@effect-agent/platform-cloudflare 0.0.1-beta.6 → 0.1.0-beta.100

package/src/internal/layers.ts

@@ -0,0 +1,756 @@
+import { doMessageDeliveryStoreLayer } from "@effect-agent/storage-cloudflare/do-message-delivery-store";
+import {
+  type DoStorageFailpointHandler,
+  type DoStorageFailpoint,
+} from "@effect-agent/storage-cloudflare/do-storage-failpoint";
+import { submissionLedgerLayer } from "@effect-agent/storage-cloudflare/do-submission-ledger";
+import {
+  threadStoreLayer,
+  storageConfigLayer,
+  storageFailpointLayer,
+  type DoStorageInitializationError,
+  type DoStorageOptions,
+} from "@effect-agent/storage-cloudflare/do-thread-store";
+import {
+  type PortRequest,
+  type PortResponse,
+} from "@effect-agent/storage-cloudflare/port-protocol";
+import {
+  executePortRequest,
+  routedThreadStoreLayer,
+  routedSubmissionLedgerLayer,
+} from "@effect-agent/storage-cloudflare/port-routing";
+import { BrowserCrypto } from "@effect/platform-browser";
+import { SqliteClient } from "@effect/sql-sqlite-do";
+import {
+  type Crypto,
+  Cause,
+  Context,
+  Duration,
+  Effect,
+  Layer,
+  Schema,
+  Semaphore,
+  type Option,
+} from "effect";
+import {
+  compileRegistrations,
+  type AgentRegistration,
+  type ResolvedBinding,
+} from "effect-agent/agent-registration";
+import { type DigestError } from "effect-agent/digest";
+import { DurableAgentRuntime, DurableRuntimeConfig } from "effect-agent/durable-agent-runtime";
+import {
+  DurableRuntimeFailpoint,
+  type DurableRuntimeFailpointHandler,
+} from "effect-agent/durable-failpoint";
+import { ThreadId, type SubmissionId } from "effect-agent/identifiers";
+import {
+  type MessageDeliveryStore,
+  MessageDeliveryDriver,
+  type MessageDeliveryError,
+} from "effect-agent/message-delivery";
+import {
+  operationAuthorizerLayer,
+  type OperationAuthorizerService,
+} from "effect-agent/operation-authorizer";
+import { type PreparedInputAdmission } from "effect-agent/prepared-input-admission";
+import { ProducerId } from "effect-agent/records";
+import {
+  type RunContextPreparation,
+  type RunCostEstimator,
+  type RunToolFailureObserver,
+} from "effect-agent/run-options";
+import {
+  CurrentToolFailureObserver,
+  RunContextPreparationPassthrough,
+  RunToolAuthorization,
+  toolFailureObserverLayer,
+} from "effect-agent/run-options";
+import {
+  LedgerError,
+  SubmissionLedger,
+  SubmissionLookupById,
+  type SubmissionSnapshot,
+} from "effect-agent/submission-ledger";
+import { ThreadProjectionMaintenance } from "effect-agent/thread-projection-maintenance";
+import { ThreadStoreError, ThreadStore } from "effect-agent/thread-store";
+import { ToolReconciler } from "effect-agent/tool-reconciler";
+import { type WakeScheduler } from "effect-agent/wake-scheduler";
+import { SqlClient } from "effect/unstable/sql/SqlClient";
+
+import {
+  ThreadMaintenance,
+  ThreadMutationGate,
+  ThreadPublication,
+  publishCommitted,
+  ThreadMaintenanceFailpoint,
+  DurableAlarmService,
+  type ThreadMaintenanceFailpointHandler,
+} from "../Alarm.ts";
+import {
+  ThreadObjectIdentity,
+  ThreadObjectPlacement,
+  DurableObjectContext,
+  type ThreadObjectNamespace,
+} from "../CloudflareBindings.ts";
+import {
+  CLOUDFLARE_RUNTIME_DEFAULTS,
+  CloudflareDurableRuntimeConfig,
+  CloudflareDurableRuntimeConfigValue,
+  CloudflarePlatformConfigError,
+} from "../CloudflareConfig.ts";
+import { CloudflareThreadClient } from "../CloudflareThreadClient.ts";
+import { cloudflareWakeSchedulerLayer } from "../WakeScheduler.ts";
+import {
+  guardedMessageDeliveryStoreLayer,
+  threadMessageDeliveryLayer,
+} from "./message-delivery.ts";
+import { cloudflarePreparedInputAdmissionLayer } from "./prepared-admission.ts";
+import { ProgressWaitRegistry } from "./progress-wait.ts";
+import { threadPortTransportLayer } from "./transport.ts";
+
+/**
+ * Raw (unvalidated) construction options for `ThreadObject.make`, mirroring
+ * `NodeDurableAgentRuntimeOptions`. Optional fields default to the documented production values
+ * (`CLOUDFLARE_RUNTIME_DEFAULTS`); everything is schema-decoded into
+ * `CloudflareDurableRuntimeConfigValue` before any resource opens (deployment §5 gate 1).
