@effect-agent/platform-cloudflare 0.0.1-beta.4 → 0.0.1-beta.6

package/dist/index.mjs

@@ -1,10 +1,11 @@
-import { Clock, Context, Duration, Effect, Layer, ManagedRuntime, Option, PubSub, Random, Ref, Schema, Stream } from "effect";
+import { Cause, Clock, Context, Duration, Effect, Exit, Fiber, Layer, ManagedRuntime, Option, PubSub, Random, Ref, Schema, Stream } from "effect";
 import { AbortCommand, AbortIntent, AdmissionConflict, AgentBindingResolver, AppendConflict, ApprovalConflict, ApprovalDecisionCommand, ApprovalDecisionIntent, CanonicalRecordEnvelope, CanonicalSequence, ConversationNotMaterialized, ConversationRead, ConversationStore, ConversationStoreError, DEFAULT_OWNERSHIP_LEASE_DURATION, DefinitionDigests, DeploymentId, DigestError, DurableAgentRuntime, DurableRuntimeConfig, DurableRuntimeFailpoint, DurableRuntimeFailpointError, FenceRejected, IdempotencyKey, IntegrityReport, JoinedToHost, LedgerError, ObligationReport, ObligationThresholds, OperationAuthorizationRequest, OperationAuthorizer, OperationDenied, OwnershipLost, PersistedJson, Principal, ProducerId, Receipt, RecoveryExplanation, RecoveryReport, RetryCommand, RetryRefused, RunJournalError, Settlement, SettlementConflict, SubmissionLedger, SubmissionLookupByKey, ToolReconciler, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, WakeScheduler } from "@effect-agent/session";
 import { ConversationPortTransport, DEFAULT_MAX_STORED_VALUE_BYTES, conversationStoreLayer, handleEncodedPortRequest, portTransportFailure, routedConversationStoreLayer, routedSubmissionLedgerLayer, storageConfigLayer, storageFailpointLayer, submissionLedgerLayer } from "@effect-agent/storage-cloudflare";
 import { AgentId, AgentInputError, ConversationId, SubmissionId } from "@effect-agent/core";
 import { BrowserCrypto } from "@effect/platform-browser";
 import { SqliteClient } from "@effect/sql-sqlite-do";
-import { DurableObject } from "cloudflare:workers";
+import { DurableObject, WorkerEntrypoint } from "cloudflare:workers";
+import { CodeExecutionHost, CodeExecutionProtocolError, CodeExecutionResourceUse, CodeExecutionResult, CodeExecutionTimeoutError, CodeExecutor, CodeExecutorStartError, CodeExecutorTerminatedError, CodeExecutorUnsupportedError, CodeHostCall, CodeHostCallLimitError, CodeOutputLimitError, CodeProgramFailedError, CodeSourceError, SandboxImplementation } from "@effect-agent/sandbox";
 //#region src/bindings.ts
 /**
 * Cloudflare platform bindings as Effect services (DEPLOY-010: "Cloudflare platform bindings
@@ -13,7 +14,7 @@ import { DurableObject } from "cloudflare:workers";
 * per incarnation and everything downstream consumes the services.
 */
 /** A Cloudflare platform binding was missing or carried the wrong shape (DEPLOY-003/010). */
-var CloudflareBindingError = class extends Schema.TaggedErrorClass()("CloudflareBindingError", {
+var CloudflareBindingError = class extends Schema.TaggedError()("CloudflareBindingError", {
 	binding: Schema.String,
 	message: Schema.String
 }) {};
@@ -76,7 +77,7 @@ var ConversationObjectIdentity = class extends Context.Service()("@effect-agent/
 const PositiveMillis = Schema.Int.check(Schema.isGreaterThan(0));
 const NonNegativeMillis = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
 /** The supplied Cloudflare durable runtime configuration failed validation (DEPLOY-003). */
-var CloudflarePlatformConfigError = class extends Schema.TaggedErrorClass()("CloudflarePlatformConfigError", {
+var CloudflarePlatformConfigError = class extends Schema.TaggedError()("CloudflarePlatformConfigError", {
 	message: Schema.String,
 	cause: Schema.optionalKey(Schema.Defect())
 }) {};
@@ -88,7 +89,7 @@ var CloudflarePlatformConfigError = class extends Schema.TaggedErrorClass()("Clo
 * Conversation Object's submit entry point before `DurableAgentRuntime.submit` runs, and
 * nothing was admitted or written.
 */
-var AdmissionLimitExceeded = class extends Schema.TaggedErrorClass()("AdmissionLimitExceeded", {
+var AdmissionLimitExceeded = class extends Schema.TaggedError()("AdmissionLimitExceeded", {
 	limit: Schema.Literals([
 		"queue-depth",
 		"input-bytes",
@@ -146,6 +147,8 @@ var CloudflareDurableRuntimeConfigValue = class extends Schema.Class("@effect-ag
 	abortPollInterval: PositiveMillis,
 	/** Canonical observation poll cadence of the Durable Object store. */
 	observationPollInterval: NonNegativeMillis,
+	/** Cooperative background-export budget; native Object delivery never awaits the flush. */
+	telemetryFlushTimeout: PositiveMillis,
 	/** Per-value byte bound; must stay under the platform's 2 MB SQLite value limit. */
 	maxStoredValueBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2e6)),
 	/** Opt-in full payload/digest-chain audit while opening the store. */
@@ -164,6 +167,7 @@ const CLOUDFLARE_RUNTIME_DEFAULTS = {
 	leaseRenewalInterval: 1e4,
 	abortPollInterval: 500,
 	observationPollInterval: 25,
+	telemetryFlushTimeout: 2e3,
 	maxStoredValueBytes: DEFAULT_MAX_STORED_VALUE_BYTES,
 	verifyOnOpen: false,
 	maxQueueDepthPerLane: 256,
@@ -185,7 +189,7 @@ const CLOUDFLARE_RUNTIME_DEFAULTS = {
 * alarms are harmless by design: a pass over an all-settled lane simply deletes the slot.
 */
 /** The Durable Object alarm API failed; surfaces on host entry points as a typed refusal. */
-var DurableAlarmError = class extends Schema.TaggedErrorClass()("DurableAlarmError", {
+var DurableAlarmError = class extends Schema.TaggedError()("DurableAlarmError", {
 	operation: Schema.String,
 	message: Schema.String,
 	cause: Schema.optionalKey(Schema.Defect())
@@ -351,7 +355,7 @@ var ConversationMaintenance = class ConversationMaintenance extends Context.Serv
 */
 const WAKE_BUFFER_CAPACITY = 1024;
 /** A remote wake stub call failed; always swallowed and logged (hints are droppable). */
-var RemoteWakeDropped = class extends Schema.TaggedErrorClass()("RemoteWakeDropped", {
+var RemoteWakeDropped = class extends Schema.TaggedError()("RemoteWakeDropped", {
 	conversationId: Schema.String,
 	message: Schema.String,
 	cause: Schema.optionalKey(Schema.Defect())
@@ -411,6 +415,31 @@ const conversationPortTransportLayer = Layer.effect(ConversationPortTransport)(E
 	}).pipe(Effect.withSpan("CloudflarePortTransport.call", { attributes: { conversationId } })) });
 }));
 //#endregion
+//#region src/telemetry.ts
+/** A host exporter failed during one coalesced background export attempt. */
+var CloudflareTelemetryExportError = class extends Schema.TaggedError()("CloudflareTelemetryExportError", { 
+/** The original exporter failure, retained for host-side diagnostics. */
+cause: Schema.Defect() }) {};
+/**
+* Host-owned exporter lifecycle for one Cloudflare Conversation Object incarnation.
