@demlik/tea 0.13.0 → 0.15.0

package/dist/{chunk-25LBDCBC.js → chunk-6IQPODUF.js}

@@ -62,5 +62,5 @@ function pendingEffectsLedger(restore) {
 }
 
 export { applyEffectEvent, emptyLedger, foldLedger, isOwed, pendingEffectsLedger, survivingEffects };
-//# sourceMappingURL=chunk-25LBDCBC.js.map
-//# sourceMappingURL=chunk-25LBDCBC.js.map
+//# sourceMappingURL=chunk-6IQPODUF.js.map
+//# sourceMappingURL=chunk-6IQPODUF.js.map

package/dist/{chunk-25LBDCBC.js.map → chunk-6IQPODUF.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/do/durable-effects.ts"],"names":[],"mappings":";AA+GO,SAAS,WAAA,GAA0C;AACxD,EAAA,2BAAW,GAAA,EAAmB;AAChC;AAcO,SAAS,gBAAA,CACd,QACA,KAAA,EACyB;AACzB,EAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,MAAM,CAAA;AAC3B,EAAA,QAAQ,MAAM,IAAA;AAAM,IAClB,KAAK,aAAA;AACH,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,KAAA,CAAM,MAAM,CAAA;AAC/B,MAAA,OAAO,IAAA;AAAA,IACT,KAAK,kBAAA;AACH,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,EAAE,CAAA;AACpB,MAAA,OAAO,IAAA;AAAA;AAEb;AAWO,SAAS,WACd,MAAA,EACyB;AACzB,EAAA,IAAI,SAAS,WAAA,EAAe;AAC5B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,EAAQ,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACnE,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,iBACd,MAAA,EAC0B;AAC1B,EAAA,MAAM,MAAuB,EAAC;AAC9B,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,MAAM,CAAA,IAAK,MAAA,MAAY,IAAA,CAAK,EAAE,EAAA,EAAI,MAAA,EAAQ,CAAA;AAC1D,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,MAAA,CACd,QACA,EAAA,EACS;AACT,EAAA,OAAO,MAAA,CAAO,IAAI,EAAE,CAAA;AACtB;AAsDO,SAAS,qBAAwB,OAAA,EAGV;AAK5B,EAAA,MAAM,SAAS,OAAA,EAAS,MAAA,GAAS,CAAC,GAAG,OAAA,CAAQ,MAAM,CAAA,GAAI,MAAA;AACvD,EAAA,IAAI,MAAA,GAAkC,MAAA,GAClC,UAAA,CAAW,MAAM,IACjB,WAAA,EAAe;AAKnB,EAAA,IAAI,OAAA,GAAU,SAAS,MAAA,IAAU,CAAA;AACjC,EAAA,IAAI,OAAA,EAAS,MAAA,KAAW,MAAA,IAAa,MAAA,EAAQ;AAC3C,IAAA,KAAA,MAAW,KAAK,MAAA,EAAQ,IAAI,EAAE,EAAA,GAAK,OAAA,YAAmB,CAAA,CAAE,EAAA;AAAA,EAC1D,CAAA,MAAA,IAAW,OAAA,EAAS,MAAA,KAAW,MAAA,EAAW;AACxC,IAAA,KAAA,MAAW,MAAM,MAAA,CAAO,IAAA,IAAQ,IAAI,EAAA,GAAK,SAAS,OAAA,GAAU,EAAA;AAAA,EAC9D;AAEA,EAAA,OAAO;AAAA,IACL,IAAI,MAAA,EAAQ;AACV,MAAA,OAAA,IAAW,CAAA;AACX,MAAA,MAAM,EAAA,GAAK,OAAA;AACX,MAAA,MAAM,KAAA,GAAuB,EAAE,IAAA,EAAM,aAAA,EAAe,IAAI,MAAA,EAAO;AAC/D,MAAA,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACvC,MAAA,OAAO,EAAE,IAAI,KAAA,EAAM;AAAA,IACrB,CAAA;AAAA,IACA,QAAQ,EAAA,EAAI;AACV,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAC/B,MAAA,MAAM,KAAA,GAAyB,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAG;AAC9D,MAAA,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACvC,MAAA,OAAO,EAAE,WAAW,KAAA,EAAM;AAAA,IAC5B,CAAA;AAAA,IACA,SAAA,GAAY;AACV,MAAA,OAAO,iBAAiB,MAAM,CAAA;AAAA,IAChC,CAAA;AAAA,IACA,MAAA,GAAS;AACP,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,GAAS;AACP,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,GACF;AACF","file":"chunk-25LBDCBC.js","sourcesContent":["/**\n * @demlik/tea/do — the durable pending-effects ledger (substrate primitive #1).\n *\n * Durable *state* and durable *effects* are different problems. An\n * event-sourced actor rebuilds its STATE by folding the event log\n * (`doEventSourcedStore`, sibling file). But an outbound side effect — a tool\n * round-trip, a message to a sibling grain — is fire-and-forget: if the actor\n * interprets the `Cmd` inside an activation that hibernates mid-flight, the\n * effect is lost, yet nothing in the replayed state records that it is still\n * OWED. This is the one real tax of the event-sourced-virtual-actor target\n * (ADR 0003 primitive #1): \"I owe this effect\" must itself be part of the\n * folded state.\n *\n * Akka's classic `AtLeastOnceDelivery` solves it with a ledger of unconfirmed\n * deliveries kept AS PART OF the persisted state: each `deliver` adds an entry\n * keyed by a monotonic `deliveryId`; each `confirmDelivery` removes it. On\n * recovery the ledger is rebuilt from the SAME events, and any surviving entry\n * is re-sent. At-least-once ⇒ a confirmed-but-not-yet-persisted delivery WILL\n * be re-sent after a crash, so the receiver must deduplicate by id.\n *\n * ## The load-bearing rule (do not violate)\n *\n * The ledger is a PURE FOLD over the same kind of event stream the actor\n * already replays — it is **NOT** a separately-persisted side table:\n *\n *   - `effect_owed`     — `{ id, effect }` ADDS an entry to the ledger.\n *   - `effect_confirmed`— `{ id }`         REMOVES the entry.\n *\n * `foldLedger(events)` is `events.reduce(applyEffectEvent, empty())` — the same\n * fold shape `replay` / `foldEvents` / the recorder use. Persist these two\n * events into the SAME log `doEventSourcedStore` already appends (they are just\n * Msg variants), and the ledger is rebuilt for free on the next activation:\n * `foldLedger(log)` after eviction equals `foldLedger(log)` never-evicted, by\n * construction (a pure fold over identical input).\n *\n * On activation (replay completion), `survivingEffects(ledger)` returns the\n * owed-but-unconfirmed entries to re-fire, ordered by their monotonic id. The\n * re-fire is a SIDE EFFECT DERIVED from the surviving ledger — never stored\n * separately, never fired during replay (recovery.md: add to the ledger during\n * recovery; let recovery-END re-emit the survivors).\n *\n * Anti-patterns this file refuses (mirroring durable-effects.md):\n *   - A side-table ledger persisted apart from the events. The events ARE the\n *     ledger; the Map is rebuilt by folding them.\n *   - Re-firing every historical effect during replay. Only `survivingEffects`\n *     (post-fold) re-emits.\n *   - Assuming the receiver gets each effect exactly once. At-least-once: dedup\n *     by `id` at the receiver (`isOwed` here is the sender's view; the receiver\n *     owns its own dedup).\n */\n\nimport type { Cmd } from \"../index\";\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The two events the ledger folds. These are ordinary Msg variants — persist\n// them into the same event log `doEventSourcedStore` appends, and the ledger\n// rebuilds itself on the next activation with no extra storage.