@qlever-llc/trellis 0.5.1 → 0.6.0

package/script/trellis/trellis.js

@@ -1,5 +1,4 @@
 "use strict";
-// @ts-nocheck
 var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
     if (kind === "m") throw new TypeError("Private method is not writable");
     if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
@@ -11,28 +10,45 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _Trellis_instances, _Trellis_log, _Trellis_tasks, _Trellis_noResponderMaxRetries, _Trellis_noResponderRetryMs, _Trellis_authBypassMethods, _Trellis_handleRPC, _Trellis_processRPCMessage, _Trellis_respondWithError, _Trellis_handleEvent, _Trellis_escapeSubjectToken, _Trellis_createProof, _TrellisServer_version, _TrellisServer_log;
+var _Trellis_instances, _Trellis_log, _Trellis_tasks, _Trellis_hasExplicitApi, _Trellis_noResponderMaxRetries, _Trellis_noResponderRetryMs, _Trellis_authBypassMethods, _Trellis_operationStore, _Trellis_unknownApiError, _Trellis_handleRPC, _Trellis_processRPCMessage, _Trellis_respondWithError, _Trellis_handleEvent, _Trellis_escapeSubjectToken, _Trellis_createProof, _Trellis_requestJson, _Trellis_watchJson;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TrellisServer = exports.Trellis = void 0;
+exports.Trellis = exports.DurableOperationRecordSchema = void 0;
+exports.safeJson = safeJson;
+exports.base64urlEncode = base64urlEncode;
+exports.base64urlDecode = base64urlDecode;
+exports.toArrayBuffer = toArrayBuffer;
+exports.sha256 = sha256;
+exports.buildProofInput = buildProofInput;
+exports.isResultLike = isResultLike;
+exports.buildRuntimeOperationSnapshot = buildRuntimeOperationSnapshot;
+exports.isTerminalRuntimeOperationSnapshot = isTerminalRuntimeOperationSnapshot;
 const jetstream_1 = require("@nats-io/jetstream");
 const nats_core_1 = require("@nats-io/nats-core");
-const trellis_result_1 = require("@qlever-llc/trellis-result");
-const trellis_sdk_core_1 = require("@qlever-llc/trellis-sdk-core");
-const trellis_telemetry_1 = require("@qlever-llc/trellis-telemetry");
+const result_1 = require("@qlever-llc/result");
+const tracing_ts_1 = require("./tracing.ts");
+const typebox_1 = require("typebox");
 const value_1 = require("typebox/value");
 const ulid_1 = require("ulid");
-const codec_js_1 = require("./codec.js");
-const index_js_1 = require("./errors/index.js");
-const RemoteError_js_1 = require("./errors/RemoteError.js");
-const globals_js_1 = require("./globals.js");
-const TrellisError_js_1 = require("./models/trellis/TrellisError.js");
-const tasks_js_1 = require("./tasks.js");
+const codec_ts_1 = require("./codec.ts");
+const index_ts_1 = require("./errors/index.ts");
+const RemoteError_ts_1 = require("./errors/RemoteError.ts");
+const globals_ts_1 = require("./globals.ts");
+const kv_ts_1 = require("./kv.ts");
+const TrellisError_ts_1 = require("./models/trellis/TrellisError.ts");
+const operations_ts_1 = require("./operations.ts");
+const tasks_ts_1 = require("./tasks.ts");
 /**
  * Safely extract JSON from a NATS message.
  * The .json() method can throw if the message data is not valid JSON.
  */
 function safeJson(msg) {
-    return trellis_result_1.Result.try(() => msg.json());
+    return result_1.Result.try(() => msg.json());
+}
+function encodeRuntimeSchema(schema, data) {
+    return (0, codec_ts_1.encodeSchema)(schema, data);
+}
+function parseRuntimeSchema(schema, data) {
+    return (0, codec_ts_1.parseUnknownSchema)(schema, data);
 }
 function base64urlEncode(data) {
     const b64 = btoa(String.fromCharCode(...data));
@@ -86,9 +102,90 @@ function buildProofInput(sessionKey, subject, payloadHash) {
     buf.set(payloadHash, offset);
     return buf;
 }
+function isResultLike(value) {
+    return value instanceof result_1.Result;
+}
+const DurableOperationSnapshotSchema = typebox_1.Type.Object({
+    id: typebox_1.Type.String(),
+    service: typebox_1.Type.String(),
+    operation: typebox_1.Type.String(),
+    revision: typebox_1.Type.Number(),
+    state: typebox_1.Type.Union([
+        typebox_1.Type.Literal("pending"),
+        typebox_1.Type.Literal("running"),
+        typebox_1.Type.Literal("completed"),
+        typebox_1.Type.Literal("failed"),
+        typebox_1.Type.Literal("cancelled"),
+    ]),
+    createdAt: typebox_1.Type.String(),
+    updatedAt: typebox_1.Type.String(),
+    completedAt: typebox_1.Type.Optional(typebox_1.Type.String()),
+    progress: typebox_1.Type.Optional(typebox_1.Type.Any()),
+    output: typebox_1.Type.Optional(typebox_1.Type.Any()),
+    error: typebox_1.Type.Optional(typebox_1.Type.Object({
+        type: typebox_1.Type.String(),
+        message: typebox_1.Type.String(),
+    })),
+});
+exports.DurableOperationRecordSchema = typebox_1.Type.Object({
+    ownerSessionKey: typebox_1.Type.String(),
+    sequence: typebox_1.Type.Number(),
+    snapshot: DurableOperationSnapshotSchema,
+});
+function buildRuntimeOperationSnapshot(runtime, state, patch) {
+    const updatedAt = new Date().toISOString();
+    const completedAt = state === "completed" || state === "failed" || state === "cancelled"
+        ? (patch?.completedAt ?? updatedAt)
+        : patch?.completedAt;
+    return {
+        id: runtime.id,
+        service: runtime.service,
+        operation: runtime.operation,
+        revision: patch?.revision ?? runtime.snapshot.revision + 1,
