apache-iggy 0.10.0 → 0.10.1-edge.2

package/dist/client/client.socket.js

@@ -15,981 +15,1126 @@
 // specific language governing permissions and limitations
 // under the License.
 import { EventEmitter } from 'node:events';
-import { ResponseError, responseError } from '../wire/error.utils.js';
-import { debug } from './client.debug.js';
-import { endpointKey, IggyConnection } from './client.connection.js';
+import { DeserializeError, ResponseError, responseError } from '../wire/error.utils.js';
+import { IggyConnection, endpointKey } from './client.connection.js';
+import { normalizeClientConfig } from './client.config.js';
+import { ChangeSignal, MutationLanes, NotConnectedError, OperationUncertainError, OperationNotRetainedError, OPERATION_TIMEOUT_MS, VsrResponseTimeoutError, pause, waitWithin } from './client.operation.js';
 import { LOGIN, LOGIN_WITH_TOKEN, LOGOUT, PING } from '../wire/index.js';
 import { GET_CLUSTER_METADATA } from '../wire/cluster/get-cluster-metadata.command.js';
-import { deserializeNode } from '../wire/cluster/cluster.utils.js';
+import { deserializePartitionRoute } from '../wire/partition/partition-route.js';
+import { ConsumerKind } from '../wire/offset/offset.utils.js';
 import { COMMAND_CODE } from '../wire/command.code.js';
 import { serializeIdentifier } from '../wire/identifier.utils.js';
-import { Command, HEADER_SIZE, REPLY_OFFSET, peekCommand, readReplyOperation, readStatus } from '../wire/vsr/header.js';
-import { Operation, isKnownOperation } from '../wire/vsr/operation.js';
-import { decodeVsrResponse, prepareVsrCommand, readRegisteredSession, readWireName, VsrEvictionError, VsrSession, } from '../wire/vsr/index.js';
-import { normalizeClientConfig } from './client.config.js';
-const VSR_RESPONSE_TIMEOUT_MS = 30_000;
-const VSR_RETRY_INTERVAL_MS = 50;
-const LEADERLESS_WAIT_BUDGET_MS = 5_000;
-const LEADERLESS_POLL_INTERVAL_MS = 250;
-const MAX_LEADER_REDIRECTS = 3;
+import { deserializeOptions } from '../wire/options.utils.js';
+import { OptionsScope } from '../wire/system/describe-options.command.js';
+import { PartitionKind } from '../wire/message/partitioning.utils.js';
+import { PollingStrategyKind } from '../wire/message/poll.utils.js';
+import { EvictionReason, HEADER_SIZE, REPLY_OFFSET, hasCommittedResult, EMPTY_PARTITION_CONTEXT, readReplyOperation } from '../wire/vsr/header.js';
+import { Operation, isMetadata, operationForCode } from '../wire/vsr/operation.js';
+import { decodeVsrResponse, prepareVsrCommand, readRegisteredSession, readWireName, VsrEvictionError, VsrSession } from '../wire/vsr/index.js';
+import { validateReplyForRequest } from '../wire/vsr/reply.js';
+import { debug } from './client.debug.js';
+export { LaneBlockedError, NotConnectedError, OperationNotRetainedError, OperationUncertainError, VsrResponseTimeoutError } from './client.operation.js';
+const RETRY_INTERVAL_MS = 50;
+const MAX_RETRY_INTERVAL_MS = 1_000;
+const MAX_LIFECYCLE_INTERVAL_MS = 1_000;
+const MAX_RECONNECT_INTERVAL_MS = 10_000;
+const MAX_REPLICAS = 256;
+const MAX_CONCURRENT_DIALS = 4;
+const MAX_PARTITION_ROUTES = 4096;
 const TRANSIENT_NOT_COMMITTED = 57;
 const TRANSIENT_NOT_ACCEPTED = 58;
 const UNAUTHENTICATED = 40;
 const STALE_CLIENT = 30;
+const OPERATION_NOT_RETAINED = 85;
+const HISTORY_UNAVAILABLE = 87;
+const LIFECYCLE_BUSY = 88;
+const NOT_PRIMARY = 89;
+const INVALID_COMMAND = 3;
 const FEATURE_UNAVAILABLE = 5;
-const MAX_POLL_ROUTES = 4096;
-const MAX_POLL_CONNECTIONS = 256;
-const CONSUMER_SESSION_SIZE = 32;
-const METADATA_WATERMARK_OFFSET = 24;
+const INVALID_SESSION_BINDING = 14004;
+const ROUTE_NAMESPACE_MISSING = new Set([1009, 1010, 2010, 2011, 3007]);
 const POLL_OPTIONS_SIZE = 9 + 4 + 1;
-/**
- * How long a `TRANSIENT_NOT_ACCEPTED` request replays on the same connection
- * before the roster is re-read. A node that stopped being primary refuses
- * forever, so replaying alone never recovers. Matches the Rust SDK.
- */
-const VSR_FAILOVER_CHECK_MS = 2_000;
-/**
- * Whether a request's budget still holds enough for another attempt. One
- * exchange needs at least a replay interval to be worth starting; below that
- * the attempt can only end in a timeout, which would hide the refusal that
- * actually came back.
- */
-const worthAnotherAttempt = (deadline) => deadline - Date.now() > VSR_RETRY_INTERVAL_MS;
-/**
- * A request the current node keeps refusing as not-admitted. Carries the
- * refusal so the caller can surface it when the roster turns out to still name
- * this node as the leader. Never escapes `sendCommand`.
- */
-class LeaderMovedError extends Error {
-    refusal;
-    constructor(refusal) {
-        super('the node refused the request as not-admitted; re-reading the roster');
-        this.refusal = refusal;
+const IDENTIFIER_PREFIX_SIZE = 2;
+const SEND_METADATA_LENGTH_SIZE = 4;
+const PARTITION_ID_SIZE = 4;
+const STORE_OFFSET_SUFFIX_SIZE = 8 + 1;
+const DELETE_OFFSET_SUFFIX_SIZE = 1;
+const RAW_SEND_NEEDS_PARTITION = 'Raw sends need an explicit partition id. Use the typed send API for Balanced or MessageKey partitioning.';
+const TOPIC_DISCOVERY_RESETS = new Set([
+    COMMAND_CODE.DeleteStream, COMMAND_CODE.DeleteTopic,
+    COMMAND_CODE.CreatePartitions, COMMAND_CODE.DeletePartitions
+]);
+const READ_COMMANDS = new Set([
+    COMMAND_CODE.Ping, COMMAND_CODE.GetStats, COMMAND_CODE.GetClusterMetadata,
+    COMMAND_CODE.DescribeOptions, COMMAND_CODE.GetMe, COMMAND_CODE.GetClient,
+    COMMAND_CODE.GetClients, COMMAND_CODE.GetUser, COMMAND_CODE.GetUsers,
+    COMMAND_CODE.GetAccessTokens, COMMAND_CODE.GetPartitionRoute, COMMAND_CODE.GetOffset,
+    COMMAND_CODE.GetStream, COMMAND_CODE.GetStreams, COMMAND_CODE.GetTopic,
+    COMMAND_CODE.GetTopics, COMMAND_CODE.GetGroup, COMMAND_CODE.GetGroups, COMMAND_CODE.SyncGroup
+]);
+/** A replica link used its retry budget, and nothing restarts it. */
+class ReconnectExhaustedError extends Error {
+    constructor() {
+        super('replica reconnect attempts exhausted');
     }
 }
-/**
- * Command codes that can be executed without authentication.
- */
-const UNLOGGED_COMMAND_CODE = [
-    PING.code,
-    LOGIN.code,
-    LOGIN_WITH_TOKEN.code
-];
-export class VsrResponseTimeoutError extends Error {
-    constructor(timeout) {
-        super(`timed out after ${timeout} ms waiting for VSR response`);
-        this.name = 'VsrResponseTimeoutError';
-        Object.setPrototypeOf(this, VsrResponseTimeoutError.prototype);
-    }
-}
-/**
- * Manages command execution and response handling for the Iggy server.
- * Implements command queuing, authentication, and heartbeat functionality.
- */
+/** One logical session owns every link, mutation lane and retained operation. */
 export class CommandResponseStream extends EventEmitter {
-    /** Client configuration */
     options;
-    /** Underlying connection to the server */
-    connection;
-    /** Queue of pending command jobs */
-    _execQueue;
-    /** Consensus session used by VSR framing */
-    vsrSession;
-    /** Shared authentication attempt for concurrent callers */
-    authenticationPromise;
-    /** Whether a login is already being moved to the leader */
-    settlingLeader;
+    vsrSession = new VsrSession();
+    lanes;
+    replicas = new Map();
+    partitionRoutes = new Map();
+    changed = new ChangeSignal();
+    lifetime = new AbortController();
+    sessionLifetime = new AbortController();
+    bootstrap;
+    bootstrapPromise;
     /**
-     * The leader re-check a refused request started, shared with every other
-     * request refused by the same node so one demotion moves the client once.
+     * What the running bootstrap reports when it gives up: the bind failure of
+     * the last endpoint that accepted a dial, else NotConnectedError with the
+     * last dial failure.
      */
-    leaderMoveInFlight;
+    bootstrapFailure;
+    authenticationPromise;
+    sessionAction = Promise.resolve();
+    recoveryPromise;
+    rosterPromise;
     /**
-     * Set when a roster walk just redirected this client, so the login that
-     * re-authenticates it stays on the dialed node instead of settling back on
-     * the metadata leader whose partition replica refused the request.
+     * Whom the client signs in as by itself: the caller's last sign-in, else the
+     * configured credentials while the caller never signed in. A logout, a
+     * sign-in of the caller that fails and a refused sign-in clear it.
      */
-    walkSettleSuppressed = false;
+    signInCredentials;
     /**
-     * Refusals handed out to callers that have not decided what to do with them
-     * yet. The queue holds while any are outstanding: the caller of a refused
-     * command re-checks the leader, and a command written in the meantime goes
-     * out on the socket that check is about to replace.
+     * Raised by each sign-in and sign-out of the caller. A call continues under
+     * a new session only while the lineage it started with is unchanged.
      */
-    leaderMovesUndecided;
-    /** How long a leaderless roster is polled before settling in place */
-    leaderlessWaitBudget;
-    /** Delay between roster reads while the cluster elects */
-    leaderlessPollInterval;
-    /** Calls that have acquired this stream but have not fully settled */
-    pendingSubmissions;
-    /** Whether the stream is currently processing a command */
-    busy;
-    /** Whether the client has been authenticated */
-    isAuthenticated;
-    /** Authenticated user ID */
-    userId;
-    /** Heartbeat interval timer handle */
-    heartbeatIntervalHandler;
-    /** Whether a heartbeat ping is still awaiting its response */
-    heartbeatInFlight;
-    rememberedCredentials;
-    clustered;
+    sessionLineage = 0;
+    knownEndpoints = [];
+    configuredEndpoint;
+    metadataReplica;
     metadataWatermark = 0n;
     routingGeneration = 0;
-    pollRoutes = new Map();
-    pollConnections = new Map();
-    /**
-     * Creates a new CommandResponseStream.
-     *
-     * @param options - Client configuration
-     */
-    constructor(options) {
+    activeDials = 0;
+    pendingSubmissions = 0;
+    heartbeatIntervalHandler;
+    isAuthenticated = false;
+    userId;
+    constructor(config) {
         super();
-        const normalizedConfig = normalizeClientConfig(options);
-        this.options = normalizedConfig;
-        this.connection = new IggyConnection(normalizedConfig);
-        this.busy = false;
-        this.isAuthenticated = false;
-        this._execQueue = [];
-        this.vsrSession = new VsrSession();
-        this.authenticationPromise = undefined;
-        this.settlingLeader = false;
-        this.leaderMovesUndecided = 0;
-        this.leaderlessWaitBudget = LEADERLESS_WAIT_BUDGET_MS;
-        this.leaderlessPollInterval = LEADERLESS_POLL_INTERVAL_MS;
-        this.pendingSubmissions = 0;
-        this.heartbeatInFlight = false;
-        this._init();
+        this.options = normalizeClientConfig(config);
+        this.signInCredentials = this.options.credentials;
+        this.configuredEndpoint = { host: this.options.options.host ?? '127.0.0.1', port: this.options.options.port };
+        this.lanes = new MutationLanes(this.options.maxPendingOperations, this.options.maxPendingOperationBytes);
     }
-    ;
-    /**
-     * Initializes the stream by setting up heartbeat and connection event handlers.
-     */
-    _init() {
-        this.heartbeat(this.options.heartbeatInterval);
-        this.connection.on('error', (error) => {
-            this._failQueue(error);
-        });
-        this.connection.on('eviction', (error) => {
-            this._resetSession();
-            this.emit('eviction', error);
-        });
-        this.connection.on('disconnected', () => {
-            this._resetSession();
-            if (this.connection.redirecting) {
-                // The client is moving to the leader, which is its own doing: a queued
-                // command has not been written, so it belongs on the node being moved
-                // to rather than in an error.
-                this._reissueQueue();
-                return;
-            }
-            this._failQueue(new Error('connection closed before queued commands were sent'));
-        });
-    }
-    /**
-     * Re-submits queued commands through the full send path, so each one
-     * reconnects, re-authenticates and re-checks the leader as if it had just
-     * been called.
