@effect-agent/platform-cloudflare 0.0.1-beta.0

package/dist/index.mjs

@@ -0,0 +1,1073 @@
+import { Clock, Context, Duration, Effect, Layer, ManagedRuntime, Option, PubSub, Random, Ref, Schema, Stream } from "effect";
+import { AbortCommand, AbortIntent, AdmissionConflict, AgentBindingResolver, AppendConflict, ApprovalConflict, ApprovalDecisionCommand, ApprovalDecisionIntent, CanonicalRecordEnvelope, CanonicalSequence, ConversationNotMaterialized, ConversationRead, ConversationStore, ConversationStoreError, DEFAULT_OWNERSHIP_LEASE_DURATION, DefinitionDigests, DeploymentId, DigestError, DurableAgentRuntime, DurableRuntimeConfig, DurableRuntimeFailpoint, DurableRuntimeFailpointError, FenceRejected, IdempotencyKey, IntegrityReport, JoinedToHost, LedgerError, ObligationReport, ObligationThresholds, OperationAuthorizationRequest, OperationAuthorizer, OperationDenied, OwnershipLost, PersistedJson, Principal, ProducerId, Receipt, RecoveryExplanation, RecoveryReport, RetryCommand, RetryRefused, RunJournalError, Settlement, SettlementConflict, SubmissionLedger, SubmissionLookupByKey, ToolReconciler, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, WakeScheduler } from "@effect-agent/session";
+import { ConversationPortTransport, DEFAULT_MAX_STORED_VALUE_BYTES, conversationStoreLayer, handleEncodedPortRequest, portTransportFailure, routedConversationStoreLayer, routedSubmissionLedgerLayer, storageConfigLayer, storageFailpointLayer, submissionLedgerLayer } from "@effect-agent/storage-cloudflare";
+import { AgentId, AgentInputError, ConversationId, SubmissionId } from "@effect-agent/core";
+import { BrowserCrypto } from "@effect/platform-browser";
+import { SqliteClient } from "@effect/sql-sqlite-do";
+import { DurableObject } from "cloudflare:workers";
+//#region src/bindings.ts
+/**
+* Cloudflare platform bindings as Effect services (DEPLOY-010: "Cloudflare platform bindings
+* are supplied as Effect services/Layers"). Application code never reads `env` or touches a
+* `DurableObjectState` directly — the Conversation Object class constructs these Layers once
+* per incarnation and everything downstream consumes the services.
+*/
+/** A Cloudflare platform binding was missing or carried the wrong shape (DEPLOY-003/010). */
+var CloudflareBindingError = class extends Schema.TaggedError()("CloudflareBindingError", {
+	binding: Schema.String,
+	message: Schema.String
+}) {};
+/**
+* The `DurableObjectNamespace` binding that addresses Conversation Objects. The Object
+* identity rule is `namespace.idFromName(conversationId)` (plan §1.2): Conversation IDs are
+* globally unique, so the mapping is total and deterministic and no directory service exists.
+*/
+var ConversationObjectNamespace = class ConversationObjectNamespace extends Context.Service()("@effect-agent/platform-cloudflare/ConversationObjectNamespace") {
+	static layer(namespace) {
+		return Layer.succeed(ConversationObjectNamespace)({ namespace });
+	}
+};
+/**
+* Narrow one `env` member to a `DurableObjectNamespace`. `env` is an untyped platform value,
+* and a namespace binding is a host object no Schema can decode, so this is the documented
+* narrowest-boundary check (structural probe for the namespace surface the transport uses);
+* a missing or misshaped binding fails typed before any Layer is built.
+*/
+const conversationNamespaceFromEnv = (env, binding) => Effect.suspend(() => {
+	if (typeof env !== "object" || env === null) return Effect.fail(CloudflareBindingError.make({
+		binding,
+		message: "The Worker environment is not an object; no bindings are available."
+	}));
+	const candidate = env[binding];
+	if (typeof candidate === "object" && candidate !== null && "idFromName" in candidate && typeof candidate.idFromName === "function" && "get" in candidate && typeof candidate.get === "function") return Effect.succeed(candidate);
+	return Effect.fail(CloudflareBindingError.make({
+		binding,
+		message: `env.${binding} is not a DurableObjectNamespace binding; declare the Conversation Object class under this binding in the Worker configuration.`
+	}));
+});
+/** `ConversationObjectNamespace` built from the untyped Worker `env` (fails typed). */
+const conversationNamespaceLayer = (env, binding) => Layer.effect(ConversationObjectNamespace)(Effect.map(conversationNamespaceFromEnv(env, binding), (namespace) => ({ namespace })));
+/**
+* The live Durable Object execution context of THIS incarnation. Only Layer construction and
+* the alarm service consume it; important state never lives on it (`ctx.storage` is truth,
+* everything in memory is a cache — deployment spec §11).
+*/
+var DurableObjectContext = class DurableObjectContext extends Context.Service()("@effect-agent/platform-cloudflare/DurableObjectContext") {
+	static layer(ctx, env) {
+		return Layer.succeed(DurableObjectContext)({
+			ctx,
+			env
+		});
+	}
+};
+/**
+* The Conversation identity this Object serializes and the producer identity its Attempts
+* write with (`{producerPrefix}:{conversationId}`, plan §1.4). Derived once per incarnation
+* from `ctx.id.name` — the Object identity rule guarantees the name IS the Conversation ID.
+*/
+var ConversationObjectIdentity = class extends Context.Service()("@effect-agent/platform-cloudflare/ConversationObjectIdentity") {};
+//#endregion
+//#region src/config.ts
+/**
+* Schema-validated configuration for the Cloudflare durable runtime (deployment spec §4:
+* decoded once during Layer construction, exposed as a typed service; DEPLOY-003). Every
+* cadence is in milliseconds; every bound is finite and checked before any resource opens.
+*/
+const PositiveMillis = Schema.Int.check(Schema.isGreaterThan(0));
+const NonNegativeMillis = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+/** The supplied Cloudflare durable runtime configuration failed validation (DEPLOY-003). */
+var CloudflarePlatformConfigError = class extends Schema.TaggedError()("CloudflarePlatformConfigError", {
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+/**
+* An admission was refused by a host resource limit BEFORE any ledger row existed
+* (deployment spec §8, DEPLOY-007: "Admission has explicit bounded quota and overload
+* behavior... a typed rejection"). This is the DC analogue of `NodeDurableHost`'s
+* `AdmissionClosed` host gate: the port surface stays untouched, the refusal happens in the
+* Conversation Object's submit entry point before `DurableAgentRuntime.submit` runs, and
+* nothing was admitted or written.
+*/
+var AdmissionLimitExceeded = class extends Schema.TaggedError()("AdmissionLimitExceeded", {
+	limit: Schema.Literals([
+		"queue-depth",
+		"input-bytes",
+		"database-bytes"
+	]),
+	actual: Schema.Int,
+	maximum: Schema.Int
+}) {
+	get message() {
+		return `Admission refused before any ledger row existed: ${this.limit} ${this.actual} exceeds the configured maximum ${this.maximum}. Accepted work is unaffected; retry after the lane drains or raise the limit (DEPLOY-007).`;
+	}
+};
+/** The platform's hard per-Object database cap (10 GB, developers.cloudflare.com limits). */
+const CLOUDFLARE_DATABASE_CAP_BYTES = 1e10;
+/** Default database-size admission ceiling: a 1 GB safety margin under the platform cap. */
+const DEFAULT_MAX_DATABASE_BYTES = 9e9;
+/**
+* Explicit bounded admission quotas checked by the Conversation Object BEFORE admission
+* (exit gate "resource limits are checked before admission").
+*/
+var CloudflareAdmissionLimitsValue = class extends Schema.Class("@effect-agent/platform-cloudflare/CloudflareAdmissionLimitsValue")({
+	/** Maximum nonterminal Submissions per Conversation lane before new admissions refuse. */
+	maxQueueDepthPerLane: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(1e5)),
+	/** Maximum encoded input bytes; never above the storage per-value bound. */
+	maxInputBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2e6)),
+	/** Maximum `ctx.storage.sql.databaseSize` at admission; stays under the 10 GB platform cap. */
+	maxDatabaseBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(CLOUDFLARE_DATABASE_CAP_BYTES))
+}) {};
+/**
+* Validated Cloudflare durable runtime configuration. The producer identity of one
+* Conversation Object is `{producerPrefix}:{conversationId}` — stable across incarnations of
+* the same deployment, distinct across deployments — and producer-epoch fencing (not the
+* producer name) remains the correctness authority (DUR-006).