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Monotonic, gap-free delivery id — the single correlation + dedup key. */\nexport type DeliveryId = number;\n\n/**\n * An effect is now OWED: it has been decided but its delivery is not yet\n * confirmed. Adds `{ id → effect }` to the ledger when folded.\n *\n * Persist this BEFORE interpreting the effect (durable-effects.md rule:\n * \"persist the intent before deliver\"). A crash between persist and deliver is\n * fine — the surviving entry re-fires on activation. A crash before the persist\n * means the effect was never owed, so nothing is lost that the actor promised.\n */\nexport interface EffectOwed<E> extends Cmd<\"effect_owed\"> {\n  readonly id: DeliveryId;\n  readonly effect: E;\n}\n\n/**\n * An owed effect has been CONFIRMED delivered. Removes its entry from the\n * ledger when folded. Persist this BEFORE acting on the confirmation\n * (\"persist the confirmation before confirmDelivery\").\n */\nexport interface EffectConfirmed extends Cmd<\"effect_confirmed\"> {\n  readonly id: DeliveryId;\n}\n\n/** The event union the ledger folds over. `E` is the consumer's effect type. */\nexport type EffectLedgerEvent<E> = EffectOwed<E> | EffectConfirmed;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The ledger itself — a pure value. Insertion-ordered by monotonic id, so\n// `survivingEffects` re-emits in owed-order without a sort.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * The pending-effects ledger: owed-but-unconfirmed effects keyed by their\n * monotonic delivery id. A pure value reconstructed by `foldLedger` — it is\n * never persisted on its own; the events are.\n *\n * `ReadonlyMap` preserves insertion order, which (because ids are appended\n * monotonically) is exactly id order — so iteration yields the survivors\n * oldest-first with no sort.\n */\nexport type PendingEffectsLedger<E> = ReadonlyMap<DeliveryId, E>;\n\n/** A single surviving entry to re-emit: its id and the effect it owes. */\nexport interface OwedEffect<E> {\n  readonly id: DeliveryId;\n  readonly effect: E;\n}\n\n/** The empty ledger — the fold's seed (a fresh actor owes nothing). */\nexport function emptyLedger<E>(): PendingEffectsLedger<E> {\n  return new Map<DeliveryId, E>();\n}\n\n/**\n * Apply ONE ledger event — the reducer at the heart of the fold.\n *\n *   - `effect_owed`      → add `{ id → effect }`.\n *   - `effect_confirmed` → remove `id` (no-op if already absent: a duplicate\n *     confirm, or a confirm for an id evicted with the actor — at-least-once\n *     tolerates both).\n *\n * Pure: returns a NEW ledger, never mutates the input — so folding the same\n * events twice (live and post-eviction) yields equal results, and a caller may\n * keep the prior ledger value.\n */\nexport function applyEffectEvent<E>(\n  ledger: PendingEffectsLedger<E>,\n  event: EffectLedgerEvent<E>,\n): PendingEffectsLedger<E> {\n  const next = new Map(ledger);\n  switch (event.type) {\n    case \"effect_owed\":\n      next.set(event.id, event.effect);\n      return next;\n    case \"effect_confirmed\":\n      next.delete(event.id);\n      return next;\n  }\n}\n\n/**\n * THE FOLD. Rebuild the ledger from an event stream — the same fold shape\n * `replay` uses for state. After a simulated eviction this is called over the\n * persisted log and yields a ledger byte-for-byte equal to the never-evicted\n * one, because a pure fold over identical input is identical.\n *\n * This is the function that proves \"no side table\": the ledger is `events`\n * reduced, nothing more.\n */\nexport function foldLedger<E>(\n  events: Iterable<EffectLedgerEvent<E>>,\n): PendingEffectsLedger<E> {\n  let ledger = emptyLedger<E>();\n  for (const event of events) ledger = applyEffectEvent(ledger, event);\n  return ledger;\n}\n\n/**\n * RE-EMIT ON ACTIVATION. Given the rebuilt ledger, the owed-but-unconfirmed\n * effects to re-fire — ordered oldest-first by monotonic id. On a fresh /\n * fully-confirmed actor this is empty (nothing re-emitted).\n *\n * Idempotency is the RECEIVER's job: it must dedup by `id`, because\n * at-least-once means a re-emitted already-handled id WILL arrive again\n * (e.g. an effect confirmed in the activation that hibernated before the\n * `effect_confirmed` event was persisted). Re-firing the same id is therefore\n * a no-op AT THE RECEIVER, not here.\n */\nexport function survivingEffects<E>(\n  ledger: PendingEffectsLedger<E>,\n): readonly OwedEffect<E>[] {\n  const out: OwedEffect<E>[] = [];\n  for (const [id, effect] of ledger) out.push({ id, effect });\n  return out;\n}\n\n/** Is this id still owed (unconfirmed) in the ledger? Sender-side view. */\nexport function isOwed<E>(\n  ledger: PendingEffectsLedger<E>,\n  id: DeliveryId,\n): boolean {\n  return ledger.has(id);\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// pendingEffectsLedger — the stateful, monotonic-id-issuing recorder.\n//\n// The pure `foldLedger` is the contract; this is the ergonomic driver a host\n// uses live. It owns the monotonic `deliveryId` (gap-free, shared across all\n// destinations — durable-effects.md), emits the `effect_owed` / `effect_confirmed`\n// events for the caller to PERSIST, and keeps an in-memory mirror folded from\n// those same events so `survivingEffects` is available without a re-read.\n//\n// Mirrors `deferredGateway`'s factory shape: no clock / RNG captured; pure\n// bookkeeping. The caller is responsible for persisting each returned event\n// into the log (so the ledger survives eviction) and for actually interpreting\n// the effect after the owed event is durable.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * A live, monotonic-id-issuing ledger recorder.\n *\n *   - `owe(effect)` — allocate the next `deliveryId`, return the\n *     `effect_owed` event to PERSIST plus the allocated `id`. Folding the event\n *     into the recorder's mirror is done for you; the caller persists it.