-     *
-     * Only for a drop the client caused. Nothing here was written, so there is no
-     * outcome in doubt: a command still in the queue when the socket is replaced
-     * would otherwise fail with a lost-connection error the caller can do nothing
-     * about.
-     */
-    _reissueQueue() {
-        const queued = this._execQueue;
-        this._execQueue = [];
-        for (const job of queued) {
-            debug('re-issuing a queued command after a leader move', job.command);
-            // The whole job, not just the payload: a fresh budget would let a command
-            // caught in a move take twice the response timeout, and a roster read
-            // re-issued as leader-following would answer a leader check with another
-            // leader check.
-            this.sendCommand(job.command, job.payload, {
-                handleResponse: job.handleResponse,
-                last: job.last,
-                followsLeaderMoves: job.followsLeaderMoves,
-                deadline: job.deadline
-            }).then(job.resolve, job.reject);
-        }
-    }
-    /**
-     * Sends a command to the server.
-     * Automatically handles connection, authentication and leader settlement.
-     *
-     * @param command - Command code to send
-     * @param payload - Command payload buffer
-     * @param options - Response and queue options
-     * @returns Promise resolving to the command response
-     */
+    get lineage() { return this.sessionLineage; }
+    get busy() { return this.pendingSubmissions > 0; }
     async sendCommand(command, payload, options = {}) {
-        this.pendingSubmissions += 1;
+        if (isLoginCommand(command))
+            return this.loginByCaller(command, () => Buffer.from(payload), options);
+        const lineage = options.lineage ?? this.lineage;
+        payload = Buffer.from(payload);
+        const release = this.hold();
+        const deadline = options.deadline ?? Date.now() + OPERATION_TIMEOUT_MS;
+        const signal = AbortSignal.any([this.lifetime.signal, ...(options.signal ? [options.signal] : [])]);
         try {
-            const { handleResponse = true, last = true, followsLeaderMoves = true } = options;
-            const autoCommitPoll = command === COMMAND_CODE.PollMessages &&
-                payload.length > POLL_OPTIONS_SIZE && payload.at(-1) === 1;
-            const pollDeadline = autoCommitPoll
-                ? options.deadline ?? Date.now() + VSR_RESPONSE_TIMEOUT_MS
-                : undefined;
-            if (!this.connection.connected)
-                await (pollDeadline === undefined ? this.connection.connect()
-                    : withinDeadline(this.connection.connect(), pollDeadline));
-            if (!this.isAuthenticated && !this.isUnloggedCommand(command))
-                await (pollDeadline === undefined ? this.authenticate(this._signInCredentials())
-                    : withinDeadline(this.authenticate(this._signInCredentials()), pollDeadline));
-            if (pollDeadline !== undefined) {
-                const deadline = pollDeadline;
-                if (this.clustered === undefined)
-                    await withinDeadline(this.sendCommand(GET_CLUSTER_METADATA.code, GET_CLUSTER_METADATA.serialize(), { deadline, followsLeaderMoves: false }), deadline);
-                if (this.clustered === undefined)
-                    throw new Error('cannot determine the poll routing topology');
-                if (this.clustered)
-                    return await this._pollOnPrimary(payload, deadline, handleResponse);
-            }
-            // The roster read is itself a queued command and the queue is
-            // single-flighted, so the leader re-check cannot happen inside
-            // `_processVsr`. The refusal comes back out here instead, where the
-            // queue is free, and the command is re-issued on the node that now
-            // leads.
-            //
-            // A not-admitted refusal means the request was never applied, so it is
-            // re-issued for the whole request budget rather than given up on after
-            // one window: the roster can still name this node -- an election in
-            // flight, a leader that has not moved yet -- and that is a wait, not a
-            // verdict.
-            //
-            // One budget for the whole request: the transient replays on a
-            // connection, the leader re-checks, and the re-issues after a move all
-            // spend it, so a request cannot outlive it by moving. A command re-issued
-            // after a move keeps the budget it was first submitted with, rather than
-            // opening a second one.
-            const deadline = options.deadline ?? Date.now() + VSR_RESPONSE_TIMEOUT_MS;
-            let response;
-            let walkingRoster = false;
-            const visitedRosterEndpoints = new Set();
-            for (;;) {
-                try {
-                    response = await this._queueCommand(command, payload, handleResponse, last, followsLeaderMoves, deadline);
-                    break;
-                }
-                catch (error) {
-                    if (!(error instanceof LeaderMovedError))
-                        throw error;
-                    // The roster read that a re-check runs is itself a command that can
-                    // be refused this way, and answering a leader check with another
-                    // leader check would recurse. Its caller reads a failure as "stay
-                    // where you are".
-                    //
-                    // A budget too small to carry another attempt ends it here, with the
-                    // refusal the server actually gave: re-issued into what is left, the
-                    // request would time out instead and the caller would see a timeout
-                    // where the answer was "not admitted".
-                    let moved = false;
+            if (command === LOGOUT.code) {
+                const signedOut = ++this.sessionLineage;
+                this.signInCredentials = undefined;
+                return await this.serializeSession(async () => {
+                    this.ensureLineage(signedOut, command);
                     try {
-                        if (!followsLeaderMoves || !worthAnotherAttempt(deadline))
-                            throw responseError(command, error.refusal.errorCode);
-                        // Once this request starts walking the roster it keeps walking: a
-                        // leader recheck between hops would put it straight back on the
-                        // metadata leader whose partition replica refused it, and the
-                        // walk would bounce between two nodes without reaching the rest.
-                        moved = await this._followLeaderMove(walkingRoster, visitedRosterEndpoints);
-                        if (typeof moved === 'object') {
-                            walkingRoster = true;
-                            visitedRosterEndpoints.add(endpointKey(moved.endpoint));
-                        }
+                        if (!this.isAuthenticated)
+                            throw responseError(command, UNAUTHENTICATED);
+                        return await this.drive(command, payload, options, deadline, signal, signedOut);
                     }
                     finally {
-                        // Released as soon as the move is decided, before the pace below
-                        // and before any re-authentication: those go through the queue
-                        // themselves, and a queue still held for this refusal would never
-                        // reach them.
-                        if (followsLeaderMoves)
-                            this._releaseUndecidedMove();
-                    }
-                    const connectionMoved = moved === 'leader' ||
-                        (typeof moved === 'object' && moved.moved);
-                    if (!connectionMoved) {
-                        // Nowhere else to go yet: the roster still names this node, or it
-                        // could not be read. Paced, because the in-connection replay
-                        // window belongs to the request's budget and has already been
-                        // spent -- re-issuing straight away would spin.
-                        await delay(Math.min(VSR_FAILOVER_CHECK_MS, Math.max(0, deadline - Date.now())));
+                        if (signedOut === this.lineage) {
+                            this.signInCredentials = undefined;
+                            this.resetSession();
+                        }
                     }
-                    if (!worthAnotherAttempt(deadline))
-                        throw responseError(command, error.refusal.errorCode);
-                    // A move drops the session with the socket it was bound to, so the
-                    // re-issue would otherwise go out under no session: a replicated
-                    // command fails client-side, a non-replicated one goes out with
-                    // session 0.
-                    if (!this.isAuthenticated && !this.isUnloggedCommand(command))
-                        await this.authenticate(this._signInCredentials());
-                }
+                });
             }
-            if (!isLoginCommand(command) || this.settlingLeader)
-                return response;
-            // A login that re-authenticates a roster walk stays on the dialed node:
-            // settling would put the client back on the metadata leader whose
-            // partition replica refused the walked request. One login only.
-            if (this.walkSettleSuppressed) {
-                this.walkSettleSuppressed = false;
-                return response;
+            if (lineage !== this.lineage)
+                throw responseError(command, UNAUTHENTICATED);
+            if (!this.isAuthenticated && command !== PING.code) {
+                void this.signIn();
+                await this.nextSession(command, lineage, deadline, signal);
             }
-            this.settlingLeader = true;
-            try {
-                const settled = await this._settleOnLeader(command, payload);
-                return settled ?? response;
-            }
-            finally {
-                this.settlingLeader = false;
+            if (this.isAuthenticated && this.replicas.size === 0) {
+                const generation = this.routingGeneration;
+                // The call waits for a session lost meanwhile itself.
+                await this.refreshRoster(deadline, signal).catch((error) => {
+                    if (generation !== this.routingGeneration)
+                        return;
+                    // The call sent nothing yet, so a deadline leaves it not accepted.
+                    throw error instanceof VsrResponseTimeoutError ? responseError(command, TRANSIENT_NOT_ACCEPTED) : error;
+                });
             }
+            return await this.drive(command, payload, options, deadline, signal, lineage);
         }
         finally {
-            this.pendingSubmissions -= 1;
-            this._emitFinishQueue();
+            release();
         }
     }
-    _queueCommand(command, payload, handleResponse, last, followsLeaderMoves, deadline) {
-        return new Promise((resolve, reject) => {
-            const job = {
-                command,
-                payload,
-                handleResponse,
-                last,
-                followsLeaderMoves,
-                deadline,
-                resolve,
-                reject
-            };
-            if (last)
-                this._execQueue.push(job);
-            else
-                this._execQueue.unshift(job);
-            this._processQueue();
-        });
+    async resolveOperation(operationId, options = {}) {
+        try {
+            await this.replay(this.lanes.retained(operationId), options);
+        }
+        catch (error) {
+            // A replay that proved the outcome released the operation.
+            if (!(error instanceof OperationNotRetainedError))
+                throw error;
+            this.lanes.provedOutcome(operationId);
+        }
     }
-    /**
-     * Re-reads the roster and moves to the leader it names.
-     *
-     * Best effort: an unreadable roster, or one that still names this node,
-     * leaves the client where it is and the refused request is re-issued anyway.
-     *
-     * Single-flighted, and concurrent callers share the outcome instead of
-     * failing: several commands are refused by the same demoted node, and each
-     * starting its own redirect would move the client once per command. The
-     * first redirect's `'disconnected'` also fails the others' roster reads, so
-     * a caller that raced one would report a refusal it never had to.
-     *
-     * @returns Whether the client moved
-     */
-    _followLeaderMove(walkPastLeader = false, visitedRosterEndpoints = new Set()) {
-        const inFlight = this.leaderMoveInFlight;
-        if (inFlight)
-            return inFlight;
-        const move = (async () => {
-            try {
-                if (!walkPastLeader) {
-                    const leader = await this._readLeaderEndpoint();
-                    if (leader && !this.connection.isConnectedTo(leader.host, leader.port)) {
-                        debug(`the leader moved to ${leader.host}:${leader.port}, following it`);
-                        await this.connection.redirect(leader.host, leader.port);
-                        return 'leader';
+    abandonOperation(operationId) {
+        this.lanes.abandon(operationId);
+    }
+    async replay(operation, options) {
+        const lineage = options.lineage ?? this.lineage;
+        operation.frame.retain();
+        const release = this.hold();
+        const deadline = options.deadline ?? Date.now() + OPERATION_TIMEOUT_MS;
+        const signal = AbortSignal.any([this.lifetime.signal, this.sessionLifetime.signal,
+            operation.lifetime.signal, ...(options.signal ? [options.signal] : [])]);
+        let unlock;
+        try {
+            unlock = await this.lanes.acquireResolution(operation, deadline, signal);
+            await this.drive(operation.command, operation.frame.buffer.subarray(HEADER_SIZE), { context: operation.context }, deadline, signal, lineage, operation);
+        }
+        finally {
+            unlock?.();
+            operation.frame.release();
+            release();
+        }
+    }
+    async drive(command, body, options, deadline, signal, lineage, retained) {
+        /** The session that the frame of the call belongs to. */
+        let generation = this.routingGeneration;
+        const target = partitionRoute(command, body);
+        const replicated = command !== LOGOUT.code && operationForCode(command) !== Operation.NonReplicated;
+        const progress = command === COMMAND_CODE.PollMessages &&
+            (body[body.length - 1] !== 0 || body[body.length - POLL_OPTIONS_SIZE] === PollingStrategyKind.Next);
+        const safeRead = READ_COMMANDS.has(command) || (command === COMMAND_CODE.PollMessages && !progress);
+        // A replay and a logout belong to their session. Any other call that
+        // needs a session waits for the one that replaces a lost one.
+        const restartable = !retained && command !== LOGOUT.code && (command !== PING.code || this.isAuthenticated);
+        let operation = retained;
+        let frameLease = false;
+        /** The frame of the operation belongs to a replaced session, or an 88 spent its request id. */
+        let staleFrame = false;
+        let frame;
+        let context = options.context ? { ...options.context } : undefined;
+        let selected;
+        let historyRefreshed = false;
+        let lifecycleDelay = RETRY_INTERVAL_MS;
+        let retryDelay = RETRY_INTERVAL_MS;
+        let notPrimary = false;
+        let refresh = false;
+        let lastRefusal;
+        let previousLink;
+        let sent = false;
+        try {
+            for (;;) {
+                this.ensureLineage(lineage, command);
+                signal.throwIfAborted();
+                if (Date.now() >= deadline)
+                    throw new VsrResponseTimeoutError(0);
+                if (generation !== this.routingGeneration || (restartable && !this.isAuthenticated)) {
+                    // No session but the one of a frame can apply it. A frame that can
+                    // have taken effect ends uncertain and never goes out again.