+*/
+var CloudflareDurableRuntimeConfigValue = class extends Schema.Class("@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfigValue")({
+	deploymentId: DeploymentId,
+	/** Head of the minted producer identity `{producerPrefix}:{conversationId}`. */
+	producerPrefix: Schema.NonEmptyString.check(Schema.isMaxLength(256)),
+	/** Submission ownership lease duration (D5); fences work across Object incarnations. */
+	ownershipLeaseDuration: PositiveMillis,
+	/** Base delay of the alarm re-arm backoff when a pass makes no progress. */
+	alarmBackoffBase: PositiveMillis,
+	/** Ceiling of the alarm re-arm backoff. */
+	alarmBackoffCap: PositiveMillis,
+	/**
+	* The maintenance-pass scan cadence and the ceiling of every re-arm delay: nonterminal
+	* work is revisited at least this often (wake/scan pairing, persistence §14).
+	*/
+	wakeScanInterval: PositiveMillis,
+	/** `awaitSettlement` ledger re-check cadence when no wake arrives. */
+	settlementPollInterval: PositiveMillis,
+	/** Worker ownership-lease renewal cadence during an active Attempt. */
+	leaseRenewalInterval: PositiveMillis,
+	/** Active-Run abort-intent poll cadence. */
+	abortPollInterval: PositiveMillis,
+	/** Canonical observation poll cadence of the Durable Object store. */
+	observationPollInterval: NonNegativeMillis,
+	/** Per-value byte bound; must stay under the platform's 2 MB SQLite value limit. */
+	maxStoredValueBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2e6)),
+	/** Opt-in full payload/digest-chain audit while opening the store. */
+	verifyOnOpen: Schema.Boolean,
+	limits: CloudflareAdmissionLimitsValue
+}) {};
+/** Explicit configuration authority for the assembled Cloudflare durable runtime. */
+var CloudflareDurableRuntimeConfig = class extends Context.Service()("@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfig") {};
+/** Documented production defaults applied by `CloudflareDurableRuntime.layer`. */
+const CLOUDFLARE_RUNTIME_DEFAULTS = {
+	ownershipLeaseDuration: Duration.toMillis(DEFAULT_OWNERSHIP_LEASE_DURATION),
+	alarmBackoffBase: 100,
+	alarmBackoffCap: 5e3,
+	wakeScanInterval: 1e3,
+	settlementPollInterval: 500,
+	leaseRenewalInterval: 1e4,
+	abortPollInterval: 500,
+	observationPollInterval: 25,
+	maxStoredValueBytes: DEFAULT_MAX_STORED_VALUE_BYTES,
+	verifyOnOpen: false,
+	maxQueueDepthPerLane: 256,
+	maxInputBytes: DEFAULT_MAX_STORED_VALUE_BYTES,
+	maxDatabaseBytes: DEFAULT_MAX_DATABASE_BYTES
+};
+//#endregion
+//#region src/alarm.ts
+/**
+* The single multiplexed Durable Object alarm (decision D-P6-2). A Durable Object has ONE
+* alarm slot; every cadence the Node host ran on fibers (wake scan, lease expiry, settlement
+* and abort re-checks, retry backoff) multiplexes into one idempotent maintenance pass, and
+* the slot always holds the EARLIEST deadline any caller asked for.
+*
+* The alarm invariant (plan §1.4): committed nonterminal work implies a committed alarm.
+* It is established by pre-arming — every mutating entry point and every pass arms the alarm
+* BEFORE its durable mutations — so an eviction at any failpoint leaves a persisted alarm
+* that workerd re-delivers to a fresh incarnation WITHOUT any incoming request. Spurious
+* alarms are harmless by design: a pass over an all-settled lane simply deletes the slot.
+*/
+/** The Durable Object alarm API failed; surfaces on host entry points as a typed refusal. */
+var DurableAlarmError = class extends Schema.TaggedError()("DurableAlarmError", {
+	operation: Schema.String,
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+const alarmFailure = (operation) => (cause) => DurableAlarmError.make({
+	operation,
+	message: cause instanceof Error ? cause.message : String(cause),
+	cause
+});
+/** `ctx.storage` alarm slot as an Effect service; storage is truth, never a memory field. */
+var DurableAlarmService = class DurableAlarmService extends Context.Service()("@effect-agent/platform-cloudflare/DurableAlarmService") {
+	static layer = Layer.effect(DurableAlarmService)(Effect.gen(function* () {
+		const { ctx } = yield* DurableObjectContext;
+		/**
+		* In-memory pass bookkeeping — a pure CACHE, never state: a fresh incarnation has no
+		* running pass, and a deferred wake lost to eviction was only ever a promptness hint
+		* on top of the already-committed pre-armed alarm.
+		*/
+		const runningPasses = yield* Ref.make(0);
+		const wakeDeferred = yield* Ref.make(false);
+		const scheduled = Effect.tryPromise({
+			try: () => ctx.storage.getAlarm(),
+			catch: alarmFailure("get alarm")
+		}).pipe(Effect.map((deadline) => deadline === null ? Option.none() : Option.some(deadline)));
+		const scheduleAt = (epochMillis) => Effect.tryPromise({
+			try: () => ctx.storage.setAlarm(epochMillis),
+			catch: alarmFailure("set alarm")
+		});
+		const ensureScheduledBy = (epochMillis) => scheduled.pipe(Effect.flatMap((existing) => Option.isSome(existing) && existing.value <= epochMillis ? Effect.void : scheduleAt(epochMillis)));
+		const armNow = Clock.currentTimeMillis.pipe(Effect.flatMap((now) => ensureScheduledBy(now)));
+		const scheduleNow = Ref.get(runningPasses).pipe(Effect.flatMap((passes) => passes > 0 ? Ref.set(wakeDeferred, true) : armNow));
+		/**
+		* Flush after the LAST concurrent pass: the re-arm lands at the very end of the alarm
+		* handler, where a superseding cancellation only re-delivers to the already-idempotent
+		* pass. Runs inside `Effect.ensuring`, so flush failures are logged, never raised.
+		*/
+		const flushDeferredWake = Ref.get(runningPasses).pipe(Effect.flatMap((passes) => passes > 0 ? Effect.void : Ref.getAndSet(wakeDeferred, false).pipe(Effect.flatMap((wanted) => wanted ? armNow : Effect.void))), Effect.catch((error) => Effect.logWarning("DurableAlarmService: deferred wake flush failed", error)));
+		const withWakesDeferred = (body) => Ref.update(runningPasses, (passes) => passes + 1).pipe(Effect.andThen(body), Effect.ensuring(Ref.update(runningPasses, (passes) => passes - 1).pipe(Effect.andThen(flushDeferredWake))));
+		const cancel = Effect.tryPromise({
+			try: () => ctx.storage.deleteAlarm(),
+			catch: alarmFailure("delete alarm")
+		});
+		return DurableAlarmService.of({
+			scheduled,
+			scheduleAt,
+			ensureScheduledBy,
+			scheduleNow,
+			withWakesDeferred,
+			cancel
+		});
+	}));
+};
+/** What one maintenance pass did — auditable evidence mirroring `NodeDurableHost`'s report. */
+var MaintenancePassReport = class extends Schema.Class("@effect-agent/platform-cloudflare/MaintenancePassReport")({
+	/** Recovery decisions executed (or deferred) BEFORE any new claim in this pass. */
+	recovered: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Settlements the drain pass finalized. */
+	settled: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Submissions still nonterminal after the pass (suspended/unknown lanes stay honest). */
+	nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** `rearmed` while nonterminal work remains, `cleared` once everything settled. */
+	alarm: Schema.Literals(["rearmed", "cleared"])
+}) {};
+/**
+* The idempotent maintenance pass and the alarm-invariant helpers (plan §1.4, D-P6-1/2).
