@smthrs/flow 1.0.0-rc.8 → 1.0.0-rc.9

package/dist/cjs/HumanTask.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/HumanTask.ts"],
-  "sourcesContent": ["/**\n * Asking a person something, as an ordinary declared action.\n *\n * {@link module:WaitFor.action} is the general rendezvous: it parks until\n * something outside the run resolves it, and settles with whatever arrived.\n * That is the right primitive and the wrong affordance for a human, because a\n * human answers in prose, in a hurry, and sometimes wrongly. Smithers 0.x had\n * the affordance \u2014 a `HumanTask` with a kind, a prompt, an output schema, an\n * attempt budget, and a deadline \u2014 and this module is that affordance rebuilt\n * on the primitives this package already has.\n *\n * Four things are added to a bare wait:\n *\n * - a **kind**, so the four shapes a person is asked for (`ask`, `confirm`,\n *   `select`, `json`) are stated rather than reconstructed from a schema;\n * - **validation**, so an answer that does not fit is refused where it arrives\n *   instead of failing three steps later as a decode error;\n * - **re-asking**, so a refused answer parks again on a NEW wait point rather\n *   than ending the run, until the attempt budget is spent;\n * - a **deadline**, so a question nobody answers settles instead of parking\n *   forever.\n *\n * All four are built from what is already durable. Each attempt is its own wait\n * point in {@link module:WaitFor}'s namespace \u2014 `WaitFor/<name>#<attempt>` \u2014 so\n * an answer is recorded exactly as any other durable deferred completion is, a\n * refused answer stays recorded under the attempt that refused it, and a\n * re-driven round replays every answer it already has before parking on the\n * first attempt that has none. The reason an answer was refused is recorded\n * too, as a sealed step named `HumanTask/<name>#<attempt>/rejected`, so the\n * judgment the run made sits in the journal beside the answer it judged rather\n * than in a log stream nobody replays. The park is declared through the ordinary\n * waiting vocabulary under `approval`, carrying the current attempt's token, so\n * whoever collects answers always sees the one wait point that is open. The\n * deadline is a {@link module:DurableClock} armed once per task and raced\n * against every attempt, which makes it a deadline for the QUESTION rather than\n * for one attempt at answering it.\n *\n * @since 0.1.0\n */\n\nimport * as Node from \"@smthrs/plan/Node\"\nimport type * as Crypto from \"effect/Crypto\"\nimport * as Duration from \"effect/Duration\"\nimport * as Effect from \"effect/Effect\"\nimport * as Exit from \"effect/Exit\"\nimport type * as Layer from \"effect/Layer\"\nimport * as Schema from \"effect/Schema\"\nimport * as Action from \"./Action/index.ts\"\nimport * as DurableClock from \"./DurableClock.ts\"\nimport * as DurableDeferred from \"./DurableDeferred.ts\"\nimport { FlowInstance } from \"./FlowRuntime/FlowInstance.ts\"\nimport { FlowRuntime } from \"./FlowRuntime/FlowRuntime.ts\"\nimport { annotateWaiting } from \"./FlowRuntime/WaitingAnnotation.ts\"\nimport * as BoundedJson from \"./internal/BoundedJson.ts\"\nimport * as JsonSchemaSubset from \"./internal/JsonSchemaSubset.ts\"\nimport * as WaitFor from \"./WaitFor.ts\"\n\n/**\n * The shape a person is asked for.\n *\n * `ask` wants prose, `confirm` wants yes or no, `select` wants one of the\n * options the task names, and `json` wants a value the task's JSON Schema\n * accepts. The kind is what an interface renders and what {@link validate}\n * checks; it is stated rather than inferred, because a text box and a two-\n * button confirmation are different questions even when both answers happen to\n * be strings.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Kind = \"ask\" | \"confirm\" | \"select\" | \"json\"\n\n/**\n * The schema the `kind` payload field is declared with.\n *\n * @category schemas\n * @since 0.1.0\n */\nexport const Kind: Schema.Literals<readonly [\"ask\", \"confirm\", \"select\", \"json\"]> = Schema.Literals([\n  \"ask\",\n  \"confirm\",\n  \"select\",\n  \"json\"\n])\n\n/**\n * A question that ended without an answer the task could accept.\n *\n * `request_invalid` is the author's mistake \u2014 a `select` with no options, an\n * attempt budget below one, a deadline that is not a length of time, a JSON\n * Schema outside the supported subset \u2014 and is refused before anyone is asked\n * anything. `rejected` means every attempt was\n * spent on answers the task refused, and `timeout` means the deadline passed\n * with the question still open. All three are typed failures rather than\n * defects, so a body recovers from them with `Node.catch` like any other\n * declared failure \u2014 which is the point, because \"the reviewer never answered\"\n * is an ordinary outcome of asking a reviewer.\n *\n * @category errors\n * @since 0.1.0\n */\nexport class HumanTaskFailed extends Schema.TaggedError<HumanTaskFailed>()(\n  \"@smthrs/flow/HumanTaskFailed\",\n  {\n    code: Schema.Literals([\"request_invalid\", \"rejected\", \"timeout\"]),\n    task: Schema.String,\n    attempts: Schema.Number,\n    rejections: Schema.Array(Schema.String),\n    message: Schema.String\n  }\n) {}\n\n/**\n * An answer refused before it could consume durable storage.\n *\n * @category errors\n * @since 1.0.0\n */\nexport class HumanAnswerInvalid extends Schema.TaggedError<HumanAnswerInvalid>()(\n  \"@smthrs/flow/HumanAnswerInvalid\",\n  {\n    code: Schema.Literals([\"answer_invalid\", \"answer_not_open\"]).pipe(\n      Schema.withConstructorDefault(Effect.succeed(\"answer_invalid\"))\n    ),\n    message: Schema.String\n  }\n) {}\n\n/**\n * The tag the human-task declaration is catalogued and resolved under.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const tag = \"system/human-task\"\n\n/**\n * The attempt budget a task that names none is asked under.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const defaultMaxAttempts = 10\n\n/**\n * The deepest supported JSON Schema path, counting the root as depth zero.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxSchemaDepth = JsonSchemaSubset.maxSchemaDepth\n\n/**\n * The most schema objects one human-task request may contain.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxSchemaNodes = JsonSchemaSubset.maxSchemaNodes\n\n/**\n * The most JSON values embedded across schema keywords such as `enum`.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxSchemaValueNodes = JsonSchemaSubset.maxSchemaValueNodes\n\n/**\n * The deepest JSON value embedded in a schema, including enum members.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxSchemaValueDepth = JsonSchemaSubset.maxSchemaValueDepth\n\n/**\n * The most JSON values one answer validation may visit.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxAnswerNodes = JsonSchemaSubset.maxAnswerNodes\n\n/**\n * The largest encoded JSON answer that can enter the durable store.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxAnswerBytes = JsonSchemaSubset.maxAnswerBytes\n\n/**\n * The largest encoded JSON Schema carried by one question.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxSchemaBytes = JsonSchemaSubset.maxSchemaBytes\n\n/**\n * The deepest admitted answer tree.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxAnswerDepth = JsonSchemaSubset.maxAnswerDepth\n\n/**\n * The largest encoded string value admitted in a request or answer.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxJsonStringBytes = JsonSchemaSubset.maxJsonStringBytes\n\n/**\n * The largest encoded object key admitted in a request or answer.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxJsonKeyBytes = JsonSchemaSubset.maxJsonKeyBytes\n\n/**\n * The most members admitted in one JSON array or object.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxJsonMembers = JsonSchemaSubset.maxJsonMembers\n\n/**\n * The largest encoded task name.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxTaskNameBytes = 1_024\n\n/**\n * The largest encoded prompt.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxPromptBytes = 64 * 1024\n\n/**\n * The largest option list on one select question.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxOptions = 256\n\n/**\n * The largest encoded select option.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxOptionBytes = 4 * 1024\n\n/**\n * The largest attempt budget one human task may declare.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxAttemptBudget = 1_000\n\n/**\n * The most caller-supplied characters retained in one rendered diagnostic.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxDiagnosticChars = JsonSchemaSubset.maxDiagnosticChars\n\n/**\n * The most characters retained across a terminal failure's rejection list.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxRetainedRejectionChars = 8_192\n\n/**\n * The durable deferred one attempt at answering resolves through.\n *\n * Attempts are separate wait points on purpose. A durable deferred records the\n * FIRST completion and replays it forever, so re-asking on the same wait point\n * would read the refused answer again on every round; a new point per attempt\n * makes \"answer again\" expressible without a second completion mechanism, and\n * leaves the refused answers in place as the record of what was asked and what\n * came back.\n *\n * The name lives in {@link module:WaitFor}'s namespace because an answer is\n * completed through exactly the {@link module:WaitFor} path: a token, and\n * `DurableDeferred.succeed`. {@link answer} is that call with the token parsed\n * for you.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const deferred = (\n  name: string,\n  attempt: number\n): DurableDeferred.DurableDeferred<typeof Schema.Json> => WaitFor.deferred(`${name}#${attempt}`)\n\n/** The namespace {@link module:WaitFor.deferred} prepends to every wait point. */\nconst waitForNamespace = /^WaitFor\\//\n\n/**\n * The only spelling of an attempt {@link deferred} writes: a canonical decimal\n * with no sign, no leading zero, no exponent, and no fraction.\n *\n * `Number()` alone is not this check. `NaN`, `Infinity`, `-Infinity`, and\n * `1e+21` all survive a `Number()`/`String()` round trip character for\n * character, so a gate that rebuilt the name through `Number()` would accept\n * them as attempts the action never parks on.\n */\nconst attemptSuffix = /^(0|[1-9][0-9]*)$/\n\n/**\n * The deferred a token addresses, when {@link deferred} could have named it.\n *\n * {@link answer} builds its deferred FROM the caller's token, so\n * `DurableDeferred.done`'s own name check compares a name against itself and\n * can never refuse. This is the check that is not vacuous: the name is taken\n * apart at its attempt separator, the suffix is required to be a canonical\n * decimal naming an attempt the action can park on (a safe integer of one or\n * more), the name is rebuilt through {@link deferred}, and it is accepted only\n * when the rebuilt name is character-for-character the one the token carried.\n * A name {@link deferred} cannot produce -- a `DurableQueue` item address, a\n * plain {@link module:WaitFor} gate, another flow's deferred, a suffix spelled\n * any way other than the decimal {@link deferred} writes -- fails, so a\n * foreign token cannot be completed under `Schema.Json` through the\n * human-answer path.\n *\n * This bounds the confusion to human-task wait points. It does NOT distinguish\n * two human tasks from each other, nor a wait point an author deliberately\n * named to collide with one; separating those needs the deferred's schema and\n * purpose carried in the address itself, which is a wire-format change.\n *\n * @private\n */\nconst answerableDeferred = (\n  deferredName: string\n): DurableDeferred.DurableDeferred<typeof Schema.Json> | undefined => {\n  const separator = deferredName.lastIndexOf(\"#\")\n  if (separator === -1) return undefined\n  const suffix = deferredName.slice(separator + 1)\n  if (!attemptSuffix.test(suffix)) return undefined\n  const attempt = Number(suffix)\n  if (!Number.isSafeInteger(attempt) || attempt < 1) return undefined\n  const rebuilt = deferred(deferredName.slice(0, separator).replace(waitForNamespace, \"\"), attempt)\n  return rebuilt.name === deferredName ? rebuilt : undefined\n}\n\n/**\n * The clock a task's deadline is armed on.\n *\n * One clock per task, not one per attempt: the deadline bounds how long the\n * QUESTION stays open, so re-asking does not extend it. The name is the task's,\n * so every attempt's race arms and awaits the same durable timer \u2014 a clock row\n * keeps the deadline it was first armed with, which is what makes the bound\n * survive a restart.\n *\n * The deadline settles on both hosts. `@smthrs/engine`'s in-process engine and\n * the SQLite engine store each re-drive a run parked on\n * {@link module:DurableDeferred.raceAll}, so the durable timer wakes the\n * question wherever it was asked\n * (`packages/smithers/flows/engine-store/test/RacedParkResume.test.ts`).\n *\n * @private\n */\nconst timeoutClockName = (name: string): string => `HumanTask/${name}/timeout`\n\n/**\n * What one attempt settled with: the answer that arrived, or the deadline.\n *\n * @private\n */\nconst Settled = Schema.Union([\n  Schema.Struct({ _tag: Schema.Literal(\"answered\"), value: Schema.Json }),\n  Schema.Struct({ _tag: Schema.Literal(\"timeout\") })\n])\n\ntype Settled = typeof Settled.Type\n\n/**\n * What {@link validate} checks an answer against.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Request {\n  readonly kind: Kind\n  /** Ignored for `json`: an option list alone constrains no JSON value. */\n  readonly options?: ReadonlyArray<string> | undefined\n  readonly schema?: unknown\n}\n\n/**\n * Checks that a JSON Schema stays inside the bounded subset, at every depth.\n *\n * This is a different question from {@link validate}, which asks whether an\n * ANSWER fits a schema. A question is worth refusing before anyone is asked it:\n * a constraint the subset cannot enforce would otherwise be silently dropped,\n * and the person would be told their answer was fine when half of what was\n * asked for went unchecked.\n *\n * The subset is `type` (`object`, `array`, `string`, `number`, `integer`,\n * `boolean`, `null`), `enum`, `properties`, `required`, `items`, and\n * `nullable`; it lives in `internal/JsonSchemaSubset`.\n *\n * Returns the first reason the schema is out of bounds, or `undefined` when the\n * whole tree is inside it.\n *\n * @category combinators\n * @since 0.1.0\n */\nexport const validateSchema = (\n  schema: unknown,\n  path: ReadonlyArray<string> = []\n): string | undefined => JsonSchemaSubset.validateSchema(schema, path)\n\n/**\n * Checks one answer against the question that was asked.\n *\n * Returns the reason the answer was refused, or `undefined` when it fits. It is\n * exported because it is the same check an interface should run BEFORE it\n * records an answer: refusing a typo in the text box the person is looking at\n * is worth more than refusing it one durable round later.\n *\n * ```ts\n * const rejection = HumanTask.validate(value, { kind: \"select\", options })\n * if (rejection !== undefined) return showTheReviewer(rejection)\n * ```\n *\n * @category combinators\n * @since 0.1.0\n */\nexport const validate = (value: unknown, request: Request): string | undefined => {\n  switch (request.kind) {\n    case \"ask\":\n      if (typeof value !== \"string\") return \"The answer must be a string.\"\n      return BoundedJson.textFits(value, maxJsonStringBytes)\n        ? undefined\n        : `The answer must fit within ${maxJsonStringBytes} encoded bytes of well-formed text.`\n    case \"confirm\":\n      return typeof value === \"boolean\" ? undefined : \"The answer must be a boolean.\"\n    case \"select\": {\n      if (request.options === undefined || request.options.length === 0) {\n        return \"The question declares no options to choose from.\"\n      }\n      if (\n        request.options.length > maxOptions ||\n        request.options.some((option) => typeof option !== \"string\" || !BoundedJson.textFits(option, maxOptionBytes))\n      ) {\n        return `The question's options exceed the ${maxOptions}-member or ${maxOptionBytes}-byte limits.`\n      }\n      return request.options.some((option) => option === value)\n        ? undefined\n        : `The answer ${JsonSchemaSubset.renderDiagnostic(value)} is not one of ${\n          JsonSchemaSubset.truncateDiagnostic(request.options.join(\", \"))\n        }.`\n    }\n    default: {\n      if (request.schema !== undefined) return JsonSchemaSubset.check(value, request.schema)\n      const admitted = BoundedJson.admit(value, JsonSchemaSubset.answerLimits)\n      return admitted.ok ? undefined : admitted.complaint\n    }\n  }\n}\n\n/**\n * The fields a question is asked with.\n *\n * @private\n */\nconst boundedText = (label: string, maximumBytes: number) =>\n  Schema.String.check(\n    Schema.makeFilter(\n      (value) =>\n        BoundedJson.textFits(value, maximumBytes) ||\n        `${label} must be well-formed text within ${maximumBytes} encoded bytes`,\n      { title: `bounded${label.replaceAll(\" \", \"\")}` }\n    )\n  )\n\nconst boundedSchema = Schema.Json.check(\n  Schema.makeFilter(\n    (value) => {\n      const admitted = BoundedJson.admit(value, JsonSchemaSubset.schemaLimits)\n      return admitted.ok || admitted.complaint\n    },\n    { title: \"boundedHumanTaskSchema\" }\n  )\n)\n\nconst option = boundedText(\"option\", maxOptionBytes)\n\nconst payloadFields = {\n  name: boundedText(\"task name\", maxTaskNameBytes),\n  kind: Kind,\n  prompt: boundedText(\"prompt\", maxPromptBytes),\n  options: Schema.optional(\n    Schema.Array(option).check(Schema.isMaxLength(maxOptions))\n  ),\n  schema: Schema.optional(boundedSchema),\n  timeoutMs: Schema.optional(Schema.Number),\n  maxAttempts: Schema.optional(Schema.Number)\n}\n\n/**\n * The declared human-task action.\n *\n * **When to use**\n *\n * Use it in a body wherever the next step depends on a person: a release that\n * needs sign-off, a plan that needs a choice, a field the run cannot compute.