+                    if (operation?.uncertain)
+                        throw new OperationUncertainError(operation.id, responseError(command, TRANSIENT_NOT_ACCEPTED));
+                    if (!restartable)
+                        throw responseError(command, TRANSIENT_NOT_ACCEPTED);
+                    await this.nextSession(command, lineage, deadline, signal);
+                    generation = this.routingGeneration;
+                    selected = undefined;
+                    previousLink = undefined;
+                    refresh = false;
+                    frame = undefined;
+                    // A frame of the new session carries the context of the route that
+                    // the new session looks up.
+                    context = options.context ? { ...options.context } : undefined;
+                    if (operation) {
+                        if (frameLease)
+                            operation.frame.release();
+                        frameLease = false;
+                        staleFrame = true;
                     }
                 }
-                // The roster names this node as the metadata leader (or said nothing
-                // usable), yet it keeps refusing to admit the request: its replica of
-                // the target partition group is not that group's primary, because
-                // metadata and partition consensus groups elect independently. Walk
-                // the roster instead of re-issuing into the same refusal.
-                const next = this.connection.nextRosterEndpoint(visitedRosterEndpoints);
-                if (!next)
-                    return false;
-                debug('the request keeps being refused here, walking the roster to ' +
-                    `${next.host}:${next.port}`);
-                // The re-authentication after this redirect runs a login, and a login
-                // normally settles on the metadata leader, which would put the walk
-                // right back on the node that refused. One login only.
-                this.walkSettleSuppressed = true;
+                const sessionSignal = AbortSignal.any([signal, this.sessionLifetime.signal]);
+                if (target && !selected) {
+                    try {
+                        selected = await this.routeFor(target, deadline, sessionSignal, generation);
+                    }
+                    catch (error) {
+                        // A session failure answered the lookup of the call itself.
+                        if (restartable && generation !== this.routingGeneration && !isSessionFailure(error))
+                            continue;
+                        throw error;
+                    }
+                    context ??= { ...selected.route.context };
+                }
+                context ??= { ...EMPTY_PARTITION_CONTEXT, metadataOp: this.metadataWatermark };
+                this.ensureLineage(lineage, command);
+                const lane = target ? groupKey(context, target) : 'metadata';
+                if (operation && staleFrame && operation.lane !== lane) {
+                    // A definitive refusal released the old history. The replacement
+                    // must enter the lane that orders writes to its current incarnation.
+                    this.lanes.complete(operation);
+                    operation = undefined;
+                }
+                if (operation && staleFrame) {
+                    staleFrame = false;
+                    try {
+                        await this.lanes.restart(operation, body, context, this.vsrSession, deadline, signal);
+                    }
+                    catch (error) {
+                        if (generation === this.routingGeneration)
+                            throw error;
+                        this.lanes.complete(operation);
+                        operation = undefined;
+                        continue;
+                    }
+                }
+                else if (!operation && (replicated || progress)) {
+                    try {
+                        operation = await this.lanes.enter(lane, command, body, context, replicated, this.vsrSession, deadline, signal);
+                        staleFrame = false;
+                    }
+                    catch (error) {
+                        // A lane can free while no session is bound to encode the frame.
+                        if (restartable && generation !== this.routingGeneration)
+                            continue;
+                        throw error;
+                    }
+                }
+                if (operation && !frameLease) {
+                    operation.frame.retain();
+                    frameLease = true;
+                }
+                const attemptSignal = operation
+                    ? AbortSignal.any([sessionSignal, operation.lifetime.signal]) : sessionSignal;
+                let attempt;
+                let exchanged = false;
                 try {
-                    await this.connection.redirect(next.host, next.port);
+                    if (refresh && target)
+                        selected = await this.routeFor(target, deadline, attemptSignal, generation, true);
+                    else if (refresh)
+                        await this.refreshRoster(deadline, attemptSignal);
+                    refresh = false;
+                    const link = target
+                        ? await this.primaryLink(selected, deadline, attemptSignal)
+                        : await this.readyLink(deadline, attemptSignal, safeRead ? previousLink : undefined);
+                    previousLink = link;
+                    this.ensureGeneration(generation, command);
+                    attempt = await this.exchange(link, command, () => {
+                        this.ensureGeneration(generation, command);
+                        this.ensureLineage(lineage, command);
+                        return operation?.frame.buffer ?? (frame ??= this.vsrSession.encode(command, body, context));
+                    }, deadline, attemptSignal, operation);
+                    exchanged = true;
                 }
                 catch (error) {
-                    // The suppression belongs to the redirect above. If that redirect
-                    // never lands, a later unrelated login must settle normally.
-                    this.walkSettleSuppressed = false;
-                    debug('the roster endpoint could not be reached', error);
-                    return { endpoint: next, moved: false };
+                    attempt = { error, committed: false, started: false };
+                }
+                sent ||= attempt.started;
+                if (generation !== this.routingGeneration && attempt.started && (replicated || progress))
+                    throw uncertainOutcome(command, operation, attempt.error ?? responseError(command, TRANSIENT_NOT_ACCEPTED));
+                // A committed rejection proves the outcome even when it also ends the session.
+                if (operation?.uncertain && attempt.committed && attempt.error) {
+                    operation.uncertain = false;
+                    this.lanes.prove(operation, attempt.error);
+                    if (isSessionFailure(attempt.error))
+                        this.recoverSession(generation);
+                    throw attempt.error;
+                }
+                if (isSessionFailure(attempt.error)) {
+                    // An eviction does not say whether a written request was applied,
+                    // while a 40 refusal or a committed 30 answers this exact request.
+                    const uncertain = operation?.uncertain ||
+                        (attempt.started && (replicated || progress) && attempt.error instanceof VsrEvictionError);
+                    this.recoverSession(generation);
+                    if (uncertain)
+                        throw uncertainOutcome(command, operation, attempt.error);
+                    // An eviction fails every exchange of its link, also one never written.
+                    if (restartable && exchanged && !attempt.started && generation !== this.routingGeneration)
+                        continue;
+                    throw attempt.error;
+                }
+                if (generation !== this.routingGeneration) {
+                    if (restartable && (!attempt.started || safeRead))
+                        continue;
+                    throw responseError(command, TRANSIENT_NOT_ACCEPTED);
+                }
+                if (!attempt.error) {
+                    if (operation?.uncertain && !attempt.committed)
+                        throw new OperationUncertainError(operation.id, new Error('reply does not prove the retained result'));
+                    if (command === COMMAND_CODE.GetPartitionRoute &&
+                        !this.rememberRoute({ query: body, key: body.toString('hex') }, attempt.response)) {
+                        await waitWithin(pause(Math.floor(Math.random() * (retryDelay + 1)), signal), deadline, signal);
+                        retryDelay = Math.min(retryDelay * 2, MAX_RETRY_INTERVAL_MS);
+                        continue;
+                    }
+                    if (lineage === this.lineage)
+                        this._rememberCredentials(command, body);
+                    if (command === GET_CLUSTER_METADATA.code)
+                        this.installRoster(attempt.response);
+                    if (TOPIC_DISCOVERY_RESETS.has(command)) {
+                        for (const route of this.partitionRoutes.values())
+                            route.stale = true;
+                        this.emit('topicDiscoveryReset');
+                    }
+                    if (operation)
+                        this.lanes.prove(operation);
+                    return options.handleResponse === false ? attempt.raw : attempt.response;
+                }
+                const error = attempt.error;
+                if (error instanceof ResponseError && error.fromServer)
+                    lastRefusal = error;
+                const code = error instanceof ResponseError && error.fromServer ? error.errorCode : undefined;
+                const repeatedNotPrimary = notPrimary;
+                notPrimary = code === NOT_PRIMARY;
+                if (code === TRANSIENT_NOT_COMMITTED) {
+                    if (operation?.retainable)
+                        operation.uncertain = true;
+                    else if (!safeRead)
+                        throw error;
+                }
+                else if (code === OPERATION_NOT_RETAINED) {
+                    if (operation?.retainable)
+                        operation.uncertain = true;
+                    throw uncertainOutcome(command, operation, error);
+                }
+                else if (code === NOT_PRIMARY || code === TRANSIENT_NOT_ACCEPTED) {
+                    if (selected)
+                        this.invalidateRoute(selected, code === NOT_PRIMARY);
+                    refresh = true;
+                    if (code === NOT_PRIMARY) {
+                        // Neither 58 nor 89 admitted the call, so the deadline reports both as 58.
+                        lastRefusal = responseError(command, TRANSIENT_NOT_ACCEPTED);
+                        lastRefusal.fromServer = true;
+                    }
+                    if (code === NOT_PRIMARY && !repeatedNotPrimary)
+                        continue;
+                }
+                else if (code === HISTORY_UNAVAILABLE && !operation?.uncertain) {
+                    if (selected)
+                        this.invalidateRoute(selected, false);
+                    if (target && command === COMMAND_CODE.SendMessages && !options.context && !historyRefreshed) {
+                        historyRefreshed = true;
+                        if (operation) {
+                            this.lanes.complete(operation);
+                            operation.frame.release();
+                            frameLease = false;
+                            operation = undefined;
+                        }
+                        selected = undefined;
+                        context = undefined;
+                        continue;
+                    }
+                    throw error;
+                }
+                else if (code === LIFECYCLE_BUSY && !operation?.uncertain) {
+                    // The refusal spent the request id, so the call goes out again as a
+                    // new operation in its lane, with the context of its route by then.
+                    if (operation) {
+                        operation.frame.release();
+                        frameLease = false;
+                        staleFrame = true;
+                    }
+                    frame = undefined;
+                    selected = undefined;
+                    context = options.context ? { ...options.context } : undefined;
+                    await waitWithin(pause(lifecycleDelay, signal), deadline, signal);
+                    lifecycleDelay = Math.min(lifecycleDelay * 2, MAX_LIFECYCLE_INTERVAL_MS);
+                    continue;
+                }
+                else if (code !== undefined && ROUTE_NAMESPACE_MISSING.has(code) && attempt.started &&
+                    (selected || command === COMMAND_CODE.GetPartitionRoute) &&
+                    !(await this.isMetadataPrimary(previousLink, generation, deadline, attemptSignal))) {
+                    // A backup can lag the metadata create that the metadata primary
+                    // committed. A partition call retries with a new route, and a route
+                    // lookup asks the next replica. A miss of the lookup that routes a
+                    // partition call came before the request started and stays final.
+                    if (selected) {
+                        this.invalidateRoute(selected, false);
+                        refresh = true;
+                    }
+                    lastRefusal = responseError(command, TRANSIENT_NOT_ACCEPTED);
+                    lastRefusal.fromServer = true;
                 }
-                return { endpoint: next, moved: true };
+                else if (code !== undefined) {
+                    if (operation?.uncertain)
+                        throw new OperationUncertainError(operation.id, error);
+                    throw error;
+                }
+                else {
+                    if (attempt.started) {
+                        if (operation?.retainable)
+                            operation.uncertain = true;
+                        else if (!safeRead)
+                            throw uncertainOutcome(command, operation, error);
+                    }
+                    // NotConnectedError and an exhausted link leave no link up or
+                    // redialing, so the call fails now instead of at its deadline.
+                    if (error instanceof TypeError || error instanceof ResponseError || error instanceof VsrEvictionError ||
+                        signal.aborted || error instanceof NotConnectedError || error instanceof ReconnectExhaustedError)
+                        throw error;
+                    refresh = true;
+                }
+                await waitWithin(pause(Math.floor(Math.random() * (retryDelay + 1)), signal), deadline, signal);
+                retryDelay = Math.min(retryDelay * 2, MAX_RETRY_INTERVAL_MS);
             }
-            catch (error) {
-                debug('the leader could not be re-checked, staying on this node', error);
-                return false;
+        }
+        catch (error) {
+            // A call that sent nothing and saw no refusal was not accepted either.
+            if (error instanceof VsrResponseTimeoutError && (lastRefusal || !sent))
+                error = lastRefusal ?? responseError(command, TRANSIENT_NOT_ACCEPTED);
+            if (operation?.uncertain) {
+                // A frame of a replaced session must not block the lane of the new one.
+                if (generation === this.routingGeneration && this.lanes.owns(operation))
+                    this.lanes.retain(operation);
+                throw error instanceof OperationUncertainError ? error : new OperationUncertainError(operation.id, error);
             }
-        })();
-        this.leaderMoveInFlight = move;
-        void move.finally(() => {
-            if (this.leaderMoveInFlight !== move)
-                return;
-            this.leaderMoveInFlight = undefined;
-            // The drain stopped while the move was being decided. A move that
-            // happened re-issues what was held back on the new socket; one that did
-            // not leaves it here, with nothing else due to pick it up.
-            if (!this.connection.redirecting)
-                void this._processQueue();
-        });
-        return move;
-    }
-    /** Whether a leader move is being decided or carried out. */
-    _movePending() {
-        return this.leaderMovesUndecided > 0 || this.leaderMoveInFlight !== undefined;
-    }
-    /**
-     * Releases the queue hold one refusal took, and drains what was held back
-     * once the last of them is decided.