+*
+* The platform package creates measurements but deliberately does not select an exporter or
+* vendor. Native entrypoint instrumentation consumes this service at the Worker composition edge;
+* applications pass its provider as the second `makeConversationObjectClass` argument together
+* with their Effect Logger, Tracer, and Metric layers. That provider may read `DurableObjectContext` or
+* `ConversationObjectNamespace`, and its typed acquisition error remains visible in construction.
+* `flush` must attempt to export every configured signal. After the native span closes, the
+* Conversation Object reserves it into a shared post-settlement batch before `ctx.waitUntil` under
+* a cooperative timeout. Only each pending/trailing/queued batch's first owner registers its
+* shared Promise. Cycles remain capped at one first exporter attempt plus at most one trailing
+* attempt, with one queued cycle while trailing runs; exporter completion never holds endpoint
+* delivery open and exporter failure never replaces endpoint behavior.
+*/
+var CloudflareRuntimeTelemetry = class CloudflareRuntimeTelemetry extends Context.Service()("@effect-agent/platform-cloudflare/CloudflareRuntimeTelemetry") {
+	/** Content-free default selected by `makeConversationObjectClass` when no host Layer is passed. */
+	static layerNoop = Layer.succeed(CloudflareRuntimeTelemetry)({ flush: Effect.void });
+};
+//#endregion
 //#region src/layers.ts
 /**
 * Owner-side endpoint body for the Conversation Object's `portCall` (plan §1.3): decode,
@@ -433,6 +462,7 @@ const configFromOptions = (options) => decodeConfigValue({
 	leaseRenewalInterval: options.leaseRenewalInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.leaseRenewalInterval,
 	abortPollInterval: options.abortPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.abortPollInterval,
 	observationPollInterval: options.observationPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.observationPollInterval,
+	telemetryFlushTimeout: options.telemetryFlushTimeout ?? CLOUDFLARE_RUNTIME_DEFAULTS.telemetryFlushTimeout,
 	maxStoredValueBytes: options.maxStoredValueBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxStoredValueBytes,
 	verifyOnOpen: options.verifyOnOpen ?? CLOUDFLARE_RUNTIME_DEFAULTS.verifyOnOpen,
 	limits: {
@@ -453,7 +483,10 @@ const conversationIdFromState = (ctx) => ctx.id.name === void 0 ? Effect.fail(Cl
 	message: `The Durable Object name is not a valid ConversationId: ${error.message}`,
 	cause: error
 })));
-const resolveBindings = (bindings) => bindings === void 0 ? Effect.succeed([]) : Effect.isEffect(bindings) ? bindings : Effect.succeed(bindings);
+const resolveBindings = (source, context) => source === void 0 ? Effect.succeed([]) : Effect.isEffect(source) ? source : typeof source === "function" ? Effect.suspend(() => {
+	const bindings = source(context);
+	return Effect.isEffect(bindings) ? bindings : Effect.succeed(bindings);
+}) : Effect.succeed(source);
 /**
 * The DC Layer assembly (deployment §12: a Layer-assembly library, not an app entrypoint;
 * plan §1.4). `layer(options)` decodes the configuration, derives this Object's Conversation
@@ -467,14 +500,14 @@ const resolveBindings = (bindings) => bindings === void 0 ? Effect.succeed([]) :
 * Storage compatibility is verified during construction: an incompatible database fails the
 * Layer typed (`DoStorageCompatibilityError`) before anything is mutated (DEPLOY-008).
 *
-* Requires only the two binding services (`DurableObjectContext`,
-* `ConversationObjectNamespace`) — platform values enter exclusively through Layers
-* (DEPLOY-010).
+* Requires the two binding services (`DurableObjectContext`, `ConversationObjectNamespace`).
+* Host observability belongs to the Worker composition edge because native entrypoint lifecycle
+* instrumentation, rather than this durable runtime assembly, consumes it (DEPLOY-010).
 */
 var CloudflareDurableRuntime = class {
 	static layer(options) {
 		return Layer.unwrap(Effect.gen(function* () {
-			const { ctx } = yield* DurableObjectContext;
+			const { ctx, env } = yield* DurableObjectContext;
 			const config = yield* configFromOptions(options);
 			const conversationId = yield* conversationIdFromState(ctx);
 			const producerId = yield* decodeProducerId(`${config.producerPrefix}:${conversationId}`).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
@@ -515,7 +548,12 @@ var CloudflareDurableRuntime = class {
 			}));
 			const runtimeFailpointLayer = options.runtimeFailpoint === void 0 ? DurableRuntimeFailpoint.layer : Layer.succeed(DurableRuntimeFailpoint)({ hit: options.runtimeFailpoint(ctx) });
 			const reconcilerLayer = options.toolReconciler ?? ToolReconciler.uncertain;
-			const bindingResolverLayer = Layer.effect(AgentBindingResolver)(Effect.map(resolveBindings(options.bindings), AgentBindingResolver.fromBindings));
+			const bindingResolverLayer = Layer.effect(AgentBindingResolver)(Effect.map(resolveBindings(options.bindings, {
+				ctx,
+				env,
+				conversationId,
+				producerId
+			}), (bindings) => AgentBindingResolver.fromBindings(bindings)));
 			const base = Layer.mergeAll(identityLayer, cloudflareConfigLayer, DurableAlarmService.layer);
 			const runtimeStack = DurableAgentRuntime.layer.pipe(Layer.provideMerge(routedPorts), Layer.provideMerge(cloudflareWakeSchedulerLayer), Layer.provideMerge(runtimeConfigLayer), Layer.provideMerge(bindingResolverLayer), Layer.provide(Layer.mergeAll(runtimeFailpointLayer, reconcilerLayer, BrowserCrypto.layer)), Layer.provideMerge(base));
 			return Layer.mergeAll(runtimeStack, ConversationMaintenance.layer.pipe(Layer.provide(runtimeStack)), portsEndpointLayer);
@@ -541,9 +579,9 @@ const boundHostDiagnostic = (value) => value.length > MAX_HOST_DIAGNOSTIC_LENGTH
 * The envelope itself could not be honored: the Object could not decode the request, or a
 * response could not be encoded/decoded. Never carries operation semantics.
