@qlever-llc/trellis 0.10.2 → 0.10.3-rc.4

package/esm/npm/src/trellis.js

@@ -1,2284 +0,0 @@
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _Trellis_instances, _Trellis_log, _Trellis_tasks, _Trellis_hasExplicitApi, _Trellis_noResponderMaxRetries, _Trellis_noResponderRetryMs, _Trellis_onSessionNotFound, _Trellis_operationStore, _Trellis_eventConsumers, _Trellis_durableEventLoops, _Trellis_createStateFacade, _Trellis_createRpcFacade, _Trellis_createRpcHandleFacade, _Trellis_createEventFacade, _Trellis_createEventPublishFacade, _Trellis_createFeedFacade, _Trellis_createHandlerTrellis, _Trellis_createOperationFacade, _Trellis_unknownApiError, _Trellis_requestBuiltRpcUnknown, _Trellis_requestBuiltRpc, _Trellis_handleBrowserAuthRequired, _Trellis_authenticateFeedRequest, _Trellis_subscribeFeed, _Trellis_handleFeed, _Trellis_processFeedMessage, _Trellis_handleRPC, _Trellis_processRPCMessage, _Trellis_respondWithPayload, _Trellis_respondWithError, _Trellis_startEphemeralEvent, _Trellis_resolveEventConsumerGroup, _Trellis_registerDurableEventHandler, _Trellis_startDurableEventConsumer, _Trellis_durableEventConsumerGroupReady, _Trellis_runDurableEventConsumer, _Trellis_handleDurableEvent, _Trellis_handleDurableEventConsumer, _Trellis_parseEventMessage, _Trellis_escapeSubjectToken, _Trellis_currentIat, _Trellis_createProof, _Trellis_requestMessageWithRetry, _Trellis_requestJson, _Trellis_watchJson;
-import { jetstream, jetstreamManager, } from "@nats-io/jetstream";
-import { createInbox, headers as natsHeaders, } from "@nats-io/nats-core";
-import { CONTRACT_JOBS_METADATA, CONTRACT_KV_METADATA, CONTRACT_STATE_METADATA, } from "./contract_support/mod.js";
-import { AsyncResult, BaseError, err, isErr, ok, Result, } from "@qlever-llc/result";
-import { createNatsHeaderCarrier, extractTraceContext, injectTraceContext, SpanStatusCode, startClientSpan, startServerSpan, withSpanAsync, } from "./tracing.js";
-import { Type } from "typebox";
-import { Pointer } from "typebox/value";
-import { ulid } from "ulid";
-import { encodeSchema, parse, parseUnknownSchema, } from "./codec.js";
-import { AuthError, getBuiltinRpcError, TransferError, TransportError, UnexpectedError, ValidationError, } from "./errors/index.js";
-import { RemoteError } from "./errors/RemoteError.js";
-import { logger } from "./globals.js";
-import { TypedKV } from "./kv.js";
-import { TrellisErrorDataSchema } from "./models/trellis/TrellisError.js";
-import { OperationInvoker, } from "./operations.js";
-import { StateDeleteResponseSchema, StateDeleteSchema, } from "./models/trellis/rpc/StateDelete.js";
-import { StateGetResponseSchema, StateGetSchema, } from "./models/trellis/rpc/StateGet.js";
-import { StateListResponseSchema, StateListSchema, } from "./models/trellis/rpc/StateList.js";
-import { StatePutResponseSchema, StatePutSchema, } from "./models/trellis/rpc/StatePut.js";
-import { createTransferHandle, } from "./transfer.js";
-import { TrellisTasks } from "./tasks.js";
-import { TrellisConnection } from "./connection.js";
-/**
- * Safely extract JSON from a NATS message.
- * The .json() method can throw if the message data is not valid JSON.
- */
-export function safeJson(msg) {
-    return Result.try(() => msg.json());
-}
-function transportCauseContext(cause) {
-    if (cause instanceof Error) {
-        return {
-            causeName: cause.name,
-            causeMessage: cause.message,
-        };
-    }
-    return { cause: String(cause) };
-}
-function createTransportError(args) {
-    return new TransportError({
-        code: args.code,
-        message: args.message,
-        hint: args.hint,
-        cause: args.cause,
-        context: {
-            ...(args.context ?? {}),
-            ...(args.cause === undefined ? {} : transportCauseContext(args.cause)),
-        },
-    });
-}
-function requestFailedTransportError(args) {
-    return createTransportError({
-        code: args.code,
-        message: args.message,
-        hint: args.hint,
-        cause: args.cause,
-        context: {
-            subject: args.subject,
-            ...(args.method === undefined ? {} : { method: args.method }),
-            ...(args.context ?? {}),
-        },
-    });
-}
-function classifyRequestTransportFailure(args) {
-    const message = args.cause instanceof Error
-        ? args.cause.message
-        : String(args.cause);
-    const isNoResponders = message.includes("no responders");
-    const isNatsPermission = message.includes("Permissions Violation");
-    return requestFailedTransportError({
-        code: isNoResponders
-            ? "trellis.request.unavailable"
-            : isNatsPermission
-                ? "trellis.request.denied"
-                : "trellis.request.failed",
-        message: isNoResponders
-            ? "Trellis could not reach the requested capability."
-            : isNatsPermission
-                ? "Trellis denied this request."
-                : "Trellis could not complete the request.",
-        hint: isNoResponders
-            ? "Check that the target service is installed and reachable, then try again."
-            : isNatsPermission
-                ? "Sign in with a profile that has the required capability, then try again."
-                : "Retry the request. If it keeps failing, check Trellis runtime health.",
-        cause: args.cause,
-        method: args.method,
-        subject: args.subject,
-        context: {
-            ...(args.callerCapabilities === undefined
-                ? {}
-                : { requiredCapabilities: args.callerCapabilities }),
-            noResponders: isNoResponders,
-            lowLevelMessage: message,
-        },
-    });
-}
-function encodeRuntimeSchema(schema, data) {
-    return encodeSchema(schema, data);
-}
-function parseRuntimeSchema(schema, data) {
-    return parseUnknownSchema(schema, data);
-}
-export function base64urlEncode(data) {
-    const b64 = btoa(String.fromCharCode(...data));
-    return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-export function base64urlDecode(s) {
-    const normalized = s.replace(/-/g, "+").replace(/_/g, "/");
-    const padLen = (4 - (normalized.length % 4)) % 4;
-    const padded = normalized + "=".repeat(padLen);
-    const bin = atob(padded);
-    const out = new Uint8Array(bin.length);
-    for (let i = 0; i < bin.length; i++)
-        out[i] = bin.charCodeAt(i);
-    return out;
-}
-export function toArrayBuffer(data) {
-    const buf = data.buffer;
-    if (buf instanceof ArrayBuffer) {
-        return buf.slice(data.byteOffset, data.byteOffset + data.byteLength);
-    }
-    const copy = new Uint8Array(data.byteLength);
-    copy.set(data);
-    return copy.buffer;
-}
-export async function sha256(data) {
-    const digest = await crypto.subtle.digest("SHA-256", toArrayBuffer(data));
-    return new Uint8Array(digest);
-}
-export function buildProofInput(sessionKey, subject, payloadHash, iat, requestId) {
-    const enc = new TextEncoder();
-    const sessionKeyBytes = enc.encode(sessionKey);
-    const subjectBytes = enc.encode(subject);
-    const iatBytes = enc.encode(String(iat));
-    const requestIdBytes = enc.encode(requestId);
-    const buf = new Uint8Array(4 +
-        sessionKeyBytes.length +
-        4 +
-        subjectBytes.length +
-        4 +
-        payloadHash.length +
-        4 +
-        iatBytes.length +
-        4 +
-        requestIdBytes.length);
-    const view = new DataView(buf.buffer);
-    let offset = 0;
-    view.setUint32(offset, sessionKeyBytes.length);
-    offset += 4;
-    buf.set(sessionKeyBytes, offset);
-    offset += sessionKeyBytes.length;
-    view.setUint32(offset, subjectBytes.length);
-    offset += 4;
-    buf.set(subjectBytes, offset);
-    offset += subjectBytes.length;
-    view.setUint32(offset, payloadHash.length);
-    offset += 4;
-    buf.set(payloadHash, offset);
-    offset += payloadHash.length;
-    view.setUint32(offset, iatBytes.length);
-    offset += 4;
-    buf.set(iatBytes, offset);
-    offset += iatBytes.length;
-    view.setUint32(offset, requestIdBytes.length);
-    offset += 4;
-    buf.set(requestIdBytes, offset);
-    return buf;
-}
-/**
- * Returns true when a handler result explicitly leaves operation completion to
- * an external control path.
- */
-export function isOperationDeferred(value) {
-    return !!value && typeof value === "object" &&
-        "kind" in value && value.kind === "deferred";
-}
-export function isResultLike(value) {
-    return value instanceof Result;
-}
-const DurableOperationSignalSchema = Type.Object({
-    operationId: Type.String(),
-    sequence: Type.Number(),
-    signal: Type.String(),
-    input: Type.Optional(Type.Any()),
-    acceptedAt: Type.String(),
-});
-const DurableOperationSnapshotSchema = Type.Object({
-    id: Type.String(),
-    service: Type.String(),
-    operation: Type.String(),
-    revision: Type.Number(),
-    state: Type.Union([
-        Type.Literal("pending"),
-        Type.Literal("running"),
-        Type.Literal("completed"),
-        Type.Literal("failed"),
-        Type.Literal("cancelled"),
-    ]),
-    createdAt: Type.String(),
-    updatedAt: Type.String(),
-    completedAt: Type.Optional(Type.String()),
-    progress: Type.Optional(Type.Any()),
-    transfer: Type.Optional(Type.Object({
-        chunkIndex: Type.Number(),
-        chunkBytes: Type.Number(),
-        transferredBytes: Type.Number(),
-    })),
-    output: Type.Optional(Type.Any()),
-    error: Type.Optional(Type.Object({
-        type: Type.String(),
-        message: Type.String(),
-    })),
-});
-export const DurableOperationRecordSchema = Type.Object({
-    ownerSessionKey: Type.String(),
-    sequence: Type.Number(),
-    signalSequence: Type.Optional(Type.Number()),
-    signals: Type.Optional(Type.Array(DurableOperationSignalSchema)),
-    snapshot: DurableOperationSnapshotSchema,
-});
-export function buildRuntimeOperationSnapshot(runtime, state, patch) {
-    const updatedAt = new Date().toISOString();
-    const completedAt = state === "completed" || state === "failed" || state === "cancelled"
-        ? (patch?.completedAt ?? updatedAt)
-        : patch?.completedAt;
-    return {
-        id: runtime.id,
-        service: runtime.service,
-        operation: runtime.operation,
-        revision: patch?.revision ?? runtime.snapshot.revision + 1,
-        state,
-        createdAt: patch?.createdAt ?? runtime.snapshot.createdAt,
-        updatedAt,
-        ...(completedAt ? { completedAt } : {}),
-        ...(patch?.progress !== undefined
-            ? { progress: patch.progress }
-            : runtime.snapshot.progress !== undefined
-                ? { progress: runtime.snapshot.progress }
-                : {}),
-        ...(patch?.transfer !== undefined
-            ? { transfer: patch.transfer }
-            : runtime.snapshot.transfer !== undefined
-                ? { transfer: runtime.snapshot.transfer }
-                : {}),
-        ...(patch?.output !== undefined
-            ? { output: patch.output }
-            : runtime.snapshot.output !== undefined
-                ? { output: runtime.snapshot.output }
-                : {}),
-        ...(patch?.error
-            ? { error: patch.error }
-            : runtime.snapshot.error
-                ? { error: runtime.snapshot.error }
-                : {}),
-    };
-}
-function isRuntimeOperationSnapshot(value) {
-    return !!value && typeof value === "object" &&
-        typeof value.id === "string" &&
-        typeof value.service === "string" &&
-        typeof value.operation === "string" &&
-        typeof value.revision === "number" &&
-        typeof value.state === "string" &&
-        typeof value.createdAt === "string" &&
-        typeof value.updatedAt === "string";
-}
-export function isTerminalRuntimeOperationSnapshot(value) {
-    return isRuntimeOperationSnapshot(value) && (value.state === "completed" || value.state === "failed" ||
-        value.state === "cancelled");
-}
-let pendingInternalEventConsumers;
-/**
- * Creates a Trellis runtime with bootstrap-resolved bindings.