\n * The node settles with the answer, so downstream steps read it the way they\n * read any other step result, and {@link decode} gives that answer the caller's\n * own type.\n *\n * ```ts\n * HumanTask.action.call({\n *   name: \"release\",\n *   kind: \"select\",\n *   prompt: \"Which build should ship?\",\n *   options: [\"canary\", \"stable\"],\n *   timeoutMs: 6 * 60 * 60 * 1000\n * })\n * ```\n *\n * `name` addresses the question, so two calls naming one question in one\n * execution await one answer \u2014 the same reading {@link module:WaitFor} takes,\n * for the same reason: a person has to be able to name what they are answering.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const action: Action.Declared<\n  typeof tag,\n  Schema.Struct<typeof payloadFields>,\n  typeof Schema.Json,\n  typeof HumanTaskFailed,\n  never\n> = Action.makeSystem(tag, {\n  payload: payloadFields,\n  success: Schema.Json,\n  error: HumanTaskFailed,\n  tier: \"sealed\"\n})\n\n/** The payload the action is called with, as its implementation reads it. */\ntype Payload = typeof action.payloadSchema.Type\n\n/**\n * The question a park publishes about itself, as the JSON text the durable\n * waiting row stores.\n *\n * It is the payload's own fields, narrowed to what an interface needs to\n * render an answer box and refuse a bad answer before a person sends it: the\n * kind picks the control, the prompt is the question, `options` fills a\n * select, `schema` validates a JSON answer, and the two attempt numbers say\n * how much of the budget is left. The answer VALUE never appears here \u2014 this\n * describes the question, not what anybody said.\n *\n * @private\n */\nconst declaredQuestion = (\n  payload: Payload,\n  attempt: number,\n  maxAttempts: number\n): string =>\n  JSON.stringify({\n    task: \"human\",\n    name: payload.name,\n    kind: payload.kind,\n    prompt: payload.prompt,\n    attempt,\n    maxAttempts,\n    ...(payload.options === undefined ? {} : { options: [...payload.options] }),\n    ...(payload.schema === undefined ? {} : { schema: payload.schema })\n  })\n\n/** Builds the failure a task settles with, with the reasons it refused. */\nconst failed = (\n  payload: Payload,\n  code: typeof HumanTaskFailed.Type[\"code\"],\n  attempts: number,\n  rejections: ReadonlyArray<string>,\n  message: string\n): HumanTaskFailed => new HumanTaskFailed({ code, task: payload.name, attempts, rejections, message })\n\ninterface RetainedRejections {\n  readonly entries: Array<string>\n  chars: number\n  omitted: number\n}\n\n/** Describes the tail of a rejection history that could not be retained. */\nconst omissionMarker = (count: number): string => `${count} further rejections were omitted.`\n\n/** Adds one rejection while keeping the terminal rejection history bounded. */\nconst retainRejection = (state: RetainedRejections, rejection: string): void => {\n  const alreadyOmitting = state.omitted > 0\n  if (alreadyOmitting) {\n    const previousMarker = state.entries.pop()!\n    state.chars -= previousMarker.length\n  }\n  if (!alreadyOmitting && state.chars + rejection.length <= maxRetainedRejectionChars) {\n    state.entries.push(rejection)\n    state.chars += rejection.length\n    return\n  }\n  state.omitted++\n  let marker = omissionMarker(state.omitted)\n  while (state.chars + marker.length > maxRetainedRejectionChars) {\n    const removed = state.entries.pop()!\n    state.chars -= removed.length\n    state.omitted++\n    marker = omissionMarker(state.omitted)\n  }\n  state.entries.push(marker)\n  state.chars += marker.length\n}\n\n/**\n * The attempt budget a payload asks for, refused when it is not a whole number\n * of attempts.\n *\n * @private\n */\nconst budgetOf = (payload: Payload): Effect.Effect<number, HumanTaskFailed> => {\n  const maxAttempts = payload.maxAttempts ?? defaultMaxAttempts\n  if (!Number.isInteger(maxAttempts) || maxAttempts < 1) {\n    return Effect.fail(\n      failed(\n        payload,\n        \"request_invalid\",\n        0,\n        [],\n        `${tag} was called with maxAttempts ${maxAttempts}. A question is asked at least once.`\n      )\n    )\n  }\n  return maxAttempts <= maxAttemptBudget\n    ? Effect.succeed(maxAttempts)\n    : Effect.fail(\n      failed(\n        payload,\n        \"request_invalid\",\n        0,\n        [],\n        `${tag} was called with maxAttempts ${maxAttempts}. A question asked more than ` +\n          `${maxAttemptBudget} times is a stuck question.`\n      )\n    )\n}\n\n/**\n * The deadline a payload asks for, refused when it is not a length of time.\n *\n * `Duration.millis` takes any number, so an unchecked deadline does not fail \u2014\n * it changes what the question means. `NaN` becomes zero and a negative stays\n * negative, so both are deadlines that have ALREADY passed: the task times out\n * on its first park and nobody is ever really asked. `Infinity` becomes the\n * infinite duration, so the race has a branch that can never win and a question\n * asked with a deadline has none. All three are the same authoring mistake as a\n * `select` with no options, and they are refused in the same place, before the\n * first park, rather than surfacing as a `timeout` nobody waited for.\n *\n * @private\n */\nconst deadlineOf = (payload: Payload): Effect.Effect<Duration.Duration | undefined, HumanTaskFailed> => {\n  const timeoutMs = payload.timeoutMs\n  if (timeoutMs === undefined) return Effect.succeed(undefined)\n  return Number.isFinite(timeoutMs) && timeoutMs >= 0\n    ? Effect.succeed(Duration.millis(timeoutMs))\n    : Effect.fail(\n      failed(\n        payload,\n        \"request_invalid\",\n        0,\n        [],\n        `${tag} was called with timeoutMs ${timeoutMs}. A deadline is a finite number of ` +\n          \"milliseconds that is not negative; the question would be over before it was asked, or \" +\n          \"never over at all.\"\n      )\n    )\n}\n\n/**\n * Refuses a question nobody could answer correctly, before anyone is asked.\n *\n * A `select` with no options and a schema outside the supported subset are\n * authoring mistakes whose only symptom at answer time would be a person being\n * refused for something they did not do, so {@link validateSchema} walks the\n * whole schema tree before the first park rather than waiting for an answer to\n * reach the keyword nobody can enforce.\n *\n * An `options` list on a `json` question is ignored because it constrains\n * nothing; JSON constraints come only from `schema`.\n *\n * @private\n */\nconst requestOf = (payload: Payload): Effect.Effect<Request, HumanTaskFailed> => {\n  const request: Request = {\n    kind: payload.kind,\n    options: payload.options,\n    ...(payload.schema === undefined ? {} : { schema: payload.schema })\n  }\n  if (payload.schema !== undefined && payload.kind !== \"json\") {\n    return Effect.fail(\n      failed(\n        payload,\n        \"request_invalid\",\n        0,\n        [],\n        `A schema describes a \"json\" answer, and this question is an \"${payload.kind}\".`\n      )\n    )\n  }\n  if (payload.kind === \"select\" && (payload.options === undefined || payload.options.length === 0)) {\n    return Effect.fail(\n      failed(payload, \"request_invalid\", 0, [], `${tag} was called as a select with no options to choose from.`)\n    )\n  }\n  if (payload.kind === \"json\" && payload.schema !== undefined) {\n    const complaint = validateSchema(payload.schema)\n    if (complaint !== undefined) return Effect.fail(failed(payload, \"request_invalid\", 0, [], complaint))\n  }\n  return Effect.succeed(request)\n}\n\n/**\n * Awaits one attempt, racing the answer against the task's deadline.\n *\n * The race is named per attempt because a durable race records its winner: one\n * name across attempts would replay the first attempt's answer forever. The\n * clock is NOT named per attempt, for the mirrored reason \u2014 the deadline is one\n * fact about the question.\n *\n * @private\n */\nconst attemptOnce = (\n  payload: Payload,\n  attempt: number,\n  deadline: Duration.Duration | undefined\n): Effect.Effect<Settled, never, Crypto.Crypto | FlowRuntime | FlowInstance> => {\n  const answered: Effect.Effect<Settled, never, FlowRuntime | FlowInstance> = Effect.map(\n    DurableDeferred.await(deferred(payload.name, attempt)),\n    (value): Settled => ({ _tag: \"answered\", value })\n  )\n  if (deadline === undefined) return answered\n  return DurableDeferred.raceAll({\n    name: `HumanTask/${payload.name}#${attempt}`,\n    success: Settled,\n    error: Schema.Never,\n    effects: [\n      answered,\n      Effect.as(\n        DurableClock.sleep({\n          name: timeoutClockName(payload.name),\n          duration: deadline,\n          // The wait is the point: the question parks the execution rather than\n          // holding a fiber open for however long a person takes.\n          inMemoryThreshold: Duration.zero\n        }),\n        { _tag: \"timeout\" } as const\n      )\n    ]\n  })\n}\n\n/**\n * What a refusal records: which question, which attempt, and why the answer\n * could not be accepted.\n *\n * @private\n */\nconst RejectionRecord = Schema.Struct({\n  task: Schema.String,\n  attempt: Schema.Number,\n  reason: Schema.String\n})\n\n/**\n * Records that an answer was refused, as a step rather than as a log line.\n *\n * A refusal is a decision the run made about something a person did, and it is\n * the only part of the exchange that is not already durable: the answer is\n * recorded under its own wait point and the re-ask is recorded as the next\n * one, but WHY the answer was refused would otherwise live in a log stream\n * nobody replays. `Action.make` is the recorded boundary the rest of this\n * package already writes through \u2014 {@link module:DurableClock.sleep} takes it\n * for an in-memory wait \u2014 so the refusal is dispatched, journaled, and\n * replayed like any other sealed step, under a name that carries the task and\n * the attempt it refused.\n *\n * The payload names no time. A record whose contents depend on the wall clock\n * would differ between the first run and its replay, which is the one thing a\n * journaled decision may never do.\n *\n * @private\n */\nconst recordRejection = (task: string, attempt: number, reason: string) =>\n  Action.make({\n    name: `HumanTask/${task}#${attempt}/rejected`,\n    tier: \"sealed\",\n    success: RejectionRecord,\n    execute: Effect.succeed({ task, attempt, reason })\n  })\n\n/**\n * The human-task implementation: park, validate, re-ask, settle.\n *\n * Provide it beside the other action implementation layers a body calls, over\n * the {@link module:Implementations.layerImplementations} table they file\n * themselves in:\n *\n * ```ts\n * Layer.mergeAll(HumanTask.layer, Interpreter.layer(Release)).pipe(\n *   Layer.provideMerge(Action.layerImplementations)\n * )\n * ```\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer: Layer.Layer<never, never, Crypto.Crypto | FlowRuntime> = action.toLayer((payload) =>\n  Effect.gen(function*() {\n    const instance = yield* FlowInstance\n    const maxAttempts = yield* budgetOf(payload)\n    const deadline = yield* deadlineOf(payload)\n    const request = yield* requestOf(payload)\n    const retained: RetainedRejections = { entries: [], chars: 0, omitted: 0 }\n    for (let attempt = 1; attempt <= maxAttempts; attempt++) {\n      const token = DurableDeferred.tokenFromExecutionId(deferred(payload.name, attempt), {\n        flow: instance.flow,\n        executionId: instance.executionId\n      })\n      // Declared rather than left to a driver's derivation, so the run parks\n      // under `approval` carrying the ONE wait point that is currently open.\n      // The question travels with the park for a different reason than the\n      // token does: the token addresses the wait, and the question is what an\n      // inbox has to render for a person to answer it at all. Without it a\n      // parked run carried nothing but a wait name, so run-3's\n      // `coding-clarification` could be listed and never asked.\n      yield* annotateWaiting({ reason: \"approval\", token, request: declaredQuestion(payload, attempt, maxAttempts) })\n      const settled = yield* attemptOnce(payload, attempt, deadline)\n      // The attempt is over either way, so the declared park is over too. A\n      // raced attempt awaits on a copied instance, so the branch that resolved\n      // could not clear the annotation itself.\n      yield* annotateWaiting(undefined)\n      if (settled._tag === \"timeout\") {\n        return yield* Effect.fail(\n          failed(\n            payload,\n            \"timeout\",\n            attempt,\n            retained.entries,\n            `Nobody answered \"${payload.name}\" within ${payload.timeoutMs} ms.`\n          )\n        )\n      }\n      const rejection = validate(settled.value, request)\n      if (rejection === undefined) return settled.value\n      retainRejection(retained, `attempt ${attempt}: ${rejection}`)\n      yield* recordRejection(payload.name, attempt, rejection)\n    }\n    return yield* Effect.fail(\n      failed(\n        payload,\n        \"rejected\",\n        maxAttempts,\n        retained.entries,\n        `\"${payload.name}\" was asked ${maxAttempts} times without an answer it could accept.`\n      )\n    )\n  })\n)\n\n/**\n * Records one answer to a human task.\n *\n * `token` is the value the run parked with \u2014 the `token` of the waiting\n * annotation, which is the wait point the current attempt is open on. The\n * runtime checks that exact approval wait and records the completion as one\n * mutation, so guessed, unopened, or stale attempt tokens cannot pre-answer a\n * run. An admitted answer then resumes the run through the ordinary durable\n * deferred path.\n *\n * The token is not a credential: anyone who knows or derives the address of\n * the open attempt can answer it. The host decides who may answer, and must\n * authorize the caller before calling `answer`.\n *\n * ```ts\n * yield* HumanTask.answer({ token: waiting.token, value: { decision: \"ship\" } })\n * ```\n *\n * The durable JSON boundary is validated here: the value must be inert,\n * detached, and within the exported depth, node, member, string, key, and byte\n * limits. Whether that JSON fits the question is the task's own judgment, made\n * where its kind and schema are known; a semantically refused answer stays\n * recorded so the record shows what was actually said. Call {@link validate}\n * first when the interface can refuse it while the person is still looking at\n * it.\n *\n * The TOKEN is checked. This entry point completes an arbitrary caller-supplied\n * address under `Schema.Json`, so it accepts only a token whose deferred name\n * {@link deferred} could have written. A token for a `DurableQueue` item, a\n * plain {@link module:WaitFor} gate, or an unrelated flow's deferred fails with\n * `TokenInvalid` carrying `deferred_mismatch` rather than writing a JSON exit\n * into a row another schema will decode.\n *\n * A syntactically valid HumanTask token can still fail with\n * `HumanAnswerInvalid` carrying `answer_not_open` when the addressed run is not\n * currently parked on that exact approval token.\n *\n * @category combinators\n * @since 0.1.0\n */\nexport const answer = (options: {\n  readonly token: DurableDeferred.Token\n  readonly value: typeof Schema.Json.Type\n}): Effect.Effect<void, DurableDeferred.TokenInvalid | HumanAnswerInvalid, FlowRuntime> =>\n  Effect.gen(function*() {\n    const admitted = BoundedJson.admit(options.value, JsonSchemaSubset.answerLimits)\n    if (!admitted.ok) {\n      return yield* Effect.fail(\n        new HumanAnswerInvalid({\n          message: `The human-task answer was not recorded: ${JsonSchemaSubset.truncateDiagnostic(admitted.complaint)}`\n        })\n      )\n    }\n    const parsed = yield* DurableDeferred.TokenParsed.parse(options.token)\n    const target = answerableDeferred(parsed.deferredName)\n    if (target === undefined) {\n      return yield* Effect.fail(\n        new DurableDeferred.TokenInvalid({\n          code: \"deferred_mismatch\",\n          message:\n            `The token addresses deferred \"${\n              JsonSchemaSubset.truncateDiagnostic(parsed.deferredName)\n            }\", which is not a ` +\n            \"human task wait point. Answer it through the surface that owns it.\"\n        })\n      )\n    }\n    const runtime = yield* FlowRuntime\n    const outcome = yield* runtime.deferredDoneIfWaiting(target, {\n      flowName: parsed.flowName,\n      executionId: parsed.executionId,\n      deferredName: parsed.deferredName,\n      reason: \"approval\",\n      token: options.token,\n      exit: Exit.succeed(admitted.value)\n    })\n    if (outcome === \"NotWaiting\") {\n      return yield* Effect.fail(\n        new HumanAnswerInvalid({\n          code: \"answer_not_open\",\n          message: \"The human-task answer was not recorded because the run is not parked on this approval token.\"\n        })\n      )\n    }\n  })\n\n/**\n * Gives an answer the caller's own type.\n *\n * The action's success schema is `Schema.Json`, because what a person may\n * answer is described by the task's payload rather than by a TypeScript type.\n * `decode` is the other half: the author states the schema they were really\n * asking for, and the node downstream of the question carries that type.\n *\n * ```ts\n * const Decision = Schema.Struct({ decision: Schema.Literals([\"ship\", \"hold\"]) })\n *\n * HumanTask.action.call({ name: \"release\", kind: \"json\", prompt, schema }).pipe(\n *   HumanTask.decode(Decision)\n * )\n * ```\n *\n * The two descriptions must agree. The answer already passed the task's own\n * JSON Schema before it reached here, so a value this schema rejects means the\n * payload's schema and the author's schema describe different answers \u2014 an\n * authoring mistake, not a human one \u2014 and it surfaces as a defect naming the\n * offending path rather than as a failure a body could sensibly catch.