@requence/service 0.8.2-edge.1151 → 0.8.2-edge.1155

package/build/types/helpers/src/protocol/update.d.ts

@@ -90,7 +90,7 @@ declare const nodeUpdateSchema: z.ZodObject<{
     }, z.core.$strip>;
     type: z.ZodLiteral<"NODE_UPDATE">;
     output: z.ZodNullable<z.ZodString>;
-    data: z.ZodUnknown;
+    data: z.ZodOptional<z.ZodUnknown>;
     overwrite: z.ZodBoolean;
 }, z.core.$strip>;
 export type NodeUpdate = z.infer<typeof nodeUpdateSchema>;
@@ -122,7 +122,7 @@ declare const nodeCallbackSchema: z.ZodObject<{
     }, z.core.$strip>;
     propertyPath: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
     output: z.ZodNullable<z.ZodString>;
-    data: z.ZodUnknown;
+    data: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strip>;
 export type NodeCallback = z.infer<typeof nodeCallbackSchema>;
 declare const nodeEndUpdateSchema: z.ZodObject<{
@@ -166,9 +166,72 @@ declare const nodeDebugUpdateSchema: z.ZodObject<{
         system: "system";
         warn: "warn";
     }>;
-    data: z.ZodUnknown;
+    data: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strip>;
 export type NodeDebugUpdate = z.infer<typeof nodeDebugUpdateSchema>;
+declare const nodeRenderUpdateSchema: z.ZodObject<{
+    component: z.ZodObject<{
+        id: z.ZodString;
+        hash: z.ZodString;
+        source: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>;
+    props: z.ZodUnknown;
+    defaults: z.ZodOptional<z.ZodUnknown>;
+    surfaceId: z.ZodString;
+    devSession: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
+    id: z.ZodUUID;
+    rootTaskId: z.ZodOptional<z.ZodUUID>;
+    traceIds: z.ZodArray<z.ZodString>;
+    node: z.ZodObject<{
+        id: z.ZodUUID;
+        type: z.ZodEnum<{
+            logic: "logic";
+            or: "or";
+            reference: "reference";
+            service: "service";
+        }>;
+        alias: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    type: z.ZodLiteral<"NODE_RENDER">;
+    messageId: z.ZodUUID;
+    connectionId: z.ZodUUID;
+    ownTraceId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    handlerQueue: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type NodeRenderUpdate = z.infer<typeof nodeRenderUpdateSchema>;
+declare const surfaceDeadUpdateSchema: z.ZodObject<{
+    timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
+    id: z.ZodUUID;
+    rootTaskId: z.ZodOptional<z.ZodUUID>;
+    traceIds: z.ZodArray<z.ZodString>;
+    type: z.ZodLiteral<"SURFACE_DEAD">;
+    messageId: z.ZodUUID;
+    connectionId: z.ZodDefault<z.ZodNullable<z.ZodUUID>>;
+}, z.core.$strip>;
+export type SurfaceDeadUpdate = z.infer<typeof surfaceDeadUpdateSchema>;
+declare const surfaceInteractionErrorUpdateSchema: z.ZodObject<{
+    timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
+    id: z.ZodUUID;
+    rootTaskId: z.ZodOptional<z.ZodUUID>;
+    traceIds: z.ZodArray<z.ZodString>;
+    type: z.ZodLiteral<"SURFACE_INTERACTION_ERROR">;
+    surface: z.ZodUUID;
+    message: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+}, z.core.$strip>;
+export type SurfaceInteractionErrorUpdate = z.infer<typeof surfaceInteractionErrorUpdateSchema>;
+declare const uiRebuiltUpdateSchema: z.ZodObject<{
+    devSession: z.ZodString;
+    uiId: z.ZodString;
+    hash: z.ZodString;
+    source: z.ZodString;
+    timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
+    id: z.ZodUUID;
+    rootTaskId: z.ZodOptional<z.ZodUUID>;
+    traceIds: z.ZodArray<z.ZodString>;
+    type: z.ZodLiteral<"UI_REBUILT">;
+}, z.core.$strip>;
+export type UiRebuiltUpdate = z.infer<typeof uiRebuiltUpdateSchema>;
 declare const nodeDeferUpdateSchema: z.ZodObject<{
     timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
     id: z.ZodUUID;
@@ -185,7 +248,7 @@ declare const nodeDeferUpdateSchema: z.ZodObject<{
         alias: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     type: z.ZodLiteral<"NODE_DEFER">;
-    reason: z.ZodUnknown;
+    reason: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strip>;
 export type NodeDeferUpdate = z.infer<typeof nodeDeferUpdateSchema>;
 declare const taskStartUpdateSchema: z.ZodObject<{
@@ -200,7 +263,7 @@ declare const taskStartUpdateSchema: z.ZodObject<{
