@entifix/amqp 0.10.0 → 0.10.1

package/dist/adapters/amqp-event-bus.d.ts

@@ -1,7 +1,7 @@
 import type { WiringRegistry } from '@entifix/business';
 import { ShutdownRegistryTag, WiringRegistryTag } from '@entifix/business';
 import { type EventBus, EventBusTag, type Subscription } from '@entifix/transactions';
-import { Effect, Layer } from 'effect';
+import { Duration, Effect, Layer } from 'effect';
 import { AmqpChannelTag, type AmqpConnector } from '../amqp-connection/amqp-connection.js';
 /**
  * The queue a subscription binds.
@@ -21,6 +21,27 @@ import { AmqpChannelTag, type AmqpConnector } from '../amqp-connection/amqp-conn
  * three saved characters.
  */
 export declare const queueNameFor: (subscription: Subscription) => string;
+/**
+ * The adapter's own count of the attempts a message has failed, carried on the
+ * copy it republishes (#130).
+ *
+ * The broker cannot be trusted with it. RabbitMQ 4 does not count a requeued
+ * `basic.nack` toward a quorum queue's `x-delivery-limit` — measured on 4.3.5:
+ * a queue limited to 2 delivered one message 8 times and never set
+ * `x-delivery-count` — so a transient failure that never cleared was
+ * redelivered without a ceiling and without a pause. `x-delivery-limit` stays
+ * on the queue, where it still bounds the redeliveries a crashed consumer
+ * causes, which the broker does count.
+ */
+export declare const ATTEMPTS_HEADER = "x-entifix-attempts";
+/** How long a transient failure waits before its copy goes back on the queue. */
+export type RedeliveryBackoff = (attempt: number) => Duration.Duration;
+/**
+ * Doubling from 100 ms, capped at two seconds. The wait holds the delivery —
+ * the queue is `prefetch(1)`, so it pauses this consumer — which is the point:
+ * a dependency that is down is not helped by asking it again at once.
+ */
+export declare const DEFAULT_REDELIVERY_BACKOFF: RedeliveryBackoff;
 /**
  * RabbitMQ-backed {@link EventBus}. Events go out as `event` envelopes on the
  * shared topic exchange — the adapter owns the wire framing, so the port stays
@@ -48,7 +69,9 @@ export declare const queueNameFor: (subscription: Subscription) => string;
  * runs them — and putting it on `EventBus` would make every implementation of
  * a framework-free port carry a shutdown concern it has no deliveries to drain.
  */
-export declare const makeAmqpEventBus: (connector: AmqpConnector, wiring: WiringRegistry) => {
+export declare const makeAmqpEventBus: (connector: AmqpConnector, wiring: WiringRegistry, options?: {
+    readonly redeliveryBackoff?: RedeliveryBackoff;
+}) => {
     bus: EventBus;
     drainDeliveries: Effect.Effect<void>;
 };

package/dist/adapters/amqp-event-bus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"amqp-event-bus.d.ts","sourceRoot":"","sources":["../../src/adapters/amqp-event-bus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAO3E,OAAO,EACL,KAAK,QAAQ,EACb,WAAW,EACX,KAAK,YAAY,EAElB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAY,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,EACL,cAAc,EACd,KAAK,aAAa,EAGnB,MAAM,uCAAuC,CAAC;AAsE/C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,GAAI,cAAc,YAAY,KAAG,MAG1B,CAAC;AAsGjC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,gBAAgB,GAC3B,WAAW,aAAa,EACxB,QAAQ,cAAc,KACrB;IAAE,GAAG,EAAE,QAAQ,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CAqKvD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,2FAuB7B,CAAC"}
+{"version":3,"file":"amqp-event-bus.d.ts","sourceRoot":"","sources":["../../src/adapters/amqp-event-bus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAO3E,OAAO,EACL,KAAK,QAAQ,EACb,WAAW,EACX,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,EACL,cAAc,EACd,KAAK,aAAa,EAGnB,MAAM,uCAAuC,CAAC;AAuE/C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,GAAI,cAAc,YAAY,KAAG,MAG1B,CAAC;AAsDjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,uBAAuB,CAAC;AASpD,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,iBACmB,CAAC;AAoF7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,gBAAgB,GAC3B,WAAW,aAAa,EACxB,QAAQ,cAAc,EACtB,UAAS;IAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;CAAO,KAC/D;IAAE,GAAG,EAAE,QAAQ,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CAqKvD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,2FAuB7B,CAAC"}

package/dist/adapters/amqp-event-bus.js

@@ -19,9 +19,10 @@ import { recordConsumed, recordFailed, recordPublished, recordPublishFailure } f
  * ([ADR 0013](../../../../../docs/adr/0013-failures-are-typed-values-decided-at-the-shell.md)):
  * an answer redelivered is the same answer, so every business failure is
  * poison, and so is `protocol` — bytes that did not decode will not decode on
- * the fifth try. The transient categories are redelivered, bounded by
- * `x-delivery-limit`, and so is anything uncategorised: not knowing what went
- * wrong is not evidence that retrying is pointless.
+ * the fifth try. The transient categories are redelivered, bounded by the
+ * subscription's `maxAttempts` as the adapter counts them, and so is anything
+ * uncategorised: not knowing what went wrong is not evidence that retrying is
+ * pointless.
  */ const classify = (error)=>isFailure(error) ? {
         kind: error.family === 'business' || error.category === 'protocol' ? 'poison' : 'transient',
         code: error.code,
@@ -58,9 +59,11 @@ import { recordConsumed, recordFailed, recordPublished, recordPublishFailure } f
  *
  * A **work** queue is durable and quorum-backed, so it survives the consumer's
  * restart and accumulates while it is gone — the hop the outbox relay's
- * durability chain was missing. Its retry ceiling is `x-delivery-limit`, a queue argument
- * rather than logic every consumer reimplements, so it also counts a
- * redelivery after a crash.
+ * durability chain was missing. Its retry ceiling is the subscription's
+ * `maxAttempts`, counted by the adapter in {@link ATTEMPTS_HEADER} because the
+ * broker does not count a requeued nack (#130). The same number is the queue's
+ * `x-delivery-limit`, which bounds what the broker *does* count — a redelivery
+ * after a consumer crash.
  *
  * The quarantine is declared **first**: a message dead-lettered the instant the
  * work queue exists must have somewhere to land, and a `direct` exchange with
@@ -100,43 +103,85 @@ import { recordConsumed, recordFailed, recordPublished, recordPublishFailure } f
     return queue;
 };
 /**
- * Whether a failed delivery should go back on the queue.
+ * The adapter's own count of the attempts a message has failed, carried on the
+ * copy it republishes (#130).
  *
- * Only a transient failure on a **work** queue: there the broker counts the
- * redelivery against `x-delivery-limit` and dead-letters at the ceiling, so a
- * requeue is bounded. A broadcast queue has neither a ceiling nor a dead-letter
- * path, so requeueing there is an unbounded loop.
- */ /**
+ * The broker cannot be trusted with it. RabbitMQ 4 does not count a requeued
+ * `basic.nack` toward a quorum queue's `x-delivery-limit` — measured on 4.3.5:
+ * a queue limited to 2 delivered one message 8 times and never set
+ * `x-delivery-count` — so a transient failure that never cleared was
+ * redelivered without a ceiling and without a pause. `x-delivery-limit` stays
+ * on the queue, where it still bounds the redeliveries a crashed consumer
+ * causes, which the broker does count.
+ */ export const ATTEMPTS_HEADER = 'x-entifix-attempts';
+const attemptsSoFar = (message)=>{
+    var _message_properties_headers, _message_properties;
+    const value = (_message_properties = message.properties) == null ? void 0 : (_message_properties_headers = _message_properties.headers) == null ? void 0 : _message_properties_headers[ATTEMPTS_HEADER];
+    return typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : 0;
+};
+/**
+ * Doubling from 100 ms, capped at two seconds. The wait holds the delivery —
+ * the queue is `prefetch(1)`, so it pauses this consumer — which is the point:
+ * a dependency that is down is not helped by asking it again at once.
+ */ export const DEFAULT_REDELIVERY_BACKOFF = (attempt)=>Duration.millis(Math.min(100 * 2 ** (attempt - 1), 2000));
+/**
  * Settles a delivery that failed.
  *
- * Poison on a `work` queue is republished to the dead-letter exchange **with
- * its reason** — `x-failure-code` and `x-failure-category` — and then acked,
- * rather than nacked: a nack cannot carry headers, and a quarantine of
- * messages nobody can say anything about is a queue an operator has to replay
- * blind. If that publish is refused the nack still quarantines it, reasonless.
+ * Poison on a `work` queue — and a transient failure that has spent the
+ * subscription's `maxAttempts` — is republished to the dead-letter exchange
+ * **with its reason**: `x-failure-code`, `x-failure-category` and the attempts
+ * spent. It is then acked rather than nacked, because a nack cannot carry
+ * headers, and a quarantine of messages nobody can say anything about is a
+ * queue an operator has to replay blind. If that publish is refused the nack
+ * still quarantines it, reasonless.
  *
- * A transient failure is nacked for the broker to redeliver; a `broadcast`
- * queue has no quarantine, so its failures are dropped.
- */ const settleFailure = (channel, message, queue, mode, failure)=>{
-    if (failure.kind === 'poison' && mode === 'work') {
+ * A transient failure under the ceiling waits its backoff, goes back on its own
+ * queue as a copy carrying the attempt count, and the original is acked. If
+ * that publish is refused it is nacked for the broker to redeliver, which is
+ * the old behaviour and still better than losing it. A `broadcast` queue has no
+ * quarantine and no ceiling, so its failures are dropped.