- *
- * @internal
- */
-export function createTrellisInternal(name, nats, auth, opts) {
-    const { eventConsumers, ...publicOpts } = opts ?? {};
-    pendingInternalEventConsumers = eventConsumers;
-    try {
-        return new Trellis(name, nats, auth, publicOpts);
-    }
-    finally {
-        pendingInternalEventConsumers = undefined;
-    }
-}
-function surfaceGroupName(key) {
-    return lowerCamelIdent(key.split(".")[0] ?? key);
-}
-function surfaceLeafName(key) {
-    const parts = key.split(".");
-    parts.shift();
-    return lowerCamelIdent(parts.length === 0 ? key : parts.join("."));
-}
-function lowerCamelIdent(value) {
-    const pascal = value
-        .split(/[^A-Za-z0-9]+/)
-        .filter((part) => part.length > 0)
-        .map((part) => part[0].toUpperCase() + part.slice(1))
-        .join("");
-    return pascal.length === 0 ? "_" : pascal[0].toLowerCase() + pascal.slice(1);
-}
-function addSurfaceLeaf(surface, key, leaf) {
-    const group = surfaceGroupName(key);
-    surface[group] ??= {};
-    surface[group][surfaceLeafName(key)] = leaf;
-}
-function natsSubjectMatches(pattern, subject) {
-    const patternParts = pattern.split(".");
-    const subjectParts = subject.split(".");
-    for (let index = 0; index < patternParts.length; index += 1) {
-        const part = patternParts[index];
-        if (part === ">")
-            return true;
-        const subjectPart = subjectParts[index];
-        if (subjectPart === undefined)
-            return false;
-        if (part !== "*" && part !== subjectPart)
-            return false;
-    }
-    return patternParts.length === subjectParts.length;
-}
-const DEFAULT_STATE_LIST_LIMIT = 100;
-const STATE_RUNTIME_RPC = {
-    get: {
-        subject: "rpc.v1.State.Get",
-        input: StateGetSchema,
-        output: StateGetResponseSchema,
-        callerCapabilities: [],
-        errors: ["AuthError", "ValidationError", "UnexpectedError"],
-        declaredErrorTypes: [
-            "AuthError",
-            "ValidationError",
-            "UnexpectedError",
-        ],
-    },
-    put: {
-        subject: "rpc.v1.State.Put",
-        input: StatePutSchema,
-        output: StatePutResponseSchema,
-        callerCapabilities: [],
-        errors: ["AuthError", "ValidationError", "UnexpectedError"],
-        declaredErrorTypes: [
-            "AuthError",
-            "ValidationError",
-            "UnexpectedError",
-        ],
-    },
-    delete: {
-        subject: "rpc.v1.State.Delete",
-        input: StateDeleteSchema,
-        output: StateDeleteResponseSchema,
-        callerCapabilities: [],
-        errors: ["AuthError", "ValidationError", "UnexpectedError"],
-        declaredErrorTypes: [
-            "AuthError",
-            "ValidationError",
-            "UnexpectedError",
-        ],
-    },
-    list: {
-        subject: "rpc.v1.State.List",
-        input: StateListSchema,
-        output: StateListResponseSchema,
-        callerCapabilities: [],
-        errors: ["AuthError", "ValidationError", "UnexpectedError"],
-        declaredErrorTypes: [
-            "AuthError",
-            "ValidationError",
-            "UnexpectedError",
-        ],
-    },
-};
-function joinStatePath(prefix, key) {
-    return [prefix, key]
-        .flatMap((value) => value?.split("/") ?? [])
-        .filter((segment) => segment.length > 0)
-        .join("/");
-}
-function validateStateValue(schema, value) {
-    return parseRuntimeSchema(schema, value);
-}
-function validateStateGetResult(descriptor, result) {
-    if ("migrationRequired" in result) {
-        const schema = descriptor.acceptedVersions?.[result.stateVersion];
-        if (!schema) {
-            return Result.err(new ValidationError({
-                errors: [{
-                        path: "/stateVersion",
-                        message: `state version '${result.stateVersion}' is not accepted by the runtime store`,
-                    }],
-            }));
-        }
-        const parsed = validateStateValue(schema, result.entry.value);
-        if (parsed.isErr())
-            return Result.err(parsed.error);
-        return Result.ok({
-            ...result,
-            entry: {
-                ...result.entry,
-                value: parsed.unwrapOrElse(() => {
-                    throw new Error("state value validation unexpectedly failed");
-                }),
-            },
-        });
-    }
-    if (!result.found) {
-        return Result.ok(result);
-    }
-    const parsed = validateStateValue(descriptor.schema, result.entry.value);
-    if (parsed.isErr()) {
-        return Result.err(parsed.error);
-    }
-    return Result.ok({
-        ...result,
-        entry: {
-            ...result.entry,
-            value: parsed.unwrapOrElse(() => {
-                throw new Error("state value validation unexpectedly failed");
-            }),
-        },
-    });
-}
-function validateStatePutResult(descriptor, result) {
-    if (result.applied) {
-        const parsed = validateStateValue(descriptor.schema, result.entry.value);
-        if (parsed.isErr())
-            return Result.err(parsed.error);
-        return Result.ok({
-            ...result,
-            entry: {
-                ...result.entry,
-                value: parsed.unwrapOrElse(() => {
-                    throw new Error("state value validation unexpectedly failed");
-                }),
-            },
-        });
-    }
-    if (!result.entry) {
-        return Result.ok(result);
-    }
-    if ("migrationRequired" in result.entry) {
-        const schema = descriptor.acceptedVersions?.[result.entry.stateVersion];
-        if (!schema) {
-            return Result.err(new ValidationError({
-                errors: [{
-                        path: "/stateVersion",
-                        message: `state version '${result.entry.stateVersion}' is not accepted by the runtime store`,
-                    }],
-            }));
-        }
-        const parsed = validateStateValue(schema, result.entry.entry.value);
-        if (parsed.isErr())
-            return Result.err(parsed.error);
-        return Result.ok({
-            ...result,
-            entry: {
-                ...result.entry,
-                entry: {
-                    ...result.entry.entry,
-                    value: parsed.unwrapOrElse(() => {
-                        throw new Error("state value validation unexpectedly failed");
-                    }),
-                },
-            },
-        });
-    }
-    const parsed = validateStateValue(descriptor.schema, result.entry.value);
-    if (parsed.isErr()) {
-        return Result.err(parsed.error);
-    }
-    return Result.ok({
-        ...result,
-        entry: {
-            ...result.entry,
-            value: parsed.unwrapOrElse(() => {
-                throw new Error("state value validation unexpectedly failed");
-            }),
-        },
-    });
-}
-function validateStateListResult(descriptor, result) {
-    const entries = [];
-    for (const entry of result.entries) {
-        if ("migrationRequired" in entry) {
-            const schema = descriptor.acceptedVersions?.[entry.stateVersion];
-            if (!schema) {
-                return Result.err(new ValidationError({
-                    errors: [{
-                            path: "/stateVersion",
-                            message: `state version '${entry.stateVersion}' is not accepted by the runtime store`,
-                        }],
-                }));
-            }
-            const parsed = validateStateValue(schema, entry.entry.value);
-            if (parsed.isErr())
-                return Result.err(parsed.error);
-            entries.push({
-                ...entry,
-                entry: {
-                    ...entry.entry,
-                    value: parsed.unwrapOrElse(() => {
-                        throw new Error("state value validation unexpectedly failed");
-                    }),
-                },
-            });
-            continue;
-        }
-        const parsed = validateStateValue(descriptor.schema, entry.value);
-        if (parsed.isErr()) {
-            return Result.err(parsed.error);
-        }
-        entries.push({
-            ...entry,
-            value: parsed.unwrapOrElse(() => {
-                throw new Error("state value validation unexpectedly failed");
-            }),
-        });
-    }
-    return Result.ok({ ...result, entries });
-}
-const NATS_SUBJECT_TOKEN_FORBIDDEN = /[\u0000\s.*>~]/gu;
-const DEFAULT_NO_RESPONDER_MAX_RETRIES = 2;
-const DEFAULT_NO_RESPONDER_RETRY_MS = 200;
-const DEFAULT_AUTH_VALIDATE_SESSION_RETRY_ATTEMPTS = 3;
-const DEFAULT_AUTH_VALIDATE_SESSION_RETRY_MS = 25;
-function activeTraceId(span) {
-    const traceId = span.spanContext().traceId;
-    return traceId === "00000000000000000000000000000000" ? undefined : traceId;
-}
-function traceIdFromTraceparent(traceparent) {
-    const [version, traceId, parentId, flags, extra] = traceparent?.split("-") ??