\n *   - `confirm(id)` — return the `effect_confirmed` event to PERSIST, and `true`\n *     iff the id was owed (a duplicate confirm returns `false` — the boolean is\n *     itself a dedup signal, exactly Akka `confirmDelivery`).\n *   - `surviving()` — the current owed-but-unconfirmed effects (for re-emit on\n *     activation).\n *   - `ledger()` — the current folded ledger value.\n *   - `lastId()` — the highest id issued (so a host can seed the counter from a\n *     rebuilt ledger after eviction; see `restore`).\n */\nexport interface PendingEffectsRecorder<E> {\n  owe(effect: E): { id: DeliveryId; event: EffectOwed<E> };\n  confirm(id: DeliveryId): { confirmed: boolean; event: EffectConfirmed };\n  surviving(): readonly OwedEffect<E>[];\n  ledger(): PendingEffectsLedger<E>;\n  lastId(): DeliveryId;\n}\n\n/**\n * Build a live recorder. `restore` rehydrates it after an eviction: pass the\n * events read back from the log (or the rebuilt ledger's survivors) so the\n * monotonic counter resumes WITHOUT gaps and the mirror reflects the surviving\n * owed set. Omit `restore` for a fresh actor.\n *\n * Counter seeding rule: the next id is `max(seen ids) + 1`. Restoring only the\n * survivors is sufficient for correctness of re-emit, but to keep ids gap-free\n * across confirmed-and-pruned entries the host should pass `lastId` explicitly\n * when it has it (e.g. persisted alongside the snapshot). When only survivors\n * are known, the counter resumes from the highest surviving id — a confirmed id\n * higher than every survivor could in principle be reissued, so a host that\n * needs strict global monotonicity persists `lastId`.\n */\nexport function pendingEffectsLedger<E>(restore?: {\n  readonly events?: Iterable<EffectLedgerEvent<E>>;\n  readonly lastId?: DeliveryId;\n}): PendingEffectsRecorder<E> {\n  // Materialize the restore events ONCE — `restore.events` is only an\n  // `Iterable`, so a single-use generator would be exhausted by `foldLedger`\n  // and yield nothing on a second walk (seeding the counter to 0 and reissuing\n  // colliding ids). Folding and counter-seeding both read this array.\n  const events = restore?.events ? [...restore.events] : undefined;\n  let mirror: PendingEffectsLedger<E> = events\n    ? foldLedger(events)\n    : emptyLedger<E>();\n\n  // Seed the monotonic counter. Prefer an explicit `lastId` (gap-free across\n  // pruned ids); else the highest id observed in the restore events; else the\n  // highest surviving id; else 0 (fresh).\n  let counter = restore?.lastId ?? 0;\n  if (restore?.lastId === undefined && events) {\n    for (const e of events) if (e.id > counter) counter = e.id;\n  } else if (restore?.lastId === undefined) {\n    for (const id of mirror.keys()) if (id > counter) counter = id;\n  }\n\n  return {\n    owe(effect) {\n      counter += 1;\n      const id = counter;\n      const event: EffectOwed<E> = { type: \"effect_owed\", id, effect };\n      mirror = applyEffectEvent(mirror, event);\n      return { id, event };\n    },\n    confirm(id) {\n      const confirmed = mirror.has(id);\n      const event: EffectConfirmed = { type: \"effect_confirmed\", id };\n      mirror = applyEffectEvent(mirror, event);\n      return { confirmed, event };\n    },\n    surviving() {\n      return survivingEffects(mirror);\n    },\n    ledger() {\n      return mirror;\n    },\n    lastId() {\n      return counter;\n    },\n  };\n}\n"]}
+{"version":3,"sources":["../src/do/durable-effects.ts"],"names":[],"mappings":";AA+GO,SAAS,WAAA,GAA0C;AACxD,EAAA,2BAAW,GAAA,EAAmB;AAChC;AAcO,SAAS,gBAAA,CACd,QACA,KAAA,EACyB;AACzB,EAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,MAAM,CAAA;AAC3B,EAAA,QAAQ,MAAM,IAAA;AAAM,IAClB,KAAK,aAAA;AACH,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,KAAA,CAAM,MAAM,CAAA;AAC/B,MAAA,OAAO,IAAA;AAAA,IACT,KAAK,kBAAA;AACH,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,EAAE,CAAA;AACpB,MAAA,OAAO,IAAA;AAAA;AAEb;AAWO,SAAS,WACd,MAAA,EACyB;AACzB,EAAA,IAAI,SAAS,WAAA,EAAe;AAC5B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,EAAQ,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACnE,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,iBACd,MAAA,EAC0B;AAC1B,EAAA,MAAM,MAAuB,EAAC;AAC9B,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,MAAM,CAAA,IAAK,MAAA,MAAY,IAAA,CAAK,EAAE,EAAA,EAAI,MAAA,EAAQ,CAAA;AAC1D,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,MAAA,CACd,QACA,EAAA,EACS;AACT,EAAA,OAAO,MAAA,CAAO,IAAI,EAAE,CAAA;AACtB;AAsDO,SAAS,qBAAwB,OAAA,EAGV;AAK5B,EAAA,MAAM,SAAS,OAAA,EAAS,MAAA,GAAS,CAAC,GAAG,OAAA,CAAQ,MAAM,CAAA,GAAI,MAAA;AACvD,EAAA,IAAI,MAAA,GAAkC,MAAA,GAClC,UAAA,CAAW,MAAM,IACjB,WAAA,EAAe;AAKnB,EAAA,IAAI,OAAA,GAAU,SAAS,MAAA,IAAU,CAAA;AACjC,EAAA,IAAI,OAAA,EAAS,MAAA,KAAW,MAAA,IAAa,MAAA,EAAQ;AAC3C,IAAA,KAAA,MAAW,KAAK,MAAA,EAAQ,IAAI,EAAE,EAAA,GAAK,OAAA,YAAmB,CAAA,CAAE,EAAA;AAAA,EAC1D,CAAA,MAAA,IAAW,OAAA,EAAS,MAAA,KAAW,MAAA,EAAW;AACxC,IAAA,KAAA,MAAW,MAAM,MAAA,CAAO,IAAA,IAAQ,IAAI,EAAA,GAAK,SAAS,OAAA,GAAU,EAAA;AAAA,EAC9D;AAEA,EAAA,OAAO;AAAA,IACL,IAAI,MAAA,EAAQ;AACV,MAAA,OAAA,IAAW,CAAA;AACX,MAAA,MAAM,EAAA,GAAK,OAAA;AACX,MAAA,MAAM,KAAA,GAAuB,EAAE,IAAA,EAAM,aAAA,EAAe,IAAI,MAAA,EAAO;AAC/D,MAAA,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACvC,MAAA,OAAO,EAAE,IAAI,KAAA,EAAM;AAAA,IACrB,CAAA;AAAA,IACA,QAAQ,EAAA,EAAI;AACV,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAC/B,MAAA,MAAM,KAAA,GAAyB,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAG;AAC9D,MAAA,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACvC,MAAA,OAAO,EAAE,WAAW,KAAA,EAAM;AAAA,IAC5B,CAAA;AAAA,IACA,SAAA,GAAY;AACV,MAAA,OAAO,iBAAiB,MAAM,CAAA;AAAA,IAChC,CAAA;AAAA,IACA,MAAA,GAAS;AACP,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,GAAS;AACP,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,GACF;AACF","file":"chunk-6IQPODUF.js","sourcesContent":["/**\n * @demlik/tea/do — the durable pending-effects ledger (substrate primitive #1).