 */
-var HostProtocolError = class extends Schema.TaggedErrorClass()("HostProtocolError", { message: BoundedDiagnostic }) {};
+var HostProtocolError = class extends Schema.TaggedError()("HostProtocolError", { message: BoundedDiagnostic }) {};
 /** The Worker-side stub call itself failed (RPC rejection, overload, eviction mid-call). */
-var ConversationClientError = class extends Schema.TaggedErrorClass()("ConversationClientError", {
+var ConversationClientError = class extends Schema.TaggedError()("ConversationClientError", {
 	conversationId: Schema.String,
 	message: Schema.String,
 	cause: Schema.optionalKey(Schema.Defect())
@@ -770,6 +808,258 @@ var CloudflareConversationClient = class CloudflareConversationClient extends Co
 	}));
 };
 //#endregion
+//#region src/telemetry-internal.ts
+/** Bounded typed control signal used only while a native entrypoint span is active. */
+var CloudflareNativeSpanFailure = class extends Error {
+	name = "ConversationObjectDeliveryFailed";
+	constructor() {
+		super("Cloudflare Conversation Object delivery failed");
+	}
+};
+const stripCloudflareNativeSpanFailures = (cause) => {
+	if (!cause.reasons.some((reason) => Cause.isFailReason(reason) && reason.error instanceof CloudflareNativeSpanFailure)) return {
+		found: false,
+		residual: cause
+	};
+	const reasons = cause.reasons.filter((reason) => {
+		if (Cause.isFailReason(reason) && reason.error instanceof CloudflareNativeSpanFailure) return false;
+		return true;
+	});
+	return {
+		found: true,
+		residual: Cause.fromReasons(reasons)
+	};
+};
+/**
+* @internal Replace an entrypoint Cause with a bounded typed marker inside a span, then remove
+* only that marker and restore the exact invocation-local Cause plus any newly composed reasons.
+*/
+const withCloudflareNativeSpanFailure = (effect, trace) => Effect.suspend(() => {
+	let original;
+	return trace(effect.pipe(Effect.catchCause((cause) => {
+		original = cause;
+		return Effect.fail(new CloudflareNativeSpanFailure());
+	}))).pipe(Effect.catchCause((cause) => {
+		const { found, residual } = stripCloudflareNativeSpanFailures(cause);
+		if (!found) return Effect.failCause(residual);
+		const restored = original === void 0 ? residual : Cause.combine(original, residual);
+		return Effect.failCause(restored);
+	}));
+});
+const logCloudflareTelemetryCause = (cause) => {
+	const kinds = /* @__PURE__ */ new Set();
+	for (const reason of cause.reasons) if (Cause.isFailReason(reason)) kinds.add(Cause.isTimeoutError(reason.error) ? "timeout" : "exporter");
+	else if (Cause.isDieReason(reason)) kinds.add("defect");
+	else kinds.add("interrupted");
+	return Effect.forEach(kinds, (kind) => {
+		return (kind === "defect" ? Effect.logError("Cloudflare telemetry flush defect") : Effect.logWarning(kind === "exporter" ? "Cloudflare telemetry exporter failed" : kind === "timeout" ? "Cloudflare telemetry flush exceeded its time budget" : "Cloudflare telemetry flush interrupted")).pipe(Effect.annotateLogs({ "effect_agent.cloudflare.telemetry.failure_kind": kind }));
+	}, { discard: true });
+};
+/**
+* @internal Cooperative background flush budget. Interruptible exporters stop at the configured
+* timeout; uninterruptible exporters remain bounded by Cloudflare's waitUntil lifecycle instead
+* of holding the native delivery open.
+*/
+const flushCloudflareRuntimeTelemetry = (timeoutMillis) => Effect.flatMap(CloudflareRuntimeTelemetry, ({ flush }) => flush).pipe(Effect.interruptible, Effect.timeout(Duration.millis(timeoutMillis)), Effect.onExit((exit) => Exit.isFailure(exit) ? logCloudflareTelemetryCause(exit.cause) : Effect.void), Effect.asVoid);
+/** @internal Convert the shared exporter result into the always-fulfilled waitUntil bridge. */
+const fulfillCloudflareTelemetryBackground = (result) => result.then(() => void 0, () => void 0);
+const makeFlushBatch = () => {
+	let resolveResult = () => void 0;
+	let rejectResult = (_cause) => void 0;
+	const result = new Promise((resolve, reject) => {
+		resolveResult = resolve;
+		rejectResult = reject;
+	});
+	let resolveReady = () => void 0;
+	const ready = new Promise((resolve) => {
+		resolveReady = resolve;
+	});
+	return {
+		result,
+		background: fulfillCloudflareTelemetryBackground(result),
+		resolveResult,
+		rejectResult,
+		ready,
+		resolveReady,
+		phase: "pending",
+		reservations: 0,
+		unsettledDeliveries: 0,
+		dropDiagnosed: false
+	};
+};
+const makeFlushCycle = () => {
+	let resolveCycle = () => void 0;
+	let rejectCycle = (_cause) => void 0;
+	const promise = new Promise((resolve, reject) => {
+		resolveCycle = resolve;
+		rejectCycle = reject;
+	});
+	fulfillCloudflareTelemetryBackground(promise);
+	return {
+		promise,
+		resolve: resolveCycle,
+		reject: rejectCycle,
+		first: makeFlushBatch(),
+		phase: "pending",
+		trailing: void 0
+	};
+};
+/**
+* @internal Coordinate exporter attempts for one Conversation Object incarnation. Each cycle is
+* capped at a first attempt plus one trailing attempt. Each batch is reserved synchronously and
+* waits for every delivery assigned to it before exporting. Only the first owner of the pending,
+* trailing, or queued batch registers that batch's shared background Promise, so a stalled
+* exporter cannot accumulate per-delivery waitUntil registrations. Each batch retains at most
+* `MAX_CLOUDFLARE_TELEMETRY_BATCH_DELIVERIES` settlement Promises; excess deliveries are lossy-
+* coalesced into the already-requested export without settlement ownership and diagnosed once for
+* that batch. Failures remain rejected by the raw cycle after every requested attempt runs; each
+* shared waitUntil bridge always fulfills.
