@moltzap/client 2026.922.2 → 2026.930.0

package/dist/endpoint/collective/operation.js

@@ -0,0 +1,784 @@
+/**
+ * @file Collective operations over the post envelope.
+ *
+ * The daemon holds one `CollectiveOperations` per active identity. It turns
+ * each send into the posts its operation certifies and each certified remote
+ * post into the item the subscriber receives, or consumes it. Every post an
+ * endpoint authors carries its operation as an explicit collective part, so
+ * each certified post says which operation it belongs to; a post without a
+ * collective part reads as multicast, the operation an omitted `op` names.
+ *
+ * Collective state lives in daemon memory: an operation open at a daemon
+ * restart is lost, and a request whose delivery the member already
+ * acknowledged can no longer be answered after one.
+ *
+ * ```mermaid
+ * sequenceDiagram
+ *   participant RM as Requester host
+ *   participant RE as Requester endpoint
+ *   participant ME as Member endpoint
+ *   participant MM as Member host
+ *   RM->>RE: send gather to, question, deadline, schema
+ *   RE->>RE: validate schema, mint id<br>deadline = now + duration
+ *   RE->>ME: one request post per member
+ *   alt a request post is refused
+ *     RE-->>RM: error naming each unreachable member
+ *   else every request post accepted
+ *     RE-->>RM: operation id
+ *   end
+ *   ME->>MM: collectiveRequest item
+ *   MM->>ME: send collectiveResponse id, action, content
+ *   ME->>ME: validate content against the stored schema
+ *   ME->>RE: response post in the direct conversation
+ *   RE->>RE: consume, validate and record the answer
+ *   Note over RE: complete when every member has an outcome<br>or at the deadline
+ *   RE->>RM: collectiveResult item
+ * ```
+ *
+ * An all_gather asks a group in its own conversation. Every member endpoint
+ * consumes the answers it sees there, so no model sees a peer's answer before
+ * the close, and builds its result from exactly the answers the requester's
+ * close lists.
+ *
+ * ```mermaid
+ * sequenceDiagram
+ *   participant RM as Requester host
+ *   participant RE as Requester endpoint
+ *   participant ME as Member endpoints
+ *   participant MM as Member hosts
+ *   RM->>RE: send all_gather to group, question, deadline, schema
+ *   RE->>ME: one request post to the group
+ *   alt the group post is refused or not certified in time
+ *     RE-->>RM: error naming each unreachable member
+ *   else request post certified
+ *     RE-->>RM: operation id
+ *   end
+ *   ME->>MM: collectiveRequest item
+ *   MM->>ME: send collectiveResponse id, action, content
+ *   ME->>ME: validate content against the stored schema
+ *   ME->>RE: response post to the group
+ *   ME->>ME: peer response posts, consumed and recorded by record hash
+ *   Note over RE: complete when every member has an outcome<br>or at the deadline
+ *   RE->>ME: close post listing the counted answers' record hashes
+ *   RE->>RM: collectiveResult item once the close is certified
+ *   ME->>ME: build the result from exactly the listed answers
+ *   ME->>MM: collectiveResult item, the same outcomes
+ * ```
+ */
+import { Clock, Duration, Effect, Array as EffectArray, Either, Exit, Fiber, Option, ParseResult, Schema, } from "effect";
+import { randomBytes } from "node:crypto";
+import { AgentAddress, CollectiveError, MAXIMUM_DEADLINE_SECONDS, RequestedSchema, SendError, } from "../../contract.js";
+import { canonicalMessageAddress } from "../addressing/index.js";
+import { keepFirstAnswer, listedAnswers, memberOutcomes, } from "./shared-answers.js";
+import { outcomeOfResponse, validateAnswer } from "./validation.js";
+import { collectiveIdOf, encodeCollectiveContent, FormModeSchema, readCollectiveValue, withoutCollectivePart, } from "./wire.js";
+/**
+ * How long a collecting operation's send waits for its request posts before
+ * returning. A gather's request still uncertified then is left running: its
+ * member answers or is reported as no-answer at the deadline. An all_gather's
+ * one group post must be certified by then, or the all_gather cannot start:
+ * a cold group's GENESIS needs every member. The bound stays under the MCP
+ * SDK's request timeout so a waiting host receives the result rather than a
+ * transport timeout.