\n *\n * @category combinators\n * @since 0.1.0\n */\nexport const decode =\n  <S extends Schema.ConstraintDecoder<unknown>>(schema: S) =>\n  <E, R>(self: Node.Node<typeof Schema.Json.Type, E, R>): Node.Node<S[\"Type\"], E, R> =>\n    Node.map(self, Schema.decodeUnknownSync(schema))\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwCA,WAAsB;AAEtB,eAA0B;AAC1B,aAAwB;AACxB,WAAsB;AAEtB,aAAwB;AACxB,aAAwB;AACxB,mBAA8B;AAC9B,sBAAiC;AACjC,0BAA6B;AAC7B,yBAA4B;AAC5B,+BAAgC;AAChC,kBAA6B;AAC7B,uBAAkC;AAClC,cAAyB;AAuBlB,MAAM,OAAuE,OAAO,SAAS;AAAA,EAClG;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAkBM,MAAM,wBAAwB,OAAO,YAA6B;AAAA,EACvE;AAAA,EACA;AAAA,IACE,MAAM,OAAO,SAAS,CAAC,mBAAmB,YAAY,SAAS,CAAC;AAAA,IAChE,MAAM,OAAO;AAAA,IACb,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO,MAAM,OAAO,MAAM;AAAA,IACtC,SAAS,OAAO;AAAA,EAClB;AACF,EAAE;AAAC;AAQI,MAAM,2BAA2B,OAAO,YAAgC;AAAA,EAC7E;AAAA,EACA;AAAA,IACE,MAAM,OAAO,SAAS,CAAC,kBAAkB,iBAAiB,CAAC,EAAE;AAAA,MAC3D,OAAO,uBAAuB,OAAO,QAAQ,gBAAgB,CAAC;AAAA,IAChE;AAAA,IACA,SAAS,OAAO;AAAA,EAClB;AACF,EAAE;AAAC;AAQI,MAAM,MAAM;AAQZ,MAAM,qBAAqB;AAQ3B,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,sBAAsB,iBAAiB;AAQ7C,MAAM,sBAAsB,iBAAiB;AAQ7C,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,qBAAqB,iBAAiB;AAQ5C,MAAM,kBAAkB,iBAAiB;AAQzC,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,mBAAmB;AAQzB,MAAM,iBAAiB,KAAK;AAQ5B,MAAM,aAAa;AAQnB,MAAM,iBAAiB,IAAI;AAQ3B,MAAM,mBAAmB;AAQzB,MAAM,qBAAqB,iBAAiB;AAQ5C,MAAM,4BAA4B;AAoBlC,MAAM,WAAW,CACtB,MACA,YACwD,QAAQ,SAAS,GAAG,IAAI,IAAI,OAAO,EAAE;AAG/F,MAAM,mBAAmB;AAWzB,MAAM,gBAAgB;AAyBtB,MAAM,qBAAqB,CACzB,iBACoE;AACpE,QAAM,YAAY,aAAa,YAAY,GAAG;AAC9C,MAAI,cAAc,GAAI,QAAO;AAC7B,QAAM,SAAS,aAAa,MAAM,YAAY,CAAC;AAC/C,MAAI,CAAC,cAAc,KAAK,MAAM,EAAG,QAAO;AACxC,QAAM,UAAU,OAAO,MAAM;AAC7B,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,UAAU,EAAG,QAAO;AAC1D,QAAM,UAAU,SAAS,aAAa,MAAM,GAAG,SAAS,EAAE,QAAQ,kBAAkB,EAAE,GAAG,OAAO;AAChG,SAAO,QAAQ,SAAS,eAAe,UAAU;AACnD;AAmBA,MAAM,mBAAmB,CAAC,SAAyB,aAAa,IAAI;AAOpE,MAAM,UAAU,OAAO,MAAM;AAAA,EAC3B,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,UAAU,GAAG,OAAO,OAAO,KAAK,CAAC;AAAA,EACtE,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,SAAS,EAAE,CAAC;AACnD,CAAC;AAoCM,MAAM,iBAAiB,CAC5B,QACA,OAA8B,CAAC,MACR,iBAAiB,eAAe,QAAQ,IAAI;AAkB9D,MAAM,WAAW,CAAC,OAAgB,YAAyC;AAChF,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK;AACH,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,aAAO,YAAY,SAAS,OAAO,kBAAkB,IACjD,SACA,8BAA8B,kBAAkB;AAAA,IACtD,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,SAAY;AAAA,IAClD,KAAK,UAAU;AACb,UAAI,QAAQ,YAAY,UAAa,QAAQ,QAAQ,WAAW,GAAG;AACjE,eAAO;AAAA,MACT;AACA,UACE,QAAQ,QAAQ,SAAS,cACzB,QAAQ,QAAQ,KAAK,CAACA,YAAW,OAAOA,YAAW,YAAY,CAAC,YAAY,SAASA,SAAQ,cAAc,CAAC,GAC5G;AACA,eAAO,qCAAqC,UAAU,cAAc,cAAc;AAAA,MACpF;AACA,aAAO,QAAQ,QAAQ,KAAK,CAACA,YAAWA,YAAW,KAAK,IACpD,SACA,cAAc,iBAAiB,iBAAiB,KAAK,CAAC,kBACtD,iBAAiB,mBAAmB,QAAQ,QAAQ,KAAK,IAAI,CAAC,CAChE;AAAA,IACJ;AAAA,IACA,SAAS;AACP,UAAI,QAAQ,WAAW,OAAW,QAAO,iBAAiB,MAAM,OAAO,QAAQ,MAAM;AACrF,YAAM,WAAW,YAAY,MAAM,OAAO,iBAAiB,YAAY;AACvE,aAAO,SAAS,KAAK,SAAY,SAAS;AAAA,IAC5C;AAAA,EACF;AACF;AAOA,MAAM,cAAc,CAAC,OAAe,iBAClC,OAAO,OAAO;AAAA,EACZ,OAAO;AAAA,IACL,CAAC,UACC,YAAY,SAAS,OAAO,YAAY,KACxC,GAAG,KAAK,oCAAoC,YAAY;AAAA,IAC1D,EAAE,OAAO,UAAU,MAAM,WAAW,KAAK,EAAE,CAAC,GAAG;AAAA,EACjD;AACF;AAEF,MAAM,gBAAgB,OAAO,KAAK;AAAA,EAChC,OAAO;AAAA,IACL,CAAC,UAAU;AACT,YAAM,WAAW,YAAY,MAAM,OAAO,iBAAiB,YAAY;AACvE,aAAO,SAAS,MAAM,SAAS;AAAA,IACjC;AAAA,IACA,EAAE,OAAO,yBAAyB;AAAA,EACpC;AACF;AAEA,MAAM,SAAS,YAAY,UAAU,cAAc;AAEnD,MAAM,gBAAgB;AAAA,EACpB,MAAM,YAAY,aAAa,gBAAgB;AAAA,EAC/C,MAAM;AAAA,EACN,QAAQ,YAAY,UAAU,cAAc;AAAA,EAC5C,SAAS,OAAO;AAAA,IACd,OAAO,MAAM,MAAM,EAAE,MAAM,OAAO,YAAY,UAAU,CAAC;AAAA,EAC3D;AAAA,EACA,QAAQ,OAAO,SAAS,aAAa;AAAA,EACrC,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,EACxC,aAAa,OAAO,SAAS,OAAO,MAAM;AAC5C;AA8BO,MAAM,SAMT,OAAO,WAAW,KAAK;AAAA,EACzB,SAAS;AAAA,EACT,SAAS,OAAO;AAAA,EAChB,OAAO;AAAA,EACP,MAAM;AACR,CAAC;AAkBD,MAAM,mBAAmB,CACvB,SACA,SACA,gBAEA,KAAK,UAAU;AAAA,EACb,MAAM;AAAA,EACN,MAAM,QAAQ;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,QAAQ,QAAQ;AAAA,EAChB;AAAA,EACA;AAAA,EACA,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,QAAQ,OAAO,EAAE;AAAA,EACzE,GAAI,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AACnE,CAAC;AAGH,MAAM,SAAS,CACb,SACA,MACA,UACA,YACA,YACoB,IAAI,gBAAgB,EAAE,MAAM,MAAM,QAAQ,MAAM,UAAU,YAAY,QAAQ,CAAC;AASrG,MAAM,iBAAiB,CAAC,UAA0B,GAAG,KAAK;AAG1D,MAAM,kBAAkB,CAAC,OAA2B,cAA4B;AAC9E,QAAM,kBAAkB,MAAM,UAAU;AACxC,MAAI,iBAAiB;AACnB,UAAM,iBAAiB,MAAM,QAAQ,IAAI;AACzC,UAAM,SAAS,eAAe;AAAA,EAChC;AACA,MAAI,CAAC,mBAAmB,MAAM,QAAQ,UAAU,UAAU,2BAA2B;AACnF,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,SAAS,UAAU;AACzB;AAAA,EACF;AACA,QAAM;AACN,MAAI,SAAS,eAAe,MAAM,OAAO;AACzC,SAAO,MAAM,QAAQ,OAAO,SAAS,2BAA2B;AAC9D,UAAM,UAAU,MAAM,QAAQ,IAAI;AAClC,UAAM,SAAS,QAAQ;AACvB,UAAM;AACN,aAAS,eAAe,MAAM,OAAO;AAAA,EACvC;AACA,QAAM,QAAQ,KAAK,MAAM;AACzB,QAAM,SAAS,OAAO;AACxB;AAQA,MAAM,WAAW,CAAC,YAA6D;AAC7E,QAAM,cAAc,QAAQ,eAAe;AAC3C,MAAI,CAAC,OAAO,UAAU,WAAW,KAAK,cAAc,GAAG;AACrD,WAAO,OAAO;AAAA,MACZ;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAC;AAAA,QACD,GAAG,GAAG,gCAAgC,WAAW;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACA,SAAO,eAAe,mBAClB,OAAO,QAAQ,WAAW,IAC1B,OAAO;AAAA,IACP;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC;AAAA,MACD,GAAG,GAAG,gCAAgC,WAAW,gCAC5C,gBAAgB;AAAA,IACvB;AAAA,EACF;AACJ;AAgBA,MAAM,aAAa,CAAC,YAAoF;AACtG,QAAM,YAAY,QAAQ;AAC1B,MAAI,cAAc,OAAW,QAAO,OAAO,QAAQ,MAAS;AAC5D,SAAO,OAAO,SAAS,SAAS,KAAK,aAAa,IAC9C,OAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,IACzC,OAAO;AAAA,IACP;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC;AAAA,MACD,GAAG,GAAG,8BAA8B,SAAS;AAAA,IAG/C;AAAA,EACF;AACJ;AAgBA,MAAM,YAAY,CAAC,YAA8D;AAC/E,QAAM,UAAmB;AAAA,IACvB,MAAM,QAAQ;AAAA,IACd,SAAS,QAAQ;AAAA,IACjB,GAAI,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,EACnE;AACA,MAAI,QAAQ,WAAW,UAAa,QAAQ,SAAS,QAAQ;AAC3D,WAAO,OAAO;AAAA,MACZ;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAC;AAAA,QACD,gEAAgE,QAAQ,IAAI;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,aAAa,QAAQ,YAAY,UAAa,QAAQ,QAAQ,WAAW,IAAI;AAChG,WAAO,OAAO;AAAA,MACZ,OAAO,SAAS,mBAAmB,GAAG,CAAC,GAAG,GAAG,GAAG,yDAAyD;AAAA,IAC3G;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,UAAU,QAAQ,WAAW,QAAW;AAC3D,UAAM,YAAY,eAAe,QAAQ,MAAM;AAC/C,QAAI,cAAc,OAAW,QAAO,OAAO,KAAK,OAAO,SAAS,mBAAmB,GAAG,CAAC,GAAG,SAAS,CAAC;AAAA,EACtG;AACA,SAAO,OAAO,QAAQ,OAAO;AAC/B;AAYA,MAAM,cAAc,CAClB,SACA,SACA,aAC8E;AAC9E,QAAM,WAAsE,OAAO;AAAA,IACjF,gBAAgB,MAAM,SAAS,QAAQ,MAAM,OAAO,CAAC;AAAA,IACrD,CAAC,WAAoB,EAAE,MAAM,YAAY,MAAM;AAAA,EACjD;AACA,MAAI,aAAa,OAAW,QAAO;AACnC,SAAO,gBAAgB,QAAQ;AAAA,IAC7B,MAAM,aAAa,QAAQ,IAAI,IAAI,OAAO;AAAA,IAC1C,SAAS;AAAA,IACT,OAAO,OAAO;AAAA,IACd,SAAS;AAAA,MACP;AAAA,MACA,OAAO;AAAA,QACL,aAAa,MAAM;AAAA,UACjB,MAAM,iBAAiB,QAAQ,IAAI;AAAA,UACnC,UAAU;AAAA;AAAA;AAAA,UAGV,mBAAmB,SAAS;AAAA,QAC9B,CAAC;AAAA,QACD,EAAE,MAAM,UAAU;AAAA,MACpB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAQA,MAAM,kBAAkB,OAAO,OAAO;AAAA,EACpC,MAAM,OAAO;AAAA,EACb,SAAS,OAAO;AAAA,EAChB,QAAQ,OAAO;AACjB,CAAC;AAqBD,MAAM,kBAAkB,CAAC,MAAc,SAAiB,WACtD,OAAO,KAAK;AAAA,EACV,MAAM,aAAa,IAAI,IAAI,OAAO;AAAA,EAClC,MAAM;AAAA,EACN,SAAS;AAAA,EACT,SAAS,OAAO,QAAQ,EAAE,MAAM,SAAS,OAAO,CAAC;AACnD,CAAC;AAkBI,MAAM,QAAgE,OAAO;AAAA,EAAQ,CAAC,YAC3F,OAAO,IAAI,aAAY;AACrB,UAAM,WAAW,OAAO;AACxB,UAAM,cAAc,OAAO,SAAS,OAAO;AAC3C,UAAM,WAAW,OAAO,WAAW,OAAO;AAC1C,UAAM,UAAU,OAAO,UAAU,OAAO;AACxC,UAAM,WAA+B,EAAE,SAAS,CAAC,GAAG,OAAO,GAAG,SAAS,EAAE;AACzE,aAAS,UAAU,GAAG,WAAW,aAAa,WAAW;AACvD,YAAM,QAAQ,gBAAgB,qBAAqB,SAAS,QAAQ,MAAM,OAAO,GAAG;AAAA,QAClF,MAAM,SAAS;AAAA,QACf,aAAa,SAAS;AAAA,MACxB,CAAC;AAQD,iBAAO,0CAAgB,EAAE,QAAQ,YAAY,OAAO,SAAS,iBAAiB,SAAS,SAAS,WAAW,EAAE,CAAC;AAC9G,YAAM,UAAU,OAAO,YAAY,SAAS,SAAS,QAAQ;AAI7D,iBAAO,0CAAgB,MAAS;AAChC,UAAI,QAAQ,SAAS,WAAW;AAC9B,eAAO,OAAO,OAAO;AAAA,UACnB;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA,SAAS;AAAA,YACT,oBAAoB,QAAQ,IAAI,YAAY,QAAQ,SAAS;AAAA,UAC/D;AAAA,QACF;AAAA,MACF;AACA,YAAM,YAAY,SAAS,QAAQ,OAAO,OAAO;AACjD,UAAI,cAAc,OAAW,QAAO,QAAQ;AAC5C,sBAAgB,UAAU,WAAW,OAAO,KAAK,SAAS,EAAE;AAC5D,aAAO,gBAAgB,QAAQ,MAAM,SAAS,SAAS;AAAA,IACzD;AACA,WAAO,OAAO,OAAO;AAAA,MACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,IAAI,QAAQ,IAAI,eAAe,WAAW;AAAA,MAC5C;AAAA,IACF;AAAA,EACF,CAAC;AACH;AA0CO,MAAM,SAAS,CAAC,YAIrB,OAAO,IAAI,aAAY;AACrB,QAAM,WAAW,YAAY,MAAM,QAAQ,OAAO,iBAAiB,YAAY;AAC/E,MAAI,CAAC,SAAS,IAAI;AAChB,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,mBAAmB;AAAA,QACrB,SAAS,2CAA2C,iBAAiB,mBAAmB,SAAS,SAAS,CAAC;AAAA,MAC7G,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,SAAS,OAAO,gBAAgB,YAAY,MAAM,QAAQ,KAAK;AACrE,QAAM,SAAS,mBAAmB,OAAO,YAAY;AACrD,MAAI,WAAW,QAAW;AACxB,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,gBAAgB,aAAa;AAAA,QAC/B,MAAM;AAAA,QACN,SACE,iCACE,iBAAiB,mBAAmB,OAAO,YAAY,CACzD;AAAA,MAEJ,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,UAAU,OAAO;AACvB,QAAM,UAAU,OAAO,QAAQ,sBAAsB,QAAQ;AAAA,IAC3D,UAAU,OAAO;AAAA,IACjB,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,IACrB,QAAQ;AAAA,IACR,OAAO,QAAQ;AAAA,IACf,MAAM,KAAK,QAAQ,SAAS,KAAK;AAAA,EACnC,CAAC;AACD,MAAI,YAAY,cAAc;AAC5B,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,mBAAmB;AAAA,QACrB,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AA2BI,MAAM,SACX,CAA8C,WAC9C,CAAO,SACL,KAAK,IAAI,MAAM,OAAO,kBAAkB,MAAM,CAAC;",
+  "sourcesContent": ["/**\n * Asking a person something, as an ordinary declared action.\n *\n * {@link module:WaitFor.action} is the general rendezvous: it parks until\n * something outside the run resolves it, and settles with whatever arrived.\n * That is the right primitive and the wrong affordance for a human, because a\n * human answers in prose, in a hurry, and sometimes wrongly. Smithers 0.x had\n * the affordance \u2014 a `HumanTask` with a kind, a prompt, an output schema, an\n * attempt budget, and a deadline \u2014 and this module is that affordance rebuilt\n * on the primitives this package already has.\n *\n * Four things are added to a bare wait:\n *\n * - a **kind**, so the four shapes a person is asked for (`ask`, `confirm`,\n *   `select`, `json`) are stated rather than reconstructed from a schema;\n * - **validation**, so an answer that does not fit is refused where it arrives\n *   instead of failing three steps later as a decode error;\n * - **re-asking**, so a refused answer parks again on a NEW wait point rather\n *   than ending the run, until the attempt budget is spent;\n * - a **deadline**, so a question nobody answers settles instead of parking\n *   forever.\n *\n * All four are built from what is already durable. Each attempt is its own wait\n * point in {@link module:WaitFor}'s namespace \u2014 `WaitFor/<name>#<attempt>` \u2014 so\n * an answer is recorded exactly as any other durable deferred completion is, a\n * refused answer stays recorded under the attempt that refused it, and a\n * re-driven round replays every answer it already has before parking on the\n * first attempt that has none. The reason an answer was refused is recorded\n * too, as a sealed step named `HumanTask/<name>#<attempt>/rejected`, so the\n * judgment the run made sits in the journal beside the answer it judged rather\n * than in a log stream nobody replays. The park is declared through the ordinary\n * waiting vocabulary under `approval`, carrying the current attempt's token, so\n * whoever collects answers always sees the one wait point that is open. The\n * deadline is a {@link module:DurableClock} armed once per task and raced\n * against every attempt, which makes it a deadline for the QUESTION rather than\n * for one attempt at answering it.\n *\n * @since 0.1.0\n */\n\nimport * as Node from \"@smthrs/plan/Node\"\nimport type * as Crypto from \"effect/Crypto\"\nimport * as Duration from \"effect/Duration\"\nimport * as Effect from \"effect/Effect\"\nimport * as Exit from \"effect/Exit\"\nimport type * as Layer from \"effect/Layer\"\nimport * as Schema from \"effect/Schema\"\nimport * as Action from \"./Action/index.ts\"\nimport * as DurableClock from \"./DurableClock.ts\"\nimport * as DurableDeferred from \"./DurableDeferred.ts\"\nimport { FlowInstance } from \"./FlowRuntime/FlowInstance.ts\"\nimport { FlowRuntime } from \"./FlowRuntime/FlowRuntime.ts\"\nimport { annotateWaiting } from \"./FlowRuntime/WaitingAnnotation.ts\"\nimport * as BoundedJson from \"./internal/BoundedJson.ts\"\nimport * as JsonSchemaSubset from \"./internal/JsonSchemaSubset.ts\"\nimport * as WaitFor from \"./WaitFor.ts\"\n\n/**\n * The shape a person is asked for.\n *\n * `ask` wants prose, `confirm` wants yes or no, `select` wants one of the\n * options the task names, and `json` wants a value the task's JSON Schema\n * accepts. The kind is what an interface renders and what {@link validate}\n * checks; it is stated rather than inferred, because a text box and a two-\n * button confirmation are different questions even when both answers happen to\n * be strings.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Kind = \"ask\" | \"confirm\" | \"select\" | \"json\"\n\n/**\n * The schema the `kind` payload field is declared with.\n *\n * @category schemas\n * @since 0.1.0\n */\nexport const Kind: Schema.Literals<readonly [\"ask\", \"confirm\", \"select\", \"json\"]> = Schema.Literals([\n  \"ask\",\n  \"confirm\",\n  \"select\",\n  \"json\"\n])\n\n/**\n * A question that ended without an answer the task could accept.\n *\n * `request_invalid` is the author's mistake \u2014 a `select` with no options, an\n * attempt budget below one, a deadline that is not a length of time, a JSON\n * Schema outside the supported subset \u2014 and is refused before anyone is asked\n * anything. `rejected` means every attempt was\n * spent on answers the task refused, and `timeout` means the deadline passed\n * with the question still open. All three are typed failures rather than\n * defects, so a body recovers from them with `Node.catch` like any other\n * declared failure \u2014 which is the point, because \"the reviewer never answered\"\n * is an ordinary outcome of asking a reviewer.\n *\n * @category errors\n * @since 0.1.0\n */\nexport class HumanTaskFailed extends Schema.TaggedError<HumanTaskFailed>()(\n  \"@smthrs/flow/HumanTaskFailed\",\n  {\n    code: Schema.Literals([\"request_invalid\", \"rejected\", \"timeout\"]),\n    task: Schema.String,\n    attempts: Schema.Number,\n    rejections: Schema.Array(Schema.String),\n    message: Schema.String\n  }\n) {}\n\n/**\n * An answer refused before it could consume durable storage.\n *\n * @category errors\n * @since 1.0.0\n */\nexport class HumanAnswerInvalid extends Schema.TaggedError<HumanAnswerInvalid>()(\n  \"@smthrs/flow/HumanAnswerInvalid\",\n  {\n    code: Schema.Literals([\"answer_invalid\", \"answer_not_open\"]).pipe(\n      Schema.withConstructorDefault(Effect.succeed(\"answer_invalid\"))\n    ),\n    message: Schema.String\n  }\n) {}\n\n/**\n * The tag the human-task declaration is catalogued and resolved under.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const tag = \"system/human-task\"\n\n/**\n * The attempt budget a task that names none is asked under.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const defaultMaxAttempts = 10\n\n/**\n * The deepest supported JSON Schema path, counting the root as depth zero.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxSchemaDepth = JsonSchemaSubset.maxSchemaDepth\n\n/**\n * The most schema objects one human-task request may contain.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxSchemaNodes = JsonSchemaSubset.maxSchemaNodes\n\n/**\n * The most JSON values embedded across schema keywords such as `enum`.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxSchemaValueNodes = JsonSchemaSubset.maxSchemaValueNodes\n\n/**\n * The deepest JSON value embedded in a schema, including enum members.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxSchemaValueDepth = JsonSchemaSubset.maxSchemaValueDepth\n\n/**\n * The most JSON values one answer validation may visit.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxAnswerNodes = JsonSchemaSubset.maxAnswerNodes\n\n/**\n * The largest encoded JSON answer that can enter the durable store.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxAnswerBytes = JsonSchemaSubset.maxAnswerBytes\n\n/**\n * The largest encoded JSON Schema carried by one question.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxSchemaBytes = JsonSchemaSubset.maxSchemaBytes\n\n/**\n * The deepest admitted answer tree.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxAnswerDepth = JsonSchemaSubset.maxAnswerDepth\n\n/**\n * The largest encoded string value admitted in a request or answer.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxJsonStringBytes = JsonSchemaSubset.maxJsonStringBytes\n\n/**\n * The largest encoded object key admitted in a request or answer.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxJsonKeyBytes = JsonSchemaSubset.maxJsonKeyBytes\n\n/**\n * The most members admitted in one JSON array or object.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxJsonMembers = JsonSchemaSubset.maxJsonMembers\n\n/**\n * The largest encoded task name.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxTaskNameBytes = 1_024\n\n/**\n * The largest encoded prompt.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxPromptBytes = 64 * 1024\n\n/**\n * The largest option list on one select question.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxOptions = 256\n\n/**\n * The largest encoded select option.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const maxOptionBytes = 4 * 1024\n\n/**\n * The largest attempt budget one human task may declare.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxAttemptBudget = 1_000\n\n/**\n * The most caller-supplied characters retained in one rendered diagnostic.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxDiagnosticChars = JsonSchemaSubset.maxDiagnosticChars\n\n/**\n * The most characters retained across a terminal failure's rejection list.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const maxRetainedRejectionChars = 8_192\n\n/**\n * The durable deferred one attempt at answering resolves through.\n *\n * Attempts are separate wait points on purpose. A durable deferred records the\n * FIRST completion and replays it forever, so re-asking on the same wait point\n * would read the refused answer again on every round; a new point per attempt\n * makes \"answer again\" expressible without a second completion mechanism, and\n * leaves the refused answers in place as the record of what was asked and what\n * came back.