@effect-agent/platform-cloudflare 0.0.1-beta.4 → 0.0.1-beta.6

package/dist/index.d.mts

@@ -2,7 +2,8 @@ import { Context, Effect, Layer, Option, Schema } from "effect";
 import { AbortCommand, AbortIntent, AdmissionConflict, AgentBindingResolver, AppendConflict, ApprovalConflict, ApprovalDecisionCommand, ApprovalDecisionIntent, CanonicalRecordEnvelope, CanonicalSequence, ConversationNotMaterialized, ConversationStore, ConversationStoreError, DefinitionDigests, DigestError, DurableAgentRuntime, DurableBindingFailure, DurableRuntimeConfig, DurableRuntimeFailpointError, DurableRuntimeFailpointHandler, DurableSubmitAgent, DurableSubmitOptions, DurableWorkerFailure, FenceRejected, IntegrityReport, JoinedToHost, LedgerError, ObligationReport, ObligationThresholds, OperationDenied, OwnershipLost, ProducerId, Receipt, RecoveryExplanation, RecoveryReport, ResolvedBinding, RetryCommand, RetryRefused, RunJournalError, Settlement, SettlementConflict, SubmissionLedger, ToolReconciler, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, WakeScheduler } from "@effect-agent/session";
 import { ConversationPortTransport, DoStorageFailpointHandler, DoStorageInitializationError } from "@effect-agent/storage-cloudflare";
 import { AgentInputError, ConversationId } from "@effect-agent/core";
-import { DurableObject } from "cloudflare:workers";
+import { DurableObject, WorkerEntrypoint } from "cloudflare:workers";
+import { CodeExecutor, SandboxImplementation } from "@effect-agent/sandbox";
 //#region src/bindings.d.ts
 declare const CloudflareBindingError_base: Schema.Class<CloudflareBindingError, Schema.TaggedStruct<"CloudflareBindingError", {
   readonly binding: Schema.String;
@@ -148,6 +149,8 @@ declare const CloudflareDurableRuntimeConfigValue_base: Schema.Class<CloudflareD
   readonly abortPollInterval: Schema.Int;
   /** Canonical observation poll cadence of the Durable Object store. */
   readonly observationPollInterval: Schema.Int;
+  /** Cooperative background-export budget; native Object delivery never awaits the flush. */
+  readonly telemetryFlushTimeout: Schema.Int;
   /** Per-value byte bound; must stay under the platform's 2 MB SQLite value limit. */
   readonly maxStoredValueBytes: Schema.Int;
   /** Opt-in full payload/digest-chain audit while opening the store. */
@@ -174,6 +177,7 @@ declare const CLOUDFLARE_RUNTIME_DEFAULTS: {
   readonly leaseRenewalInterval: 10000;
   readonly abortPollInterval: 500;
   readonly observationPollInterval: 25;
+  readonly telemetryFlushTimeout: 2000;
   readonly maxStoredValueBytes: 1900000;
   readonly verifyOnOpen: false;
   readonly maxQueueDepthPerLane: 256;
@@ -320,6 +324,36 @@ declare const cloudflareWakeSchedulerLayer: Layer.Layer<WakeScheduler, never, Du
  */
 declare const conversationPortTransportLayer: Layer.Layer<ConversationPortTransport, never, ConversationObjectNamespace>;
 //#endregion
+//#region src/telemetry.d.ts
+declare const CloudflareTelemetryExportError_base: Schema.Class<CloudflareTelemetryExportError, Schema.TaggedStruct<"CloudflareTelemetryExportError", {
+  /** The original exporter failure, retained for host-side diagnostics. */
+  readonly cause: Schema.Defect;
+}>, import("effect/Cause").YieldableError>;
+/** A host exporter failed during one coalesced background export attempt. */
+declare class CloudflareTelemetryExportError extends CloudflareTelemetryExportError_base {}
+declare const CloudflareRuntimeTelemetry_base: Context.ServiceClass<CloudflareRuntimeTelemetry, "@effect-agent/platform-cloudflare/CloudflareRuntimeTelemetry", {
+  readonly flush: Effect.Effect<void, CloudflareTelemetryExportError>;
+}>;
+/**
+ * Host-owned exporter lifecycle for one Cloudflare Conversation Object incarnation.
+ *
+ * The platform package creates measurements but deliberately does not select an exporter or
+ * vendor. Native entrypoint instrumentation consumes this service at the Worker composition edge;
+ * applications pass its provider as the second `makeConversationObjectClass` argument together
+ * with their Effect Logger, Tracer, and Metric layers. That provider may read `DurableObjectContext` or
+ * `ConversationObjectNamespace`, and its typed acquisition error remains visible in construction.
