@cotal-ai/core 0.84.0 → 0.86.0

package/dist/endpoint-caller.d.ts

@@ -0,0 +1,113 @@
+import type { NatsConnection } from "@nats-io/transport-node";
+import type { CompiledContract } from "./schema-profile.js";
+import { type EpVerbTarget, type EpAttributedReply } from "./endpoint-call.js";
+import { type EpCaller } from "./endpoint-subjects.js";
+export declare const dec: import("util").TextDecoder, enc: import("util").TextEncoder;
+/** Delivery margin above an action owner's accepted readiness budget. Spawn's established generic
+ *  invariant was 40s client > 30s manager; preserve that measured 10s separation when a connector
+ *  declares a different budget instead of inventing a second timeout policy. */
+export declare const GOAL_FOLLOW_MARGIN_MS = 10000;
+/** A resolved command contract: the compiled input/output validators (recompiled from the store,
+ *  digest-verified against the registered declaration) plus the command's §13.2 admission facts. */
+export interface ResolvedCommand {
+    command: string;
+    contract: {
+        input: CompiledContract;
+        output: CompiledContract;
+    };
+    class: string;
+    targeted: boolean;
+    modes: readonly string[];
+    capability: string;
+}
+/** An endpoint's resolved invocation surface: every command the caller may see, with recompiled
+ *  digest-verified contracts. Built from a fresh `describe` + store fetch. Carries the `caller`
+ *  triple the describe ran as, so {@link invokeCommand} reuses the same authenticated identity,
+ *  and the ANSWERING incarnation's identity off the describe reply SUBJECT (broker-authenticated:
+ *  the §13.9 serve publish row pins `instanceId`+`epoch`, a responder cannot stamp another's) -
+ *  {@link invokeCommand}'s default currency check binds the invoke to this incarnation. */
+export interface ResolvedService {
+    endpoint: string;
+    owner: string;
+    caller: EpCaller;
+    responder: {
+        instanceId: string;
+        epoch: number;
+    };
+    commands: Map<string, ResolvedCommand>;
+    /** Set when the service was resolved PINNED to one instance's `inst` route (`--on`):
+     *  {@link invokeCommand} then routes commands to that exact instance, never the class `one` queue,
+     *  so a multi-manager space can be addressed per-instance. Absent ⇒ class anycast (the default). */
+    pinnedInstanceId?: string;
+}
+/**
+ * The reserved `describe` command as a raw request/reply (§13.7: describe pins NO contract, so it
+ * carries no `op` digests — {@link epCall} always stamps digests and the serve boundary rejects a
+ * digest-bearing describe as `contract-mismatch`, so this is a purpose-built raw path). It
+ * REQUEST-BINDS its reply exactly as {@link epCall}'s `parseAttributedReply` does (§13.2): the
+ * responder grant `epResponderReplyPattern` spans EVERY caller suffix, so any live responder can
+ * publish on the caller's rail at any nonce — acceptance therefore checks the reply SUBJECT's
+ * endpoint + nonce AND the body's echoed request id, not just "first `{ok:true}` on the rail".
+ * A reply that fails any of these is IGNORED (not rejected: an attacker racing a wrong-nonce reply
+ * must not be able to fail an honest describe), and the wait continues to the deadline. A signal
+ * that aborts with a `TimeoutError` ends the wait as that deadline would.
+ */
+export declare function describeEndpoint(nc: NatsConnection, space: string, endpoint: string, caller: EpCaller, opts?: {
+    deadlineMs?: number;
+    instanceId?: string;
+    signal?: AbortSignal;
+}): Promise<{
+    answer: DescribeAnswer;
+    responder: {
+        instanceId: string;
+        epoch: number;
+    };
+}>;
+/** The describe answer shape a caller reads (a subset — the fields the resolver needs). */
+interface DescribeAnswer {
+    public: boolean;
+    descriptor: {
+        endpoint: string;
+        owner: string;
+        clusters: {
+            digest: string;
+            commands: string[];
+        }[];
+    };
+}
+/** How many times a call is re-issued after a `not-executed` bind refusal. Every
+ *  re-issue is a first attempt, so this is a loop guard and not a duplication guard. Each attempt
+ *  splits with probability (m-1)/m in a space of m managers, so seventeen attempts leave a
+ *  three-manager space about 1 in 1000 where the unrepaired call failed 2 in 3 (#398). An attempt
+ *  costs an answered describe and invoke, never an elapsed deadline. */
+export declare const BIND_SPLIT_REISSUES = 16;
+/**
+ * INVOKE one named command on a resolved service: validate nothing here (the compiled input
+ * contract in {@link epCall}'s request builder gates args before publish, and the responder's
+ * digest-bound boundary re-validates), route on the `one` rail, return the attributed reply. A
+ * command absent from the resolved surface is `not-found` (the caller cannot see it, or it does
+ * not exist); a targeted command needs its `target`.