+ */
+export interface CloudflareDurableRuntimeOptions {
+  readonly deploymentId: string;
+  /** Head of the minted producer identity `{producerPrefix}:{threadId}`. */
+  readonly producerPrefix: string;
+  /** Milliseconds; default 30s (D5). */
+  readonly ownershipLeaseDuration?: number | undefined;
+  /** Milliseconds; default 100. */
+  readonly alarmBackoffBase?: number | undefined;
+  /** Failed/no-progress exponential backoff ceiling in milliseconds; default 5000. */
+  readonly alarmBackoffCap?: number | undefined;
+  /** Fallback scan cadence for newly dirty work in milliseconds; default 1000. */
+  readonly wakeScanInterval?: number | undefined;
+  /** Milliseconds; default 500. */
+  readonly settlementPollInterval?: number | undefined;
+  /** Milliseconds; default 10000. */
+  readonly leaseRenewalInterval?: number | undefined;
+  /** Milliseconds; default 500. */
+  readonly abortPollInterval?: number | undefined;
+  /** Deployment-owned pricing authority used by durable cost budgets and settlements. */
+  readonly estimateCostMicrousd?: RunCostEstimator | undefined;
+  /** Closed trusted Tool failure reporting. Omission masks ambient observers at construction. */
+  readonly toolFailureObserver?: RunToolFailureObserver | undefined;
+  /** Milliseconds; default 25. */
+  readonly observationPollInterval?: number | undefined;
+  /** Whole disposable projection wave in milliseconds, 1..300000; default 30000. */
+  readonly projectionDispatchTimeoutMillis?: number | undefined;
+  /** Bytes; default just under the 2 MB platform value limit. */
+  readonly maxStoredValueBytes?: number | undefined;
+  /** Default false. */
+  readonly verifyOnOpen?: boolean | undefined;
+  /** Nonterminal Submissions per lane before admission refuses; default 256. */
+  readonly maxQueueDepthPerLane?: number | undefined;
+  /** Encoded input bytes per Submission; default = the stored-value bound. */
+  readonly maxInputBytes?: number | undefined;
+  /** `ctx.storage.sql.databaseSize` ceiling at admission; default 9 GB (10 GB platform cap). */
+  readonly maxDatabaseBytes?: number | undefined;
+  /**
+   * Durable Object storage fault injection (`ledger:*` / `append:*` locations). Handlers are
+   * constructed per incarnation WITH the live `DurableObjectState`, so eviction harnesses can
+   * map an armed hit to `ctx.abort()` — the platform's real failure mode. Default none.
+   */
+  readonly storageFailpoint?: ((ctx: DurableObjectState) => DoStorageFailpointHandler) | undefined;
+  /** Coordinator fault injection (`submit:*` / `terminalize:*` locations); default none. */
+  readonly runtimeFailpoint?:
+    | ((ctx: DurableObjectState) => DurableRuntimeFailpointHandler)
+    | undefined;
+  /** Thread-maintenance generation/alarm fault injection; default none. */
+  readonly maintenanceFailpoint?:
+    | ((ctx: DurableObjectState) => ThreadMaintenanceFailpointHandler)
+    | undefined;
+  /** Host-supplied fail-closed authorization policy; defaults to service possession. */
+  readonly operationAuthorizer?: OperationAuthorizerService | undefined;
+  /**
+   * Reconciliation policy consulted for open ordinary Tool Calls before an Unknown Outcome
+   * is recorded (durability §10, DUR-009). Defaults to the fail-closed
+   * `ToolReconciler.uncertain`.