+*
+* `pass` = pre-arm → `runRecovery` → `processConversationResolved` → re-arm-or-clear:
+*
+* 1. **Pre-arm**: the alarm is re-armed at `now + wakeScanInterval` BEFORE any work, so an
+*    eviction (or thrown failure → workerd alarm retry) at any point of the pass leaves a
+*    committed alarm and the fresh incarnation converges without an incoming request.
+* 2. **Reconcile before new work** (exit gate): every pass classifies and repairs every
+*    nonterminal Submission before the drain claims anything; the pure classifier and the
+*    repair executors are idempotent, so at-least-once alarm delivery re-runs them safely.
+* 3. **Drain**: one bounded `processConversationResolved` pass over this Object's lane — the
+*    D-P6-1 shape; no infinite `runResolvedWorker` loop ever pins the Object.
+* 4. **Re-arm policy**: nonterminal work re-arms at `now + min(backoff-with-jitter,
+*    wakeScanInterval)` — the scan interval bounds every wait (lease expiry of a dead
+*    incarnation included, since claims retry each pass) and the backoff (reset on progress,
+*    grown otherwise) keeps stuck lanes from busy-spinning; all settled clears the slot.
+*
+* Every step is a durability-protocol step that already tolerates re-execution, which is
+* what makes double-fired alarms harmless (the alarm.test.ts gate).
+*/
+var ConversationMaintenance = class ConversationMaintenance extends Context.Service()("@effect-agent/platform-cloudflare/ConversationMaintenance") {
+	static layer = Layer.effect(ConversationMaintenance)(Effect.gen(function* () {
+		const runtime = yield* DurableAgentRuntime;
+		const resolver = yield* AgentBindingResolver;
+		const ledger = yield* SubmissionLedger;
+		const alarm = yield* DurableAlarmService;
+		const config = yield* CloudflareDurableRuntimeConfig;
+		const identity = yield* ConversationObjectIdentity;
+		/**
+		* Consecutive no-progress passes — an in-memory CACHE, not state: a fresh incarnation
+		* restarts at zero and merely re-arms sooner than a long-lived one would have.
+		*/
+		const stalls = yield* Ref.make(0);
+		const preArm = Clock.currentTimeMillis.pipe(Effect.flatMap((now) => alarm.ensureScheduledBy(now + config.wakeScanInterval)));
+		const countNonterminal = Stream.runCollect(ledger.scanNonterminal).pipe(Effect.map((snapshots) => snapshots.length));
+		const rearmDelay = Effect.fn("ConversationMaintenance.rearmDelay")(function* (progressed) {
+			const priorStalls = yield* Ref.getAndUpdate(stalls, (count) => progressed ? 0 : count + 1);
+			if (progressed) return config.alarmBackoffBase;
+			const exponent = Math.min(priorStalls, 30);
+			const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** exponent);
+			const jitter = yield* Random.next;
+			const jittered = Math.ceil(backoff / 2 + backoff / 2 * jitter);
+			return Math.min(jittered, config.wakeScanInterval);
+		});
+		const pass = Effect.fn("ConversationMaintenance.pass")(function* () {
+			yield* preArm;
+			const recovered = yield* runtime.runRecovery;
+			const settlements = yield* runtime.processConversationResolved(identity.conversationId).pipe(Effect.provideService(AgentBindingResolver, resolver));
+			const nonterminal = yield* countNonterminal;
+			if (nonterminal === 0) {
+				yield* alarm.cancel;
+				yield* Ref.set(stalls, 0);
+				const appeared = yield* countNonterminal;
+				if (appeared > 0) {
+					yield* preArm;
+					return MaintenancePassReport.make({
+						recovered: recovered.length,
+						settled: settlements.length,
+						nonterminal: appeared,
+						alarm: "rearmed"
+					});
+				}
+				return MaintenancePassReport.make({
+					recovered: recovered.length,
+					settled: settlements.length,
+					nonterminal,
+					alarm: "cleared"
+				});
+			}
+			const progressed = settlements.length > 0 || recovered.some((report) => report.disposition === "repaired");
+			const delay = yield* rearmDelay(progressed);
+			const now = yield* Clock.currentTimeMillis;
+			yield* alarm.ensureScheduledBy(now + delay);
+			return MaintenancePassReport.make({
+				recovered: recovered.length,
+				settled: settlements.length,
+				nonterminal,
+				alarm: "rearmed"
+			});
+		});
+		const ensureAlarm = Effect.fn("ConversationMaintenance.ensureAlarm")(function* () {
+			if ((yield* countNonterminal) === 0) return;
+			yield* preArm;
+		});
+		return ConversationMaintenance.of({
+			pass: alarm.withWakesDeferred(pass()),
+			ensureAlarm: ensureAlarm(),
+			preArm
+		});
+	}));
+};
+//#endregion
+//#region src/wake-scheduler.ts
+/**
+* Bounded in-memory wake buffer for same-incarnation `awaitSettlement` subscribers. Wake
+* hints are droppable by contract (consumers pair every subscription with ledger polls), so
+* a full buffer slides out the oldest hint and an eviction simply loses the buffer — the
+* poll interval and the persisted alarm keep liveness (persistence §14).
+*/
+const WAKE_BUFFER_CAPACITY = 1024;
+/** A remote wake stub call failed; always swallowed and logged (hints are droppable). */
+var RemoteWakeDropped = class extends Schema.TaggedError()("RemoteWakeDropped", {
+	conversationId: Schema.String,
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+/**
+* The DC `WakeScheduler` (plan §1.4):
+*
+* - `notify(local)` → `setAlarm(now)` — durable, cheap, coalescing (the alarm slot keeps the
+*   earliest deadline) — plus a same-incarnation PubSub hint for `awaitSettlement` waiters.
+* - `notify(remote)` → fire-and-forget `wake()` on the owning Object's stub with every error
+*   swallowed and logged: hints are droppable, and the target's own alarm/scan pairing (the
+*   maintenance pass re-polls unsettled children) guarantees liveness without this call.
+* - `wakes` → the bounded sliding PubSub only. No important state lives in memory: the
+*   subscription accelerates waiters within one incarnation and the settlement poll interval
+*   is the correctness path.
+*/
+const cloudflareWakeSchedulerLayer = Layer.effect(WakeScheduler)(Effect.gen(function* () {
+	const alarm = yield* DurableAlarmService;
+	const identity = yield* ConversationObjectIdentity;
+	const { namespace } = yield* ConversationObjectNamespace;
+	const hints = yield* PubSub.sliding(WAKE_BUFFER_CAPACITY);
+	yield* Effect.addFinalizer(() => PubSub.shutdown(hints));
+	const notifyLocal = (conversationId) => PubSub.publish(hints, conversationId).pipe(Effect.andThen(alarm.scheduleNow), Effect.catch((error) => Effect.logWarning("CloudflareWakeScheduler: local alarm wake failed", error)), Effect.asVoid);
+	const notifyRemote = (conversationId) => Effect.tryPromise({
+		try: () => namespace.get(namespace.idFromName(conversationId)).wake(),
+		catch: (cause) => RemoteWakeDropped.make({
+			conversationId,
+			message: cause instanceof Error ? cause.message : String(cause),
+			cause
+		})
+	}).pipe(Effect.catch((error) => Effect.logWarning(`CloudflareWakeScheduler: remote wake of ${conversationId} dropped`, error)), Effect.asVoid);
+	return WakeScheduler.of({
+		notify: (conversationId) => conversationId === identity.conversationId ? notifyLocal(conversationId) : notifyRemote(conversationId),
+		wakes: Stream.fromPubSub(hints)
+	});
+}));
+//#endregion
+//#region src/transport.ts
+/**
+* `ConversationPortTransport` over native Durable Object JS RPC (decision D-P6-3): one
+* `portCall(envelope)` on the stub of the Object that owns the addressed Conversation
+* (`namespace.idFromName(conversationId)` — the identity rule, plan §1.2). The envelopes are
+* already Schema-encoded JSON, so the RPC boundary carries only structured-cloneable values;
+* the protocol module stays transport-agnostic and fetch-with-JSON remains the documented
+* fallback carrier.
+*
+* Every delivery problem — stub construction, RPC rejection, overload, deploy-in-progress —
+* surfaces as `PortTransportError` (preserving the platform stub's own `retryable` signal
+* when present) and NEVER as a fabricated answer: on `resolveAdmission` the routing layer
+* turns exactly this error into `AdmissionIndeterminate` (SUB-031).