+ *
+ * Currency: `opts.currentEpoch` (e.g. the registry-read `serviceEpochReader`) when supplied;
+ * otherwise the DESCRIBE-BOUND default - accept exactly the incarnation that answered this
+ * service's resolve (its broker-authenticated `instanceId`+`epoch` off the describe reply
+ * subject) and refuse `failed-precondition` when a DIFFERENT instance wins the `one` queue
+ * (a superseded-or-split responder; re-resolve to adopt a legitimate successor). The bind needs
+ * no registry read grant, and it is strictly stronger than no check: two live instances of a
+ * single-instance endpoint can never both pass one resolved handle.
+ */
+export declare function invokeCommand(nc: NatsConnection, space: string, service: ResolvedService, command: string, args: Record<string, unknown> | undefined, opts: {
+    target?: EpVerbTarget;
+    deadlineMs?: number;
+    signal?: AbortSignal;
+    currentEpoch?: (instanceId: string) => Promise<number> | number;
+    /** A caller-pinned envelope id (see {@link EpVerbOp.id}): a goal-accepting command binds its
+     *  goal under it, which is what lets a durable caller resubmit idempotently. */
+    id?: string;
+}): Promise<EpAttributedReply>;
+/** The refusal a goal-following call meets on a handle whose endpoint serves no `goal-result`: an
+ *  accepted goal could never be read back to its terminal (SPEC 13.6), so nothing is submitted.
+ *  `undefined` when the handle can follow. */
+export declare function goalFollowRefusal(service: ResolvedService): EpAttributedReply | undefined;
+export {};
+//# sourceMappingURL=endpoint-caller.d.ts.map

package/dist/endpoint-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-caller.d.ts","sourceRoot":"","sources":["../src/endpoint-caller.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,yBAAyB,CAAC;AAG5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAU,KAAK,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAwE,KAAK,QAAQ,EAAgB,MAAM,wBAAwB,CAAC;AAE3I,eAAO,MAAM,GAAG,4BAAoB,EAAE,GAAG,4BAAoB,CAAC;AAmB9D;;gFAEgF;AAChF,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAE5C;oGACoG;AACpG,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QAAE,KAAK,EAAE,gBAAgB,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAAC;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;2FAK2F;AAC3F,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,QAAQ,CAAC;IACjB,SAAS,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvC;;wGAEoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,cAAc,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,QAAQ,EAChB,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAC5E,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CA0FvF;AAED,2FAA2F;AAC3F,UAAU,cAAc;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;CACrG;AAED;;;;wEAIwE;AACxE,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,IAAI,EAAE;IACJ,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAChE;oFACgF;IAChF,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,GACA,OAAO,CAAC,iBAAiB,CAAC,CA6E5B;AAED;;8CAE8C;AAC9C,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,iBAAiB,GAAG,SAAS,CASzF"}

package/dist/endpoint-caller.js

@@ -0,0 +1,260 @@
+/** The node-free half of the generic caller path: `describeEndpoint`, `invokeCommand` and
+ *  `goalFollowRefusal`, shared by `endpoint-invoke` and the browser entry. Moved unchanged from
+ *  `endpoint-invoke.ts`; the store fetch, recompile and split repair stay there. */
+import { base64url } from "./base64url.js";
+import { openPublishDenialWatch } from "./endpoint-publish-denial.js";
+import { EpEnvelopeError, EP_UNBOUND_RESPONDER, EP_UNANSWERED, parseEndpointReply } from "./endpoint-envelope.js";
+import { epCall } from "./endpoint-call.js";
+import { epRequestSubject, epCallerReplyFilter, epPlaneTokens, parseEpSubject } from "./endpoint-subjects.js";
+export const dec = new TextDecoder(), enc = new TextEncoder();
+const nonce = () => base64url(globalThis.crypto.getRandomValues(new Uint8Array(24)));
+/** A describe is the reserved read-only discovery bootstrap, so an unanswered request may be
+ *  re-published within its ORIGINAL deadline. Core NATS does not retain a request sent before a
+ *  responder subscribes; without this bounded retry, a responder that registers one moment later
+ *  is invisible until the caller pays the whole deadline. Commands are never retried here. */
+const DESCRIBE_RETRY_MS = 250;
+/** Format a caught value on a path that cannot afford to throw (timer/callback). A
+ *  poisoned `Error.message` getter or `toString` must not escape the catch; the
+ *  fallback is the detail, never a reason to skip the rejection. */
+function caughtText(e, fallback) {
+    try {
+        return e instanceof Error ? e.message : String(e);
+    }
+    catch {
+        return fallback;
+    }
+}
+/** Delivery margin above an action owner's accepted readiness budget. Spawn's established generic
+ *  invariant was 40s client > 30s manager; preserve that measured 10s separation when a connector
+ *  declares a different budget instead of inventing a second timeout policy. */
+export const GOAL_FOLLOW_MARGIN_MS = 10_000;
+/**
+ * The reserved `describe` command as a raw request/reply (§13.7: describe pins NO contract, so it
+ * carries no `op` digests — {@link epCall} always stamps digests and the serve boundary rejects a
+ * digest-bearing describe as `contract-mismatch`, so this is a purpose-built raw path). It
+ * REQUEST-BINDS its reply exactly as {@link epCall}'s `parseAttributedReply` does (§13.2): the
+ * responder grant `epResponderReplyPattern` spans EVERY caller suffix, so any live responder can
+ * publish on the caller's rail at any nonce — acceptance therefore checks the reply SUBJECT's
+ * endpoint + nonce AND the body's echoed request id, not just "first `{ok:true}` on the rail".