+        state,
+        createdAt: patch?.createdAt ?? runtime.snapshot.createdAt,
+        updatedAt,
+        ...(completedAt ? { completedAt } : {}),
+        ...(patch?.progress !== undefined
+            ? { progress: patch.progress }
+            : runtime.snapshot.progress !== undefined
+                ? { progress: runtime.snapshot.progress }
+                : {}),
+        ...(patch?.output !== undefined
+            ? { output: patch.output }
+            : runtime.snapshot.output !== undefined
+                ? { output: runtime.snapshot.output }
+                : {}),
+        ...(patch?.error
+            ? { error: patch.error }
+            : runtime.snapshot.error
+                ? { error: runtime.snapshot.error }
+                : {}),
+    };
+}
+function isRuntimeOperationSnapshot(value) {
+    return !!value && typeof value === "object" &&
+        typeof value.id === "string" &&
+        typeof value.service === "string" &&
+        typeof value.operation === "string" &&
+        typeof value.revision === "number" &&
+        typeof value.state === "string" &&
+        typeof value.createdAt === "string" &&
+        typeof value.updatedAt === "string";
+}
+function isTerminalRuntimeOperationSnapshot(value) {
+    return isRuntimeOperationSnapshot(value) && (value.state === "completed" || value.state === "failed" ||
+        value.state === "cancelled");
+}
 const NATS_SUBJECT_TOKEN_FORBIDDEN = /[\u0000\s.*>~]/gu;
 const DEFAULT_NO_RESPONDER_MAX_RETRIES = 2;
 const DEFAULT_NO_RESPONDER_RETRY_MS = 200;
+const EMPTY_TRELLIS_API = {
+    rpc: {},
+    operations: {},
+    events: {},
+    subjects: {},
+};
 class Trellis {
     constructor(name, // Must be unique for a service
     nats, auth, opts) {
@@ -137,23 +234,27 @@ class Trellis {
         });
         _Trellis_log.set(this, void 0);
         _Trellis_tasks.set(this, void 0);
+        _Trellis_hasExplicitApi.set(this, void 0);
         _Trellis_noResponderMaxRetries.set(this, void 0);
         _Trellis_noResponderRetryMs.set(this, void 0);
         _Trellis_authBypassMethods.set(this, void 0);
+        _Trellis_operationStore.set(this, void 0);
+        const api = opts?.api;
         this.name = name;
         this.nats = nats;
         this.js = (0, jetstream_1.jetstream)(this.nats);
         this.auth = auth;
-        this.api = (opts?.api ?? trellis_sdk_core_1.API);
-        __classPrivateFieldSet(this, _Trellis_log, (opts?.log ?? globals_js_1.logger).child({ lib: "trellis" }), "f");
+        this.api = (api ?? EMPTY_TRELLIS_API);
+        __classPrivateFieldSet(this, _Trellis_log, (opts?.log ?? globals_ts_1.logger).child({ lib: "trellis" }), "f");
         this.timeout = opts?.timeout ?? 3000;
         this.stream = opts?.stream ?? "trellis";
+        __classPrivateFieldSet(this, _Trellis_hasExplicitApi, api !== undefined, "f");
         __classPrivateFieldSet(this, _Trellis_noResponderMaxRetries, opts?.noResponderRetry?.maxAttempts ??
             DEFAULT_NO_RESPONDER_MAX_RETRIES, "f");
         __classPrivateFieldSet(this, _Trellis_noResponderRetryMs, opts?.noResponderRetry?.baseDelayMs ??
             DEFAULT_NO_RESPONDER_RETRY_MS, "f");
         __classPrivateFieldSet(this, _Trellis_authBypassMethods, new Set(opts?.authBypassMethods ?? []), "f");
-        __classPrivateFieldSet(this, _Trellis_tasks, new tasks_js_1.TrellisTasks({ log: __classPrivateFieldGet(this, _Trellis_log, "f") }), "f");
+        __classPrivateFieldSet(this, _Trellis_tasks, new tasks_ts_1.TrellisTasks({ log: __classPrivateFieldGet(this, _Trellis_log, "f") }), "f");
     }
     /**
      * Returns the underlying NATS connection.
@@ -161,6 +262,41 @@ class Trellis {
     get natsConnection() {
         return this.nats;
     }
+    async operationStoreHandle() {
+        if (!__classPrivateFieldGet(this, _Trellis_operationStore, "f")) {
+            const bucket = `trellis_operations_${this.name.replace(/[^A-Za-z0-9_-]/g, "_")}`;
+            __classPrivateFieldSet(this, _Trellis_operationStore, (async () => {
+                const result = await kv_ts_1.TypedKV.open(this.nats, bucket, exports.DurableOperationRecordSchema, {
+                    history: 5,
+                    ttl: 0,
+                });
+                const value = result.take();
+                if ((0, result_1.isErr)(value)) {
+                    throw value.error;
+                }
+                return value;
+            })(), "f");
+        }
+        return __classPrivateFieldGet(this, _Trellis_operationStore, "f");
+    }
+    async loadOperationRecord(operationId) {
+        const store = await this.operationStoreHandle();
+        const entry = await store.get(operationId);
+        const value = entry.take();
+        if ((0, result_1.isErr)(value)) {
+            return null;
+        }
+        return value.value;
+    }
+    async saveOperationRecord(runtime) {
+        const store = await this.operationStoreHandle();
+        const record = {
+            ownerSessionKey: runtime.ownerSessionKey,
+            sequence: runtime.sequence,
+            snapshot: runtime.snapshot,
+        };
+        await store.put(runtime.id, record);
+    }
     /**
      * Makes an authenticated request to a Trellis RPC method.