+ * `flush` must attempt to export every configured signal. After the native span closes, the
+ * Conversation Object reserves it into a shared post-settlement batch before `ctx.waitUntil` under
+ * a cooperative timeout. Only each pending/trailing/queued batch's first owner registers its
+ * shared Promise. Cycles remain capped at one first exporter attempt plus at most one trailing
+ * attempt, with one queued cycle while trailing runs; exporter completion never holds endpoint
+ * delivery open and exporter failure never replaces endpoint behavior.
+ */
+declare class CloudflareRuntimeTelemetry extends CloudflareRuntimeTelemetry_base {
+  /** Content-free default selected by `makeConversationObjectClass` when no host Layer is passed. */
+  static readonly layerNoop: Layer.Layer<CloudflareRuntimeTelemetry, never, never>;
+}
+//#endregion
 //#region src/layers.d.ts
 /**
  * Raw (unvalidated) construction options for `CloudflareDurableRuntime.layer`, mirroring
@@ -347,6 +381,11 @@ interface CloudflareDurableRuntimeOptions {
   readonly abortPollInterval?: number | undefined;
   /** Milliseconds; default 25. */
   readonly observationPollInterval?: number | undefined;
+  /**
+   * Milliseconds; default 2000. Cooperative budget for the background exporter flush registered
+   * after each native RPC, wake, or alarm span. Delivery never awaits the flush.
+   */
+  readonly telemetryFlushTimeout?: number | undefined;
   /** Bytes; default just under the 2 MB platform value limit. */
   readonly maxStoredValueBytes?: number | undefined;
   /** Default false. */
@@ -373,12 +412,25 @@ interface CloudflareDurableRuntimeOptions {
   readonly toolReconciler?: Layer.Layer<ToolReconciler> | undefined;
   /**
    * Registered worker Bindings resolved at durable claim time (S2, spec/subagents.md §11):
-   * build each with `DurableWorkerBinding.make(binding, digests)`. An Effect form is accepted
-   * because the capture is effectful; it runs once per incarnation during Layer construction.
-   * Defaults to the empty registration (every resolved claim fails closed).
+   * build each with `DurableWorkerBinding.make(binding, digests)`. An Effect or callback form is
+   * accepted because capture can be effectful. The callback receives the live Object context and
+   * derived identities and is evaluated once per incarnation during Layer construction. Defaults
+   * to the empty registration (every resolved claim fails closed).
    */
-  readonly bindings?: ReadonlyArray<ResolvedBinding> | Effect.Effect<ReadonlyArray<ResolvedBinding>> | undefined;
+  readonly bindings?: CloudflareBindingSource | undefined;
 }
+/** Per-incarnation host values available while registered worker Bindings are captured. */
+interface CloudflareBindingSourceContext {
+  readonly ctx: DurableObjectState;
+  readonly env: unknown;
+  readonly conversationId: ConversationId;
+  readonly producerId: ProducerId;
+}
+/**
+ * Registered worker Bindings, or a closed Effect/callback that captures them once for each
+ * Durable Object incarnation. Callback Effects cannot require services or fail typed.
+ */
+type CloudflareBindingSource = ReadonlyArray<ResolvedBinding> | Effect.Effect<ReadonlyArray<ResolvedBinding>, never, never> | ((context: CloudflareBindingSourceContext) => ReadonlyArray<ResolvedBinding> | Effect.Effect<ReadonlyArray<ResolvedBinding>, never, never>);
 /** Every construction failure of the assembled Cloudflare durable runtime stack. */
 type CloudflareDurableRuntimeInitializationError = CloudflarePlatformConfigError | DoStorageInitializationError;
 /** The services `CloudflareDurableRuntime.layer` provides. */
@@ -406,9 +458,9 @@ declare class ConversationObjectPorts extends ConversationObjectPorts_base {}
  * Storage compatibility is verified during construction: an incompatible database fails the
  * Layer typed (`DoStorageCompatibilityError`) before anything is mutated (DEPLOY-008).
  *
- * Requires only the two binding services (`DurableObjectContext`,
- * `ConversationObjectNamespace`) — platform values enter exclusively through Layers
- * (DEPLOY-010).
+ * Requires the two binding services (`DurableObjectContext`, `ConversationObjectNamespace`).