         nodeId: z.ZodUUID;
         messageId: z.ZodUUID;
     }, z.core.$strip>>>;
-    input: z.ZodUnknown;
+    input: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strip>;
 export type TaskStartUpdate = z.infer<typeof taskStartUpdateSchema>;
 declare const taskErrorUpdateSchema: z.ZodObject<{
@@ -307,7 +370,7 @@ export declare const updateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }, z.core.$strip>;
     type: z.ZodLiteral<"NODE_UPDATE">;
     output: z.ZodNullable<z.ZodString>;
-    data: z.ZodUnknown;
+    data: z.ZodOptional<z.ZodUnknown>;
     overwrite: z.ZodBoolean;
 }, z.core.$strip>, z.ZodObject<{
     timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
@@ -337,7 +400,7 @@ export declare const updateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }, z.core.$strip>;
     propertyPath: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
     output: z.ZodNullable<z.ZodString>;
-    data: z.ZodUnknown;
+    data: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strip>, z.ZodObject<{
     timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
     id: z.ZodUUID;
@@ -377,7 +440,62 @@ export declare const updateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         system: "system";
         warn: "warn";
     }>;
-    data: z.ZodUnknown;
+    data: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>, z.ZodObject<{
+    component: z.ZodObject<{
+        id: z.ZodString;
+        hash: z.ZodString;
+        source: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>;
+    props: z.ZodUnknown;
+    defaults: z.ZodOptional<z.ZodUnknown>;
+    surfaceId: z.ZodString;
+    devSession: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
+    id: z.ZodUUID;
+    rootTaskId: z.ZodOptional<z.ZodUUID>;
+    traceIds: z.ZodArray<z.ZodString>;
+    node: z.ZodObject<{
+        id: z.ZodUUID;
+        type: z.ZodEnum<{
+            logic: "logic";
+            or: "or";
+            reference: "reference";
+            service: "service";
+        }>;
+        alias: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    type: z.ZodLiteral<"NODE_RENDER">;
+    messageId: z.ZodUUID;
+    connectionId: z.ZodUUID;
+    ownTraceId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    handlerQueue: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
+    id: z.ZodUUID;
+    rootTaskId: z.ZodOptional<z.ZodUUID>;
+    traceIds: z.ZodArray<z.ZodString>;
+    type: z.ZodLiteral<"SURFACE_DEAD">;
+    messageId: z.ZodUUID;
+    connectionId: z.ZodDefault<z.ZodNullable<z.ZodUUID>>;
+}, z.core.$strip>, z.ZodObject<{
+    timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
+    id: z.ZodUUID;
+    rootTaskId: z.ZodOptional<z.ZodUUID>;
+    traceIds: z.ZodArray<z.ZodString>;
+    type: z.ZodLiteral<"SURFACE_INTERACTION_ERROR">;
+    surface: z.ZodUUID;
+    message: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+}, z.core.$strip>, z.ZodObject<{
+    devSession: z.ZodString;
+    uiId: z.ZodString;
+    hash: z.ZodString;
+    source: z.ZodString;
+    timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
+    id: z.ZodUUID;
+    rootTaskId: z.ZodOptional<z.ZodUUID>;
+    traceIds: z.ZodArray<z.ZodString>;
+    type: z.ZodLiteral<"UI_REBUILT">;
 }, z.core.$strip>, z.ZodObject<{
     timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
     id: z.ZodUUID;
@@ -394,7 +512,7 @@ export declare const updateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         alias: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     type: z.ZodLiteral<"NODE_DEFER">;
-    reason: z.ZodUnknown;
+    reason: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strip>, z.ZodObject<{
     timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
     id: z.ZodUUID;
@@ -407,7 +525,7 @@ export declare const updateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         nodeId: z.ZodUUID;
         messageId: z.ZodUUID;
     }, z.core.$strip>>>;
-    input: z.ZodUnknown;
+    input: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strip>, z.ZodObject<{
     timestamp: z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>;
     id: z.ZodUUID;