      *
@@ -174,44 +310,42 @@ class Trellis {
      *              ok: A validated reponse of method M
      *              err: RemoteError | ValidationError | UnexpectedError
      */
-    // TypeScript hits recursion limits on this generic surface under the app's Svelte check.
-    // The implementation still builds and is exercised by runtime validation below.
-    // @ts-expect-error
     async request(method, input, opts) {
-        __classPrivateFieldGet(this, _Trellis_log, "f").trace({ method: String(method), input: input }, `Calling ${method.toString()}.`);
-        const ctx = this.api["rpc"][method];
+        __classPrivateFieldGet(this, _Trellis_log, "f").trace({ method: String(method) }, `Calling ${method.toString()}.`);
+        const methodName = method;
+        const ctx = this.api["rpc"][methodName];
         if (!ctx) {
-            return (0, trellis_result_1.err)(new index_js_1.UnexpectedError({
-                cause: new Error(`Unknown RPC method '${method.toString()}'. Did you forget to include its API module?`),
+            return (0, result_1.err)(new index_ts_1.UnexpectedError({
+                cause: __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_unknownApiError).call(this, "RPC method", method.toString()),
                 context: { method: method.toString() },
             }));
         }
-        const msg = (0, codec_js_1.encodeSchema)(ctx.input, input).take();
-        if ((0, trellis_result_1.isErr)(msg)) {
+        const msg = encodeRuntimeSchema(ctx.input, input).take();
+        if ((0, result_1.isErr)(msg)) {
             return msg;
         }
         const subject = this.template(ctx.subject, input).take();
-        if ((0, trellis_result_1.isErr)(subject)) {
+        if ((0, result_1.isErr)(subject)) {
             return subject;
         }
         // Start a client span for this RPC request
-        const span = (0, trellis_telemetry_1.startClientSpan)(method, subject);
+        const span = (0, tracing_ts_1.startClientSpan)(method, subject);
         const attempt = async () => {
             const proof = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createProof).call(this, subject, msg);
             const headers = (0, nats_core_1.headers)();
             headers.set("session-key", this.auth.sessionKey);
             headers.set("proof", proof);
             // Inject trace context into NATS headers for propagation
-            (0, trellis_telemetry_1.injectTraceContext)((0, trellis_telemetry_1.createNatsHeaderCarrier)(headers), span);
+            (0, tracing_ts_1.injectTraceContext)((0, tracing_ts_1.createNatsHeaderCarrier)(headers), span);
             // Attempt request with retry for transient "no responders" errors
             const requestWithRetry = async () => {
                 for (let retry = 0; retry <= __classPrivateFieldGet(this, _Trellis_noResponderMaxRetries, "f"); retry++) {
-                    const result = await trellis_result_1.AsyncResult.try(() => this.nats.request(subject, msg, {
+                    const result = await result_1.AsyncResult.try(() => this.nats.request(subject, msg, {
                         headers,
                         timeout: opts?.timeout ?? this.timeout,
                     }));
                     if (result.isOk()) {
-                        return (0, trellis_result_1.ok)((await result).take());
+                        return (0, result_1.ok)((await result).take());
                     }
                     const cause = result.error.cause;
                     const message = cause instanceof Error
@@ -230,7 +364,7 @@ class Trellis {
                     const reason = isNatsPermission
                         ? `Permission denied. You need one of these capabilities: ${ctx.callerCapabilities.join(", ")}`
                         : message;
-                    return (0, trellis_result_1.err)(new index_js_1.UnexpectedError({
+                    return (0, result_1.err)(new index_ts_1.UnexpectedError({
                         cause,
                         context: {
                             method,
@@ -242,114 +376,144 @@ class Trellis {
                     }));
                 }
                 // Should be unreachable, but TypeScript needs explicit return
-                return (0, trellis_result_1.err)(new index_js_1.UnexpectedError({
+                return (0, result_1.err)(new index_ts_1.UnexpectedError({
                     context: { method, subject, reason: "retry loop exhausted" },
                 }));
             };
             const msgResult = await requestWithRetry();
             const m = msgResult.take();
-            if ((0, trellis_result_1.isErr)(m)) {
+            if ((0, result_1.isErr)(m)) {
                 return m;
             }
             if (m.headers?.get("status") === "error") {
                 const json = safeJson(m).take();
-                if ((0, trellis_result_1.isErr)(json)) {
+                if ((0, result_1.isErr)(json)) {
                     return json;
                 }
-                const error = (0, codec_js_1.parse)(TrellisError_js_1.TrellisErrorDataSchema, json).take();
-                if ((0, trellis_result_1.isErr)(error)) {
+                const error = (0, codec_ts_1.parse)(TrellisError_ts_1.TrellisErrorDataSchema, json).take();
+                if ((0, result_1.isErr)(error)) {
                     return error;
                 }
-                return (0, trellis_result_1.err)(new RemoteError_js_1.RemoteError({ error }));
+                return (0, result_1.err)(new RemoteError_ts_1.RemoteError({ error }));
             }
             const json = safeJson(m).take();
-            if ((0, trellis_result_1.isErr)(json)) {
+            if ((0, result_1.isErr)(json)) {
                 return json;
             }
-            const outputResult = (0, codec_js_1.parseSchema)(ctx.output, json);
-            if (outputResult.isErr()) {
-                return outputResult;
+            const outputResult = parseRuntimeSchema(ctx.output, json).take();
+            if ((0, result_1.isErr)(outputResult)) {
+                return (0, result_1.err)(outputResult.error);
             }
-            const output = outputResult.take();
-            return (0, trellis_result_1.ok)(output);
+            return (0, result_1.ok)(outputResult);
         };
-        return (0, trellis_telemetry_1.withSpanAsync)(span, async () => {
+        return (0, tracing_ts_1.withSpanAsync)(span, async () => {
             try {