+   */
+  readonly toolReconciler?: Layer.Layer<ToolReconciler> | undefined;
+}
+
+/** Services supplied before the application graph is built, including its dependencies. */
+export type CloudflareBootstrapServices =
+  | CloudflareDurableRuntimeConfig
+  | ThreadObjectIdentity
+  | ThreadObjectPlacement
+  | DurableRuntimeConfig
+  | Crypto.Crypto
+  | DoStorageFailpoint
+  | DurableRuntimeFailpoint
+  | ThreadMaintenanceFailpoint
+  | RunContextPreparation
+  | RunToolAuthorization
+  | ToolReconciler;
+
+/** Every construction failure of the assembled Cloudflare durable runtime stack. */
+export type CloudflareDurableRuntimeInitializationError =
+  | CloudflarePlatformConfigError
+  | DigestError
+  | MessageDeliveryError
+  | DoStorageInitializationError;
+
+/**
+ * The services `ThreadObject.layer` provides, including its single owner SQL client.
+ * Its Context also supplies ThreadMessageDelivery (a defaulted Reference, with no required R)
+ * so application-composed maintenance retains the same native message recovery capability.
+ */
+export type CloudflareDurableRuntimeServices =
+  | DurableAgentRuntime
+  | SubmissionLedger
+  | ThreadStore
+  | MessageDeliveryStore
+  | WakeScheduler
+  | DurableAlarmService
+  | ThreadMaintenance
+  | ThreadMutationGate
+  | ThreadPublication
+  | ThreadProjectionMaintenance
+  | ThreadObjectPorts
+  | ProgressWaitRegistry
+  | SqlClient;
+
+/**
+ * Owner-side execution port for a `portCall` request the wire endpoint has already decoded.
+ * It executes against THIS Object's LOCAL port facets — never the routed decorators, so a
+ * request cannot bounce between Objects — and returns the typed response for the endpoint to
+ * encode.
+ */
+export class ThreadObjectPorts extends Context.Service<
+  ThreadObjectPorts,
+  {
+    readonly handle: (request: PortRequest) => Effect.Effect<PortResponse>;
+    /** Local-only identity check before a bound RPC can read or mutate a Submission. */
+    readonly lookupSubmission: (
+      submissionId: SubmissionId,
+    ) => Effect.Effect<Option.Option<SubmissionSnapshot>, LedgerError>;
+  }
+>()("@effect-agent/platform-cloudflare/ThreadObjectPorts") {}
+
+const decodeConfigValue = Schema.decodeUnknownEffect(CloudflareDurableRuntimeConfigValue);
+const decodeThreadId = Schema.decodeUnknownEffect(ThreadId);
+const decodeProducerId = Schema.decodeUnknownEffect(ProducerId);
+
+const configFromOptions = (
+  options: CloudflareDurableRuntimeOptions,
+): Effect.Effect<CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError> =>
+  decodeConfigValue({
+    deploymentId: options.deploymentId,
+    producerPrefix: options.producerPrefix,
+    ownershipLeaseDuration:
+      options.ownershipLeaseDuration ?? CLOUDFLARE_RUNTIME_DEFAULTS.ownershipLeaseDuration,
+    alarmBackoffBase: options.alarmBackoffBase ?? CLOUDFLARE_RUNTIME_DEFAULTS.alarmBackoffBase,
+    alarmBackoffCap: options.alarmBackoffCap ?? CLOUDFLARE_RUNTIME_DEFAULTS.alarmBackoffCap,
+    wakeScanInterval: options.wakeScanInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.wakeScanInterval,
+    settlementPollInterval:
+      options.settlementPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.settlementPollInterval,
+    leaseRenewalInterval:
+      options.leaseRenewalInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.leaseRenewalInterval,
+    abortPollInterval: options.abortPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.abortPollInterval,
+    observationPollInterval:
+      options.observationPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.observationPollInterval,
+    projectionDispatchTimeoutMillis:
+      options.projectionDispatchTimeoutMillis ??