+ */
+const REQUEST_SEND_WAIT = Duration.seconds(20);
+/**
+ * How many Registry lookups a refused all_gather runs at once to name its
+ * unreachable members; they are independent, and a group has at most 32.
+ */
+const MEMBER_LOOKUP_CONCURRENCY = 8;
+/**
+ * How long past its deadline a member keeps an all_gather request while it
+ * waits for the requester's close. The requester closes at the deadline at
+ * the latest, so the close normally follows within seconds; the bound frees
+ * the request of a requester that never closes.
+ */
+const CLOSE_WAIT = Duration.hours(1);
+/**
+ * The longest single sleep a deadline timer takes. A JavaScript timer longer
+ * than about 24.8 days never fires, so a longer deadline is reached in steps.
+ */
+const DEADLINE_TIMER_STEP = Duration.days(1);
+/**
+ * How far past the longest deadline a sender may state a received request's
+ * deadline still lies. It absorbs clock skew between the two endpoints; a
+ * request further out is consumed, which bounds how long its state is held
+ * and keeps every stored deadline a representable date.
+ */
+const RECEIVED_DEADLINE_ALLOWANCE = Duration.hours(1);
+/** The furthest past `now` a received request's deadline may lie. */
+const RECEIVED_DEADLINE_HORIZON = Duration.toMillis(Duration.sum(Duration.seconds(MAXIMUM_DEADLINE_SECONDS), RECEIVED_DEADLINE_ALLOWANCE));
+const decodeAgentAddress = Schema.decodeUnknownOption(AgentAddress);
+const decodeRequestedSchema = Schema.decodeUnknownOption(RequestedSchema);
+/** A fresh nonce and the id it binds to the requester. */
+const mintCollectiveId = (requester) => Effect.sync(() => {
+    const nonce = randomBytes(32).toString("base64url");
+    return { id: collectiveIdOf(requester, nonce), nonce };
+});
+const contentInvalid = () => new SendError({ reason: "content-invalid" });
+const collectiveFailure = (id, failure) => new CollectiveError({ id, failure });
+/**
+ * Build the collective layer for one active identity.
+ * @param ports The daemon's post sending, item queue, scope and identity.
+ * @returns Send and classification over state held in daemon memory.
+ */
+export const makeCollectiveOperations = (ports) => {
+    const state = {
+        ports,
+        gathers: new Map(),
+        requests: new Map(),
+    };
+    return {
+        send: (input, failureDelivery) => "collectiveResponse" in input
+            ? reportFailure(state, failureDelivery, respond(state, input.collectiveResponse))
+            : sendOperation(state, input, failureDelivery),
+        classify: (message) => classify(state, message),
+    };
+};
+function sendOperation(state, input, failureDelivery) {
+    const operation = input.collective ?? {};
+    switch (operation.op) {
+        case undefined:
+        case "multicast":
+            return multicast(state, input.to, input.text);
+        case "gather":
+        case "all_gather":
+            return reportFailure(state, failureDelivery, gather(state, input.to, input.text, operation));
+        default: {
+            const exhaustive = operation;
+            return exhaustive;
+        }
+    }
+}
+function multicast(state, to, text) {
+    return encodeCollectiveContent({ kind: "operation", op: "multicast" }, text).pipe(Effect.mapError(contentInvalid), Effect.flatMap((content) => state.ports.sendPost({ to, content })), Effect.map((post) => ({ postIds: [post.postId] })));
+}
+/**
+ * Deliver a refused collective send's error where the host wants it. With
+ * `inbound` the send completes, naming the operation, and the error arrives
+ * as an `operationFailed` item carrying the same text.
+ */
+function reportFailure(state, failureDelivery, send) {
+    return send.pipe(Effect.catchAll((refused) => {
+        switch (failureDelivery) {
+            case "result":
+                return Effect.fail(refused.error);
+            case "inbound":
+                return state.ports
+                    .emit({
+                    kind: "operationFailed",
+                    id: refused.id,
+                    to: refused.to,
+                    error: refused.error.message,
+                })
+                    .pipe(Effect.as({ operationId: refused.id, postIds: [] }));
+            default: {
+                const exhaustive = failureDelivery;
+                return exhaustive;
+            }
+        }
+    }));
+}
+function refusedAs(id, to) {
+    return (error) => ({ id, to, error });
+}
+/**
+ * The canonical address a collecting operation's result and failure name, by
+ * the rule every send shares, and the members it asks: the one agent of an
+ * `agent:` address, or every member of a group but the requester. An
+ * all_gather asks a group in its conversation, so an `agent:` address is
+ * refused as `membership-invalid`.