                 const result = await attempt();
                 const value = result.take();
-                if ((0, trellis_result_1.isErr)(value)) {
+                if ((0, result_1.isErr)(value)) {
                     span.setStatus({
-                        code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                        code: tracing_ts_1.SpanStatusCode.ERROR,
                         message: value.error.message,
                     });
                 }
                 else {
-                    span.setStatus({ code: trellis_telemetry_1.SpanStatusCode.OK });
+                    span.setStatus({ code: tracing_ts_1.SpanStatusCode.OK });
                 }
                 return result;
             }
             catch (cause) {
-                const unexpected = new index_js_1.UnexpectedError({ cause });
+                const unexpected = new index_ts_1.UnexpectedError({ cause });
                 span.setStatus({
-                    code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                    code: tracing_ts_1.SpanStatusCode.ERROR,
                     message: unexpected.message,
                 });
                 span.recordException(unexpected);
-                return (0, trellis_result_1.err)(unexpected);
+                return (0, result_1.err)(unexpected);
             }
             finally {
                 span.end();
             }
         });
     }
+    async requestOrThrow(method, input, opts) {
+        const result = await this.request(method, input, opts);
+        const value = result.take();
+        if ((0, result_1.isErr)(value)) {
+            throw value.error;
+        }
+        return value;
+    }
+    operation(operation) {
+        const descriptor = this.api["operations"]?.[operation];
+        if (!descriptor) {
+            throw __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_unknownApiError).call(this, "operation", operation.toString());
+        }
+        const transport = {
+            requestJson: (subject, body) => __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_requestJson).call(this, subject, body),
+            watchJson: (subject, body) => __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_watchJson).call(this, subject, body),
+        };
+        return new operations_ts_1.OperationInvoker(transport, descriptor);
+    }
     /*
      * Mount a handler to process requests made to a specific Trellis API
      */
     async mount(method, fn) {
-        __classPrivateFieldGet(this, _Trellis_tasks, "f").add(method, __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_handleRPC).call(this, method, fn));
+        const methodName = method;
+        const ctx = this.api["rpc"][methodName];
+        if (!ctx) {
+            throw __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_unknownApiError).call(this, "RPC method", method.toString());
+        }
+        const task = __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_handleRPC).call(this, methodName, fn);
+        __classPrivateFieldGet(this, _Trellis_tasks, "f").add(methodName, task);
+    }
+    respondWithError(msg, error) {
+        __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_respondWithError).call(this, msg, error);
     }
     async publish(event, data) {
-        const ctx = this.api["events"][event];
+        const eventName = event;
+        const ctx = this.api["events"][eventName];
         if (!ctx) {
-            return (0, trellis_result_1.err)(new index_js_1.UnexpectedError({
-                cause: new Error(`Unknown event '${event.toString()}'. Did you forget to include its API module?`),
+            return (0, result_1.err)(new index_ts_1.UnexpectedError({
+                cause: __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_unknownApiError).call(this, "event", event.toString()),
                 context: { event: event.toString() },
             }));
         }
         const subject = this.template(ctx.subject, data).take();
-        if ((0, trellis_result_1.isErr)(subject)) {
-            globals_js_1.logger.error({ err: subject.error }, "Failed to template event.");
+        if ((0, result_1.isErr)(subject)) {
+            globals_ts_1.logger.error({ err: subject.error }, "Failed to template event.");
             return subject;
         }
-        const msg = (0, codec_js_1.encodeSchema)(ctx.event, {
+        const payload = {
             ...data,
             header: {
                 id: (0, ulid_1.ulid)(),
                 time: new Date().toISOString(),
             },
-        }).take();
-        if ((0, trellis_result_1.isErr)(msg)) {
-            globals_js_1.logger.error({ err: msg.error }, "Failed to encode event.");
-            return msg;
+        };
+        const msg = (0, codec_ts_1.encodeSchema)(ctx.event, payload).take();
+        if ((0, result_1.isErr)(msg)) {
+            globals_ts_1.logger.error({ err: msg.error }, "Failed to encode event.");
+            return (0, result_1.err)(new index_ts_1.UnexpectedError({ cause: msg.error }));
         }
-        globals_js_1.logger.trace({ subject }, `Publishing ${event.toString()} event.`);
+        globals_ts_1.logger.trace({ subject }, `Publishing ${event.toString()} event.`);
         await this.js.publish(subject, msg);
-        return (0, trellis_result_1.ok)(undefined);
+        return (0, result_1.ok)(undefined);
     }
     async event(event, subjectData, fn) {
-        const ctx = this.api["events"][event];
+        const eventName = event;
+        const ctx = this.api["events"][eventName];
         if (!ctx) {
-            return (0, trellis_result_1.err)(new index_js_1.UnexpectedError({
-                cause: new Error(`Unknown event '${event.toString()}'. Did you forget to include its API module?`),
+            return (0, result_1.err)(new index_ts_1.UnexpectedError({
+                cause: __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_unknownApiError).call(this, "event", event.toString()),
                 context: { event: event.toString() },
             }));
         }
         const jsm = await (0, jetstream_1.jetstreamManager)(this.nats);
         const subject = this.template(ctx.subject, subjectData, true).take();
-        if ((0, trellis_result_1.isErr)(subject))
+        if ((0, result_1.isErr)(subject))
             return subject;
         const consumerName = `${this.name}-${event.replaceAll(".", "_")}`;
-        const addResult = await trellis_result_1.AsyncResult.try(() => jsm.consumers.add(this.stream, {