+      CLOUDFLARE_RUNTIME_DEFAULTS.projectionDispatchTimeoutMillis,
+    maxStoredValueBytes:
+      options.maxStoredValueBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxStoredValueBytes,
+    verifyOnOpen: options.verifyOnOpen ?? CLOUDFLARE_RUNTIME_DEFAULTS.verifyOnOpen,
+    limits: {
+      maxQueueDepthPerLane:
+        options.maxQueueDepthPerLane ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxQueueDepthPerLane,
+      maxInputBytes: Math.min(
+        options.maxInputBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxInputBytes,
+        options.maxStoredValueBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxStoredValueBytes,
+      ),
+      maxDatabaseBytes: options.maxDatabaseBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxDatabaseBytes,
+    },
+  }).pipe(
+    Effect.mapError((error) =>
+      CloudflarePlatformConfigError.make({
+        message: `Invalid Cloudflare durable runtime configuration: ${error.message}`,
+        cause: error,
+      }),
+    ),
+  );
+
+/**
+ * The Thread this Object owns, from the Object identity rule (plan §1.2): Thread
+ * Objects are addressed exclusively by `idFromName(threadId)`, so `ctx.id.name` IS the
+ * Thread ID. An unnamed Object (from `newUniqueId`) is a deployment error, not a lane.
+ */
+const threadIdFromState = (
+  ctx: DurableObjectState,
+): Effect.Effect<ThreadId, CloudflarePlatformConfigError> =>
+  ctx.id.name === undefined
+    ? Effect.fail(
+        CloudflarePlatformConfigError.make({
+          message:
+            "This Durable Object was not created via idFromName(threadId); Thread " +
+            "Objects must be addressed by their Thread identity (plan §1.2).",
+        }),
+      )
+    : decodeThreadId(ctx.id.name).pipe(
+        Effect.mapError((error) =>
+          CloudflarePlatformConfigError.make({
+            message: `The Durable Object name is not a valid ThreadId: ${error.message}`,
+            cause: error,
+          }),
+        ),
+      );
+
+/**
+ * Validate deployment settings and derive services before building application dependencies.
+ * The native class factory builds this Layer inside its constructor gate. Custom Effect hosts
+ * can provide it around the complete application Layer with the native context already supplied.
+ */
+const runtimeConfigLayer = (
+  options: CloudflareDurableRuntimeOptions,
+  producerId: ProducerId,
+): Layer.Layer<
+  Exclude<CloudflareBootstrapServices, ThreadObjectIdentity | ThreadObjectPlacement>,
+  CloudflarePlatformConfigError,
+  DurableObjectContext
+> =>
+  Layer.unwrap(
+    Effect.gen(function* () {
+      const { ctx } = yield* DurableObjectContext;
+      const config = yield* configFromOptions(options);
+
+      return Layer.mergeAll(
+        Layer.succeed(CloudflareDurableRuntimeConfig, config),
+        DurableRuntimeConfig.layer({
+          deploymentId: config.deploymentId,
+          producerId,
+          settlementPollInterval: Duration.millis(config.settlementPollInterval),
+          leaseRenewalInterval: Duration.millis(config.leaseRenewalInterval),
+          abortPollInterval: Duration.millis(config.abortPollInterval),
+          ...(options.estimateCostMicrousd === undefined
+            ? {}
+            : { estimateCostMicrousd: options.estimateCostMicrousd }),
+        }),
+        BrowserCrypto.layer,
+        storageFailpointLayer({ storage: ctx.storage, failpoint: options.storageFailpoint?.(ctx) }),
+        options.runtimeFailpoint === undefined
+          ? DurableRuntimeFailpoint.layer
+          : Layer.succeed(DurableRuntimeFailpoint, { hit: options.runtimeFailpoint(ctx) }),
+        options.maintenanceFailpoint === undefined
+          ? ThreadMaintenanceFailpoint.layer
+          : Layer.succeed(ThreadMaintenanceFailpoint, {
+              hit: options.maintenanceFailpoint(ctx),
+            }),
+        options.toolReconciler ?? ToolReconciler.uncertain,
+        options.operationAuthorizer === undefined
+          ? Layer.empty