-        [];
-    if (extra !== undefined ||
-        !/^[0-9a-f]{2}$/u.test(version ?? "") ||
-        version === "ff" ||
-        !/^[0-9a-f]{32}$/u.test(traceId ?? "") ||
-        traceId === "00000000000000000000000000000000" ||
-        !/^[0-9a-f]{16}$/u.test(parentId ?? "") ||
-        parentId === "0000000000000000" ||
-        !/^[0-9a-f]{2}$/u.test(flags ?? "")) {
-        return undefined;
-    }
-    return traceId;
-}
-const EMPTY_TRELLIS_API = {
-    rpc: {},
-    operations: {},
-    events: {},
-    feeds: {},
-    subjects: {},
-};
-function isBrowserAuthRequiredError(error) {
-    const isAuthRequiredReason = (reason) => reason === "session_not_found";
-    if (error instanceof AuthError) {
-        return isAuthRequiredReason(error.reason);
-    }
-    if (error instanceof RemoteError &&
-        error.remoteError.type === "AuthError") {
-        const reason = Reflect.get(error.remoteError, "reason");
-        return isAuthRequiredReason(reason);
-    }
-    return false;
-}
-function isTransientAuthValidateSessionError(error) {
-    if (error instanceof AuthError) {
-        return error.reason === "session_not_found";
-    }
-    if (error instanceof RemoteError &&
-        error.remoteError.type === "AuthError") {
-        const reason = Reflect.get(error.remoteError, "reason");
-        return reason === "session_not_found";
-    }
-    return false;
-}
-function isDeclaredRpcError(errorNames, type) {
-    return !!errorNames?.includes(type);
-}
-function isRuntimeRpcErrorDesc(value) {
-    return !!value && typeof value === "object" &&
-        typeof Reflect.get(value, "type") === "string" &&
-        typeof Reflect.get(value, "fromSerializable") === "function";
-}
-const payloadSizeEncoder = new TextEncoder();
-function payloadByteLength(payload) {
-    return typeof payload === "string"
-        ? payloadSizeEncoder.encode(payload).byteLength
-        : payload.byteLength;
-}
-function causeMessage(cause) {
-    return cause instanceof Error ? cause.message : String(cause);
-}
-function causeLogData(cause) {
-    return cause instanceof Error
-        ? { message: cause.message, stack: cause.stack, name: cause.name }
-        : cause;
-}
-function reconstructDeclaredRpcError(errorNames, runtimeErrors, data, json) {
-    if (!isDeclaredRpcError(errorNames, data.type)) {
-        return null;
-    }
-    const runtimeError = getBuiltinRpcError(data.type) ??
-        runtimeErrors?.find((candidate) => candidate.type === data.type);
-    if (!runtimeError) {
-        return null;
-    }
-    const parsed = runtimeError.schema
-        ? parseRuntimeSchema(runtimeError.schema, json).take()
-        : data;
-    if (isErr(parsed)) {
-        return parsed.error instanceof ValidationError ||
-            parsed.error instanceof UnexpectedError
-            ? parsed.error
-            : new UnexpectedError({ cause: parsed.error });
-    }
-    try {
-        const reconstructed = runtimeError.fromSerializable(parsed);
-        if (reconstructed instanceof BaseError) {
-            return reconstructed;
-        }
-        return new UnexpectedError({
-            cause: new Error(`RPC error '${data.type}' reconstructed to a non-Trellis error instance`),
-        });
-    }
-    catch (cause) {
-        return new UnexpectedError({ cause });
-    }
-}
-async function sleep(ms) {
-    await new Promise((resolve) => setTimeout(resolve, ms));
-}
-export class Trellis {
-    constructor(name, // Must be unique for a service
-    nats, auth, opts) {
-        _Trellis_instances.add(this);
-        Object.defineProperty(this, "name", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "timeout", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "stream", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "state", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "rpc", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "event", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "feed", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "operation", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "handle", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        /** Framework-neutral lifecycle handle for this Trellis runtime connection. */
-        Object.defineProperty(this, "connection", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "nats", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "js", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "auth", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "api", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        _Trellis_log.set(this, void 0);
-        _Trellis_tasks.set(this, void 0);
-        _Trellis_hasExplicitApi.set(this, void 0);
-        _Trellis_noResponderMaxRetries.set(this, void 0);
-        _Trellis_noResponderRetryMs.set(this, void 0);
-        _Trellis_onSessionNotFound.set(this, void 0);
-        _Trellis_operationStore.set(this, void 0);
-        _Trellis_eventConsumers.set(this, void 0);
-        _Trellis_durableEventLoops.set(this, new Map());
-        const api = opts?.api;
-        this.name = name;
-        this.nats = nats;
-        this.js = jetstream(this.nats);
-        this.auth = auth;
-        this.api = (api ?? EMPTY_TRELLIS_API);
-        __classPrivateFieldSet(this, _Trellis_log, (opts?.log ?? logger).child({ lib: "trellis" }), "f");
-        this.timeout = opts?.timeout ?? 3000;
-        this.stream = opts?.stream ?? "trellis";
-        __classPrivateFieldSet(this, _Trellis_hasExplicitApi, api !== undefined, "f");
-        __classPrivateFieldSet(this, _Trellis_noResponderMaxRetries, opts?.noResponderRetry?.maxAttempts ??
-            DEFAULT_NO_RESPONDER_MAX_RETRIES, "f");
-        __classPrivateFieldSet(this, _Trellis_noResponderRetryMs, opts?.noResponderRetry?.baseDelayMs ??
-            DEFAULT_NO_RESPONDER_RETRY_MS, "f");
-        __classPrivateFieldSet(this, _Trellis_onSessionNotFound, opts?.onSessionNotFound, "f");
-        __classPrivateFieldSet(this, _Trellis_eventConsumers, pendingInternalEventConsumers ?? {}, "f");
-        this.connection = opts?.connection ??
-            new TrellisConnection({ kind: "client" });
-        __classPrivateFieldSet(this, _Trellis_tasks, new TrellisTasks({ log: __classPrivateFieldGet(this, _Trellis_log, "f") }), "f");
-        this.state = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createStateFacade).call(this, opts?.state);
-        this.rpc = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createRpcFacade).call(this);
-        this.handle = { rpc: __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createRpcHandleFacade).call(this) };
-        this.event = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createEventFacade).call(this);
-        this.feed = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createFeedFacade).call(this);
-        this.operation = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createOperationFacade).call(this);
-    }
-    /**
-     * Returns the underlying NATS connection.
-     */
-    get natsConnection() {
-        return this.nats;
-    }
-    async operationStoreHandle() {
-        if (!__classPrivateFieldGet(this, _Trellis_operationStore, "f")) {
-            const bucket = `trellis_operations_${this.auth.sessionKey.slice(0, 16)}`;
-            __classPrivateFieldSet(this, _Trellis_operationStore, (async () => {
-                const result = await TypedKV.open(this.nats, bucket, DurableOperationRecordSchema, {
-                    history: 5,
-                    ttl: 0,
-                });
-                const value = result.take();
-                if (isErr(value)) {
-                    throw value.error;
-                }
-                return value;
-            })(), "f");
-        }
-        return __classPrivateFieldGet(this, _Trellis_operationStore, "f");
-    }
-    async loadOperationRecord(operationId) {
-        const store = await this.operationStoreHandle();
-        const entry = await store.get(operationId);
-        const value = entry.take();
-        if (isErr(value)) {
-            return null;
-        }
-        return value.value;
-    }
-    async saveOperationRecord(runtime) {
-        const store = await this.operationStoreHandle();
-        const record = {
-            ownerSessionKey: runtime.ownerSessionKey,
-            sequence: runtime.sequence,
-            signalSequence: runtime.signalSequence,
-            signals: runtime.signals,
-            snapshot: runtime.snapshot,
-        };
-        await store.put(runtime.id, record);
-    }
-    request(method, input, opts) {
-        const rpcApi = this.api["rpc"];
-        const ctx = rpcApi[method];
-        if (!ctx) {
-            return AsyncResult.from(Promise.resolve(err(new UnexpectedError({
-                cause: __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_unknownApiError).call(this, "RPC method", method.toString()),
-                context: { method: method.toString() },
-            }))));
-        }
-        return __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestBuiltRpcUnknown).call(this, method, input, ctx, opts);
-    }
-    feedHandle(feed) {
-        const descriptor = this.api.feeds?.[feed];
-        if (!descriptor) {
-            throw __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_unknownApiError).call(this, "feed", feed.toString());
-        }
-        return {
-            input: (input) => ({
-                subscribe: (opts) => __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_subscribeFeed).call(this, feed.toString(), descriptor, input, opts),
-            }),
-            handle: (handler) => __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_handleFeed).call(this, feed.toString(), descriptor, handler),
-        };
-    }
-    operationHandle(operation) {
-        const descriptor = this.api["operations"]?.[operation];
-        if (!descriptor) {
-            throw __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_unknownApiError).call(this, "operation", operation.toString());
-        }
-        const transport = {
-            requestJson: (subject, body) => __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestJson).call(this, subject, body),
-            watchJson: (subject, body) => __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_watchJson).call(this, subject, body),
-            putTransfer: (grant, body) => AsyncResult.from((async () => {
-                const handle = createTransferHandle(this.nats, this.auth, this.timeout, grant);
-                if (!(handle instanceof Object) || !("send" in handle)) {
-                    return err(new TransferError({
-                        operation: "transfer",
-                        context: { reason: "invalid_operation_transfer_grant" },
-                    }));
-                }
-                return await handle.send(body);
-            })()),
-        };
-        return new OperationInvoker(transport, descriptor);
-    }
-    transfer(grant) {
-        return createTransferHandle(this.nats, this.auth, this.timeout, grant);
-    }
-    /*
-     * Mount a handler to process requests made to a specific Trellis API
-     */
-    async mount(method, fn) {
-        const methodName = method;
-        const ctx = this.api["rpc"][methodName];
-        if (!ctx) {
-            throw __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_unknownApiError).call(this, "RPC method", method.toString());
-        }
-        const task = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_handleRPC).call(this, methodName, fn);
-        __classPrivateFieldGet(this, _Trellis_tasks, "f").add(methodName, task);
-    }
-    respondWithError(msg, error) {
-        __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_respondWithError).call(this, msg, error);
-    }
-    /**
-     * Builds a stable event subject, encoded payload, and publish headers.
-     *
-     * The prepared event intentionally carries no contract id or digest so callers
-     * can persist it in a service-owned outbox without coupling storage to the
-     * publisher's current deployment metadata.
-     */
-    prepare(event, data) {
-        try {
-            const eventName = event;
-            const ctx = this.api["events"][eventName];
-            if (!ctx) {
-                return err(new UnexpectedError({
-                    cause: __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_unknownApiError).call(this, "event", event.toString()),
-                    context: { event: event.toString() },
-                }));
-            }
-            const subject = this.template(ctx.subject, data).take();
-            if (isErr(subject)) {
-                logger.error({ err: subject.error }, "Failed to template event.");
-                return subject;
-            }
-            const header = {
-                id: ulid(),
-                time: new Date().toISOString(),
-            };
-            const payload = Object.freeze({
-                ...data,
-                header: Object.freeze(header),
-            });
-            const msg = encodeSchema(ctx.event, payload).take();
-            if (isErr(msg)) {
-                logger.error({ err: msg.error }, "Failed to encode event.");
-                return err(new UnexpectedError({ cause: msg.error }));
-            }
-            const headers = natsHeaders();
-            headers.set("Nats-Msg-Id", header.id);
-            injectTraceContext(createNatsHeaderCarrier(headers));
-            const headerRecord = {};
-            for (const [key, value] of headers) {
-                headerRecord[key] = value.join(",");
-            }
-            return ok(Object.freeze({
-                event: event.toString(),
-                subject,
-                payload,
-                encodedPayload: msg,
-                headers: Object.freeze(headerRecord),
-            }));
-        }
-        catch (cause) {
-            return err(new UnexpectedError({ cause, context: { event: event.toString() } }));
-        }
-    }
-    /**
-     * Publishes a previously prepared event without regenerating its id, time,
-     * subject, payload, or headers.