+ * Host observability belongs to the Worker composition edge because native entrypoint lifecycle
+ * instrumentation, rather than this durable runtime assembly, consumes it (DEPLOY-010).
  */
 declare class CloudflareDurableRuntime {
   static layer(options: CloudflareDurableRuntimeOptions): Layer.Layer<CloudflareDurableRuntimeServices, CloudflareDurableRuntimeInitializationError, DurableObjectContext | ConversationObjectNamespace>;
@@ -579,14 +631,6 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
       readonly createdAt: string;
       readonly deploymentId: string;
       readonly payload: {
-        readonly _tag: "SubagentStarted";
-        readonly runId: string;
-        readonly toolCallId: string;
-        readonly childConversationId: string;
-        readonly childSubmissionId: string;
-        readonly childReceiptId: string;
-        readonly childRunId: string;
-      } | {
         readonly _tag: "ConversationCreated";
         readonly agentId: string;
         readonly definitions: {
@@ -717,6 +761,14 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
         readonly childConversationId: string;
         readonly childPrincipal: string;
         readonly childIdempotencyKey: string;
+      } | {
+        readonly _tag: "SubagentStarted";
+        readonly runId: string;
+        readonly toolCallId: string;
+        readonly childConversationId: string;
+        readonly childSubmissionId: string;
+        readonly childReceiptId: string;
+        readonly childRunId: string;
       } | {
         readonly _tag: "SubagentJoined";
         readonly runId: string;
@@ -911,7 +963,7 @@ declare class CloudflareConversationClient extends CloudflareConversationClient_
 //#endregion
 //#region src/conversation-object.d.ts
 /**
- * `makeConversationObjectClass(options)` — the Conversation Durable Object (plan §1.4,
+ * `makeConversationObjectClass(options, telemetry?)` — the Conversation Durable Object (plan §1.4,
  * D-P6-1): a factory returning a class that applications export from their Worker entry.
  * One SQLite-backed Object per Conversation is the serialized owner (durability §6); the
  * Object never runs `runResolvedWorker`'s infinite loop — each ingress event or alarm runs
@@ -1384,21 +1436,38 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
 } | {
   readonly _tag: "AdminFailed";
   readonly failure: {
-    readonly _tag: "HostProtocolError";
+    readonly _tag: "OperationDenied";
+    readonly operation: "explain" | "observe" | "resolveApproval" | "resolveUnknown" | "retry" | "scanObligations" | "verify" | "wake";
+    readonly reason: string;
+    readonly conversationId?: string | undefined;
+    readonly submissionId?: string | undefined;
+  } | {
+    readonly _tag: "RetryRefused";
+    readonly submissionId: string;
+    readonly refusal: "await-approval-decision" | "await-unknown-resolution" | "settled";
+    readonly decisionTag: string;
+    readonly message: string;
+  } | {
+    readonly _tag: "LedgerError";
+    readonly operation: string;
+    readonly message: string;
+    readonly cause?: Schema.Json | undefined;
+  } | {
+    readonly _tag: "RunJournalError";
     readonly message: string;
+    readonly cause?: Schema.Json | undefined;
   } | {
     readonly _tag: "DigestError";
     readonly message: string;
     readonly cause?: Schema.Json | undefined;
+  } | {
+    readonly _tag: "OwnershipLost";
+    readonly submissionId: string;
+    readonly actualEpoch: number;
   } | {
     readonly _tag: "SettlementConflict";
     readonly submissionId: string;
     readonly existingOutcome: "aborted" | "completed" | "failed";
-  } | {
-    readonly _tag: "LedgerError";
-    readonly operation: string;
-    readonly message: string;
-    readonly cause?: Schema.Json | undefined;
   } | {
     readonly _tag: "ConversationStoreError";
     readonly operation: string;
@@ -1428,25 +1497,8 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
     readonly message: string;
     readonly cause?: Schema.Json | undefined;
   } | {
-    readonly _tag: "OperationDenied";
-    readonly operation: "explain" | "observe" | "resolveApproval" | "resolveUnknown" | "retry" | "scanObligations" | "verify" | "wake";
-    readonly reason: string;
-    readonly conversationId?: string | undefined;
-    readonly submissionId?: string | undefined;
-  } | {
-    readonly _tag: "RetryRefused";
-    readonly submissionId: string;
-    readonly refusal: "await-approval-decision" | "await-unknown-resolution" | "settled";
-    readonly decisionTag: string;
-    readonly message: string;
-  } | {
-    readonly _tag: "RunJournalError";
+    readonly _tag: "HostProtocolError";
     readonly message: string;
-    readonly cause?: Schema.Json | undefined;
-  } | {
-    readonly _tag: "OwnershipLost";
-    readonly submissionId: string;
-    readonly actualEpoch: number;
   };
 }, Schema.SchemaError, never>;
 declare const decodeAdminResponse: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => Effect.Effect<AdminFailed | ExplainedRecovery | ObligationsScanned | RetryExecuted | VerifiedIntegrity, Schema.SchemaError, never>;
@@ -1471,12 +1523,58 @@ interface ConversationObjectClass {
   new (ctx: DurableObjectState, env: Cloudflare.Env): ConversationObjectInstance;
 }
 /**
- * Build the application's Conversation Object class (export it from the
- * Worker entry). The explicit return type is what makes declaration emit
- * possible: the class body carries a private runtime field, and TS4094
- * rejects inferring an exported anonymous class type around it.