+ */ const settleFailure = (channel, message, queue, subscription, failure, backoff)=>{
+    if (subscription.mode === 'broadcast') {
+        return Effect.sync(()=>channel.nack(message, false, false));
+    }
+    const attempts = failure.kind === 'transient' ? attemptsSoFar(message) + 1 : 0;
+    if (failure.kind === 'poison' || attempts >= subscription.maxAttempts) {
+        return Effect.sync(()=>quarantine(channel, message, queue, failure, attempts));
+    }
+    const wait = backoff(attempts);
+    return (Duration.isZero(wait) ? Effect.void : Effect.sleep(wait)).pipe(Effect.andThen(Effect.sync(()=>{
         try {
             var _message_properties;
-            channel.publish(EVENTS_DLX, queue, message.content, _extends({}, message.properties, {
+            channel.publish('', queue, message.content, _extends({}, message.properties, {
                 persistent: true,
                 headers: _extends({}, (_message_properties = message.properties) == null ? void 0 : _message_properties.headers, {
-                    'x-failure-code': failure.code,
-                    'x-failure-category': failure.category
+                    [ATTEMPTS_HEADER]: attempts
                 })
             }));
             channel.ack(message);
-            return;
         } catch (unused) {
-        // Fall through: quarantined without its reason beats not quarantined.
+            channel.nack(message, false, true);
         }
+    })));
+};
+const quarantine = (channel, message, queue, failure, attempts)=>{
+    try {
+        var _message_properties;
+        channel.publish(EVENTS_DLX, queue, message.content, _extends({}, message.properties, {
+            persistent: true,
+            headers: _extends({}, (_message_properties = message.properties) == null ? void 0 : _message_properties.headers, {
+                'x-failure-code': failure.code,
+                'x-failure-category': failure.category
+            }, attempts > 0 ? {
+                [ATTEMPTS_HEADER]: attempts
+            } : {})
+        }));
+        channel.ack(message);
+    } catch (unused) {
+        // Quarantined without its reason beats not quarantined.
+        channel.nack(message, false, false);
     }
-    channel.nack(message, false, requeues(failure, mode));
 };
-const requeues = (failure, mode)=>failure.kind === 'transient' && mode === 'work';
 /**
  * RabbitMQ-backed {@link EventBus}. Events go out as `event` envelopes on the
  * shared topic exchange — the adapter owns the wire framing, so the port stays
@@ -163,7 +208,9 @@ const requeues = (failure, mode)=>failure.kind === 'transient' && mode === 'work
  * waiting for in-flight handlers is an adapter fact — it is this module that
  * runs them — and putting it on `EventBus` would make every implementation of
  * a framework-free port carry a shutdown concern it has no deliveries to drain.
- */ export const makeAmqpEventBus = (connector, wiring)=>{
+ */ export const makeAmqpEventBus = (connector, wiring, options = {})=>{
+    var _options_redeliveryBackoff;
+    const backoff = (_options_redeliveryBackoff = options.redeliveryBackoff) != null ? _options_redeliveryBackoff : DEFAULT_REDELIVERY_BACKOFF;
     /**
    * Handlers started and not yet settled.
    *
@@ -235,7 +282,7 @@ const requeues = (failure, mode)=>failure.kind === 'transient' && mode === 'work
                             // is the *only* thing that can tell a malformed one from a bad
                             // afternoon at the database — and it says so by failing with
                             // a business or `protocol` failure, which quarantines at once
-                            // instead of spending `x-delivery-limit` on every message
+                            // instead of spending `maxAttempts` on every message
                             // behind it. Measured on `catalog.published`: a payload the
                             // contract rejected used to take five deliveries to quarantine.
                             Effect.flatMap((event)=>handler(event).pipe(Effect.mapError(classify))));
@@ -250,7 +297,7 @@ const requeues = (failure, mode)=>failure.kind === 'transient' && mode === 'work
                             // inside the observability layer.
                             Effect.matchEffect({
                                 onSuccess: ()=>recordConsumed(tags).pipe(Effect.andThen(Effect.sync(()=>channel.ack(message)))),
-                                onFailure: (failure)=>recordFailed(tags, failure.kind).pipe(Effect.andThen(Effect.sync(()=>settleFailure(channel, message, queue, subscription.mode, failure))))
+                                onFailure: (failure)=>recordFailed(tags, failure.kind).pipe(Effect.andThen(settleFailure(channel, message, queue, subscription, failure, backoff)))
                             }))).finally(()=>{
                                 inFlight -= 1;
                             });

package/dist/adapters/amqp-event-bus.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/amqp-event-bus.ts"],"sourcesContent":["import type { WiringRegistry } from '@entifix/business';\nimport { ShutdownRegistryTag, WiringRegistryTag } from '@entifix/business';\nimport {\n  isFailure,\n  makeEventEnvelope,\n  readEventEnvelope,\n  Unavailable,\n} from '@entifix/core';\nimport {\n  type EventBus,\n  EventBusTag,\n  type Subscription,\n  type SubscriptionMode,\n} from '@entifix/transactions';\nimport type { Channel, ConsumeMessage } from 'amqplib';\nimport { Duration, Effect, Layer } from 'effect';\n\nimport {\n  AmqpChannelTag,\n  type AmqpConnector,\n  EVENTS_DLX,\n  EVENTS_EXCHANGE,\n} from '../amqp-connection/amqp-connection.js';\nimport {\n  recordConsumed,\n  recordFailed,\n  recordPublished,\n  recordPublishFailure,\n  type SubscriptionTags,\n} from './bus-metrics.js';\n\n/** Appended to a work queue's name to make the queue that holds its failures. */\nconst QUARANTINE_SUFFIX = '.quarantine';\n\n/**\n * How often the shutdown drain re-checks whether the handlers have finished.\n *\n * A poll rather than a latch because a delivery is started from amqplib's own\n * callback, outside any fiber this module holds; the drain's own bound is the\n * shutdown hook's, so this interval only decides how promptly the process\n * notices it is free to go.\n */\nconst DELIVERY_POLL = Duration.millis(25);\n\n/**\n * Why a delivery did not succeed, which is the whole of the nack decision.\n *\n * `transient` is a handler that threw — a dependency briefly gone, a timeout —\n * and is worth another delivery. `poison` is a payload this process cannot\n * read, and is worth **none**: a message that cannot be deserialized never\n * becomes deserializable, so retrying it only spends the delivery budget of the\n * messages queued behind it. Conflating the two is what the adapter once did,\n * on a queue that discarded both.\n *\n * A *business* failure is neither, and never reaches here: that message was\n * handled successfully and produced its own `failed` event.\n */\ninterface DeliveryFailure {\n  readonly kind: 'transient' | 'poison';\n  /** The failure's code and category, carried onto a quarantined message. */\n  readonly code: string;\n  readonly category: string;\n}\n\n/**\n * The poison rule, by category and never by class\n * ([ADR 0013](../../../../../docs/adr/0013-failures-are-typed-values-decided-at-the-shell.md)):\n * an answer redelivered is the same answer, so every business failure is\n * poison, and so is `protocol` — bytes that did not decode will not decode on\n * the fifth try. The transient categories are redelivered, bounded by\n * `x-delivery-limit`, and so is anything uncategorised: not knowing what went\n * wrong is not evidence that retrying is pointless.\n */\nconst classify = (error: unknown): DeliveryFailure =>\n  isFailure(error)\n    ? {\n        kind:\n          error.family === 'business' || error.category === 'protocol'\n            ? 'poison'\n            : 'transient',\n        code: error.code,\n        category: error.category,\n      }\n    : { kind: 'transient', code: 'internal', category: 'internal' };\n\n/** A payload that is not JSON: the sender's fault, decided before any handler. */\nconst UNREADABLE: DeliveryFailure = {\n  kind: 'poison',\n  code: 'invalidEnvelope',\n  category: 'invalid',\n};\n\n/**\n * The queue a subscription binds.\n *\n * `<subscribing slice>.