\n *\n * Durable *state* and durable *effects* are different problems. An\n * event-sourced actor rebuilds its STATE by folding the event log\n * (`doEventSourcedStore`, sibling file). But an outbound side effect — a tool\n * round-trip, a message to a sibling grain — is fire-and-forget: if the actor\n * interprets the `Cmd` inside an activation that hibernates mid-flight, the\n * effect is lost, yet nothing in the replayed state records that it is still\n * OWED. This is the one real tax of the event-sourced-virtual-actor target\n * (ADR 0003 primitive #1): \"I owe this effect\" must itself be part of the\n * folded state.\n *\n * Akka's classic `AtLeastOnceDelivery` solves it with a ledger of unconfirmed\n * deliveries kept AS PART OF the persisted state: each `deliver` adds an entry\n * keyed by a monotonic `deliveryId`; each `confirmDelivery` removes it. On\n * recovery the ledger is rebuilt from the SAME events, and any surviving entry\n * is re-sent. At-least-once ⇒ a confirmed-but-not-yet-persisted delivery WILL\n * be re-sent after a crash, so the receiver must deduplicate by id.\n *\n * ## The load-bearing rule (do not violate)\n *\n * The ledger is a PURE FOLD over the same kind of event stream the actor\n * already replays — it is **NOT** a separately-persisted side table:\n *\n *   - `effect_owed`     — `{ id, effect }` ADDS an entry to the ledger.\n *   - `effect_confirmed`— `{ id }`         REMOVES the entry.\n *\n * `foldLedger(events)` is `events.reduce(applyEffectEvent, empty())` — the same\n * fold shape `replay` / `foldEvents` / the recorder use. Persist these two\n * events into the SAME log `doEventSourcedStore` already appends (they are just\n * Msg variants), and the ledger is rebuilt for free on the next activation:\n * `foldLedger(log)` after eviction equals `foldLedger(log)` never-evicted, by\n * construction (a pure fold over identical input).\n *\n * On activation (replay completion), `survivingEffects(ledger)` returns the\n * owed-but-unconfirmed entries to re-fire, ordered by their monotonic id. The\n * re-fire is a SIDE EFFECT DERIVED from the surviving ledger — never stored\n * separately, never fired during replay (recovery.md: add to the ledger during\n * recovery; let recovery-END re-emit the survivors).\n *\n * Anti-patterns this file refuses (mirroring durable-effects.md):\n *   - A side-table ledger persisted apart from the events. The events ARE the\n *     ledger; the Map is rebuilt by folding them.\n *   - Re-firing every historical effect during replay. Only `survivingEffects`\n *     (post-fold) re-emits.\n *   - Assuming the receiver gets each effect exactly once. At-least-once: dedup\n *     by `id` at the receiver (`isOwed` here is the sender's view; the receiver\n *     owns its own dedup).\n */\n\nimport type { Cmd } from \"../index\";\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The two events the ledger folds. These are ordinary Msg variants — persist\n// them into the same event log `doEventSourcedStore` appends, and the ledger\n// rebuilds itself on the next activation with no extra storage.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Monotonic, gap-free delivery id — the single correlation + dedup key. */\nexport type DeliveryId = number;\n\n/**\n * An effect is now OWED: it has been decided but its delivery is not yet\n * confirmed. Adds `{ id → effect }` to the ledger when folded.\n *\n * Persist this BEFORE interpreting the effect (durable-effects.md rule:\n * \"persist the intent before deliver\"). A crash between persist and deliver is\n * fine — the surviving entry re-fires on activation. A crash before the persist\n * means the effect was never owed, so nothing is lost that the actor promised.\n */\nexport interface EffectOwed<E> extends Cmd<\"effect_owed\"> {\n  readonly id: DeliveryId;\n  readonly effect: E;\n}\n\n/**\n * An owed effect has been CONFIRMED delivered. Removes its entry from the\n * ledger when folded. Persist this BEFORE acting on the confirmation\n * (\"persist the confirmation before confirmDelivery\").\n */\nexport interface EffectConfirmed extends Cmd<\"effect_confirmed\"> {\n  readonly id: DeliveryId;\n}\n\n/** The event union the ledger folds over. `E` is the consumer's effect type. */\nexport type EffectLedgerEvent<E> = EffectOwed<E> | EffectConfirmed;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The ledger itself — a pure value. Insertion-ordered by monotonic id, so\n// `survivingEffects` re-emits in owed-order without a sort.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * The pending-effects ledger: owed-but-unconfirmed effects keyed by their\n * monotonic delivery id. A pure value reconstructed by `foldLedger` — it is\n * never persisted on its own; the events are.\n *\n * `ReadonlyMap` preserves insertion order, which (because ids are appended\n * monotonically) is exactly id order — so iteration yields the survivors\n * oldest-first with no sort.\n */\nexport type PendingEffectsLedger<E> = ReadonlyMap<DeliveryId, E>;\n\n/** A single surviving entry to re-emit: its id and the effect it owes. */\nexport interface OwedEffect<E> {\n  readonly id: DeliveryId;\n  readonly effect: E;\n}\n\n/** The empty ledger — the fold's starting value (a fresh actor owes nothing). */\nexport function emptyLedger<E>(): PendingEffectsLedger<E> {\n  return new Map<DeliveryId, E>();\n}\n\n/**\n * Apply ONE ledger event — the reducer at the heart of the fold.\n *\n *   - `effect_owed`      → add `{ id → effect }`.\n *   - `effect_confirmed` → remove `id` (no-op if already absent: a duplicate\n *     confirm, or a confirm for an id evicted with the actor — at-least-once\n *     tolerates both).\n *\n * Pure: returns a NEW ledger, never mutates the input — so folding the same\n * events twice (live and post-eviction) yields equal results, and a caller may\n * keep the prior ledger value.