-     */
-    _releaseUndecidedMove() {
-        if (this.leaderMovesUndecided > 0)
-            this.leaderMovesUndecided -= 1;
-        if (this._movePending() || this.connection.redirecting)
-            return;
-        void this._processQueue();
+            if (retained && !this.lanes.owns(retained))
+                throw error instanceof ResponseError ? error : new OperationNotRetainedError(retained.id);
+            if (error instanceof ResponseError && !(error instanceof VsrEvictionError) && error.commandCode !== command) {
+                const remapped = responseError(command, error.errorCode);
+                remapped.fromServer = error.fromServer;
+                remapped.committed = error.committed;
+                throw remapped;
+            }
+            throw error;
+        }
+        finally {
+            if (operation && !operation.retained)
+                this.lanes.complete(operation);
+            if (operation && frameLease)
+                operation.frame.release();
+        }
     }
-    _rememberRoster(response) {
+    async exchange(link, command, frame, deadline, signal, operation) {
+        const generation = this.routingGeneration;
+        let request;
+        const attempt = await link.exchange(() => request = frame(), deadline, signal, operation?.frame);
+        if (attempt.error || !attempt.response) {
+            const error = this.isAuthenticated && command !== COMMAND_CODE.BindSession &&
+                isDetachedFailure(attempt.error)
+                ? new Error('replica link detached from its session', { cause: attempt.error }) : attempt.error;
+            return { error, committed: false, started: attempt.started };
+        }
         try {
-            const metadata = GET_CLUSTER_METADATA.deserialize(response);
-            if (metadata.nodes.length === 0)
-                return;
-            this.clustered = metadata.nodes.length > 1;
-            this.connection.rememberRoster(metadata.nodes
-                .filter((node) => node.endpoints.tcp !== 0)
-                .map((node) => ({ host: node.ip, port: node.endpoints.tcp })));
+            validateReplyForRequest(attempt.response, request, command);
+            const response = decodeVsrResponse(attempt.response, command);
+            if (generation === this.routingGeneration)
+                this.observeMetadata(attempt.response);
+            return { response, raw: attempt.response, committed: hasCommittedResult(attempt.response), started: attempt.started };
         }
         catch (error) {
-            debug('an unreadable roster leaves the redial candidates as they are', error);
+            if (this.isAuthenticated && command !== COMMAND_CODE.BindSession && isDetachedFailure(error) &&
+                error instanceof ResponseError && error.errorCode === UNAUTHENTICATED) {
+                link._destroy();
+                const refusal = responseError(command, TRANSIENT_NOT_ACCEPTED);
+                refusal.fromServer = true;
+                return { error: refusal, committed: false, started: attempt.started };
+            }
+            if (error instanceof ResponseError && error.committed)
+                if (generation === this.routingGeneration)
+                    this.observeMetadata(attempt.response);
+            return { error, committed: error instanceof ResponseError && error.committed, started: attempt.started };
         }
     }
-    async _pollOnPrimary(payload, deadline, handleResponse) {
-        const key = payload.subarray(0, -POLL_OPTIONS_SIZE).toString('hex');
-        while (Date.now() < deadline && !this.connection.ending) {
+    async control(link, command, body, deadline, signal) {
+        let frame;
+        let retryDelay = RETRY_INTERVAL_MS;
+        for (;;) {
+            const attempt = await this.exchange(link, command, () => frame ??= this.vsrSession.encode(command, body, { ...EMPTY_PARTITION_CONTEXT, metadataOp: this.metadataWatermark }), deadline, signal);
+            if (!attempt.error)
+                return attempt.response;
+            if (!(attempt.error instanceof ResponseError) || !attempt.error.fromServer ||
+                !isTransient(attempt.error.errorCode))
+                throw attempt.error;
             try {
-                const generation = this.routingGeneration;
-                let route = this.pollRoutes.get(key);
-                if (!route ||
-                    route.attachment.readBigUInt64LE(METADATA_WATERMARK_OFFSET) <
-                        this.metadataWatermark) {
-                    const response = await withinDeadline(this._pollRoutingControl(payload, deadline), deadline);
-                    if (generation !== this.routingGeneration)
-                        throw responseError(COMMAND_CODE.PollMessages, TRANSIENT_NOT_ACCEPTED);
-                    if (response.data.length < CONSUMER_SESSION_SIZE)
-                        throw new Error('poll routing response is incomplete');
-                    const node = deserializeNode(response.data, CONSUMER_SESSION_SIZE);
-                    if (node.length + CONSUMER_SESSION_SIZE !== response.data.length || !node.data.ip)
-                        throw new Error('poll routing response has no valid TCP endpoint');
-                    if (node.data.endpoints.tcp === 0)
-                        throw responseError(COMMAND_CODE.PollMessages, FEATURE_UNAVAILABLE);
-                    const attachment = Buffer.from(response.data.subarray(0, CONSUMER_SESSION_SIZE));
-                    if (attachment.readBigUInt64LE(METADATA_WATERMARK_OFFSET) < this.metadataWatermark)
-                        attachment.writeBigUInt64LE(this.metadataWatermark, METADATA_WATERMARK_OFFSET);
-                    route = {
-                        endpoint: { host: node.data.ip, port: node.data.endpoints.tcp },
-                        attachment
-                    };
-                    if (this.pollRoutes.size >= MAX_POLL_ROUTES)
-                        this.pollRoutes.clear();
-                    this.pollRoutes.set(key, route);
-                }
-                const endpoint = endpointKey(route.endpoint);
-                let entry = this.pollConnections.get(endpoint);
-                if (!entry) {
-                    if (this.pollConnections.size >= MAX_POLL_CONNECTIONS) {
-                        const idle = Array.from(this.pollConnections).find(([, value]) => !value.busy);
-                        if (!idle)
-                            throw responseError(COMMAND_CODE.PollMessages, TRANSIENT_NOT_ACCEPTED);
-                        this.pollConnections.delete(idle[0]);
-                        idle[1].client.destroy();
-                    }
-                    entry = {
-                        client: new CommandResponseStream({
-                            ...this.options,
-                            options: { ...this.options.options, ...route.endpoint },
-                            heartbeatInterval: 0,
-                            reconnect: { enabled: false, interval: 0, maxRetries: 0 }
-                        })
-                    };
-                    this.pollConnections.set(endpoint, entry);
-                }
-                while (entry.busy)
-                    await withinDeadline(entry.busy, deadline);
-                if (generation !== this.routingGeneration ||
-                    this.pollConnections.get(endpoint) !== entry ||
-                    route.attachment.readBigUInt64LE(METADATA_WATERMARK_OFFSET) <
-                        this.metadataWatermark)
-                    throw responseError(COMMAND_CODE.PollMessages, TRANSIENT_NOT_ACCEPTED);
-                let release;
-                entry.busy = new Promise((resolve) => { release = resolve; });
-                let polling = false;
+                await waitWithin(pause(Math.floor(Math.random() * (retryDelay + 1)), signal), deadline, signal);
+            }
+            catch (error) {
+                throw error instanceof VsrResponseTimeoutError ? attempt.error : error;
+            }
+            retryDelay = Math.min(retryDelay * 2, MAX_RETRY_INTERVAL_MS);
+            if (command === GET_CLUSTER_METADATA.code) {
+                const alternative = [...this.replicas.values()].find((slot) => slot.attached && slot.connection?.connected && slot.connection !== link);
+                link = alternative?.connection ?? link;
+            }
+        }
+    }
+    async routeFor(target, deadline, signal, generation, force = false) {
+        const cached = this.partitionRoutes.get(target.key);
+        if (!force && cached && !cached.stale && cached.route.context.metadataOp >= this.metadataWatermark)
+            return cached;
+        let lastRefusal;
+        let refreshedRoster = false;
+        let previous;
+        let retryDelay = RETRY_INTERVAL_MS;
+        const visited = new Set();
+        for (;;) {
+            this.ensureGeneration(generation, COMMAND_CODE.GetPartitionRoute);
+            const link = await this.readyLink(deadline, signal, previous);
+            if (visited.has(link)) {
+                visited.clear();
+                // Each pass starts at the metadata primary, which a roster read after
+                // a namespace miss can have moved.
+                previous = undefined;
                 try {
-                    if (!entry.client.isAuthenticated) {
-                        entry.attachment = undefined;
-                        await withinDeadline(entry.client.connection.connect(true), deadline, () => entry.client.destroy());
-                        const credentials = this._signInCredentials();
-                        const login = 'token' in credentials ? LOGIN_WITH_TOKEN : LOGIN;
-                        const loginPayload = 'token' in credentials
-                            ? LOGIN_WITH_TOKEN.serialize(credentials)
-                            : LOGIN.serialize(credentials);
-                        await entry.client._queueCommand(login.code, loginPayload, true, true, false, deadline);
-                    }
-                    if (!entry.attachment?.equals(route.attachment)) {
-                        await entry.client._queueCommand(COMMAND_CODE.AttachConsumerSession, route.attachment, true, true, false, deadline);
-                        entry.attachment = route.attachment;
-                    }
-                    if (generation !== this.routingGeneration ||
-                        route.attachment.readBigUInt64LE(METADATA_WATERMARK_OFFSET) <
-                            this.metadataWatermark)
-                        throw responseError(COMMAND_CODE.PollMessages, TRANSIENT_NOT_ACCEPTED);
-                    polling = true;
-                    return await entry.client._queueCommand(COMMAND_CODE.PollMessagesOnPrimary, payload, handleResponse, true, false, deadline);
+                    await waitWithin(pause(Math.floor(Math.random() * (retryDelay + 1)), signal), deadline, signal);
                 }
                 catch (error) {
-                    if (error instanceof ResponseError &&
-                        error.errorCode === TRANSIENT_NOT_ACCEPTED) {
-                        entry.attachment = undefined;
-                    }
-                    else {
-                        if (this.pollConnections.get(endpoint) === entry)
-                            this.pollConnections.delete(endpoint);
-                        entry.client.destroy();
+                    throw error instanceof VsrResponseTimeoutError && lastRefusal ? lastRefusal : error;
+                }
+                retryDelay = Math.min(retryDelay * 2, MAX_RETRY_INTERVAL_MS);
+                continue;
+            }
+            visited.add(link);
+            previous = link;
+            try {
+                const attempt = await this.exchange(link, COMMAND_CODE.GetPartitionRoute, () => this.vsrSession.encode(COMMAND_CODE.GetPartitionRoute, target.query, { ...EMPTY_PARTITION_CONTEXT, metadataOp: this.metadataWatermark }), deadline, signal);
+                if (attempt.error)
+                    throw attempt.error;
+                this.ensureGeneration(generation, COMMAND_CODE.GetPartitionRoute);
+                const entry = this.rememberRoute(target, attempt.response);
+                if (entry) {
+                    if (!this.replicas.has(entry.route.primaryReplica) && !refreshedRoster) {
+                        refreshedRoster = true;
+                        await this.refreshRoster(deadline, signal);
                     }
-                    if (!(error instanceof ResponseError) || error instanceof VsrEvictionError ||
-                        error.errorCode === UNAUTHENTICATED || error.errorCode === STALE_CLIENT)
-                        throw responseError(COMMAND_CODE.PollMessages, polling ? TRANSIENT_NOT_COMMITTED : TRANSIENT_NOT_ACCEPTED);
+                    if (this.replicas.has(entry.route.primaryReplica))
+                        return entry;
+                    const error = responseError(COMMAND_CODE.GetPartitionRoute, TRANSIENT_NOT_ACCEPTED);
+                    error.fromServer = true;
                     throw error;
                 }
-                finally {
-                    entry.busy = undefined;
-                    release();
-                }
             }
             catch (error) {
-                this.pollRoutes.delete(key);
-                if (error instanceof VsrResponseTimeoutError)
-                    throw responseError(COMMAND_CODE.PollMessages, TRANSIENT_NOT_COMMITTED);
-                if (!(error instanceof ResponseError) ||
-                    error.errorCode !== TRANSIENT_NOT_ACCEPTED)
-                    throw error instanceof ResponseError
-                        ? responseError(COMMAND_CODE.PollMessages, error.errorCode)
-                        : error;
-                if (!worthAnotherAttempt(deadline))
-                    throw responseError(COMMAND_CODE.PollMessages, TRANSIENT_NOT_ACCEPTED);
-                await delay(VSR_RETRY_INTERVAL_MS);
+                if (isSessionFailure(error)) {
+                    this.recoverSession(generation);
+                    throw error;
+                }
+                this.ensureGeneration(generation, COMMAND_CODE.GetPartitionRoute);
+                if (error instanceof ResponseError && ROUTE_NAMESPACE_MISSING.has(error.errorCode) &&
+                    !(await this.isMetadataPrimary(link, generation, deadline, signal))) {
+                    // A backup can lag a metadata create while the primary materializes the route.
+                    lastRefusal = responseError(COMMAND_CODE.GetPartitionRoute, TRANSIENT_NOT_ACCEPTED);
+                    lastRefusal.fromServer = error.fromServer;
+                    continue;
+                }
+                if (error instanceof DeserializeError || (error instanceof ResponseError && !isTransient(error.errorCode)))
+                    throw error;
+                if (error instanceof ResponseError)
+                    lastRefusal = error;
             }
         }
-        throw responseError(COMMAND_CODE.PollMessages, TRANSIENT_NOT_ACCEPTED);
     }
-    async _pollRoutingControl(payload, deadline) {
-        const options = { deadline, followsLeaderMoves: false };
+    /**
+     * Whether the replica that answered a namespace miss on `link` is the
+     * metadata primary. The belief can predate a view change, so one roster read
+     * on `link`, without a retry or another link, must still name that replica.
+     * No lookup reaches a believed metadata primary without a link, so then that
+     * roster also moves the belief.