package/build/types/helpers/src/protocol/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../../../helpers/src/protocol/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAsB1B,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;iBAIxB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAYjE,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAezB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;iBAGzB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;iBAKpB,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMtB,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;;iBAEvB,CAAA;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;iBAIzB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;iBAGzB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;iBAYzB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,qBAAqB;;;;;;;iBAGzB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,mBAAmB;;;;;;;;iBAIvB,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAO/D,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAavB,CAAA;AAEF,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../../../helpers/src/protocol/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAyB1B,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;iBAIxB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAYjE,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAezB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;iBAGzB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;iBAQpB,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMtB,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;;iBAEvB,CAAA;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;iBAIzB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAiBnE,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4C1B,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAgBrE,QAAA,MAAM,uBAAuB;;;;;;;;iBAgB3B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAyBvE,QAAA,MAAM,mCAAmC;;;;;;;;iBAMvC,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAA;AAeD,QAAA,MAAM,qBAAqB;;;;;;;;;;iBAGzB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;iBAIzB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;iBAYzB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,qBAAqB;;;;;;;iBAGzB,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,QAAA,MAAM,mBAAmB;;;;;;;;iBAIvB,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAO/D,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAiBvB,CAAA;AAEF,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA"}

package/build/types/helpers/src/utils/amqpPublishRetry.d.ts

@@ -11,35 +11,130 @@ export declare const DEFAULT_AMQP_PUBLISH_RETRY_ATTEMPTS = 3;
  * out and retries) and far below the incident's multi-second stalls.
  */
 export declare const PUBLISH_STARVATION_THRESHOLD_MS = 1000;
-export interface LoopStarvationProbe {
+/**
+ * How long to wait, after a confirm deadline elapsed on a starved loop, before
+ * reading the link's incarnation for the second time.
+ *
+ * The stall that delayed the confirm delayed the socket's own close callback
+ * too, and Node runs the timers phase BEFORE the poll phase — so the deadline's
+ * timer can fire before the disconnect it was caused by has even been read off
+ * the socket. Deciding on the spot would call that lost message delivered. One
+ * settle turn puts the read after the poll phase; the margin above that costs
+ * nothing, because this only ever delays a publish that already spent its full
+ * timeout.
+ */
+export declare const PUBLISH_LINK_SETTLE_MS = 250;
+/**
+ * Reads the publish link's incarnation: a number that changes on every
+ * (re)connect, and `null` for as long as the link is down.
+ *
+ * Encoding "down" as `null` is what lets a single equality carry the whole
+ * liveness question — `start !== null && start === end` holds only if the link
+ * was up at both ends AND never cycled in between.
+ */
+export type PublishLinkEpoch = () => number | null;
+export interface PublishLinkTracker {
+    /** Pass this to `createPublishWindowProbe`. */
+    epoch: PublishLinkEpoch;
+    /** Call when the publish channel is (re)connected and usable. */
+    markConnected: () => void;
+    /** Call when the connection or the publish channel is lost. */
+    markDisconnected: () => void;
+}
+/**
+ * Tracks whether a publisher's link to the broker is up, and how many times it
+ * has been re-made. Every AMQP client wires this to its own connection and
+ * channel events; the counter is deliberately not derived from the library's
+ * `isConnected()`, because a drop-and-recover inside one publish window is
+ * invisible to a boolean and must not read as "the link held".
+ */
+export declare function createPublishLinkTracker(): PublishLinkTracker;
+export interface PublishTimeoutVerdict {
+    /** Longest stretch (ms) in which the loop could not run a callback. */
+    starvedMs: number;
+    /** The loop was starved past the threshold during the window. */
+    starved: boolean;
+    /** The link was down at some point while the confirm was outstanding. */
+    linkLost: boolean;
+    /**
+     * A reading taken while the message was still the library's responsibility