-     */
-    publishPrepared(event) {
-        return AsyncResult.from((async () => {
-            try {
-                const headers = natsHeaders();
-                for (const [key, value] of Object.entries(event.headers)) {
-                    headers.set(key, value);
-                }
-                logger.trace({ subject: event.subject }, `Publishing ${event.event} event.`);
-                await this.js.publish(event.subject, event.encodedPayload, { headers });
-                return ok(undefined);
-            }
-            catch (cause) {
-                return err(new UnexpectedError({ cause, context: { event: event.event } }));
-            }
-        })());
-    }
-    publish(event, data) {
-        return AsyncResult.from((async () => {
-            const prepared = this.prepare(event, data).take();
-            if (isErr(prepared))
-                return prepared;
-            return await this.publishPrepared(prepared);
-        })());
-    }
-    listenEvent(event, subjectData, fn, opts) {
-        return AsyncResult.from((async () => {
-            try {
-                const eventName = event;
-                const ctx = this.api["events"][eventName];
-                if (!ctx) {
-                    return err(new UnexpectedError({
-                        cause: __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_unknownApiError).call(this, "event", event.toString()),
-                        context: { event: event.toString() },
-                    }));
-                }
-                const subject = this.template(ctx.subject, subjectData, true).take();
-                if (isErr(subject))
-                    return subject;
-                if (opts?.mode === "ephemeral") {
-                    return __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_startEphemeralEvent).call(this, eventName, ctx, subject, fn, opts.signal);
-                }
-                if (opts?.durableName) {
-                    return err(new UnexpectedError({
-                        cause: new Error("Durable event listener names are provisioned by Trellis event consumer bindings; use opts.group instead."),
-                        context: {
-                            event: event.toString(),
-                            durableName: opts.durableName,
-                        },
-                    }));
-                }
-                const groupResult = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_resolveEventConsumerGroup).call(this, eventName, opts);
-                const group = groupResult.take();
-                if (isErr(group))
-                    return group;
-                __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_registerDurableEventHandler).call(this, {
-                    group,
-                    event: eventName,
-                    ctx,
-                    subject,
-                    fn,
-                    signal: opts?.signal,
-                });
-                return ok(undefined);
-            }
-            catch (cause) {
-                return err(new UnexpectedError({ cause, context: { event: event.toString() } }));
-            }
-        })());
-    }
-    wait() {
-        return __classPrivateFieldGet(this, _Trellis_tasks, "f").wait();
-    }
-    // FIXME: If are validating things twice in most cases...
-    template(subject, data, allowWildcards = false) {
-        // Find all template placeholders and check if values exist
-        const placeholders = subject.match(/\{([^}]+)\}/g) || [];
-        for (const placeholder of placeholders) {
-            const key = placeholder.slice(1, -1); // Remove { and }
-            const value = Pointer.Get(data, key);
-            if ((value === undefined || value === null) && !allowWildcards) {
-                return err(new ValidationError({
-                    errors: [
-                        {
-                            path: key,
-                            message: "Missing required data for subject template",
-                        },
-                    ],
-                    context: { key },
-                }));
-            }
-        }
-        const result = subject.replace(/\{([^}]+)\}/g, (_, key) => {
-            const value = Pointer.Get(data, key);
-            if (allowWildcards && value === "*") {
-                return "*";
-            }
-            if (allowWildcards && (value === undefined || value === null)) {
-                return "*";
-            }
-            return __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_escapeSubjectToken).call(this, `${value}`);
-        });
-        return ok(result);
-    }
-    requestAuthValidate(input) {
-        const request = this.request.bind(this);
-        return request("Auth.Requests.Validate", input);
-    }
-}
-_Trellis_log = new WeakMap(), _Trellis_tasks = new WeakMap(), _Trellis_hasExplicitApi = new WeakMap(), _Trellis_noResponderMaxRetries = new WeakMap(), _Trellis_noResponderRetryMs = new WeakMap(), _Trellis_onSessionNotFound = new WeakMap(), _Trellis_operationStore = new WeakMap(), _Trellis_eventConsumers = new WeakMap(), _Trellis_durableEventLoops = new WeakMap(), _Trellis_instances = new WeakSet(), _Trellis_createStateFacade = function _Trellis_createStateFacade(state) {
-    const stores = (state ?? {});
-    const facade = Object.fromEntries(Object.entries(stores).map(([store, descriptor]) => {
-        if (descriptor.kind === "value") {
-            const client = {
-                get: () => AsyncResult.from((async () => {
-                    const result = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestBuiltRpc).call(this, "State.Get", { store }, STATE_RUNTIME_RPC.get);
-                    if (result.isErr())
-                        return result;
-                    return validateStateGetResult(descriptor, result.unwrapOrElse(() => {
-                        throw new Error("state get unexpectedly failed");
-                    }));
-                })()),
-                put: (value, opts) => AsyncResult.from((async () => {
-                    const encoded = encodeRuntimeSchema(descriptor.schema, value)
-                        .take();
-                    if (isErr(encoded)) {
-                        return Result.err(encoded.error);
-                    }
-                    const result = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestBuiltRpc).call(this, "State.Put", { store, value, ...opts }, STATE_RUNTIME_RPC.put);
-                    if (result.isErr())
-                        return result;
-                    return validateStatePutResult(descriptor, result.unwrapOrElse(() => {
-                        throw new Error("state put unexpectedly failed");
-                    }));
-                })()),
-                delete: (opts) => __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestBuiltRpc).call(this, "State.Delete", { store, ...opts }, STATE_RUNTIME_RPC.delete),
-            };
-            return [store, client];
-        }
-        const mapClient = (prefix) => ({
-            get: (key) => AsyncResult.from((async () => {
-                const result = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestBuiltRpc).call(this, "State.Get", { store, key: joinStatePath(prefix, key) }, STATE_RUNTIME_RPC.get);
-                if (result.isErr())
-                    return result;
-                return validateStateGetResult(descriptor, result.unwrapOrElse(() => {
-                    throw new Error("state get unexpectedly failed");
-                }));
-            })()),
-            put: (key, value, opts) => AsyncResult.from((async () => {
-                const encoded = encodeRuntimeSchema(descriptor.schema, value)
-                    .take();
-                if (isErr(encoded)) {
-                    return Result.err(encoded.error);
-                }
-                const result = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestBuiltRpc).call(this, "State.Put", { store, key: joinStatePath(prefix, key), value, ...opts }, STATE_RUNTIME_RPC.put);
-                if (result.isErr())
-                    return result;
-                return validateStatePutResult(descriptor, result.unwrapOrElse(() => {
-                    throw new Error("state put unexpectedly failed");
-                }));
-            })()),
-            delete: (key, opts) => __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestBuiltRpc).call(this, "State.Delete", { store, key: joinStatePath(prefix, key), ...opts }, STATE_RUNTIME_RPC.delete),
-            list: (opts) => AsyncResult.from((async () => {
-                const result = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestBuiltRpc).call(this, "State.List", {
-                    store,
-                    ...(prefix ? { prefix } : {}),
-                    offset: opts?.offset ?? 0,
-                    limit: opts?.limit ?? DEFAULT_STATE_LIST_LIMIT,
-                }, STATE_RUNTIME_RPC.list);
-                if (result.isErr())
-                    return result;
-                return validateStateListResult(descriptor, result.unwrapOrElse(() => {
-                    throw new Error("state list unexpectedly failed");
-                }));
-            })()),
-            prefix: (path) => mapClient(joinStatePath(prefix, path)),
-        });
-        return [store, mapClient()];
-    }));
-    return facade;
-}, _Trellis_createRpcFacade = function _Trellis_createRpcFacade() {
-    const surface = {};
-    for (const method of Object.keys(this.api.rpc ?? {})) {
-        const leaf = (input, opts) => this.request(method, input, opts);
-        addSurfaceLeaf(surface, method, leaf);
-    }
-    return surface;
-}, _Trellis_createRpcHandleFacade = function _Trellis_createRpcHandleFacade() {
-    const surface = {};
-    for (const method of Object.keys(this.api.rpc ?? {})) {
-        addSurfaceLeaf(surface, method, (handler) => this.mount(method, handler));
-    }
-    return surface;
-}, _Trellis_createEventFacade = function _Trellis_createEventFacade() {
-    const surface = {};
-    for (const event of Object.keys(this.api.events ?? {})) {
-        addSurfaceLeaf(surface, event, {
-            prepare: (payload) => this.prepare(event, payload),
-            publish: (payload) => this.publish(event, payload),
-            listen: (handler, subjectData = {}, opts) => this.listenEvent(event, subjectData, handler, opts),
-        });
-    }
-    return surface;
-}, _Trellis_createEventPublishFacade = function _Trellis_createEventPublishFacade() {
-    const surface = {};
-    for (const event of Object.keys(this.api.events ?? {})) {
-        addSurfaceLeaf(surface, event, {
-            prepare: (payload) => this.prepare(event, payload),
-            publish: (payload) => this.publish(event, payload),
-        });
-    }
-    return surface;
-}, _Trellis_createFeedFacade = function _Trellis_createFeedFacade() {
-    const surface = {};
-    for (const feed of Object.keys(this.api.feeds ?? {})) {
-        const leaf = (input, opts) => this.feedHandle(feed).input(input).subscribe(opts);
-        addSurfaceLeaf(surface, feed, leaf);
-    }
-    return surface;
-}, _Trellis_createHandlerTrellis = function _Trellis_createHandlerTrellis() {
-    return {
-        rpc: this.rpc,
-        event: __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createEventPublishFacade).call(this),
-        feed: this.feed,
-        operation: this.operation,
-        request: this.request.bind(this),
-        prepare: (event, data) => this.prepare(event, data),
-        publish: (event, data) => this.publish(event, data),
-        publishPrepared: (event) => this.publishPrepared(event),
-    };
-}, _Trellis_createOperationFacade = function _Trellis_createOperationFacade() {
-    const surface = {};
-    for (const operation of Object.keys(this.api.operations ?? {})) {
-        addSurfaceLeaf(surface, operation, this.operationHandle(operation));
-    }
-    return surface;
-}, _Trellis_unknownApiError = function _Trellis_unknownApiError(kind, name) {
-    const base = `Unknown ${kind} '${name}'.`;
-    if (__classPrivateFieldGet(this, _Trellis_hasExplicitApi, "f")) {