\n *\n * The name lives in {@link module:WaitFor}'s namespace because an answer is\n * completed through exactly the {@link module:WaitFor} path: a token, and\n * `DurableDeferred.succeed`. {@link answer} is that call with the token parsed\n * for you.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const deferred = (\n  name: string,\n  attempt: number\n): DurableDeferred.DurableDeferred<typeof Schema.Json> => WaitFor.deferred(`${name}#${attempt}`)\n\n/** The namespace {@link module:WaitFor.deferred} prepends to every wait point. */\nconst waitForNamespace = /^WaitFor\\//\n\n/**\n * The only spelling of an attempt {@link deferred} writes: a canonical decimal\n * with no sign, no leading zero, no exponent, and no fraction.\n *\n * `Number()` alone is not this check. `NaN`, `Infinity`, `-Infinity`, and\n * `1e+21` all survive a `Number()`/`String()` round trip character for\n * character, so a gate that rebuilt the name through `Number()` would accept\n * them as attempts the action never parks on.\n */\nconst attemptSuffix = /^(0|[1-9][0-9]*)$/\n\n/**\n * The deferred a token addresses, when {@link deferred} could have named it.\n *\n * {@link answer} builds its deferred FROM the caller's token, so\n * `DurableDeferred.done`'s own name check compares a name against itself and\n * can never refuse. This is the check that is not vacuous: the name is taken\n * apart at its attempt separator, the suffix is required to be a canonical\n * decimal naming an attempt the action can park on (a safe integer of one or\n * more), the name is rebuilt through {@link deferred}, and it is accepted only\n * when the rebuilt name is character-for-character the one the token carried.\n * A name {@link deferred} cannot produce -- a `DurableQueue` item address, a\n * plain {@link module:WaitFor} gate, another flow's deferred, a suffix spelled\n * any way other than the decimal {@link deferred} writes -- fails, so a\n * foreign token cannot be completed under `Schema.Json` through the\n * human-answer path.\n *\n * This bounds the confusion to human-task wait points. It does NOT distinguish\n * two human tasks from each other, nor a wait point an author deliberately\n * named to collide with one; separating those needs the deferred's schema and\n * purpose carried in the address itself, which is a wire-format change.\n *\n * @private\n */\nconst answerableDeferred = (\n  deferredName: string\n): DurableDeferred.DurableDeferred<typeof Schema.Json> | undefined => {\n  const separator = deferredName.lastIndexOf(\"#\")\n  if (separator === -1) return undefined\n  const suffix = deferredName.slice(separator + 1)\n  if (!attemptSuffix.test(suffix)) return undefined\n  const attempt = Number(suffix)\n  if (!Number.isSafeInteger(attempt) || attempt < 1) return undefined\n  const rebuilt = deferred(deferredName.slice(0, separator).replace(waitForNamespace, \"\"), attempt)\n  return rebuilt.name === deferredName ? rebuilt : undefined\n}\n\n/**\n * The clock a task's deadline is armed on.\n *\n * One clock per task, not one per attempt: the deadline bounds how long the\n * QUESTION stays open, so re-asking does not extend it. The name is the task's,\n * so every attempt's race arms and awaits the same durable timer \u2014 a clock row\n * keeps the deadline it was first armed with, which is what makes the bound\n * survive a restart.\n *\n * The deadline settles on both hosts. `@smthrs/engine`'s in-process engine and\n * the SQLite engine store each re-drive a run parked on\n * {@link module:DurableDeferred.raceAll}, so the durable timer wakes the\n * question wherever it was asked\n * (`packages/smithers/flows/engine-store/test/RacedParkResume.test.ts`).\n *\n * @private\n */\nconst timeoutClockName = (name: string): string => `HumanTask/${name}/timeout`\n\n/**\n * What one attempt settled with: the answer that arrived, or the deadline.\n *\n * @private\n */\nconst Settled = Schema.Union([\n  Schema.Struct({ _tag: Schema.Literal(\"answered\"), value: Schema.Json }),\n  Schema.Struct({ _tag: Schema.Literal(\"timeout\") })\n])\n\ntype Settled = typeof Settled.Type\n\n/**\n * What {@link validate} checks an answer against.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Request {\n  readonly kind: Kind\n  /** Ignored for `json`: an option list alone constrains no JSON value. */\n  readonly options?: ReadonlyArray<string> | undefined\n  readonly schema?: unknown\n}\n\n/**\n * Checks that a JSON Schema stays inside the bounded subset, at every depth.\n *\n * This is a different question from {@link validate}, which asks whether an\n * ANSWER fits a schema. A question is worth refusing before anyone is asked it:\n * a constraint the subset cannot enforce would otherwise be silently dropped,\n * and the person would be told their answer was fine when half of what was\n * asked for went unchecked.\n *\n * The subset is `type` (`object`, `array`, `string`, `number`, `integer`,\n * `boolean`, `null`), `enum`, `properties`, `required`, `items`, and\n * `nullable`; it lives in `internal/JsonSchemaSubset`.\n *\n * Returns the first reason the schema is out of bounds, or `undefined` when the\n * whole tree is inside it.\n *\n * @category combinators\n * @since 0.1.0\n */\nexport const validateSchema = (\n  schema: unknown,\n  path: ReadonlyArray<string> = []\n): string | undefined => JsonSchemaSubset.validateSchema(schema, path)\n\n/**\n * Checks one answer against the question that was asked.\n *\n * Returns the reason the answer was refused, or `undefined` when it fits. It is\n * exported because it is the same check an interface should run BEFORE it\n * records an answer: refusing a typo in the text box the person is looking at\n * is worth more than refusing it one durable round later.\n *\n * ```ts\n * const rejection = HumanTask.validate(value, { kind: \"select\", options })\n * if (rejection !== undefined) return showTheReviewer(rejection)\n * ```\n *\n * @category combinators\n * @since 0.1.0\n */\nexport const validate = (value: unknown, request: Request): string | undefined => {\n  switch (request.kind) {\n    case \"ask\":\n      if (typeof value !== \"string\") return \"The answer must be a string.\"\n      return BoundedJson.textFits(value, maxJsonStringBytes)\n        ? undefined\n        : `The answer must fit within ${maxJsonStringBytes} encoded bytes of well-formed text.`\n    case \"confirm\":\n      return typeof value === \"boolean\" ? undefined : \"The answer must be a boolean.\"\n    case \"select\": {\n      if (request.options === undefined || request.options.length === 0) {\n        return \"The question declares no options to choose from.\"\n      }\n      if (\n        request.options.length > maxOptions ||\n        request.options.some((option) => typeof option !== \"string\" || !BoundedJson.textFits(option, maxOptionBytes))\n      ) {\n        return `The question's options exceed the ${maxOptions}-member or ${maxOptionBytes}-byte limits.`\n      }\n      return request.options.some((option) => option === value)\n        ? undefined\n        : `The answer ${JsonSchemaSubset.renderDiagnostic(value)} is not one of ${\n          JsonSchemaSubset.truncateDiagnostic(request.options.join(\", \"))\n        }.`\n    }\n    default: {\n      if (request.schema !== undefined) return JsonSchemaSubset.check(value, request.schema)\n      const admitted = BoundedJson.admit(value, JsonSchemaSubset.answerLimits)\n      return admitted.ok ? undefined : admitted.complaint\n    }\n  }\n}\n\n/**\n * The fields a question is asked with.\n *\n * @private\n */\nconst boundedText = (label: string, maximumBytes: number) =>\n  Schema.String.check(\n    Schema.makeFilter(\n      (value) =>\n        BoundedJson.textFits(value, maximumBytes) ||\n        `${label} must be well-formed text within ${maximumBytes} encoded bytes`,\n      { title: `bounded${label.replaceAll(\" \", \"\")}` }\n    )\n  )\n\nconst boundedSchema = Schema.Json.check(\n  Schema.makeFilter(\n    (value) => {\n      const admitted = BoundedJson.admit(value, JsonSchemaSubset.schemaLimits)\n      return admitted.ok || admitted.complaint\n    },\n    { title: \"boundedHumanTaskSchema\" }\n  )\n)\n\nconst option = boundedText(\"option\", maxOptionBytes)\n\nconst payloadFields = {\n  name: boundedText(\"task name\", maxTaskNameBytes),\n  kind: Kind,\n  prompt: boundedText(\"prompt\", maxPromptBytes),\n  options: Schema.optional(\n    Schema.Array(option).check(Schema.isMaxLength(maxOptions))\n  ),\n  schema: Schema.optional(boundedSchema),\n  timeoutMs: Schema.optional(Schema.Number),\n  maxAttempts: Schema.optional(Schema.Number)\n}\n\n/**\n * The declared human-task action.\n *\n * **When to use**\n *\n * Use it in a body wherever the next step depends on a person: a release that\n * needs sign-off, a plan that needs a choice, a field the run cannot compute.\n * The node settles with the answer, so downstream steps read it the way they\n * read any other step result, and {@link decode} gives that answer the caller's\n * own type.\n *\n * ```ts\n * HumanTask.action.call({\n *   name: \"release\",\n *   kind: \"select\",\n *   prompt: \"Which build should ship?\",\n *   options: [\"canary\", \"stable\"],\n *   timeoutMs: 6 * 60 * 60 * 1000\n * })\n * ```\n *\n * `name` addresses the question, so two calls naming one question in one\n * execution await one answer \u2014 the same reading {@link module:WaitFor} takes,\n * for the same reason: a person has to be able to name what they are answering.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const action: Action.Declared<\n  typeof tag,\n  Schema.Struct<typeof payloadFields>,\n  typeof Schema.Json,\n  typeof HumanTaskFailed,\n  never\n> = Action.makeSystem(tag, {\n  payload: payloadFields,\n  success: Schema.Json,\n  error: HumanTaskFailed,\n  tier: \"sealed\"\n})\n\n/** The payload the action is called with, as its implementation reads it. */\ntype Payload = typeof action.payloadSchema.Type\n\n/**\n * The question a park publishes about itself, as the JSON text the durable\n * waiting row stores.\n *\n * It is the payload's own fields, narrowed to what an interface needs to\n * render an answer box and refuse a bad answer before a person sends it: the\n * kind picks the control, the prompt is the question, `options` fills a\n * select, `schema` validates a JSON answer, and the two attempt numbers say\n * how much of the budget is left. The answer VALUE never appears here \u2014 this\n * describes the question, not what anybody said.\n *\n * @private\n */\nconst declaredQuestion = (\n  payload: Payload,\n  attempt: number,\n  maxAttempts: number\n): string =>\n  JSON.stringify({\n    task: \"human\",\n    name: payload.name,\n    kind: payload.kind,\n    prompt: payload.prompt,\n    attempt,\n    maxAttempts,\n    ...(payload.options === undefined ? {} : { options: [...payload.options] }),\n    ...(payload.schema === undefined ? {} : { schema: payload.schema })\n  })\n\n/** Builds the failure a task settles with, with the reasons it refused. */\nconst failed = (\n  payload: Payload,\n  code: typeof HumanTaskFailed.Type[\"code\"],\n  attempts: number,\n  rejections: ReadonlyArray<string>,\n  message: string\n): HumanTaskFailed => new HumanTaskFailed({ code, task: payload.name, attempts, rejections, message })\n\ninterface RetainedRejections {\n  readonly entries: Array<string>\n  chars: number\n  omitted: number\n}\n\n/** Describes the tail of a rejection history that could not be retained. */\nconst omissionMarker = (count: number): string => `${count} further rejections were omitted.`\n\n/** Adds one rejection while keeping the terminal rejection history bounded. */\nconst retainRejection = (state: RetainedRejections, rejection: string): void => {\n  const alreadyOmitting = state.omitted > 0\n  if (alreadyOmitting) {\n    const previousMarker = state.entries.pop()!\n    state.chars -= previousMarker.length\n  }\n  if (!alreadyOmitting && state.chars + rejection.length <= maxRetainedRejectionChars) {\n    state.entries.push(rejection)\n    state.chars += rejection.length\n    return\n  }\n  state.omitted++\n  let marker = omissionMarker(state.omitted)\n  while (state.chars + marker.length > maxRetainedRejectionChars) {\n    const removed = state.entries.pop()!\n    state.chars -= removed.length\n    state.omitted++\n    marker = omissionMarker(state.omitted)\n  }\n  state.entries.push(marker)\n  state.chars += marker.length\n}\n\n/**\n * The attempt budget a payload asks for, refused when it is not a whole number\n * of attempts.\n *\n * @private\n */\nconst budgetOf = (payload: Payload): Effect.Effect<number, HumanTaskFailed> => {\n  const maxAttempts = payload.maxAttempts ?? defaultMaxAttempts\n  if (!Number.isInteger(maxAttempts) || maxAttempts < 1) {\n    return Effect.fail(\n      failed(\n        payload,\n        \"request_invalid\",\n        0,\n        [],\n        `${tag} was called with maxAttempts ${maxAttempts}. A question is asked at least once.`\n      )\n    )\n  }\n  return maxAttempts <= maxAttemptBudget\n    ? Effect.succeed(maxAttempts)\n    : Effect.fail(\n      failed(\n        payload,\n        \"request_invalid\",\n        0,\n        [],\n        `${tag} was called with maxAttempts ${maxAttempts}. A question asked more than ` +\n          `${maxAttemptBudget} times is a stuck question.`\n      )\n    )\n}\n\n/**\n * The deadline a payload asks for, refused when it is not a length of time.\n *\n * `Duration.millis` takes any number, so an unchecked deadline does not fail \u2014\n * it changes what the question means. `NaN` becomes zero and a negative stays\n * negative, so both are deadlines that have ALREADY passed: the task times out\n * on its first park and nobody is ever really asked. `Infinity` becomes the\n * infinite duration, so the race has a branch that can never win and a question\n * asked with a deadline has none. All three are the same authoring mistake as a\n * `select` with no options, and they are refused in the same place, before the\n * first park, rather than surfacing as a `timeout` nobody waited for.\n *\n * @private\n */\nconst deadlineOf = (payload: Payload): Effect.Effect<Duration.Duration | undefined, HumanTaskFailed> => {\n  const timeoutMs = payload.timeoutMs\n  if (timeoutMs === undefined) return Effect.succeed(undefined)\n  // The timeout clock is due at its start plus the deadline, and a durable\n  // store records that due time as a safe integer.\n  return Number.isFinite(timeoutMs) && timeoutMs >= 0 && timeoutMs <= Number.MAX_SAFE_INTEGER\n    ? Effect.succeed(Duration.millis(timeoutMs))\n    : Effect.fail(\n      failed(\n        payload,\n        \"request_invalid\",\n        0,\n        [],\n        `${tag} was called with timeoutMs ${timeoutMs}. A deadline is a number of milliseconds ` +\n          `from 0 to ${Number.MAX_SAFE_INTEGER}; the question would be over before it was asked, or ` +\n          \"never over at all.\"\n      )\n    )\n}\n\n/**\n * Refuses a question nobody could answer correctly, before anyone is asked.\n *\n * A `select` with no options and a schema outside the supported subset are\n * authoring mistakes whose only symptom at answer time would be a person being\n * refused for something they did not do, so {@link validateSchema} walks the\n * whole schema tree before the first park rather than waiting for an answer to\n * reach the keyword nobody can enforce.\n *\n * An `options` list on a `json` question is ignored because it constrains\n * nothing; JSON constraints come only from `schema`.\n *\n * @private\n */\nconst requestOf = (payload: Payload): Effect.Effect<Request, HumanTaskFailed> => {\n  const request: Request = {\n    kind: payload.kind,\n    options: payload.options,\n    ...(payload.schema === undefined ? {} : { schema: payload.schema })\n  }\n  if (payload.schema !== undefined && payload.kind !== \"json\") {\n    return Effect.fail(\n      failed(\n        payload,\n        \"request_invalid\",\n        0,\n        [],\n        `A schema describes a \"json\" answer, and this question is an \"${payload.kind}\".`\n      )\n    )\n  }\n  if (payload.kind === \"select\" && (payload.options === undefined || payload.options.length === 0)) {\n    return Effect.fail(\n      failed(payload, \"request_invalid\", 0, [], `${tag} was called as a select with no options to choose from.`)\n    )\n  }\n  if (payload.kind === \"json\" && payload.schema !== undefined) {\n    const complaint = validateSchema(payload.schema)\n    if (complaint !== undefined) return Effect.fail(failed(payload, \"request_invalid\", 0, [], complaint))\n  }\n  return Effect.succeed(request)\n}\n\n/**\n * Awaits one attempt, racing the answer against the task's deadline.\n *\n * The race is named per attempt because a durable race records its winner: one\n * name across attempts would replay the first attempt's answer forever. The\n * clock is NOT named per attempt, for the mirrored reason \u2014 the deadline is one\n * fact about the question.\n *\n * @private\n */\nconst attemptOnce = (\n  payload: Payload,\n  attempt: number,\n  deadline: Duration.Duration | undefined\n): Effect.Effect<Settled, never, Crypto.Crypto | FlowRuntime | FlowInstance> => {\n  const answered: Effect.Effect<Settled, never, FlowRuntime | FlowInstance> = Effect.map(\n    DurableDeferred.await(deferred(payload.name, attempt)),\n    (value): Settled => ({ _tag: \"answered\", value })\n  )\n  if (deadline === undefined) return answered\n  return DurableDeferred.raceAll({\n    name: `HumanTask/${payload.name}#${attempt}`,\n    success: Settled,\n    error: Schema.Never,\n    effects: [\n      answered,\n      Effect.as(\n        DurableClock.sleep({\n          name: timeoutClockName(payload.name),\n          duration: deadline,\n          // The wait is the point: the question parks the execution rather than\n          // holding a fiber open for however long a person takes.\n          inMemoryThreshold: Duration.zero\n        }),\n        { _tag: \"timeout\" } as const\n      )\n    ]\n  })\n}\n\n/**\n * What a refusal records: which question, which attempt, and why the answer\n * could not be accepted.