+ */
+function gatherAddress(to, self, op) {
+    const selfName = self.slice("agent:".length);
+    const membershipInvalid = new SendError({ reason: "membership-invalid" });
+    return canonicalMessageAddress(to, selfName).pipe(Effect.flatMap((canonical) => {
+        if (canonical.kind === "direct") {
+            return op === "gather"
+                ? Effect.succeed({
+                    to: canonical.address,
+                    members: [canonical.address],
+                })
+                : Effect.fail(membershipInvalid);
+        }
+        const [first, ...rest] = canonical.memberNames
+            .filter((name) => name !== selfName)
+            .flatMap((name) => Option.toArray(decodeAgentAddress(`agent:${name}`)));
+        return first === undefined
+            ? Effect.fail(membershipInvalid)
+            : Effect.succeed({ to: canonical.address, members: [first, ...rest] });
+    }));
+}
+/** Check a collecting operation's schema against the MCP form-mode grammar. */
+function formModeSchema(id, requestedSchema) {
+    return Schema.decodeUnknown(FormModeSchema)(requestedSchema).pipe(Effect.mapError((error) => collectiveFailure(id, {
+        kind: "schema-invalid",
+        detail: ParseResult.TreeFormatter.formatErrorSync(error),
+    })));
+}
+/**
+ * Validate a gather or all_gather before any post: mint its id, check its
+ * schema against the form-mode grammar, name its members, fix its absolute
+ * deadline, and build the request content within the content limit.
+ */
+function prepareGather(state, requestedTo, question, operation) {
+    return Effect.gen(function* () {
+        const { id, nonce } = yield* mintCollectiveId(state.ports.self);
+        const { to, members } = yield* gatherAddress(requestedTo, state.ports.self, operation.op).pipe(Effect.mapError(refusedAs(id, requestedTo)));
+        const refused = refusedAs(id, to);
+        const requestedSchema = yield* formModeSchema(id, operation.requestedSchema).pipe(Effect.mapError(refused));
+        const now = yield* Clock.currentTimeMillis;
+        const untilDeadline = Duration.toMillis(Duration.seconds(operation.deadline));
+        const deadlineAt = now + untilDeadline;
+        const content = yield* encodeCollectiveContent({
+            kind: "operation",
+            op: operation.op,
+            id,
+            nonce,
+            deadlineAt,
+            requestedSchema,
+        }, question).pipe(Effect.mapError(() => refused(contentInvalid())));
+        const open = {
+            op: operation.op,
+            to,
+            question,
+            members,
+            requestedSchema,
+            outcomes: new Map(),
+            answerHashes: new Map(),
+        };
+        return { id, open, content, deadlineAt, untilDeadline };
+    });
+}
+/**
+ * Start the operation's deadline timer, open it so answers can be recorded
+ * while its requests are still being sent, and send them.
+ */
+function gather(state, requestedTo, question, operation) {
+    return Effect.gen(function* () {
+        const prepared = yield* prepareGather(state, requestedTo, question, operation);
+        const timer = yield* sleepUntil(prepared.deadlineAt).pipe(Effect.zipRight(completeGather(state, prepared.id)), Effect.forkIn(state.ports.scope));
+        yield* Effect.sync(() => {
+            state.gathers.set(prepared.id, { ...prepared.open, timer });
+        });
+        const requests = prepared.open.op === "gather"
+            ? sendRequests(state, prepared)
+            : sendGroupRequest(state, prepared);
+        const postIds = yield* requests.pipe(Effect.mapError(refusedAs(prepared.id, prepared.open.to)));
+        return { operationId: prepared.id, postIds };
+    });
+}
+/** Sleep until the absolute time `at`, in steps no timer overflows. */
+function sleepUntil(at) {
+    return Clock.currentTimeMillis.pipe(Effect.flatMap((now) => now >= at
+        ? Effect.void
+        : Effect.sleep(Duration.min(Duration.millis(at - now), DEADLINE_TIMER_STEP)).pipe(Effect.zipRight(sleepUntil(at)))));
+}
+/**
+ * Send one request post per member and wait for them, never past the
+ * deadline. Any refusal abandons the gather and names every refused member;
+ * a post still pending when the wait ends is left running.