-        return new Error(`${base} Did you forget to include its API module?`);
-    }
-    return new Error(`${base} No API surface was provided. Pass opts.api, use createClient(contract, ...), or await createCoreClient(...) instead.`);
-}, _Trellis_requestBuiltRpcUnknown = function _Trellis_requestBuiltRpcUnknown(method, input, ctx, opts) {
-    return __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestBuiltRpc).call(this, method, input, ctx, opts);
-}, _Trellis_requestBuiltRpc = function _Trellis_requestBuiltRpc(method, input, ctx, opts) {
-    return AsyncResult.from((async () => {
-        __classPrivateFieldGet(this, _Trellis_log, "f").trace({ method: String(method) }, `Calling ${method.toString()}.`);
-        const msg = encodeRuntimeSchema(ctx.input, input).take();
-        if (isErr(msg)) {
-            return msg;
-        }
-        const subject = this.template(ctx.subject, input).take();
-        if (isErr(subject)) {
-            return subject;
-        }
-        const span = startClientSpan(method, subject);
-        const attempt = async () => {
-            const authHeaders = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createProof).call(this, subject, msg);
-            const headers = natsHeaders();
-            headers.set("session-key", this.auth.sessionKey);
-            headers.set("proof", authHeaders.proof);
-            headers.set("iat", String(authHeaders.iat));
-            headers.set("request-id", authHeaders.requestId);
-            injectTraceContext(createNatsHeaderCarrier(headers), span);
-            const msgResult = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestMessageWithRetry).call(this, {
-                method,
-                subject,
-                payload: msg,
-                headers,
-                timeout: opts?.timeout ?? this.timeout,
-                callerCapabilities: ctx.callerCapabilities,
-            });
-            const response = msgResult.take();
-            if (isErr(response)) {
-                return response;
-            }
-            if (response.headers?.get("status") === "error") {
-                const json = safeJson(response).take();
-                if (isErr(json)) {
-                    return err(requestFailedTransportError({
-                        code: "trellis.request.invalid_response",
-                        message: "Trellis returned an invalid response.",
-                        hint: "Retry the request. If it keeps happening, check the Trellis capability handling this request.",
-                        method,
-                        subject,
-                        cause: json.error.cause,
-                    }));
-                }
-                const errorData = parse(TrellisErrorDataSchema, json).take();
-                if (isErr(errorData)) {
-                    return err(requestFailedTransportError({
-                        code: "trellis.request.invalid_response",
-                        message: "Trellis returned an invalid response.",
-                        hint: "Retry the request. If it keeps happening, check the Trellis capability handling this request.",
-                        method,
-                        subject,
-                        cause: errorData.error,
-                    }));
-                }
-                const declaredErrorTypes = Array.isArray(ctx.declaredErrorTypes)
-                    ? ctx.declaredErrorTypes.filter((value) => typeof value === "string")
-                    : ctx.errors;
-                const runtimeErrors = Array.isArray(ctx.runtimeErrors)
-                    ? ctx.runtimeErrors.filter(isRuntimeRpcErrorDesc)
-                    : undefined;
-                const reconstructed = reconstructDeclaredRpcError(declaredErrorTypes, runtimeErrors, errorData, json);
-                if (reconstructed) {
-                    await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_handleBrowserAuthRequired).call(this, reconstructed);
-                    return err(reconstructed);
-                }
-                const remoteError = new RemoteError({ error: errorData });
-                await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_handleBrowserAuthRequired).call(this, remoteError);
-                return err(remoteError);
-            }
-            const json = safeJson(response).take();
-            if (isErr(json)) {
-                return err(requestFailedTransportError({
-                    code: "trellis.request.invalid_response",
-                    message: "Trellis returned an invalid response.",
-                    hint: "Retry the request. If it keeps happening, check the Trellis capability handling this request.",
-                    method,
-                    subject,
-                    cause: json.error.cause,
-                }));
-            }
-            const outputResult = parseRuntimeSchema(ctx.output, json).take();
-            if (isErr(outputResult)) {
-                return err(outputResult.error);
-            }
-            return ok(outputResult);
-        };
-        return await withSpanAsync(span, async () => {
-            try {
-                const result = await attempt();
-                const value = result.take();
-                if (isErr(value)) {
-                    span.setStatus({
-                        code: SpanStatusCode.ERROR,
-                        message: value.error.message,
-                    });
-                }
-                else {
-                    span.setStatus({ code: SpanStatusCode.OK });
-                }
-                return result;
-            }
-            catch (cause) {
-                const unexpected = cause instanceof TransportError
-                    ? cause
-                    : new UnexpectedError({ cause });
-                span.setStatus({
-                    code: SpanStatusCode.ERROR,
-                    message: unexpected.message,
-                });
-                span.recordException(unexpected);
-                return err(unexpected);
-            }
-            finally {
-                span.end();
-            }
-        });
-    })());
-}, _Trellis_handleBrowserAuthRequired = async function _Trellis_handleBrowserAuthRequired(error) {
-    if (!__classPrivateFieldGet(this, _Trellis_onSessionNotFound, "f") || !isBrowserAuthRequiredError(error)) {
-        return;
-    }
-    await __classPrivateFieldGet(this, _Trellis_onSessionNotFound, "f").call(this);
-}, _Trellis_authenticateFeedRequest = async function _Trellis_authenticateFeedRequest(args) {
-    const sessionKey = args.msg.headers?.get("session-key");
-    const proof = args.msg.headers?.get("proof");
-    const iatHeader = args.msg.headers?.get("iat");
-    const requestId = args.msg.headers?.get("request-id");
-    if (!sessionKey) {
-        return err(new AuthError({ reason: "missing_session_key" }));
-    }
-    if (!proof)
-        return err(new AuthError({ reason: "missing_proof" }));
-    const iat = Number(iatHeader);
-    if (!Number.isSafeInteger(iat) || !requestId) {
-        return err(new AuthError({ reason: "invalid_signature" }));
-    }
-    const proofInput = buildProofInput(sessionKey, args.subject, args.payloadHash, iat, requestId);
-    const digest = await sha256(proofInput);
-    const verifyResult = await AsyncResult.try(async () => {
-        const publicKeyRaw = base64urlDecode(sessionKey);
-        const pub = await crypto.subtle.importKey("raw", toArrayBuffer(publicKeyRaw), { name: "Ed25519" }, true, ["verify"]);
-        return crypto.subtle.verify({ name: "Ed25519" }, pub, toArrayBuffer(base64urlDecode(proof)), toArrayBuffer(digest));
-    });
-    if (!verifyResult.isOk() || verifyResult.take() !== true) {
-        return err(new AuthError({ reason: "invalid_signature", context: { sessionKey } }));
-    }
-    const auth = await this.requestAuthValidate({
-        sessionKey,
-        proof,
-        subject: args.subject,
-        payloadHash: base64urlEncode(args.payloadHash),
-        iat,
-        requestId,
-        capabilities: [...args.requiredCapabilities],
-    }).take();
-    if (isErr(auth))
-        return err(auth.error);
-    if (!auth.allowed) {
-        return err(new AuthError({
-            reason: "insufficient_permissions",
-            context: {
-                feed: args.feed,
-                requiredCapabilities: args.requiredCapabilities,
-                userCapabilities: auth.caller.capabilities,
-            },
-        }));
-    }
-    if (typeof args.msg.reply !== "string" ||
-        !args.msg.reply.startsWith(`${auth.inboxPrefix}.`)) {
-        return err(new AuthError({
-            reason: "reply_subject_mismatch",
-            context: { expected: auth.inboxPrefix, actual: args.msg.reply },
-        }));
-    }
-    return ok(auth.caller);
-}, _Trellis_subscribeFeed = function _Trellis_subscribeFeed(feed, descriptor, input, opts) {
-    return AsyncResult.from((async () => {
-        const payload = encodeRuntimeSchema(descriptor.input, input).take();
-        if (isErr(payload))
-            return payload;
-        const subject = this.template(descriptor.subject, input).take();
-        if (isErr(subject))
-            return subject;
-        const authHeaders = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createProof).call(this, subject, payload);
-        const headers = natsHeaders();
-        headers.set("session-key", this.auth.sessionKey);
-        headers.set("proof", authHeaders.proof);
-        headers.set("iat", String(authHeaders.iat));
-        headers.set("request-id", authHeaders.requestId);
-        injectTraceContext(createNatsHeaderCarrier(headers));
-        const inbox = createInbox(`_INBOX.${this.auth.sessionKey.slice(0, 16)}`);
-        const sub = this.nats.subscribe(inbox);
-        const iterator = sub[Symbol.asyncIterator]();
-        const abort = () => sub.unsubscribe();
-        opts?.signal?.addEventListener("abort", abort, { once: true });
-        try {
-            this.nats.publish(subject, payload, { headers, reply: inbox });
-            await this.nats.flush();
-        }
-        catch (cause) {
-            opts?.signal?.removeEventListener("abort", abort);
-            sub.unsubscribe();
-            return err(createTransportError({
-                code: "trellis.feed.subscribe_failed",
-                message: "Trellis could not subscribe to the feed.",
-                hint: "Retry the subscription. If it keeps failing, check Trellis runtime health.",
-                cause,
-                context: { feed, subject },
-            }));
-        }
-        let timeoutId;
-        let abortHandler;
-        const handshakePromises = [
-            iterator.next(),
-            new Promise((resolve) => {
-                timeoutId = setTimeout(() => resolve("timeout"), this.timeout);
-            }),
-        ];
-        const signal = opts?.signal;
-        if (signal) {
-            handshakePromises.push(new Promise((resolve) => {
-                abortHandler = () => resolve("aborted");
-                signal.addEventListener("abort", abortHandler, { once: true });
-            }));
-        }
-        const firstFrame = await Promise.race(handshakePromises);
-        if (timeoutId !== undefined)
-            clearTimeout(timeoutId);
-        if (signal && abortHandler) {
-            signal.removeEventListener("abort", abortHandler);
-        }
-        if (firstFrame === "timeout" || firstFrame === "aborted") {
-            opts?.signal?.removeEventListener("abort", abort);
-            sub.unsubscribe();
-            return err(createTransportError({
-                code: firstFrame === "timeout"
-                    ? "trellis.feed.subscribe_timeout"
-                    : "trellis.feed.subscribe_aborted",
-                message: firstFrame === "timeout"
-                    ? "Trellis did not receive a feed acknowledgement."
-                    : "The feed subscription was aborted before Trellis acknowledged it.",
-                hint: firstFrame === "timeout"
-                    ? "Check that the target service is running and has the current deployment digest, then retry."