+        const addResult = await result_1.AsyncResult.try(() => jsm.consumers.add(this.stream, {
             durable_name: consumerName,
             ack_policy: "explicit",
             deliver_policy: "all",
@@ -358,13 +522,13 @@ class Trellis {
         // If add failed (consumer already exists), try to get existing consumer info
         const consumerInfoResult = addResult.isOk()
             ? addResult
-            : await trellis_result_1.AsyncResult.try(() => jsm.consumers.info(this.stream, consumerName));
+            : await result_1.AsyncResult.try(() => jsm.consumers.info(this.stream, consumerName));
         const info = consumerInfoResult.take();
-        if ((0, trellis_result_1.isErr)(info))
+        if ((0, result_1.isErr)(info))
             return info;
         const consumer = this.js.consumers.getConsumerFromInfo(info);
-        __classPrivateFieldGet(this, _Trellis_tasks, "f").add(event, __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_handleEvent).call(this, event, consumer, fn));
-        return (0, trellis_result_1.ok)(undefined);
+        __classPrivateFieldGet(this, _Trellis_tasks, "f").add(eventName, __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_handleEvent).call(this, eventName, consumer, fn));
+        return (0, result_1.ok)(undefined);
     }
     wait() {
         return __classPrivateFieldGet(this, _Trellis_tasks, "f").wait();
@@ -377,7 +541,7 @@ class Trellis {
             const key = placeholder.slice(1, -1); // Remove { and }
             const value = value_1.Pointer.Get(data, key);
             if ((value === undefined || value === null) && !allowWildcards) {
-                return (0, trellis_result_1.err)(new index_js_1.ValidationError({
+                return (0, result_1.err)(new index_ts_1.ValidationError({
                     errors: [
                         {
                             path: key,
@@ -398,24 +562,35 @@ class Trellis {
             }
             return __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_escapeSubjectToken).call(this, `${value}`);
         });
-        return (0, trellis_result_1.ok)(result);
+        return (0, result_1.ok)(result);
+    }
+    async requestAuthValidate(input) {
+        const request = this.request.bind(this);
+        const result = await request("Auth.ValidateRequest", input);
+        return result;
     }
 }
 exports.Trellis = Trellis;
-_Trellis_log = new WeakMap(), _Trellis_tasks = new WeakMap(), _Trellis_noResponderMaxRetries = new WeakMap(), _Trellis_noResponderRetryMs = new WeakMap(), _Trellis_authBypassMethods = new WeakMap(), _Trellis_instances = new WeakSet(), _Trellis_handleRPC = function _Trellis_handleRPC(method, fn, subjectData = {}) {
+_Trellis_log = new WeakMap(), _Trellis_tasks = new WeakMap(), _Trellis_hasExplicitApi = new WeakMap(), _Trellis_noResponderMaxRetries = new WeakMap(), _Trellis_noResponderRetryMs = new WeakMap(), _Trellis_authBypassMethods = new WeakMap(), _Trellis_operationStore = new WeakMap(), _Trellis_instances = new WeakSet(), _Trellis_unknownApiError = function _Trellis_unknownApiError(kind, name) {
+    const base = `Unknown ${kind} '${name}'.`;
+    if (__classPrivateFieldGet(this, _Trellis_hasExplicitApi, "f")) {
+        return new Error(`${base} Did you forget to include its API module?`);
+    }
+    return new Error(`${base} No API surface was provided. Pass opts.api, use createClient(contract, ...), or await createCoreClient(...) instead.`);
+}, _Trellis_handleRPC = function _Trellis_handleRPC(method, fn, subjectData = {}) {
     // Get API details
     const ctx = this.api["rpc"][method];
     const subject = this.template(ctx.subject, subjectData, true).take();
-    if ((0, trellis_result_1.isErr)(subject)) {
-        return trellis_result_1.AsyncResult.lift(subject);
+    if ((0, result_1.isErr)(subject)) {
+        return result_1.AsyncResult.lift(subject);
     }
     __classPrivateFieldGet(this, _Trellis_log, "f").info({ method: String(method) }, `Mounting ${method.toString()} RPC handler`);
     const sub = this.nats.subscribe(subject);
-    return trellis_result_1.AsyncResult.try(async () => {
+    return result_1.AsyncResult.try(async () => {
         for await (const msg of sub) {
             const resultPromise = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_processRPCMessage).call(this, method, ctx, msg, fn);
             const result = resultPromise.take();
-            if ((0, trellis_result_1.isErr)(result)) {
+            if ((0, result_1.isErr)(result)) {
                 __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_respondWithError).call(this, msg, result.error);
                 continue;
             }
@@ -425,42 +600,41 @@ _Trellis_log = new WeakMap(), _Trellis_tasks = new WeakMap(), _Trellis_noRespond
 }, _Trellis_processRPCMessage = async function _Trellis_processRPCMessage(method, ctx, msg, fn) {
     __classPrivateFieldGet(this, _Trellis_log, "f").debug({ method: String(method), subject: msg.subject }, "Processing RPC message");
     // Extract trace context from incoming NATS headers
-    const parentContext = (0, trellis_telemetry_1.extractTraceContext)((0, trellis_telemetry_1.createNatsHeaderCarrier)({
+    const parentContext = (0, tracing_ts_1.extractTraceContext)((0, tracing_ts_1.createNatsHeaderCarrier)({
         get: (k) => msg.headers?.get(k) ?? undefined,
         set: () => { }, // Server doesn't need to set headers on incoming messages
     }));
     // Start a server span for this RPC handler
-    const span = (0, trellis_telemetry_1.startServerSpan)(method, msg.subject, parentContext);
+    const span = (0, tracing_ts_1.startServerSpan)(method, msg.subject, parentContext);
     // Execute the handler within the span's context
-    return (0, trellis_telemetry_1.withSpanAsync)(span, async () => {
+    return (0, tracing_ts_1.withSpanAsync)(span, async () => {
         const execute = async () => {
             const jsonData = safeJson(msg).take();
-            if ((0, trellis_result_1.isErr)(jsonData)) {
+            if ((0, result_1.isErr)(jsonData)) {
                 __classPrivateFieldGet(this, _Trellis_log, "f").warn({ method, error: jsonData.error.message }, "Failed to parse JSON");
                 span.setStatus({
-                    code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                    code: tracing_ts_1.SpanStatusCode.ERROR,
                     message: "Failed to parse JSON",
                 });