<pattern>`, so the name says who is owed the messages in\n * it — readable in the broker's own UI, which is where someone looks when a\n * queue has depth. The slice is the *subscriber's*, never the publisher's:\n * `EventSourceTag` names the emitter, and one deployment hosts several slices\n * (a host may co-deploy two slices in one process), so\n * deriving from it would file a consumer's queue under whoever happened to\n * publish from the same process.\n *\n * `*` and `#` are spelled out because AMQP 0-9-1 restricts a queue name to\n * letters, digits, hyphen, underscore, period and colon. RabbitMQ is lenient in\n * practice, but the name also has to survive being a URL path segment in the\n * management API, and `%2A` in an operator's address bar is a poor trade for\n * three saved characters.\n */\nexport const queueNameFor = (subscription: Subscription): string =>\n  `${subscription.slice}.${subscription.pattern\n    .replaceAll('*', '_star_')\n    .replaceAll('#', '_hash_')}`;\n\n/**\n * Declares the queue a subscription consumes and returns its name.\n *\n * A **work** queue is durable and quorum-backed, so it survives the consumer's\n * restart and accumulates while it is gone — the hop the outbox relay's\n * durability chain was missing. Its retry ceiling is `x-delivery-limit`, a queue argument\n * rather than logic every consumer reimplements, so it also counts a\n * redelivery after a crash.\n *\n * The quarantine is declared **first**: a message dead-lettered the instant the\n * work queue exists must have somewhere to land, and a `direct` exchange with\n * no matching binding drops what it routes.\n *\n * `x-delivery-limit` is immutable once a queue exists. Re-declaring with a\n * different `maxAttempts` fails `PRECONDITION_FAILED` and closes the channel,\n * and there is no safe automatic recovery — so changing the ceiling means\n * deleting the queue, which locally is `pnpm run <app>:dev:reset`.\n */\nconst declareQueue = async (\n  channel: Channel,\n  subscription: Subscription,\n): Promise<string> => {\n  if (subscription.mode === 'broadcast') {\n    // Connection-scoped and retained by nobody, which is right only when the\n    // replicas differ from one another, as a per-connection push does.\n    const { queue } = await channel.assertQueue('', { exclusive: true });\n    return queue;\n  }\n\n  const queue = queueNameFor(subscription);\n  const quarantine = `${queue}${QUARANTINE_SUFFIX}`;\n\n  await channel.assertQueue(quarantine, {\n    durable: true,\n    arguments: { 'x-queue-type': 'quorum' },\n  });\n  await channel.bindQueue(quarantine, EVENTS_DLX, queue);\n  await channel.assertQueue(queue, {\n    durable: true,\n    arguments: {\n      'x-queue-type': 'quorum',\n      'x-delivery-limit': subscription.maxAttempts,\n      'x-dead-letter-exchange': EVENTS_DLX,\n      'x-dead-letter-routing-key': queue,\n    },\n  });\n\n  return queue;\n};\n\n/**\n * Whether a failed delivery should go back on the queue.\n *\n * Only a transient failure on a **work** queue: there the broker counts the\n * redelivery against `x-delivery-limit` and dead-letters at the ceiling, so a\n * requeue is bounded. A broadcast queue has neither a ceiling nor a dead-letter\n * path, so requeueing there is an unbounded loop.\n */\n/**\n * Settles a delivery that failed.\n *\n * Poison on a `work` queue is republished to the dead-letter exchange **with\n * its reason** — `x-failure-code` and `x-failure-category` — and then acked,\n * rather than nacked: a nack cannot carry headers, and a quarantine of\n * messages nobody can say anything about is a queue an operator has to replay\n * blind. If that publish is refused the nack still quarantines it, reasonless.\n *\n * A transient failure is nacked for the broker to redeliver; a `broadcast`\n * queue has no quarantine, so its failures are dropped.\n */\nconst settleFailure = (\n  channel: Channel,\n  message: ConsumeMessage,\n  queue: string,\n  mode: SubscriptionMode,\n  failure: DeliveryFailure,\n): void => {\n  if (failure.kind === 'poison' && mode === 'work') {\n    try {\n      channel.publish(EVENTS_DLX, queue, message.content, {\n        ...message.properties,\n        persistent: true,\n        headers: {\n          ...message.properties?.headers,\n          'x-failure-code': failure.code,\n          'x-failure-category': failure.category,\n        },\n      });\n      channel.ack(message);\n      return;\n    } catch {\n      // Fall through: quarantined without its reason beats not quarantined.\n    }\n  }\n  channel.nack(message, false, requeues(failure, mode));\n};\n\nconst requeues = (failure: DeliveryFailure, mode: SubscriptionMode): boolean =>\n  failure.kind === 'transient' && mode === 'work';\n\n/**\n * RabbitMQ-backed {@link EventBus}. Events go out as `event` envelopes on the\n * shared topic exchange — the adapter owns the wire framing, so the port stays\n * event-typed.\n *\n * **The event's own name is the routing key**, which is what lets a subscriber\n * bind the exact pattern it declared in `tools/slices/*.slice.ts`.\n *\n * The queue a subscriber binds is its own choice of shape. A `work`\n * subscription gets a named durable queue that replicas share and that keeps\n * accumulating while the consumer is down; a `broadcast` one gets an exclusive\n * queue, where every replica sees every event and nothing\n * survives a restart. Choosing broadcast for a workload that is work is how an\n * event published during a rollout is dropped by the broker while the outbox\n * has already recorded it sent.\n *\n * Both methods go through the {@link AmqpConnector} rather than holding a\n * channel, because a channel does not survive the broker restarting. `publish`\n * asks for a live one per call, and `subscribe` registers its setup so the\n * connector can re-run it against the new channel after a reconnect. A durable\n * queue outlives that reconnect; the consumer bound to it does not.\n *\n * It returns the bus **and** its `drainDeliveries`, rather than only the port:\n * waiting for in-flight handlers is an adapter fact — it is this module that\n * runs them — and putting it on `EventBus` would make every implementation of\n * a framework-free port carry a shutdown concern it has no deliveries to drain.\n */\nexport const makeAmqpEventBus = (\n  connector: AmqpConnector,\n  wiring: WiringRegistry,\n): { bus: EventBus; drainDeliveries: Effect.Effect<void> } => {\n  /**\n   * Handlers started and not yet settled.\n   *\n   * Nothing tracked them before, so a SIGTERM killed them mid-flight and the\n   * broker redelivered whatever was unacked — safe only while every consumer\n   * happens to be idempotent, which is the assumption the command inbox stops\n   * making.\n   */\n  let inFlight = 0;\n\n  const bus: EventBus = {\n    publish: event =>\n      Effect.tryPromise({\n        try: () =>\n          connector.withChannel(async channel => {\n            channel.publish(\n              EVENTS_EXCHANGE,\n              event.name,\n              Buffer.from(JSON.stringify(makeEventEnvelope(event))),\n              { persistent: true },\n            );\n          }),\n        catch: error => new Unavailable({ dependency: 'amqp' }),\n        // Recorded **after** the publish succeeds, so `GET /api/$service` reports\n        // what this process actually put on the exchange. Recording the intent\n        // instead would make the declared-vs-observed diff pass on a service whose\n        // every publish is failing.\n      }).pipe(\n        Effect.tap(() =>\n          wiring\n            .recordPublish(event.name)\n            .pipe(Effect.andThen(recordPublished(event.name))),\n        ),\n        // Counted here and not in the `catch` above, which only builds the\n        // error: a rising publish-failure rate against a flat published rate\n        // is what a broker outage looks like from the publisher's side, and\n        // the outbox's own backlog is the confirmation.\n        Effect.tapError(() => recordPublishFailure(event.name)),\n      ),\n\n    subscribe: (subscription, handler) =>\n      Effect.tryPromise({\n        try: () =>\n          connector.addConsumer(async channel => {\n            // One unacked message at a time: events for a transaction are then\n            // folded serially (never concurrently), so an `accepted`/`completed`\n            // pair can't race into two upserts.