+     * found the publisher's send queue empty, which proves this message was handed
+     * to the socket. `false` means unproven, not "provably still queued".
+     */
+    leftSendQueue: boolean;
+    /**
+     * Only true when the loop was starved AND the link held throughout AND the
+     * message provably left the send queue: it is in the broker's hands and must
+     * NOT be re-sent.
+     */
+    delivered: boolean;
+}
+export interface PublishWindowProbe {
+    /**
+     * Take a send-queue reading now. Call it synchronously right after handing the
+     * message to the publisher: `ChannelWrapper.publish()` enqueues AND runs its
+     * send worker synchronously, so on a healthy channel the queue is already
+     * empty by the time it returns — which is the sharpest reading available.
+     */
+    observeSendQueue: () => void;
+    /** Stop sampling. Idempotent; call it on the success path. */
+    stop: () => void;
     /**
-     * Stop sampling and return the longest stretch (ms) during which the loop
-     * could not run a callback since the probe started. Idempotent — subsequent
-     * calls return the same value without re-reading the clock.
+     * Decide what an elapsed confirm deadline means. Stops sampling, then — only
+     * where the answer could still flip — waits out `settleMs` before re-reading
+     * the link. Idempotent: subsequent calls return the first verdict.
      */
-    stop: () => number;
+    readTimeoutVerdict: () => Promise<PublishTimeoutVerdict>;
+}
+interface PublishWindowProbeOptions {
+    epoch: PublishLinkEpoch;
+    /**
+     * Reads how many messages the publisher still holds unsent — the wrapper's
+     * `queueLength()`. Required, not optional: a publisher that skipped it would
+     * silently inherit the pre-#139 verdict and drop messages again.
+     */
+    sendQueueLength: () => number;
+    now?: () => number;
+    settleMs?: number;
 }
 /**
- * Measure how long the event loop was starved while a single publish is in
- * flight. It runs a self-rescheduling timer and, crucially, also reads the
- * pending gap synchronously at `stop()`: a stall that blocked the loop right up
- * to `stop()` is caught by `now() - expected` even though the timer never got a
- * chance to fire. That makes the reading immune to the very stall it measures
- * and independent of callback ordering after the loop resumes.
+ * Watch a single publish's in-flight window: how long the event loop was
+ * starved, whether the link to the broker survived, and whether the message
+ * provably left the publisher's send queue.
+ *
+ * The starvation term runs a self-rescheduling timer and, crucially, also reads
+ * the pending gap synchronously when sampling stops: a stall that blocked the
+ * loop right up to that moment is caught by `now() - expected` even though the
+ * timer never got a chance to fire. That makes the reading immune to the very
+ * stall it measures and independent of callback ordering after the loop resumes.
+ *
+ * The send-queue term samples on the same tick, and the caller adds the sharpest
+ * reading of all through `observeSendQueue()` — the synchronous one taken right
+ * after the publisher accepted the message, which no stall can delay.
  *
  * The clock is monotonic (`performance.now`), never wall time — the operator's
  * lag monitor uses the same, and a wall-clock step (NTP) must not read as
- * starvation and suppress a legitimate retry. `now` is injectable for tests.
+ * starvation and suppress a legitimate retry. `now` and `settleMs` are
+ * injectable for tests.
  */
-export declare function createLoopStarvationProbe({ now, }?: {
-    now?: () => number;
-}): LoopStarvationProbe;
+export declare function createPublishWindowProbe({ epoch, sendQueueLength, now, settleMs, }: PublishWindowProbeOptions): PublishWindowProbe;
 /**
- * Whether a confirm deadline that elapsed should be read as loop starvation
- * rather than a lost publish. When it returns true the publish must NOT be
- * re-sent: the message is in the broker's hands and only the confirm was late.
+ * The starvation term of the verdict — whether the loop was unresponsive long
+ * enough for the confirm deadline to be an artefact of the stall. On its own it
+ * is NOT a reason to suppress a re-send; see `createPublishWindowProbe`.
  */
 export declare function isStarvedPublishTimeout(starvedMs: number): boolean;
+/**
+ * The error a non-delivered confirm deadline becomes. Shared so the operator and
+ * the task SDK report the same thing, and worded to say WHICH of the two failure
+ * shapes happened — a starved window whose link died reads as a healthy broker
+ * timing out unless the message says otherwise.
+ *
+ * The `RabbitMQ publish timed out` prefix is load-bearing:
+ * `isRetryablePublishError` matches on it.
+ */
+export declare function formatPublishTimeoutError({ starved, starvedMs, linkLost, leftSendQueue, }: PublishTimeoutVerdict): string;
 export declare function isRetryablePublishError(error: unknown): boolean;
 export declare function computeAmqpPublishRetryDelay(attempt: number): number;
+export {};
 //# sourceMappingURL=amqpPublishRetry.d.ts.map