\n *\n * @private\n */\nconst RejectionRecord = Schema.Struct({\n  task: Schema.String,\n  attempt: Schema.Number,\n  reason: Schema.String\n})\n\n/**\n * Records that an answer was refused, as a step rather than as a log line.\n *\n * A refusal is a decision the run made about something a person did, and it is\n * the only part of the exchange that is not already durable: the answer is\n * recorded under its own wait point and the re-ask is recorded as the next\n * one, but WHY the answer was refused would otherwise live in a log stream\n * nobody replays. `Action.make` is the recorded boundary the rest of this\n * package already writes through \u2014 {@link module:DurableClock.sleep} takes it\n * for an in-memory wait \u2014 so the refusal is dispatched, journaled, and\n * replayed like any other sealed step, under a name that carries the task and\n * the attempt it refused.\n *\n * The payload names no time. A record whose contents depend on the wall clock\n * would differ between the first run and its replay, which is the one thing a\n * journaled decision may never do.\n *\n * @private\n */\nconst recordRejection = (task: string, attempt: number, reason: string) =>\n  Action.make({\n    name: `HumanTask/${task}#${attempt}/rejected`,\n    tier: \"sealed\",\n    success: RejectionRecord,\n    execute: Effect.succeed({ task, attempt, reason })\n  })\n\n/**\n * The human-task implementation: park, validate, re-ask, settle.\n *\n * Provide it beside the other action implementation layers a body calls, over\n * the {@link module:Implementations.layerImplementations} table they file\n * themselves in:\n *\n * ```ts\n * Layer.mergeAll(HumanTask.layer, Interpreter.layer(Release)).pipe(\n *   Layer.provideMerge(Action.layerImplementations)\n * )\n * ```\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer: Layer.Layer<never, never, Crypto.Crypto | FlowRuntime> = action.toLayer((payload) =>\n  Effect.gen(function*() {\n    const instance = yield* FlowInstance\n    const maxAttempts = yield* budgetOf(payload)\n    const deadline = yield* deadlineOf(payload)\n    const request = yield* requestOf(payload)\n    const retained: RetainedRejections = { entries: [], chars: 0, omitted: 0 }\n    for (let attempt = 1; attempt <= maxAttempts; attempt++) {\n      const token = DurableDeferred.tokenFromExecutionId(deferred(payload.name, attempt), {\n        flow: instance.flow,\n        executionId: instance.executionId\n      })\n      // Declared rather than left to a driver's derivation, so the run parks\n      // under `approval` carrying the ONE wait point that is currently open.\n      // The question travels with the park for a different reason than the\n      // token does: the token addresses the wait, and the question is what an\n      // inbox has to render for a person to answer it at all. Without it a\n      // parked run carried nothing but a wait name, so run-3's\n      // `coding-clarification` could be listed and never asked.\n      yield* annotateWaiting({ reason: \"approval\", token, request: declaredQuestion(payload, attempt, maxAttempts) })\n      const settled = yield* attemptOnce(payload, attempt, deadline)\n      // The attempt is over either way, so the declared park is over too. A\n      // raced attempt awaits on a copied instance, so the branch that resolved\n      // could not clear the annotation itself.\n      yield* annotateWaiting(undefined)\n      if (settled._tag === \"timeout\") {\n        return yield* Effect.fail(\n          failed(\n            payload,\n            \"timeout\",\n            attempt,\n            retained.entries,\n            `Nobody answered \"${payload.name}\" within ${payload.timeoutMs} ms.`\n          )\n        )\n      }\n      const rejection = validate(settled.value, request)\n      if (rejection === undefined) return settled.value\n      retainRejection(retained, `attempt ${attempt}: ${rejection}`)\n      yield* recordRejection(payload.name, attempt, rejection)\n    }\n    return yield* Effect.fail(\n      failed(\n        payload,\n        \"rejected\",\n        maxAttempts,\n        retained.entries,\n        `\"${payload.name}\" was asked ${maxAttempts} times without an answer it could accept.`\n      )\n    )\n  })\n)\n\n/**\n * Records one answer to a human task.\n *\n * `token` is the value the run parked with \u2014 the `token` of the waiting\n * annotation, which is the wait point the current attempt is open on. The\n * runtime checks that exact approval wait and records the completion as one\n * mutation, so guessed, unopened, or stale attempt tokens cannot pre-answer a\n * run. An admitted answer then resumes the run through the ordinary durable\n * deferred path.\n *\n * The token is not a credential: anyone who knows or derives the address of\n * the open attempt can answer it. The host decides who may answer, and must\n * authorize the caller before calling `answer`.\n *\n * ```ts\n * yield* HumanTask.answer({ token: waiting.token, value: { decision: \"ship\" } })\n * ```\n *\n * The durable JSON boundary is validated here: the value must be inert,\n * detached, and within the exported depth, node, member, string, key, and byte\n * limits. Whether that JSON fits the question is the task's own judgment, made\n * where its kind and schema are known; a semantically refused answer stays\n * recorded so the record shows what was actually said. Call {@link validate}\n * first when the interface can refuse it while the person is still looking at\n * it.\n *\n * The TOKEN is checked. This entry point completes an arbitrary caller-supplied\n * address under `Schema.Json`, so it accepts only a token whose deferred name\n * {@link deferred} could have written. A token for a `DurableQueue` item, a\n * plain {@link module:WaitFor} gate, or an unrelated flow's deferred fails with\n * `TokenInvalid` carrying `deferred_mismatch` rather than writing a JSON exit\n * into a row another schema will decode.\n *\n * A syntactically valid HumanTask token can still fail with\n * `HumanAnswerInvalid` carrying `answer_not_open` when the addressed run is not\n * currently parked on that exact approval token.\n *\n * @category combinators\n * @since 0.1.0\n */\nexport const answer = (options: {\n  readonly token: DurableDeferred.Token\n  readonly value: typeof Schema.Json.Type\n}): Effect.Effect<void, DurableDeferred.TokenInvalid | HumanAnswerInvalid, FlowRuntime> =>\n  Effect.gen(function*() {\n    const admitted = BoundedJson.admit(options.value, JsonSchemaSubset.answerLimits)\n    if (!admitted.ok) {\n      return yield* Effect.fail(\n        new HumanAnswerInvalid({\n          message: `The human-task answer was not recorded: ${JsonSchemaSubset.truncateDiagnostic(admitted.complaint)}`\n        })\n      )\n    }\n    const parsed = yield* DurableDeferred.TokenParsed.parse(options.token)\n    const target = answerableDeferred(parsed.deferredName)\n    if (target === undefined) {\n      return yield* Effect.fail(\n        new DurableDeferred.TokenInvalid({\n          code: \"deferred_mismatch\",\n          message:\n            `The token addresses deferred \"${\n              JsonSchemaSubset.truncateDiagnostic(parsed.deferredName)\n            }\", which is not a ` +\n            \"human task wait point. Answer it through the surface that owns it.\"\n        })\n      )\n    }\n    const runtime = yield* FlowRuntime\n    const outcome = yield* runtime.deferredDoneIfWaiting(target, {\n      flowName: parsed.flowName,\n      executionId: parsed.executionId,\n      deferredName: parsed.deferredName,\n      reason: \"approval\",\n      token: options.token,\n      exit: Exit.succeed(admitted.value)\n    })\n    if (outcome === \"NotWaiting\") {\n      return yield* Effect.fail(\n        new HumanAnswerInvalid({\n          code: \"answer_not_open\",\n          message: \"The human-task answer was not recorded because the run is not parked on this approval token.\"\n        })\n      )\n    }\n  })\n\n/**\n * Gives an answer the caller's own type.\n *\n * The action's success schema is `Schema.Json`, because what a person may\n * answer is described by the task's payload rather than by a TypeScript type.\n * `decode` is the other half: the author states the schema they were really\n * asking for, and the node downstream of the question carries that type.\n *\n * ```ts\n * const Decision = Schema.Struct({ decision: Schema.Literals([\"ship\", \"hold\"]) })\n *\n * HumanTask.action.call({ name: \"release\", kind: \"json\", prompt, schema }).pipe(\n *   HumanTask.decode(Decision)\n * )\n * ```\n *\n * The two descriptions must agree. The answer already passed the task's own\n * JSON Schema before it reached here, so a value this schema rejects means the\n * payload's schema and the author's schema describe different answers \u2014 an\n * authoring mistake, not a human one \u2014 and it surfaces as a defect naming the\n * offending path rather than as a failure a body could sensibly catch.\n *\n * @category combinators\n * @since 0.1.0\n */\nexport const decode =\n  <S extends Schema.ConstraintDecoder<unknown>>(schema: S) =>\n  <E, R>(self: Node.Node<typeof Schema.Json.Type, E, R>): Node.Node<S[\"Type\"], E, R> =>\n    Node.map(self, Schema.decodeUnknownSync(schema))\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwCA,WAAsB;AAEtB,eAA0B;AAC1B,aAAwB;AACxB,WAAsB;AAEtB,aAAwB;AACxB,aAAwB;AACxB,mBAA8B;AAC9B,sBAAiC;AACjC,0BAA6B;AAC7B,yBAA4B;AAC5B,+BAAgC;AAChC,kBAA6B;AAC7B,uBAAkC;AAClC,cAAyB;AAuBlB,MAAM,OAAuE,OAAO,SAAS;AAAA,EAClG;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAkBM,MAAM,wBAAwB,OAAO,YAA6B;AAAA,EACvE;AAAA,EACA;AAAA,IACE,MAAM,OAAO,SAAS,CAAC,mBAAmB,YAAY,SAAS,CAAC;AAAA,IAChE,MAAM,OAAO;AAAA,IACb,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO,MAAM,OAAO,MAAM;AAAA,IACtC,SAAS,OAAO;AAAA,EAClB;AACF,EAAE;AAAC;AAQI,MAAM,2BAA2B,OAAO,YAAgC;AAAA,EAC7E;AAAA,EACA;AAAA,IACE,MAAM,OAAO,SAAS,CAAC,kBAAkB,iBAAiB,CAAC,EAAE;AAAA,MAC3D,OAAO,uBAAuB,OAAO,QAAQ,gBAAgB,CAAC;AAAA,IAChE;AAAA,IACA,SAAS,OAAO;AAAA,EAClB;AACF,EAAE;AAAC;AAQI,MAAM,MAAM;AAQZ,MAAM,qBAAqB;AAQ3B,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,sBAAsB,iBAAiB;AAQ7C,MAAM,sBAAsB,iBAAiB;AAQ7C,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,qBAAqB,iBAAiB;AAQ5C,MAAM,kBAAkB,iBAAiB;AAQzC,MAAM,iBAAiB,iBAAiB;AAQxC,MAAM,mBAAmB;AAQzB,MAAM,iBAAiB,KAAK;AAQ5B,MAAM,aAAa;AAQnB,MAAM,iBAAiB,IAAI;AAQ3B,MAAM,mBAAmB;AAQzB,MAAM,qBAAqB,iBAAiB;AAQ5C,MAAM,4BAA4B;AAoBlC,MAAM,WAAW,CACtB,MACA,YACwD,QAAQ,SAAS,GAAG,IAAI,IAAI,OAAO,EAAE;AAG/F,MAAM,mBAAmB;AAWzB,MAAM,gBAAgB;AAyBtB,MAAM,qBAAqB,CACzB,iBACoE;AACpE,QAAM,YAAY,aAAa,YAAY,GAAG;AAC9C,MAAI,cAAc,GAAI,QAAO;AAC7B,QAAM,SAAS,aAAa,MAAM,YAAY,CAAC;AAC/C,MAAI,CAAC,cAAc,KAAK,MAAM,EAAG,QAAO;AACxC,QAAM,UAAU,OAAO,MAAM;AAC7B,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,UAAU,EAAG,QAAO;AAC1D,QAAM,UAAU,SAAS,aAAa,MAAM,GAAG,SAAS,EAAE,QAAQ,kBAAkB,EAAE,GAAG,OAAO;AAChG,SAAO,QAAQ,SAAS,eAAe,UAAU;AACnD;AAmBA,MAAM,mBAAmB,CAAC,SAAyB,aAAa,IAAI;AAOpE,MAAM,UAAU,OAAO,MAAM;AAAA,EAC3B,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,UAAU,GAAG,OAAO,OAAO,KAAK,CAAC;AAAA,EACtE,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,SAAS,EAAE,CAAC;AACnD,CAAC;AAoCM,MAAM,iBAAiB,CAC5B,QACA,OAA8B,CAAC,MACR,iBAAiB,eAAe,QAAQ,IAAI;AAkB9D,MAAM,WAAW,CAAC,OAAgB,YAAyC;AAChF,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK;AACH,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,aAAO,YAAY,SAAS,OAAO,kBAAkB,IACjD,SACA,8BAA8B,kBAAkB;AAAA,IACtD,KAAK;AACH,aAAO,OAAO,UAAU,YAAY,SAAY;AAAA,IAClD,KAAK,UAAU;AACb,UAAI,QAAQ,YAAY,UAAa,QAAQ,QAAQ,WAAW,GAAG;AACjE,eAAO;AAAA,MACT;AACA,UACE,QAAQ,QAAQ,SAAS,cACzB,QAAQ,QAAQ,KAAK,CAACA,YAAW,OAAOA,YAAW,YAAY,CAAC,YAAY,SAASA,SAAQ,cAAc,CAAC,GAC5G;AACA,eAAO,qCAAqC,UAAU,cAAc,cAAc;AAAA,MACpF;AACA,aAAO,QAAQ,QAAQ,KAAK,CAACA,YAAWA,YAAW,KAAK,IACpD,SACA,cAAc,iBAAiB,iBAAiB,KAAK,CAAC,kBACtD,iBAAiB,mBAAmB,QAAQ,QAAQ,KAAK,IAAI,CAAC,CAChE;AAAA,IACJ;AAAA,IACA,SAAS;AACP,UAAI,QAAQ,WAAW,OAAW,QAAO,iBAAiB,MAAM,OAAO,QAAQ,MAAM;AACrF,YAAM,WAAW,YAAY,MAAM,OAAO,iBAAiB,YAAY;AACvE,aAAO,SAAS,KAAK,SAAY,SAAS;AAAA,IAC5C;AAAA,EACF;AACF;AAOA,MAAM,cAAc,CAAC,OAAe,iBAClC,OAAO,OAAO;AAAA,EACZ,OAAO;AAAA,IACL,CAAC,UACC,YAAY,SAAS,OAAO,YAAY,KACxC,GAAG,KAAK,oCAAoC,YAAY;AAAA,IAC1D,EAAE,OAAO,UAAU,MAAM,WAAW,KAAK,EAAE,CAAC,GAAG;AAAA,EACjD;AACF;AAEF,MAAM,gBAAgB,OAAO,KAAK;AAAA,EAChC,OAAO;AAAA,IACL,CAAC,UAAU;AACT,YAAM,WAAW,YAAY,MAAM,OAAO,iBAAiB,YAAY;AACvE,aAAO,SAAS,MAAM,SAAS;AAAA,IACjC;AAAA,IACA,EAAE,OAAO,yBAAyB;AAAA,EACpC;AACF;AAEA,MAAM,SAAS,YAAY,UAAU,cAAc;AAEnD,MAAM,gBAAgB;AAAA,EACpB,MAAM,YAAY,aAAa,gBAAgB;AAAA,EAC/C,MAAM;AAAA,EACN,QAAQ,YAAY,UAAU,cAAc;AAAA,EAC5C,SAAS,OAAO;AAAA,IACd,OAAO,MAAM,MAAM,EAAE,MAAM,OAAO,YAAY,UAAU,CAAC;AAAA,EAC3D;AAAA,EACA,QAAQ,OAAO,SAAS,aAAa;AAAA,EACrC,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,EACxC,aAAa,OAAO,SAAS,OAAO,MAAM;AAC5C;AA8BO,MAAM,SAMT,OAAO,WAAW,KAAK;AAAA,EACzB,SAAS;AAAA,EACT,SAAS,OAAO;AAAA,EAChB,OAAO;AAAA,EACP,MAAM;AACR,CAAC;AAkBD,MAAM,mBAAmB,CACvB,SACA,SACA,gBAEA,KAAK,UAAU;AAAA,EACb,MAAM;AAAA,EACN,MAAM,QAAQ;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,QAAQ,QAAQ;AAAA,EAChB;AAAA,EACA;AAAA,EACA,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,QAAQ,OAAO,EAAE;AAAA,EACzE,GAAI,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AACnE,CAAC;AAGH,MAAM,SAAS,CACb,SACA,MACA,UACA,YACA,YACoB,IAAI,gBAAgB,EAAE,MAAM,MAAM,QAAQ,MAAM,UAAU,YAAY,QAAQ,CAAC;AASrG,MAAM,iBAAiB,CAAC,UAA0B,GAAG,KAAK;AAG1D,MAAM,kBAAkB,CAAC,OAA2B,cAA4B;AAC9E,QAAM,kBAAkB,MAAM,UAAU;AACxC,MAAI,iBAAiB;AACnB,UAAM,iBAAiB,MAAM,QAAQ,IAAI;AACzC,UAAM,SAAS,eAAe;AAAA,EAChC;AACA,MAAI,CAAC,mBAAmB,MAAM,QAAQ,UAAU,UAAU,2BAA2B;AACnF,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,SAAS,UAAU;AACzB;AAAA,EACF;AACA,QAAM;AACN,MAAI,SAAS,eAAe,MAAM,OAAO;AACzC,SAAO,MAAM,QAAQ,OAAO,SAAS,2BAA2B;AAC9D,UAAM,UAAU,MAAM,QAAQ,IAAI;AAClC,UAAM,SAAS,QAAQ;AACvB,UAAM;AACN,aAAS,eAAe,MAAM,OAAO;AAAA,EACvC;AACA,QAAM,QAAQ,KAAK,MAAM;AACzB,QAAM,SAAS,OAAO;AACxB;AAQA,MAAM,WAAW,CAAC,YAA6D;AAC7E,QAAM,cAAc,QAAQ,eAAe;AAC3C,MAAI,CAAC,OAAO,UAAU,WAAW,KAAK,cAAc,GAAG;AACrD,WAAO,OAAO;AAAA,MACZ;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAC;AAAA,QACD,GAAG,GAAG,gCAAgC,WAAW;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACA,SAAO,eAAe,mBAClB,OAAO,QAAQ,WAAW,IAC1B,OAAO;AAAA,IACP;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC;AAAA,MACD,GAAG,GAAG,gCAAgC,WAAW,gCAC5C,gBAAgB;AAAA,IACvB;AAAA,EACF;AACJ;AAgBA,MAAM,aAAa,CAAC,YAAoF;AACtG,QAAM,YAAY,QAAQ;AAC1B,MAAI,cAAc,OAAW,QAAO,OAAO,QAAQ,MAAS;AAG5D,SAAO,OAAO,SAAS,SAAS,KAAK,aAAa,KAAK,aAAa,OAAO,mBACvE,OAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,IACzC,OAAO;AAAA,IACP;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC;AAAA,MACD,GAAG,GAAG,8BAA8B,SAAS,sDAC9B,OAAO,gBAAgB;AAAA,IAExC;AAAA,EACF;AACJ;AAgBA,MAAM,YAAY,CAAC,YAA8D;AAC/E,QAAM,UAAmB;AAAA,IACvB,MAAM,QAAQ;AAAA,IACd,SAAS,QAAQ;AAAA,IACjB,GAAI,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,EACnE;AACA,MAAI,QAAQ,WAAW,UAAa,QAAQ,SAAS,QAAQ;AAC3D,WAAO,OAAO;AAAA,MACZ;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAC;AAAA,QACD,gEAAgE,QAAQ,IAAI;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,aAAa,QAAQ,YAAY,UAAa,QAAQ,QAAQ,WAAW,IAAI;AAChG,WAAO,OAAO;AAAA,MACZ,OAAO,SAAS,mBAAmB,GAAG,CAAC,GAAG,GAAG,GAAG,yDAAyD;AAAA,IAC3G;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,UAAU,QAAQ,WAAW,QAAW;AAC3D,UAAM,YAAY,eAAe,QAAQ,MAAM;AAC/C,QAAI,cAAc,OAAW,QAAO,OAAO,KAAK,OAAO,SAAS,mBAAmB,GAAG,CAAC,GAAG,SAAS,CAAC;AAAA,EACtG;AACA,SAAO,OAAO,QAAQ,OAAO;AAC/B;AAYA,MAAM,cAAc,CAClB,SACA,SACA,aAC8E;AAC9E,QAAM,WAAsE,OAAO;AAAA,IACjF,gBAAgB,MAAM,SAAS,QAAQ,MAAM,OAAO,CAAC;AAAA,IACrD,CAAC,WAAoB,EAAE,MAAM,YAAY,MAAM;AAAA,EACjD;AACA,MAAI,aAAa,OAAW,QAAO;AACnC,SAAO,gBAAgB,QAAQ;AAAA,IAC7B,MAAM,aAAa,QAAQ,IAAI,IAAI,OAAO;AAAA,IAC1C,SAAS;AAAA,IACT,OAAO,OAAO;AAAA,IACd,SAAS;AAAA,MACP;AAAA,MACA,OAAO;AAAA,QACL,aAAa,MAAM;AAAA,UACjB,MAAM,iBAAiB,QAAQ,IAAI;AAAA,UACnC,UAAU;AAAA;AAAA;AAAA,UAGV,mBAAmB,SAAS;AAAA,QAC9B,CAAC;AAAA,QACD,EAAE,MAAM,UAAU;AAAA,MACpB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAQA,MAAM,kBAAkB,OAAO,OAAO;AAAA,EACpC,MAAM,OAAO;AAAA,EACb,SAAS,OAAO;AAAA,EAChB,QAAQ,OAAO;AACjB,CAAC;AAqBD,MAAM,kBAAkB,CAAC,MAAc,SAAiB,WACtD,OAAO,KAAK;AAAA,EACV,MAAM,aAAa,IAAI,IAAI,OAAO;AAAA,EAClC,MAAM;AAAA,EACN,SAAS;AAAA,EACT,SAAS,OAAO,QAAQ,EAAE,MAAM,SAAS,OAAO,CAAC;AACnD,CAAC;AAkBI,MAAM,QAAgE,OAAO;AAAA,EAAQ,CAAC,YAC3F,OAAO,IAAI,aAAY;AACrB,UAAM,WAAW,OAAO;AACxB,UAAM,cAAc,OAAO,SAAS,OAAO;AAC3C,UAAM,WAAW,OAAO,WAAW,OAAO;AAC1C,UAAM,UAAU,OAAO,UAAU,OAAO;AACxC,UAAM,WAA+B,EAAE,SAAS,CAAC,GAAG,OAAO,GAAG,SAAS,EAAE;AACzE,aAAS,UAAU,GAAG,WAAW,aAAa,WAAW;AACvD,YAAM,QAAQ,gBAAgB,qBAAqB,SAAS,QAAQ,MAAM,OAAO,GAAG;AAAA,QAClF,MAAM,SAAS;AAAA,QACf,aAAa,SAAS;AAAA,MACxB,CAAC;AAQD,iBAAO,0CAAgB,EAAE,QAAQ,YAAY,OAAO,SAAS,iBAAiB,SAAS,SAAS,WAAW,EAAE,CAAC;AAC9G,YAAM,UAAU,OAAO,YAAY,SAAS,SAAS,QAAQ;AAI7D,iBAAO,0CAAgB,MAAS;AAChC,UAAI,QAAQ,SAAS,WAAW;AAC9B,eAAO,OAAO,OAAO;AAAA,UACnB;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA,SAAS;AAAA,YACT,oBAAoB,QAAQ,IAAI,YAAY,QAAQ,SAAS;AAAA,UAC/D;AAAA,QACF;AAAA,MACF;AACA,YAAM,YAAY,SAAS,QAAQ,OAAO,OAAO;AACjD,UAAI,cAAc,OAAW,QAAO,QAAQ;AAC5C,sBAAgB,UAAU,WAAW,OAAO,KAAK,SAAS,EAAE;AAC5D,aAAO,gBAAgB,QAAQ,MAAM,SAAS,SAAS;AAAA,IACzD;AACA,WAAO,OAAO,OAAO;AAAA,MACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,IAAI,QAAQ,IAAI,eAAe,WAAW;AAAA,MAC5C;AAAA,IACF;AAAA,EACF,CAAC;AACH;AA0CO,MAAM,SAAS,CAAC,YAIrB,OAAO,IAAI,aAAY;AACrB,QAAM,WAAW,YAAY,MAAM,QAAQ,OAAO,iBAAiB,YAAY;AAC/E,MAAI,CAAC,SAAS,IAAI;AAChB,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,mBAAmB;AAAA,QACrB,SAAS,2CAA2C,iBAAiB,mBAAmB,SAAS,SAAS,CAAC;AAAA,MAC7G,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,SAAS,OAAO,gBAAgB,YAAY,MAAM,QAAQ,KAAK;AACrE,QAAM,SAAS,mBAAmB,OAAO,YAAY;AACrD,MAAI,WAAW,QAAW;AACxB,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,gBAAgB,aAAa;AAAA,QAC/B,MAAM;AAAA,QACN,SACE,iCACE,iBAAiB,mBAAmB,OAAO,YAAY,CACzD;AAAA,MAEJ,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,UAAU,OAAO;AACvB,QAAM,UAAU,OAAO,QAAQ,sBAAsB,QAAQ;AAAA,IAC3D,UAAU,OAAO;AAAA,IACjB,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,IACrB,QAAQ;AAAA,IACR,OAAO,QAAQ;AAAA,IACf,MAAM,KAAK,QAAQ,SAAS,KAAK;AAAA,EACnC,CAAC;AACD,MAAI,YAAY,cAAc;AAC5B,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,mBAAmB;AAAA,QACrB,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AA2BI,MAAM,SACX,CAA8C,WAC9C,CAAO,SACL,KAAK,IAAI,MAAM,OAAO,kBAAkB,MAAM,CAAC;",
   "names": ["option"]
 }