+*/
+const conversationPortTransportLayer = Layer.effect(ConversationPortTransport)(Effect.gen(function* () {
+	const { namespace } = yield* ConversationObjectNamespace;
+	return ConversationPortTransport.of({ call: (conversationId, request) => Effect.tryPromise({
+		try: () => namespace.get(namespace.idFromName(conversationId)).portCall(request),
+		catch: (cause) => portTransportFailure(conversationId, cause)
+	}).pipe(Effect.withSpan("CloudflarePortTransport.call", { attributes: { conversationId } })) });
+}));
+//#endregion
+//#region src/layers.ts
+/**
+* Owner-side endpoint body for the Conversation Object's `portCall` (plan §1.3): decode,
+* execute against THIS Object's LOCAL port facets — never the routed decorators, so a
+* request cannot bounce between Objects — and answer the encoded response envelope. Total by
+* construction (protocol anomalies answer `PortFailed(PortProtocolError)`).
+*/
+var ConversationObjectPorts = class extends Context.Service()("@effect-agent/platform-cloudflare/ConversationObjectPorts") {};
+const decodeConfigValue = Schema.decodeUnknownEffect(CloudflareDurableRuntimeConfigValue);
+const decodeConversationId = Schema.decodeUnknownEffect(ConversationId);
+const decodeProducerId = Schema.decodeUnknownEffect(ProducerId);
+const configFromOptions = (options) => decodeConfigValue({
+	deploymentId: options.deploymentId,
+	producerPrefix: options.producerPrefix,
+	ownershipLeaseDuration: options.ownershipLeaseDuration ?? CLOUDFLARE_RUNTIME_DEFAULTS.ownershipLeaseDuration,
+	alarmBackoffBase: options.alarmBackoffBase ?? CLOUDFLARE_RUNTIME_DEFAULTS.alarmBackoffBase,
+	alarmBackoffCap: options.alarmBackoffCap ?? CLOUDFLARE_RUNTIME_DEFAULTS.alarmBackoffCap,
+	wakeScanInterval: options.wakeScanInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.wakeScanInterval,
+	settlementPollInterval: options.settlementPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.settlementPollInterval,
+	leaseRenewalInterval: options.leaseRenewalInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.leaseRenewalInterval,
+	abortPollInterval: options.abortPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.abortPollInterval,
+	observationPollInterval: options.observationPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.observationPollInterval,
+	maxStoredValueBytes: options.maxStoredValueBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxStoredValueBytes,
+	verifyOnOpen: options.verifyOnOpen ?? CLOUDFLARE_RUNTIME_DEFAULTS.verifyOnOpen,
+	limits: {
+		maxQueueDepthPerLane: options.maxQueueDepthPerLane ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxQueueDepthPerLane,
+		maxInputBytes: Math.min(options.maxInputBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxInputBytes, options.maxStoredValueBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxStoredValueBytes),
+		maxDatabaseBytes: options.maxDatabaseBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxDatabaseBytes
+	}
+}).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
+	message: `Invalid Cloudflare durable runtime configuration: ${error.message}`,
+	cause: error
+})));
+/**
+* The Conversation this Object owns, from the Object identity rule (plan §1.2): Conversation
+* Objects are addressed exclusively by `idFromName(conversationId)`, so `ctx.id.name` IS the
+* Conversation ID. An unnamed Object (from `newUniqueId`) is a deployment error, not a lane.
+*/
+const conversationIdFromState = (ctx) => ctx.id.name === void 0 ? Effect.fail(CloudflarePlatformConfigError.make({ message: "This Durable Object was not created via idFromName(conversationId); Conversation Objects must be addressed by their Conversation identity (plan §1.2)." })) : decodeConversationId(ctx.id.name).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
+	message: `The Durable Object name is not a valid ConversationId: ${error.message}`,
+	cause: error
+})));
+const resolveBindings = (source, context) => source === void 0 ? Effect.succeed([]) : Effect.isEffect(source) ? source : typeof source === "function" ? Effect.suspend(() => {
+	const bindings = source(context);
+	return Effect.isEffect(bindings) ? bindings : Effect.succeed(bindings);
+}) : Effect.succeed(source);
+/**
+* The DC Layer assembly (deployment §12: a Layer-assembly library, not an app entrypoint;
+* plan §1.4). `layer(options)` decodes the configuration, derives this Object's Conversation
+* and producer identities, opens the Object's private SQLite database through
+* `@effect/sql-sqlite-do` for BOTH the Conversation Log and the Submission Ledger (so claims
+* fence the same producer epochs — ADR-0011 D7 transposed), wraps the local port facets with
+* the WP2 cross-Object routing decorators over the Durable Object RPC transport, wires the
+* alarm-backed wake scheduler and the maintenance pass, defaults reconciliation to the
+* fail-closed `ToolReconciler.uncertain`, and provides a ready `DurableAgentRuntime` on top.
+*
+* Storage compatibility is verified during construction: an incompatible database fails the
+* Layer typed (`DoStorageCompatibilityError`) before anything is mutated (DEPLOY-008).
+*
+* Requires only the two binding services (`DurableObjectContext`,
+* `ConversationObjectNamespace`) — platform values enter exclusively through Layers
+* (DEPLOY-010).
+*/
+var CloudflareDurableRuntime = class {
+	static layer(options) {
+		return Layer.unwrap(Effect.gen(function* () {
+			const { ctx, env } = yield* DurableObjectContext;
+			const config = yield* configFromOptions(options);
+			const conversationId = yield* conversationIdFromState(ctx);
+			const producerId = yield* decodeProducerId(`${config.producerPrefix}:${conversationId}`).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
+				message: `The minted producer identity is invalid: ${error.message}`,
+				cause: error
+			})));
+			const identityLayer = Layer.succeed(ConversationObjectIdentity)({
+				conversationId,
+				producerId
+			});
+			const cloudflareConfigLayer = Layer.succeed(CloudflareDurableRuntimeConfig)(config);
+			const storageOptions = {
+				storage: ctx.storage,
+				observationPollInterval: config.observationPollInterval,
+				ownershipLeaseDuration: config.ownershipLeaseDuration,
+				maxStoredValueBytes: config.maxStoredValueBytes,
+				verifyOnOpen: config.verifyOnOpen,
+				failpoint: options.storageFailpoint?.(ctx)
+			};
+			const infrastructure = Layer.mergeAll(storageConfigLayer(storageOptions), storageFailpointLayer(storageOptions), SqliteClient.layer({ storage: ctx.storage }), BrowserCrypto.layer);
+			/**
+			* ONE local-facet instance (a shared Layer value) serves both the routed decorators
+			* and the owner-side `portCall` executor — the executor must never see the routed
+			* ports (plan §1.3: re-routing could bounce a request between Objects).