+ * Build the application's Conversation Object class (export it from the Worker entry).
+ * `telemetry` is the host composition boundary: it may require the Object context/namespace and
+ * retain a typed acquisition error, while any additional output services remain available to the
+ * cached runtime. `TelemetryError` stays the first explicit generic for source compatibility;
+ * additional outputs infer from the Layer. Omitting it installs the content-free no-op service.
+ * The explicit return type is what makes declaration emit possible: the class body carries a
+ * private runtime field, and TS4094 rejects inferring an exported anonymous class type around it.
+ */
+declare const makeConversationObjectClass: <TelemetryError = never, AdditionalTelemetryOutputs = never>(options: ConversationObjectOptions, telemetry?: Layer.Layer<CloudflareRuntimeTelemetry | AdditionalTelemetryOutputs, TelemetryError, DurableObjectContext | ConversationObjectNamespace>) => ConversationObjectClass;
+//#endregion
+//#region src/code-mode-executor.d.ts
+/**
+ * The Cloudflare Dynamic Worker `CodeExecutor` adapter (C4 of ADR-0017;
+ * DEPLOY-011). Each pass loads one fresh Worker through the Worker Loader
+ * with `globalOutbound: null`, so generated code has no ambient network,
+ * bindings, or secrets; its only authority is the pass-scoped host stub that
+ * routes back to `CodeModeHostEntrypoint` and, from there, into the pass's
+ * `CodeExecutionHost` service. Platform CPU limits stop synchronous runaway
+ * programs; the executor-owned wall-clock deadline interrupts asynchronously
+ * suspended passes. Deployment class `E` only: the adapter records no
+ * persistent state and a later pass may run in a completely different
+ * isolate.
  */
-declare const makeConversationObjectClass: (options: ConversationObjectOptions) => ConversationObjectClass;
+declare const dynamicWorkerImplementation: SandboxImplementation;
+/** The narrow host stub the dynamic worker receives (Workers RPC). */
+interface CodeModeHostStub {
+  readonly call: (passId: string, hostCall: unknown) => Promise<unknown>;
+}
+/**
+ * The host-side RPC target for dynamic workers. The application exposes it
+ * from its Worker entry (`export { CodeModeHostEntrypoint }`) and hands the
+ * adapter a same-instance stub — `ctx.exports.CodeModeHostEntrypoint()` in
+ * production (a self service binding may reach a different instance and must
+ * not be used there); tests bind it through Miniflare's `kCurrentWorker`.
+ */
+declare class CodeModeHostEntrypoint extends WorkerEntrypoint {
+  call(passId: unknown, hostCall: unknown): Promise<unknown>;
+}
+interface DynamicWorkerCodeExecutorOptions {
+  /** The `worker_loader` binding. */
+  readonly loader: WorkerLoader;
+  /**
+   * A SAME-INSTANCE stub of `CodeModeHostEntrypoint`. In production create it
+   * with `ctx.exports.CodeModeHostEntrypoint()`; a cross-instance stub would
+   * dispatch host calls into an isolate without this pass's registry entry.