+          : operationAuthorizerLayer(options.operationAuthorizer),
+        options.toolFailureObserver === undefined
+          ? Layer.succeed(CurrentToolFailureObserver, undefined)
+          : toolFailureObserverLayer(options.toolFailureObserver),
+        RunContextPreparationPassthrough,
+        RunToolAuthorization.allowAll,
+      );
+    }),
+  );
+
+const producerIdentity = (prefix: string, owner: string) =>
+  decodeProducerId(`${prefix}:${owner}`).pipe(
+    Effect.mapError((error) =>
+      CloudflarePlatformConfigError.make({
+        message: `The minted producer identity is invalid: ${error.message}`,
+        cause: error,
+      }),
+    ),
+  );
+
+/** Native one-Thread configuration; retains its existing producer and logical identities. */
+export const layerConfig = (
+  options: CloudflareDurableRuntimeOptions,
+): Layer.Layer<CloudflareBootstrapServices, CloudflarePlatformConfigError, DurableObjectContext> =>
+  Layer.unwrap(
+    Effect.gen(function* () {
+      const { ctx } = yield* DurableObjectContext;
+      const threadId = yield* threadIdFromState(ctx);
+      const producerId = yield* producerIdentity(options.producerPrefix, threadId);
+
+      return Layer.mergeAll(
+        runtimeConfigLayer(options, producerId),
+        Layer.succeed(ThreadObjectIdentity, { threadId, producerId }),
+        Layer.succeed(ThreadObjectPlacement, { ownsThread: (target) => target === threadId }),
+      );
+    }),
+  );
+
+/**
+ * Configuration for an application Object owning several logical Threads. The producer is
+ * the stable physical Object. No logical identity is installed globally: handleRpc binds and
+ * validates it per request using the placement guard and this actual runtime producer.
+ */
+export const layerHostConfig = (
+  options: CloudflareDurableRuntimeOptions,
+  ownsThread: (threadId: ThreadId) => boolean,
+): Layer.Layer<
+  Exclude<CloudflareBootstrapServices, ThreadObjectIdentity>,
+  CloudflarePlatformConfigError,
+  DurableObjectContext
+> =>
+  Layer.unwrap(
+    Effect.gen(function* () {
+      const { ctx } = yield* DurableObjectContext;
+      const producerId = yield* producerIdentity(options.producerPrefix, ctx.id.toString());
+
+      return Layer.merge(
+        runtimeConfigLayer(options, producerId),
+        Layer.succeed(ThreadObjectPlacement, { ownsThread }),
+      );
+    }),
+  );
+
+export interface ThreadPublicationOptions<E = never, R = never, P = never> {
+  /**
+   * Optional host outbox consumer, built once per incarnation with RAW LOCAL ThreadStore and
+   * SubmissionLedger services. Yield DurableObjectContext and ThreadObjectIdentity for native
+   * bindings and identity. Initialization is local-only, inside the constructor gate; setup
+   * errors and additional requirements remain in the returned Layer. Layer.effect owns Scope.
+   * Canonical appends and durable approval, abort and unknown-resolution intents invalidate
+   * publication after commit. Custom host facts must use ThreadMaintenance.withMutation.
+   */
+  readonly publication?: Layer.Layer<ThreadPublication, E, R>;
+  /**
+   * Disposable index maintenance, built once with the raw local ThreadStore and owner
+   * SqlClient. Additional services P are exposed by the returned Layer, allowing Tool
+   * handlers and maintenance to share one index instance. Construction is local-only.
+   * Live committed batches run before append returns; bounded backfill uses the native
+   * alarm without delaying execution behind projection backlog.
+   */
+  readonly projection?: Layer.Layer<ThreadProjectionMaintenance | P, E, R>;
+}
+
+/**
+ * Register typed Agents and version declarations. Hashing and dependency capture happen in
+ * this Layer's Scope, after application Layers have been provided. Every Agent's instruction,
+ * Tool, Schema, and model requirements remain visible until satisfied by Layer composition.
+ * Use Layer.unwrap for registration values that need effectful application setup.