+			*/
+			const localPorts = Layer.mergeAll(conversationStoreLayer, submissionLedgerLayer).pipe(Layer.provide(infrastructure));
+			const portsEndpointLayer = Layer.effect(ConversationObjectPorts)(Effect.gen(function* () {
+				const local = yield* Effect.context();
+				return ConversationObjectPorts.of({ handle: (encoded) => handleEncodedPortRequest(encoded).pipe(Effect.provide(local)) });
+			})).pipe(Layer.provide(localPorts));
+			const routedPorts = Layer.mergeAll(routedSubmissionLedgerLayer({ localConversationId: conversationId }), routedConversationStoreLayer({ localConversationId: conversationId })).pipe(Layer.provide(localPorts), Layer.provide(conversationPortTransportLayer));
+			const runtimeConfigLayer = Layer.succeed(DurableRuntimeConfig)(DurableRuntimeConfig.make({
+				deploymentId: config.deploymentId,
+				producerId,
+				settlementPollInterval: Duration.millis(config.settlementPollInterval),
+				leaseRenewalInterval: Duration.millis(config.leaseRenewalInterval),
+				abortPollInterval: Duration.millis(config.abortPollInterval)
+			}));
+			const runtimeFailpointLayer = options.runtimeFailpoint === void 0 ? DurableRuntimeFailpoint.layer : Layer.succeed(DurableRuntimeFailpoint)({ hit: options.runtimeFailpoint(ctx) });
+			const reconcilerLayer = options.toolReconciler ?? ToolReconciler.uncertain;
+			const bindingResolverLayer = Layer.effect(AgentBindingResolver)(Effect.map(resolveBindings(options.bindings, {
+				ctx,
+				env,
+				conversationId,
+				producerId
+			}), (bindings) => AgentBindingResolver.fromBindings(bindings)));
+			const base = Layer.mergeAll(identityLayer, cloudflareConfigLayer, DurableAlarmService.layer);
+			const runtimeStack = DurableAgentRuntime.layer.pipe(Layer.provideMerge(routedPorts), Layer.provideMerge(cloudflareWakeSchedulerLayer), Layer.provideMerge(runtimeConfigLayer), Layer.provideMerge(bindingResolverLayer), Layer.provide(Layer.mergeAll(runtimeFailpointLayer, reconcilerLayer, BrowserCrypto.layer)), Layer.provideMerge(base));
+			return Layer.mergeAll(runtimeStack, ConversationMaintenance.layer.pipe(Layer.provide(runtimeStack)), portsEndpointLayer);
+		}));
+	}
+};
+//#endregion
+//#region src/client.ts
+/**
+* The Worker↔Conversation-Object host protocol (plan §1.4): Schema envelopes for the host
+* entry points (`submitEncoded`, `awaitSettlementEncoded`, `observePage`, `abortEncoded`,
+* `resolveApprovalEncoded`, `resolveUnknownEncoded`) plus the Worker-side client that speaks
+* it. Mirrors the WP2 port protocol: requests and responses are closed Schema unions, typed
+* failures travel as their own tagged classes and RE-DECODE to identical tags on the caller
+* (error-tag fidelity), and protocol anomalies are answered typed instead of thrown.
+*/
+/** Ceiling for host protocol diagnostic strings. */
+const MAX_HOST_DIAGNOSTIC_LENGTH = 4096;
+const BoundedDiagnostic = Schema.String.check(Schema.isMaxLength(MAX_HOST_DIAGNOSTIC_LENGTH));
+/** Truncate a diagnostic string to the host protocol's bounded length. */
+const boundHostDiagnostic = (value) => value.length > MAX_HOST_DIAGNOSTIC_LENGTH ? `${value.slice(0, MAX_HOST_DIAGNOSTIC_LENGTH - 3)}...` : value;
+/**
+* The envelope itself could not be honored: the Object could not decode the request, or a
+* response could not be encoded/decoded. Never carries operation semantics.
+*/
+var HostProtocolError = class extends Schema.TaggedError()("HostProtocolError", { message: BoundedDiagnostic }) {};
+/** The Worker-side stub call itself failed (RPC rejection, overload, eviction mid-call). */
+var ConversationClientError = class extends Schema.TaggedError()("ConversationClientError", {
+	conversationId: Schema.String,
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+/**
+* One durable submission, input ALREADY encoded by the caller through the Agent Binding's
+* input schema (the Worker bundles the same Agent definitions as the Object, so schema
+* validation happens client-side; the resolved Binding re-validates at claim time). The
+* Conversation identity is deliberately absent — the addressed Object IS the lane.
+*/
+var SubmitRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/SubmitRequest")({
+	agentId: AgentId,
+	principal: Principal,
+	idempotencyKey: IdempotencyKey,
+	definitions: DefinitionDigests,
+	inputPayload: PersistedJson
+}) {};
+/** One bounded page of canonical records after an optional sequence. */
+var ObservePageRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/ObservePageRequest")({
+	afterSequence: Schema.optionalKey(CanonicalSequence),
+	limit: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(1024))
+}) {};
+/**
+* Every typed failure a host entry point can produce, plus the protocol's own errors. Same
+* closed-union discipline as the WP2 `PortFailure`: members re-decode to the SAME tagged
+* classes on the Worker side; `cause` chains travel as Schema defects without instance
+* fidelity (plan §2.8).
+*/
+const HostFailure = Schema.Union([
+	AgentInputError,
+	DigestError,
+	AdmissionConflict,
+	SettlementConflict,
+	ApprovalConflict,
+	UnknownResolutionConflict,
+	JoinedToHost,
+	LedgerError,
+	ConversationStoreError,
+	ConversationNotMaterialized,
+	AppendConflict,
+	FenceRejected,
+	DurableRuntimeFailpointError,
+	AdmissionLimitExceeded,
+	DurableAlarmError,
+	HostProtocolError
+]);
+var SubmitSucceeded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/SubmitSucceeded")("SubmitSucceeded", { receipt: Receipt }) {};
+var SettlementReached = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/SettlementReached")("SettlementReached", { settlement: Settlement }) {};
+var ObservedPage = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ObservedPage")("ObservedPage", { records: Schema.Array(CanonicalRecordEnvelope).check(Schema.isMaxLength(1024)) }) {};
+var AbortRecorded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/AbortRecorded")("AbortRecorded", { intent: AbortIntent }) {};
+var ApprovalRecorded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ApprovalRecorded")("ApprovalRecorded", { intent: ApprovalDecisionIntent }) {};
+var UnknownResolutionRecorded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/UnknownResolutionRecorded")("UnknownResolutionRecorded", { intent: UnknownResolutionIntent }) {};
+/** The entry point failed TYPED on the Object; the failure re-decodes verbatim. */
+var HostFailed = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/HostFailed")("HostFailed", { failure: HostFailure }) {};
+/** The uniform answer of one host entry point. Callers narrow by the tag their call implies. */
+const HostResponse = Schema.Union([
+	SubmitSucceeded,
+	SettlementReached,
+	ObservedPage,
+	AbortRecorded,
+	ApprovalRecorded,
+	UnknownResolutionRecorded,
+	HostFailed
+]);
+const decodeSubmitRequest = Schema.decodeUnknownEffect(SubmitRequest);
+const encodeSubmitRequest = Schema.encodeEffect(SubmitRequest);
+const decodeReceipt = Schema.decodeUnknownEffect(Receipt);
+const encodeReceipt = Schema.encodeEffect(Receipt);
+const decodeObservePageRequest = Schema.decodeUnknownEffect(ObservePageRequest);
+const encodeObservePageRequest = Schema.encodeEffect(ObservePageRequest);
+const decodeAbortCommand = Schema.decodeUnknownEffect(AbortCommand);
+const encodeAbortCommand = Schema.encodeEffect(AbortCommand);
+const decodeApprovalDecisionCommand = Schema.decodeUnknownEffect(ApprovalDecisionCommand);
+const encodeApprovalDecisionCommand = Schema.encodeEffect(ApprovalDecisionCommand);
+const decodeUnknownResolutionCommand = Schema.decodeUnknownEffect(UnknownResolutionCommand);
+const encodeUnknownResolutionCommand = Schema.encodeEffect(UnknownResolutionCommand);
+const encodeHostResponse = Schema.encodeEffect(HostResponse);
+const decodeHostResponse = Schema.decodeUnknownEffect(HostResponse);
+const SUBMIT_FAILURE_TAGS = /* @__PURE__ */ new Set([
+	"AgentInputError",
+	"DigestError",
+	"AdmissionConflict",
+	"LedgerError",
+	"ConversationStoreError",
+	"ConversationNotMaterialized",
+	"AppendConflict",
+	"FenceRejected",
+	"DurableRuntimeFailpointError",
+	"AdmissionLimitExceeded",
+	"DurableAlarmError",
+	"HostProtocolError"
+]);
+const AWAIT_FAILURE_TAGS = /* @__PURE__ */ new Set([
+	"LedgerError",
+	"SettlementConflict",
+	"HostProtocolError"
+]);
+const OBSERVE_FAILURE_TAGS = /* @__PURE__ */ new Set([
+	"ConversationStoreError",
+	"ConversationNotMaterialized",
+	"HostProtocolError"
+]);
+const ABORT_FAILURE_TAGS = /* @__PURE__ */ new Set([
+	"LedgerError",
+	"SettlementConflict",
+	"JoinedToHost",
+	"DurableRuntimeFailpointError",
+	"DurableAlarmError",
+	"HostProtocolError"
+]);
+const APPROVAL_FAILURE_TAGS = /* @__PURE__ */ new Set([
+	"LedgerError",
+	"SettlementConflict",
+	"ApprovalConflict",
+	"DurableAlarmError",
+	"HostProtocolError"
+]);
+const UNKNOWN_FAILURE_TAGS = /* @__PURE__ */ new Set([
+	"LedgerError",
+	"SettlementConflict",
+	"UnknownResolutionConflict",
+	"JoinedToHost",
+	"DurableRuntimeFailpointError",
+	"DurableAlarmError",
+	"HostProtocolError"
+]);
+const outOfContract = (conversationId, operation, observed) => ConversationClientError.make({
+	conversationId,
+	message: boundHostDiagnostic(`The Conversation Object answered ${operation} with the out-of-contract ${observed}.`)
+});
+/**
+* Narrow one decoded `HostFailed.failure` to the operation's declared failure family; an
+* out-of-contract tag folds into `ConversationClientError` instead of being erased or
+* re-thrown raw (the WP2 discipline). The predicate is the single documented narrowing over
+* the closed `HostFailure` union.