\n            await channel.prefetch(1);\n            const queue = await declareQueue(channel, subscription);\n            await channel.bindQueue(\n              queue,\n              EVENTS_EXCHANGE,\n              subscription.pattern,\n            );\n            // What the process **bound**, recorded at the point it bound it. The\n            // registry deduplicates, so re-running this setup after a reconnect\n            // does not double the entry.\n            await Effect.runPromise(\n              wiring.recordSubscription({\n                slice: subscription.slice,\n                pattern: subscription.pattern,\n                mode: subscription.mode,\n                queue,\n              }),\n            );\n            // Resolved once per binding rather than per delivery: `queue` is the\n            // durable name for a `work` subscription and the broker's generated\n            // one for a `broadcast` queue, so it is only knowable here.\n            const tags: SubscriptionTags = {\n              queue,\n              slice: subscription.slice,\n              mode: subscription.mode,\n            };\n            const { consumerTag } = await channel.consume(\n              queue,\n              (message: ConsumeMessage | null) => {\n                if (message === null) {\n                  return;\n                }\n\n                // Reading the payload and running the handler are separated on\n                // purpose: they fail for different reasons and earn different\n                // treatment. `JSON.parse` is inside the Effect because it throws\n                // *synchronously* — outside, it escaped into amqplib's callback and\n                // the message was never even nacked.\n                const settle = Effect.try({\n                  try: () => JSON.parse(message.content.toString()) as unknown,\n                  catch: (): DeliveryFailure => UNREADABLE,\n                }).pipe(\n                  Effect.flatMap(parsed =>\n                    readEventEnvelope(parsed).pipe(Effect.mapError(classify)),\n                  ),\n                  // The handler carries no requirements (the subscriber closes over\n                  // its store), so it runs standalone.\n                  //\n                  // ⚠️ A handler's failure is classified by its category, not\n                  // treated as transient across the board. The transport\n                  // validates `meta` and deliberately not `data` (inventing an\n                  // opinion about a payload is how the bus would start knowing\n                  // about domains), so a consumer that decodes its own payload\n                  // is the *only* thing that can tell a malformed one from a bad\n                  // afternoon at the database — and it says so by failing with\n                  // a business or `protocol` failure, which quarantines at once\n                  // instead of spending `x-delivery-limit` on every message\n                  // behind it. Measured on `catalog.published`: a payload the\n                  // contract rejected used to take five deliveries to quarantine.\n                  Effect.flatMap(event =>\n                    handler(event).pipe(Effect.mapError(classify)),\n                  ),\n                );\n\n                // Counted around the whole settle, so a shutdown waits for the ack\n                // as well as the handler: cancelling a consumer stops *new*\n                // deliveries and says nothing about this one.\n                inFlight += 1;\n                void Effect.runPromise(\n                  settle.pipe(\n                    // Effect's metric registry is a process-wide singleton, so an\n                    // increment inside this detached `runPromise` reaches the same\n                    // producer `NodeSdk` exports from. That is the only reason a\n                    // metric works here at all — nothing about this fiber is\n                    // inside the observability layer.\n                    Effect.matchEffect({\n                      onSuccess: () =>\n                        recordConsumed(tags).pipe(\n                          Effect.andThen(\n                            Effect.sync(() => channel.ack(message)),\n                          ),\n                        ),\n                      onFailure: failure =>\n                        recordFailed(tags, failure.kind).pipe(\n                          Effect.andThen(\n                            Effect.sync(() =>\n                              settleFailure(\n                                channel,\n                                message,\n                                queue,\n                                subscription.mode,\n                                failure,\n                              ),\n                            ),\n                          ),\n                        ),\n                    }),\n                  ),\n                ).finally(() => {\n                  inFlight -= 1;\n                });\n              },\n            );\n            return [consumerTag];\n          }),\n        catch: error => new Unavailable({ dependency: 'amqp' }),\n      }),\n  };\n\n  return {\n    bus,\n    drainDeliveries: Effect.gen(function* () {\n      while (inFlight > 0) {\n        yield* Effect.sleep(DELIVERY_POLL);\n      }\n    }),\n  };\n};\n\n/**\n * Provides {@link EventBusTag} from an {@link AmqpChannelTag}.\n *\n * It also takes {@link WiringRegistryTag}, which `makeServerLayer` provides once\n * per service — so the bus and `GET /api/$service` share one instance, and the\n * document reports the bindings this very process made.\n */\nexport const AmqpEventBusLayer = Layer.effect(\n  EventBusTag,\n  Effect.gen(function* () {\n    const connector = yield* AmqpChannelTag;\n    const wiring = yield* WiringRegistryTag;\n    const shutdown = yield* ShutdownRegistryTag;\n    const { bus, drainDeliveries } = makeAmqpEventBus(connector, wiring);\n\n    // `stop-intake`, and both halves are it: cancelling stops the broker\n    // handing over anything new, then the drain waits for the deliveries\n    // already in progress. Registered here rather than in a service's `main.ts`\n    // for the reason every registry in this repo exists — a service that gains\n    // a bus gains its drain, with nothing to remember.\n    yield* shutdown.register({\n      name: 'amqp-consumers',\n      phase: 'stop-intake',\n      run: Effect.promise(() => connector.cancelConsumers()).pipe(\n        Effect.andThen(drainDeliveries),\n      ),\n    });\n\n    return bus;\n  }),\n);\n"],"names":["ShutdownRegistryTag","WiringRegistryTag","isFailure","makeEventEnvelope","readEventEnvelope","Unavailable","EventBusTag","Duration","Effect","Layer","AmqpChannelTag","EVENTS_DLX","EVENTS_EXCHANGE","recordConsumed","recordFailed","recordPublished","recordPublishFailure","QUARANTINE_SUFFIX","DELIVERY_POLL","millis","classify","error","kind","family","category","code","UNREADABLE","queueNameFor","subscription","slice","pattern","replaceAll","declareQueue","channel","mode","queue","assertQueue","exclusive","quarantine","durable","arguments","bindQueue","maxAttempts","settleFailure","message","failure","publish","content","properties","persistent","headers","ack","nack","requeues","makeAmqpEventBus","connector","wiring","inFlight","bus","event","tryPromise","try","withChannel","name","Buffer","from","JSON","stringify","catch","dependency","pipe","tap","recordPublish","andThen","tapError","subscribe","handler","addConsumer","prefetch","runPromise","recordSubscription","tags","consumerTag","consume","settle","parse","toString","flatMap","parsed","mapError","matchEffect","onSuccess","sync","onFailure","finally","drainDeliveries","gen","sleep","AmqpEventBusLayer","effect","shutdown","register","phase","run","promise","cancelConsumers"],"mappings":";AACA,SAASA,mBAAmB,EAAEC,iBAAiB,QAAQ,oBAAoB;AAC3E,SACEC,SAAS,EACTC,iBAAiB,EACjBC,iBAAiB,EACjBC,WAAW,QACN,gBAAgB;AACvB,SAEEC,WAAW,QAGN,wBAAwB;AAE/B,SAASC,QAAQ,EAAEC,MAAM,EAAEC,KAAK,QAAQ,SAAS;AAEjD,SACEC,cAAc,EAEdC,UAAU,EACVC,eAAe,QACV,wCAAwC;AAC/C,SACEC,cAAc,EACdC,YAAY,EACZC,eAAe,EACfC,oBAAoB,QAEf,mBAAmB;AAE1B,+EAA+E,GAC/E,MAAMC,oBAAoB;AAE1B;;;;;;;CAOC,GACD,MAAMC,gBAAgBX,SAASY,MAAM,CAAC;AAsBtC;;;;;;;;CAQC,GACD,MAAMC,WAAW,CAACC,QAChBnB,UAAUmB,SACN;QACEC,MACED,MAAME,MAAM,KAAK,cAAcF,MAAMG,QAAQ,KAAK,aAC9C,WACA;QACNC,MAAMJ,MAAMI,IAAI;QAChBD,UAAUH,MAAMG,QAAQ;IAC1B,IACA;QAAEF,MAAM;QAAaG,MAAM;QAAYD,UAAU;IAAW;AAElE,gFAAgF,GAChF,MAAME,aAA8B;IAClCJ,MAAM;IACNG,MAAM;IACND,UAAU;AACZ;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMG,eAAe,CAACC,eAC3B,GAAGA,aAAaC,KAAK,CAAC,CAAC,EAAED,aAAaE,OAAO,CAC1CC,UAAU,CAAC,KAAK,UAChBA,UAAU,CAAC,KAAK,