\n */\nexport function applyEffectEvent<E>(\n  ledger: PendingEffectsLedger<E>,\n  event: EffectLedgerEvent<E>,\n): PendingEffectsLedger<E> {\n  const next = new Map(ledger);\n  switch (event.type) {\n    case \"effect_owed\":\n      next.set(event.id, event.effect);\n      return next;\n    case \"effect_confirmed\":\n      next.delete(event.id);\n      return next;\n  }\n}\n\n/**\n * THE FOLD. Rebuild the ledger from an event stream — the same fold shape\n * `replay` uses for state. After a simulated eviction this is called over the\n * persisted log and yields a ledger byte-for-byte equal to the never-evicted\n * one, because a pure fold over identical input is identical.\n *\n * This is the function that proves \"no side table\": the ledger is `events`\n * reduced, nothing more.\n */\nexport function foldLedger<E>(\n  events: Iterable<EffectLedgerEvent<E>>,\n): PendingEffectsLedger<E> {\n  let ledger = emptyLedger<E>();\n  for (const event of events) ledger = applyEffectEvent(ledger, event);\n  return ledger;\n}\n\n/**\n * RE-EMIT ON ACTIVATION. Given the rebuilt ledger, the owed-but-unconfirmed\n * effects to re-fire — ordered oldest-first by monotonic id. On a fresh /\n * fully-confirmed actor this is empty (nothing re-emitted).\n *\n * Idempotency is the RECEIVER's job: it must dedup by `id`, because\n * at-least-once means a re-emitted already-handled id WILL arrive again\n * (e.g. an effect confirmed in the activation that hibernated before the\n * `effect_confirmed` event was persisted). Re-firing the same id is therefore\n * a no-op AT THE RECEIVER, not here.\n */\nexport function survivingEffects<E>(\n  ledger: PendingEffectsLedger<E>,\n): readonly OwedEffect<E>[] {\n  const out: OwedEffect<E>[] = [];\n  for (const [id, effect] of ledger) out.push({ id, effect });\n  return out;\n}\n\n/** Is this id still owed (unconfirmed) in the ledger? Sender-side view. */\nexport function isOwed<E>(\n  ledger: PendingEffectsLedger<E>,\n  id: DeliveryId,\n): boolean {\n  return ledger.has(id);\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// pendingEffectsLedger — the stateful, monotonic-id-issuing recorder.\n//\n// The pure `foldLedger` is the contract; this is the ergonomic driver a host\n// uses live. It owns the monotonic `deliveryId` (gap-free, shared across all\n// destinations — durable-effects.md), emits the `effect_owed` / `effect_confirmed`\n// events for the caller to PERSIST, and keeps an in-memory mirror folded from\n// those same events so `survivingEffects` is available without a re-read.\n//\n// Mirrors `deferredGateway`'s factory shape: no clock / RNG captured; pure\n// bookkeeping. The caller is responsible for persisting each returned event\n// into the log (so the ledger survives eviction) and for actually interpreting\n// the effect after the owed event is durable.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * A live, monotonic-id-issuing ledger recorder.\n *\n *   - `owe(effect)` — allocate the next `deliveryId`, return the\n *     `effect_owed` event to PERSIST plus the allocated `id`. Folding the event\n *     into the recorder's mirror is done for you; the caller persists it.\n *   - `confirm(id)` — return the `effect_confirmed` event to PERSIST, and `true`\n *     iff the id was owed (a duplicate confirm returns `false` — the boolean is\n *     itself a dedup signal, exactly Akka `confirmDelivery`).\n *   - `surviving()` — the current owed-but-unconfirmed effects (for re-emit on\n *     activation).\n *   - `ledger()` — the current folded ledger value.\n *   - `lastId()` — the highest id issued (so a host can seed the counter from a\n *     rebuilt ledger after eviction; see `restore`).\n */\nexport interface PendingEffectsRecorder<E> {\n  owe(effect: E): { id: DeliveryId; event: EffectOwed<E> };\n  confirm(id: DeliveryId): { confirmed: boolean; event: EffectConfirmed };\n  surviving(): readonly OwedEffect<E>[];\n  ledger(): PendingEffectsLedger<E>;\n  lastId(): DeliveryId;\n}\n\n/**\n * Build a live recorder. `restore` rehydrates it after an eviction: pass the\n * events read back from the log (or the rebuilt ledger's survivors) so the\n * monotonic counter resumes WITHOUT gaps and the mirror reflects the surviving\n * owed set. Omit `restore` for a fresh actor.\n *\n * Counter seeding rule: the next id is `max(seen ids) + 1`. Restoring only the\n * survivors is sufficient for correctness of re-emit, but to keep ids gap-free\n * across confirmed-and-pruned entries the host should pass `lastId` explicitly\n * when it has it (e.g. persisted alongside the snapshot). When only survivors\n * are known, the counter resumes from the highest surviving id — a confirmed id\n * higher than every survivor could in principle be reissued, so a host that\n * needs strict global monotonicity persists `lastId`.\n */\nexport function pendingEffectsLedger<E>(restore?: {\n  readonly events?: Iterable<EffectLedgerEvent<E>>;\n  readonly lastId?: DeliveryId;\n}): PendingEffectsRecorder<E> {\n  // Materialize the restore events ONCE — `restore.events` is only an\n  // `Iterable`, so a single-use generator would be exhausted by `foldLedger`\n  // and yield nothing on a second walk (seeding the counter to 0 and reissuing\n  // colliding ids). Folding and counter-seeding both read this array.\n  const events = restore?.events ? [...restore.events] : undefined;\n  let mirror: PendingEffectsLedger<E> = events\n    ? foldLedger(events)\n    : emptyLedger<E>();\n\n  // Seed the monotonic counter. Prefer an explicit `lastId` (gap-free across\n  // pruned ids); else the highest id observed in the restore events; else the\n  // highest surviving id; else 0 (fresh).\n  let counter = restore?.lastId ?? 0;\n  if (restore?.lastId === undefined && events) {\n    for (const e of events) if (e.id > counter) counter = e.id;\n  } else if (restore?.lastId === undefined) {\n    for (const id of mirror.keys()) if (id > counter) counter = id;\n  }\n\n  return {\n    owe(effect) {\n      counter += 1;\n      const id = counter;\n      const event: EffectOwed<E> = { type: \"effect_owed\", id, effect };\n      mirror = applyEffectEvent(mirror, event);\n      return { id, event };\n    },\n    confirm(id) {\n      const confirmed = mirror.has(id);\n      const event: EffectConfirmed = { type: \"effect_confirmed\", id };\n      mirror = applyEffectEvent(mirror, event);\n      return { confirmed, event };\n    },\n    surviving() {\n      return survivingEffects(mirror);\n    },\n    ledger() {\n      return mirror;\n    },\n    lastId() {\n      return counter;\n    },\n  };\n}\n"]}