+*/
+const narrowFailure = (tags) => (failure) => tags.has(failure._tag);
+/** Worker-side client over the Conversation Object namespace (DEPLOY-010). */
+var CloudflareConversationClient = class CloudflareConversationClient extends Context.Service()("@effect-agent/platform-cloudflare/CloudflareConversationClient") {
+	static layer = Layer.effect(CloudflareConversationClient)(Effect.gen(function* () {
+		const { namespace } = yield* ConversationObjectNamespace;
+		const call = (conversationId, operation, invoke) => Effect.tryPromise({
+			try: () => invoke(namespace.get(namespace.idFromName(conversationId))),
+			catch: (cause) => ConversationClientError.make({
+				conversationId,
+				message: boundHostDiagnostic(`${operation} did not reach the Conversation Object: ${cause instanceof Error ? cause.message : String(cause)}`),
+				cause
+			})
+		}).pipe(Effect.flatMap((raw) => decodeHostResponse(raw).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`The ${operation} answer could not be decoded: ${error.message}`) })))), Effect.withSpan("CloudflareConversationClient.call", { attributes: {
+			conversationId,
+			operation
+		} }));
+		const expect = (conversationId, operation, resultTag, tags) => {
+			const isExpected = narrowFailure(tags);
+			return (response) => {
+				if (response._tag === "HostFailed") {
+					const failure = response.failure;
+					return isExpected(failure) ? Effect.fail(failure) : Effect.fail(outOfContract(conversationId, operation, `failure ${failure._tag}`));
+				}
+				if (response._tag !== resultTag) return Effect.fail(outOfContract(conversationId, operation, `result ${response._tag}`));
+				return Effect.succeed(response);
+			};
+		};
+		const readPage = (conversationId, options) => Effect.gen(function* () {
+			const request = ObservePageRequest.make({
+				...options?.afterSequence === void 0 ? {} : { afterSequence: options.afterSequence },
+				limit: options?.limit ?? 256
+			});
+			const encoded = yield* encodeObservePageRequest(request).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`observePage request encode failed: ${error.message}`) })));
+			const response = yield* call(conversationId, "observePage", (stub) => stub.observePage(encoded));
+			return (yield* expect(conversationId, "observePage", "ObservedPage", OBSERVE_FAILURE_TAGS)(response)).records;
+		});
+		return CloudflareConversationClient.of({
+			submit: (agent, input, options) => Effect.gen(function* () {
+				const encodedInput = yield* Schema.encodeEffect(agent.definition.input)(input).pipe(Effect.mapError((cause) => AgentInputError.make({ message: `Unable to encode Agent input: ${cause.message}` })));
+				const inputPayload = yield* Schema.decodeUnknownEffect(PersistedJson)(encodedInput).pipe(Effect.mapError(() => AgentInputError.make({ message: "Agent input does not satisfy the canonical persistence bounds" })));
+				const request = SubmitRequest.make({
+					agentId: agent.definition.id,
+					principal: options.principal,
+					idempotencyKey: options.idempotencyKey,
+					definitions: options.definitions,
+					inputPayload
+				});
+				const encoded = yield* encodeSubmitRequest(request).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`submit request encode failed: ${error.message}`) })));
+				const response = yield* call(options.conversationId, "submit", (stub) => stub.submitEncoded(encoded));
+				return (yield* expect(options.conversationId, "submit", "SubmitSucceeded", SUBMIT_FAILURE_TAGS)(response)).receipt;
+			}),
+			awaitSettlement: (receipt) => Effect.gen(function* () {
+				const encoded = yield* encodeReceipt(receipt).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`receipt encode failed: ${error.message}`) })));
+				const response = yield* call(receipt.conversationId, "awaitSettlement", (stub) => stub.awaitSettlementEncoded(encoded));
+				return (yield* expect(receipt.conversationId, "awaitSettlement", "SettlementReached", AWAIT_FAILURE_TAGS)(response)).settlement;
+			}),
+			readPage,
+			readAll: (conversationId) => Effect.gen(function* () {
+				const all = [];
+				let after;
+				for (;;) {
+					const page = yield* readPage(conversationId, {
+						afterSequence: after,
+						limit: 1024
+					});
+					all.push(...page);
+					const last = page.at(-1);
+					if (page.length < 1024 || last === void 0) return all;
+					after = last.sequence;
+				}
+			}),
+			abort: (conversationId, command) => Effect.gen(function* () {
+				const encoded = yield* encodeAbortCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`abort command encode failed: ${error.message}`) })));
+				const response = yield* call(conversationId, "abort", (stub) => stub.abortEncoded(encoded));
+				return (yield* expect(conversationId, "abort", "AbortRecorded", ABORT_FAILURE_TAGS)(response)).intent;
+			}),
+			resolveApproval: (conversationId, command) => Effect.gen(function* () {
+				const encoded = yield* encodeApprovalDecisionCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`approval command encode failed: ${error.message}`) })));
+				const response = yield* call(conversationId, "resolveApproval", (stub) => stub.resolveApprovalEncoded(encoded));
+				return (yield* expect(conversationId, "resolveApproval", "ApprovalRecorded", APPROVAL_FAILURE_TAGS)(response)).intent;
+			}),
+			resolveUnknown: (conversationId, command) => Effect.gen(function* () {
+				const encoded = yield* encodeUnknownResolutionCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`resolution command encode failed: ${error.message}`) })));
+				const response = yield* call(conversationId, "resolveUnknown", (stub) => stub.resolveUnknownEncoded(encoded));
+				return (yield* expect(conversationId, "resolveUnknown", "UnknownResolutionRecorded", UNKNOWN_FAILURE_TAGS)(response)).intent;
+			})
+		});
+	}));
+};
+//#endregion
+//#region src/conversation-object.ts
+/** Port envelope tags whose owner-side execution durably mutates this Object's lane. */
+const MUTATING_PORT_TAGS = /* @__PURE__ */ new Set([
+	"LedgerAdmit",
+	"LedgerMarkReady",
+	"LedgerRequestAbort",
+	"LedgerRecordChildSettled",
+	"StoreMaterialize",
+	"StoreAppend"
+]);
+const isMutatingPortRequest = (encoded) => typeof encoded === "object" && encoded !== null && "_tag" in encoded && typeof encoded._tag === "string" && MUTATING_PORT_TAGS.has(encoded._tag);
+/** The literal encoded `PortFailed(PortProtocolError)` fallback (same shape as WP2's). */
+const encodedPortProtocolFailure = (message) => ({
+	_tag: "PortFailed",
+	failure: {
+		_tag: "PortProtocolError",
+		message: boundHostDiagnostic(message)
+	}
+});
+const protocolFailure = (context) => (error) => HostProtocolError.make({ message: boundHostDiagnostic(`${context}: ${error.message}`) });
+/** Fold one endpoint's typed failures into the uniform `HostResponse` envelope. */
+const respond = (effect) => effect.pipe(Effect.map((result) => result), Effect.catch((failure) => Effect.succeed(HostFailed.make({ failure }))));
+/** Encode the response envelope; an unencodable response degrades to a protocol failure. */
+const encodeResponse = (response) => encodeHostResponse(response).pipe(Effect.catch((error) => Effect.succeed({
+	_tag: "HostFailed",
+	failure: {
+		_tag: "HostProtocolError",
+		message: boundHostDiagnostic(`The host response could not be encoded: ${error.message}`)
+	}
+})));
+const utf8Bytes = (value) => new TextEncoder().encode(JSON.stringify(value)).length;
+/**
+* The admission-limits gate, BEFORE `runtime.submit` touches the ledger (exit gate
+* "resource limits are checked before admission"; DEPLOY-007). A replayed idempotency key is
+* exempt: its accepted-work obligation already exists, and returning the original Receipt
+* consumes no new quota. Refusals are typed `AdmissionLimitExceeded` and nothing is written.