                 return jsonData;
             }
-            const parsedInput = (0, codec_js_1.parseSchema)(ctx.input, jsonData).take();
-            if ((0, trellis_result_1.isErr)(parsedInput)) {
+            const parsedInput = parseRuntimeSchema(ctx.input, jsonData).take();
+            if ((0, result_1.isErr)(parsedInput)) {
                 span.setStatus({
-                    code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                    code: tracing_ts_1.SpanStatusCode.ERROR,
                     message: "Input validation failed",
                 });
                 return parsedInput;
             }
-            let user;
+            let caller;
             const callerSessionKey = msg.headers?.get("session-key") ?? "";
             const authRequired = ctx.authRequired ?? true;
             if (!authRequired || __classPrivateFieldGet(this, _Trellis_authBypassMethods, "f").has(method)) {
-                user = {
+                caller = {
+                    type: "service",
                     id: "system",
-                    origin: "trellis",
                     active: true,
                     name: "System",
-                    email: "system@trellis.internal",
                     capabilities: ["service"],
                 };
             }
@@ -470,25 +644,25 @@ _Trellis_log = new WeakMap(), _Trellis_tasks = new WeakMap(), _Trellis_noRespond
                 if (!sessionKey) {
                     __classPrivateFieldGet(this, _Trellis_log, "f").warn({ method }, "Missing session-key header");
                     span.setStatus({
-                        code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                        code: tracing_ts_1.SpanStatusCode.ERROR,
                         message: "Missing session-key",
                     });
-                    return (0, trellis_result_1.err)(new index_js_1.AuthError({ reason: "missing_session_key" }));
+                    return (0, result_1.err)(new index_ts_1.AuthError({ reason: "missing_session_key" }));
                 }
                 if (!proof) {
                     __classPrivateFieldGet(this, _Trellis_log, "f").warn({ method }, "Missing proof in request");
                     span.setStatus({
-                        code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                        code: tracing_ts_1.SpanStatusCode.ERROR,
                         message: "Missing proof",
                     });
-                    return (0, trellis_result_1.err)(new index_js_1.AuthError({ reason: "missing_proof" }));
+                    return (0, result_1.err)(new index_ts_1.AuthError({ reason: "missing_proof" }));
                 }
                 // Verify proof signature locally using the raw request bytes we received.
                 const payloadBytes = msg.data ?? new Uint8Array();
                 const payloadHash = await sha256(payloadBytes);
                 const proofInput = buildProofInput(sessionKey, msg.subject, payloadHash);
                 const digest = await sha256(proofInput);
-                const verifyResult = await trellis_result_1.AsyncResult.try(async () => {
+                const verifyResult = await result_1.AsyncResult.try(async () => {
                     const publicKeyRaw = base64urlDecode(sessionKey);
                     const pub = await crypto.subtle.importKey("raw", toArrayBuffer(publicKeyRaw), { name: "Ed25519" }, true, ["verify"]);
                     return crypto.subtle.verify({ name: "Ed25519" }, pub, toArrayBuffer(base64urlDecode(proof)), toArrayBuffer(digest));
@@ -497,15 +671,15 @@ _Trellis_log = new WeakMap(), _Trellis_tasks = new WeakMap(), _Trellis_noRespond
                     (await verifyResult).take() === true;
                 if (!signatureOk) {
                     span.setStatus({
-                        code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                        code: tracing_ts_1.SpanStatusCode.ERROR,
                         message: "Invalid signature",
                     });
-                    return (0, trellis_result_1.err)(new index_js_1.AuthError({
+                    return (0, result_1.err)(new index_ts_1.AuthError({
                         reason: "invalid_signature",
                         context: { sessionKey },
                     }));
                 }
-                const authResult = await this.request("Auth.ValidateRequest", {
+                const authResult = await this.requestAuthValidate({
                     sessionKey,
                     proof,
                     subject: msg.subject,
@@ -513,52 +687,61 @@ _Trellis_log = new WeakMap(), _Trellis_tasks = new WeakMap(), _Trellis_noRespond
                     capabilities: ctx.callerCapabilities,
                 });
                 const auth = authResult.take();
-                if ((0, trellis_result_1.isErr)(auth)) {
+                if ((0, result_1.isErr)(auth)) {
                     __classPrivateFieldGet(this, _Trellis_log, "f").warn({
                         method,
                         error: auth.error.message,
                         errorType: auth.error.name,
-                        remoteError: auth.error instanceof RemoteError_js_1.RemoteError
+                        remoteError: auth.error instanceof RemoteError_ts_1.RemoteError
                             ? auth.error.toSerializable()
                             : undefined,
                     }, "Auth.ValidateRequest failed");
                     span.setStatus({
-                        code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                        code: tracing_ts_1.SpanStatusCode.ERROR,
                         message: "Auth.ValidateRequest failed",
                     });
-                    return auth;
+                    return (0, result_1.err)(auth.error);
                 }
                 if (!auth.allowed) {
                     span.setStatus({
-                        code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                        code: tracing_ts_1.SpanStatusCode.ERROR,
                         message: "Insufficient permissions",
                     });
-                    return (0, trellis_result_1.err)(new index_js_1.AuthError({
+                    return (0, result_1.err)(new index_ts_1.AuthError({
                         reason: "insufficient_permissions",
                         context: {
                             requiredCapabilities: ctx.callerCapabilities,