package/dist/chunk-AYS5N6WY.js

@@ -0,0 +1,505 @@
+import { asRng, recordFailure, shouldRetry, nextDelayMs, initRetry } from './chunk-VBDU4JL6.js';
+import { deadlineMsgType, subscribeDeadline, initCache, set, deadlineSub, get } from './chunk-22POWGFA.js';
+import { Cmd, liftSlice, without, tryInterpret } from './chunk-66PY5WYF.js';
+import { z } from 'zod';
+
+// src/protocol.ts
+var MsgType = {
+  // --- resilient-call: the run Cmd + its two settle Msgs -------------------
+  /** The "run the port for `key`" effect Cmd resilient-call emits. */
+  ResilientRun: "resilient_run",
+  /** PRIVATE success settle Msg (read only by `agentEvents`, #47). */
+  ResilientOk: "resilient_ok",
+  /** Failure settle Msg — routed to the `fail` verb (back off via retry). */
+  ResilientErr: "resilient_err",
+  // --- agent: the wired machine's own entry-point Msgs ---------------------
+  /** Begin a run. */
+  AgentStart: "agent_start",
+  /** PRIVATE tool-fan-out success settle Msg (read only by `agentEvents`, #47). */
+  AgentToolOk: "agent_tool_ok",
+  /** Tool-fan-out failure settle Msg. */
+  AgentToolErr: "agent_tool_err",
+  /**
+   * Re-fire the one outstanding effect on rehydrate (the do↔agent seam). Fired
+   * by `do/host`'s `autoBoot` via the typed `agentBootMsg` constructor, matched
+   * by the agent reducer — see `AgentBootPort` in `../agent`.
+   */
+  AgentBoot: "agent_boot",
+  /**
+   * Stop the run from outside and settle it `cancelled` — what an `AbortSignal`
+   * handed to `driveToDone` / a defined agent's `run` dispatches on abort. A
+   * transition, never a throw: the outcome lands in the Model, so a reload reads
+   * a run that ended rather than one to resume.
+   */
+  AgentCancel: "agent_cancel",
+  // --- agent: the context-compaction round-trip (#85) ----------------------
+  /**
+   * The "summarize the oldest N turns" effect Cmd the agent emits when its
+   * `CompactionPolicy` asks to compact before a brain call. A DEDICATED
+   * round-trip (design B1), distinct from the brain call's `resilient_run`, so
+   * compaction is its own honest `Awaiting` state — see `../agent`.
+   */
+  CompactRun: "compact_run",
+  /** Compaction round-trip resolved — carries the summary text the fold-back folds. */
+  CompactOk: "compact_ok",
+  /** Compaction round-trip failed (exhausted retry) — surfaced as data, not a stall. */
+  CompactErr: "compact_err",
+  // --- token-refresh: the two refresh-result Msgs --------------------------
+  /** Refresh port resolved — carries the fresh `Token`. */
+  TokenRefreshed: "token_refreshed",
+  /** Refresh port rejected — carries the rejection (errors are data). */
+  TokenRefreshFailed: "token_refresh_failed",
+  // --- authed-call: the 401 trigger ----------------------------------------
+  /** The 401 the consumer dispatches when a guarded call comes back unauthorized. */
+  Unauthorized: "unauthorized"
+};
+
+// src/internal/resilience/circuit-breaker/index.ts
+var defaultCircuitPolicy = {
+  failureThreshold: 5,
+  cooldownMs: 3e4,
+  halfOpenMaxProbes: 1
+};
+function initCircuit() {
+  return { phase: "closed", failures: 0 };
+}
+function onSuccess(state, _policy) {
+  switch (state.phase) {
+    case "closed":
+      return state.failures === 0 ? state : { phase: "closed", failures: 0 };
+    case "half_open":
+      return { phase: "closed", failures: 0 };
+    case "open":
+      return state;
+  }
+}
+function onFailure(state, policy, nowMs) {
+  switch (state.phase) {
+    case "closed": {
+      const failures = state.failures + 1;
+      return failures >= policy.failureThreshold ? { phase: "open", openedAtMs: nowMs } : { phase: "closed", failures };
+    }
+    case "half_open":
+      return { phase: "open", openedAtMs: nowMs };
+    case "open":
+      return state;
+  }
+}
+function canPass(state, policy, nowMs) {
+  switch (state.phase) {
+    case "closed":
+      return [state, true];
+    case "open": {
+      const elapsed = nowMs - state.openedAtMs;
+      if (elapsed >= policy.cooldownMs) {
+        return [{ phase: "half_open", probes: 1 }, true];
+      }
+      return [state, false];
+    }
+    case "half_open":
+      if (state.probes < policy.halfOpenMaxProbes) {
+        return [{ phase: "half_open", probes: state.probes + 1 }, true];
+      }
+      return [state, false];
+  }
+}
+
+// src/internal/resilience/rate-limit/index.ts
+function initBucket(capacity, refillPerSec, nowMs) {
+  return {
+    tokens: capacity,
+    capacity,
+    refillPerSec,
+    lastRefillMs: nowMs
+  };
+}
+function refill(bucket, nowMs) {
+  const elapsedSec = Math.max(0, nowMs - bucket.lastRefillMs) / 1e3;
+  const replenished = bucket.tokens + elapsedSec * bucket.refillPerSec;
+  return {
+    ...bucket,
+    tokens: Math.min(bucket.capacity, replenished),
+    lastRefillMs: nowMs
+  };
+}
+function tryConsume(bucket, nowMs, n = 1) {
+  const refilled = refill(bucket, nowMs);
+  if (refilled.tokens >= n) {
+    return [{ ...refilled, tokens: refilled.tokens - n }, true];
+  }
+  return [refilled, false];
+}
+function initWindow(windowMs, limit) {
+  return { hits: [], windowMs, limit };
+}
+function prune(window, nowMs) {
+  const cutoff = nowMs - window.windowMs;
+  return window.hits.filter((t) => t > cutoff);
+}
+function record(window, nowMs) {
+  const pruned = prune(window, nowMs);