+*/
+const makeCloudflareTelemetryFlushCoordinator = (flush, options = {}) => {
+	let active;
+	let queued;
+	const closeBatch = (batch) => {
+		if (batch.phase !== "pending") return;
+		batch.phase = "waiting";
+		if (batch.unsettledDeliveries === 0) batch.resolveReady();
+	};
+	const cancelBatch = (batch) => {
+		if (batch.phase === "settled" || batch.phase === "cancelled") return;
+		batch.phase = "cancelled";
+		batch.resolveReady();
+		batch.resolveResult();
+	};
+	const reserveDelivery = (batch, delivery) => {
+		if (batch.reservations >= 64) {
+			if (!batch.dropDiagnosed) {
+				batch.dropDiagnosed = true;
+				try {
+					options.onReservationDropped?.();
+				} catch {}
+			}
+			return {
+				owner: false,
+				dropped: true
+			};
+		}
+		const owner = batch.reservations === 0;
+		batch.reservations += 1;
+		batch.unsettledDeliveries += 1;
+		const settled = () => {
+			batch.unsettledDeliveries -= 1;
+			if (batch.phase === "waiting" && batch.unsettledDeliveries === 0) batch.resolveReady();
+		};
+		delivery.then(settled, settled);
+		return {
+			owner,
+			dropped: false
+		};
+	};
+	const runCycle = async (cycle) => {
+		const failures = [];
+		const runAttempt = async () => {
+			try {
+				await flush();
+			} catch (cause) {
+				failures.push(cause);
+			}
+		};
+		const runBatch = async (batch) => {
+			closeBatch(batch);
+			await batch.ready;
+			if (batch.phase === "cancelled") return;
+			batch.phase = "running";
+			const failureStart = failures.length;
+			await runAttempt();
+			batch.phase = "settled";
+			if (failures.length === failureStart) batch.resolveResult();
+			else batch.rejectResult(failures[failures.length - 1]);
+		};
+		try {
+			cycle.phase = "first";
+			await runBatch(cycle.first);
+			const trailing = cycle.trailing;
+			if (trailing !== void 0) {
+				cycle.phase = "trailing";
+				await runBatch(trailing);
+			}
+			cycle.phase = "settling";
+			options.onSettling?.();
+		} finally {
+			const next = queued;
+			queued = void 0;
+			active = next;
+			if (next !== void 0) startCycle(next);
+		}
+		if (failures.length === 0) return;
+		if (failures.length === 1) throw failures[0];
+		throw new AggregateError(failures, `${failures.length} Cloudflare telemetry flush attempts failed`);
+	};
+	const startCycle = (cycle) => {
+		Promise.resolve().then(() => runCycle(cycle)).then(cycle.resolve, cycle.reject);
+	};
+	const reserve = (delivery) => {
+		let cycle;
+		let batch;
+		let shouldStart = false;
+		if (active === void 0) {
+			cycle = makeFlushCycle();
+			active = cycle;
+			batch = cycle.first;
+			shouldStart = true;
+		} else if (active.phase === "pending" && active.first.phase !== "cancelled") {
+			cycle = active;
+			batch = active.first;
+		} else if (active.phase === "first") {
+			cycle = active;
+			batch = active.trailing ??= makeFlushBatch();
+		} else {
+			if (queued === void 0) queued = makeFlushCycle();
+			cycle = queued;
+			batch = queued.first;
+		}
+		const { dropped, owner } = reserveDelivery(batch, delivery);
+		if (shouldStart) startCycle(cycle);
+		return {
+			background: batch.background,
+			cycle: cycle.promise,
+			owner,
+			dropped,
+			cancel: () => {
+				if (!owner) return;
+				cancelBatch(batch);
+				if (cycle.trailing === batch && cycle.phase === "first") cycle.trailing = void 0;
+				else if (queued === cycle && active !== cycle) {
+					queued = void 0;
+					cycle.resolve();
+				}
+			}
+		};
+	};
+	return { reserve };
+};
+/**
+* @internal Reserve telemetry before registration without allowing a synchronous platform failure
+* to replace the already-running native delivery Promise. Only a batch owner calls waitUntil; its
+* shared bridge is already always fulfilled, and registration failure cancels export for that
+* unowned batch.
+*/
+const registerCloudflareTelemetryAfterNativeSettlement = (waitUntil, delivery, reserve, diagnoseRegistrationFailure) => {
+	const reservation = reserve(delivery);
+	if (!reservation.owner) return delivery;
+	try {
+		waitUntil(reservation.background);
+	} catch (cause) {
+		reservation.cancel();
+		try {
+			diagnoseRegistrationFailure(cause);
+		} catch {}
+	}
+	return delivery;
+};
+/** @internal Content-free diagnostic for a rejected Cloudflare waitUntil registration. */
+const logCloudflareWaitUntilRegistrationFailure = (_cause) => Effect.logError("Cloudflare telemetry waitUntil registration failed").pipe(Effect.annotateLogs({ "effect_agent.cloudflare.telemetry.failure_kind": "wait_until_registration" }));
+//#endregion
 //#region src/conversation-object.ts
 /** Port envelope tags whose owner-side execution durably mutates this Object's lane. */
 const MUTATING_PORT_TAGS = /* @__PURE__ */ new Set([
@@ -1009,62 +1299,643 @@ const gateEndpoint = Effect.gen(function* () {
 	yield* (yield* ConversationMaintenance).ensureAlarm;
 });
 /**
-* Build the application's Conversation Object class (export it from the
-* Worker entry). The explicit return type is what makes declaration emit
-* possible: the class body carries a private runtime field, and TS4094
-* rejects inferring an exported anonymous class type around it.
+* Owner-side delivery measurement. The exact endpoint Cause is hidden behind a bounded typed
+* marker while the span closes, then restored together with any newly composed real reasons.
 */
-const makeConversationObjectClass = (options) => {
+const observeNativeEntrypoint = (entrypoint, effect) => Effect.gen(function* () {
+	const identity = yield* ConversationObjectIdentity;
+	const config = yield* CloudflareDurableRuntimeConfig;
+	return yield* withCloudflareNativeSpanFailure(effect, (masked) => masked.pipe(Effect.withSpan(`effect_agent.cloudflare.conversation_object.${entrypoint}`, {
+		kind: "server",
+		attributes: {
+			"effect_agent.cloudflare.entrypoint": entrypoint,
+			"effect_agent.deployment.id": config.deploymentId,
+			conversationId: identity.conversationId,
+			producerId: identity.producerId
+		}
+	})));
+});
+const flushNativeEntrypointTelemetry = Effect.flatMap(CloudflareDurableRuntimeConfig, (config) => flushCloudflareRuntimeTelemetry(config.telemetryFlushTimeout));
+/**
+* Build the application's Conversation Object class (export it from the Worker entry).
+* `telemetry` is the host composition boundary: it may require the Object context/namespace and
+* retain a typed acquisition error, while any additional output services remain available to the
+* cached runtime. `TelemetryError` stays the first explicit generic for source compatibility;
+* additional outputs infer from the Layer. Omitting it installs the content-free no-op service.
+* The explicit return type is what makes declaration emit possible: the class body carries a
+* private runtime field, and TS4094 rejects inferring an exported anonymous class type around it.