+     */
+    async isMetadataPrimary(link, generation, deadline, signal) {
+        const replica = [...this.replicas.values()].find((slot) => slot.connection === link)?.replica;
+        const believed = this.metadataReplica === undefined ? undefined : this.replicas.get(this.metadataReplica);
+        if (replica !== this.metadataReplica && believed?.attached && believed.connection?.connected)
+            return false;
         try {
-            return await this.sendCommand(COMMAND_CODE.GetPollRouting, payload, options);
+            const attempt = await this.exchange(link, GET_CLUSTER_METADATA.code, () => this.vsrSession.encode(GET_CLUSTER_METADATA.code, GET_CLUSTER_METADATA.serialize(), { ...EMPTY_PARTITION_CONTEXT, metadataOp: this.metadataWatermark }), deadline, signal);
+            if (attempt.error)
+                throw attempt.error;
+            this.ensureGeneration(generation, GET_CLUSTER_METADATA.code);
+            this.installRoster(attempt.response);
         }
         catch (error) {
-            if (error instanceof ResponseError &&
-                error.errorCode !== UNAUTHENTICATED && error.errorCode !== STALE_CLIENT)
-                throw error;
-            if (Date.now() >= deadline)
-                throw error;
-            // Only a failed coordinator exchange uses normal session recovery.
-            // A healthy coordinator refusing a route must retain its group membership.
-            if (error instanceof ResponseError) {
-                this.connection.abort();
-                this.connection.connected = false;
-                this._resetSession();
-            }
-            await this.sendCommand(PING.code, PING.serialize(), { deadline });
-            return this.sendCommand(COMMAND_CODE.GetPollRouting, payload, options);
+            debug('roster read after a namespace miss failed', error);
+            return false;
         }
+        return replica !== undefined && replica === this.metadataReplica;
     }
-    _observeMetadataReply(frame) {
-        if (frame.length < HEADER_SIZE || peekCommand(frame) !== Command.Reply)
-            return;
-        const operation = readReplyOperation(frame);
-        if (!isKnownOperation(operation) || operation === Operation.NonReplicated ||
-            operation === Operation.SendMessages || operation === Operation.StoreConsumerOffset ||
-            operation === Operation.DeleteConsumerOffset)
-            return;
-        const commit = frame.readBigUInt64LE(REPLY_OFFSET.commit);
-        if (commit > this.metadataWatermark)
-            this.metadataWatermark = commit;
-    }
-    _rememberCredentials(command, payload) {
-        if (command === LOGIN.code) {
-            const username = readWireName(payload, 0);
-            this.rememberedCredentials = {
-                username: username.value, password: readWireName(payload, username.next).value
-            };
+    rememberRoute(target, response) {
+        const route = deserializePartitionRoute(response.data);
+        const group = groupKey(route.context, target);
+        const cached = this.partitionRoutes.get(target.key);
+        if (cached && cached.group !== group && route.context.metadataOp < cached.route.context.metadataOp)
+            return undefined;
+        let minimumView = cached?.group === group ? cached.minimumView : 0;
+        for (const alias of this.partitionRoutes.values()) {
+            if (alias.group !== group)
+                continue;
+            minimumView = Math.max(minimumView, alias.minimumView, alias.route.view);
+            if (alias.route.view === route.view && alias.route.primaryReplica !== route.primaryReplica)
+                minimumView = Math.max(minimumView, route.view + 1);
         }
-        else if (command === LOGIN_WITH_TOKEN.code) {
-            this.rememberedCredentials = { token: readWireName(payload, 0).value };
+        if (route.context.metadataOp < this.metadataWatermark || route.view < minimumView)
+            return undefined;
+        const entry = { route, group, minimumView: route.view, stale: false };
+        for (const alias of this.partitionRoutes.values()) {
+            if (alias.group !== group)
+                continue;
+            alias.minimumView = Math.max(alias.minimumView, route.view);
+            if (alias.route.view < route.view)
+                alias.stale = true;
         }
-        else if ((command === COMMAND_CODE.ChangePassword || command === COMMAND_CODE.UpdateUser) &&
-            this.userId !== undefined && this.rememberedCredentials &&
-            'username' in this.rememberedCredentials) {
-            const credentials = this.rememberedCredentials;
-            const identifier = [serializeIdentifier(this.userId), serializeIdentifier(credentials.username)]
-                .find((encoded) => payload.subarray(0, encoded.length).equals(encoded));
-            if (!identifier)
-                return;
-            if (command === COMMAND_CODE.ChangePassword) {
-                const currentPassword = readWireName(payload, identifier.length);
-                const password = readWireName(payload, currentPassword.next).value;
-                this.rememberedCredentials = { ...credentials, password };
-                if ('username' in this.options.credentials && this.options.credentials.username === credentials.username)
-                    this.options.credentials = { ...this.options.credentials, password };
+        this.partitionRoutes.delete(target.key);
+        if (this.partitionRoutes.size >= MAX_PARTITION_ROUTES)
+            this.partitionRoutes.delete(this.partitionRoutes.keys().next().value);
+        this.partitionRoutes.set(target.key, entry);
+        this.emit('partitionRoute', { topic: target.query.subarray(0, -PARTITION_ID_SIZE).toString('hex'), count: route.partitionsCount });
+        return entry;
+    }
+    invalidateRoute(refused, advanceView) {
+        const floor = refused.route.view + (advanceView ? 1 : 0);
+        for (const route of this.partitionRoutes.values()) {
+            if (route.group !== refused.group || route.route.view > refused.route.view)
+                continue;
+            route.stale = true;
+            route.minimumView = Math.max(route.minimumView, floor);
+        }
+    }
+    async primaryLink(route, deadline, signal) {
+        for (;;) {
+            const slot = this.replicas.get(route.route.primaryReplica);
+            if (slot?.attached && slot.connection?.connected)
+                return slot.connection;
+            if (slot?.failure instanceof ResponseError)
+                throw slot.failure;
+            if (slot?.failure instanceof TypeError)
+                throw slot.failure;
+            if (!slot || !slot.initial) {
+                route.stale = true;
+                const error = responseError(COMMAND_CODE.GetPartitionRoute, TRANSIENT_NOT_ACCEPTED);
+                error.fromServer = true;
+                throw error;
             }
-            else if (payload[identifier.length] === 1) {
-                const username = readWireName(payload, identifier.length + 1).value;
-                this.rememberedCredentials = { ...credentials, username };
-                if ('username' in this.options.credentials && this.options.credentials.username === credentials.username)
-                    this.options.credentials = { ...this.options.credentials, username };
+            try {
+                await waitWithin(this.changed.promise, deadline, signal);
+            }
+            catch (error) {
+                if (!(error instanceof VsrResponseTimeoutError))
+                    throw error;
+                const refusal = responseError(COMMAND_CODE.GetPartitionRoute, TRANSIENT_NOT_ACCEPTED);
+                refusal.fromServer = true;
+                throw refusal;
             }
         }
     }
-    _signInCredentials() {
-        return this.rememberedCredentials ?? this.options.credentials;
+    async readyLink(deadline, signal, avoid) {
+        for (;;) {
+            if (avoid) {
+                const ready = [...this.replicas.values()].filter((slot) => slot.attached && slot.connection?.connected);
+                const previous = ready.findIndex((slot) => slot.connection === avoid);
+                if (previous >= 0)
+                    return ready[(previous + 1) % ready.length].connection;
+            }
+            const primary = this.metadataReplica === undefined ? undefined : this.replicas.get(this.metadataReplica);
+            if (primary?.attached && primary.connection?.connected && primary.connection !== avoid)
+                return primary.connection;
+            for (const slot of this.replicas.values())
+                if (slot.attached && slot.connection?.connected && slot.connection !== avoid)
+                    return slot.connection;
+            if (this.bootstrap?.connected && !this.bootstrapPromise)
+                return this.bootstrap;
+            if (!this.isAuthenticated || this.replicas.size === 0)
+                return await this.connectBootstrap(deadline, signal);
+            if ([...this.replicas.values()].every((slot) => slot.failure))
+                throw [...this.replicas.values()][0]?.failure ?? new Error('no replica endpoints');
+            await waitWithin(this.changed.promise, deadline, signal);
+        }
     }
-    _clearPollRouting() {
-        this.routingGeneration += 1;
-        this.pollRoutes.clear();
-        for (const entry of this.pollConnections.values())
-            entry.client.destroy();
-        this.pollConnections.clear();
+    async refreshRoster(deadline, signal) {
+        if (!this.rosterPromise) {
+            const generation = this.routingGeneration;
+            const ownerSignal = AbortSignal.any([this.lifetime.signal, this.sessionLifetime.signal]);
+            const pending = (async () => {
+                const link = await this.readyLink(Date.now() + OPERATION_TIMEOUT_MS, ownerSignal);
+                const response = await this.control(link, GET_CLUSTER_METADATA.code, GET_CLUSTER_METADATA.serialize(), Date.now() + OPERATION_TIMEOUT_MS, ownerSignal);
+                this.ensureGeneration(generation, GET_CLUSTER_METADATA.code);
+                this.installRoster(response);
+            })().finally(() => { if (this.rosterPromise === pending)
+                this.rosterPromise = undefined; });
+            this.rosterPromise = pending;
+        }
+        await waitWithin(this.rosterPromise, deadline, signal);
     }
-    /**
-     * Processes queued commands sequentially.
-     * Emits 'finishQueue' when all commands are processed.
-     *
-     */
-    async _processQueue() {
-        if (this.busy)
-            return;
-        this.busy = true;
-        while (this._execQueue.length > 0 && this.connection.socket.writable) {
-            // While a leader move is being decided, only the roster read the move
-            // itself runs goes out -- it is what decides where the client lands, and
-            // it is the one command that does not follow moves. Draining the rest
-            // would write them to the socket `redirect()` is about to replace, and a
-            // command in flight when that happens dies with a lost-connection error
-            // instead of being re-issued on the node the move lands on.
-            const index = this._movePending()
-                ? this._execQueue.findIndex((job) => !job.followsLeaderMoves)
-                : 0;
-            if (index < 0)
-                break;
-            const [next] = this._execQueue.splice(index, 1);
-            if (!next)
-                break;
-            const { command, payload, handleResponse, deadline, resolve, reject } = next;
-            try {
-                resolve(await this._processNext(command, payload, handleResponse, deadline));
+    installRoster(response) {
+        const metadata = GET_CLUSTER_METADATA.deserialize(response);
+        if (metadata.nodes.length === 0 || metadata.nodes.length > MAX_REPLICAS || new Set(metadata.nodes.map((node) => node.replicaId)).size !== metadata.nodes.length)
+            throw responseError(GET_CLUSTER_METADATA.code, INVALID_COMMAND, 'invalid replica roster');
+        metadata.nodes = metadata.nodes.filter((node) => node.endpoints.tcp !== 0);
+        this.metadataReplica = metadata.nodes.find((node) => node.role === 'Leader' && node.status === 'Healthy')?.replicaId;
+        this.knownEndpoints = metadata.nodes.map((node) => ({ host: node.ip, port: node.endpoints.tcp }));
+        const present = new Set(metadata.nodes.map((node) => node.replicaId));
+        for (const [replica, slot] of this.replicas) {
+            const endpoint = metadata.nodes.find((node) => node.replicaId === replica);
+            if (!present.has(replica) || !endpoint || endpointKey(slot.endpoint) !== endpointKey({ host: endpoint.ip, port: endpoint.endpoints.tcp })) {
+                slot.lifetime.abort();
+                slot.connection?._destroy();
+                this.replicas.delete(replica);
             }
-            catch (err) {
-                if (err instanceof LeaderMovedError && next.followsLeaderMoves)
-                    // Counted before the rejection is handed out, not after: the caller
-                    // resumes as a microtask, so this loop would otherwise write the next
-                    // command before the re-check it is about to start has begun.
-                    this.leaderMovesUndecided += 1;
-                reject(err);
+        }
+        // A single node can advertise an address the client cannot reach, such as
+        // one behind a port mapping or a port-forward, so its slot dials the
+        // configured endpoint.
+        const single = metadata.nodes.length === 1;
+        for (const node of metadata.nodes) {
+            if (this.replicas.has(node.replicaId))
+                continue;
+            const endpoint = { host: node.ip, port: node.endpoints.tcp };
+            const slot = {
+                replica: node.replicaId, endpoint, dialEndpoint: single ? this.configuredEndpoint : endpoint,
+                generation: this.routingGeneration, lifetime: new AbortController(), attached: false, initial: true,
+                heartbeat: false, restartable: false
+            };
+            if (this.bootstrap?.connected && (single || this.bootstrap.isConnectedTo(endpoint.host, endpoint.port))) {
+                slot.connection = this.bootstrap;
+                slot.attached = true;
+                slot.initial = false;
+                this.bootstrap = undefined;
             }
+            this.replicas.set(slot.replica, slot);
+            void this.runReplica(slot);
         }
-        if (this._execQueue.length > 0) {
-            // The same distinction as on 'disconnected': the socket a leader move
-            // replaced stops being writable, and what is still queued belongs on the
-            // node being moved to.
-            if (this.connection.redirecting)
-                this._reissueQueue();
-            else if (!this._movePending())
-                this._failQueue(new Error('connection is not writable'));
-            // Otherwise the move is still being decided: these commands were never
-            // written, and they are drained again once it settles -- here if the
-            // client stays, on the new socket if it moves.