package/build/types/helpers/src/utils/amqpPublishRetry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"amqpPublishRetry.d.ts","sourceRoot":"","sources":["../../../../../../helpers/src/utils/amqpPublishRetry.ts"],"names":[],"mappings":"AA8BA,eAAO,MAAM,+BAA+B,QAAS,CAAA;AACrD,eAAO,MAAM,mCAAmC,IAAI,CAAA;AAqBpD;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,OAAQ,CAAA;AAEpD,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,IAAI,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,GAA6B,GAC9B,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GAAG,mBAAmB,CAyBnD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,WAExD;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,WAQrD;AAID,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,UAM3D"}
+{"version":3,"file":"amqpPublishRetry.d.ts","sourceRoot":"","sources":["../../../../../../helpers/src/utils/amqpPublishRetry.ts"],"names":[],"mappings":"AA8BA,eAAO,MAAM,+BAA+B,QAAS,CAAA;AACrD,eAAO,MAAM,mCAAmC,IAAI,CAAA;AAoEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,OAAQ,CAAA;AAEpD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAA;AAEzC;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,MAAM,GAAG,IAAI,CAAA;AAElD,MAAM,WAAW,kBAAkB;IACjC,+CAA+C;IAC/C,KAAK,EAAE,gBAAgB,CAAA;IACvB,iEAAiE;IACjE,aAAa,EAAE,MAAM,IAAI,CAAA;IACzB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,kBAAkB,CAc7D;AAED,MAAM,WAAW,qBAAqB;IACpC,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,OAAO,EAAE,OAAO,CAAA;IAChB,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,IAAI,CAAA;IAC5B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,IAAI,CAAA;IAChB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;CACzD;AAED,UAAU,yBAAyB;IACjC,KAAK,EAAE,gBAAgB,CAAA;IACvB;;;;OAIG;IACH,eAAe,EAAE,MAAM,MAAM,CAAA;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,KAAK,EACL,eAAe,EACf,GAA6B,EAC7B,QAAiC,GAClC,EAAE,yBAAyB,GAAG,kBAAkB,CAuEhD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,WAExD;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,OAAO,EACP,SAAS,EACT,QAAQ,EACR,aAAa,GACd,EAAE,qBAAqB,UAevB;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,WAQrD;AAID,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,UAM3D"}

package/build/types/helpers/src/utils/matchSchema.d.ts

@@ -1,4 +1,18 @@
 import type { z } from 'zod/v4';
+/**
+ * Curried on **arity**, never on the value — which is what the rest parameter
+ * buys over an optional one.
+ *
+ * It used to branch on `if (input)`, so a falsy second argument fell through to
+ * the curried arm and the caller was handed a predicate *function* instead of an
+ * answer. A function is truthy, so `if (!matchSchema(schema, value))` passed on
+ * exactly the input it was written to catch (a missing `correlationId`, an absent
+ * `taskId` header), and `if (matchSchema(schema, value))` fired on values that
+ * match nothing — `resolveAccept`'s unresolvable `#/definitions/…` hop reached
+ * `undefined.const` that way. The mirror image was just as wrong: `0`, `''` and
+ * `false` are legitimate values a guard must be able to say *yes* about, and
+ * `index: 0` is the first publish of every service message.
+ */
 export declare function matchSchema<Schema extends z.ZodSchema>(schema: Schema, input: unknown): input is z.infer<Schema>;
 export declare function matchSchema<Schema extends z.ZodSchema>(schema: Schema): (input: unknown) => input is z.infer<Schema>;
 //# sourceMappingURL=matchSchema.d.ts.map