+ */
+function sendRequests(state, prepared) {
+    return Effect.gen(function* () {
+        const sends = yield* Effect.forEach(prepared.open.members, (member) => state.ports.sendPost({ to: member, content: prepared.content }).pipe(Effect.mapError((error) => ({ member, reason: error.reason })), Effect.either, Effect.forkIn(state.ports.scope)), { concurrency: 1 });
+        yield* Fiber.awaitAll(sends).pipe(Effect.timeoutOption(requestWait(state, prepared)));
+        const results = yield* settledSends(sends);
+        const [refusal, ...refusals] = results.flatMap((result) => Option.toArray(Either.getLeft(result)));
+        if (refusal !== undefined) {
+            yield* abandonGather(state, prepared.id, sends);
+            return yield* Effect.fail(collectiveFailure(prepared.id, {
+                kind: "members-unreachable",
+                members: [refusal, ...refusals],
+            }));
+        }
+        return results.flatMap((result) => Option.toArray(Either.getRight(result)).map((post) => post.postId));
+    });
+}
+/**
+ * Send an all_gather's one request post to the group and wait for it, never
+ * past the deadline. A refused post, or one still uncertified when the wait
+ * ends, abandons the all_gather: the group's GENESIS needs every member. The
+ * operation is dropped before its unreachable members are looked up, so a
+ * deadline that passes during the lookups cannot close it.
+ */
+function sendGroupRequest(state, prepared) {
+    return state.ports
+        .sendPost({ to: prepared.open.to, content: prepared.content })
+        .pipe(Effect.timeoutFail({
+        duration: requestWait(state, prepared),
+        onTimeout: () => new SendError({ reason: "certification-unavailable" }),
+    }), Effect.map((post) => [post.postId]), Effect.catchAll((error) => forgetGather(state, prepared.id).pipe(Effect.zipRight(unreachableMembers(state, prepared.open.members, error.reason)), Effect.flatMap((members) => Effect.fail(collectiveFailure(prepared.id, {
+        kind: "members-unreachable",
+        members,
+    }))))));
+}
+/**
+ * The members to name for a refused group post. A group post succeeds or
+ * fails as a whole, so each member is looked up on its own: the members whose
+ * lookup fails are named with their own reason, and when every lookup
+ * succeeds each member is named with the group post's reason.
+ */
+function unreachableMembers(state, members, groupReason) {
+    return Effect.forEach(members, (member) => state.ports.lookupMember(member).pipe(Effect.flip, Effect.map((error) => ({ member, reason: error.reason })), Effect.option), { concurrency: MEMBER_LOOKUP_CONCURRENCY }).pipe(Effect.map((lookups) => {
+        const [first, ...rest] = lookups.flatMap((lookup) => Option.toArray(lookup));
+        if (first !== undefined) {
+            return [first, ...rest];
+        }
+        const [member, ...others] = members;
+        return [
+            { member, reason: groupReason },
+            ...others.map((other) => ({ member: other, reason: groupReason })),
+        ];
+    }));
+}
+/** How long a send waits for request posts: the bound, never past the deadline. */
+function requestWait(state, prepared) {
+    return Duration.min(state.ports.requestSendWait ?? REQUEST_SEND_WAIT, Duration.millis(prepared.untilDeadline));
+}
+/** The request sends that have finished, each with its post or refusal. */
+function settledSends(sends) {
+    return Effect.forEach(sends, (send) => Fiber.poll(send), {
+        concurrency: 1,
+    }).pipe(Effect.map((polls) => polls.flatMap((poll) => Option.toArray(Option.flatMap(poll, (exit) => Exit.isSuccess(exit) ? Option.some(exit.value) : Option.none())))));
+}
+function abandonGather(state, id, sends) {
+    return Effect.forEach(sends, (send) => Fiber.interruptFork(send), {
+        concurrency: 1,
+        discard: true,
+    }).pipe(Effect.zipRight(forgetGather(state, id)));
+}
+/** Drop an operation this endpoint abandons, and stop its deadline timer. */
+function forgetGather(state, id) {
+    return Effect.suspend(() => {
+        const open = state.gathers.get(id);
+        state.gathers.delete(id);
+        return open === undefined ? Effect.void : Fiber.interrupt(open.timer);
+    });
+}
+/**
+ * Complete an operation this endpoint started. A gather emits its result
+ * now; an all_gather first posts its close, off the calling fiber because
+ * completion can run inside a publication pass that certification waits on.