package/dist/esm/Deadline.d.ts

@@ -44,6 +44,11 @@ import { FlowRuntime } from "./FlowRuntime/FlowRuntime.ts";
  * replay must line up with: the origin and the clock are addressed by fixed
  * names within the execution.
  *
+ * A deadline that is not a positive finite duration, a `startedAtMs` that is
+ * not finite, or a bound that would expire after epoch millisecond
+ * `Number.MAX_SAFE_INTEGER` dies with a `RangeError`: a durable store records
+ * the clock's due time as a safe integer.
+ *
  * @category constructors
  * @since 1.0.0
  */

package/dist/esm/Deadline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Deadline.d.ts","sourceRoot":"","sources":["../../src/Deadline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAMvC,OAAO,EAAW,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAgB1D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,KAAK,GAAI,SAAS;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1C,KAAG,MAAM,CAAC,MAAM,CAAC,eAAe,GAAG,SAAS,EAAE,KAAK,EAAE,WAAW,GAAG,YAAY,GAAG,MAAM,CAAC,MAAM,CAyB5F,CAAA;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,eAAe,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAC+B,CAAA;AAE3G;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,MAAM,GAChB,UAAU,eAAe,GAAG,SAAS,EAAE,UAAU,MAAM,MACvD,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,YAAY,CAwBzE,CAAA;AAEN;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,KAAK,GAAI,SAAS;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IAC9C,sDAAsD;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1C,MACA,CAAC,EAAE,CAAC,EAAE,CAAC,EACN,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,WAAW,GAAG,YAAY,GAAG,MAAM,CAAC,MAAM,CACmB,CAAA"}
+{"version":3,"file":"Deadline.d.ts","sourceRoot":"","sources":["../../src/Deadline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAMvC,OAAO,EAAW,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAgB1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,KAAK,GAAI,SAAS;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1C,KAAG,MAAM,CAAC,MAAM,CAAC,eAAe,GAAG,SAAS,EAAE,KAAK,EAAE,WAAW,GAAG,YAAY,GAAG,MAAM,CAAC,MAAM,CAoC5F,CAAA;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,eAAe,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAC+B,CAAA;AAE3G;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,MAAM,GAChB,UAAU,eAAe,GAAG,SAAS,EAAE,UAAU,MAAM,MACvD,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,YAAY,CAwBzE,CAAA;AAEN;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,KAAK,GAAI,SAAS;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IAC9C,sDAAsD;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1C,MACA,CAAC,EAAE,CAAC,EAAE,CAAC,EACN,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,WAAW,GAAG,YAAY,GAAG,MAAM,CAAC,MAAM,CACmB,CAAA"}

package/dist/esm/Deadline.js

@@ -62,6 +62,11 @@ const origin = Action.make({
  * replay must line up with: the origin and the clock are addressed by fixed
  * names within the execution.
  *
+ * A deadline that is not a positive finite duration, a `startedAtMs` that is
+ * not finite, or a bound that would expire after epoch millisecond
+ * `Number.MAX_SAFE_INTEGER` dies with a `RangeError`: a durable store records
+ * the clock's due time as a safe integer.
+ *
  * @category constructors
  * @since 1.0.0
  */
@@ -78,7 +83,14 @@ export const start = (options) => Effect.gen(function* () {
         if (!Number.isFinite(deadlineMs) || deadlineMs <= 0) {
             return yield* Effect.die(new RangeError(`Deadline.start: "${options.flowName}" deadline must be a positive finite duration`));
         }
-        lineage = { startedAtMs: options.startedAtMs ?? (yield* origin), deadlineMs };
+        const startedAtMs = options.startedAtMs ?? (yield* origin);
+        // The clock armed below is due at `startedAtMs + deadlineMs`, and a
+        // durable store records a due time as a safe integer.
+        if (!Number.isFinite(startedAtMs) || startedAtMs + deadlineMs > Number.MAX_SAFE_INTEGER) {
+            return yield* Effect.die(new RangeError(`Deadline.start: "${options.flowName}" deadline must expire by epoch millisecond ` +
+                `${Number.MAX_SAFE_INTEGER}, and a ${deadlineMs} ms deadline from ${startedAtMs} does not`));
+        }
+        lineage = { startedAtMs, deadlineMs };
     }
     const remaining = yield* remainingMs(lineage);
     if (remaining > 0) {