+ * A reply that fails any of these is IGNORED (not rejected: an attacker racing a wrong-nonce reply
+ * must not be able to fail an honest describe), and the wait continues to the deadline. A signal
+ * that aborts with a `TimeoutError` ends the wait as that deadline would.
+ */
+export async function describeEndpoint(nc, space, endpoint, caller, opts = {}) {
+    opts.signal?.throwIfAborted();
+    const deadlineMs = opts.deadlineMs ?? 10_000;
+    const n = nonce();
+    const requestId = nonce();
+    // `--on <instance>`: PIN the describe to one instance's `inst` route so a multi-manager
+    // space resolves the exact instance addressed, not whichever wins the class `one` queue. Default =
+    // class anycast (mode "one"), unchanged for every existing caller.
+    const route = opts.instanceId !== undefined ? { mode: "inst", instanceId: opts.instanceId } : { mode: "one" };
+    const subject = epRequestSubject(space, { route, endpoint, command: "describe", caller, nonce: n });
+    // The plane this describe rides, recorded on the unanswered marker so a surface that renders a
+    // reachability verdict can scope it (SPEC 13.15: the legacy and versioned rails are disjoint subject spaces,
+    // an endpoint serves both, and a caller holds rows on one of them only). Silence on the versioned rail is
+    // therefore consistent with a responder that predates the versioned rail and serves `ep` alone.
+    const rail = epPlaneTokens(caller).join(".");
+    const env = {
+        v: 1, id: requestId, op: { endpoint, command: "describe" }, class: "ephemeral",
+        replyExpected: true, deadlineMs, from: { id: `${caller.owner}.${caller.actor}`, name: caller.actor },
+    };
+    let sub;
+    let timer;
+    let retryTimer;
+    let denialWatch;
+    let onAbort;
+    const startedAt = performance.now();
+    const unanswered = (ms) => new EpEnvelopeError("deadline-exceeded", `no describe reply from ${endpoint}${opts.instanceId !== undefined ? ` instance ${opts.instanceId}` : ""} within ${ms}ms on the ${rail} rail`, [{ kind: EP_UNANSWERED, endpoint, command: "describe", rail }]);
+    const cancelled = new Promise((_, reject) => {
+        onAbort = () => reject(opts.signal?.reason?.name === "TimeoutError"
+            ? unanswered(Math.round(performance.now() - startedAt))
+            : new EpEnvelopeError("unavailable", `describe(${endpoint}) observation cancelled`));
+        opts.signal?.addEventListener("abort", onAbort, { once: true });
+    });
+    try {
+        // REGISTER THE PERMISSION WATCH BEFORE THE PUBLISH IT IS WATCHING. See
+        // {@link openPublishDenialWatch}: a refused publish is otherwise indistinguishable
+        // from an unanswered describe.
+        denialWatch = openPublishDenialWatch(nc, subject, () => new EpEnvelopeError("permission-denied", `the describe for ${endpoint} was REFUSED BY THE BROKER, not unanswered: this caller's credential does not authorize publishing to "${subject}"${opts.instanceId !== undefined ? ` (the instance rail for ${opts.instanceId}: an instance-addressed call needs a credential minted with that instance, not a class-rail one)` : ""}. The responder may be perfectly healthy; the grant is what is missing (SPEC 13.2)`, undefined, "not-executed"), "describe");
+        const got = new Promise((resolve, reject) => {
+            sub = nc.subscribe(epCallerReplyFilter(space, caller), {
+                callback: (err, msg) => {
+                    if (err) {
+                        reject(new EpEnvelopeError("unavailable", `describe reply subscription failed: ${err.message}`));
+                        return;
+                    }
+                    // REQUEST-BIND off the reply SUBJECT first (§13.2): the responder triple + nonce are
+                    // broker-pinned by the serve publish grant. A reply for a DIFFERENT endpoint, or on a
+                    // nonce that is not the one we published (the rail is shared across our concurrent
+                    // requests, and a hostile responder can publish at any nonce), is NOT ours — ignore it
+                    // and keep waiting, never fail the honest describe on an injected reply.
+                    const parsed = parseEpSubject(msg.subject);
+                    if (!parsed || parsed.plane !== "reply" || parsed.endpoint !== endpoint || parsed.nonce !== n)
+                        return;
+                    // Then the body: it must parse as an EndpointReply and ECHO our request id on this
+                    // nonce-scoped rail (§13.3) — the second half of the confused-deputy binding.