+ * An operation completes once; a later call does nothing. The deadline timer
+ * calls it too, so it leaves the timer to its caller.
+ */
+function completeGather(state, id) {
+    return Effect.suspend(() => {
+        const open = state.gathers.get(id);
+        if (open === undefined) {
+            return Effect.void;
+        }
+        state.gathers.delete(id);
+        const result = {
+            kind: "collectiveResult",
+            id,
+            to: open.to,
+            question: open.question,
+            outcomes: memberOutcomes(open.members, open.outcomes),
+        };
+        switch (open.op) {
+            case "gather":
+                return state.ports.emit(result);
+            case "all_gather":
+                return closeAllGather(state, open, result).pipe(Effect.forkIn(state.ports.scope), Effect.asVoid);
+            default: {
+                const exhaustive = open.op;
+                return exhaustive;
+            }
+        }
+    });
+}
+/**
+ * Post an all_gather's close, listing the certified record of every answer
+ * its result counts, and emit the result once the close is certified, naming
+ * the close post. A close that cannot be certified ends the operation as an
+ * `operationFailed` item, since members then have no result to agree on.
+ */
+function closeAllGather(state, open, result) {
+    const included = open.members.flatMap((member) => Option.toArray(Option.fromNullable(open.answerHashes.get(member))));
+    return encodeCollectiveContent({
+        kind: "close",
+        id: result.id,
+        included,
+    }).pipe(Effect.mapError(contentInvalid), Effect.flatMap((content) => state.ports.sendPost({ to: open.to, content })), Effect.matchEffect({
+        onFailure: (error) => state.ports.emit({
+            kind: "operationFailed",
+            id: result.id,
+            to: open.to,
+            error: `collective ${result.id} failed: its close was not certified (${error.reason})`,
+        }),
+        onSuccess: (post) => state.ports.emit({ ...result, closePostId: post.postId }),
+    }));
+}
+function respond(state, response) {
+    return Effect.gen(function* () {
+        const { id } = response;
+        const now = yield* Clock.currentTimeMillis;
+        const request = yield* openRequest(state, id, now);
+        const refused = refusedAs(id, request.to);
+        const value = { kind: "response", ...response };
+        const content = yield* responseContent(request, value).pipe(Effect.mapError(refused));
+        yield* claimRequest(id, request).pipe(Effect.mapError(refused));
+        const post = yield* state.ports.sendPost({ to: request.to, content }).pipe(Effect.tapBoth({
+            onFailure: () => settleAnswer(state, id, request, Option.none()),
+            onSuccess: (sent) => settleAnswer(state, id, request, Option.some({ recordHash: sent.recordHash, response: value })),
+        }), Effect.onInterrupt(() => settleAnswer(state, id, request, Option.none())), Effect.mapError(refused));
+        return { operationId: id, postIds: [post.postId] };
+    });
+}
+/**
+ * The received request a response answers, refused when this endpoint never
+ * received it, it was already answered, or its deadline or close has passed.
+ * A refusal for an unknown request is addressed to the local agent, since no
+ * requester is known.
+ */
+function openRequest(state, id, now) {
+    const request = state.requests.get(id);
+    if (request === undefined) {
+        return Effect.fail({
+            id,
+            to: state.ports.self,
+            error: collectiveFailure(id, { kind: "request-unknown" }),
+        });
+    }
+    const unavailable = requestUnavailable(request, now);
+    return unavailable === undefined
+        ? Effect.succeed(request)
+        : Effect.fail({
+            id,
+            to: request.to,
+            error: collectiveFailure(id, { kind: unavailable }),
+        });
+}
+function requestUnavailable(request, now) {
+    switch (request.state) {
+        case "open":
+            return now >= request.deadlineAt ? "request-expired" : undefined;
+        case "sending":
+        case "answered":
+            return "request-answered";
+        case "closed":
+            return "request-expired";
+        default: {
+            const exhaustive = request.state;
+            return exhaustive;
+        }
+    }
+}
+/**
+ * Validate an `accept` answer against the request's stored schema and build
+ * the response post's content, which carries no text.