package/build/types/helpers/src/utils/matchSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"matchSchema.d.ts","sourceRoot":"","sources":["../../../../../../helpers/src/utils/matchSchema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAE/B,wBAAgB,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC,SAAS,EACpD,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAC3B,wBAAgB,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC,SAAS,EACpD,MAAM,EAAE,MAAM,GACb,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"matchSchema.d.ts","sourceRoot":"","sources":["../../../../../../helpers/src/utils/matchSchema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC,SAAS,EACpD,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAC3B,wBAAgB,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC,SAAS,EACpD,MAAM,EAAE,MAAM,GACb,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA"}

package/build/types/helpers/src/utils/serviceRender.d.ts

@@ -0,0 +1,73 @@
+import { z } from 'zod/v4';
+/**
+ * The render payload a service publishes when a handler calls
+ * `context.render(ui, props)` — the wire shape shared by the service SDK
+ * (which composes it) and the operator (which parses it before emitting the
+ * render as a task update). See `knowledge/service-ui-surfaces.md`.
+ *
+ * `component.source` travels only on the **first** render of a given hash into a
+ * given task; later renders carry the hash alone, because ui/backend stores the
+ * bundle hash-addressed and that row outlives every render. A hash arriving
+ * without a source that ui/backend has never seen is an error state on the
+ * surface, not a silent fallback (D16).
+ *
+ * Per task rather than per connection because bundle retention is per task
+ * (D19): the last-referent sweep removes a bundle once no task references it, and
+ * a connection can outlive every task that referenced its component.
+ *
+ * Every field is deliberately a *top-level* key, because that is the granularity
+ * the size-triggered claim-check works at: it offloads a record body's largest
+ * top-level values first, and the publisher pins every one of these inline except
+ * `props`. So an oversized render always offloads `props` — the one value whose
+ * loss is a named error state rather than a broken surface. The source is capped
+ * at {@link MAX_UI_SOURCE_BYTES} anyway, well under the offload threshold, so the
+ * bundle always travels inline (D4).
+ */
+export declare const serviceRenderSchema: z.ZodObject<{
+    component: z.ZodObject<{
+        id: z.ZodString;
+        hash: z.ZodString;
+        source: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>;
+    props: z.ZodUnknown;
+    defaults: z.ZodOptional<z.ZodUnknown>;
+    surfaceId: z.ZodString;
+    devSession: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type ServiceRender = z.infer<typeof serviceRenderSchema>;
+/**
+ * Hard cap on a UI component bundle, enforced when the component is registered
+ * (D4). Fits a self-contained React component, stays storable inline in
+ * Postgres, and fails fast on an accidental whole-app bundle.
+ */
+export declare const MAX_UI_SOURCE_BYTES: number;
+/**
+ * The surface a render targets when it names none (D3). A node's surfaces are
+ * keyed by this id, so the default is a single surface per node/trace.
+ */
+export declare const DEFAULT_SURFACE_ID = "default";
+/**
+ * Hard cap on one value a browser sends into a surface — a callback
+ * invocation's argument, or a deferred form's submitted response — enforced in
+ * ui/backend before either is published (D7).
+ *
+ * One number for both because they are the same thing arriving by two routes:
+ * viewer-authored bytes that reach service code, bounded before they enter the
+ * fabric. A response additionally has to fit the node's own output, which the
+ * operator enforces on the way in as it does for any service result.
+ *
+ * An interaction is exactly that — a click, a form submit, an approval — not
+ * a data transfer, and unlike a service's own publishes it crosses no outbound
+ * boundary: nothing offloads it, so its bytes reach the broker as they are. The
+ * cap is what keeps that true, and it is deliberately far below any message
+ * limit rather than tuned to one, so a task's `maxPayloadSize` can never make
+ * the difference between a usable synchronous rejection and a dropped AMQP
+ * connection.
+ *
+ * Lives here, next to {@link MAX_UI_SOURCE_BYTES}, rather than inside ui/backend:
+ * the browser is the other party that has to respect it, and when the surface
+ * host starts refusing an oversized argument before the round trip it should
+ * read the number from where the server enforces it, not restate it.
+ */
+export declare const MAX_SURFACE_INTERACTION_BYTES: number;
+//# sourceMappingURL=serviceRender.d.ts.map