+        if (this.bootstrap && metadata.nodes.length > 0) {
+            this.bootstrap._destroy();
+            this.bootstrap = undefined;
         }
-        this.busy = false;
-        this._emitFinishQueue();
+        this.changed.pulse();
     }
-    _emitFinishQueue() {
-        if (this.pendingSubmissions === 0 &&
-            !this.busy &&
-            this._execQueue.length === 0)
-            this.emit('finishQueue');
+    async runReplica(slot) {
+        const signal = AbortSignal.any([this.lifetime.signal, this.sessionLifetime.signal, slot.lifetime.signal]);
+        const reconnect = this.options.reconnect ?? { enabled: true, interval: 5_000, maxRetries: 12 };
+        let failures = 0;
+        try {
+            for (;;) {
+                signal.throwIfAborted();
+                if (!slot.connection) {
+                    let permit = false;
+                    try {
+                        while (this.activeDials >= MAX_CONCURRENT_DIALS)
+                            await waitWithin(this.changed.promise, Date.now() + OPERATION_TIMEOUT_MS, signal);
+                        signal.throwIfAborted();
+                        this.activeDials += 1;
+                        permit = true;
+                        const connection = this.connectionFor(slot.dialEndpoint);
+                        slot.connection = connection;
+                        await connection.connect(signal);
+                        this.activeDials -= 1;
+                        permit = false;
+                        this.changed.pulse();
+                        const body = this.vsrSession.resumePayload(this.metadataWatermark);
+                        if (!body)
+                            throw responseError(COMMAND_CODE.BindSession, UNAUTHENTICATED);
+                        const response = await this.control(connection, COMMAND_CODE.BindSession, body, Date.now() + OPERATION_TIMEOUT_MS, signal);
+                        this.ensureGeneration(slot.generation, COMMAND_CODE.BindSession);
+                        if (readRegisteredSession(response) !== this.vsrSession.sessionId)
+                            throw responseError(COMMAND_CODE.BindSession, INVALID_SESSION_BINDING);
+                        slot.attached = true;
+                        failures = 0;
+                        this.changed.pulse();
+                    }
+                    catch (error) {
+                        slot.connection?._destroy();
+                        if (isSessionFailure(error, true)) {
+                            this.recoverSession(slot.generation);
+                            return;
+                        }
+                        // A 30 refusal failed only the link, so the slot binds again.
+                        if (error instanceof TypeError || (error instanceof ResponseError &&
+                            !isTransient(error.errorCode) && error.errorCode !== STALE_CLIENT)) {
+                            slot.failure = error;
+                            return;
+                        }
+                    }
+                    finally {
+                        if (permit)
+                            this.activeDials -= 1;
+                        slot.initial = false;
+                        this.changed.pulse();
+                    }
+                }
+                if (slot.attached && slot.connection) {
+                    await waitWithin(slot.connection.closed, Number.MAX_SAFE_INTEGER, signal);
+                    if (isSessionFailure(slot.connection.failure)) {
+                        this.recoverSession(slot.generation);
+                        return;
+                    }
+                }
+                slot.attached = false;
+                slot.connection?._destroy();
+                slot.connection = undefined;
+                this.changed.pulse();
+                if (!reconnect.enabled || failures >= reconnect.maxRetries) {
+                    slot.restartable = reconnect.enabled;
+                    slot.failure = this.budgetFailure(slot);
+                    return;
+                }
+                const base = Math.min(reconnect.interval * 2 ** Math.min(failures, 16), MAX_RECONNECT_INTERVAL_MS);
+                failures += 1;
+                await pause(Math.floor(Math.random() * (base + 1)), signal, true);
+            }
+        }
+        catch (error) {
+            if (!signal.aborted)
+                slot.failure = error;
+        }
+        finally {
+            slot.attached = false;
+            slot.connection?._destroy();
+            this.changed.pulse();
+        }
     }
     /**
-     * Processes a single command by writing it to the connection and waiting for response.
-     *
-     * @param command - Command code
-     * @param payload - Command payload
-     * @param handleResp - Whether to parse the response
-     * @param deadline - When the whole request gives up, shared with the leader
-     * re-checks and the re-issues after a move
-     * @returns Promise resolving to the command response
+     * Only a heartbeat restarts a link that used its budget, so without one the
+     * link stays down for good.
      */
-    _processNext(command, payload, handleResp = true, deadline = Date.now() + VSR_RESPONSE_TIMEOUT_MS) {
-        if (isLoginCommand(command) && this.isAuthenticated)
-            return this._processVsrLogin(command, payload, handleResp, deadline);
-        return this._processVsr(command, payload, handleResp, deadline);
+    budgetFailure(slot) {
+        return slot.restartable && this.heartbeatIntervalHandler ? new NotConnectedError() : new ReconnectExhaustedError();
     }
-    async _processVsrLogin(command, payload, handleResp, deadline) {
-        await this._processVsr(LOGOUT.code, LOGOUT.serialize(), true, deadline);
-        return this._processVsr(command, payload, handleResp, deadline);
+    connectionFor(endpoint) {
+        const connection = new IggyConnection({ ...this.options, options: { ...this.options.options, ...endpoint } });
+        connection.on('eviction', (error) => this.emit('eviction', error));
+        return connection;
     }
-    async _processVsr(command, payload, handleResp, deadline) {
-        let requestWritten = false;
-        try {
-            const prepared = prepareVsrCommand(command, payload);
-            // A transient retry must preserve all request identity fields.
-            const frame = this.vsrSession.encode(prepared.command, prepared.payload);
-            // Derived from the request's own budget rather than read off the clock,
-            // so one request spends one budget however many times it is re-issued.
-            const notAcceptedDeadline = deadline - VSR_RESPONSE_TIMEOUT_MS + VSR_FAILOVER_CHECK_MS;
-            let lastTransientError;
-            let parsed;
-            while (true) {
-                const remaining = deadline - Date.now();
-                if (remaining <= 0) {
-                    if (lastTransientError)
-                        throw lastTransientError;
-                    throw new VsrResponseTimeoutError(VSR_RESPONSE_TIMEOUT_MS);
-                }
-                const exchangeState = { written: false };
-                let response;
-                try {
-                    response = await this._exchange(() => this.connection.writeFrame(frame), remaining, exchangeState);
-                }
-                finally {
-                    requestWritten ||= exchangeState.written;
-                }
-                this._observeMetadataReply(response);
-                if (!handleResp) {
-                    // Routing still needs refusals when the caller decodes the frame.
-                    if (command === COMMAND_CODE.PollMessagesOnPrimary &&
-                        peekCommand(response) === Command.Reply &&
-                        readStatus(response) === TRANSIENT_NOT_ACCEPTED)
-                        throw responseError(command, TRANSIENT_NOT_ACCEPTED);
-                    return response;
-                }
-                try {
-                    parsed = decodeVsrResponse(response, command);
-                    break;
-                }
-                catch (error) {
-                    if (!(error instanceof ResponseError) ||
-                        !isTransientVsrError(error.errorCode))
-                        throw error;
-                    if (command === COMMAND_CODE.PollMessagesOnPrimary ||
-                        command === COMMAND_CODE.GetPollRouting ||
-                        command === COMMAND_CODE.AttachConsumerSession)
-                        throw error;
-                    lastTransientError = error;
-                    // A not-admitted refusal is a statement about who leads, not about
-                    // load: a node that stopped being primary refuses forever, so
-                    // replaying on this connection never recovers. Hand it back for a
-                    // roster re-read once the window is spent. Not-committed (57) stays
-                    // here: the request is in flight on this very node, and its outcome
-                    // is unknown anywhere else.
-                    if (error.errorCode === TRANSIENT_NOT_ACCEPTED &&
-                        !isLoginCommand(command) &&
-                        Date.now() >= notAcceptedDeadline)
-                        throw new LeaderMovedError(error);
-                    const retryDelay = Math.min(VSR_RETRY_INTERVAL_MS, Math.max(0, deadline - Date.now()));
-                    if (retryDelay === 0)
-                        throw error;
-                    await delay(retryDelay);
+    async connectBootstrap(deadline, signal) {
+        if (this.bootstrap?.connected && !this.bootstrapPromise)
+            return this.bootstrap;
+        if (!this.bootstrapPromise) {
+            const generation = this.routingGeneration;
+            const ownerSignal = AbortSignal.any([this.lifetime.signal, this.sessionLifetime.signal]);
+            this.bootstrapFailure = undefined;
+            const pending = (async () => {
+                const endpoints = [...new Map([this.configuredEndpoint, ...this.knownEndpoints].map((endpoint) => [endpointKey(endpoint), endpoint])).values()];
+                const reconnect = this.options.reconnect ?? { enabled: true, interval: 5_000, maxRetries: 12 };
+                let dialed = false;
+                for (let pass = 0;; pass += 1) {
+                    for (const endpoint of endpoints) {
+                        const link = this.connectionFor(endpoint);
+                        this.bootstrap = link;
+                        let accepted = false;
+                        try {
+                            await link.connect(ownerSignal);
+                            accepted = dialed = true;
+                            this.bootstrapFailure = undefined;
+                            if (this.isAuthenticated) {
+                                const body = this.vsrSession.resumePayload(this.metadataWatermark);
+                                if (!body)
+                                    throw responseError(COMMAND_CODE.BindSession, UNAUTHENTICATED);
+                                const response = await this.control(link, COMMAND_CODE.BindSession, body, Date.now() + OPERATION_TIMEOUT_MS, ownerSignal);
+                                if (readRegisteredSession(response) !== this.vsrSession.sessionId)
+                                    throw responseError(COMMAND_CODE.BindSession, INVALID_SESSION_BINDING);
+                            }
+                            return link;
+                        }
+                        catch (error) {
+                            link._destroy();
+                            if (this.isAuthenticated && isSessionFailure(error, true)) {
+                                this.recoverSession(generation);
+                                throw error;
+                            }
+                            if (error instanceof TypeError || ownerSignal.aborted)
+                                throw error;
+                            if (accepted)
+                                this.bootstrapFailure = error;
+                            else if (!dialed)
+                                this.bootstrapFailure = new NotConnectedError(error);
+                        }
+                    }
+                    if (!reconnect.enabled || pass >= reconnect.maxRetries)
+                        throw this.bootstrapFailure;
+                    const base = Math.min(reconnect.interval * 2 ** Math.min(pass, 16), MAX_RECONNECT_INTERVAL_MS);
+                    await pause(Math.floor(Math.random() * (base + 1)), ownerSignal, true);
                 }
-            }
-            if (prepared.command === COMMAND_CODE.LoginRegister ||
-                prepared.command === COMMAND_CODE.LoginRegisterWithAccessToken) {
-                this.vsrSession.bind(readRegisteredSession(parsed));
-                this.isAuthenticated = true;
-                this.userId = parsed.data.readUInt32LE(0);
-            }
-            this._rememberCredentials(command, payload);
-            if (prepared.command === COMMAND_CODE.LogoutUser) {
-                this.rememberedCredentials = undefined;
-                this._resetSession();
-            }
-            // Every roster read feeds the redial candidates, whoever asked for it
-            // and whatever it says: a node dies together with its address, the
-            // roster is unreachable exactly when it is needed, and reading it only
-            // during a login would leave the candidates stale between logins.
-            if (handleResp && command === GET_CLUSTER_METADATA.code)
-                this._rememberRoster(parsed);
-            return parsed;
+            })().finally(() => { if (this.bootstrapPromise === pending)
+                this.bootstrapPromise = undefined; });
+            this.bootstrapPromise = pending;
+        }
+        try {
+            return await waitWithin(this.bootstrapPromise, deadline, signal);
         }
         catch (error) {
-            // A not-admitted refusal is an answer, so the session is not in doubt
-            // and the request was never applied.
-            if (error instanceof LeaderMovedError)
-                throw error;
-            // Once bytes were handed to the socket, a local transport or decode
-            // failure leaves the request outcome ambiguous. Register a fresh session
-            // rather than replaying that request under a different client identity.
-            if (!(error instanceof ResponseError) && requestWritten)
-                this._resetSession();
-            if (error instanceof VsrEvictionError)
-                throw error;
-            if (error instanceof ResponseError)
-                throw responseError(command, error.errorCode);
+            // With the default reconnect values the deadline usually ends the dials
+            // before the retry budget does, so it reports the last failure the same way.