+ */
+function responseContent(request, response) {
+    const validated = response.action === "accept"
+        ? validateAnswer(request.requestedSchema, response.content).pipe(Effect.mapError((error) => collectiveFailure(response.id, {
+            kind: "answer-invalid",
+            fields: error.failures,
+        })))
+        : Effect.void;
+    return validated.pipe(Effect.zipRight(encodeCollectiveContent(response).pipe(Effect.mapError(contentInvalid))));
+}
+/**
+ * Hold the request's one answer. The check and the claim run without a yield
+ * between them, so of two concurrent answers only one is sent.
+ */
+function claimRequest(id, request) {
+    return Effect.suspend(() => {
+        if (request.state !== "open") {
+            return Effect.fail(collectiveFailure(id, { kind: "request-answered" }));
+        }
+        request.state = "sending";
+        return Effect.void;
+    });
+}
+/**
+ * Settle a request's answer send: answered with the certified answer, or
+ * reopened when it was refused. A member's own answer never arrives inbound,
+ * so an all_gather member records it here, and applies a close that was
+ * waiting for it; after a refused answer that close lists a record this
+ * endpoint will not hold, so applying it drops it. A request already closed
+ * stays closed: its result is out, and a close delivered again must not
+ * apply a second time.
+ */
+function settleAnswer(state, id, request, certified) {
+    return Effect.suspend(() => {
+        if (request.state === "closed") {
+            return Effect.void;
+        }
+        request.state = Option.isSome(certified) ? "answered" : "open";
+        const shared = request.shared;
+        if (shared === undefined) {
+            return Effect.void;
+        }
+        if (Option.isSome(certified)) {
+            shared.answers.set(state.ports.self, certified.value);
+        }
+        const held = shared.heldClose;
+        shared.heldClose = undefined;
+        return held === undefined
+            ? Effect.void
+            : applyClose(state, { id, request, shared }, held);
+    });
+}
+function classify(state, post) {
+    const { message } = post;
+    return readCollectiveValue(message.content).pipe(Effect.flatMap(Option.match({
+        onNone: () => Effect.succeed(Option.some({ kind: "multicast", message })),
+        onSome: (value) => collectiveItem(state, post, value),
+    })), Effect.catchTag("CollectivePartInvalidError", (error) => Effect.logWarning(`consumed post ${message.postId} from ${message.sender}: its collective part is ${error.reason}`).pipe(Effect.as(Option.none()))));
+}
+function collectiveItem(state, post, value) {
+    switch (value.kind) {
+        case "operation":
+            return operationItem(state, post.message, value);
+        case "response":
+            return recordAnswer(state, post, value).pipe(Effect.as(Option.none()));
+        case "close":
+            return receiveClose(state, post.message, value).pipe(Effect.as(Option.none()));
+        default: {
+            const exhaustive = value;
+            return exhaustive;
+        }
+    }
+}
+function operationItem(state, message, value) {
+    switch (value.op) {
+        case "multicast":
+            return Effect.succeed(multicastItem(message, withoutCollectivePart(message.content)));
+        case "gather":
+        case "all_gather":
+            return requestItem(state, message, value);
+        default: {
+            const exhaustive = value;
+            return exhaustive;
+        }
+    }
+}
+function multicastItem(message, content) {
+    return EffectArray.isNonEmptyReadonlyArray(content)
+        ? Option.some({ kind: "multicast", message: { ...message, content } })
+        : Option.none();
+}
+/**
+ * The request state a request post opens, when it arrived where its
+ * operation sends it and its id derives from its sender: a gather's in the
+ * member's direct conversation with the requester before its deadline, an
+ * all_gather's in a group conversation, whose other members are the ones
+ * asked, until `CLOSE_WAIT` past its deadline. A deadline beyond
+ * `RECEIVED_DEADLINE_HORIZON` opens nothing.