+                    let reply;
+                    try {
+                        reply = parseEndpointReply(JSON.parse(dec.decode(msg.data)));
+                    }
+                    catch {
+                        return;
+                    } // a malformed body on our nonce is not a usable answer; wait for a valid one
+                    if (reply.id !== requestId)
+                        return;
+                    resolve({ body: reply, responder: { instanceId: parsed.instanceId, epoch: parsed.epoch } });
+                },
+            });
+            const request = enc.encode(JSON.stringify(env));
+            nc.publish(subject, request);
+            // The first publish may precede the responder's subscription during startup. Re-publish the
+            // SAME read-only describe under the SAME request binding until one answer wins or the original
+            // deadline expires; this neither extends the budget nor retries the command being resolved.
+            // `publish` throws synchronously after close/drain. A timer throw escapes the caller's promise
+            // and crashes the process, so make transport loss settle this describe instead.
+            retryTimer = setInterval(() => {
+                try {
+                    nc.publish(subject, request);
+                }
+                catch (e) {
+                    reject(new EpEnvelopeError("unavailable", `the describe retry for ${endpoint} could not publish: ${caughtText(e, "unknown publish failure")}`));
+                }
+            }, DESCRIBE_RETRY_MS);
+        });
+        const timeout = new Promise((_, reject) => { timer = setTimeout(() => reject(unanswered(deadlineMs)), deadlineMs); });
+        const { body: reply, responder } = await Promise.race([got, timeout, denialWatch.denied, cancelled]);
+        if (reply.ok !== true) {
+            // A responder ANSWERED with a refusal: it is rethrown under the responder's own code (which
+            // may be `unavailable`) and deliberately without the EP_UNANSWERED marker the deadline above
+            // carries, so a consumer keyed on that marker never reads an answering responder as absent.
+            const e = reply.error;
+            throw new EpEnvelopeError(e?.code ?? "unavailable", `describe(${endpoint}) failed: ${e?.message ?? "unknown"}`);
+        }
+        return { answer: reply.data, responder };
+    }
+    finally {
+        sub?.unsubscribe();
+        if (timer !== undefined)
+            clearTimeout(timer);
+        if (retryTimer !== undefined)
+            clearInterval(retryTimer);
+        if (onAbort)
+            opts.signal?.removeEventListener("abort", onAbort);
+        // Release on EVERY exit, success included. See {@link openPublishDenialWatch}.
+        denialWatch?.release();
+    }
+}
+/** How many times a call is re-issued after a `not-executed` bind refusal. Every
+ *  re-issue is a first attempt, so this is a loop guard and not a duplication guard. Each attempt
+ *  splits with probability (m-1)/m in a space of m managers, so seventeen attempts leave a
+ *  three-manager space about 1 in 1000 where the unrepaired call failed 2 in 3 (#398). An attempt
+ *  costs an answered describe and invoke, never an elapsed deadline. */
+export const BIND_SPLIT_REISSUES = 16;
+/**
+ * INVOKE one named command on a resolved service: validate nothing here (the compiled input
+ * contract in {@link epCall}'s request builder gates args before publish, and the responder's
+ * digest-bound boundary re-validates), route on the `one` rail, return the attributed reply. A
+ * command absent from the resolved surface is `not-found` (the caller cannot see it, or it does
+ * not exist); a targeted command needs its `target`.
+ *
+ * Currency: `opts.currentEpoch` (e.g. the registry-read `serviceEpochReader`) when supplied;
+ * otherwise the DESCRIBE-BOUND default - accept exactly the incarnation that answered this
+ * service's resolve (its broker-authenticated `instanceId`+`epoch` off the describe reply
+ * subject) and refuse `failed-precondition` when a DIFFERENT instance wins the `one` queue
+ * (a superseded-or-split responder; re-resolve to adopt a legitimate successor). The bind needs
+ * no registry read grant, and it is strictly stronger than no check: two live instances of a
+ * single-instance endpoint can never both pass one resolved handle.
+ */
+export async function invokeCommand(nc, space, service, command, args, opts) {
+    const resolved = service.commands.get(command);
+    if (resolved === undefined)
+        throw new EpEnvelopeError("not-found", `command "${command}" is not in ${service.endpoint}'s visible surface; describe lists ${[...service.commands.keys()].sort().join(", ") || "(none)"}`);
+    if (resolved.targeted && opts.target === undefined)
+        throw new EpEnvelopeError("bad-request", `command "${command}" is targeted (modes: ${resolved.modes.join(", ")}); an invoke needs its target`);
+    if (!resolved.targeted && opts.target !== undefined)
+        throw new EpEnvelopeError("bad-request", `command "${command}" is untargeted; an invoke must not carry a target`);
+    const caller = service.caller;
+    // "No args" marshals to the CONTRACT's canonical empty form: absent args ride as null on the
+    // wire, so when this command's input rejects null but accepts the empty object (e.g. an
+    // all-optional `{type:"object"}` input like despawn's), send `{}` — that IS the caller's
+    // intent in that contract's vocabulary (a targeted CLI stop has nothing left after the alias
+    // becomes the target block). Contract-derived, never a guess: an input that requires fields
+    // accepts neither form and still refuses loud at the pre-publish validation below.