+*/
+const makeConversationObjectClass = (options, telemetry) => {
 	class ConversationObject extends DurableObject {
 		#runtime;
+		#ctx;
+		#telemetryFlush;
 		constructor(ctx, env) {
 			super(ctx, env);
-			this.#runtime = ManagedRuntime.make(CloudflareDurableRuntime.layer(options).pipe(Layer.provideMerge(Layer.mergeAll(DurableObjectContext.layer(ctx, env), conversationNamespaceLayer(env, options.namespaceBinding)))));
+			this.#ctx = ctx;
+			const platform = Layer.mergeAll(DurableObjectContext.layer(ctx, env), conversationNamespaceLayer(env, options.namespaceBinding));
+			const hostTelemetry = (telemetry ?? CloudflareRuntimeTelemetry.layerNoop).pipe(Layer.provideMerge(platform));
+			this.#runtime = ManagedRuntime.make(CloudflareDurableRuntime.layer(options).pipe(Layer.provideMerge(hostTelemetry)));
+			this.#telemetryFlush = makeCloudflareTelemetryFlushCoordinator(() => this.#runtime.runPromise(flushNativeEntrypointTelemetry), { onReservationDropped: () => {
+				this.#runtime.runSyncExit(Effect.logWarning("Cloudflare telemetry delivery coalesced at the batch reservation limit").pipe(Effect.annotateLogs({ "effect_agent.cloudflare.telemetry.failure_kind": "reservation_limit" })));
+			} });
 			ctx.blockConcurrencyWhile(() => this.#runtime.runPromise(gateEndpoint));
 		}
+		#runNative(entrypoint, effect) {
+			return registerCloudflareTelemetryAfterNativeSettlement((background) => this.#ctx.waitUntil(background), this.#runtime.runPromise(observeNativeEntrypoint(entrypoint, effect)), this.#telemetryFlush.reserve, (cause) => {
+				this.#runtime.runSyncExit(logCloudflareWaitUntilRegistrationFailure(cause));
+			});
+		}
 		async submitEncoded(encoded) {
-			return this.#runtime.runPromise(submitEndpoint(encoded));
+			return this.#runNative("submit", submitEndpoint(encoded));
 		}
 		async awaitSettlementEncoded(encoded) {
-			return this.#runtime.runPromise(awaitSettlementEndpoint(encoded));
+			return this.#runNative("await_settlement", awaitSettlementEndpoint(encoded));
 		}
 		async observePage(encoded) {
-			return this.#runtime.runPromise(observePageEndpoint(encoded));
+			return this.#runNative("observe", observePageEndpoint(encoded));
 		}
 		async abortEncoded(encoded) {
-			return this.#runtime.runPromise(abortEndpoint(encoded));
+			return this.#runNative("abort", abortEndpoint(encoded));
 		}
 		async resolveApprovalEncoded(encoded) {
-			return this.#runtime.runPromise(resolveApprovalEndpoint(encoded));
+			return this.#runNative("resolve_approval", resolveApprovalEndpoint(encoded));
 		}
 		async resolveUnknownEncoded(encoded) {
-			return this.#runtime.runPromise(resolveUnknownEndpoint(encoded));
+			return this.#runNative("resolve_unknown", resolveUnknownEndpoint(encoded));
 		}
 		async explainEncoded(encoded) {
-			return this.#runtime.runPromise(explainEndpoint(encoded));
+			return this.#runNative("explain", explainEndpoint(encoded));
 		}
 		async verifyEncoded(encoded) {
-			return this.#runtime.runPromise(verifyEndpoint(encoded));
+			return this.#runNative("verify", verifyEndpoint(encoded));
 		}
 		async retryEncoded(encoded) {
-			return this.#runtime.runPromise(retryEndpoint(encoded));
+			return this.#runNative("retry", retryEndpoint(encoded));
 		}
 		async obligationsEncoded(encoded) {
-			return this.#runtime.runPromise(obligationsEndpoint(encoded));
+			return this.#runNative("obligations", obligationsEndpoint(encoded));
 		}
 		async portCall(encoded) {
-			return this.#runtime.runPromise(portCallEndpoint(encoded));
+			return this.#runNative("port_call", portCallEndpoint(encoded));
 		}
 		async wake() {
-			await this.#runtime.runPromise(wakeEndpoint);
+			await this.#runNative("wake", wakeEndpoint);
 		}
 		async alarm() {
-			await this.#runtime.runPromise(alarmEndpoint);
+			await this.#runNative("alarm", alarmEndpoint);
 		}
 	}
 	return ConversationObject;
 };
 //#endregion
-export { AbortRecorded, AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, AdmissionLimitExceeded, ApprovalRecorded, CLOUDFLARE_DATABASE_CAP_BYTES, CLOUDFLARE_RUNTIME_DEFAULTS, CloudflareAdmissionLimitsValue, CloudflareBindingError, CloudflareConversationClient, CloudflareDurableRuntime, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError, ConversationClientError, ConversationMaintenance, ConversationObjectIdentity, ConversationObjectNamespace, ConversationObjectPorts, DEFAULT_MAX_DATABASE_BYTES, DurableAlarmError, DurableAlarmService, DurableObjectContext, ExplainedRecovery, HostFailed, HostFailure, HostProtocolError, HostResponse, MaintenancePassReport, ObligationsScanned, ObservePageRequest, ObservedPage, RetryExecuted, SettlementReached, SubmitRequest, SubmitSucceeded, UnknownResolutionRecorded, VerifiedIntegrity, boundHostDiagnostic, cloudflareWakeSchedulerLayer, conversationNamespaceFromEnv, conversationNamespaceLayer, conversationPortTransportLayer, decodeAbortCommand, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeApprovalDecisionCommand, decodeHostResponse, decodeObligationThresholds, decodeObservePageRequest, decodeReceipt, decodeRetryCommand, decodeSubmitRequest, decodeUnknownResolutionCommand, encodeAbortCommand, encodeAdminResponse, encodeApprovalDecisionCommand, encodeHostResponse, encodeObservePageRequest, encodeReceipt, encodeSubmitRequest, encodeUnknownResolutionCommand, makeConversationObjectClass };
+//#region src/code-mode-executor.ts
+/**
+* The Cloudflare Dynamic Worker `CodeExecutor` adapter (C4 of ADR-0017;
+* DEPLOY-011). Each pass loads one fresh Worker through the Worker Loader
+* with `globalOutbound: null`, so generated code has no ambient network,
+* bindings, or secrets; its only authority is the pass-scoped host stub that
+* routes back to `CodeModeHostEntrypoint` and, from there, into the pass's
+* `CodeExecutionHost` service. Platform CPU limits stop synchronous runaway
+* programs; the executor-owned wall-clock deadline interrupts asynchronously
+* suspended passes. Deployment class `E` only: the adapter records no
+* persistent state and a later pass may run in a completely different
+* isolate.
+*/
+const dynamicWorkerImplementation = SandboxImplementation.make({
+	isolation: "isolated",
+	identity: "cloudflare-dynamic-worker"
+});
+/**
+* Live passes by identity. Entries are Scope-managed: registered when a pass
+* opens and removed by its finalizer, so a stale harness (or a forged
+* `passId`) cannot reach any host authority.
+*/
+const passRegistry = /* @__PURE__ */ new Map();
+/**
+* The host-side RPC target for dynamic workers. The application exposes it
+* from its Worker entry (`export { CodeModeHostEntrypoint }`) and hands the
+* adapter a same-instance stub — `ctx.exports.CodeModeHostEntrypoint()` in
+* production (a self service binding may reach a different instance and must
+* not be used there); tests bind it through Miniflare's `kCurrentWorker`.
+*/
+var CodeModeHostEntrypoint = class extends WorkerEntrypoint {
+	async call(passId, hostCall) {
+		const pass = passRegistry.get(String(passId));
+		if (pass === void 0) throw new Error("Unknown Code Mode pass");
+		return pass.dispatch(hostCall);
+	}
+};
+/**
+* The fixed harness loaded as the dynamic worker's main module. The generated
+* source becomes `program.mjs` (`export default (<expression>);`) — a module,
+* never `eval`. The harness installs namespace globals and a bounded console,
+* imports the program, invokes it exactly once, and returns one envelope the
+* host validates through Effect Schema.