-                    : "Retry the subscription if the feed is still needed.",
-                context: { feed, subject },
-            }));
-        }
-        if (firstFrame.done) {
-            opts?.signal?.removeEventListener("abort", abort);
-            sub.unsubscribe();
-            return err(createTransportError({
-                code: "trellis.feed.subscribe_closed",
-                message: "Trellis closed the feed before acknowledging it.",
-                hint: "Retry the subscription. If it keeps failing, check Trellis runtime health.",
-                context: { feed, subject },
-            }));
-        }
-        const firstMessage = firstFrame.value;
-        if (firstMessage.headers?.get("status") === "error") {
-            opts?.signal?.removeEventListener("abort", abort);
-            sub.unsubscribe();
-            return err(createTransportError({
-                code: "trellis.feed.failed",
-                message: "Trellis rejected the feed subscription.",
-                hint: "Retry the subscription. If it keeps failing, check Trellis runtime health and permissions.",
-                context: { feed, subject, frame: firstMessage.string() },
-            }));
-        }
-        const firstEvent = firstMessage.headers?.get("feed-status") === "ready"
-            ? undefined
-            : firstMessage;
-        const eventSchema = descriptor.event;
-        return ok((async function* () {
-            try {
-                const parseFeedFrame = (msg) => {
-                    if (msg.headers?.get("status") === "error") {
-                        throw createTransportError({
-                            code: "trellis.feed.failed",
-                            message: "Trellis stopped the feed.",
-                            hint: "Retry the subscription. If it keeps failing, check Trellis runtime health.",
-                            context: { feed, subject, frame: msg.string() },
-                        });
-                    }
-                    const json = safeJson(msg).take();
-                    if (isErr(json))
-                        throw json.error;
-                    const parsed = parseRuntimeSchema(eventSchema, json).take();
-                    if (isErr(parsed))
-                        throw parsed.error;
-                    return parsed;
-                };
-                if (firstEvent)
-                    yield parseFeedFrame(firstEvent);
-                while (true) {
-                    const next = await iterator.next();
-                    if (next.done)
-                        break;
-                    yield parseFeedFrame(next.value);
-                }
-            }
-            finally {
-                opts?.signal?.removeEventListener("abort", abort);
-                sub.unsubscribe();
-            }
-        })());
-    })());
-}, _Trellis_handleFeed = async function _Trellis_handleFeed(feed, descriptor, handler) {
-    const subject = this.template(descriptor.subject, {}, true).take();
-    if (isErr(subject))
-        throw subject.error;
-    let sub;
-    try {
-        sub = this.nats.subscribe(subject);
-        await this.nats.flush();
-    }
-    catch (cause) {
-        throw createTransportError({
-            code: "trellis.feed.listen_failed",
-            message: "Trellis could not listen for feed requests.",
-            hint: "Check the service deployment digest and runtime permissions, then restart the service.",
-            cause,
-            context: { feed, subject },
-        });
-    }
-    const task = AsyncResult.try(async () => {
-        for await (const msg of sub) {
-            void (async () => {
-                try {
-                    const result = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_processFeedMessage).call(this, feed, descriptor, msg, handler);
-                    const value = result.take();
-                    if (isErr(value)) {
-                        __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_respondWithError).call(this, msg, value.error);
-                    }
-                }
-                catch (cause) {
-                    const error = cause instanceof BaseError
-                        ? cause
-                        : new UnexpectedError({ cause });
-                    __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_respondWithError).call(this, msg, error);
-                }
-            })();
-        }
-    });
-    __classPrivateFieldGet(this, _Trellis_tasks, "f").add(`feed:${feed}`, task);
-}, _Trellis_processFeedMessage = async function _Trellis_processFeedMessage(feed, descriptor, msg, handler) {
-    const json = safeJson(msg).take();
-    if (isErr(json))
-        return json;
-    const parsed = parseRuntimeSchema(descriptor.input, json).take();
-    if (isErr(parsed))
-        return parsed;
-    const caller = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_authenticateFeedRequest).call(this, {
-        feed,
-        subject: msg.subject,
-        msg,
-        payloadHash: await sha256(msg.data ?? new Uint8Array()),
-        requiredCapabilities: descriptor.subscribeCapabilities,
-    });
-    const callerValue = caller.take();
-    if (isErr(callerValue))
-        return callerValue;
-    if (!msg.reply) {
-        return err(new UnexpectedError({
-            context: { feed, reason: "missing_reply" },
-        }));
-    }
-    const readyHeaders = natsHeaders();
-    readyHeaders.set("feed-status", "ready");
-    this.nats.publish(msg.reply, new Uint8Array(), { headers: readyHeaders });
-    await this.nats.flush();
-    const controller = new AbortController();
-    try {
-        await handler({
-            input: parsed,
-            caller: callerValue,
-            signal: controller.signal,
-            emit: (event) => AsyncResult.from((async () => {
-                const payload = encodeRuntimeSchema(descriptor.event, event).take();
-                if (isErr(payload))
-                    return payload;
-                if (!msg.reply) {
-                    return err(new UnexpectedError({
-                        context: { feed, reason: "missing_reply" },
-                    }));
-                }
-                this.nats.publish(msg.reply, payload);
-                await this.nats.flush();
-                return ok(undefined);
-            })()),
-        });
-        return ok(undefined);
-    }
-    finally {
-        controller.abort();
-    }
-}, _Trellis_handleRPC = function _Trellis_handleRPC(method, fn, subjectData = {}) {
-    // Get API details
-    const ctx = this.api["rpc"][method];
-    const subject = this.template(ctx.subject, subjectData, true).take();
-    if (isErr(subject)) {
-        return AsyncResult.lift(subject);
-    }
-    const handlerTrellis = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createHandlerTrellis).call(this);
-    __classPrivateFieldGet(this, _Trellis_log, "f").info({ method: String(method) }, `Mounting ${method.toString()} RPC handler`);
-    const sub = this.nats.subscribe(subject);
-    return AsyncResult.try(async () => {
-        for await (const msg of sub) {
-            const resultPromise = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_processRPCMessage).call(this, method, ctx, msg, fn, handlerTrellis);
-            const result = resultPromise.take();
-            if (isErr(result)) {
-                __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_respondWithError).call(this, msg, result.error, { method: String(method) });
-                continue;
-            }
-            const sent = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_respondWithPayload).call(this, msg, result, undefined, {
-                method: String(method),
-                responseKind: "success",
-            });
-            if (sent.isErr()) {
-                const responseBytes = payloadByteLength(result);
-                const message = causeMessage(sent.error.cause);
-                __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_respondWithError).call(this, msg, new TransportError({
-                    code: "trellis.rpc.response_send_failed",
-                    message: message.includes("max_payload")
-                        ? "Trellis RPC response exceeded NATS max_payload."
-                        : "Trellis could not send the RPC response.",
-                    hint: "Reduce the requested page size or use a narrower RPC that does not include large detail payloads.",
-                    cause: sent.error.cause,
-                    context: {
-                        method: String(method),
-                        subject: msg.subject,
-                        responseBytes,
-                        causeMessage: message,
-                    },
-                }), { method: String(method), responseBytes });
-            }
-        }
-    });
-}, _Trellis_processRPCMessage = async function _Trellis_processRPCMessage(method, ctx, msg, fn, handlerTrellis) {
-    __classPrivateFieldGet(this, _Trellis_log, "f").debug({ method: String(method), subject: msg.subject }, "Processing RPC message");
-    // Extract trace context from incoming NATS headers
-    const parentContext = extractTraceContext(createNatsHeaderCarrier({
-        get: (k) => msg.headers?.get(k) ?? undefined,
-        set: () => { }, // Server doesn't need to set headers on incoming messages
-    }));
-    // Start a server span for this RPC handler
-    const span = startServerSpan(method, msg.subject, parentContext);
-    const incomingTraceId = traceIdFromTraceparent(msg.headers?.get("traceparent"));
-    // Execute the handler within the span's context
-    return withSpanAsync(span, async () => {
-        const execute = async () => {
-            const jsonData = safeJson(msg).take();
-            if (isErr(jsonData)) {
-                __classPrivateFieldGet(this, _Trellis_log, "f").warn({ method, error: jsonData.error.message }, "Failed to parse JSON");
-                span.setStatus({
-                    code: SpanStatusCode.ERROR,
-                    message: "Failed to parse JSON",
-                });
-                return jsonData;
-            }
-            const parsedInput = parseRuntimeSchema(ctx.input, jsonData).take();
-            if (isErr(parsedInput)) {
-                span.setStatus({
-                    code: SpanStatusCode.ERROR,
-                    message: "Input validation failed",
-                });
-                return parsedInput;
-            }
-            let caller;
-            const callerSessionKey = msg.headers?.get("session-key") ?? "";
-            const authRequired = ctx.authRequired ?? true;
-            if (!authRequired) {
-                caller = {
-                    type: "service",
-                    id: "system",
-                    active: true,
-                    name: "System",
-                    capabilities: ["service"],
-                };
-            }
-            else {
-                const sessionKey = msg.headers?.get("session-key");
-                const proof = msg.headers?.get("proof");
-                const iatHeader = msg.headers?.get("iat");
-                const requestId = msg.headers?.get("request-id");
-                if (!sessionKey) {
-                    __classPrivateFieldGet(this, _Trellis_log, "f").warn({ method }, "Missing session-key header");
-                    span.setStatus({
-                        code: SpanStatusCode.ERROR,
-                        message: "Missing session-key",
-                    });
-                    return err(new AuthError({ reason: "missing_session_key" }));
-                }
-                if (!proof) {
-                    __classPrivateFieldGet(this, _Trellis_log, "f").warn({ method }, "Missing proof in request");
-                    span.setStatus({
-                        code: SpanStatusCode.ERROR,
-                        message: "Missing proof",
-                    });
-                    return err(new AuthError({ reason: "missing_proof" }));
-                }
-                const iat = Number(iatHeader);
-                if (!Number.isSafeInteger(iat) || !requestId) {
-                    return err(new AuthError({ reason: "invalid_signature" }));
-                }
-                // Verify proof signature locally using the raw request bytes we received.