+*/
+const gateAdmissionLimits = Effect.fn("ConversationObject.gateAdmissionLimits")(function* (request) {
+	const identity = yield* ConversationObjectIdentity;
+	const config = yield* CloudflareDurableRuntimeConfig;
+	const ledger = yield* SubmissionLedger;
+	const { ctx } = yield* DurableObjectContext;
+	const existing = yield* ledger.lookup(SubmissionLookupByKey.make({
+		conversationId: identity.conversationId,
+		principal: request.principal,
+		idempotencyKey: request.idempotencyKey
+	}));
+	if (Option.isSome(existing)) return;
+	const inputBytes = utf8Bytes(request.inputPayload);
+	if (inputBytes > config.limits.maxInputBytes) return yield* AdmissionLimitExceeded.make({
+		limit: "input-bytes",
+		actual: inputBytes,
+		maximum: config.limits.maxInputBytes
+	});
+	const nonterminal = yield* Stream.runCollect(ledger.scanNonterminal);
+	if (nonterminal.length >= config.limits.maxQueueDepthPerLane) return yield* AdmissionLimitExceeded.make({
+		limit: "queue-depth",
+		actual: nonterminal.length,
+		maximum: config.limits.maxQueueDepthPerLane
+	});
+	const databaseBytes = yield* Effect.sync(() => ctx.storage.sql.databaseSize);
+	if (databaseBytes > config.limits.maxDatabaseBytes) return yield* AdmissionLimitExceeded.make({
+		limit: "database-bytes",
+		actual: databaseBytes,
+		maximum: config.limits.maxDatabaseBytes
+	});
+});
+/**
+* The submit-capable projection of an Agent Binding on the OBJECT side: the input arrived
+* already encoded through the real input schema on the Worker side (`client.ts`), so the
+* Object admits the canonical `PersistedJson` payload as-is; the resolved Binding re-derives
+* everything else from the stored `(agentId, agentDigests)` at claim time (SUB-023).
+*/
+const passthroughSubmitAgent = (agentId) => ({ definition: {
+	id: agentId,
+	input: PersistedJson
+} });
+const submitEndpoint = (encoded) => decodeSubmitRequest(encoded).pipe(Effect.mapError(protocolFailure("The submit request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ConversationObjectIdentity;
+	const maintenance = yield* ConversationMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	yield* gateAdmissionLimits(request);
+	yield* maintenance.preArm;
+	const receipt = yield* runtime.submit(passthroughSubmitAgent(request.agentId), request.inputPayload, {
+		conversationId: identity.conversationId,
+		principal: request.principal,
+		idempotencyKey: request.idempotencyKey,
+		definitions: request.definitions
+	});
+	return SubmitSucceeded.make({ receipt });
+})), respond, Effect.flatMap(encodeResponse));
+const awaitSettlementEndpoint = (encoded) => decodeReceipt(encoded).pipe(Effect.mapError(protocolFailure("The receipt could not be decoded")), Effect.flatMap((receipt) => Effect.gen(function* () {
+	const settlement = yield* (yield* DurableAgentRuntime).awaitSettlement(receipt);
+	return SettlementReached.make({ settlement });
+})), respond, Effect.flatMap(encodeResponse));
+const observePageEndpoint = (encoded) => decodeObservePageRequest(encoded).pipe(Effect.mapError(protocolFailure("The observe request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ConversationObjectIdentity;
+	const store = yield* ConversationStore;
+	yield* (yield* OperationAuthorizer).authorize(OperationAuthorizationRequest.make({
+		operation: "observe",
+		conversationId: identity.conversationId
+	})).pipe(Effect.catchTag("OperationDenied", deniedToProtocolFailure));
+	const records = yield* Stream.runCollect(store.read(ConversationRead.make({
+		conversationId: identity.conversationId,
+		...request.afterSequence === void 0 ? {} : { afterSequence: request.afterSequence },
+		limit: request.limit
+	})));
+	return ObservedPage.make({ records: [...records] });
+})), respond, Effect.flatMap(encodeResponse));
+const abortEndpoint = (encoded) => decodeAbortCommand(encoded).pipe(Effect.mapError(protocolFailure("The abort command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	const maintenance = yield* ConversationMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	yield* maintenance.preArm;
+	const intent = yield* runtime.abort(command);
+	return AbortRecorded.make({ intent });
+})), respond, Effect.flatMap(encodeResponse));
+/**
+* The pre-P7 host protocol's failure union does not carry `OperationDenied` (the Worker client
+* predates the authorizer). This assembly always runs the default possession authorizer — no
+* `CloudflareDurableRuntimeOptions` authorizer lever exists yet — so a denial here is
+* unreachable today; if one ever surfaces it degrades to the protocol failure instead of an
+* out-of-contract throw. The four P7 admin entry points below carry `OperationDenied` typed.
+*/
+const deniedToProtocolFailure = (denied) => Effect.fail(HostProtocolError.make({ message: boundHostDiagnostic(`The ${denied.operation} operation was denied: ${denied.reason}`) }));
+const resolveApprovalEndpoint = (encoded) => decodeApprovalDecisionCommand(encoded).pipe(Effect.mapError(protocolFailure("The approval command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	const maintenance = yield* ConversationMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	yield* maintenance.preArm;
+	const intent = yield* runtime.resolveApproval(command).pipe(Effect.catchTag("OperationDenied", deniedToProtocolFailure));
+	return ApprovalRecorded.make({ intent });
+})), respond, Effect.flatMap(encodeResponse));
+const resolveUnknownEndpoint = (encoded) => decodeUnknownResolutionCommand(encoded).pipe(Effect.mapError(protocolFailure("The resolution command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	const maintenance = yield* ConversationMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	yield* maintenance.preArm;
+	const intent = yield* runtime.resolveUnknown(command).pipe(Effect.catchTag("OperationDenied", deniedToProtocolFailure));
+	return UnknownResolutionRecorded.make({ intent });
+})), respond, Effect.flatMap(encodeResponse));
+/** Explain one Submission (`submissionId` present) or every nonterminal lane member. */
+var AdminExplainRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/AdminExplainRequest")({ submissionId: Schema.optionalKey(SubmissionId) }) {};
+/** Verify carries no parameters — the addressed Object IS the lane. */
+var AdminVerifyRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/AdminVerifyRequest")({}) {};
+/** Every typed failure of the four admin entry points, plus the protocol's own errors. */
+const AdminFailure = Schema.Union([
+	OperationDenied,
+	RetryRefused,
+	LedgerError,
+	RunJournalError,
+	DigestError,
+	OwnershipLost,
+	SettlementConflict,
+	ConversationStoreError,
+	ConversationNotMaterialized,
+	AppendConflict,
+	FenceRejected,
+	DurableRuntimeFailpointError,
+	DurableAlarmError,
+	HostProtocolError
+]);
+var ExplainedRecovery = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ExplainedRecovery")("ExplainedRecovery", { explanations: Schema.Array(RecoveryExplanation).check(Schema.isMaxLength(1024)) }) {};
+var VerifiedIntegrity = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/VerifiedIntegrity")("VerifiedIntegrity", { report: IntegrityReport }) {};
+var RetryExecuted = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/RetryExecuted")("RetryExecuted", { report: RecoveryReport }) {};
+var ObligationsScanned = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ObligationsScanned")("ObligationsScanned", { report: ObligationReport }) {};
+/** The admin entry point failed TYPED on the Object; the failure re-decodes verbatim. */
+var AdminFailed = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/AdminFailed")("AdminFailed", { failure: AdminFailure }) {};
+/** The uniform answer of one admin entry point. Callers narrow by the tag their call implies. */
+const AdminResponse = Schema.Union([
+	ExplainedRecovery,
+	VerifiedIntegrity,
+	RetryExecuted,