+*/
+const HARNESS_MODULE = String.raw`
+import { WorkerEntrypoint } from "cloudflare:workers";
+import programDefault from "./program.js";
+
+const encoder = new TextEncoder();
+const utf8 = (text) => encoder.encode(text).byteLength;
+const safeText = (value) => {
+  try {
+    if (value instanceof Error) return (value.name + ": " + value.message).slice(0, 4000);
+    if (typeof value === "string") return value.slice(0, 4000);
+    const encoded = JSON.stringify(value);
+    return (encoded === undefined ? String(value) : encoded).slice(0, 4000);
+  } catch {
+    return "[unserializable value]";
+  }
+};
+const safeJson = (value) => {
+  try {
+    const encoded = JSON.stringify(value);
+    if (encoded !== undefined && encoded.length <= 4000) return JSON.parse(encoded);
+  } catch {}
+  return safeText(value);
+};
+
+export default class CodeModeHarness extends WorkerEntrypoint {
+  async run() {
+    const config = JSON.parse(this.env.CODE_MODE_PASS);
+    const host = this.env.CODE_MODE_HOST;
+    const limits = config.limits;
+    const logs = [];
+    let logBytes = 0;
+    let fatal;
+    const boundedLogs = () => logs.slice(0, 4096);
+    const write = (...values) => {
+      const joined = values.map(safeText).join(" ");
+      const line = joined.length > 16000 ? joined.slice(0, 15999) + "…" : joined;
+      const bytes = utf8(line);
+      if (logs.length >= 4096 || logBytes + bytes > limits.maxLogBytes) {
+        fatal = fatal ?? { _tag: "log-limit", observed: logBytes + bytes, logs: boundedLogs() };
+        throw new Error("code-mode log limit exceeded");
+      }
+      logs.push(line);
+      logBytes += bytes;
+    };
+    globalThis.console = { log: write, info: write, warn: write, error: write, debug: write };
+
+    let hostCalls = 0;
+    const makeMethod = (namespace, method) => async (argument) => {
+      hostCalls += 1;
+      if (hostCalls > limits.maxHostCalls) {
+        fatal = fatal ?? { _tag: "host-call-limit", logs: boundedLogs() };
+        throw new Error("code-mode host-call limit exceeded");
+      }
+      let argText;
+      try {
+        argText = JSON.stringify(argument);
+      } catch {}
+      if (argText === undefined || utf8(argText) > limits.maxHostCallArgumentBytes) {
+        fatal = fatal ?? {
+          _tag: "argument-limit",
+          observed: argText === undefined ? 0 : utf8(argText),
+          logs: boundedLogs(),
+        };
+        throw new Error("code-mode host-call argument limit exceeded");
+      }
+      const outcome = await host.call(config.passId, {
+        namespace,
+        method,
+        argument: JSON.parse(argText),
+      });
+      if (outcome !== null && typeof outcome === "object" && outcome._tag === "CodeHostCallSuccess") {
+        return outcome.value;
+      }
+      if (outcome !== null && typeof outcome === "object" && outcome._tag === "CodeHostCallFailure") {
+        throw outcome.error;
+      }
+      fatal = fatal ?? { _tag: "protocol", message: "host returned an unrecognized outcome" };
+      throw new Error("code-mode host protocol violation");
+    };
+    for (const namespace of config.namespaces) {
+      const methods = {};
+      for (const method of namespace.methods) {
+        methods[method] = makeMethod(namespace.name, method);
+      }
+      globalThis[namespace.name] = methods;
+    }
+
+    // program.js is imported statically at the top of this module, so a
+    // syntactically invalid program fails the whole harness at load (mapped
+    // to a source error by the host). Using a static import keeps this module
+    // free of dynamic-import expressions, which single-script Miniflare hosts
+    // reject. The isolation boundary does NOT depend on the ordering of this
+    // import versus the console/namespace shims installed below: the loaded
+    // Worker has globalOutbound: null and no bindings, secrets, or env from
+    // the Worker Loader config BEFORE any module in the graph evaluates, so
+    // module-level program code has no ambient authority regardless. The
+    // shims below are usability wrappers (bounded console, namespace globals),
+    // and the accepted program is a single async-function expression whose
+    // body runs only when invoked here — after the shims exist.
+    const program = programDefault;
+    if (typeof program !== "function") {
+      return { _tag: "source-not-a-function", actual: typeof program };
+    }
+    try {
+      const value = await program();
+      if (fatal !== undefined) return fatal;
+      let text;
+      try {
+        text = JSON.stringify(value);
+      } catch {}
+      if (text === undefined) {
+        return {
+          _tag: "program-failed",
+          reason: "non-json-result",
+          thrown: null,
+          message: "The program must return a JSON value",
+          logs: boundedLogs(),
+        };
+      }
+      const resultBytes = utf8(text);
+      if (resultBytes > limits.maxResultBytes) {
+        return { _tag: "result-limit", observed: resultBytes, logs: boundedLogs() };
+      }
+      return {
+        _tag: "completed",
+        value: JSON.parse(text),
+        logs: boundedLogs(),
+        hostCalls,
+        logBytes,
+        resultBytes,
+      };
+    } catch (cause) {
+      if (fatal !== undefined) return fatal;
+      return {
+        _tag: "program-failed",
+        reason: cause instanceof Error ? "threw" : "rejected",
+        thrown: safeJson(cause),
+        message: safeText(cause),
+        logs: boundedLogs(),
+      };
+    }
+  }
+}
+`;
+const BoundedLogs = Schema.Array(Schema.String.check(Schema.isMaxLength(16 * 1024))).check(Schema.isMaxLength(4096));
+const HarnessCompleted = Schema.Struct({
+	_tag: Schema.Literal("completed"),
+	value: Schema.Json,
+	logs: BoundedLogs,
+	hostCalls: Schema.Natural,
+	logBytes: Schema.Natural,
+	resultBytes: Schema.Natural
+});
+const HarnessSourceInvalid = Schema.Struct({
+	_tag: Schema.Literal("source-invalid"),
+	message: Schema.String
+});
+const HarnessNotAFunction = Schema.Struct({
+	_tag: Schema.Literal("source-not-a-function"),
+	actual: Schema.String
+});
+const HarnessProgramFailed = Schema.Struct({
+	_tag: Schema.Literal("program-failed"),
+	reason: Schema.Literals([
+		"threw",
+		"rejected",
+		"non-json-result"
+	]),
+	thrown: Schema.Json,
+	message: Schema.String,
+	logs: BoundedLogs
+});
+const HarnessLogLimit = Schema.Struct({
+	_tag: Schema.Literal("log-limit"),
+	observed: Schema.Natural,
+	logs: BoundedLogs
+});
+const HarnessArgumentLimit = Schema.Struct({
+	_tag: Schema.Literal("argument-limit"),
+	observed: Schema.Natural,
+	logs: BoundedLogs
+});
+const HarnessResultLimit = Schema.Struct({
+	_tag: Schema.Literal("result-limit"),
+	observed: Schema.Natural,
+	logs: BoundedLogs
+});
+const HarnessHostCallLimit = Schema.Struct({
+	_tag: Schema.Literal("host-call-limit"),
+	logs: BoundedLogs
+});
+const HarnessProtocol = Schema.Struct({
+	_tag: Schema.Literal("protocol"),
+	message: Schema.String
+});
+const HarnessOutcome = Schema.Union([
+	HarnessCompleted,
+	HarnessSourceInvalid,
+	HarnessNotAFunction,
+	HarnessProgramFailed,
+	HarnessLogLimit,
+	HarnessArgumentLimit,
+	HarnessResultLimit,
+	HarnessHostCallLimit,
+	HarnessProtocol
+]);
+const decodeHarnessOutcome = (value) => {
+	try {
+		return Schema.decodeUnknownOption(HarnessOutcome)(value);
+	} catch {
+		return Option.none();
+	}
+};
+const decodeHostCall = (value) => {
+	try {
+		return Schema.decodeUnknownOption(CodeHostCall)(value);
+	} catch {
+		return Option.none();
+	}
+};
+/**
+* Project a host outcome to the plain JSON envelope the harness reads. A
+* `CodeExecutionHost` may return either real `CodeHostCallResult` instances
+* (the substitute and conformance kit) or plain-object equivalents (the Code
+* Mode capability's broker route), so this reads the shared fields rather than
+* `Schema.encodeSync`, which would reject a plain object.