+  if (pruned.length < window.limit) {
+    return [{ ...window, hits: [...pruned, nowMs] }, true];
+  }
+  return [{ ...window, hits: pruned }, false];
+}
+function remaining(window, nowMs) {
+  const live = prune(window, nowMs).length;
+  return Math.max(0, window.limit - live);
+}
+var DEFAULT_RESILIENT_NAME = "resilient";
+function runCmdDef(name = DEFAULT_RESILIENT_NAME) {
+  return Cmd.define(`${name}_run`, {
+    input: z.custom(),
+    ok: z.custom(),
+    err: ["port_rejected", "deadline_exceeded"]
+  });
+}
+function circuitPolicy(config) {
+  if (config.circuit === void 0) return null;
+  return {
+    failureThreshold: config.circuit.threshold,
+    cooldownMs: config.circuit.cooldownMs,
+    halfOpenMaxProbes: config.circuit.halfOpenMaxProbes ?? 1
+  };
+}
+function charge(budget, at) {
+  if (budget.remainingMs <= 0) return { ...budget, chargingSinceMs: at };
+  const elapsed = Math.max(0, at - budget.chargingSinceMs);
+  return { remainingMs: budget.remainingMs - elapsed, chargingSinceMs: at };
+}
+function retryTimerId(name, key) {
+  return `${name}:retry:${key}`;
+}
+function deadlineTimerId(name, key) {
+  return `${name}:deadline:${key}`;
+}
+function deadlineNameOf(name) {
+  return name === DEFAULT_RESILIENT_NAME ? void 0 : name;
+}
+function createResilientCall(config, rng = Math.random) {
+  const name = config.name ?? DEFAULT_RESILIENT_NAME;
+  const cPolicy = circuitPolicy(config);
+  const rngBranded = asRng(rng);
+  const runCmd = runCmdDef(name);
+  const okType = `${name}_ok`;
+  const errType = `${name}_err`;
+  const deadlineName = deadlineNameOf(name);
+  function init() {
+    return {
+      circuit: initCircuit(),
+      // The bucket carries a default value even without the rateLimit brick so
+      // the slice shape is uniform, but the rate-limit GATE is skipped entirely
+      // when the brick is absent (see `gate`) — the bucket is simply never
+      // consulted. A `0/0` placeholder bucket would be touched by `tryConsume`;
+      // a `1-cap` default is harmless because the gate never calls it.
+      bucket: config.rateLimit ? initBucket(
+        config.rateLimit.capacity,
+        config.rateLimit.refillPerSec,
+        0
+      ) : initBucket(1, 1, 0),
+      retry: {},
+      cache: initCache(),
+      calls: {}
+    };
+  }
+  function retryOf(s, key) {
+    return s.retry[key] ?? initRetry();
+  }
+  function freshBudget(at) {
+    return {
+      remainingMs: config.deadline ? config.deadline.ms : 0,
+      chargingSinceMs: at
+    };
+  }
+  function budgetFor(s, key, at) {
+    const call = s.calls[key];
+    if (call?.phase === "running" || call?.phase === "waiting_retry") {
+      return charge(call.budget, at);
+    }
+    return freshBudget(at);
+  }
+  function gate(s, key, input, at, budget) {
+    if (config.deadline !== void 0 && budget.remainingMs <= 0) {
+      return [
+        setCall(s, key, {
+          phase: "failed",
+          error: {
+            _tag: "deadline_exceeded",
+            id: deadlineTimerId(name, key),
+            atMs: at
+          }
+        }),
+        []
+      ];
+    }
+    if (config.cache !== void 0) {
+      const cached = get(s.cache, key, at);
+      if (cached !== void 0) {
+        return [setCall(s, key, { phase: "succeeded", result: cached }), []];
+      }
+    }
+    let bucket = s.bucket;
+    if (config.rateLimit !== void 0) {
+      const [next, hasToken] = tryConsume(bucket, at);
+      bucket = next;
+      if (!hasToken) {
+        return backoff(
+          { ...s, bucket },
+          key,
+          input,
+          "rate_limited",
+          at,
+          budget
+        );
+      }
+    }
+    let circuit = s.circuit;
+    if (cPolicy !== null) {
+      const [next, ok] = canPass(circuit, cPolicy, at);
+      circuit = next;
+      if (!ok) {
+        return [
+          { ...setCall(s, key, { phase: "circuit_open" }), bucket, circuit },
+          []
+        ];
+      }
+    }
+    return [
+      {
+        ...setCall(s, key, { phase: "running", input, budget }),
+        circuit,
+        bucket
+      },
+      [runCmd({ key, input })]
+    ];
+  }
+  function backoff(s, key, input, error, at, budget) {
+    if (config.retry === void 0) {
+      return [setCall(s, key, { phase: "failed", error }), []];
+    }
+    const retry = recordFailure(retryOf(s, key), error, at);
+    const withRetry = { ...s, retry: { ...s.retry, [key]: retry } };
+    if (!shouldRetry(retry, config.retry, at)) {
+      return [setCall(withRetry, key, { phase: "failed", error }), []];
+    }
+    const retryAtMs = at + nextDelayMs(retry, config.retry, rngBranded);
+    return [
+      setCall(withRetry, key, {
+        phase: "waiting_retry",
+        input,
+        retryAtMs,
+        budget
+      }),
+      []
+    ];
+  }
+  function setCall(s, key, phase) {
+    return { ...s, calls: { ...s.calls, [key]: phase } };
+  }
+  function attempt(s, key, input, at) {
+    return gate(s, key, input, at, budgetFor(s, key, at));
+  }
+  function resume(s, at) {
+    const calls = { ...s.calls };
+    for (const [key, call] of Object.entries(calls)) {
+      if (call.phase !== "running" && call.phase !== "waiting_retry") continue;
+      calls[key] = {
+        ...call,
+        budget: { ...call.budget, chargingSinceMs: at }
+      };
+    }
+    return { ...s, calls };
+  }
+  function succeed(s, key, msg) {
+    const circuit = cPolicy !== null ? onSuccess(s.circuit) : s.circuit;
+    const cache = config.cache !== void 0 ? set(s.cache, key, msg.result, msg.at, config.cache.ttlMs) : s.cache;
+    const retry = without(s.retry, key);
+    return [
+      {
+        ...setCall(s, key, { phase: "succeeded", result: msg.result }),
+        circuit,
+        cache,
+        retry
+      },
+      []
+    ];
+  }
+  function fail(s, key, msg) {
+    const circuit = cPolicy !== null ? onFailure(s.circuit, cPolicy, msg.at) : s.circuit;
+    const withCircuit = { ...s, circuit };