WAAW,CAAC;AAEjC;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAMC,eAAe,OACnBC,SACAL;IAEA,IAAIA,aAAaM,IAAI,KAAK,aAAa;QACrC,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,EAAEC,KAAK,EAAE,GAAG,MAAMF,QAAQG,WAAW,CAAC,IAAI;YAAEC,WAAW;QAAK;QAClE,OAAOF;IACT;IAEA,MAAMA,QAAQR,aAAaC;IAC3B,MAAMU,aAAa,GAAGH,QAAQlB,mBAAmB;IAEjD,MAAMgB,QAAQG,WAAW,CAACE,YAAY;QACpCC,SAAS;QACTC,WAAW;YAAE,gBAAgB;QAAS;IACxC;IACA,MAAMP,QAAQQ,SAAS,CAACH,YAAY3B,YAAYwB;IAChD,MAAMF,QAAQG,WAAW,CAACD,OAAO;QAC/BI,SAAS;QACTC,WAAW;YACT,gBAAgB;YAChB,oBAAoBZ,aAAac,WAAW;YAC5C,0BAA0B/B;YAC1B,6BAA6BwB;QAC/B;IACF;IAEA,OAAOA;AACT;AAEA;;;;;;;CAOC,GACD;;;;;;;;;;;CAWC,GACD,MAAMQ,gBAAgB,CACpBV,SACAW,SACAT,OACAD,MACAW;IAEA,IAAIA,QAAQvB,IAAI,KAAK,YAAYY,SAAS,QAAQ;QAChD,IAAI;gBAKKU;YAJPX,QAAQa,OAAO,CAACnC,YAAYwB,OAAOS,QAAQG,OAAO,EAAE,aAC/CH,QAAQI,UAAU;gBACrBC,YAAY;gBACZC,SAAS,cACJN,sBAAAA,QAAQI,UAAU,qBAAlBJ,oBAAoBM,OAAO;oBAC9B,kBAAkBL,QAAQpB,IAAI;oBAC9B,sBAAsBoB,QAAQrB,QAAQ;;;YAG1CS,QAAQkB,GAAG,CAACP;YACZ;QACF,EAAE,eAAM;QACN,sEAAsE;QACxE;IACF;IACAX,QAAQmB,IAAI,CAACR,SAAS,OAAOS,SAASR,SAASX;AACjD;AAEA,MAAMmB,WAAW,CAACR,SAA0BX,OAC1CW,QAAQvB,IAAI,KAAK,eAAeY,SAAS;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,MAAMoB,mBAAmB,CAC9BC,WACAC;IAEA;;;;;;;GAOC,GACD,IAAIC,WAAW;IAEf,MAAMC,MAAgB;QACpBZ,SAASa,CAAAA,QACPnD,OAAOoD,UAAU,CAAC;gBAChBC,KAAK,IACHN,UAAUO,WAAW,CAAC,OAAM7B;wBAC1BA,QAAQa,OAAO,CACblC,iBACA+C,MAAMI,IAAI,EACVC,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAAChE,kBAAkBwD,UAC7C;4BAAEV,YAAY;wBAAK;oBAEvB;gBACFmB,OAAO/C,CAAAA,QAAS,IAAIhB,YAAY;wBAAEgE,YAAY;oBAAO;YAKvD,GAAGC,IAAI,CACL9D,OAAO+D,GAAG,CAAC,IACTf,OACGgB,aAAa,CAACb,MAAMI,IAAI,EACxBO,IAAI,CAAC9D,OAAOiE,OAAO,CAAC1D,gBAAgB4C,MAAMI,IAAI,MAEnD,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,gDAAgD;YAChDvD,OAAOkE,QAAQ,CAAC,IAAM1D,qBAAqB2C,MAAMI,IAAI;QAGzDY,WAAW,CAAC/C,cAAcgD,UACxBpE,OAAOoD,UAAU,CAAC;gBAChBC,KAAK,IACHN,UAAUsB,WAAW,CAAC,OAAM5C;wBAC1B,mEAAmE;wBACnE,qEAAqE;wBACrE,oCAAoC;wBACpC,MAAMA,QAAQ6C,QAAQ,CAAC;wBACvB,MAAM3C,QAAQ,MAAMH,aAAaC,SAASL;wBAC1C,MAAMK,QAAQQ,SAAS,CACrBN,OACAvB,iBACAgB,aAAaE,OAAO;wBAEtB,qEAAqE;wBACrE,oEAAoE;wBACpE,6BAA6B;wBAC7B,MAAMtB,OAAOuE,UAAU,CACrBvB,OAAOwB,kBAAkB,CAAC;4BACxBnD,OAAOD,aAAaC,KAAK;4BACzBC,SAASF,aAAaE,OAAO;4BAC7BI,MAAMN,aAAaM,IAAI;4BACvBC;wBACF;wBAEF,qEAAqE;wBACrE,oEAAoE;wBACpE,4DAA4D;wBAC5D,MAAM8C,OAAyB;4BAC7B9C;4BACAN,OAAOD,aAAaC,KAAK;4BACzBK,MAAMN,aAAaM,IAAI;wBACzB;wBACA,MAAM,EAAEgD,WAAW,EAAE,GAAG,MAAMjD,QAAQkD,OAAO,CAC3ChD,OACA,CAACS;4BACC,IAAIA,YAAY,MAAM;gCACpB;4BACF;4BAEA,+DAA+D;4BAC/D,8DAA8D;4BAC9D,iEAAiE;4BACjE,oEAAoE;4BACpE,qCAAqC;4BACrC,MAAMwC,SAAS5E,OAAOqD,GAAG,CAAC;gCACxBA,KAAK,IAAMK,KAAKmB,KAAK,CAACzC,QAAQG,OAAO,CAACuC,QAAQ;gCAC9ClB,OAAO,IAAuB1C;4BAChC,GAAG4C,IAAI,CACL9D,OAAO+E,OAAO,CAACC,CAAAA,SACbpF,kBAAkBoF,QAAQlB,IAAI,CAAC9D,OAAOiF,QAAQ,CAACrE,aAEjD,kEAAkE;4BAClE,qCAAqC;4BACrC,EAAE;4BACF,4DAA4D;4BAC5D,uDAAuD;4BACvD,6DAA6D;4BAC7D,6DAA6D;4BAC7D,6DAA6D;4BAC7D,+DAA+D;4BAC/D,6DAA6D;4BAC7D,8DAA8D;4BAC9D,0DAA0D;4BAC1D,4DAA4D;4BAC5D,gEAAgE;4BAChEZ,OAAO+E,OAAO,CAAC5B,CAAAA,QACbiB,QAAQjB,OAAOW,IAAI,CAAC9D,OAAOiF,QAAQ,CAACrE;4BAIxC,mEAAmE;4BACnE,4DAA4D;4BAC5D,8CAA8C;4BAC9CqC,YAAY;4BACZ,KAAKjD,OAAOuE,UAAU,CACpBK,OAAOd,IAAI,CACT,8DAA8D;4BAC9D,+DAA+D;4BAC/D,6DAA6D;4BAC7D,yDAAyD;4BACzD,kCAAkC;4BAClC9D,OAAOkF,WAAW,CAAC;gCACjBC,WAAW,IACT9E,eAAeoE,MAAMX,IAAI,CACvB9D,OAAOiE,OAAO,CACZjE,OAAOoF,IAAI,CAAC,IAAM3D,QAAQkB,GAAG,CAACP;gCAGpCiD,WAAWhD,CAAAA,UACT/B,aAAamE,MAAMpC,QAAQvB,IAAI,EAAEgD,IAAI,CACnC9D,OAAOiE,OAAO,CACZjE,OAAOoF,IAAI,CAAC,IACVjD,cACEV,SACAW,SACAT,OACAP,aAAaM,IAAI,EACjBW;4BAKZ,KAEFiD,OAAO,CAAC;gCACRrC,YAAY;4BACd;wBACF;wBAEF,OAAO;4BAACyB;yBAAY;oBACtB;gBACFd,OAAO/C,CAAAA,QAAS,IAAIhB,YAAY;wBAAEgE,YAAY;oBAAO;YACvD;IACJ;IAEA,OAAO;QACLX;QACAqC,iBAAiBvF,OAAOwF,GAAG,CAAC;YAC1B,MAAOvC,WAAW,EAAG;gBACnB,OAAOjD,OAAOyF,KAAK,CAAC/E;YACtB;QACF;IACF;AACF,EAAE;AAEF;;;;;;CAMC,GACD,OAAO,MAAMgF,oBAAoBzF,MAAM0F,MAAM,CAC3C7F,aACAE,OAAOwF,GAAG,CAAC;IACT,MAAMzC,YAAY,OAAO7C;IACzB,MAAM8C,SAAS,OAAOvD;IACtB,MAAMmG,WAAW,OAAOpG;IACxB,MAAM,EAAE0D,GAAG,EAAEqC,eAAe,EAAE,GAAGzC,iBAAiBC,WAAWC;IAE7D,qEAAqE;IACrE,qEAAqE;IACrE,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,OAAO4C,SAASC,QAAQ,CAAC;QACvBtC,MAAM;QACNuC,OAAO;QACPC,KAAK/F,OAAOgG,OAAO,CAAC,IAAMjD,UAAUkD,eAAe,IAAInC,IAAI,CACzD9D,OAAOiE,OAAO,CAACsB;IAEnB;IAEA,OAAOrC;AACT,IACA"}
+{"version":3,"sources":["../../src/adapters/amqp-event-bus.ts"],"sourcesContent":["import type { WiringRegistry } from '@entifix/business';\nimport { ShutdownRegistryTag, WiringRegistryTag } from '@entifix/business';\nimport {\n  isFailure,\n  makeEventEnvelope,\n  readEventEnvelope,\n  Unavailable,\n} from '@entifix/core';\nimport {\n  type EventBus,\n  EventBusTag,\n  type Subscription,\n} from '@entifix/transactions';\nimport type { Channel, ConsumeMessage } from 'amqplib';\nimport { Duration, Effect, Layer } from 'effect';\n\nimport {\n  AmqpChannelTag,\n  type AmqpConnector,\n  EVENTS_DLX,\n  EVENTS_EXCHANGE,\n} from '../amqp-connection/amqp-connection.js';\nimport {\n  recordConsumed,\n  recordFailed,\n  recordPublished,\n  recordPublishFailure,\n  type SubscriptionTags,\n} from './bus-metrics.js';\n\n/** Appended to a work queue's name to make the queue that holds its failures. */\nconst QUARANTINE_SUFFIX = '.quarantine';\n\n/**\n * How often the shutdown drain re-checks whether the handlers have finished.\n *\n * A poll rather than a latch because a delivery is started from amqplib's own\n * callback, outside any fiber this module holds; the drain's own bound is the\n * shutdown hook's, so this interval only decides how promptly the process\n * notices it is free to go.\n */\nconst DELIVERY_POLL = Duration.millis(25);\n\n/**\n * Why a delivery did not succeed, which is the whole of the nack decision.\n *\n * `transient` is a handler that threw — a dependency briefly gone, a timeout —\n * and is worth another delivery. `poison` is a payload this process cannot\n * read, and is worth **none**: a message that cannot be deserialized never\n * becomes deserializable, so retrying it only spends the delivery budget of the\n * messages queued behind it. Conflating the two is what the adapter once did,\n * on a queue that discarded both.\n *\n * A *business* failure is neither, and never reaches here: that message was\n * handled successfully and produced its own `failed` event.\n */\ninterface DeliveryFailure {\n  readonly kind: 'transient' | 'poison';\n  /** The failure's code and category, carried onto a quarantined message. */\n  readonly code: string;\n  readonly category: string;\n}\n\n/**\n * The poison rule, by category and never by class\n * ([ADR 0013](../../../../../docs/adr/0013-failures-are-typed-values-decided-at-the-shell.md)):\n * an answer redelivered is the same answer, so every business failure is\n * poison, and so is `protocol` — bytes that did not decode will not decode on\n * the fifth try. The transient categories are redelivered, bounded by the\n * subscription's `maxAttempts` as the adapter counts them, and so is anything\n * uncategorised: not knowing what went wrong is not evidence that retrying is\n * pointless.\n */\nconst classify = (error: unknown): DeliveryFailure =>\n  isFailure(error)\n    ? {\n        kind:\n          error.family === 'business' || error.category === 'protocol'\n            ? 'poison'\n            : 'transient',\n        code: error.code,\n        category: error.category,\n      }\n    : { kind: 'transient', code: 'internal', category: 'internal' };\n\n/** A payload that is not JSON: the sender's fault, decided before any handler. */\nconst UNREADABLE: DeliveryFailure = {\n  kind: 'poison',\n  code: 'invalidEnvelope',\n  category: 'invalid',\n};\n\n/**\n * The queue a subscription binds.\n *\n * `<subscribing slice>.<pattern>`, so the name says who is owed the messages in\n * it — readable in the broker's own UI, which is where someone looks when a\n * queue has depth. The slice is the *subscriber's*, never the publisher's:\n * `EventSourceTag` names the emitter, and one deployment hosts several slices\n * (a host may co-deploy two slices in one process), so\n * deriving from it would file a consumer's queue under whoever happened to\n * publish from the same process.\n *\n * `*` and `#` are spelled out because AMQP 0-9-1 restricts a queue name to\n * letters, digits, hyphen, underscore, period and colon. RabbitMQ is lenient in\n * practice, but the name also has to survive being a URL path segment in the\n * management API, and `%2A` in an operator's address bar is a poor trade for\n * three saved characters.