted absence, on the argument that a responder too old to
+ *  know the field emits exactly that and refusing it would stop core repairing splits for a third
+ *  party that is otherwise behaving. That argument does not survive SPEC 2271: a client MUST NOT
+ *  automatically re-issue a command declared `write` after any outcome that does not prove
+ *  non-execution, whatever `id` the re-issue carries, and `unknown` proves nothing. Since this
+ *  predicate is what licenses a re-issue that SKIPS {@link isRepeatSafeCommand}, accepting absence
+ *  made core re-issue writes on an outcome the spec says is `unknown`.
+ *
+ *  The cost is real and it is bounded: a responder that omits the field no longer has its splits
+ *  repaired. That responder is already non-conforming, because §13.3 requires a refusal raised
+ *  before dispatch to carry `not-executed`, so what it loses is a repair it was never owed. This
+ *  endpoint's own responder sets the field, so conforming deployments are unaffected. */
+export function replyRefusedBeforeEffect(e) {
+    if (!bindRefusalMarked(e))
+        return false;
+    return e?.outcome === "not-executed";
+}
 /** A consuming-boundary rejection: the catalog code plus a human message. Boundaries convert it
  *  to an `EndpointReply` error via {@link EpEnvelopeError.toEpError} (or, on reply-less planes,
  *  to the §13.4 decision/quarantine fact carrying the same code). */
 export class EpEnvelopeError extends Error {
     code;
     details;
-    constructor(code, message, details) {
+    outcome;
+    constructor(code, message, details, outcome) {
         super(message);
         this.code = code;
         this.details = details;
+        this.outcome = outcome;
         this.name = "EpEnvelopeError";
     }
     toEpError() {
-        return { code: this.code, message: this.message, ...(this.details ? { details: this.details } : {}) };
+        return {
+            code: this.code, message: this.message,
+            ...(this.details ? { details: this.details } : {}),
+            ...(this.outcome ? { outcome: this.outcome } : {}),
+        };
     }
 }
 //# sourceMappingURL=endpoint-error.js.map

package/dist/endpoint-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-error.js","sourceRoot":"","sources":["../src/endpoint-error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;mDACmD;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,aAAa,EAAE,qBAAqB,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB;IACxF,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,WAAW,EAAE,gBAAgB;IACxF,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB;IAC1E,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe;IAC3E,oBAAoB,EAAE,UAAU;CACxB,CAAC,CAAC;AAgBZ;;qEAEqE;AACrE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAA6C;IAAlE,YAAqB,IAAiB,EAAE,OAAe,EAAW,OAAyB;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAa;QAA4B,YAAO,GAAP,OAAO,CAAkB;QAEzF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;IACD,SAAS;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxG,CAAC;CACF"}
+{"version":3,"file":"endpoint-error.js","sourceRoot":"","sources":["../src/endpoint-error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;mDACmD;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,aAAa,EAAE,qBAAqB,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB;IACxF,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,WAAW,EAAE,gBAAgB;IACxF,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB;IAC1E,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe;IAC3E,oBAAoB,EAAE,UAAU;CACxB,CAAC,CAAC;AASZ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAuBpE;;kDAEkD;AAClD,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,OAAO,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAStD;kFACkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,CAAU;IAC1C,OAAO,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kCAAkC,CAAC;AAS1E;mDACmD;AACnD,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,OAAO,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC;AAC3G,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAgB1D;;;;;;;;;;;2DAW2D;AAC3D,MAAM,UAAU,iBAAiB,CAAC,CAAsB;IACtD,OAAO,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yFA6ByF;AACzF,MAAM,UAAU,wBAAwB,CAAC,CAAsB;IAC7D,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,KAAK,cAAc,CAAC;AACvC,CAAC;AAkBD;;qEAEqE;AACrE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAA6C;IAC7C;IADrB,YAAqB,IAAiB,EAAE,OAAe,EAAW,OAAyB,EACtE,OAAyB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QAFI,SAAI,GAAJ,IAAI,CAAa;QAA4B,YAAO,GAAP,OAAO,CAAkB;QACtE,YAAO,GAAP,OAAO,CAAkB;QAE5C,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;IACD,SAAS;QACP,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;YACtC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC;IACJ,CAAC;CACF"}