+*/
+const hostResultEnvelope = (outcome) => outcome._tag === "CodeHostCallSuccess" ? {
+	_tag: "CodeHostCallSuccess",
+	value: outcome.value
+} : {
+	_tag: "CodeHostCallFailure",
+	error: outcome.error
+};
+const utf8ByteLength = (value) => {
+	let total = 0;
+	for (const character of value) {
+		const codePoint = character.codePointAt(0) ?? 0;
+		total += codePoint <= 127 ? 1 : codePoint <= 2047 ? 2 : codePoint <= 65535 ? 3 : 4;
+	}
+	return total;
+};
+const encodedJsonByteLength = (value) => {
+	try {
+		const encoded = JSON.stringify(value);
+		return encoded === void 0 ? void 0 : utf8ByteLength(encoded);
+	} catch {
+		return;
+	}
+};
+/** Reserved global names the harness owns inside the dynamic worker. */
+const reservedHarnessGlobals = /* @__PURE__ */ new Set(["console"]);
+const passCounterState = { next: 0 };
+const makeExecute = (options) => Effect.fn("DynamicWorkerCodeExecutor.execute")(function* (request) {
+	if (request.network._tag !== "NetworkDisabled") return yield* CodeExecutorUnsupportedError.make({
+		implementation: dynamicWorkerImplementation,
+		feature: "network",
+		message: "The Dynamic Worker executor denies all egress with globalOutbound: null; an allowlist is not supported in the first slice"
+	});
+	const sourceBytes = utf8ByteLength(request.source);
+	if (sourceBytes > request.limits.maxSourceBytes) return yield* CodeSourceError.make({
+		implementation: dynamicWorkerImplementation,
+		reason: "oversized",
+		message: `Source is ${sourceBytes} bytes; the request allows ${request.limits.maxSourceBytes}`
+	});
+	for (const namespace of request.namespaces) if (reservedHarnessGlobals.has(namespace.name)) return yield* CodeExecutorUnsupportedError.make({
+		implementation: dynamicWorkerImplementation,
+		feature: "namespaces",
+		message: `Namespace ${namespace.name} collides with a harness binding`
+	});
+	const host = yield* CodeExecutionHost;
+	passCounterState.next += 1;
+	const passId = `code-mode-pass-${passCounterState.next}-${crypto.randomUUID()}`;
+	const pending = [];
+	let wake;
+	let issuedHostCalls = 0;
+	const dispatch = (hostCall) => new Promise((resolve, reject) => {
+		issuedHostCalls += 1;
+		if (issuedHostCalls > request.limits.maxHostCalls + 1) {
+			reject(/* @__PURE__ */ new Error("host-call limit exceeded"));
+			return;
+		}
+		pending.push({
+			hostCall,
+			resolve,
+			reject
+		});
+		wake?.();
+	});
+	yield* Effect.acquireRelease(Effect.sync(() => {
+		passRegistry.set(passId, { dispatch });
+	}), () => Effect.sync(() => {
+		passRegistry.delete(passId);
+	}));
+	const nextPending = Effect.suspend(() => {
+		const item = pending.shift();
+		if (item !== void 0) return Effect.succeed(item);
+		return Effect.callback((resume) => {
+			wake = () => {
+				wake = void 0;
+				const next = pending.shift();
+				if (next !== void 0) resume(Effect.succeed(next));
+			};
+		});
+	});
+	const serveHostCalls = Effect.gen(function* () {
+		let served = 0;
+		while (true) {
+			const item = yield* nextPending;
+			served += 1;
+			if (served > request.limits.maxHostCalls) return yield* CodeHostCallLimitError.make({
+				implementation: dynamicWorkerImplementation,
+				limit: request.limits.maxHostCalls,
+				logs: []
+			});
+			const decoded = decodeHostCall(item.hostCall);
+			if (Option.isNone(decoded)) {
+				item.reject(/* @__PURE__ */ new TypeError("host calls must match the CodeHostCall schema"));
+				continue;
+			}
+			const outcome = yield* host.call(decoded.value);
+			if (outcome._tag === "CodeHostCallSuccess") {
+				const bytes = encodedJsonByteLength(outcome.value);
+				if (bytes === void 0 || bytes > request.limits.maxHostCallResultBytes) return yield* CodeOutputLimitError.make({
+					implementation: dynamicWorkerImplementation,
+					surface: "host-call-result",
+					limit: request.limits.maxHostCallResultBytes,
+					observed: bytes ?? 0,
+					logs: []
+				});
+			}
+			item.resolve(hostResultEnvelope(outcome));
+		}
+	});
+	const workerCode = {
+		compatibilityDate: options.compatibilityDate ?? "2025-05-01",
+		allowExperimental: true,
+		mainModule: "harness.js",
+		modules: {
+			"harness.js": HARNESS_MODULE,
+			"program.js": `export default (\n${request.source}\n);`
+		},
+		env: {
+			CODE_MODE_HOST: options.hostStub,
+			CODE_MODE_PASS: JSON.stringify({
+				passId,
+				namespaces: request.namespaces.map((namespace) => ({
+					name: namespace.name,
+					methods: namespace.methods
+				})),
+				limits: {
+					maxLogBytes: request.limits.maxLogBytes,
+					maxResultBytes: request.limits.maxResultBytes,
+					maxHostCalls: request.limits.maxHostCalls,
+					maxHostCallArgumentBytes: request.limits.maxHostCallArgumentBytes
+				}
+			})
+		},
+		globalOutbound: null,
+		...request.limits.cpuMillis === void 0 ? {} : { limits: {
+			cpuMs: request.limits.cpuMillis,
+			subRequests: request.limits.maxHostCalls + 8
+		} }
+	};
+	const startedAt = yield* Clock.currentTimeMillis;
+	const worker = yield* Effect.acquireRelease(Effect.try({
+		try: () => options.loader.load(workerCode),
+		catch: (cause) => {
+			const text = cause instanceof Error ? cause.message : String(cause);
+			if (/syntaxerror|failed to (compile|parse)/i.test(text)) return CodeSourceError.make({
+				implementation: dynamicWorkerImplementation,
+				reason: "invalid",
+				message: text.slice(0, 8e3)
+			});
+			return CodeExecutorStartError.make({
+				implementation: dynamicWorkerImplementation,
+				message: `The Worker Loader rejected the pass: ${text}`.slice(0, 8e3),
+				cause
+			});
+		}
+	}), (stub) => Effect.sync(() => {
+		stub[Symbol.dispose]?.();
+	}));
+	const server = yield* serveHostCalls.pipe(Effect.forkScoped);
+	const rpc = Effect.tryPromise({
+		try: async () => {
+			return await worker.getEntrypoint().run();
+		},
+		catch: (cause) => classifyWorkerFailure(cause, request.limits.maxWallTime)
+	});
+	const raw = yield* Effect.raceFirst(rpc, Fiber.join(server)).pipe(Effect.timeoutOrElse({