+ */
+function receivedRequest(message, value, now) {
+    if (!trustedRequest(message, value, now)) {
+        return Option.none();
+    }
+    const request = {
+        postId: message.postId,
+        from: message.sender,
+        to: message.address,
+        requestedSchema: value.requestedSchema,
+        deadlineAt: value.deadlineAt,
+        state: "open",
+    };
+    if (value.op === "gather") {
+        return message.kind === "direct" && now < value.deadlineAt
+            ? Option.some(request)
+            : Option.none();
+    }
+    if (message.kind !== "group" || now >= retainedUntil(request, true)) {
+        return Option.none();
+    }
+    const [first, ...rest] = message.members.filter((member) => member !== message.sender);
+    return first === undefined
+        ? Option.none()
+        : Option.some({
+            ...request,
+            shared: {
+                question: questionText(message.content),
+                members: [first, ...rest],
+                answers: new Map(),
+            },
+        });
+}
+/**
+ * Whether a request's id derives from its sender and its deadline lies
+ * within `RECEIVED_DEADLINE_HORIZON`.
+ */
+function trustedRequest(message, value, now) {
+    return (value.deadlineAt <= now + RECEIVED_DEADLINE_HORIZON &&
+        collectiveIdOf(message.sender, value.nonce) === value.id);
+}
+function questionText(content) {
+    return withoutCollectivePart(content)
+        .flatMap((part) => (part.type === "text" ? [part.text] : []))
+        .join("\n");
+}
+/**
+ * Record a received gather or all_gather request and present it as an item.
+ * A request `receivedRequest` opens nothing for is consumed. So is a second
+ * request post reusing an id this endpoint holds: the answer goes to the
+ * conversation of the first, so presenting the second would show the host a
+ * different audience. An all_gather request past its deadline is kept
+ * without being presented, so a member that catches up late still applies
+ * the close and receives the result.
+ */
+function requestItem(state, message, value) {
+    return Clock.currentTimeMillis.pipe(Effect.map((now) => {
+        const received = receivedRequest(message, value, now);
+        const held = state.requests.get(value.id);
+        if (Option.isNone(received) ||
+            (held ?? received.value).postId !== message.postId) {
+            return Option.none();
+        }
+        if (held === undefined) {
+            forgetExpiredRequests(state, now);
+            state.requests.set(value.id, received.value);
+        }
+        return decodeRequestedSchema(value.requestedSchema).pipe(Option.filter(() => now < value.deadlineAt), Option.map((requestedSchema) => ({
+            kind: "collectiveRequest",
+            id: value.id,
+            postId: message.postId,
+            from: message.sender,
+            to: received.value.to,
+            question: questionText(message.content),
+            requestedSchema,
+            deadlineAt: value.deadlineAt,
+        })));
+    }));
+}
+/** Forget every request past the time `retainedUntil` gives it. */
+function forgetExpiredRequests(state, now) {
+    for (const [id, request] of state.requests) {
+        if (now >= retainedUntil(request, request.shared !== undefined)) {
+            state.requests.delete(id);
+        }
+    }
+}
+/**
+ * When this endpoint drops a received request: at its deadline, or for an
+ * all_gather `CLOSE_WAIT` later, since its close follows the deadline.
+ */
+function retainedUntil(request, allGather) {
+    return request.deadlineAt + (allGather ? Duration.toMillis(CLOSE_WAIT) : 0);
+}
+/**
+ * Record an answer. At the requester, only a member's post in the
+ * operation's own conversation counts, and only its first; an answer to a
+ * completed or unknown operation changes nothing, and the last outstanding
+ * answer completes the operation. At an all_gather member, every member's
+ * answer in the group conversation is kept by record hash until the close.