+    let sendArgs = args;
+    if (sendArgs === undefined && !resolved.contract.input.validate(null) && resolved.contract.input.validate({}))
+        sendArgs = {};
+    const describeBound = (instanceId) => {
+        if (instanceId !== service.responder.instanceId) {
+            // The refusal is unchanged; what it SAYS is not. One message used to cover two situations
+            // that call for opposite responses, and it described only the rarer one.
+            //
+            // PINNED: the caller named an instance and a different one answered. Genuinely wrong.
+            //
+            // UNPINNED: the caller addressed the CLASS. The describe and the invoke are two independent
+            // trips through the same anycast queue, so in a multi-instance space they routinely land on
+            // different instances and this fires on an ordinary, correct request - not on a supersession.
+            // Calling that "superseded-or-split" sends the reader hunting a restart that never happened.
+            // The old text's remedy is also not executable by the surfaces that print it most (`stop`,
+            // `despawn` and `attach` have no adopt path and no pin), so it advised an action the caller
+            // could not take. Say which case this is, and stop asserting a cause that is usually wrong.
+            // The marker, not the prose, is what stops an automatic re-invoke: reaching here means a
+            // responder ANSWERED (executed or refused; the reply does not say which), so a retry is a
+            // second attempt that may duplicate an effect rather than a repair. Callers that recover
+            // from `failed-precondition` by re-resolving must consult `respondedButUnbound`.
+            // The remedy is stated in core vocabulary (address one instance), never as a CLI flag: core
+            // cannot know whether its caller has one, and most `invokeService` callers (a connector's
+            // tools, a manifest deploy) do not. The CLI names its own flag when it renders this.
+            throw new EpEnvelopeError("failed-precondition", service.pinnedInstanceId !== undefined
+                ? `the ${service.endpoint} instance ${instanceId} answered but this handle is PINNED to ${service.pinnedInstanceId}; a pinned call names its instance and never accepts another. ${instanceId} did receive and answer the request, so if "${command}" mutates, that effect may already have landed - verify before re-issuing (SPEC 13.2)`
+                : `the ${service.endpoint} instance ${instanceId} won the class queue but this UNPINNED handle resolved against ${service.responder.instanceId}; the describe and the invoke are separate trips through the same queue, so in a multi-instance space this is an ordinary split and not necessarily a supersession - the handle cannot currently adopt a different winner. THIS SAYS NOTHING ABOUT WHETHER THE COMMAND RAN: ${instanceId} received the request and answered it, possibly after this error was raised. For a read that is harmless and re-issuing is safe; if "${command}" mutates, verify the outcome ('ps'/'inspect'/roster) before re-issuing, because a retry that assumes failure duplicates the effect. A call that addresses one instance does not split (SPEC 13.2)`, [{ kind: EP_UNBOUND_RESPONDER, endpoint: service.endpoint, command, answeredBy: instanceId, boundTo: service.responder.instanceId, pinned: service.pinnedInstanceId !== undefined }]);
+        }
+        return service.responder.epoch;
+    };
+    // `--on`: a PINNED service routes to its exact instance's `inst` rail (the same instance the
+    // describe resolved to, at its resolved epoch), never the class `one` queue — so the command reaches
+    // the addressed manager in a multi-manager space. Unpinned ⇒ class anycast `one` (unchanged). The
+    // describeBound currency check still holds: an inst-routed reply carries that instance's id.
+    const route = service.pinnedInstanceId !== undefined
+        ? { mode: "inst", instanceId: service.pinnedInstanceId, epoch: service.responder.epoch }
+        : { mode: "one" };
+    // The bind travels WITH the request, so the responder can refuse before running the command
+    // rather than leaving `describeBound` to report the split afterwards. It is sent exactly when
+    // this handle's own resolve is the currency reference — that is the caller saying "this
+    // incarnation or none", and it is the same population the check below already refuses. A caller
+    // that supplied its own `currentEpoch` is asking a REGISTRY whether the answerer is current, and
+    // deliberately accepts any current member; binding it would refuse calls that succeed today.
+    const bind = opts.currentEpoch === undefined
+        ? { instanceId: service.pinnedInstanceId ?? service.responder.instanceId, epoch: service.responder.epoch }
+        : undefined;
+    return epCall(nc, space, route, {
+        endpoint: service.endpoint, command, contract: resolved.contract, caller,
+        ...(sendArgs !== undefined ? { args: sendArgs } : {}),
+        ...(opts.target ? { target: opts.target } : {}),
+        ...(bind !== undefined ? { bind } : {}),
+        ...(opts.id !== undefined ? { id: opts.id } : {}),
+    }, {
+        deadlineMs: opts.deadlineMs ?? 10_000,
+        signal: opts.signal,
+        currentEpoch: opts.currentEpoch ?? describeBound,
+        // What the currency hook returns decides how a stale-epoch refusal is worded and marked: the
+        // describe-bound default is this handle's own bind (a responder ahead of it is a successor and
+        // the handle is the stale side); a caller-supplied hook is a registry read by epCall's contract.