package/dist/esm/Deadline.js.map

@@ -1 +1 @@
-{"version":3,"file":"Deadline.js","sourceRoot":"","sources":["../../src/Deadline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAC3C,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAwB,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,EAAE,gCAAgC;IACtC,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;CAC9D,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAWrB,EAAiG,EAAE,CAClG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IACpC,IAAI,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAA;IACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACpD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YACpE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG;YACxB,MAAM,EAAE,QAAQ,CAAC,QAAQ;SAC1B,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,UAAU,CAAC,oBAAoB,OAAO,CAAC,QAAQ,+CAA+C,CAAC,CACpG,CAAA;QACH,CAAC;QACD,OAAO,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IAC7C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE;YACvD,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;SACnF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAyB,EAAyB,EAAE,CAC9E,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAA;AAE3G;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,MAAM,GACjB,CAAC,QAAqC,EAAE,QAAgB,EAAE,EAAE,CAC5D,CAAU,IAA4B,EAAyC,EAAE,CAC/E,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IACpC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;QACnC,QAAQ;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,OAAO,EAAE,GAAG,QAAQ,cAAc,QAAQ,CAAC,WAAW,iBAAiB,QAAQ,CAAC,UAAU,gBAAgB;YACxG,6BAA6B,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE;KAC9E,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACzG,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;IAChC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5D,QAAQ,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACvG,QAAQ;SACT,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAC,CAAA;AAEN;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAOrB,EAAE,EAAE,CACL,CACE,IAA4B,EACyC,EAAE,CACvE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA","sourcesContent":["/**\n * The wall-clock bound one run of a flow settles by.\n *\n * A deadline counts from the run's FIRST start, which is journaled, so it\n * survives park, resume and process death: a restarted engine honors the\n * original deadline instead of starting a new one. A trampoline lineage is one\n * run, so its rounds share one deadline: the round that hands off stamps the\n * lineage's start and bound on the {@link module:Result.Handoff}, and the next\n * round runs under that stamp rather than starting a clock of its own. Like\n * `maxRounds`, the bound belongs to the lineage originator; a handoff target\n * cannot reset or replace it.\n *\n * The engine applies {@link bound} to every execution of a flow that declares\n * `Flow.make(tag, { deadline })`. A control plane applies it inside a run body\n * to bound a run by an approved envelope's deadline. Both settle an expired\n * run with the same {@link module:DeadlineExceeded.DeadlineExceeded} defect.\n *\n * @since 1.0.0\n */\n\nimport * as Clock from \"effect/Clock\"\nimport type * as Crypto from \"effect/Crypto\"\nimport * as Duration from \"effect/Duration\"\nimport * as Effect from \"effect/Effect\"\nimport * as Option from \"effect/Option\"\nimport * as Schema from \"effect/Schema\"\nimport * as Action from \"./Action/index.ts\"\nimport * as DurableClock from \"./DurableClock.ts\"\nimport { DeadlineExceeded } from \"./Flow/DeadlineExceeded.ts\"\nimport { Handoff, type LineageDeadline } from \"./Flow/Result.ts\"\nimport { FlowInstance } from \"./FlowRuntime/FlowInstance.ts\"\nimport { FlowRuntime } from \"./FlowRuntime/FlowRuntime.ts\"\n\n/**\n * The execution's first start, journaled once.\n *\n * A sealed action's result is recorded with its attempt and replayed on every\n * later drive, so the origin a deadline counts from is the time the execution\n * first ran, on this engine or on the one that resumes it after a restart.\n */\nconst origin = Action.make({\n  name: \"@smthrs/engine/deadline-origin\",\n  tier: \"sealed\",\n  success: Schema.Number,\n  execute: Clock.currentTimeMillis.pipe(Effect.map(Math.floor))\n})\n\n/**\n * Starts the current execution's deadline: the lineage deadline this round\n * inherited from a handoff, or `deadline` counted from the execution's\n * journaled first start, or from `startedAtMs` when the host supplies a\n * durable start of its own. Answers `undefined` when neither applies, which is\n * an unbounded execution.\n *\n * **Details**\n *\n * The first start is a sealed action, so every later drive of the execution,\n * on this engine or one that resumes it after a restart, reads the same\n * origin. A durable clock is armed at the deadline so a parked execution is\n * driven again when it passes; the clock keeps the due time it was first armed\n * with, so arming it on every drive is idempotent.\n *\n * **Gotchas**\n *\n * Start at most one deadline per execution, before any other dispatch that a\n * replay must line up with: the origin and the clock are addressed by fixed\n * names within the execution.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const start = (options: {\n  /** The flow the refusal names. */\n  readonly flowName: string\n  /** The bound; a positive finite duration. Absent means unbounded. */\n  readonly deadline?: Duration.Input | undefined\n  /**\n   * Where the bound counts from, when the host already holds a durable\n   * start of its own, such as the time a control plane accepted the run.\n   * Absent, the execution's first start is journaled and read back.\n   */\n  readonly startedAtMs?: number | undefined\n}): Effect.Effect<LineageDeadline | undefined, never, FlowRuntime | FlowInstance | Crypto.Crypto> =>\n  Effect.gen(function*() {\n    const instance = yield* FlowInstance\n    let lineage = instance.lineageDeadline\n    if (lineage === undefined) {\n      if (options.deadline === undefined) return undefined\n      const deadlineMs = Option.match(Duration.fromInput(options.deadline), {\n        onNone: () => Number.NaN,\n        onSome: Duration.toMillis\n      })\n      if (!Number.isFinite(deadlineMs) || deadlineMs <= 0) {\n        return yield* Effect.die(\n          new RangeError(`Deadline.start: \"${options.flowName}\" deadline must be a positive finite duration`)\n        )\n      }\n      lineage = { startedAtMs: options.startedAtMs ?? (yield* origin), deadlineMs }\n    }\n    const remaining = yield* remainingMs(lineage)\n    if (remaining > 0) {\n      yield* (yield* FlowRuntime).scheduleClock(instance.flow, {\n        executionId: instance.executionId,\n        clock: DurableClock.make({ name: \"@smthrs/engine/deadline\", duration: remaining })\n      })\n    }\n    return lineage\n  })\n\n/**\n * The whole milliseconds left before `deadline` passes, as the durable clock\n * row stores its due time; zero or less once it has passed.\n *\n * @category getters\n * @since 1.0.0\n */\nexport const remainingMs = (deadline: LineageDeadline): Effect.Effect<number> =>\n  Effect.map(Clock.currentTimeMillis, (now) => Math.ceil(deadline.startedAtMs + deadline.deadlineMs - now))\n\n/**\n * Runs `body` within a started deadline.\n *\n * A body that starts at or past the deadline settles at once, and one that\n * starts before it races the time remaining in this fiber, so a running\n * execution is stopped too. Both settle with the same `DeadlineExceeded`\n * defect. The race is `raceFirst`: a body that parks exits first, so parking\n * still parks. A round that hands off stamps the deadline on its handoff, so\n * the next round of the lineage runs under it. An `undefined` deadline runs\n * `body` unbounded.\n *\n * @category combinators\n * @since 1.0.0\n */\nexport const within =\n  (deadline: LineageDeadline | undefined, flowName: string) =>\n  <A, E, R>(body: Effect.Effect<A, E, R>): Effect.Effect<A, E, R | FlowInstance> =>\n    deadline === undefined ? body : Effect.gen(function*() {\n      const instance = yield* FlowInstance\n      const expired = new DeadlineExceeded({\n        flowName,\n        executionId: instance.executionId,\n        deadlineMs: deadline.deadlineMs,\n        startedAtMs: deadline.startedAtMs,\n        message: `${flowName} execution ${instance.executionId} ran past its ${deadline.deadlineMs} ms deadline, ` +\n          `counted from its start at ${new Date(deadline.startedAtMs).toISOString()}`\n      })\n      const remaining = yield* remainingMs(deadline)\n      if (remaining <= 0) return yield* Effect.die(expired)\n      const value = yield* Effect.raceFirst(body, Effect.andThen(Effect.sleep(remaining), Effect.die(expired)))\n      const handoff = instance.handoff\n      if (handoff !== undefined && handoff.deadline === undefined) {\n        instance.handoff = new Handoff({\n          flow: handoff.flow,\n          payload: handoff.payload,\n          ...(handoff.capabilityCeilings === undefined ? {} : { capabilityCeilings: handoff.capabilityCeilings }),\n          deadline\n        })\n      }\n      return value\n    })\n\n/**\n * Bounds the current execution by `deadline`, counted from its journaled first\n * start, or by the lineage deadline this round inherited from a handoff:\n * {@link start}, then {@link within}.\n *\n * A round that inherited a lineage deadline runs under it whatever it\n * declares, so every round of a lineage expires at the originator's time. With\n * no inherited deadline and `deadline` absent, the body runs unbounded.\n *\n * @category combinators\n * @since 1.0.0\n */\nexport const bound = (options: {\n  /** The flow the refusal names. */\n  readonly flowName: string\n  /** The bound; a positive finite duration. Absent means unbounded. */\n  readonly deadline?: Duration.Input | undefined\n  /** Where the bound counts from; see {@link start}. */\n  readonly startedAtMs?: number | undefined\n}) =>\n<A, E, R>(\n  body: Effect.Effect<A, E, R>\n): Effect.Effect<A, E, R | FlowRuntime | FlowInstance | Crypto.Crypto> =>\n  Effect.flatMap(start(options), (deadline) => within(deadline, options.flowName)(body))\n"]}
+{"version":3,"file":"Deadline.js","sourceRoot":"","sources":["../../src/Deadline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAC3C,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAwB,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,EAAE,gCAAgC;IACtC,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;CAC9D,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAWrB,EAAiG,EAAE,CAClG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IACpC,IAAI,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAA;IACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACpD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YACpE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG;YACxB,MAAM,EAAE,QAAQ,CAAC,QAAQ;SAC1B,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,UAAU,CAAC,oBAAoB,OAAO,CAAC,QAAQ,+CAA+C,CAAC,CACpG,CAAA;QACH,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;QAC1D,oEAAoE;QACpE,sDAAsD;QACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACxF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,UAAU,CACZ,oBAAoB,OAAO,CAAC,QAAQ,8CAA8C;gBAChF,GAAG,MAAM,CAAC,gBAAgB,WAAW,UAAU,qBAAqB,WAAW,WAAW,CAC7F,CACF,CAAA;QACH,CAAC;QACD,OAAO,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,CAAA;IACvC,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IAC7C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE;YACvD,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;SACnF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAyB,EAAyB,EAAE,CAC9E,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAA;AAE3G;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,MAAM,GACjB,CAAC,QAAqC,EAAE,QAAgB,EAAE,EAAE,CAC5D,CAAU,IAA4B,EAAyC,EAAE,CAC/E,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IACpC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;QACnC,QAAQ;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,OAAO,EAAE,GAAG,QAAQ,cAAc,QAAQ,CAAC,WAAW,iBAAiB,QAAQ,CAAC,UAAU,gBAAgB;YACxG,6BAA6B,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE;KAC9E,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACzG,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;IAChC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5D,QAAQ,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACvG,QAAQ;SACT,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAC,CAAA;AAEN;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAOrB,EAAE,EAAE,CACL,CACE,IAA4B,EACyC,EAAE,CACvE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA","sourcesContent":["/**\n * The wall-clock bound one run of a flow settles by.\n *\n * A deadline counts from the run's FIRST start, which is journaled, so it\n * survives park, resume and process death: a restarted engine honors the\n * original deadline instead of starting a new one. A trampoline lineage is one\n * run, so its rounds share one deadline: the round that hands off stamps the\n * lineage's start and bound on the {@link module:Result.Handoff}, and the next\n * round runs under that stamp rather than starting a clock of its own. Like\n * `maxRounds`, the bound belongs to the lineage originator; a handoff target\n * cannot reset or replace it.\n *\n * The engine applies {@link bound} to every execution of a flow that declares\n * `Flow.make(tag, { deadline })`. A control plane applies it inside a run body\n * to bound a run by an approved envelope's deadline. Both settle an expired\n * run with the same {@link module:DeadlineExceeded.DeadlineExceeded} defect.\n *\n * @since 1.0.0\n */\n\nimport * as Clock from \"effect/Clock\"\nimport type * as Crypto from \"effect/Crypto\"\nimport * as Duration from \"effect/Duration\"\nimport * as Effect from \"effect/Effect\"\nimport * as Option from \"effect/Option\"\nimport * as Schema from \"effect/Schema\"\nimport * as Action from \"./Action/index.ts\"\nimport * as DurableClock from \"./DurableClock.ts\"\nimport { DeadlineExceeded } from \"./Flow/DeadlineExceeded.ts\"\nimport { Handoff, type LineageDeadline } from \"./Flow/Result.ts\"\nimport { FlowInstance } from \"./FlowRuntime/FlowInstance.ts\"\nimport { FlowRuntime } from \"./FlowRuntime/FlowRuntime.ts\"\n\n/**\n * The execution's first start, journaled once.\n *\n * A sealed action's result is recorded with its attempt and replayed on every\n * later drive, so the origin a deadline counts from is the time the execution\n * first ran, on this engine or on the one that resumes it after a restart.\n */\nconst origin = Action.make({\n  name: \"@smthrs/engine/deadline-origin\",\n  tier: \"sealed\",\n  success: Schema.Number,\n  execute: Clock.currentTimeMillis.pipe(Effect.map(Math.floor))\n})\n\n/**\n * Starts the current execution's deadline: the lineage deadline this round\n * inherited from a handoff, or `deadline` counted from the execution's\n * journaled first start, or from `startedAtMs` when the host supplies a\n * durable start of its own. Answers `undefined` when neither applies, which is\n * an unbounded execution.\n *\n * **Details**\n *\n * The first start is a sealed action, so every later drive of the execution,\n * on this engine or one that resumes it after a restart, reads the same\n * origin. A durable clock is armed at the deadline so a parked execution is\n * driven again when it passes; the clock keeps the due time it was first armed\n * with, so arming it on every drive is idempotent.\n *\n * **Gotchas**\n *\n * Start at most one deadline per execution, before any other dispatch that a\n * replay must line up with: the origin and the clock are addressed by fixed\n * names within the execution.\n *\n * A deadline that is not a positive finite duration, a `startedAtMs` that is\n * not finite, or a bound that would expire after epoch millisecond\n * `Number.MAX_SAFE_INTEGER` dies with a `RangeError`: a durable store records\n * the clock's due time as a safe integer.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const start = (options: {\n  /** The flow the refusal names. */\n  readonly flowName: string\n  /** The bound; a positive finite duration. Absent means unbounded. */\n  readonly deadline?: Duration.Input | undefined\n  /**\n   * Where the bound counts from, when the host already holds a durable\n   * start of its own, such as the time a control plane accepted the run.\n   * Absent, the execution's first start is journaled and read back.\n   */\n  readonly startedAtMs?: number | undefined\n}): Effect.Effect<LineageDeadline | undefined, never, FlowRuntime | FlowInstance | Crypto.Crypto> =>\n  Effect.gen(function*() {\n    const instance = yield* FlowInstance\n    let lineage = instance.lineageDeadline\n    if (lineage === undefined) {\n      if (options.deadline === undefined) return undefined\n      const deadlineMs = Option.match(Duration.fromInput(options.deadline), {\n        onNone: () => Number.NaN,\n        onSome: Duration.toMillis\n      })\n      if (!Number.isFinite(deadlineMs) || deadlineMs <= 0) {\n        return yield* Effect.die(\n          new RangeError(`Deadline.start: \"${options.flowName}\" deadline must be a positive finite duration`)\n        )\n      }\n      const startedAtMs = options.startedAtMs ?? (yield* origin)\n      // The clock armed below is due at `startedAtMs + deadlineMs`, and a\n      // durable store records a due time as a safe integer.\n      if (!Number.isFinite(startedAtMs) || startedAtMs + deadlineMs > Number.MAX_SAFE_INTEGER) {\n        return yield* Effect.die(\n          new RangeError(\n            `Deadline.start: \"${options.flowName}\" deadline must expire by epoch millisecond ` +\n              `${Number.MAX_SAFE_INTEGER}, and a ${deadlineMs} ms deadline from ${startedAtMs} does not`\n          )\n        )\n      }\n      lineage = { startedAtMs, deadlineMs }\n    }\n    const remaining = yield* remainingMs(lineage)\n    if (remaining > 0) {\n      yield* (yield* FlowRuntime).scheduleClock(instance.flow, {\n        executionId: instance.executionId,\n        clock: DurableClock.make({ name: \"@smthrs/engine/deadline\", duration: remaining })\n      })\n    }\n    return lineage\n  })\n\n/**\n * The whole milliseconds left before `deadline` passes, as the durable clock\n * row stores its due time; zero or less once it has passed.\n *\n * @category getters\n * @since 1.0.0\n */\nexport const remainingMs = (deadline: LineageDeadline): Effect.Effect<number> =>\n  Effect.map(Clock.currentTimeMillis, (now) => Math.ceil(deadline.startedAtMs + deadline.deadlineMs - now))\n\n/**\n * Runs `body` within a started deadline.\n *\n * A body that starts at or past the deadline settles at once, and one that\n * starts before it races the time remaining in this fiber, so a running\n * execution is stopped too. Both settle with the same `DeadlineExceeded`\n * defect. The race is `raceFirst`: a body that parks exits first, so parking\n * still parks. A round that hands off stamps the deadline on its handoff, so\n * the next round of the lineage runs under it. An `undefined` deadline runs\n * `body` unbounded.\n *\n * @category combinators\n * @since 1.0.0\n */\nexport const within =\n  (deadline: LineageDeadline | undefined, flowName: string) =>\n  <A, E, R>(body: Effect.Effect<A, E, R>): Effect.Effect<A, E, R | FlowInstance> =>\n    deadline === undefined ? body : Effect.gen(function*() {\n      const instance = yield* FlowInstance\n      const expired = new DeadlineExceeded({\n        flowName,\n        executionId: instance.executionId,\n        deadlineMs: deadline.deadlineMs,\n        startedAtMs: deadline.startedAtMs,\n        message: `${flowName} execution ${instance.executionId} ran past its ${deadline.deadlineMs} ms deadline, ` +\n          `counted from its start at ${new Date(deadline.startedAtMs).toISOString()}`\n      })\n      const remaining = yield* remainingMs(deadline)\n      if (remaining <= 0) return yield* Effect.die(expired)\n      const value = yield* Effect.raceFirst(body, Effect.andThen(Effect.sleep(remaining), Effect.die(expired)))\n      const handoff = instance.handoff\n      if (handoff !== undefined && handoff.deadline === undefined) {\n        instance.handoff = new Handoff({\n          flow: handoff.flow,\n          payload: handoff.payload,\n          ...(handoff.capabilityCeilings === undefined ? {} : { capabilityCeilings: handoff.capabilityCeilings }),\n          deadline\n        })\n      }\n      return value\n    })\n\n/**\n * Bounds the current execution by `deadline`, counted from its journaled first\n * start, or by the lineage deadline this round inherited from a handoff:\n * {@link start}, then {@link within}.\n *\n * A round that inherited a lineage deadline runs under it whatever it\n * declares, so every round of a lineage expires at the originator's time. With\n * no inherited deadline and `deadline` absent, the body runs unbounded.\n *\n * @category combinators\n * @since 1.0.0\n */\nexport const bound = (options: {\n  /** The flow the refusal names. */\n  readonly flowName: string\n  /** The bound; a positive finite duration. Absent means unbounded. */\n  readonly deadline?: Duration.Input | undefined\n  /** Where the bound counts from; see {@link start}. */\n  readonly startedAtMs?: number | undefined\n}) =>\n<A, E, R>(\n  body: Effect.Effect<A, E, R>\n): Effect.Effect<A, E, R | FlowRuntime | FlowInstance | Crypto.Crypto> =>\n  Effect.flatMap(start(options), (deadline) => within(deadline, options.flowName)(body))\n"]}

package/dist/esm/DurableClock.d.ts

@@ -1,13 +1,3 @@
-/**
- * Durable timers for flow sleeps.
- *
- * `make` creates a `DurableClock` with a name, duration, and deferred wake-up
- * signal. `sleep` ignores zero durations, runs short sleeps through an
- * in-memory action, and schedules longer sleeps through the `FlowRuntime`
- * before awaiting the durable deferred tied to the clock.
- *
- * @since 0.1.0
- */
 import type * as Crypto from "effect/Crypto";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
@@ -32,6 +22,10 @@ export interface DurableClock {
 /**
  * Declares one durable clock after validating its finite nonnegative duration.
  *
+ * Throws a `RangeError` for a malformed, infinite or negative duration, or one
+ * longer than `Number.MAX_SAFE_INTEGER` milliseconds: a durable store records
+ * a clock's due time as a safe integer.
+ *
  * @category constructors
  * @since 0.1.0
  */
@@ -43,6 +37,11 @@ export declare const make: (options: {
  * Waits inside a flow, using an in-memory action for durations at or
  * below the threshold and scheduling a durable clock for longer durations.
  *
+ * Throws a `RangeError` for the same durations {@link make} refuses, and for
+ * a malformed, infinite or negative threshold. A durable sleep that would
+ * wake after epoch millisecond `Number.MAX_SAFE_INTEGER` dies with a
+ * `RangeError` instead of arming its clock.
+ *
  * @category sleeping
  * @since 0.1.0
  */

package/dist/esm/DurableClock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DurableClock.d.ts","sourceRoot":"","sources":["../../src/DurableClock.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAEH,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAE5C,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAE1D,QAAA,MAAM,MAAM,8BAA8B,CAAA;AAE1C;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,MAAM,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,eAAe,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;CACvE;AA4BD;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,SAAS;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAA;CAClC,KAAG,YAAwF,CAAA;AAE5F;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,GAChB,SAAS;IACP,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;CACxD,KACA,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,KAAK,EACL,MAAM,CAAC,MAAM,GAAG,WAAW,GAAG,YAAY,CAgC3C,CAAA"}
+{"version":3,"file":"DurableClock.d.ts","sourceRoot":"","sources":["../../src/DurableClock.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAE5C,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAE1D,QAAA,MAAM,MAAM,8BAA8B,CAAA;AAE1C;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,MAAM,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,eAAe,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;CACvE;AAkDD;;;;;;;;;GASG;AACH,eAAO,MAAM,IAAI,GAAI,SAAS;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAA;CAClC,KAAG,YAAwE,CAAA;AAE5E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,KAAK,GAChB,SAAS;IACP,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;CACxD,KACA,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,KAAK,EACL,MAAM,CAAC,MAAM,GAAG,WAAW,GAAG,YAAY,CA2C3C,CAAA"}

package/dist/esm/DurableClock.js

@@ -1,4 +1,15 @@
 // Deep reviewed and polished by a human on 2026-08-10.
+/**
+ * Durable timers for flow sleeps.
+ *
+ * `make` creates a `DurableClock` with a name, duration, and deferred wake-up
+ * signal. `sleep` ignores zero durations, runs short sleeps through an
+ * in-memory action, and schedules longer sleeps through the `FlowRuntime`
+ * before awaiting the durable deferred tied to the clock.
+ *
+ * @since 0.1.0
+ */
+import * as Clock from "effect/Clock";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
@@ -25,6 +36,26 @@ const durationFromInput = (input, field) => {
     }
     return parsed.value;
 };
+/**
+ * The latest due time a durable timer records, in epoch milliseconds: a store
+ * keeps a clock's due time as a safe integer.
+ *
+ * @private
+ */
+const latestDueAtMs = Number.MAX_SAFE_INTEGER;
+/**
+ * Parses a clock's own duration, which a store adds to the current time and
+ * records, so it is at most {@link latestDueAtMs} milliseconds.
+ *
+ * @private
+ */
+const clockDuration = (input) => {
+    const duration = durationFromInput(input, "duration");
+    if (Duration.toMillis(duration) > latestDueAtMs) {
+        throw new RangeError(`DurableClock: "duration" must be at most ${latestDueAtMs} milliseconds.`);
+    }
+    return duration;
+};
 const makeClock = (name, duration) => ({
     [TypeId]: TypeId,
     name,
@@ -34,20 +65,29 @@ const makeClock = (name, duration) => ({
 /**
  * Declares one durable clock after validating its finite nonnegative duration.
  *
+ * Throws a `RangeError` for a malformed, infinite or negative duration, or one
+ * longer than `Number.MAX_SAFE_INTEGER` milliseconds: a durable store records
+ * a clock's due time as a safe integer.
+ *
  * @category constructors
  * @since 0.1.0
  */
-export const make = (options) => makeClock(options.name, durationFromInput(options.duration, "duration"));
+export const make = (options) => makeClock(options.name, clockDuration(options.duration));
 /**
  * Waits inside a flow, using an in-memory action for durations at or
  * below the threshold and scheduling a durable clock for longer durations.
  *
+ * Throws a `RangeError` for the same durations {@link make} refuses, and for
+ * a malformed, infinite or negative threshold. A durable sleep that would
+ * wake after epoch millisecond `Number.MAX_SAFE_INTEGER` dies with a
+ * `RangeError` instead of arming its clock.
+ *
  * @category sleeping
  * @since 0.1.0
  */
 export const sleep = (options) => {
     const name = options.name;
-    const duration = durationFromInput(options.duration, "duration");
+    const duration = clockDuration(options.duration);
     const inMemoryThreshold = durationFromInput(options.inMemoryThreshold ?? defaultInMemoryThreshold, "inMemoryThreshold");
     // Untraced because durable sleeps are recursively resumed by the engine.
     return Effect.fnUntraced(function* () {
@@ -61,6 +101,13 @@ export const sleep = (options) => {
                 execute: Effect.sleep(duration)
             });
         }
+        // A due time past the latest one a store records would fail the park
+        // write deep in the engine, so the sleep refuses it here by name.
+        const now = yield* Clock.currentTimeMillis;
+        if (now + Duration.toMillis(duration) > latestDueAtMs) {
+            return yield* Effect.die(new RangeError(`DurableClock: "${name}" would wake after epoch millisecond ${latestDueAtMs}, ` +
+                `the latest due time a durable timer records.`));
+        }
         const engine = yield* FlowRuntime;
         const instance = yield* FlowInstance;
         const clock = makeClock(name, duration);