+		duration: request.limits.maxWallTime,
+		orElse: () => CodeExecutionTimeoutError.make({
+			implementation: dynamicWorkerImplementation,
+			kind: "wall-clock",
+			maxWallTime: request.limits.maxWallTime,
+			logs: []
+		})
+	}), Effect.ensuring(Fiber.interrupt(server)));
+	const finishedAt = yield* Clock.currentTimeMillis;
+	const outcome = decodeHarnessOutcome(raw);
+	if (Option.isNone(outcome)) return yield* CodeExecutionProtocolError.make({
+		implementation: dynamicWorkerImplementation,
+		message: "The dynamic worker returned a value outside the harness envelope schema"
+	});
+	switch (outcome.value._tag) {
+		case "completed": return CodeExecutionResult.make({
+			implementation: dynamicWorkerImplementation,
+			value: outcome.value.value,
+			logs: outcome.value.logs,
+			resourceUse: CodeExecutionResourceUse.make({
+				wallTime: Duration.millis(Math.max(0, finishedAt - startedAt)),
+				hostCalls: outcome.value.hostCalls,
+				logBytes: outcome.value.logBytes,
+				resultBytes: outcome.value.resultBytes
+			})
+		});
+		case "source-invalid": return yield* CodeSourceError.make({
+			implementation: dynamicWorkerImplementation,
+			reason: "invalid",
+			message: outcome.value.message.slice(0, 8e3)
+		});
+		case "source-not-a-function": return yield* CodeSourceError.make({
+			implementation: dynamicWorkerImplementation,
+			reason: "not-a-function",
+			message: `The source expression evaluated to ${outcome.value.actual}; it must evaluate to one async function`
+		});
+		case "program-failed": return yield* CodeProgramFailedError.make({
+			implementation: dynamicWorkerImplementation,
+			reason: outcome.value.reason,
+			thrown: outcome.value.thrown,
+			message: outcome.value.message.slice(0, 8e3),
+			logs: outcome.value.logs
+		});
+		case "log-limit": return yield* CodeOutputLimitError.make({
+			implementation: dynamicWorkerImplementation,
+			surface: "logs",
+			limit: request.limits.maxLogBytes,
+			observed: outcome.value.observed,
+			logs: outcome.value.logs
+		});
+		case "argument-limit": return yield* CodeOutputLimitError.make({
+			implementation: dynamicWorkerImplementation,
+			surface: "host-call-argument",
+			limit: request.limits.maxHostCallArgumentBytes,
+			observed: outcome.value.observed,
+			logs: outcome.value.logs
+		});
+		case "result-limit": return yield* CodeOutputLimitError.make({
+			implementation: dynamicWorkerImplementation,
+			surface: "result",
+			limit: request.limits.maxResultBytes,
+			observed: outcome.value.observed,
+			logs: outcome.value.logs
+		});
+		case "host-call-limit": return yield* CodeHostCallLimitError.make({
+			implementation: dynamicWorkerImplementation,
+			limit: request.limits.maxHostCalls,
+			logs: outcome.value.logs
+		});
+		case "protocol": return yield* CodeExecutionProtocolError.make({
+			implementation: dynamicWorkerImplementation,
+			message: outcome.value.message.slice(0, 8e3)
+		});
+	}
+});
+/**
+* Expected worker-level failures map into the typed union with bounded
+* diagnostics; anything unrecognized stays a start/termination error rather
+* than a fabricated program result.
+*/
+const classifyWorkerFailure = (cause, maxWallTime) => {
+	const text = (() => {
+		try {
+			return cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause);
+		} catch {
+			return "[unserializable worker failure]";
+		}
+	})();
+	if (/syntaxerror|failed to (compile|parse)/i.test(text)) return CodeSourceError.make({
+		implementation: dynamicWorkerImplementation,
+		reason: "invalid",
+		message: text.slice(0, 8e3)
+	});
+	if (/cpu/i.test(text)) return CodeExecutionTimeoutError.make({
+		implementation: dynamicWorkerImplementation,
+		kind: "cpu",
+		maxWallTime,
+		logs: []
+	});
+	if (/failed to start worker/i.test(text)) return CodeExecutorStartError.make({
+		implementation: dynamicWorkerImplementation,
+		message: text.slice(0, 8e3),
+		cause
+	});
+	return CodeExecutorTerminatedError.make({
+		implementation: dynamicWorkerImplementation,
+		message: text.slice(0, 8e3)
+	});
+};
+/** Layer building the Dynamic Worker `CodeExecutor` from resolved bindings. */
+const dynamicWorkerCodeExecutorLayer = (options) => Layer.succeed(CodeExecutor)(CodeExecutor.of({ execute: makeExecute(options) }));
+//#endregion
+export { AbortRecorded, AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, AdmissionLimitExceeded, ApprovalRecorded, CLOUDFLARE_DATABASE_CAP_BYTES, CLOUDFLARE_RUNTIME_DEFAULTS, CloudflareAdmissionLimitsValue, CloudflareBindingError, CloudflareConversationClient, CloudflareDurableRuntime, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError, CloudflareRuntimeTelemetry, CloudflareTelemetryExportError, CodeModeHostEntrypoint, ConversationClientError, ConversationMaintenance, ConversationObjectIdentity, ConversationObjectNamespace, ConversationObjectPorts, DEFAULT_MAX_DATABASE_BYTES, DurableAlarmError, DurableAlarmService, DurableObjectContext, ExplainedRecovery, HostFailed, HostFailure, HostProtocolError, HostResponse, MaintenancePassReport, ObligationsScanned, ObservePageRequest, ObservedPage, RetryExecuted, SettlementReached, SubmitRequest, SubmitSucceeded, UnknownResolutionRecorded, VerifiedIntegrity, boundHostDiagnostic, cloudflareWakeSchedulerLayer, conversationNamespaceFromEnv, conversationNamespaceLayer, conversationPortTransportLayer, decodeAbortCommand, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeApprovalDecisionCommand, decodeHostResponse, decodeObligationThresholds, decodeObservePageRequest, decodeReceipt, decodeRetryCommand, decodeSubmitRequest, decodeUnknownResolutionCommand, dynamicWorkerCodeExecutorLayer, dynamicWorkerImplementation, encodeAbortCommand, encodeAdminResponse, encodeApprovalDecisionCommand, encodeHostResponse, encodeObservePageRequest, encodeReceipt, encodeSubmitRequest, encodeUnknownResolutionCommand, makeConversationObjectClass };
 
 //# sourceMappingURL=index.mjs.map