+        currencyReference: opts.currentEpoch ? "registry" : "bind",
+    });
+}
+/** The refusal a goal-following call meets on a handle whose endpoint serves no `goal-result`: an
+ *  accepted goal could never be read back to its terminal (SPEC 13.6), so nothing is submitted.
+ *  `undefined` when the handle can follow. */
+export function goalFollowRefusal(service) {
+    if (service.commands.has("goal-result"))
+        return undefined;
+    return {
+        reply: { v: 1, id: globalThis.crypto.randomUUID(), ok: false, error: {
+                code: "failed-precondition", outcome: "not-executed",
+                message: `endpoint "${service.endpoint}" does not support "goal-result"; upgrade manager to enable durable goal following (SPEC 13.6)`,
+            } },
+        responder: { endpoint: service.endpoint, instanceId: service.responder.instanceId, epoch: service.responder.epoch },
+    };
+}
+//# sourceMappingURL=endpoint-caller.js.map

package/dist/endpoint-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-caller.js","sourceRoot":"","sources":["../src/endpoint-caller.ts"],"names":[],"mappings":"AAAA;;oFAEoF;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAElH,OAAO,EAAE,MAAM,EAA6C,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAA+B,MAAM,wBAAwB,CAAC;AAE3I,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,EAAE,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9D,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7F;;;8FAG8F;AAC9F,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;oEAEoE;AACpE,SAAS,UAAU,CAAC,CAAU,EAAE,QAAgB;IAC9C,IAAI,CAAC;QACH,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;gFAEgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AA+B5C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAkB,EAClB,KAAa,EACb,QAAgB,EAChB,MAAgB,EAChB,OAA2E,EAAE;IAE7E,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC7C,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;IAClB,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,wFAAwF;IACxF,mGAAmG;IACnG,mEAAmE;IACnE,MAAM,KAAK,GAAY,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvH,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACpG,+FAA+F;IAC/F,6GAA6G;IAC7G,0GAA0G;IAC1G,gGAAgG;IAChG,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG;QACV,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,WAAW;QAC9E,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE;KACrG,CAAC;IACF,IAAI,GAA6B,CAAC;IAClC,IAAI,KAAgD,CAAC;IACrD,IAAI,UAAsD,CAAC;IAC3D,IAAI,WAAoE,CAAC;IACzE,IAAI,OAAiC,CAAC;IACtC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,mBAAmB,EAAE,0BAA0B,QAAQ,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,IAAI,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3R,MAAM,SAAS,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACjD,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,cAAc;YACjE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;YACvD,CAAC,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,YAAY,QAAQ,yBAAyB,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,uEAAuE;QACvE,mFAAmF;QACnF,+BAA+B;QAC/B,WAAW,GAAG,sBAAsB,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,mBAAmB,EAC7F,oBAAoB,QAAQ,0GAA0G,OAAO,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,2BAA2B,IAAI,CAAC,UAAU,kGAAkG,CAAC,CAAC,CAAC,EAAE,oFAAoF,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,UAAU,CAAC,CAAC;QAClc,MAAM,GAAG,GAAG,IAAI,OAAO,CAAsF,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC/H,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBACrD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBACrB,IAAI,GAAG,EAAE,CAAC;wBAAC,MAAM,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBACtH,qFAAqF;oBACrF,sFAAsF;oBACtF,mFAAmF;oBACnF,uFAAuF;oBACvF,yEAAyE;oBACzE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;wBAAE,OAAO;oBACtG,mFAAmF;oBACnF,8EAA8E;oBAC9E,IAAI,KAAK,CAAC;oBACV,IAAI,CAAC;wBAAC,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAC,CAAC;oBACrE,MAAM,CAAC;wBAAC,OAAO;oBAAC,CAAC,CAAC,6EAA6E;oBAC/F,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;wBAAE,OAAO;oBACnC,OAAO,CAAC,EAAE,IAAI,EAAE,KAA2C,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACpI,CAAC;aACF,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAChD,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,4FAA4F;YAC5F,+FAA+F;YAC/F,4FAA4F;YAC5F,+FAA+F;YAC/F,gFAAgF;YAChF,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC;oBAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAAC,CAAC;gBACrC,OAAO,CAAC,EAAE,CAAC;oBACT,MAAM,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,0BAA0B,QAAQ,uBAAuB,UAAU,CAAC,CAAC,EAAE,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClJ,CAAC;YACH,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7H,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACrG,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACtB,4FAA4F;YAC5F,6FAA6F;YAC7F,4FAA4F;YAC5F,MAAM,CAAC,GAAG,KAAK,CAAC,KAAwD,CAAC;YACzE,MAAM,IAAI,eAAe,CAAE,CAAC,EAAE,IAAc,IAAI,aAAa,EAAE,YAAY,QAAQ,aAAa,CAAC,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAiC,EAAE,SAAS,EAAE,CAAC;IACxE,CAAC;YAAS,CAAC;QACT,GAAG,EAAE,WAAW,EAAE,CAAC;QACnB,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,UAAU,KAAK,SAAS;YAAE,aAAa,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,OAAO;YAAE,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChE,+EAA+E;QAC/E,WAAW,EAAE,OAAO,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAQD;;;;wEAIwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAkB,EAClB,KAAa,EACb,OAAwB,EACxB,OAAe,EACf,IAAyC,EACzC,IAQC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS;QACxB,