+	ObligationsScanned,
+	AdminFailed
+]);
+const decodeAdminExplainRequest = Schema.decodeUnknownEffect(AdminExplainRequest);
+const decodeAdminVerifyRequest = Schema.decodeUnknownEffect(AdminVerifyRequest);
+const decodeRetryCommand = Schema.decodeUnknownEffect(RetryCommand);
+const decodeObligationThresholds = Schema.decodeUnknownEffect(ObligationThresholds);
+const encodeAdminResponse = Schema.encodeEffect(AdminResponse);
+const decodeAdminResponse = Schema.decodeUnknownEffect(AdminResponse);
+/** Fold one admin endpoint's typed failures into the uniform `AdminResponse` envelope. */
+const respondAdmin = (effect) => effect.pipe(Effect.map((result) => result), Effect.catch((failure) => Effect.succeed(AdminFailed.make({ failure }))));
+/** Encode the admin response envelope; an unencodable response degrades to a protocol failure. */
+const encodeAdminResponseTotal = (response) => encodeAdminResponse(response).pipe(Effect.catch((error) => Effect.succeed({
+	_tag: "AdminFailed",
+	failure: {
+		_tag: "HostProtocolError",
+		message: boundHostDiagnostic(`The admin response could not be encoded: ${error.message}`)
+	}
+})));
+const explainEndpoint = (encoded) => decodeAdminExplainRequest(encoded).pipe(Effect.mapError(protocolFailure("The explain request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ConversationObjectIdentity;
+	const runtime = yield* DurableAgentRuntime;
+	const explanations = request.submissionId === void 0 ? yield* runtime.explainConversation(identity.conversationId) : [yield* runtime.explain(request.submissionId)];
+	return ExplainedRecovery.make({ explanations });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+const verifyEndpoint = (encoded) => decodeAdminVerifyRequest(encoded).pipe(Effect.mapError(protocolFailure("The verify request could not be decoded")), Effect.flatMap(() => Effect.gen(function* () {
+	const identity = yield* ConversationObjectIdentity;
+	const report = yield* (yield* DurableAgentRuntime).verify(identity.conversationId);
+	return VerifiedIntegrity.make({ report });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+const retryEndpoint = (encoded) => decodeRetryCommand(encoded).pipe(Effect.mapError(protocolFailure("The retry command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	const maintenance = yield* ConversationMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	yield* maintenance.preArm;
+	const report = yield* runtime.retry(command);
+	return RetryExecuted.make({ report });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+const obligationsEndpoint = (encoded) => decodeObligationThresholds(encoded).pipe(Effect.mapError(protocolFailure("The obligation thresholds could not be decoded")), Effect.flatMap((thresholds) => Effect.gen(function* () {
+	const report = yield* (yield* DurableAgentRuntime).scanObligations(thresholds);
+	return ObligationsScanned.make({ report });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+/**
+* Owner-side `portCall`: pre-arm before a mutating envelope (a routed admission committed by
+* THIS Object must already carry the alarm that will finish it), execute on the LOCAL facets
+* (never the routed decorators), then arm an immediate alarm so the mutated lane is
+* processed promptly. Protocol anomalies answer `PortFailed(PortProtocolError)`.
+*/
+const portCallEndpoint = (encoded) => Effect.gen(function* () {
+	const ports = yield* ConversationObjectPorts;
+	const maintenance = yield* ConversationMaintenance;
+	const alarm = yield* DurableAlarmService;
+	const mutating = isMutatingPortRequest(encoded);
+	if (mutating) {
+		if ((yield* maintenance.preArm.pipe(Effect.exit))._tag === "Failure") return encodedPortProtocolFailure("The owner Object could not arm its maintenance alarm before the mutation.");
+	}
+	const response = yield* ports.handle(encoded);
+	if (mutating) yield* alarm.scheduleNow.pipe(Effect.catch((error) => Effect.logWarning("ConversationObject.portCall: immediate re-arm failed", error)));
+	return response;
+});
+const wakeEndpoint = Effect.gen(function* () {
+	yield* (yield* DurableAlarmService).scheduleNow.pipe(Effect.catch((error) => Effect.logWarning("ConversationObject.wake dropped", error)));
+});
+const alarmEndpoint = Effect.gen(function* () {
+	yield* (yield* ConversationMaintenance).pass;
+});
+const gateEndpoint = Effect.gen(function* () {
+	yield* (yield* ConversationMaintenance).ensureAlarm;
+});
+/** Build the application's Conversation Object class (export it from the Worker entry). */
+const makeConversationObjectClass = (options) => {
+	class ConversationObject extends DurableObject {
+		#runtime;
+		constructor(ctx, env) {
+			super(ctx, env);
+			this.#runtime = ManagedRuntime.make(CloudflareDurableRuntime.layer(options).pipe(Layer.provideMerge(Layer.mergeAll(DurableObjectContext.layer(ctx, env), conversationNamespaceLayer(env, options.namespaceBinding)))));
+			ctx.blockConcurrencyWhile(() => this.#runtime.runPromise(gateEndpoint));
+		}
+		async submitEncoded(encoded) {
+			return this.#runtime.runPromise(submitEndpoint(encoded));
+		}
+		async awaitSettlementEncoded(encoded) {
+			return this.#runtime.runPromise(awaitSettlementEndpoint(encoded));
+		}
+		async observePage(encoded) {
+			return this.#runtime.runPromise(observePageEndpoint(encoded));
+		}
+		async abortEncoded(encoded) {
+			return this.#runtime.runPromise(abortEndpoint(encoded));
+		}
+		async resolveApprovalEncoded(encoded) {
+			return this.#runtime.runPromise(resolveApprovalEndpoint(encoded));
+		}
+		async resolveUnknownEncoded(encoded) {
+			return this.#runtime.runPromise(resolveUnknownEndpoint(encoded));
+		}
+		async explainEncoded(encoded) {
+			return this.#runtime.runPromise(explainEndpoint(encoded));
+		}
+		async verifyEncoded(encoded) {
+			return this.#runtime.runPromise(verifyEndpoint(encoded));
+		}
+		async retryEncoded(encoded) {
+			return this.#runtime.runPromise(retryEndpoint(encoded));
+		}
+		async obligationsEncoded(encoded) {
+			return this.#runtime.runPromise(obligationsEndpoint(encoded));
+		}
+		async portCall(encoded) {
+			return this.#runtime.runPromise(portCallEndpoint(encoded));
+		}
+		async wake() {
+			await this.#runtime.runPromise(wakeEndpoint);
+		}
+		async alarm() {
+			await this.#runtime.runPromise(alarmEndpoint);
+		}
+	}
+	return ConversationObject;
+};
+//#endregion
+export { AbortRecorded, AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, AdmissionLimitExceeded, ApprovalRecorded, CLOUDFLARE_DATABASE_CAP_BYTES, CLOUDFLARE_RUNTIME_DEFAULTS, CloudflareAdmissionLimitsValue, CloudflareBindingError, CloudflareConversationClient, CloudflareDurableRuntime, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError, ConversationClientError, ConversationMaintenance, ConversationObjectIdentity, ConversationObjectNamespace, ConversationObjectPorts, DEFAULT_MAX_DATABASE_BYTES, DurableAlarmError, DurableAlarmService, DurableObjectContext, ExplainedRecovery, HostFailed, HostFailure, HostProtocolError, HostResponse, MaintenancePassReport, ObligationsScanned, ObservePageRequest, ObservedPage, RetryExecuted, SettlementReached, SubmitRequest, SubmitSucceeded, UnknownResolutionRecorded, VerifiedIntegrity, boundHostDiagnostic, cloudflareWakeSchedulerLayer, conversationNamespaceFromEnv, conversationNamespaceLayer, conversationPortTransportLayer, decodeAbortCommand, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeApprovalDecisionCommand, decodeHostResponse, decodeObligationThresholds, decodeObservePageRequest, decodeReceipt, decodeRetryCommand, decodeSubmitRequest, decodeUnknownResolutionCommand, encodeAbortCommand, encodeAdminResponse, encodeApprovalDecisionCommand, encodeHostResponse, encodeObservePageRequest, encodeReceipt, encodeSubmitRequest, encodeUnknownResolutionCommand, makeConversationObjectClass };
+
+//# sourceMappingURL=index.mjs.map