+            if (error instanceof VsrResponseTimeoutError && this.bootstrapFailure !== undefined)
+                throw this.bootstrapFailure;
             throw error;
         }
     }
-    _exchange(write, timeout, state) {
-        return new Promise((resolve, reject) => {
-            let timeoutHandler;
-            const cleanup = () => {
-                if (timeoutHandler)
-                    clearTimeout(timeoutHandler);
-                this.connection.removeListener('error', errorCallback);
-                this.connection.removeListener('disconnected', disconnectedCallback);
-                this.connection.removeListener('eviction', evictionCallback);
-                this.connection.removeListener('response', responseCallback);
-            };
-            const errorCallback = (error) => {
-                cleanup();
-                reject(error);
-            };
-            const disconnectedCallback = () => {
-                cleanup();
-                reject(new Error('connection closed while waiting for response'));
-            };
-            const evictionCallback = (error) => {
-                cleanup();
-                reject(error);
-            };
-            const responseCallback = (response) => {
-                cleanup();
-                resolve(response);
-            };
-            if (timeout !== undefined) {
-                timeoutHandler = setTimeout(() => {
-                    cleanup();
-                    this.connection.abort();
-                    reject(new VsrResponseTimeoutError(timeout));
-                }, timeout);
-            }
-            this.connection.once('error', errorCallback);
-            this.connection.once('disconnected', disconnectedCallback);
-            this.connection.once('eviction', evictionCallback);
-            this.connection.once('response', responseCallback);
-            try {
-                write();
-                if (state)
-                    state.written = true;
+    serializeSession(action) {
+        const pending = this.sessionAction.then(action, action);
+        this.sessionAction = pending.catch(() => undefined);
+        return pending;
+    }
+    async login(command, body, deadline, signal, lineage) {
+        this.ensureLineage(lineage, command);
+        signal.throwIfAborted();
+        if (this.isAuthenticated)
+            await this.drive(LOGOUT.code, LOGOUT.serialize(), {}, deadline, AbortSignal.any([signal, this.sessionLifetime.signal]), lineage);
+        this.ensureLineage(lineage, command);
+        this.resetSession();
+        const generation = this.routingGeneration;
+        const sessionSignal = AbortSignal.any([signal, this.sessionLifetime.signal]);
+        const prepared = prepareVsrCommand(command, body, this.vsrSession.bindSecret);
+        let frame;
+        let retryDelay = RETRY_INTERVAL_MS;
+        for (;;) {
+            const link = await this.connectBootstrap(deadline, sessionSignal);
+            this.ensureLineage(lineage, command);
+            const attempt = await this.exchange(link, prepared.command, () => frame ??= this.vsrSession.encode(prepared.command, prepared.payload), deadline, sessionSignal);
+            this.ensureLineage(lineage, command);
+            this.ensureGeneration(generation, command);
+            if (!attempt.error) {
+                this.vsrSession.bind(readRegisteredSession(attempt.response));
+                this.userId = attempt.response.data.readUInt32LE(0);
+                this.isAuthenticated = true;
+                this.heartbeat(this.options.heartbeatInterval);
+                await this.refreshRoster(deadline, sessionSignal);
+                this.ensureLineage(lineage, command);
+                this._rememberCredentials(command, body);
+                return attempt.response;
             }
-            catch (error) {
-                cleanup();
-                reject(error);
+            if (attempt.error instanceof ResponseError && !isTransient(attempt.error.errorCode)) {
+                throw attempt.error;
             }
-        });
-    }
-    // `GetClusterMetadata` is deliberately absent: the server auth-gates it,
-    // so the client authenticates before reading the topology. A login dialed
-    // at a backup still succeeds because the server forwards the register to
-    // the primary.
-    isUnloggedCommand(command) {
-        return UNLOGGED_COMMAND_CODE.includes(command);
-    }
-    /**
-     * Moves a freshly authenticated session to the cluster leader.
-     *
-     * Only the leader accepts replicated commands, and the roster read is
-     * auth-gated, so the topology cannot be inspected before a login binds a
-     * session. The redirect drops that session along with the socket, so the
-     * login is replayed on the leader and its answer supersedes the one from the
-     * node the client dialed. Leadership can move between the roster read and
-     * the replay, so each freshly bound hop rechecks the roster under a bounded
-     * redirect budget.
-     *
-     * @returns The leader's login response, or undefined when the client stays
-     */
-    async _settleOnLeader(loginCommand, loginPayload) {
-        let settledResponse;
-        for (let redirects = 0; redirects < MAX_LEADER_REDIRECTS; redirects += 1) {
-            const leader = await this._readLeaderEndpoint();
-            if (!leader || this.connection.isConnectedTo(leader.host, leader.port))
-                return settledResponse;
-            await this.connection.redirect(leader.host, leader.port);
-            settledResponse = await this.sendCommand(loginCommand, loginPayload, { last: false });
+            if (attempt.error instanceof VsrEvictionError || attempt.error instanceof TypeError)
+                throw attempt.error;
+            await waitWithin(pause(Math.floor(Math.random() * (retryDelay + 1)), sessionSignal), deadline, sessionSignal);
+            retryDelay = Math.min(retryDelay * 2, MAX_RETRY_INTERVAL_MS);
         }
-        debug(`leader settlement reached its ${MAX_LEADER_REDIRECTS}-hop budget, ` +
-            'staying on the current node');
-        return settledResponse;
+    }
+    recoverSession(generation) {
+        if (generation !== this.routingGeneration || this.recoveryPromise || this.lifetime.signal.aborted)
+            return;
+        this.resetSession();
+        this.authenticationPromise = undefined;
+        this.recoveryPromise = this.signIn().then(() => undefined)
+            .catch((error) => { debug('session recovery failed', error); })
+            .finally(() => { this.recoveryPromise = undefined; });
     }
     /**
-     * Reads the cluster roster and picks the endpoint to settle on.
-     *
-     * Best effort: an unreadable roster, `Unauthenticated` included (the session
-     * died between the login and this read), keeps the client on its current
-     * node instead of failing a login that already succeeded.
+     * Waits for the sign-in that runs or is queued now, and fails unless it binds
+     * a session of the call's lineage. Only the client's own sign-in continues a
+     * call: after a sign-in or sign-out of the caller, or a refused sign-in, the
+     * call ends with 40, and at its deadline with 58.
      */
-    async _readLeaderEndpoint() {
-        // A cluster can be transiently leaderless: a restarted node cedes the
-        // primaryship its stale view assigns it, and the roster reports no leader
-        // until the peers' election completes. That window is roughly one heartbeat
-        // timeout, so poll through it rather than settling on a replica that denies
-        // every replicated command for its whole retry budget.
-        const deadline = Date.now() + this.leaderlessWaitBudget;
-        while (true) {
-            // Reading without a session would re-enter authentication, which awaits
-            // the very login this settlement runs inside of. The session can also die
-            // between polls, so this holds for every pass, not just the first.
-            if (!this.isAuthenticated)
-                return undefined;
+    async nextSession(command, lineage, deadline, signal) {
+        let failure;
+        if (lineage === this.lineage) {
             try {
-                // Queue the metadata fetch instead of writing directly: a bare write
-                // would race an in-flight exchange and both would wake on the same
-                // response event.
-                const response = await this.sendCommand(GET_CLUSTER_METADATA.code, GET_CLUSTER_METADATA.serialize(), { last: false, followsLeaderMoves: false });
-                // The redial candidates are fed by `_processVsr` for every roster
-                // read, leaderless ones included: a roster with no leader still names
-                // where the nodes are.
-                const metadata = GET_CLUSTER_METADATA.deserialize(response);
-                if (metadata.nodes.length <= 1)
-                    return undefined;
-                const leader = metadata.nodes.find((node) => node.role === 'Leader' && node.status === 'Healthy');
-                if (leader)
-                    return { host: leader.ip, port: leader.endpoints.tcp };
+                await waitWithin(this.authenticationPromise ?? this.sessionAction, deadline, signal);
             }
             catch (error) {
-                debug('cluster metadata is unreadable, staying on this node', error);
-                return undefined;
-            }
-            if (Date.now() >= deadline) {
-                debug('cluster metadata named no healthy leader within ' +
-                    `${this.leaderlessWaitBudget} ms, staying on this node`);
-                return undefined;
+                signal.throwIfAborted();
+                failure = error;
             }
-            await delay(this.leaderlessPollInterval);
         }
+        if (lineage !== this.lineage)
+            throw unauthenticated(command, failure);
+        if (failure instanceof VsrResponseTimeoutError)
+            throw responseError(command, TRANSIENT_NOT_ACCEPTED);
+        if (!this.isAuthenticated && !this.signInCredentials)
+            throw unauthenticated(command, failure);
+        if (failure !== undefined)
+            throw failure;
+        if (!this.isAuthenticated)
+            throw responseError(command, TRANSIENT_NOT_ACCEPTED);
     }
     /**
-     * Fails all queued commands with the given error.
-     *
-     * @param err - Error to reject all queued commands with
+     * The `sessionReset` event says whether the reset ended a signed-in session.
+     * A reset after a refused sign-in ends none.
      */
-    _failQueue(err) {
-        this._execQueue.forEach(({ reject }) => reject(err));
-        this._execQueue = [];
-    }
-    _resetSession() {
-        this._clearPollRouting();
-        this.clustered = undefined;
-        if (!this.isAuthenticated &&
-            this.userId === undefined &&
-            !this.vsrSession.hasActivity)
-            return;
+    resetSession() {
+        const signedIn = this.isAuthenticated;
+        const hadActivity = signedIn || this.vsrSession.hasActivity;
+        this.routingGeneration += 1;
+        this.sessionLifetime.abort(responseError(0, TRANSIENT_NOT_ACCEPTED));
+        this.sessionLifetime = new AbortController();
+        this.lanes.reset();
+        for (const slot of this.replicas.values()) {
+            slot.lifetime.abort();
+            slot.connection?._destroy();
+        }
+        this.replicas.clear();
+        this.bootstrap?._destroy();
+        this.bootstrap = undefined;
+        this.bootstrapPromise = undefined;
+        this.rosterPromise = undefined;
+        this.partitionRoutes.clear();
+        this.metadataReplica = undefined;
         this.isAuthenticated = false;
         this.userId = undefined;
         this.vsrSession.reset();
-        this.emit('sessionReset');
+        clearInterval(this.heartbeatIntervalHandler);
+        this.heartbeatIntervalHandler = undefined;
+        this.changed.pulse();
+        if (hadActivity)
+            this.emit('sessionReset', signedIn);
+    }
+    ensureLineage(lineage, command) {
+        if (lineage !== this.lineage)
+            throw responseError(command, UNAUTHENTICATED);
+    }
+    ensureGeneration(generation, command) {
+        if (generation !== this.routingGeneration || this.lifetime.signal.aborted)
+            throw responseError(command, TRANSIENT_NOT_ACCEPTED);
+    }
+    observeMetadata(frame) {
+        const operation = readReplyOperation(frame);
+        if (!hasCommittedResult(frame) || !(isMetadata(operation) || operation === Operation.DeleteSegments || operation === Operation.Register))
+            return;
+        const commit = frame.readBigUInt64LE(REPLY_OFFSET.commit);
+        if (commit > this.metadataWatermark)
+            this.metadataWatermark = commit;
+    }
+    _rememberCredentials(command, payload) {
+        if (command === LOGIN.code) {
+            const username = readWireName(payload, 0);
+            this.signInCredentials = {
+                username: username.value, password: readWireName(payload, username.next).value
+            };
+        }
+        else if (command === LOGIN_WITH_TOKEN.code) {
+            this.signInCredentials = { token: readWireName(payload, 0).value };
+        }
+        else if ((command === COMMAND_CODE.ChangePassword ||
+            (command === COMMAND_CODE.UpdateResource && payload[0] === OptionsScope.User)) &&
+            this.userId !== undefined && this.signInCredentials &&
+            'username' in this.signInCredentials) {
+            const credentials = this.signInCredentials;
+            // An update leads with its scope byte, a password change with the user id.
+            const start = command === COMMAND_CODE.ChangePassword ? 0 : 1;
+            const identifier = [serializeIdentifier(this.userId), serializeIdentifier(credentials.username)]
+                .find((encoded) => payload.subarray(start, start + encoded.length).equals(encoded));
+            if (!identifier)
+                return;
+            if (command === COMMAND_CODE.ChangePassword) {
+                const currentPassword = readWireName(payload, identifier.length);
+                const password = readWireName(payload, currentPassword.next).value;
+                this.signInCredentials = { ...credentials, password };
+                return;
+            }
+            let position = start + identifier.length;
+            const resetCount = payload.readUInt8(position);
+            position += 1;
+            for (let index = 0; index < resetCount; index++)
+                position = readWireName(payload, position).next;
+            const username = deserializeOptions(payload, position).username;
+            if (typeof username !== 'string')
+                return;
+            this.signInCredentials = { ...credentials, username };
+        }
     }
     hold() {
         this.pendingSubmissions += 1;
@@ -999,146 +1144,225 @@ export class CommandResponseStream extends EventEmitter {
                 return;
             released = true;
             this.pendingSubmissions -= 1;
-            this._emitFinishQueue();
+            if (this.pendingSubmissions === 0)
+                this.emit('finishQueue');
         };
     }
-    /**
-     * Authenticates the client with the server.
-     *
-     * @param creds - Authentication credentials (token or password)
-     * @returns True if authentication succeeded
-     */
-    async authenticate(creds) {
-        if (this.isAuthenticated)
-            return true;
-        if (this.authenticationPromise)
-            return this.authenticationPromise;
-        this.authenticationPromise = this._authenticate(creds);
+    async authenticate(credentials) {
+        if (credentials && typeof credentials === 'object' && 'token' in credentials)
+            await this._authWithToken(credentials);
+        else
+            await this._authWithPassword(credentials);
+        return true;
+    }
+    async loginByCaller(command, payload, options = {}) {
+        const lineage = ++this.sessionLineage;
+        this.signInCredentials = undefined;
+        const release = this.hold();
+        const deadline = options.deadline ?? Date.now() + OPERATION_TIMEOUT_MS;
+        const signal = AbortSignal.any([this.lifetime.signal, ...(options.signal ? [options.signal] : [])]);
         try {
-            return await this.authenticationPromise;
+            const body = payload();
+            let admit;
+            const admitted = new Promise((resolve) => { admit = resolve; });
+            const pending = this.serializeSession(() => {
+                admit();
+                return this.login(command, body, deadline, signal, lineage);
+            });
+            const authentication = pending.then(() => true)
+                .finally(() => { if (this.authenticationPromise === authentication)
+                this.authenticationPromise = undefined; });
+            this.authenticationPromise = authentication;
+            void authentication.catch(() => undefined);
+            // Bound the queue wait separately so dial timeouts keep their last transport error.