package/dist/esm/DurableClock.js.map

@@ -1 +1 @@
-{"version":3,"file":"DurableClock.js","sourceRoot":"","sources":["../../src/DurableClock.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAcvD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAC3C,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAE1D,MAAM,MAAM,GAAG,2BAA2B,CAAA;AAgB1C;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,KAAqB,EAAE,KAAa,EAAqB,EAAE;IACpF,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACxC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAAC,kBAAkB,KAAK,yDAAyD,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,UAAU,CAAC,kBAAkB,KAAK,yDAAyD,CAAC,CAAA;IACxG,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAA;AACrB,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,QAA2B,EAAgB,EAAE,CAAC,CAAC;IAC9E,CAAC,MAAM,CAAC,EAAE,MAAM;IAChB,IAAI;IACJ,QAAQ;IACR,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;CACvD,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAGpB,EAAgB,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAA;AAE5F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,OAUC,EAKD,EAAE;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAChE,MAAM,iBAAiB,GAAG,iBAAiB,CACzC,OAAO,CAAC,iBAAiB,IAAI,wBAAwB,EACrD,mBAAmB,CACpB,CAAA;IAED,yEAAyE;IACzE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAChC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBACxB,IAAI,EAAE,gBAAgB,IAAI,EAAE;gBAC5B,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAA;QACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACvC,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE;YACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK;SACN,CAAC,CAAA;QACF,OAAO,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACrD,CAAC,CAAC,EAAE,CAAA;AACN,CAAC,CAAA;AAED,MAAM,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA","sourcesContent":["// Deep reviewed and polished by a human on 2026-08-10.\n\n/**\n * Durable timers for flow sleeps.\n *\n * `make` creates a `DurableClock` with a name, duration, and deferred wake-up\n * signal. `sleep` ignores zero durations, runs short sleeps through an\n * in-memory action, and schedules longer sleeps through the `FlowRuntime`\n * before awaiting the durable deferred tied to the clock.\n *\n * @since 0.1.0\n */\n\nimport type * as Crypto from \"effect/Crypto\"\nimport * as Duration from \"effect/Duration\"\nimport * as Effect from \"effect/Effect\"\nimport * as Option from \"effect/Option\"\nimport type * as Schema from \"effect/Schema\"\nimport * as Action from \"./Action/index.ts\"\nimport * as DurableDeferred from \"./DurableDeferred.ts\"\nimport { FlowInstance } from \"./FlowRuntime/FlowInstance.ts\"\nimport { FlowRuntime } from \"./FlowRuntime/FlowRuntime.ts\"\n\nconst TypeId = \"@smthrs/flow/DurableClock\"\n\n/**\n * Represents a durable flow timer with a name, duration, and deferred\n * completed when the timer wakes.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface DurableClock {\n  readonly [TypeId]: typeof TypeId\n  readonly name: string\n  readonly duration: Duration.Duration\n  readonly deferred: DurableDeferred.DurableDeferred<typeof Schema.Void>\n}\n\n/**\n * Parses one author-supplied duration and requires it to be finite and\n * nonnegative. Invalid input throws `RangeError` so the authoring mistake is\n * caught at declaration time, matching `Flow.make` and `Poll.make`.\n *\n * @private\n */\nconst durationFromInput = (input: Duration.Input, field: string): Duration.Duration => {\n  const parsed = Duration.fromInput(input)\n  if (Option.isNone(parsed)) {\n    throw new RangeError(`DurableClock: \"${field}\" must be a valid finite duration that is not negative.`)\n  }\n  const millis = Duration.toMillis(parsed.value)\n  if (!Duration.isFinite(parsed.value) || !Number.isFinite(millis) || millis < 0) {\n    throw new RangeError(`DurableClock: \"${field}\" must be a valid finite duration that is not negative.`)\n  }\n  return parsed.value\n}\n\nconst makeClock = (name: string, duration: Duration.Duration): DurableClock => ({\n  [TypeId]: TypeId,\n  name,\n  duration,\n  deferred: DurableDeferred.make(`DurableClock/${name}`)\n})\n\n/**\n * Declares one durable clock after validating its finite nonnegative duration.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = (options: {\n  readonly name: string\n  readonly duration: Duration.Input\n}): DurableClock => makeClock(options.name, durationFromInput(options.duration, \"duration\"))\n\n/**\n * Waits inside a flow, using an in-memory action for durations at or\n * below the threshold and scheduling a durable clock for longer durations.\n *\n * @category sleeping\n * @since 0.1.0\n */\nexport const sleep = (\n  options: {\n    readonly name: string\n    readonly duration: Duration.Input\n    /**\n     * If the duration is less than or equal to this threshold, the clock will\n     * be executed in memory.\n     *\n     * @default 60 seconds\n     */\n    readonly inMemoryThreshold?: Duration.Input | undefined\n  }\n): Effect.Effect<\n  void,\n  never,\n  Crypto.Crypto | FlowRuntime | FlowInstance\n> => {\n  const name = options.name\n  const duration = durationFromInput(options.duration, \"duration\")\n  const inMemoryThreshold = durationFromInput(\n    options.inMemoryThreshold ?? defaultInMemoryThreshold,\n    \"inMemoryThreshold\"\n  )\n\n  // Untraced because durable sleeps are recursively resumed by the engine.\n  return Effect.fnUntraced(function*() {\n    if (Duration.isZero(duration)) {\n      return\n    }\n\n    if (Duration.isLessThanOrEqualTo(duration, inMemoryThreshold)) {\n      return yield* Action.make({\n        name: `DurableClock/${name}`,\n        tier: \"sealed\",\n        execute: Effect.sleep(duration)\n      })\n    }\n\n    const engine = yield* FlowRuntime\n    const instance = yield* FlowInstance\n    const clock = makeClock(name, duration)\n    yield* engine.scheduleClock(instance.flow, {\n      executionId: instance.executionId,\n      clock\n    })\n    return yield* DurableDeferred.await(clock.deferred)\n  })()\n}\n\nconst defaultInMemoryThreshold = Duration.seconds(60)\n"]}
+{"version":3,"file":"DurableClock.js","sourceRoot":"","sources":["../../src/DurableClock.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD;;;;;;;;;GASG;AAEH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAC3C,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAE1D,MAAM,MAAM,GAAG,2BAA2B,CAAA;AAgB1C;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,KAAqB,EAAE,KAAa,EAAqB,EAAE;IACpF,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACxC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAAC,kBAAkB,KAAK,yDAAyD,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,UAAU,CAAC,kBAAkB,KAAK,yDAAyD,CAAC,CAAA;IACxG,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAA;AACrB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAA;AAE7C;;;;;GAKG;AACH,MAAM,aAAa,GAAG,CAAC,KAAqB,EAAqB,EAAE;IACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,aAAa,EAAE,CAAC;QAChD,MAAM,IAAI,UAAU,CAAC,4CAA4C,aAAa,gBAAgB,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,QAA2B,EAAgB,EAAE,CAAC,CAAC;IAC9E,CAAC,MAAM,CAAC,EAAE,MAAM;IAChB,IAAI;IACJ,QAAQ;IACR,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;CACvD,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAGpB,EAAgB,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;AAE5E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,OAUC,EAKD,EAAE;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,iBAAiB,GAAG,iBAAiB,CACzC,OAAO,CAAC,iBAAiB,IAAI,wBAAwB,EACrD,mBAAmB,CACpB,CAAA;IAED,yEAAyE;IACzE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAChC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBACxB,IAAI,EAAE,gBAAgB,IAAI,EAAE;gBAC5B,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAC1C,IAAI,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,aAAa,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,UAAU,CACZ,kBAAkB,IAAI,wCAAwC,aAAa,IAAI;gBAC7E,8CAA8C,CACjD,CACF,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAA;QACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACvC,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE;YACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK;SACN,CAAC,CAAA;QACF,OAAO,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACrD,CAAC,CAAC,EAAE,CAAA;AACN,CAAC,CAAA;AAED,MAAM,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA","sourcesContent":["// Deep reviewed and polished by a human on 2026-08-10.\n\n/**\n * Durable timers for flow sleeps.\n *\n * `make` creates a `DurableClock` with a name, duration, and deferred wake-up\n * signal. `sleep` ignores zero durations, runs short sleeps through an\n * in-memory action, and schedules longer sleeps through the `FlowRuntime`\n * before awaiting the durable deferred tied to the clock.\n *\n * @since 0.1.0\n */\n\nimport * as Clock from \"effect/Clock\"\nimport type * as Crypto from \"effect/Crypto\"\nimport * as Duration from \"effect/Duration\"\nimport * as Effect from \"effect/Effect\"\nimport * as Option from \"effect/Option\"\nimport type * as Schema from \"effect/Schema\"\nimport * as Action from \"./Action/index.ts\"\nimport * as DurableDeferred from \"./DurableDeferred.ts\"\nimport { FlowInstance } from \"./FlowRuntime/FlowInstance.ts\"\nimport { FlowRuntime } from \"./FlowRuntime/FlowRuntime.ts\"\n\nconst TypeId = \"@smthrs/flow/DurableClock\"\n\n/**\n * Represents a durable flow timer with a name, duration, and deferred\n * completed when the timer wakes.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface DurableClock {\n  readonly [TypeId]: typeof TypeId\n  readonly name: string\n  readonly duration: Duration.Duration\n  readonly deferred: DurableDeferred.DurableDeferred<typeof Schema.Void>\n}\n\n/**\n * Parses one author-supplied duration and requires it to be finite and\n * nonnegative. Invalid input throws `RangeError` so the authoring mistake is\n * caught at declaration time, matching `Flow.make` and `Poll.make`.\n *\n * @private\n */\nconst durationFromInput = (input: Duration.Input, field: string): Duration.Duration => {\n  const parsed = Duration.fromInput(input)\n  if (Option.isNone(parsed)) {\n    throw new RangeError(`DurableClock: \"${field}\" must be a valid finite duration that is not negative.`)\n  }\n  const millis = Duration.toMillis(parsed.value)\n  if (!Duration.isFinite(parsed.value) || !Number.isFinite(millis) || millis < 0) {\n    throw new RangeError(`DurableClock: \"${field}\" must be a valid finite duration that is not negative.`)\n  }\n  return parsed.value\n}\n\n/**\n * The latest due time a durable timer records, in epoch milliseconds: a store\n * keeps a clock's due time as a safe integer.\n *\n * @private\n */\nconst latestDueAtMs = Number.MAX_SAFE_INTEGER\n\n/**\n * Parses a clock's own duration, which a store adds to the current time and\n * records, so it is at most {@link latestDueAtMs} milliseconds.\n *\n * @private\n */\nconst clockDuration = (input: Duration.Input): Duration.Duration => {\n  const duration = durationFromInput(input, \"duration\")\n  if (Duration.toMillis(duration) > latestDueAtMs) {\n    throw new RangeError(`DurableClock: \"duration\" must be at most ${latestDueAtMs} milliseconds.`)\n  }\n  return duration\n}\n\nconst makeClock = (name: string, duration: Duration.Duration): DurableClock => ({\n  [TypeId]: TypeId,\n  name,\n  duration,\n  deferred: DurableDeferred.make(`DurableClock/${name}`)\n})\n\n/**\n * Declares one durable clock after validating its finite nonnegative duration.\n *\n * Throws a `RangeError` for a malformed, infinite or negative duration, or one\n * longer than `Number.MAX_SAFE_INTEGER` milliseconds: a durable store records\n * a clock's due time as a safe integer.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = (options: {\n  readonly name: string\n  readonly duration: Duration.Input\n}): DurableClock => makeClock(options.name, clockDuration(options.duration))\n\n/**\n * Waits inside a flow, using an in-memory action for durations at or\n * below the threshold and scheduling a durable clock for longer durations.\n *\n * Throws a `RangeError` for the same durations {@link make} refuses, and for\n * a malformed, infinite or negative threshold. A durable sleep that would\n * wake after epoch millisecond `Number.MAX_SAFE_INTEGER` dies with a\n * `RangeError` instead of arming its clock.\n *\n * @category sleeping\n * @since 0.1.0\n */\nexport const sleep = (\n  options: {\n    readonly name: string\n    readonly duration: Duration.Input\n    /**\n     * If the duration is less than or equal to this threshold, the clock will\n     * be executed in memory.\n     *\n     * @default 60 seconds\n     */\n    readonly inMemoryThreshold?: Duration.Input | undefined\n  }\n): Effect.Effect<\n  void,\n  never,\n  Crypto.Crypto | FlowRuntime | FlowInstance\n> => {\n  const name = options.name\n  const duration = clockDuration(options.duration)\n  const inMemoryThreshold = durationFromInput(\n    options.inMemoryThreshold ?? defaultInMemoryThreshold,\n    \"inMemoryThreshold\"\n  )\n\n  // Untraced because durable sleeps are recursively resumed by the engine.\n  return Effect.fnUntraced(function*() {\n    if (Duration.isZero(duration)) {\n      return\n    }\n\n    if (Duration.isLessThanOrEqualTo(duration, inMemoryThreshold)) {\n      return yield* Action.make({\n        name: `DurableClock/${name}`,\n        tier: \"sealed\",\n        execute: Effect.sleep(duration)\n      })\n    }\n\n    // A due time past the latest one a store records would fail the park\n    // write deep in the engine, so the sleep refuses it here by name.\n    const now = yield* Clock.currentTimeMillis\n    if (now + Duration.toMillis(duration) > latestDueAtMs) {\n      return yield* Effect.die(\n        new RangeError(\n          `DurableClock: \"${name}\" would wake after epoch millisecond ${latestDueAtMs}, ` +\n            `the latest due time a durable timer records.`\n        )\n      )\n    }\n    const engine = yield* FlowRuntime\n    const instance = yield* FlowInstance\n    const clock = makeClock(name, duration)\n    yield* engine.scheduleClock(instance.flow, {\n      executionId: instance.executionId,\n      clock\n    })\n    return yield* DurableDeferred.await(clock.deferred)\n  })()\n}\n\nconst defaultInMemoryThreshold = Duration.seconds(60)\n"]}

package/dist/esm/Flow/make.d.ts

@@ -78,7 +78,8 @@ interface MakeOptions<Payload extends Schema.Struct.Fields | AnyStructSchema, Su
     readonly maxRounds?: number | undefined;
     /**
      * How long one execution may take, counted from its journaled first start.
-     * A positive finite duration; see {@link Flow.deadline}.
+     * A positive finite duration of at most `Number.MAX_SAFE_INTEGER`
+     * milliseconds; see {@link Flow.deadline}.
      */
     readonly deadline?: Duration.Input | undefined;
     readonly annotations?: Context.Context<never>;

package/dist/esm/Flow/make.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"make.d.ts","sourceRoot":"","sources":["../../../src/Flow/make.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH,OAAO,KAAK,KAAK,OAAO,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,KAAK,OAAO,MAAM,gBAAgB,CAAA;AAC9C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAG3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAKvC,OAAO,KAAK,KAAK,WAAW,MAAM,mBAAmB,CAAA;AACrD,OAAO,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAIzG;;;;GAIG;AACH,UAAU,WAAW,CACnB,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,EACtD,OAAO,SAAS,MAAM,CAAC,GAAG,EAC1B,KAAK,SAAS,MAAM,CAAC,GAAG,CACxB,SAAQ,mBAAmB;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACzD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,GAAG,SAAS,CAAA;IAClD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,cAAc,CAAC,EACpB,CAAC,CACD,OAAO,EAAE,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GACvE,OAAO,CAAC,MAAM,CAAC,KAChB,MAAM,CAAC,GACV,SAAS,CAAA;IACb,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,WAAW,GAAG,SAAS,CAAA;IACnE;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;CAC9C;AAED;;;;GAIG;AACH,KAAK,IAAI,CACP,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,EACtD,OAAO,SAAS,MAAM,CAAC,GAAG,EAC1B,KAAK,SAAS,MAAM,CAAC,GAAG,EACxB,QAAQ,IACN,CACF,OAAO,EAAE,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAC1F,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAA;AAErE;;;;GAIG;AACH,KAAK,eAAe,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,IAAI,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAC/G,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GACtB,OAAO,CAAA;AAEX;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,GAA2C,CAAA;AAE5F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,EAAE;IACjB,CACE,KAAK,CAAC,GAAG,SAAS,MAAM,EACxB,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,EACtD,OAAO,SAAS,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,EACxC,KAAK,SAAS,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,EACvC,QAAQ,GAAG,KAAK,EAEhB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG;QAC9C,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;KACxB,GACA,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;IAChE,CACE,KAAK,CAAC,GAAG,SAAS,MAAM,EACxB,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,EACtD,OAAO,SAAS,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,EACxC,KAAK,SAAS,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,EAEvC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG;QAC9C,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,MAAM,CAAA;QACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAA;QACrB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACpD,GACA,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;CAiG7D,CAAA"}
+{"version":3,"file":"make.d.ts","sourceRoot":"","sources":["../../../src/Flow/make.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH,OAAO,KAAK,KAAK,OAAO,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,KAAK,OAAO,MAAM,gBAAgB,CAAA;AAC9C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAG3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAKvC,OAAO,KAAK,KAAK,WAAW,MAAM,mBAAmB,CAAA;AACrD,OAAO,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAIzG;;;;GAIG;AACH,UAAU,WAAW,CACnB,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,EACtD,OAAO,SAAS,MAAM,CAAC,GAAG,EAC1B,KAAK,SAAS,MAAM,CAAC,GAAG,CACxB,SAAQ,mBAAmB;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACzD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,GAAG,SAAS,CAAA;IAClD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,cAAc,CAAC,EACpB,CAAC,CACD,OAAO,EAAE,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GACvE,OAAO,CAAC,MAAM,CAAC,KAChB,MAAM,CAAC,GACV,SAAS,CAAA;IACb,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,WAAW,GAAG,SAAS,CAAA;IACnE;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;CAC9C;AAED;;;;GAIG;AACH,KAAK,IAAI,CACP,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,EACtD,OAAO,SAAS,MAAM,CAAC,GAAG,EAC1B,KAAK,SAAS,MAAM,CAAC,GAAG,EACxB,QAAQ,IACN,CACF,OAAO,EAAE,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAC1F,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAA;AAErE;;;;GAIG;AACH,KAAK,eAAe,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,IAAI,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAC/G,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GACtB,OAAO,CAAA;AAEX;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,GAA2C,CAAA;AAE5F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,EAAE;IACjB,CACE,KAAK,CAAC,GAAG,SAAS,MAAM,EACxB,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,EACtD,OAAO,SAAS,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,EACxC,KAAK,SAAS,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,EACvC,QAAQ,GAAG,KAAK,EAEhB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG;QAC9C,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;KACxB,GACA,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;IAChE,CACE,KAAK,CAAC,GAAG,SAAS,MAAM,EACxB,OAAO,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,EACtD,OAAO,SAAS,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,EACxC,KAAK,SAAS,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,EAEvC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG;QAC9C,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,MAAM,CAAA;QACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAA;QACrB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACpD,GACA,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;CAsG7D,CAAA"}

package/dist/esm/Flow/make.js

@@ -56,6 +56,11 @@ export const make = (tag, options) => {
         (deadline === undefined || !Duration.isFinite(deadline) || Duration.toMillis(deadline) <= 0)) {
         throw new RangeError(`Flow.make: "${tag}" deadline must be a positive finite duration`);
     }
+    // The durable clock that enforces a deadline is due at its start plus the
+    // deadline, and a store records that due time as a safe integer.
+    if (deadline !== undefined && Duration.toMillis(deadline) > Number.MAX_SAFE_INTEGER) {
+        throw new RangeError(`Flow.make: "${tag}" deadline must be at most ${Number.MAX_SAFE_INTEGER} ms`);
+    }
     // Captured here, where the stack still names the author's file, and carried
     // as a non-enumerable property so no digest can see it
     // (`internal/DeclarationSite.ts`).