-                const payloadBytes = msg.data ?? new Uint8Array();
-                const payloadHash = await sha256(payloadBytes);
-                const proofInput = buildProofInput(sessionKey, msg.subject, payloadHash, iat, requestId);
-                const digest = await sha256(proofInput);
-                const verifyResult = await AsyncResult.try(async () => {
-                    const publicKeyRaw = base64urlDecode(sessionKey);
-                    const pub = await crypto.subtle.importKey("raw", toArrayBuffer(publicKeyRaw), { name: "Ed25519" }, true, ["verify"]);
-                    return crypto.subtle.verify({ name: "Ed25519" }, pub, toArrayBuffer(base64urlDecode(proof)), toArrayBuffer(digest));
-                });
-                const signatureOk = verifyResult.isOk() &&
-                    verifyResult.take() === true;
-                if (!signatureOk) {
-                    span.setStatus({
-                        code: SpanStatusCode.ERROR,
-                        message: "Invalid signature",
-                    });
-                    return err(new AuthError({
-                        reason: "invalid_signature",
-                        context: { sessionKey },
-                    }));
-                }
-                let auth;
-                for (let attempt = 0; attempt < DEFAULT_AUTH_VALIDATE_SESSION_RETRY_ATTEMPTS; attempt++) {
-                    const authValue = await this.requestAuthValidate({
-                        sessionKey,
-                        proof,
-                        subject: msg.subject,
-                        payloadHash: base64urlEncode(payloadHash),
-                        iat,
-                        requestId,
-                        capabilities: [...ctx.callerCapabilities],
-                    }).take();
-                    if (!isErr(authValue)) {
-                        auth = authValue;
-                        break;
-                    }
-                    const authError = authValue.error;
-                    if (!isTransientAuthValidateSessionError(authError) ||
-                        attempt === DEFAULT_AUTH_VALIDATE_SESSION_RETRY_ATTEMPTS - 1) {
-                        auth = authError;
-                        break;
-                    }
-                    await sleep(DEFAULT_AUTH_VALIDATE_SESSION_RETRY_MS * (attempt + 1));
-                }
-                if (!auth) {
-                    return err(new UnexpectedError({
-                        context: { reason: "missing_auth_validate_result" },
-                    }));
-                }
-                if (auth instanceof Error) {
-                    __classPrivateFieldGet(this, _Trellis_log, "f").warn({
-                        method,
-                        error: auth.message,
-                        errorType: auth.name,
-                        remoteError: auth instanceof RemoteError
-                            ? auth.toSerializable()
-                            : undefined,
-                    }, "Auth.Requests.Validate failed");
-                    span.setStatus({
-                        code: SpanStatusCode.ERROR,
-                        message: "Auth.Requests.Validate failed",
-                    });
-                    if (auth instanceof BaseError) {
-                        return err(auth);
-                    }
-                    return err(new UnexpectedError({ cause: auth }));
-                }
-                if (!auth.allowed) {
-                    span.setStatus({
-                        code: SpanStatusCode.ERROR,
-                        message: "Insufficient permissions",
-                    });
-                    return err(new AuthError({
-                        reason: "insufficient_permissions",
-                        context: {
-                            requiredCapabilities: ctx.callerCapabilities,
-                            userCapabilities: auth.caller.capabilities,
-                        },
-                    }));
-                }
-                if (typeof msg.reply !== "string" ||
-                    !msg.reply.startsWith(`${auth.inboxPrefix}.`)) {
-                    span.setStatus({
-                        code: SpanStatusCode.ERROR,
-                        message: "Reply subject mismatch",
-                    });
-                    return err(new AuthError({
-                        reason: "reply_subject_mismatch",
-                        context: { expected: auth.inboxPrefix, actual: msg.reply },
-                    }));
-                }
-                caller = auth.caller;
-            }
-            span.setAttribute("auth.caller.type", caller.type);
-            if (caller.type === "user") {
-                span.setAttribute("user.id", caller.userId);
-                span.setAttribute("user.identity.provider", caller.identity.provider);
-                span.setAttribute("user.identity.subject", caller.identity.subject);
-            }
-            if (caller.type === "service") {
-                const { id } = caller;
-                span.setAttribute("service.id", id);
-            }
-            if (caller.type === "device") {
-                span.setAttribute("device.id", caller.deviceId);
-                span.setAttribute("device.deployment_id", caller.deploymentId);
-            }
-            const invokeHandler = fn;
-            const handlerResultWrapped = await AsyncResult.try(async () => await Promise.resolve(invokeHandler({
-                input: parsedInput,
-                context: {
-                    caller,
-                    sessionKey: callerSessionKey,
-                },
-                client: handlerTrellis,
-            })));
-            if (handlerResultWrapped.isErr()) {
-                const error = handlerResultWrapped.error.withContext({ method });
-                __classPrivateFieldGet(this, _Trellis_log, "f").error({
-                    method,
-                    error: error.message,
-                    cause: error.cause instanceof Error
-                        ? { message: error.cause.message, stack: error.cause.stack }
-                        : error.cause,
-                }, "Handler threw unexpectedly.");
-                span.setStatus({
-                    code: SpanStatusCode.ERROR,
-                    message: error.message,
-                });
-                span.recordException(error);
-                return err(error);
-            }
-            const handlerResult = handlerResultWrapped.take();
-            const handlerOutcome = handlerResult.take();
-            if (isErr(handlerOutcome)) {
-                const handlerError = handlerOutcome.error;
-                const error = handlerError instanceof BaseError &&
-                    !(handlerError instanceof RemoteError)
-                    ? handlerError
-                    : new UnexpectedError({ cause: handlerError });
-                __classPrivateFieldGet(this, _Trellis_log, "f").error({
-                    method,
-                    error: error.message,
-                    errorType: error.name,
-                    cause: error.cause instanceof Error
-                        ? { message: error.cause.message, stack: error.cause.stack }
-                        : error.cause,
-                }, "Handler returned error.");
-                span.setStatus({
-                    code: SpanStatusCode.ERROR,
-                    message: error.message,
-                });
-                return err(error);
-            }
-            const encoded = encodeSchema(ctx.output, handlerOutcome).take();
-            if (isErr(encoded)) {
-                span.setStatus({
-                    code: SpanStatusCode.ERROR,
-                    message: "Output encoding failed",
-                });
-                return encoded;
-            }
-            span.setStatus({ code: SpanStatusCode.OK });
-            return ok(encoded);
-        };
-        const result = await execute();
-        if (isErr(result)) {
-            result.error.withTraceId(activeTraceId(span) ?? incomingTraceId);
-        }
-        span.end();
-        return result;
-    });
-}, _Trellis_respondWithPayload = function _Trellis_respondWithPayload(msg, payload, options, context) {
-    const responseBytes = payloadByteLength(payload);
-    try {
-        msg.respond(payload, options);
-        return ok(undefined);
-    }
-    catch (cause) {
-        const error = new UnexpectedError({
-            cause,
-            context: {
-                method: context.method,
-                responseKind: context.responseKind,
-                subject: msg.subject,
-                reply: msg.reply,
-                responseBytes,
-                causeMessage: causeMessage(cause),
-            },
-        });
-        __classPrivateFieldGet(this, _Trellis_log, "f").error({
-            method: context.method,
-            responseKind: context.responseKind,
-            subject: msg.subject,
-            reply: msg.reply,
-            responseBytes,
-            cause: causeLogData(cause),
-        }, "Failed to send RPC response");
-        return err(error);
-    }
-}, _Trellis_respondWithError = function _Trellis_respondWithError(msg, error, context = {}) {
-    const trellisError = error instanceof BaseError &&
-        !(error instanceof RemoteError)
-        ? error
-        : new UnexpectedError({ cause: error });
-    __classPrivateFieldGet(this, _Trellis_log, "f").error({
-        method: context.method,
-        subject: msg.subject,
-        responseBytes: context.responseBytes,
-        error: trellisError.toSerializable(),
-    }, "RPC error");
-    const errorData = trellisError.toSerializable();
-    const hdrs = natsHeaders();
-    hdrs.set("status", "error");
-    const serialized = Result.try(() => JSON.stringify(errorData));
-    if (serialized.isErr()) {
-        __classPrivateFieldGet(this, _Trellis_log, "f").error({ error: serialized.error }, "Failed to serialize error response");
-        __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_respondWithPayload).call(this, msg, '{"type":"UnexpectedError","message":"Failed to serialize error"}', { headers: hdrs }, { method: context.method, responseKind: "error" });
-        return;
-    }
-    __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_respondWithPayload).call(this, msg, serialized.take(), { headers: hdrs }, { method: context.method, responseKind: "error" });
-}, _Trellis_startEphemeralEvent = function _Trellis_startEphemeralEvent(event, ctx, subject, fn, signal) {
-    const sub = this.nats.subscribe(subject);
-    if (signal) {
-        if (signal.aborted) {
-            sub.unsubscribe();
-            return ok(undefined);
-        }
-        signal.addEventListener("abort", () => sub.unsubscribe(), { once: true });
-    }
-    const task = AsyncResult.try(async () => {
-        for await (const msg of sub) {
-            const parsedEvent = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_parseEventMessage).call(this, event, ctx, msg);
-            const m = parsedEvent.take();
-            if (isErr(m)) {
-                __classPrivateFieldGet(this, _Trellis_log, "f").error({ error: m.error }, "Event validation failed");
-                continue;
-            }
-            const handlerResult = await AsyncResult.lift(fn(m));
-            if (handlerResult.isErr()) {
-                __classPrivateFieldGet(this, _Trellis_log, "f").error({
-                    error: handlerResult.error.toSerializable(),
-                    event,
-                    subject: msg.subject,
-                }, "Event handler failed");
-            }
-        }
-    });
-    __classPrivateFieldGet(this, _Trellis_tasks, "f").add(`event:${event}:${ulid()}`, task);
-    return ok(undefined);
-}, _Trellis_resolveEventConsumerGroup = function _Trellis_resolveEventConsumerGroup(event, opts) {
-    const metadata = __classPrivateFieldGet(this, _Trellis_eventConsumers, "f").metadata;
-    const bindings = __classPrivateFieldGet(this, _Trellis_eventConsumers, "f").bindings ?? {};
-    const groups = Object.entries(metadata ?? {})
-        .filter(([, group]) => group.events.some((entry) => entry.event === String(event)))
-        .map(([group]) => group);
-    if (opts?.group) {
-        if (!groups.includes(opts.group)) {
-            return err(new UnexpectedError({
-                cause: new Error(`Event '${String(event)}' is not declared in event consumer group '${opts.group}'.`),
-                context: { event: String(event), group: opts.group },
-            }));
-        }
-        if (!bindings[opts.group]) {
-            return err(new UnexpectedError({
-                cause: new Error(`Event consumer group '${opts.group}' has no Trellis-provisioned binding.`),
-                context: { event: String(event), group: opts.group },
-            }));
-        }
-        return ok(opts.group);
-    }
-    if (groups.length === 0) {
-        return err(new UnexpectedError({
-            cause: new Error(`Event '${String(event)}' is not declared in any event consumer group.`),
-            context: { event: String(event) },
-        }));
-    }
-    if (groups.length > 1) {
-        return err(new UnexpectedError({
-            cause: new Error(`Event '${String(event)}' is declared in multiple event consumer groups; pass opts.group.`),
-            context: { event: String(event), groups },
-        }));
-    }
-    const group = groups[0];
-    if (!bindings[group]) {
-        return err(new UnexpectedError({
-            cause: new Error(`Event consumer group '${group}' has no Trellis-provisioned binding.`),
-            context: { event: String(event), group },
-        }));
-    }
-    return ok(group);
-}, _Trellis_registerDurableEventHandler = function _Trellis_registerDurableEventHandler(args) {
-    if (args.signal?.aborted)
-        return;
-    const loop = __classPrivateFieldGet(this, _Trellis_durableEventLoops, "f").get(args.group) ?? {
-        registrations: [],
-        started: false,
-    };
-    const registration = {
-        event: args.event,
-        ctx: args.ctx,
-        subject: args.subject,
-        fn: args.fn,
-    };
-    loop.registrations.push(registration);
-    __classPrivateFieldGet(this, _Trellis_durableEventLoops, "f").set(args.group, loop);
-    args.signal?.addEventListener("abort", () => {
-        const index = loop.registrations.indexOf(registration);
-        if (index >= 0)
-            loop.registrations.splice(index, 1);
-        if (!__classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_durableEventConsumerGroupReady).call(this, args.group, loop)) {
-            loop.messages?.stop();
-        }
-    }, { once: true });