+            await waitWithin(admitted, deadline, signal);
+            return await pending;
+        }
+        catch (error) {
+            if (lineage === this.lineage) {
+                this.sessionLineage += 1;
+                this.signInCredentials = undefined;
+                this.resetSession();
+            }
+            if (error instanceof VsrResponseTimeoutError)
+                throw responseError(command, TRANSIENT_NOT_ACCEPTED);
+            throw error;
         }
         finally {
-            this.authenticationPromise = undefined;
+            release();
         }
     }
-    async _authenticate(creds) {
-        const r = ('token' in creds) ?
-            await this._authWithToken(creds) :
-            await this._authWithPassword(creds);
-        this.isAuthenticated = true;
-        this.userId = r.userId;
-        return this.isAuthenticated;
+    /** Only SDK recovery shares a sign-in; callers always own a fresh attempt. */
+    signIn() {
+        if (this.isAuthenticated)
+            return Promise.resolve(true);
+        if (!this.authenticationPromise) {
+            const lineage = this.lineage;
+            const identity = this.signInCredentials;
+            const pending = this.serializeSession(async () => {
+                this.ensureLineage(lineage, LOGIN.code);
+                if (this.isAuthenticated)
+                    return true;
+                if (!identity)
+                    return false;
+                const command = 'token' in identity ? LOGIN_WITH_TOKEN : LOGIN;
+                try {
+                    const body = 'token' in identity ? LOGIN_WITH_TOKEN.serialize(identity) : LOGIN.serialize(identity);
+                    await this.login(command.code, body, Date.now() + OPERATION_TIMEOUT_MS, this.lifetime.signal, lineage);
+                    return this.isAuthenticated;
+                }
+                catch (error) {
+                    if (lineage === this.lineage && (error instanceof TypeError || error instanceof VsrEvictionError ||
+                        (error instanceof ResponseError && !isTransient(error.errorCode))))
+                        this.signInCredentials = undefined;
+                    throw error;
+                }
+            }).finally(() => { if (this.authenticationPromise === pending)
+                this.authenticationPromise = undefined; });
+            this.authenticationPromise = pending;
+        }
+        return this.authenticationPromise;
     }
-    /**
-     * Authenticates using username and password.
-     *
-     * @param creds - Password credentials
-     * @returns Login response with user ID
-     */
-    async _authWithPassword(creds) {
-        const pl = LOGIN.serialize(creds);
-        const logr = await this.sendCommand(LOGIN.code, pl, { last: false });
-        return LOGIN.deserialize(logr);
+    async _authWithPassword(credentials) {
+        return LOGIN.deserialize(await this.loginByCaller(LOGIN.code, () => LOGIN.serialize(credentials)));
     }
-    /**
-     * Authenticates using a token.
-     *
-     * @param creds - Token credentials
-     * @returns Login response with user ID
-     */
-    async _authWithToken(creds) {
-        const pl = LOGIN_WITH_TOKEN.serialize(creds);
-        const logr = await this.sendCommand(LOGIN_WITH_TOKEN.code, pl, { last: false });
-        return LOGIN_WITH_TOKEN.deserialize(logr);
+    async _authWithToken(credentials) {
+        return LOGIN_WITH_TOKEN.deserialize(await this.loginByCaller(LOGIN_WITH_TOKEN.code, () => LOGIN_WITH_TOKEN.serialize(credentials)));
     }
-    /**
-     * Sends a ping command to the server.
-     *
-     * @returns Ping response
-     */
     async ping() {
-        const pl = PING.serialize();
-        const pingR = await this.sendCommand(PING.code, pl);
-        return PING.deserialize(pingR);
+        return PING.deserialize(await this.sendCommand(PING.code, PING.serialize()));
     }
-    /**
-     * Starts sending periodic heartbeat pings to keep the connection alive.
-     *
-     * @param interval - Heartbeat interval in milliseconds
-     */
     heartbeat(interval) {
-        if (!interval)
-            return;
-        this.heartbeatIntervalHandler = setInterval(async () => {
-            if (this.connection.connected && !this.heartbeatInFlight) {
-                this.heartbeatInFlight = true;
-                debug(`sending heartbeat ping (interval: ${interval} ms)`);
-                try {
-                    await this.ping();
-                    this.emit('heartbeat');
-                }
-                catch (error) {
-                    debug('heartbeat ping failed', error);
-                }
-                finally {
-                    this.heartbeatInFlight = false;
+        clearInterval(this.heartbeatIntervalHandler);
+        this.heartbeatIntervalHandler = undefined;
+        if (interval && this.isAuthenticated) {
+            this.heartbeatIntervalHandler = setInterval(() => {
+                for (const slot of this.replicas.values()) {
+                    // A retry budget limits one reconnect burst, not the life of the
+                    // session, so a long outage cannot leave the client down for good.
+                    if (slot.restartable) {
+                        slot.restartable = false;
+                        slot.failure = undefined;
+                        void this.runReplica(slot);
+                    }
+                    if (!slot.attached || !slot.connection?.connected || slot.heartbeat)
+                        continue;
+                    slot.heartbeat = true;
+                    const signal = AbortSignal.any([this.lifetime.signal, this.sessionLifetime.signal, slot.lifetime.signal]);
+                    void this.control(slot.connection, PING.code, PING.serialize(), Date.now() + OPERATION_TIMEOUT_MS, signal)
+                        .then(() => { this.emit('heartbeat'); })
+                        .catch((error) => {
+                        if (isSessionFailure(error))
+                            this.recoverSession(slot.generation);
+                        debug('replica heartbeat failed', error);
+                    }).finally(() => { slot.heartbeat = false; });
                 }
-            }
-        }, interval);
-        // A pending heartbeat must not be the reason the process stays up: a script
-        // that never calls destroy() would otherwise hang on exit.
-        this.heartbeatIntervalHandler.unref();
+            }, interval);
+            this.heartbeatIntervalHandler.unref();
+        }
+        // A link that used its budget reports whether a heartbeat restarts it.
+        for (const slot of this.replicas.values())
+            if (slot.restartable)
+                slot.failure = this.budgetFailure(slot);
     }
-    /**
-     * Returns the underlying socket as a readable stream.
-     *
-     * @returns The connection socket
-     */
     getReadStream() {
-        return this.connection.socket;
+        const connection = this.bootstrap ?? [...this.replicas.values()].find((slot) => slot.attached)?.connection;
+        if (!connection?.socket)
+            throw new Error('client has no connected replica');
+        return connection.socket;
     }
-    /**
-     * Destroys the stream and cleans up resources.
-     * Stops heartbeat and destroys the connection.
-     */
     destroy() {
-        this.rememberedCredentials = undefined;
-        this._clearPollRouting();
-        if (this.heartbeatIntervalHandler)
-            clearInterval(this.heartbeatIntervalHandler);
-        return this.connection._destroy();
+        this.signInCredentials = undefined;
+        this.lifetime.abort(new Error('client destroyed'));
+        this.resetSession();
     }
 }
-;
-/**
- * Creates a new RawClient instance.
- *
- * @param options - Client configuration
- * @returns RawClient instance
- */
 export function getRawClient(options) {
     return new CommandResponseStream(options);
 }
-const isLoginCommand = (command) => command === COMMAND_CODE.LoginUser ||
-    command === COMMAND_CODE.LoginWithAccessToken;
-const delay = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
-const withinDeadline = async (pending, deadline, expired) => {
-    let timer;
-    try {
-        return await Promise.race([
-            pending,
-            new Promise((_resolve, reject) => {
-                timer = setTimeout(() => {
-                    expired?.();
-                    reject(new VsrResponseTimeoutError(VSR_RESPONSE_TIMEOUT_MS));
-                }, Math.max(0, deadline - Date.now()));
-            })
-        ]);
+const isLoginCommand = (command) => command === COMMAND_CODE.LoginUser || command === COMMAND_CODE.LoginWithAccessToken;
+const isTransient = (code) => code === TRANSIENT_NOT_COMMITTED || code === TRANSIENT_NOT_ACCEPTED || code === NOT_PRIMARY;
+/** A 40 that keeps why the call has no session, such as a refused sign-in. */
+const unauthenticated = (command, cause) => {
+    const error = responseError(command, UNAUTHENTICATED);
+    if (cause !== undefined)
+        error.cause = cause;
+    return error;
+};
+/** An unknown outcome. Only a retainable operation has an ID to resolve, any other call ends with 57. */
+const uncertainOutcome = (command, operation, cause) => {
+    if (operation?.retainable)
+        return new OperationUncertainError(operation.id, cause);
+    const error = responseError(command, TRANSIENT_NOT_COMMITTED);
+    error.cause = cause;
+    return error;
+};
+const isDetachedFailure = (error) => error instanceof VsrEvictionError
+    ? error.reason === EvictionReason.NoSession || error.reason === EvictionReason.StaleClient
+    : error instanceof ResponseError && error.fromServer && !error.committed &&
+        (error.errorCode === UNAUTHENTICATED || error.errorCode === STALE_CLIENT);
+const isSessionFailure = (error, binding = false) => (error instanceof VsrEvictionError && (binding || !isDetachedFailure(error))) ||
+    (error instanceof ResponseError && error.fromServer &&
+        ((error.errorCode === UNAUTHENTICATED && (binding || error.committed)) ||
+            (error.errorCode === STALE_CLIENT && error.committed)));
+const groupKey = (context, target) => `${context.incarnation}:${target.query.readUInt32LE(target.query.length - PARTITION_ID_SIZE)}`;
+const partitionRoute = (command, payload) => {
+    if (command === COMMAND_CODE.SendMessages) {
+        const { query } = sendTarget(payload);
+        return { query, key: query.toString('hex') };
     }
-    finally {
-        clearTimeout(timer);
+    if (command !== COMMAND_CODE.PollMessages && command !== COMMAND_CODE.GetOffset &&
+        command !== COMMAND_CODE.StoreOffset && command !== COMMAND_CODE.DeleteConsumerOffset)
+        return undefined;
+    let position = 1;
+    const consumerEnd = identifierEnd(payload, position, command);
+    const streamEnd = identifierEnd(payload, consumerEnd, command);
+    position = identifierEnd(payload, streamEnd, command);
+    const suffix = command === COMMAND_CODE.PollMessages ? POLL_OPTIONS_SIZE
+        : command === COMMAND_CODE.StoreOffset ? STORE_OFFSET_SUFFIX_SIZE
+            : command === COMMAND_CODE.DeleteConsumerOffset ? DELETE_OFFSET_SUFFIX_SIZE : 0;
+    if (payload.length !== position + 1 + PARTITION_ID_SIZE + suffix || payload[position] > 1)
+        throw responseError(command, INVALID_COMMAND);
+    if (payload[position] === 0) {
+        if (command === COMMAND_CODE.StoreOffset || command === COMMAND_CODE.DeleteConsumerOffset ||
+            (command === COMMAND_CODE.PollMessages && payload[0] === ConsumerKind.Group))
+            throw responseError(command, INVALID_COMMAND);
+    }
+    const query = Buffer.concat([payload.subarray(consumerEnd, position),
+        payload[position] === 0 ? Buffer.alloc(PARTITION_ID_SIZE)
+            : payload.subarray(position + 1, position + 1 + PARTITION_ID_SIZE)]);
+    return { query, key: query.toString('hex') };
+};
+const identifierEnd = (payload, position, command) => {
+    if (position + IDENTIFIER_PREFIX_SIZE > payload.length)
+        throw responseError(command, INVALID_COMMAND);
+    const end = position + IDENTIFIER_PREFIX_SIZE + payload[position + 1];
+    if (end > payload.length)
+        throw responseError(command, INVALID_COMMAND);
+    return end;
+};
+/**
+ * Reads the explicit partition a raw send writes to. A Balanced or MessageKey
+ * send names no partition, so there is no context to capture for it, and the
+ * server refuses a send without one.
+ */
+const sendTarget = (payload) => {
+    let position = SEND_METADATA_LENGTH_SIZE;
+    for (let identifier = 0; identifier < 2; identifier++) {
+        if (position + IDENTIFIER_PREFIX_SIZE > payload.length)
+            throw responseError(COMMAND_CODE.SendMessages, INVALID_COMMAND);
+        position += IDENTIFIER_PREFIX_SIZE + payload[position + 1];
     }
+    if (position + IDENTIFIER_PREFIX_SIZE > payload.length)
+        throw responseError(COMMAND_CODE.SendMessages, INVALID_COMMAND);
+    if (payload[position] !== PartitionKind.PartitionId)
+        throw responseError(COMMAND_CODE.SendMessages, FEATURE_UNAVAILABLE, RAW_SEND_NEEDS_PARTITION);
+    const partition = position + IDENTIFIER_PREFIX_SIZE;
+    if (payload[position + 1] !== PARTITION_ID_SIZE || partition + PARTITION_ID_SIZE > payload.length)
+        throw responseError(COMMAND_CODE.SendMessages, INVALID_COMMAND);
+    const identifiers = payload.subarray(SEND_METADATA_LENGTH_SIZE, position);
+    return {
+        query: Buffer.concat([identifiers, payload.subarray(partition, partition + PARTITION_ID_SIZE)])
+    };
 };
-const isTransientVsrError = (errorCode) => errorCode === TRANSIENT_NOT_COMMITTED ||
-    errorCode === TRANSIENT_NOT_ACCEPTED;
 //# sourceMappingURL=client.socket.js.map