+   */
+  readonly hostStub: CodeModeHostStub;
+  /** Compatibility date for dynamic workers; defaults to `2025-05-01`. */
+  readonly compatibilityDate?: string | undefined;
+}
+/** Layer building the Dynamic Worker `CodeExecutor` from resolved bindings. */
+declare const dynamicWorkerCodeExecutorLayer: (options: DynamicWorkerCodeExecutorOptions) => Layer.Layer<CodeExecutor>;
 //#endregion
-export { AbortRecorded, AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, AdmissionLimitExceeded, ApprovalRecorded, CLOUDFLARE_DATABASE_CAP_BYTES, CLOUDFLARE_RUNTIME_DEFAULTS, ClientAbortFailure, ClientApprovalFailure, ClientAwaitFailure, ClientObserveFailure, ClientSubmitFailure, ClientUnknownFailure, CloudflareAdmissionLimitsValue, CloudflareBindingError, CloudflareConversationClient, CloudflareDurableRuntime, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflareDurableRuntimeInitializationError, CloudflareDurableRuntimeOptions, CloudflareDurableRuntimeServices, CloudflarePlatformConfigError, ConversationClientError, ConversationMaintenance, ConversationObjectClass, ConversationObjectIdentity, ConversationObjectInstance, ConversationObjectNamespace, ConversationObjectOptions, ConversationObjectPorts, ConversationObjectRpc, DEFAULT_MAX_DATABASE_BYTES, DurableAlarmError, DurableAlarmService, DurableObjectContext, ExplainedRecovery, HostFailed, HostFailure, HostProtocolError, HostResponse, MaintenancePassFailure, MaintenancePassReport, ObligationsScanned, ObservePageRequest, ObservedPage, RetryExecuted, SettlementReached, SubmitRequest, SubmitSucceeded, UnknownResolutionRecorded, VerifiedIntegrity, boundHostDiagnostic, cloudflareWakeSchedulerLayer, conversationNamespaceFromEnv, conversationNamespaceLayer, conversationPortTransportLayer, decodeAbortCommand, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeApprovalDecisionCommand, decodeHostResponse, decodeObligationThresholds, decodeObservePageRequest, decodeReceipt, decodeRetryCommand, decodeSubmitRequest, decodeUnknownResolutionCommand, encodeAbortCommand, encodeAdminResponse, encodeApprovalDecisionCommand, encodeHostResponse, encodeObservePageRequest, encodeReceipt, encodeSubmitRequest, encodeUnknownResolutionCommand, makeConversationObjectClass };
+export { AbortRecorded, AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, AdmissionLimitExceeded, ApprovalRecorded, CLOUDFLARE_DATABASE_CAP_BYTES, CLOUDFLARE_RUNTIME_DEFAULTS, ClientAbortFailure, ClientApprovalFailure, ClientAwaitFailure, ClientObserveFailure, ClientSubmitFailure, ClientUnknownFailure, CloudflareAdmissionLimitsValue, CloudflareBindingError, CloudflareBindingSource, CloudflareBindingSourceContext, CloudflareConversationClient, CloudflareDurableRuntime, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflareDurableRuntimeInitializationError, CloudflareDurableRuntimeOptions, CloudflareDurableRuntimeServices, CloudflarePlatformConfigError, CloudflareRuntimeTelemetry, CloudflareTelemetryExportError, CodeModeHostEntrypoint, CodeModeHostStub, ConversationClientError, ConversationMaintenance, ConversationObjectClass, ConversationObjectIdentity, ConversationObjectInstance, ConversationObjectNamespace, ConversationObjectOptions, ConversationObjectPorts, ConversationObjectRpc, DEFAULT_MAX_DATABASE_BYTES, DurableAlarmError, DurableAlarmService, DurableObjectContext, DynamicWorkerCodeExecutorOptions, ExplainedRecovery, HostFailed, HostFailure, HostProtocolError, HostResponse, MaintenancePassFailure, MaintenancePassReport, ObligationsScanned, ObservePageRequest, ObservedPage, RetryExecuted, SettlementReached, SubmitRequest, SubmitSucceeded, UnknownResolutionRecorded, VerifiedIntegrity, boundHostDiagnostic, cloudflareWakeSchedulerLayer, conversationNamespaceFromEnv, conversationNamespaceLayer, conversationPortTransportLayer, decodeAbortCommand, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeApprovalDecisionCommand, decodeHostResponse, decodeObligationThresholds, decodeObservePageRequest, decodeReceipt, decodeRetryCommand, decodeSubmitRequest, decodeUnknownResolutionCommand, dynamicWorkerCodeExecutorLayer, dynamicWorkerImplementation, encodeAbortCommand, encodeAdminResponse, encodeApprovalDecisionCommand, encodeHostResponse, encodeObservePageRequest, encodeReceipt, encodeSubmitRequest, encodeUnknownResolutionCommand, makeConversationObjectClass };
 //# sourceMappingURL=index.d.mts.map