-    __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_startDurableEventConsumer).call(this, args.group, loop);
-}, _Trellis_startDurableEventConsumer = function _Trellis_startDurableEventConsumer(group, loop) {
-    if (loop.started || !__classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_durableEventConsumerGroupReady).call(this, group, loop)) {
-        return;
-    }
-    loop.started = true;
-    __classPrivateFieldGet(this, _Trellis_tasks, "f").add(`event-consumer:${group}:${ulid()}`, __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_runDurableEventConsumer).call(this, group, loop));
-}, _Trellis_durableEventConsumerGroupReady = function _Trellis_durableEventConsumerGroupReady(group, loop) {
-    const metadata = __classPrivateFieldGet(this, _Trellis_eventConsumers, "f").metadata?.[group];
-    if (!metadata)
-        return false;
-    return metadata.events.every((entry) => loop.registrations.some((registration) => String(registration.event) === entry.event));
-}, _Trellis_runDurableEventConsumer = function _Trellis_runDurableEventConsumer(group, loop) {
-    return AsyncResult.from((async () => {
-        const binding = __classPrivateFieldGet(this, _Trellis_eventConsumers, "f").bindings?.[group];
-        if (!binding) {
-            return err(new UnexpectedError({
-                cause: new Error(`Event consumer group '${group}' has no Trellis-provisioned binding.`),
-                context: { group },
-            }));
-        }
-        try {
-            const infoResult = await AsyncResult.try(async () => {
-                const jsm = await jetstreamManager(this.nats);
-                return await jsm.consumers.info(binding.stream, binding.consumerName);
-            });
-            const info = infoResult.take();
-            if (isErr(info))
-                return info;
-            const consumer = this.js.consumers.getConsumerFromInfo(info);
-            while (__classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_durableEventConsumerGroupReady).call(this, group, loop)) {
-                const messages = await consumer.fetch({
-                    max_messages: 1,
-                    expires: 30_000,
-                });
-                loop.messages = messages;
-                if (!__classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_durableEventConsumerGroupReady).call(this, group, loop)) {
-                    messages.stop();
-                    break;
-                }
-                await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_handleDurableEventConsumer).call(this, group, loop, messages)
-                    .orThrow();
-            }
-        }
-        finally {
-            loop.started = false;
-            loop.messages = undefined;
-            __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_startDurableEventConsumer).call(this, group, loop);
-        }
-        return ok(undefined);
-    })());
-}, _Trellis_handleDurableEvent = function _Trellis_handleDurableEvent(event, ctx, messages, fn) {
-    return AsyncResult.try(async () => {
-        for await (const msg of messages) {
-            const parsedEvent = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_parseEventMessage).call(this, event, ctx, msg);
-            const m = parsedEvent.take();
-            if (isErr(m)) {
-                __classPrivateFieldGet(this, _Trellis_log, "f").error({ error: m.error }, "Event validation failed");
-                msg.term();
-                continue;
-            }
-            const handlerResult = await AsyncResult.lift(fn(m));
-            if (handlerResult.isErr()) {
-                __classPrivateFieldGet(this, _Trellis_log, "f").error({
-                    error: handlerResult.error.toSerializable(),
-                    event,
-                    subject: msg.subject,
-                }, "Event handler failed");
-                msg.nak();
-                continue;
-            }
-            msg.ack();
-        }
-    });
-}, _Trellis_handleDurableEventConsumer = function _Trellis_handleDurableEventConsumer(group, loop, messages) {
-    return AsyncResult.try(async () => {
-        for await (const msg of messages) {
-            if (!__classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_durableEventConsumerGroupReady).call(this, group, loop)) {
-                messages.stop();
-                break;
-            }
-            const matching = loop.registrations.filter((registration) => natsSubjectMatches(registration.subject, msg.subject));
-            if (matching.length === 0) {
-                __classPrivateFieldGet(this, _Trellis_log, "f").warn({ group, subject: msg.subject }, "Durable event consumer received message without registered handler");
-                msg.nak();
-                continue;
-            }
-            let failed = false;
-            for (const registration of matching) {
-                const parsedEvent = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_parseEventMessage).call(this, registration.event, registration.ctx, msg);
-                const eventPayload = parsedEvent.take();
-                if (isErr(eventPayload)) {
-                    __classPrivateFieldGet(this, _Trellis_log, "f").error({ error: eventPayload.error }, "Event validation failed");
-                    msg.term();
-                    failed = true;
-                    break;
-                }
-                const handlerResult = await AsyncResult.lift(registration.fn(eventPayload));
-                if (handlerResult.isErr()) {
-                    __classPrivateFieldGet(this, _Trellis_log, "f").error({
-                        error: handlerResult.error.toSerializable(),
-                        event: registration.event,
-                        subject: msg.subject,
-                    }, "Event handler failed");
-                    msg.nak();
-                    failed = true;
-                    break;
-                }
-            }
-            if (!failed)
-                msg.ack();
-        }
-    });
-}, _Trellis_parseEventMessage = function _Trellis_parseEventMessage(event, ctx, msg) {
-    const jsonData = Result.try(() => msg.json());
-    const json = jsonData.take();
-    if (isErr(json)) {
-        __classPrivateFieldGet(this, _Trellis_log, "f").error({ error: json.error, event, subject: msg.subject }, "Event parse failed");
-        return json;
-    }
-    return parseRuntimeSchema(ctx.event, json);
-}, _Trellis_escapeSubjectToken = function _Trellis_escapeSubjectToken(token) {
-    const out = token.replace(NATS_SUBJECT_TOKEN_FORBIDDEN, (ch) => `~${ch.codePointAt(0).toString(16).toUpperCase()}~`);
-    // Protect stapRet with $ due to NATS internal use of it
-    if (out.length === 0 || out.startsWith("$")) {
-        return `_${out}`;
-    }
-    return out;
-}, _Trellis_currentIat = function _Trellis_currentIat() {
-    return this.auth.currentIat?.() ?? Math.floor(Date.now() / 1000);
-}, _Trellis_createProof = async function _Trellis_createProof(subject, payload) {
-    const payloadBytes = new TextEncoder().encode(payload);
-    const payloadHash = await sha256(payloadBytes);
-    const iat = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_currentIat).call(this);
-    const requestId = ulid();
-    const input = buildProofInput(this.auth.sessionKey, subject, payloadHash, iat, requestId);
-    const digest = await sha256(input);
-    const sigBytes = await this.auth.sign(digest);
-    return { proof: base64urlEncode(sigBytes), iat, requestId };
-}, _Trellis_requestMessageWithRetry = async function _Trellis_requestMessageWithRetry(args) {
-    for (let retry = 0; retry <= __classPrivateFieldGet(this, _Trellis_noResponderMaxRetries, "f"); retry++) {
-        const result = await AsyncResult.try(() => this.nats.request(args.subject, args.payload, {
-            headers: args.headers,
-            timeout: args.timeout,
-        }));
-        if (result.isOk()) {
-            return ok(result.take());
-        }
-        const cause = result.error.cause;
-        const message = cause instanceof Error ? cause.message : String(cause);
-        const isNoResponders = message.includes("no responders");
-        if (isNoResponders && retry < __classPrivateFieldGet(this, _Trellis_noResponderMaxRetries, "f")) {
-            __classPrivateFieldGet(this, _Trellis_log, "f").debug({ method: args.method, subject: args.subject, retry }, "No responders, retrying...");
-            await new Promise((resolve) => setTimeout(resolve, __classPrivateFieldGet(this, _Trellis_noResponderRetryMs, "f") * (retry + 1)));
-            continue;
-        }
-        __classPrivateFieldGet(this, _Trellis_log, "f").warn({ method: args.method, subject: args.subject, error: message }, "NATS request failed");
-        return err(classifyRequestTransportFailure({
-            method: args.method,
-            subject: args.subject,
-            callerCapabilities: args.callerCapabilities,
-            cause,
-        }));
-    }
-    return err(requestFailedTransportError({
-        code: "trellis.request.retry_exhausted",
-        message: "Trellis could not complete the request after retrying.",
-        hint: "Retry the request. If it keeps failing, check that the target service is available.",
-        method: args.method,
-        subject: args.subject,
-        context: { retries: __classPrivateFieldGet(this, _Trellis_noResponderMaxRetries, "f") + 1 },
-    }));
-}, _Trellis_requestJson = function _Trellis_requestJson(subject, body) {
-    return AsyncResult.from((async () => {
-        const span = startClientSpan(subject, subject);
-        return await withSpanAsync(span, async () => {
-            try {
-                const payload = JSON.stringify(body);
-                const authHeaders = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createProof).call(this, subject, payload);
-                const headers = natsHeaders();
-                headers.set("session-key", this.auth.sessionKey);
-                headers.set("proof", authHeaders.proof);
-                headers.set("iat", String(authHeaders.iat));
-                headers.set("request-id", authHeaders.requestId);
-                injectTraceContext(createNatsHeaderCarrier(headers), span);
-                const response = (await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestMessageWithRetry).call(this, {
-                    subject,
-                    payload,
-                    headers,
-                    timeout: this.timeout,
-                })).take();
-                if (isErr(response)) {
-                    span.setStatus({
-                        code: SpanStatusCode.ERROR,
-                        message: response.error.message,
-                    });
-                    return response;
-                }
-                const json = safeJson(response).take();
-                if (isErr(json)) {
-                    const error = createTransportError({
-                        code: "trellis.request.invalid_response",
-                        message: "Trellis returned an invalid response.",
-                        hint: "Retry the request. If it keeps happening, reconnect to Trellis and try again.",
-                        cause: json.error.cause,
-                        context: { subject },
-                    });
-                    span.setStatus({
-                        code: SpanStatusCode.ERROR,
-                        message: error.message,
-                    });
-                    return err(error);
-                }
-                span.setStatus({ code: SpanStatusCode.OK });
-                return ok(json);
-            }
-            catch (cause) {
-                const error = new UnexpectedError({ cause });
-                span.setStatus({
-                    code: SpanStatusCode.ERROR,
-                    message: error.message,
-                });
-                span.recordException(error);
-                return err(error);
-            }
-            finally {
-                span.end();
-            }
-        });
-    })());
-}, _Trellis_watchJson = function _Trellis_watchJson(subject, body) {
-    return AsyncResult.from((async () => {
-        const payload = JSON.stringify(body);
-        const authHeaders = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createProof).call(this, subject, payload);
-        const headers = natsHeaders();
-        headers.set("session-key", this.auth.sessionKey);
-        headers.set("proof", authHeaders.proof);
-        headers.set("iat", String(authHeaders.iat));
-        headers.set("request-id", authHeaders.requestId);
-        const inbox = createInbox(`_INBOX.${this.auth.sessionKey.slice(0, 16)}`);
-        const sub = this.nats.subscribe(inbox);
-        try {
-            this.nats.publish(subject, payload, {
-                headers,
-                reply: inbox,
-            });
-            await this.nats.flush();
-        }
-        catch (cause) {
-            sub.unsubscribe();
-            return err(createTransportError({
-                code: "trellis.watch.failed",
-                message: "Trellis could not start the operation watch.",
-                hint: "Retry watching the operation. If it keeps failing, reconnect to Trellis and try again.",
-                cause,
-                context: { subject },
-            }));
-        }
-        return ok((async function* () {
-            try {
-                for await (const msg of sub) {
-                    if (msg.headers?.get("status") === "error") {
-                        yield err(createTransportError({
-                            code: "trellis.watch.failed",
-                            message: "Trellis stopped the operation watch.",
-                            hint: "Retry watching the operation. If it keeps happening, reconnect to Trellis and try again.",
-                            context: { subject, frame: msg.string() },
-                        }));
-                        continue;
-                    }
-                    const json = safeJson(msg).take();
-                    if (isErr(json)) {
-                        yield err(createTransportError({
-                            code: "trellis.watch.invalid_response",
-                            message: "Trellis returned an invalid watch update.",
-                            hint: "Retry watching the operation. If it keeps happening, reconnect to Trellis and try again.",
-                            cause: json.error.cause,
-                            context: { subject },
-                        }));
-                        continue;
-                    }
-                    yield ok(json);
-                }
-            }
-            finally {
-                sub.unsubscribe();
-            }
-        })());
-    })());
-};