\n */\nexport const queueNameFor = (subscription: Subscription): string =>\n  `${subscription.slice}.${subscription.pattern\n    .replaceAll('*', '_star_')\n    .replaceAll('#', '_hash_')}`;\n\n/**\n * Declares the queue a subscription consumes and returns its name.\n *\n * A **work** queue is durable and quorum-backed, so it survives the consumer's\n * restart and accumulates while it is gone — the hop the outbox relay's\n * durability chain was missing. Its retry ceiling is the subscription's\n * `maxAttempts`, counted by the adapter in {@link ATTEMPTS_HEADER} because the\n * broker does not count a requeued nack (#130). The same number is the queue's\n * `x-delivery-limit`, which bounds what the broker *does* count — a redelivery\n * after a consumer crash.\n *\n * The quarantine is declared **first**: a message dead-lettered the instant the\n * work queue exists must have somewhere to land, and a `direct` exchange with\n * no matching binding drops what it routes.\n *\n * `x-delivery-limit` is immutable once a queue exists. Re-declaring with a\n * different `maxAttempts` fails `PRECONDITION_FAILED` and closes the channel,\n * and there is no safe automatic recovery — so changing the ceiling means\n * deleting the queue, which locally is `pnpm run <app>:dev:reset`.\n */\nconst declareQueue = async (\n  channel: Channel,\n  subscription: Subscription,\n): Promise<string> => {\n  if (subscription.mode === 'broadcast') {\n    // Connection-scoped and retained by nobody, which is right only when the\n    // replicas differ from one another, as a per-connection push does.\n    const { queue } = await channel.assertQueue('', { exclusive: true });\n    return queue;\n  }\n\n  const queue = queueNameFor(subscription);\n  const quarantine = `${queue}${QUARANTINE_SUFFIX}`;\n\n  await channel.assertQueue(quarantine, {\n    durable: true,\n    arguments: { 'x-queue-type': 'quorum' },\n  });\n  await channel.bindQueue(quarantine, EVENTS_DLX, queue);\n  await channel.assertQueue(queue, {\n    durable: true,\n    arguments: {\n      'x-queue-type': 'quorum',\n      'x-delivery-limit': subscription.maxAttempts,\n      'x-dead-letter-exchange': EVENTS_DLX,\n      'x-dead-letter-routing-key': queue,\n    },\n  });\n\n  return queue;\n};\n\n/**\n * The adapter's own count of the attempts a message has failed, carried on the\n * copy it republishes (#130).\n *\n * The broker cannot be trusted with it. RabbitMQ 4 does not count a requeued\n * `basic.nack` toward a quorum queue's `x-delivery-limit` — measured on 4.3.5:\n * a queue limited to 2 delivered one message 8 times and never set\n * `x-delivery-count` — so a transient failure that never cleared was\n * redelivered without a ceiling and without a pause. `x-delivery-limit` stays\n * on the queue, where it still bounds the redeliveries a crashed consumer\n * causes, which the broker does count.\n */\nexport const ATTEMPTS_HEADER = 'x-entifix-attempts';\n\nconst attemptsSoFar = (message: ConsumeMessage): number => {\n  const value: unknown = message.properties?.headers?.[ATTEMPTS_HEADER];\n  return typeof value === 'number' && Number.isInteger(value) && value > 0\n    ? value\n    : 0;\n};\n\n/** How long a transient failure waits before its copy goes back on the queue. */\nexport type RedeliveryBackoff = (attempt: number) => Duration.Duration;\n\n/**\n * Doubling from 100 ms, capped at two seconds. The wait holds the delivery —\n * the queue is `prefetch(1)`, so it pauses this consumer — which is the point:\n * a dependency that is down is not helped by asking it again at once.\n */\nexport const DEFAULT_REDELIVERY_BACKOFF: RedeliveryBackoff = attempt =>\n  Duration.millis(Math.min(100 * 2 ** (attempt - 1), 2_000));\n\n/**\n * Settles a delivery that failed.\n *\n * Poison on a `work` queue — and a transient failure that has spent the\n * subscription's `maxAttempts` — is republished to the dead-letter exchange\n * **with its reason**: `x-failure-code`, `x-failure-category` and the attempts\n * spent. It is then acked rather than nacked, because a nack cannot carry\n * headers, and a quarantine of messages nobody can say anything about is a\n * queue an operator has to replay blind. If that publish is refused the nack\n * still quarantines it, reasonless.\n *\n * A transient failure under the ceiling waits its backoff, goes back on its own\n * queue as a copy carrying the attempt count, and the original is acked. If\n * that publish is refused it is nacked for the broker to redeliver, which is\n * the old behaviour and still better than losing it. A `broadcast` queue has no\n * quarantine and no ceiling, so its failures are dropped.\n */\nconst settleFailure = (\n  channel: Channel,\n  message: ConsumeMessage,\n  queue: string,\n  subscription: Subscription,\n  failure: DeliveryFailure,\n  backoff: RedeliveryBackoff,\n): Effect.Effect<void> => {\n  if (subscription.mode === 'broadcast') {\n    return Effect.sync(() => channel.nack(message, false, false));\n  }\n  const attempts =\n    failure.kind === 'transient' ? attemptsSoFar(message) + 1 : 0;\n  if (failure.kind === 'poison' || attempts >= subscription.maxAttempts) {\n    return Effect.sync(() =>\n      quarantine(channel, message, queue, failure, attempts),\n    );\n  }\n  const wait = backoff(attempts);\n  return (Duration.isZero(wait) ? Effect.void : Effect.sleep(wait)).pipe(\n    Effect.andThen(\n      Effect.sync(() => {\n        try {\n          channel.publish('', queue, message.content, {\n            ...message.properties,\n            persistent: true,\n            headers: {\n              ...message.properties?.headers,\n              [ATTEMPTS_HEADER]: attempts,\n            },\n          });\n          channel.ack(message);\n        } catch {\n          channel.nack(message, false, true);\n        }\n      }),\n    ),\n  );\n};\n\nconst quarantine = (\n  channel: Channel,\n  message: ConsumeMessage,\n  queue: string,\n  failure: DeliveryFailure,\n  attempts: number,\n): void => {\n  try {\n    channel.publish(EVENTS_DLX, queue, message.content, {\n      ...message.properties,\n      persistent: true,\n      headers: {\n        ...message.properties?.headers,\n        'x-failure-code': failure.code,\n        'x-failure-category': failure.category,\n        ...(attempts > 0 ? { [ATTEMPTS_HEADER]: attempts } : {}),\n      },\n    });\n    channel.ack(message);\n  } catch {\n    // Quarantined without its reason beats not quarantined.\n    channel.nack(message, false, false);\n  }\n};\n\n/**\n * RabbitMQ-backed {@link EventBus}. Events go out as `event` envelopes on the\n * shared topic exchange — the adapter owns the wire framing, so the port stays\n * event-typed.\n *\n * **The event's own name is the routing key**, which is what lets a subscriber\n * bind the exact pattern it declared in `tools/slices/*.slice.ts`.\n *\n * The queue a subscriber binds is its own choice of shape. A `work`\n * subscription gets a named durable queue that replicas share and that keeps\n * accumulating while the consumer is down; a `broadcast` one gets an exclusive\n * queue, where every replica sees every event and nothing\n * survives a restart. Choosing broadcast for a workload that is work is how an\n * event published during a rollout is dropped by the broker while the outbox\n * has already recorded it sent.\n *\n * Both methods go through the {@link AmqpConnector} rather than holding a\n * channel, because a channel does not survive the broker restarting. `publish`\n * asks for a live one per call, and `subscribe` registers its setup so the\n * connector can re-run it against the new channel after a reconnect. A durable\n * queue outlives that reconnect; the consumer bound to it does not.\n *\n * It returns the bus **and** its `drainDeliveries`, rather than only the port:\n * waiting for in-flight handlers is an adapter fact — it is this module that\n * runs them — and putting it on `EventBus` would make every implementation of\n * a framework-free port carry a shutdown concern it has no deliveries to drain.\n */\nexport const makeAmqpEventBus = (\n  connector: AmqpConnector,\n  wiring: WiringRegistry,\n  options: { readonly redeliveryBackoff?: RedeliveryBackoff } = {},\n): { bus: EventBus; drainDeliveries: Effect.Effect<void> } => {\n  const backoff = options.redeliveryBackoff ?? DEFAULT_REDELIVERY_BACKOFF;\n  /**\n   * Handlers started and not yet settled.\n   *\n   * Nothing tracked them before, so a SIGTERM killed them mid-flight and the\n   * broker redelivered whatever was unacked — safe only while every consumer\n   * happens to be idempotent, which is the assumption the command inbox stops\n   * making.