package/build/types/helpers/src/utils/serviceRender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceRender.d.ts","sourceRoot":"","sources":["../../../../../../helpers/src/utils/serviceRender.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAE1B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;iBAkD9B,CAAA;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAc,CAAA;AAE9C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,YAAY,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,6BAA6B,QAAY,CAAA"}

package/build/types/helpers/src/utils/sliceClock.d.ts

@@ -0,0 +1,61 @@
+/**
+ * THE SHARED YIELD RULE FOR LONG SYNCHRONOUS WORK (#134).
+ *
+ * A loop that does real CPU per item blocks every callback for its whole
+ * length — the AMQP heartbeat included. On 2026-08-07 that took the operator's
+ * connection down and lost every publish issued inside the dead window (#130).
+ * The fix in every such loop is the same shape: after each item, ask whether the
+ * current slice has run long enough, and if it has, hand the loop back.
+ *
+ * This is that rule, once. Two loops use it — `protocol/sliceTreeList.ts` (tree
+ * validation, the expensive one) and the operator's `machinePacker.unpack`
+ * (snapshot restore) — and any third should use it rather than re-time itself.
+ *
+ * It does NOT make work interruptible. A slice always overruns by the cost of
+ * the item that tripped it, because the item itself — an AJV compile, a msgpack
+ * decode — cannot be split part-way. The bound is `budgetMs` plus the single
+ * most expensive item, which is why the budget is set two orders of magnitude
+ * below the threshold anyone cares about.
+ */
+/**
+ * How long one uninterrupted slice may run before the loop yields.
+ *
+ * TIME, not a fixed item count, and that is deliberate: #134 asked for "every N
+ * items" picked by measurement, but N cannot hold the invariant that actually
+ * matters. Item cost spans four orders of magnitude across the callers — an edge
+ * validates in 0.004 ms, a service node with three JSON schemas in ~12 ms, a
+ * 20 kB snapshot payload in 0.01 ms — so any N tuned for one caller is wrong for
+ * the next. A time budget is the same rule expressed on the axis the loop cares
+ * about, and it makes N adaptive for free.
+ *
+ * 20 ms is two orders of magnitude below `LAG_WARN_THRESHOLD` (1000 ms in the
+ * operator's `utils/eventLoopLag.ts`), which leaves room for the overrun above.
+ */
+export declare const SLICE_BUDGET_MS = 20;
+export type SliceOptions = {
+    /** @see SLICE_BUDGET_MS */
+    budgetMs?: number;
+    /**
+     * How the loop hands control back. Injectable so a spec can count the yields
+     * instead of waiting for them.
+     */
+    yieldToEventLoop?: () => Promise<void>;
+};
+export type SliceStats = {
+    /** How many uninterrupted slices the work took. */
+    slices: number;
+    /** The longest of them, in ms — the stall the work actually caused. */
+    longestSliceMs: number;
+};
+/**
+ * The clock a sliced loop yields on. It measures the slice it is IN, so the
+ * reported worst slice includes the item that overran the budget — the honest
+ * number.
+ */
+export declare function createSliceClock(options?: SliceOptions): {
+    /** Called after every item. Yields only when the budget is spent. */
+    tick(): Promise<void>;
+    stats(): SliceStats;
+};
+export type SliceClock = ReturnType<typeof createSliceClock>;
+//# sourceMappingURL=sliceClock.d.ts.map

package/build/types/helpers/src/utils/sliceClock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sliceClock.d.ts","sourceRoot":"","sources":["../../../../../../helpers/src/utils/sliceClock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,KAAK,CAAA;AAEjC,MAAM,MAAM,YAAY,GAAG;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACvC,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAyBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,YAAiB;IASvD,qEAAqE;IAC/D,IAAI;IAWV,KAAK,IAAI,UAAU;EAOtB;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA"}