+    const call = s.calls[key];
+    const input = call?.phase === "running" ? call.input : void 0;
+    const budget = budgetFor(s, key, msg.at);
+    if (input === void 0) {
+      return [
+        setCall(withCircuit, key, { phase: "failed", error: msg.error }),
+        []
+      ];
+    }
+    return backoff(withCircuit, key, input, msg.error, msg.at, budget);
+  }
+  function settleFailed(s, key, error) {
+    return [setCall(s, key, { phase: "failed", error }), []];
+  }
+  function onTimer(s, msg) {
+    for (const [key, call] of Object.entries(s.calls)) {
+      if (msg.id === retryTimerId(name, key)) {
+        if (call.phase !== "waiting_retry") return [s, []];
+        return gate(
+          s,
+          key,
+          call.input,
+          msg.atMs,
+          charge(call.budget, msg.atMs)
+        );
+      }
+      if (msg.id === deadlineTimerId(name, key)) {
+        if (call.phase !== "running" && call.phase !== "waiting_retry")
+          return [s, []];
+        return [
+          setCall(s, key, {
+            phase: "failed",
+            error: {
+              _tag: "deadline_exceeded",
+              id: msg.id,
+              atMs: msg.atMs
+            }
+          }),
+          []
+        ];
+      }
+    }
+    return [s, []];
+  }
+  function subs(s) {
+    const out = [];
+    for (const [key, call] of Object.entries(s.calls)) {
+      if (call.phase === "waiting_retry") {
+        out.push(
+          deadlineSub(retryTimerId(name, key), call.retryAtMs, {
+            name: deadlineName
+          })
+        );
+      }
+      if (config.deadline !== void 0 && (call.phase === "running" || call.phase === "waiting_retry") && call.budget.remainingMs > 0) {
+        out.push(
+          deadlineSub(
+            deadlineTimerId(name, key),
+            call.budget.chargingSinceMs + call.budget.remainingMs,
+            { name: deadlineName }
+          )
+        );
+      }
+    }
+    return out;
+  }
+  function handlers(ports) {
+    const handle = tryInterpret(
+      (cmd) => ports.run(cmd.input, cmd.key),
+      (result, cmd) => ({
+        type: okType,
+        key: cmd.key,
+        result,
+        at: Date.now()
+      }),
+      (error, cmd) => ({
+        type: errType,
+        key: cmd.key,
+        error,
+        at: Date.now()
+      })
+    );
+    return { [runCmd.cmdType]: handle };
+  }
+  return {
+    // The Msg-name family this knob speaks, as a VALUE typed at `N`. `mount`
+    // keys its settle cells off this rather than off the `resilient_*`
+    // literals, so a named knob mounts into its own cells (#229) and the Cmd,
+    // the Msgs, the Sub ids and the mounted cells all derive from one name.
+    name,
+    init,
+    attempt,
+    resume,
+    succeed,
+    fail,
+    settleFailed,
+    onTimer,
+    subs,
+    handlers
+  };
+}
+function liftResilience(state, result) {
+  return liftSlice("resilience", state, result);
+}
+function mountResilientCall(knob, config) {
+  const { slice, attempt, onOk, onErr, onDeadline } = config;
+  function put(model, next) {
+    return {
+      ...model,
+      ...{ [slice]: next }
+    };
+  }
+  function settle(verb, fold) {
+    return (model, msg) => {
+      const [next, cmds] = verb(model[slice], msg.key, msg);
+      const settled = put(model, next);
+      if (fold === void 0) return [settled, cmds];
+      const [folded, extra] = fold(settled, msg);
+      return [folded, [...cmds, ...extra]];
+    };
+  }
+  const update = {
+    [attempt.on]: (model, msg) => {
+      const [next, cmds] = attempt.run(model[slice], msg);
+      return [put(model, next), cmds];
+    },
+    // Keyed off the knob's own name, not the `resilient_*` literals: a knob
+    // built with `name: "jev"` emits `jev_ok` / `jev_err`, and a mount that
+    // spelled the literals would spread cells nothing ever dispatches to.
+    [`${knob.name}_ok`]: settle(
+      (s, key, msg) => knob.succeed(s, key, msg),
+      onOk
+    ),
+    [`${knob.name}_err`]: settle(
+      (s, key, msg) => knob.fail(s, key, msg),
+      onErr
+    ),
+    // The one settle path that carries no settle Msg: `onTimer` writes
+    // `failed` straight into the slice, so a mounted `onErr` never sees it. The
+    // cell reads the transition off the two slices instead of inventing a Msg —
+    // whichever key moved INTO `failed` is the call that just died.
+    //
+    // Keyed off the knob's name for the same reason the two settle cells are
+    // (#238): the knob's deadline Sub dispatches `<name>_deadline`, so a cell
+    // spelling the bare literal would be one two named knobs both claim — and
+    // the second spread into `defineMachine` would silently win.
+    [deadlineMsgType(deadlineNameOf(knob.name))]: (model, msg) => {
+      const before = model[slice];
+      const [next, cmds] = knob.onTimer(before, msg);
+      const advanced = put(model, next);
+      if (onDeadline === void 0) return [advanced, cmds];
+      let folded = advanced;
+      const extra = [];
+      for (const [key, call] of Object.entries(next.calls)) {
+        if (call.phase !== "failed") continue;
+        if (before.calls[key]?.phase === "failed") continue;
+        const [m, c] = onDeadline(folded, { key, error: call.error, msg });
+        folded = m;
+        extra.push(...c);
+      }
+      return [folded, [...cmds, ...extra]];
+    }
+  };
+  return {
+    init: () => ({ [slice]: knob.init() }),
+    update,
+    subscriptions: (model) => knob.subs(model[slice]),
+    subscribe: { deadline: subscribeDeadline },
+    interpret: knob.handlers()
+  };
+}
+
+export { DEFAULT_RESILIENT_NAME, MsgType, canPass, createResilientCall, defaultCircuitPolicy, initBucket, initCircuit, initWindow, liftResilience, mountResilientCall, onFailure, onSuccess, record, refill, remaining, runCmdDef, tryConsume };
+//# sourceMappingURL=chunk-AYS5N6WY.js.map
+//# sourceMappingURL=chunk-AYS5N6WY.js.map