-                            userCapabilities: auth.user.capabilities,
+                            userCapabilities: auth.caller.capabilities,
                         },
                     }));
                 }
                 if (typeof msg.reply !== "string" ||
                     !msg.reply.startsWith(`${auth.inboxPrefix}.`)) {
                     span.setStatus({
-                        code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                        code: tracing_ts_1.SpanStatusCode.ERROR,
                         message: "Reply subject mismatch",
                     });
-                    return (0, trellis_result_1.err)(new index_js_1.AuthError({
+                    return (0, result_1.err)(new index_ts_1.AuthError({
                         reason: "reply_subject_mismatch",
                         context: { expected: auth.inboxPrefix, actual: msg.reply },
                     }));
                 }
-                user = auth.user;
+                caller = auth.caller;
+            }
+            span.setAttribute("auth.caller.type", caller.type);
+            if (caller.type === "user") {
+                span.setAttribute("user.id", caller.id);
+                span.setAttribute("user.origin", caller.origin);
             }
-            // Add user info to span attributes
-            span.setAttribute("user.id", user.id);
-            span.setAttribute("user.origin", user.origin);
-            const handlerResultWrapped = await trellis_result_1.AsyncResult.try(() => fn(parsedInput, {
-                user,
+            if (caller.type === "service") {
+                span.setAttribute("service.id", caller.id);
+            }
+            if (caller.type === "workload") {
+                span.setAttribute("workload.instance_id", caller.instanceId);
+                span.setAttribute("workload.profile_id", caller.profileId);
+            }
+            const handlerResultWrapped = await result_1.AsyncResult.try(() => fn(parsedInput, {
+                caller,
                 sessionKey: callerSessionKey,
             }));
             if (handlerResultWrapped.isErr()) {
@@ -571,21 +754,21 @@ _Trellis_log = new WeakMap(), _Trellis_tasks = new WeakMap(), _Trellis_noRespond
                         : error.cause,
                 }, "Handler threw unexpectedly.");
                 span.setStatus({
-                    code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                    code: tracing_ts_1.SpanStatusCode.ERROR,
                     message: error.message,
                 });
                 span.recordException(error);
-                return (0, trellis_result_1.err)(error);
+                return (0, result_1.err)(error);
             }
             const handlerResult = (await handlerResultWrapped).take();
             const handlerOutcome = handlerResult.take();
-            if ((0, trellis_result_1.isErr)(handlerOutcome)) {
+            if ((0, result_1.isErr)(handlerOutcome)) {
                 const handlerError = handlerOutcome.error;
-                const error = handlerError instanceof index_js_1.UnexpectedError ||
-                    handlerError instanceof index_js_1.AuthError ||
-                    handlerError instanceof index_js_1.ValidationError
+                const error = handlerError instanceof index_ts_1.UnexpectedError ||
+                    handlerError instanceof index_ts_1.AuthError ||
+                    handlerError instanceof index_ts_1.ValidationError
                     ? handlerError
-                    : new index_js_1.UnexpectedError({ cause: handlerError });
+                    : new index_ts_1.UnexpectedError({ cause: handlerError });
                 __classPrivateFieldGet(this, _Trellis_log, "f").error({
                     method,
                     error: error.message,
@@ -595,38 +778,38 @@ _Trellis_log = new WeakMap(), _Trellis_tasks = new WeakMap(), _Trellis_noRespond
                         : error.cause,
                 }, "Handler returned error.");
                 span.setStatus({
-                    code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                    code: tracing_ts_1.SpanStatusCode.ERROR,
                     message: error.message,
                 });
-                return (0, trellis_result_1.err)(error);
+                return (0, result_1.err)(error);
             }
-            const encoded = (0, codec_js_1.encodeSchema)(ctx.output, handlerOutcome).take();
-            if ((0, trellis_result_1.isErr)(encoded)) {
+            const encoded = (0, codec_ts_1.encodeSchema)(ctx.output, handlerOutcome).take();
+            if ((0, result_1.isErr)(encoded)) {
                 span.setStatus({
-                    code: trellis_telemetry_1.SpanStatusCode.ERROR,
+                    code: tracing_ts_1.SpanStatusCode.ERROR,
                     message: "Output encoding failed",
                 });
                 return encoded;
             }
-            span.setStatus({ code: trellis_telemetry_1.SpanStatusCode.OK });
-            return (0, trellis_result_1.ok)(encoded);
+            span.setStatus({ code: tracing_ts_1.SpanStatusCode.OK });
+            return (0, result_1.ok)(encoded);
         };
         const result = await execute();
         span.end();
         return result;
     });
 }, _Trellis_respondWithError = function _Trellis_respondWithError(msg, error) {
-    const trellisError = error instanceof index_js_1.UnexpectedError ||
-        error instanceof index_js_1.AuthError ||
-        error instanceof index_js_1.ValidationError ||
-        error instanceof RemoteError_js_1.RemoteError
+    const trellisError = error instanceof index_ts_1.UnexpectedError ||
+        error instanceof index_ts_1.AuthError ||
+        error instanceof index_ts_1.ValidationError ||
+        error instanceof RemoteError_ts_1.RemoteError
         ? error
-        : new index_js_1.UnexpectedError({ cause: error });
+        : new index_ts_1.UnexpectedError({ cause: error });
     __classPrivateFieldGet(this, _Trellis_log, "f").error({ error: trellisError.toSerializable() }, "RPC error");
     const errorData = trellisError.toSerializable();
     const hdrs = (0, nats_core_1.headers)();
     hdrs.set("status", "error");
-    const serialized = trellis_result_1.Result.try(() => JSON.stringify(errorData));
+    const serialized = result_1.Result.try(() => JSON.stringify(errorData));
     if (serialized.isErr()) {