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,YAAY,OAAO,eAAe,OAAO,CAAC,QAAQ,sCAAsC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC/L,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAChD,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,YAAY,OAAO,yBAAyB,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjJ,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QACjD,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,YAAY,OAAO,oDAAoD,CAAC,CAAC;IACpH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,6FAA6F;IAC7F,wFAAwF;IACxF,yFAAyF;IACzF,6FAA6F;IAC7F,4FAA4F;IAC5F,mFAAmF;IACnF,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3G,QAAQ,GAAG,EAAE,CAAC;IAChB,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAU,EAAE;QACnD,IAAI,UAAU,KAAK,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAChD,0FAA0F;YAC1F,yEAAyE;YACzE,EAAE;YACF,sFAAsF;YACtF,EAAE;YACF,4FAA4F;YAC5F,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yFAAyF;YACzF,0FAA0F;YAC1F,yFAAyF;YACzF,iFAAiF;YACjF,4FAA4F;YAC5F,0FAA0F;YAC1F,qFAAqF;YACrF,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACrF,CAAC,CAAC,OAAO,OAAO,CAAC,QAAQ,aAAa,UAAU,0CAA0C,OAAO,CAAC,gBAAgB,iEAAiE,UAAU,+CAA+C,OAAO,uFAAuF;gBAC1U,CAAC,CAAC,OAAO,OAAO,CAAC,QAAQ,aAAa,UAAU,kEAAkE,OAAO,CAAC,SAAS,CAAC,UAAU,+QAA+Q,UAAU,wIAAwI,OAAO,oMAAoM,EAC1vB,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC;QAC1L,CAAC;QACD,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;IACjC,CAAC,CAAC;IACF,6FAA6F;IAC7F,qGAAqG;IACrG,kGAAkG;IAClG,6FAA6F;IAC7F,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,KAAK,SAAS;QAClD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,UAAU,EAAE,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE;QACjG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAc,EAAE,CAAC;IAC7B,4FAA4F;IAC5F,8FAA8F;IAC9F,wFAAwF;IACxF,gGAAgG;IAChG,iGAAiG;IACjG,6FAA6F;IAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS;QAC1C,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE;QAC1G,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM;QACxE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,EAAE;QACD,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,MAAM;QACrC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,aAAa;QAChD,6FAA6F;QAC7F,+FAA+F;QAC/F,iGAAiG;QACjG,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;KAC3D,CAAC,CAAC;AACL,CAAC;AAED;;8CAE8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,OAAwB;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;gBACnE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,cAAc;gBACpD,OAAO,EAAE,aAAa,OAAO,CAAC,QAAQ,gGAAgG;aACvI,EAAE;QACH,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE;KACpH,CAAC;AACJ,CAAC"}

package/dist/endpoint-checkpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-checkpoint.d.ts","sourceRoot":"","sources":["../src/endpoint-checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAA+B,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC9G,OAAO,EAA0B,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGpG,OAAO,EAAyD,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAK9G,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAEjF;AAMD;;;;4EAI4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;;;;kFAI8E;IAC9E,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;mDAI+C;IAC/C,eAAe,EAAE,MAAM,CAAC;CACzB;AAqFD;2FAC2F;AAC3F,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AA8DD;;;;;;;4FAO4F;AAC5F,MAAM,WAAW,qBAAsB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACpE,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sFAAsF;AACtF,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ;AAkED,8FAA8F;AAC9F,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,qBAAqB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAO9I;AAED;;;;;+CAK+C;AAC/C,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjH,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;uBAGuB;AACvB,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,GAAG,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IACtD,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;+CAC2C;IAC3C,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,4FAA4F;IAC5F,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;CAC/B,GACA,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAsGnC;AA+DD;;;;;;iGAMiG;AACjG,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,GAAG,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7F,OAAO,CAAC,qBAAqB,CAAC,CAuChC;AAaD;;;;;;6FAM6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AASD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAUvG;AAWD;;+FAE+F;AAC/F,MAAM,WAAW,iBAAiB;IAChC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,cAAc,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACjD,OAAO,CAAC,iBAAiB,CAAC,CAgD5B;AAmFD;;;;;;;;;;;;wDAYwD;AACxD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,EAC7D,IAAI,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC,CAoDzI;AAUD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,kBAAkB,GAAG,aAAa,GAAG,SAAS,GAAG,UAAU,CAAA;CAAE,GACvG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAEhE;;;;;;;wCAOwC;AACxC,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IACJ,GAAG,EAAE,aAAa,CAAC;IACnB;yEACqE;IACrE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAClC,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;IAC9D,GAAG,EAAE,MAAM,CAAC;CACb,GACA,OAAO,CAAC,qBAAqB,CAAC,CAqChC;AAED;;;;sFAIsF;AACtF,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,GAAG,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5G,OAAO,CAAC,oBAAoB,CAAC,CA6C/B;AAED,kEAAkE;AAClE,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAI/I;AAED;;iGAEiG;AACjG,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAO7G;AAED;;;;;2EAK2E;AAC3E,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,GAAG,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACxC,OAAO,CAAC,oBAAoB,CAAC,CAiB/B;AA8CD;;;;;;sEAMsE;AACtE,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,GAAG,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAuBtD"}