\n   */\n  let inFlight = 0;\n\n  const bus: EventBus = {\n    publish: event =>\n      Effect.tryPromise({\n        try: () =>\n          connector.withChannel(async channel => {\n            channel.publish(\n              EVENTS_EXCHANGE,\n              event.name,\n              Buffer.from(JSON.stringify(makeEventEnvelope(event))),\n              { persistent: true },\n            );\n          }),\n        catch: error => new Unavailable({ dependency: 'amqp' }),\n        // Recorded **after** the publish succeeds, so `GET /api/$service` reports\n        // what this process actually put on the exchange. Recording the intent\n        // instead would make the declared-vs-observed diff pass on a service whose\n        // every publish is failing.\n      }).pipe(\n        Effect.tap(() =>\n          wiring\n            .recordPublish(event.name)\n            .pipe(Effect.andThen(recordPublished(event.name))),\n        ),\n        // Counted here and not in the `catch` above, which only builds the\n        // error: a rising publish-failure rate against a flat published rate\n        // is what a broker outage looks like from the publisher's side, and\n        // the outbox's own backlog is the confirmation.\n        Effect.tapError(() => recordPublishFailure(event.name)),\n      ),\n\n    subscribe: (subscription, handler) =>\n      Effect.tryPromise({\n        try: () =>\n          connector.addConsumer(async channel => {\n            // One unacked message at a time: events for a transaction are then\n            // folded serially (never concurrently), so an `accepted`/`completed`\n            // pair can't race into two upserts.\n            await channel.prefetch(1);\n            const queue = await declareQueue(channel, subscription);\n            await channel.bindQueue(\n              queue,\n              EVENTS_EXCHANGE,\n              subscription.pattern,\n            );\n            // What the process **bound**, recorded at the point it bound it. The\n            // registry deduplicates, so re-running this setup after a reconnect\n            // does not double the entry.\n            await Effect.runPromise(\n              wiring.recordSubscription({\n                slice: subscription.slice,\n                pattern: subscription.pattern,\n                mode: subscription.mode,\n                queue,\n              }),\n            );\n            // Resolved once per binding rather than per delivery: `queue` is the\n            // durable name for a `work` subscription and the broker's generated\n            // one for a `broadcast` queue, so it is only knowable here.\n            const tags: SubscriptionTags = {\n              queue,\n              slice: subscription.slice,\n              mode: subscription.mode,\n            };\n            const { consumerTag } = await channel.consume(\n              queue,\n              (message: ConsumeMessage | null) => {\n                if (message === null) {\n                  return;\n                }\n\n                // Reading the payload and running the handler are separated on\n                // purpose: they fail for different reasons and earn different\n                // treatment. `JSON.parse` is inside the Effect because it throws\n                // *synchronously* — outside, it escaped into amqplib's callback and\n                // the message was never even nacked.\n                const settle = Effect.try({\n                  try: () => JSON.parse(message.content.toString()) as unknown,\n                  catch: (): DeliveryFailure => UNREADABLE,\n                }).pipe(\n                  Effect.flatMap(parsed =>\n                    readEventEnvelope(parsed).pipe(Effect.mapError(classify)),\n                  ),\n                  // The handler carries no requirements (the subscriber closes over\n                  // its store), so it runs standalone.\n                  //\n                  // ⚠️ A handler's failure is classified by its category, not\n                  // treated as transient across the board. The transport\n                  // validates `meta` and deliberately not `data` (inventing an\n                  // opinion about a payload is how the bus would start knowing\n                  // about domains), so a consumer that decodes its own payload\n                  // is the *only* thing that can tell a malformed one from a bad\n                  // afternoon at the database — and it says so by failing with\n                  // a business or `protocol` failure, which quarantines at once\n                  // instead of spending `maxAttempts` on every message\n                  // behind it. Measured on `catalog.published`: a payload the\n                  // contract rejected used to take five deliveries to quarantine.\n                  Effect.flatMap(event =>\n                    handler(event).pipe(Effect.mapError(classify)),\n                  ),\n                );\n\n                // Counted around the whole settle, so a shutdown waits for the ack\n                // as well as the handler: cancelling a consumer stops *new*\n                // deliveries and says nothing about this one.\n                inFlight += 1;\n                void Effect.runPromise(\n                  settle.pipe(\n                    // Effect's metric registry is a process-wide singleton, so an\n                    // increment inside this detached `runPromise` reaches the same\n                    // producer `NodeSdk` exports from. That is the only reason a\n                    // metric works here at all — nothing about this fiber is\n                    // inside the observability layer.\n                    Effect.matchEffect({\n                      onSuccess: () =>\n                        recordConsumed(tags).pipe(\n                          Effect.andThen(\n                            Effect.sync(() => channel.ack(message)),\n                          ),\n                        ),\n                      onFailure: failure =>\n                        recordFailed(tags, failure.kind).pipe(\n                          Effect.andThen(\n                            settleFailure(\n                              channel,\n                              message,\n                              queue,\n                              subscription,\n                              failure,\n                              backoff,\n                            ),\n                          ),\n                        ),\n                    }),\n                  ),\n                ).finally(() => {\n                  inFlight -= 1;\n                });\n              },\n            );\n            return [consumerTag];\n          }),\n        catch: error => new Unavailable({ dependency: 'amqp' }),\n      }),\n  };\n\n  return {\n    bus,\n    drainDeliveries: Effect.gen(function* () {\n      while (inFlight > 0) {\n        yield* Effect.sleep(DELIVERY_POLL);\n      }\n    }),\n  };\n};\n\n/**\n * Provides {@link EventBusTag} from an {@link AmqpChannelTag}.\n *\n * It also takes {@link WiringRegistryTag}, which `makeServerLayer` provides once\n * per service — so the bus and `GET /api/$service` share one instance, and the\n * document reports the bindings this very process made.\n */\nexport const AmqpEventBusLayer = Layer.effect(\n  EventBusTag,\n  Effect.gen(function* () {\n    const connector = yield* AmqpChannelTag;\n    const wiring = yield* WiringRegistryTag;\n    const shutdown = yield* ShutdownRegistryTag;\n    const { bus, drainDeliveries } = makeAmqpEventBus(connector, wiring);\n\n    // `stop-intake`, and both halves are it: cancelling stops the broker\n    // handing over anything new, then the drain waits for the deliveries\n    // already in progress. Registered here rather than in a service's `main.ts`\n    // for the reason every registry in this repo exists — a service that gains\n    // a bus gains its drain, with nothing to remember.