         __classPrivateFieldGet(this, _Trellis_log, "f").error({ error: serialized.error }, "Failed to serialize error response");
         msg.respond('{"type":"UnexpectedError","message":"Failed to serialize error"}', { headers: hdrs });
@@ -635,24 +818,35 @@ _Trellis_log = new WeakMap(), _Trellis_tasks = new WeakMap(), _Trellis_noRespond
     msg.respond(serialized.take(), { headers: hdrs });
 }, _Trellis_handleEvent = function _Trellis_handleEvent(event, consumer, fn) {
     const ctx = this.api["events"][event];
-    return trellis_result_1.AsyncResult.try(async () => {
+    return result_1.AsyncResult.try(async () => {
         const msgs = await consumer.consume();
         for await (const msg of msgs) {
-            const jsonData = trellis_result_1.Result.try(() => msg.json());
+            const jsonData = result_1.Result.try(() => msg.json());
             if (jsonData.isErr()) {
                 __classPrivateFieldGet(this, _Trellis_log, "f").error({ error: jsonData.error }, "Event parse failed");
                 msg.term();
                 continue;
             }
-            const m = (0, codec_js_1.parseSchema)(ctx.event, jsonData.take()).take();
-            if ((0, trellis_result_1.isErr)(m)) {
+            const json = jsonData.take();
+            if ((0, result_1.isErr)(json)) {
+                __classPrivateFieldGet(this, _Trellis_log, "f").error({ error: json.error }, "Event parse failed");
+                msg.term();
+                continue;
+            }
+            const parsedEvent = parseRuntimeSchema(ctx.event, json);
+            const m = parsedEvent.take();
+            if ((0, result_1.isErr)(m)) {
                 __classPrivateFieldGet(this, _Trellis_log, "f").error({ error: m.error }, "Event validation failed");
                 msg.term();
                 continue;
             }
-            const handlerResult = await trellis_result_1.AsyncResult.lift(fn(m));
+            const handlerResult = await result_1.AsyncResult.lift(fn(m));
             if (handlerResult.isErr()) {
-                __classPrivateFieldGet(this, _Trellis_log, "f").error({ error: handlerResult.error.toSerializable(), event, subject: msg.subject }, "Event handler failed");
+                __classPrivateFieldGet(this, _Trellis_log, "f").error({
+                    error: handlerResult.error.toSerializable(),
+                    event,
+                    subject: msg.subject,
+                }, "Event handler failed");
                 msg.nak();
                 continue;
             }
@@ -673,43 +867,51 @@ _Trellis_log = new WeakMap(), _Trellis_tasks = new WeakMap(), _Trellis_noRespond
     const digest = await sha256(input);
     const sigBytes = await this.auth.sign(digest);
     return base64urlEncode(sigBytes);
-};
-class TrellisServer extends Trellis {
-    constructor(name, nats, auth, opts) {
-        super(name, nats, auth, opts);
-        _TrellisServer_version.set(this, void 0);
-        _TrellisServer_log.set(this, void 0);
-        __classPrivateFieldSet(this, _TrellisServer_version, opts?.version, "f");
-        __classPrivateFieldSet(this, _TrellisServer_log, (opts?.log ?? globals_js_1.logger).child({ lib: "trellis-server" }), "f");
+}, _Trellis_requestJson = async function _Trellis_requestJson(subject, body) {
+    const payload = JSON.stringify(body);
+    const proof = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createProof).call(this, subject, payload);
+    const headers = (0, nats_core_1.headers)();
+    headers.set("session-key", this.auth.sessionKey);
+    headers.set("proof", proof);
+    const response = await result_1.AsyncResult.try(() => this.nats.request(subject, payload, {
+        timeout: this.timeout,
+        headers,
+    })).take();
+    if ((0, result_1.isErr)(response)) {
+        return response;
     }
-    /**
-     * Creates an authenticated TrellisServer instance.
-     *
-     * Services connect to NATS using the session-key auth flow (see ADR):
-     * - NATS `auth_token` (aka `token`) is a JSON string `{ v: 1, sessionKey, iat, sig }`
-     * - `sig` signs SHA-256(`nats-connect:${iat}`) with the session key
-     * - `inboxPrefix` MUST be `_INBOX.${sessionKey.slice(0, 16)}`
-     *
-     * @param name Unique name for this service
-     * @param nats Existing NATS connection (already authenticated)
-     * @param auth Service session-key credentials
-     * @param opts Optional server options
-     * @returns An authenticated TrellisServer instance
-     */
-    static create(name, nats, auth, opts) {
-        return new TrellisServer(name, nats, auth, opts);
+    return safeJson(response);
+}, _Trellis_watchJson = async function _Trellis_watchJson(subject, body) {
+    const payload = JSON.stringify(body);
+    const proof = await __classPrivateFieldGet(this, _Trellis_instances, "m", _Trellis_createProof).call(this, subject, payload);
+    const headers = (0, nats_core_1.headers)();
+    headers.set("session-key", this.auth.sessionKey);
+    headers.set("proof", proof);
+    const inbox = (0, nats_core_1.createInbox)(`_INBOX.${this.auth.sessionKey.slice(0, 16)}`);
+    const sub = this.nats.subscribe(inbox);
+    try {
+        this.nats.publish(subject, payload, {
+            headers,
+            reply: inbox,
+        });
+        await this.nats.flush();
     }
-    /**
-     * Stops the server by clearing refresh timers and draining the NATS connection.
-     * Draining allows in-flight messages to complete before closing the connection.
-     * This method is idempotent and can be called multiple times safely.
-     */
-    async stop() {
-        // Only drain if the connection is not already closed
-        if (!this.natsConnection.isClosed()) {
-            await this.natsConnection.drain();
-        }
+    catch (cause) {
+        sub.unsubscribe();
+        return (0, result_1.err)(new index_ts_1.UnexpectedError({ cause }));
     }
-}
-exports.TrellisServer = TrellisServer;
-_TrellisServer_version = new WeakMap(), _TrellisServer_log = new WeakMap();
+    return (0, result_1.ok)((async function* () {
+        try {
+            for await (const msg of sub) {
+                if (msg.headers?.get("status") === "error") {
+                    yield (0, result_1.err)(new index_ts_1.UnexpectedError({ cause: new Error(msg.string()) }));
+                    continue;
+                }
+                yield safeJson(msg);
+            }
+        }
+        finally {
+            sub.unsubscribe();
+        }
+    })());
+};