+ */
+function recordAnswer(state, post, value) {
+    return Effect.suspend(() => {
+        const open = state.gathers.get(value.id);
+        if (open !== undefined) {
+            return recordCountedAnswer(state, open, post, value);
+        }
+        const request = state.requests.get(value.id);
+        if (request?.shared !== undefined) {
+            recordPeerAnswer(request, request.shared, post, value);
+        }
+        return Effect.void;
+    });
+}
+function recordCountedAnswer(state, open, post, value) {
+    const { message } = post;
+    if (!answeredInConversation(open, message) ||
+        !open.members.includes(message.sender) ||
+        open.outcomes.has(message.sender)) {
+        return Effect.void;
+    }
+    return outcomeOfResponse(open.requestedSchema, value).pipe(Effect.flatMap((outcome) => {
+        open.outcomes.set(message.sender, outcome);
+        open.answerHashes.set(message.sender, post.recordHash);
+        return open.outcomes.size === open.members.length
+            ? completeGather(state, value.id).pipe(Effect.zipRight(Fiber.interrupt(open.timer)))
+            : Effect.void;
+    }));
+}
+/** Whether an answer arrived where the operation's answers are sent. */
+function answeredInConversation(open, message) {
+    switch (open.op) {
+        case "gather":
+            return message.kind === "direct";
+        case "all_gather":
+            return message.kind === "group" && message.address === open.to;
+        default: {
+            const exhaustive = open.op;
+            return exhaustive;
+        }
+    }
+}
+function recordPeerAnswer(request, shared, post, value) {
+    const { message } = post;
+    if (request.state === "closed" ||
+        message.kind !== "group" ||
+        message.address !== request.to) {
+        return;
+    }
+    keepFirstAnswer(shared, message.sender, {
+        recordHash: post.recordHash,
+        response: value,
+    });
+}
+/**
+ * Receive an all_gather's close. Only the requester's close in the group
+ * conversation of a request this endpoint holds counts. The held request's id
+ * derives from its requester, so a close from any other sender names an id
+ * that does not derive from that sender; it, and a close for an id this
+ * endpoint does not hold, is consumed and logged. Only the first close in the
+ * conversation counts, as at every other member: a later one, including one
+ * that arrives while the first is held, changes nothing.
+ */
+function receiveClose(state, message, value) {
+    return Effect.suspend(() => {
+        const request = state.requests.get(value.id);
+        if (request?.shared === undefined ||
+            message.kind !== "group" ||
+            message.address !== request.to ||
+            message.sender !== request.from) {
+            return Effect.logWarning(`consumed close ${message.postId} from ${message.sender}: it closes no all_gather this endpoint was asked by its sender`);
+        }
+        if (request.state === "closed" || request.shared.heldClose !== undefined) {
+            return Effect.void;
+        }
+        return applyClose(state, { id: value.id, request, shared: request.shared }, { postId: message.postId, included: value.included });
+    });
+}
+/**
+ * Build a member's all_gather result from exactly the answers a close lists,
+ * and emit it.
+ *
+ * Every listed answer precedes the close in the group conversation's
+ * certified chain. The store appends a conversation's records only in chain
+ * order and pending deliveries are read in that order, so each peer answer
+ * the close lists was recorded before the close is classified. The member's
+ * own answer is not delivered inbound: it is recorded when its send returns,
+ * and a close that arrives while that send is in flight is held until it
+ * returns. A listed record the endpoint still does not hold, or one listed
+ * twice, means the close does not describe this endpoint's history, for
+ * instance after a daemon restart; it is consumed and logged, and no result
+ * is emitted. Once closed, the request keeps no answers.
+ */
+function applyClose(state, asked, close) {
+    const { id, request, shared } = asked;
+    const { answers, missing, repeated } = listedAnswers(shared, close.included);
+    if (missing && request.state === "sending") {
+        shared.heldClose = close;
+        return Effect.void;
+    }
+    request.state = "closed";
+    shared.answers.clear();
+    if (missing || repeated) {
+        return Effect.logWarning(`consumed close ${close.postId} of ${id}: it lists answers this endpoint does not hold`);
+    }
+    return Effect.forEach(answers, (answer) => outcomeOfResponse(request.requestedSchema, answer.response).pipe(Effect.map((outcome) => [answer.member, outcome])), { concurrency: 1 }).pipe(Effect.flatMap((outcomes) => state.ports.emit({
+        kind: "collectiveResult",
+        id,
+        to: request.to,
+        question: shared.question,
+        outcomes: memberOutcomes(shared.members, new Map(outcomes)),
+        closePostId: close.postId,
+    })));
+}
+//# sourceMappingURL=operation.js.map