\n    yield* shutdown.register({\n      name: 'amqp-consumers',\n      phase: 'stop-intake',\n      run: Effect.promise(() => connector.cancelConsumers()).pipe(\n        Effect.andThen(drainDeliveries),\n      ),\n    });\n\n    return bus;\n  }),\n);\n"],"names":["ShutdownRegistryTag","WiringRegistryTag","isFailure","makeEventEnvelope","readEventEnvelope","Unavailable","EventBusTag","Duration","Effect","Layer","AmqpChannelTag","EVENTS_DLX","EVENTS_EXCHANGE","recordConsumed","recordFailed","recordPublished","recordPublishFailure","QUARANTINE_SUFFIX","DELIVERY_POLL","millis","classify","error","kind","family","category","code","UNREADABLE","queueNameFor","subscription","slice","pattern","replaceAll","declareQueue","channel","mode","queue","assertQueue","exclusive","quarantine","durable","arguments","bindQueue","maxAttempts","ATTEMPTS_HEADER","attemptsSoFar","message","value","properties","headers","Number","isInteger","DEFAULT_REDELIVERY_BACKOFF","attempt","Math","min","settleFailure","failure","backoff","sync","nack","attempts","wait","isZero","void","sleep","pipe","andThen","publish","content","persistent","ack","makeAmqpEventBus","connector","wiring","options","redeliveryBackoff","inFlight","bus","event","tryPromise","try","withChannel","name","Buffer","from","JSON","stringify","catch","dependency","tap","recordPublish","tapError","subscribe","handler","addConsumer","prefetch","runPromise","recordSubscription","tags","consumerTag","consume","settle","parse","toString","flatMap","parsed","mapError","matchEffect","onSuccess","onFailure","finally","drainDeliveries","gen","AmqpEventBusLayer","effect","shutdown","register","phase","run","promise","cancelConsumers"],"mappings":";AACA,SAASA,mBAAmB,EAAEC,iBAAiB,QAAQ,oBAAoB;AAC3E,SACEC,SAAS,EACTC,iBAAiB,EACjBC,iBAAiB,EACjBC,WAAW,QACN,gBAAgB;AACvB,SAEEC,WAAW,QAEN,wBAAwB;AAE/B,SAASC,QAAQ,EAAEC,MAAM,EAAEC,KAAK,QAAQ,SAAS;AAEjD,SACEC,cAAc,EAEdC,UAAU,EACVC,eAAe,QACV,wCAAwC;AAC/C,SACEC,cAAc,EACdC,YAAY,EACZC,eAAe,EACfC,oBAAoB,QAEf,mBAAmB;AAE1B,+EAA+E,GAC/E,MAAMC,oBAAoB;AAE1B;;;;;;;CAOC,GACD,MAAMC,gBAAgBX,SAASY,MAAM,CAAC;AAsBtC;;;;;;;;;CASC,GACD,MAAMC,WAAW,CAACC,QAChBnB,UAAUmB,SACN;QACEC,MACED,MAAME,MAAM,KAAK,cAAcF,MAAMG,QAAQ,KAAK,aAC9C,WACA;QACNC,MAAMJ,MAAMI,IAAI;QAChBD,UAAUH,MAAMG,QAAQ;IAC1B,IACA;QAAEF,MAAM;QAAaG,MAAM;QAAYD,UAAU;IAAW;AAElE,gFAAgF,GAChF,MAAME,aAA8B;IAClCJ,MAAM;IACNG,MAAM;IACND,UAAU;AACZ;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMG,eAAe,CAACC,eAC3B,GAAGA,aAAaC,KAAK,CAAC,CAAC,EAAED,aAAaE,OAAO,CAC1CC,UAAU,CAAC,KAAK,UAChBA,UAAU,CAAC,KAAK,WAAW,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;CAmBC,GACD,MAAMC,eAAe,OACnBC,SACAL;IAEA,IAAIA,aAAaM,IAAI,KAAK,aAAa;QACrC,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,EAAEC,KAAK,EAAE,GAAG,MAAMF,QAAQG,WAAW,CAAC,IAAI;YAAEC,WAAW;QAAK;QAClE,OAAOF;IACT;IAEA,MAAMA,QAAQR,aAAaC;IAC3B,MAAMU,aAAa,GAAGH,QAAQlB,mBAAmB;IAEjD,MAAMgB,QAAQG,WAAW,CAACE,YAAY;QACpCC,SAAS;QACTC,WAAW;YAAE,gBAAgB;QAAS;IACxC;IACA,MAAMP,QAAQQ,SAAS,CAACH,YAAY3B,YAAYwB;IAChD,MAAMF,QAAQG,WAAW,CAACD,OAAO;QAC/BI,SAAS;QACTC,WAAW;YACT,gBAAgB;YAChB,oBAAoBZ,aAAac,WAAW;YAC5C,0BAA0B/B;YAC1B,6BAA6BwB;QAC/B;IACF;IAEA,OAAOA;AACT;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,MAAMQ,kBAAkB,qBAAqB;AAEpD,MAAMC,gBAAgB,CAACC;QACEA,6BAAAA;IAAvB,MAAMC,SAAiBD,sBAAAA,QAAQE,UAAU,sBAAlBF,8BAAAA,oBAAoBG,OAAO,qBAA3BH,2BAA6B,CAACF,gBAAgB;IACrE,OAAO,OAAOG,UAAU,YAAYG,OAAOC,SAAS,CAACJ,UAAUA,QAAQ,IACnEA,QACA;AACN;AAKA;;;;CAIC,GACD,OAAO,MAAMK,6BAAgDC,CAAAA,UAC3D7C,SAASY,MAAM,CAACkC,KAAKC,GAAG,CAAC,MAAM,KAAMF,CAAAA,UAAU,CAAA,GAAI,OAAQ;AAE7D;;;;;;;;;;;;;;;;CAgBC,GACD,MAAMG,gBAAgB,CACpBtB,SACAY,SACAV,OACAP,cACA4B,SACAC;IAEA,IAAI7B,aAAaM,IAAI,KAAK,aAAa;QACrC,OAAO1B,OAAOkD,IAAI,CAAC,IAAMzB,QAAQ0B,IAAI,CAACd,SAAS,OAAO;IACxD;IACA,MAAMe,WACJJ,QAAQlC,IAAI,KAAK,cAAcsB,cAAcC,WAAW,IAAI;IAC9D,IAAIW,QAAQlC,IAAI,KAAK,YAAYsC,YAAYhC,aAAac,WAAW,EAAE;QACrE,OAAOlC,OAAOkD,IAAI,CAAC,IACjBpB,WAAWL,SAASY,SAASV,OAAOqB,SAASI;IAEjD;IACA,MAAMC,OAAOJ,QAAQG;IACrB,OAAO,AAACrD,CAAAA,SAASuD,MAAM,CAACD,QAAQrD,OAAOuD,IAAI,GAAGvD,OAAOwD,KAAK,CAACH,KAAI,EAAGI,IAAI,CACpEzD,OAAO0D,OAAO,CACZ1D,OAAOkD,IAAI,CAAC;QACV,IAAI;gBAKKb;YAJPZ,QAAQkC,OAAO,CAAC,IAAIhC,OAAOU,QAAQuB,OAAO,EAAE,aACvCvB,QAAQE,UAAU;gBACrBsB,YAAY;gBACZrB,SAAS,cACJH,sBAAAA,QAAQE,UAAU,qBAAlBF,oBAAoBG,OAAO;oBAC9B,CAACL,gBAAgB,EAAEiB;;;YAGvB3B,QAAQqC,GAAG,CAACzB;QACd,EAAE,eAAM;YACNZ,QAAQ0B,IAAI,CAACd,SAAS,OAAO;QAC/B;IACF;AAGN;AAEA,MAAMP,aAAa,CACjBL,SACAY,SACAV,OACAqB,SACAI;IAEA,IAAI;YAKKf;QAJPZ,QAAQkC,OAAO,CAACxD,YAAYwB,OAAOU,QAAQuB,OAAO,EAAE,aAC/CvB,QAAQE,UAAU;YACrBsB,YAAY;YACZrB,SAAS,cACJH,sBAAAA,QAAQE,UAAU,qBAAlBF,oBAAoBG,OAAO;gBAC9B,kBAAkBQ,QAAQ/B,IAAI;gBAC9B,sBAAsB+B,QAAQhC,QAAQ;eAClCoC,WAAW,IAAI;gBAAE,CAACjB,gBAAgB,EAAEiB;YAAS,IAAI,CAAC;;QAG1D3B,QAAQqC,GAAG,CAACzB;IACd,EAAE,eAAM;QACN,wDAAwD;QACxDZ,QAAQ0B,IAAI,CAACd,SAAS,OAAO;IAC/B;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,MAAM0B,mBAAmB,CAC9BC,WACAC,QACAC,UAA8D,CAAC,CAAC;QAEhDA;IAAhB,MAAMjB,WAAUiB,6BAAAA,QAAQC,iBAAiB,YAAzBD,6BAA6BvB;IAC7C;;;;;;;GAOC,GACD,IAAIyB,WAAW;IAEf,MAAMC,MAAgB;QACpBV,SAASW,CAAAA,QACPtE,OAAOuE,UAAU,CAAC;gBAChBC,KAAK,IACHR,UAAUS,WAAW,CAAC,OAAMhD;wBAC1BA,QAAQkC,OAAO,CACbvD,iBACAkE,MAAMI,IAAI,EACVC,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACnF,kBAAkB2E,UAC7C;4BAAET,YAAY;wBAAK;oBAEvB;gBACFkB,OAAOlE,CAAAA,QAAS,IAAIhB,YAAY;wBAAEmF,YAAY;oBAAO;YAKvD,GAAGvB,IAAI,CACLzD,OAAOiF,GAAG,CAAC,IACThB,OACGiB,aAAa,CAACZ,MAAMI,IAAI,EACxBjB,IAAI,CAACzD,OAAO0D,OAAO,CAACnD,gBAAgB+D,MAAMI,IAAI,MAEnD,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,gDAAgD;YAChD1E,OAAOmF,QAAQ,CAAC,IAAM3E,qBAAqB8D,MAAMI,IAAI;QAGzDU,WAAW,CAAChE,cAAciE,UACxBrF,OAAOuE,UAAU,CAAC;gBAChBC,KAAK,IACHR,UAAUsB,WAAW,CAAC,OAAM7D;wBAC1B,mEAAmE;wBACnE,qEAAqE;wBACrE,oCAAoC;wBACpC,MAAMA,QAAQ8D,QAAQ,CAAC;wBACvB,MAAM5D,QAAQ,MAAMH,aAAaC,SAASL;wBAC1C,MAAMK,QAAQQ,SAAS,CACrBN,OACAvB,iBACAgB,aAAaE,OAAO;wBAEtB,qEAAqE;wBACrE,oEAAoE;wBACpE,6BAA6B;wBAC7B,MAAMtB,OAAOwF,UAAU,CACrBvB,OAAOwB,kBAAkB,CAAC;4BACxBpE,OAAOD,aAAaC,KAAK;4BACzBC,SAASF,aAAaE,OAAO;4BAC7BI,MAAMN,aAAaM,IAAI;4BACvBC;wBACF;wBAEF,qEAAqE;wBACrE,oEAAoE;wBACpE,4DAA4D;wBAC5D,MAAM+D,OAAyB;4BAC7B/D;4BACAN,OAAOD,aAAaC,KAAK;4BACzBK,MAAMN,aAAaM,IAAI;wBACzB;wBACA,MAAM,EAAEiE,WAAW,EAAE,GAAG,MAAMlE,QAAQmE,OAAO,CAC3CjE,OACA,CAACU;4BACC,IAAIA,YAAY,MAAM;gCACpB;4BACF;4BAEA,+DAA+D;4BAC/D,8DAA8D;4BAC9D,iEAAiE;4BACjE,oEAAoE;4BACpE,qCAAqC;4BACrC,MAAMwD,SAAS7F,OAAOwE,GAAG,CAAC;gCACxBA,KAAK,IAAMK,KAAKiB,KAAK,CAACzD,QAAQuB,OAAO,CAACmC,QAAQ;gCAC9ChB,OAAO,IAAuB7D;4BAChC,GAAGuC,IAAI,CACLzD,OAAOgG,OAAO,CAACC,CAAAA,SACbrG,kBAAkBqG,QAAQxC,IAAI,CAACzD,OAAOkG,QAAQ,CAACtF,aAEjD,kEAAkE;4BAClE,qCAAqC;4BACrC,EAAE;4BACF,4DAA4D;4BAC5D,uDAAuD;4BACvD,6DAA6D;4BAC7D,6DAA6D;4BAC7D,6DAA6D;4BAC7D,+DAA+D;4BAC/D,6DAA6D;4BAC7D,8DAA8D;4BAC9D,qDAAqD;4BACrD,4DAA4D;4BAC5D,gEAAgE;4BAChEZ,OAAOgG,OAAO,CAAC1B,CAAAA,QACbe,QAAQf,OAAOb,IAAI,CAACzD,OAAOkG,QAAQ,CAACtF;4BAIxC,mEAAmE;4BACnE,4DAA4D;4BAC5D,8CAA8C;4BAC9CwD,YAAY;4BACZ,KAAKpE,OAAOwF,UAAU,CACpBK,OAAOpC,IAAI,CACT,8DAA8D;4BAC9D,+DAA+D;4BAC/D,6DAA6D;4BAC7D,yDAAyD;4BACzD,kCAAkC;4BAClCzD,OAAOmG,WAAW,CAAC;gCACjBC,WAAW,IACT/F,eAAeqF,MAAMjC,IAAI,CACvBzD,OAAO0D,OAAO,CACZ1D,OAAOkD,IAAI,CAAC,IAAMzB,QAAQqC,GAAG,CAACzB;gCAGpCgE,WAAWrD,CAAAA,UACT1C,aAAaoF,MAAM1C,QAAQlC,IAAI,EAAE2C,IAAI,CACnCzD,OAAO0D,OAAO,CACZX,cACEtB,SACAY,SACAV,OACAP,cACA4B,SACAC;4BAIV,KAEFqD,OAAO,CAAC;gCACRlC,YAAY;4BACd;wBACF;wBAEF,OAAO;4BAACuB;yBAAY;oBACtB;gBACFZ,OAAOlE,CAAAA,QAAS,IAAIhB,YAAY;wBAAEmF,YAAY;oBAAO;YACvD;IACJ;IAEA,OAAO;QACLX;QACAkC,iBAAiBvG,OAAOwG,GAAG,CAAC;YAC1B,MAAOpC,WAAW,EAAG;gBACnB,OAAOpE,OAAOwD,KAAK,CAAC9C;YACtB;QACF;IACF;AACF,EAAE;AAEF;;;;;;CAMC,GACD,OAAO,MAAM+F,oBAAoBxG,MAAMyG,MAAM,CAC3C5G,aACAE,OAAOwG,GAAG,CAAC;IACT,MAAMxC,YAAY,OAAO9D;IACzB,MAAM+D,SAAS,OAAOxE;IACtB,MAAMkH,WAAW,OAAOnH;IACxB,MAAM,EAAE6E,GAAG,EAAEkC,eAAe,EAAE,GAAGxC,iBAAiBC,WAAWC;IAE7D,qEAAqE;IACrE,qEAAqE;IACrE,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,OAAO0C,SAASC,QAAQ,CAAC;QACvBlC,MAAM;QACNmC,OAAO;QACPC,KAAK9G,OAAO+G,OAAO,CAAC,IAAM/C,UAAUgD,eAAe,IAAIvD,IAAI,CACzDzD,OAAO0D,OAAO,CAAC6C;IAEnB;IAEA,OAAOlC;AACT,IACA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entifix/amqp",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "RabbitMQ connection and health probe, and an optional event bus for @entifix/transactions with retry and quarantine.",
   "license": "MIT",
   "repository": {
@@ -57,18 +57,18 @@
   "dependencies": {
     "@swc/helpers": "0.5.23",
     "amqplib": "2.2.0",
-    "@entifix/business": "0.10.0",
-    "@entifix/core": "0.10.0"
+    "@entifix/business": "0.10.1",
+    "@entifix/core": "0.10.1"
   },
   "devDependencies": {
     "@types/amqplib": "0.10.8",
     "effect": "4.0.6",
-    "@entifix/transactions": "0.10.0",
-    "@entifix/testing-unit": "0.10.0"
+    "@entifix/testing-unit": "0.10.1",
+    "@entifix/transactions": "0.10.1"
   },
   "peerDependencies": {
     "effect": "^4.0.6",
-    "@entifix/transactions": "0.10.0"
+    "@entifix/transactions": "0.10.1"
   },
   "peerDependenciesMeta": {
     "@entifix/transactions": {