+{"version":3,"file":"endpoint-checkpoint.d.ts","sourceRoot":"","sources":["../src/endpoint-checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAA+B,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC9G,OAAO,EAA0B,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAIpG,OAAO,EAAyD,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAK9G,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAEjF;AAMD;;;;4EAI4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;;;;kFAI8E;IAC9E,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;mDAI+C;IAC/C,eAAe,EAAE,MAAM,CAAC;CACzB;AAqFD;2FAC2F;AAC3F,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AA8DD;;;;;;;4FAO4F;AAC5F,MAAM,WAAW,qBAAsB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACpE,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sFAAsF;AACtF,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ;AAkED,8FAA8F;AAC9F,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,qBAAqB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAO9I;AAED;;;;;+CAK+C;AAC/C,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjH,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;uBAGuB;AACvB,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,GAAG,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IACtD,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;+CAC2C;IAC3C,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,4FAA4F;IAC5F,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;CAC/B,GACA,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAsGnC;AA+DD;;;;;;iGAMiG;AACjG,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,GAAG,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7F,OAAO,CAAC,qBAAqB,CAAC,CAuChC;AAaD;;;;;;6FAM6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AASD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAUvG;AAWD;;+FAE+F;AAC/F,MAAM,WAAW,iBAAiB;IAChC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,cAAc,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACjD,OAAO,CAAC,iBAAiB,CAAC,CAgD5B;AA8ED;;;;;;;;;;;;wDAYwD;AACxD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,EAC7D,IAAI,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC,CAoDzI;AAUD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,kBAAkB,GAAG,aAAa,GAAG,SAAS,GAAG,UAAU,CAAA;CAAE,GACvG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAEhE;;;;;;;wCAOwC;AACxC,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IACJ,GAAG,EAAE,aAAa,CAAC;IACnB;yEACqE;IACrE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAClC,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;IAC9D,GAAG,EAAE,MAAM,CAAC;CACb,GACA,OAAO,CAAC,qBAAqB,CAAC,CAqChC;AAED;;;;sFAIsF;AACtF,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,GAAG,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5G,OAAO,CAAC,oBAAoB,CAAC,CA6C/B;AAED,kEAAkE;AAClE,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAI/I;AAED;;iGAEiG;AACjG,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAO7G;AAED;;;;;2EAK2E;AAC3E,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,GAAG,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACxC,OAAO,CAAC,oBAAoB,CAAC,CAiB/B;AA8CD;;;;;;sEAMsE;AACtE,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,GAAG,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAuBtD"}

package/dist/endpoint-checkpoint.js

@@ -1,6 +1,7 @@
 import { jetstream, jetstreamManager } from "@nats-io/jetstream";
 import { headers as natsHeaders } from "@nats-io/transport-node";
 import { EpEnvelopeError } from "./endpoint-envelope.js";
+import { withDeadline } from "./deadline.js";
 import { canonicalJson } from "./canonical.js";
 import { epfSubject, eptSubject, parseEpSubject, assertIdToken } from "./endpoint-subjects.js";
 import { RECORD_KINDS, recordSpecKey, recordStatusKey, createRecordEntry, updateRecordEntry, assertStatusValue, readRecordLeader, isCasLoss } from "./endpoint-records.js";
@@ -555,20 +556,10 @@ export async function startTimerWriter(nc, space_, opts = {}) {
         done,
     };
 }
-/** Race the fresh-check against the writer's budget: a stuck status authority is a bounded
- *  `unavailable` refusal, never a hung writer. Races `Promise.resolve(p)` unconditionally so a
- *  non-native thenable cannot bypass the deadline. */
-async function withStatusBudget(p, budgetMs, what) {
-    let timer;
-    const deadline = new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new EpEnvelopeError("unavailable", `${what} did not answer within ${budgetMs}ms; the timer writer is bounded and fails closed (SPEC 13.2)`)), budgetMs);
-    });
-    try {
-        return await Promise.race([Promise.resolve(p), deadline]);
-    }
-    finally {
-        clearTimeout(timer);
-    }
+/** Bound a writer read by the writer's budget: a stuck status authority is a bounded
+ *  `unavailable` refusal, never a hung writer. */
+function withStatusBudget(p, budgetMs, what) {
+    return withDeadline(p, budgetMs, () => new EpEnvelopeError("unavailable", `${what} did not answer within ${budgetMs}ms; the timer writer is bounded and fails closed (SPEC 13.2)`));
 }
 /** LEADER-SERVED status read for the writer's fresh-check (distsys 8dcad72 M2): the fence the
  *  arm decision rests on needs read-your-writes against the leader. `kv.get` on the