+ */
+const registeredLayer = <
+  const Entries extends ReadonlyArray<AgentRegistration>,
+  E = never,
+  R = never,
+>(
+  registrations: Entries,
+  options: ThreadPublicationOptions<E, R> = {},
+) =>
+  Layer.unwrap(
+    Effect.map(compileRegistrations(registrations), (bindings) => boundLayer(bindings, options)),
+  );
+
+/** Preserve additional index services only when a projection Layer is actually supplied. */
+export function layer<
+  const Entries extends ReadonlyArray<AgentRegistration>,
+  E = never,
+  R = never,
+  P = never,
+  PE = never,
+  PR = never,
+>(
+  registrations: Entries,
+  options: Omit<ThreadPublicationOptions<E, R>, "projection"> & {
+    readonly projection: Layer.Layer<ThreadProjectionMaintenance | P, PE, PR>;
+  },
+): Layer.Layer<
+  Layer.Success<ReturnType<typeof registeredLayer<Entries, E | PE, R | PR>>> | P,
+  Layer.Error<ReturnType<typeof registeredLayer<Entries, E | PE, R | PR>>>,
+  Layer.Services<ReturnType<typeof registeredLayer<Entries, E | PE, R | PR>>>
+>;
+
+export function layer<const Entries extends ReadonlyArray<AgentRegistration>, E = never, R = never>(
+  registrations: Entries,
+  options?: ThreadPublicationOptions<E, R>,
+): ReturnType<typeof registeredLayer<Entries, E, R>>;
+
+export function layer<const Entries extends ReadonlyArray<AgentRegistration>, E = never, R = never>(
+  registrations: Entries,
+  options: ThreadPublicationOptions<E, R> = {},
+) {
+  return registeredLayer(registrations, options);
+}
+
+export function layerFromBindings<E = never, R = never, P = never, PE = never, PR = never>(
+  bindings: ReadonlyArray<ResolvedBinding>,
+  options: Omit<ThreadPublicationOptions<E, R>, "projection"> & {
+    readonly projection: Layer.Layer<ThreadProjectionMaintenance | P, PE, PR>;
+  },
+): Layer.Layer<
+  CloudflareDurableRuntimeServices | P,
+  Layer.Error<ReturnType<typeof boundLayer<E | PE, R | PR>>>,
+  Layer.Services<ReturnType<typeof boundLayer<E | PE, R | PR>>>
+>;
+
+export function layerFromBindings<E = never, R = never>(
+  bindings: ReadonlyArray<ResolvedBinding>,
+  options?: ThreadPublicationOptions<E, R>,
+): ReturnType<typeof boundLayer<E, R>>;
+
+export function layerFromBindings(
+  bindings: ReadonlyArray<ResolvedBinding>,
+): ReturnType<typeof boundLayer<never, never>>;
+
+export function layerFromBindings<E = never, R = never>(
+  bindings: ReadonlyArray<ResolvedBinding>,
+  options: ThreadPublicationOptions<E, R> = {},
+) {
+  return boundLayer(bindings, options);
+}
+
+/**
+ * Assemble the durable runtime from already-resolved Agent Bindings.
+ * Use `ThreadObject.layer` to compile typed Agent registrations instead.
+ * Supply host services through `ThreadObject.make` or `ThreadObject.layerConfig` and
+ * the Durable Object context and namespace Layers when composing a custom host.
+ */
+const boundLayer = <E = never, R = never>(
+  bindings: ReadonlyArray<ResolvedBinding>,
+  options: ThreadPublicationOptions<E, R> = {},
+): Layer.Layer<
+  CloudflareDurableRuntimeServices,
+  DoStorageInitializationError | MessageDeliveryError | E,
+  | DurableObjectContext
+  | ThreadObjectNamespace
+  | CloudflareBootstrapServices
+  | Exclude<R, ThreadStore | SubmissionLedger | SqlClient>
+> =>
+  Layer.unwrap(
+    Effect.map(DurableObjectContext, ({ ctx }) =>
+      sharedLayer(DurableAgentRuntime.layerWithBindings(bindings), options).pipe(
+        Layer.provideMerge(SqliteClient.layer({ storage: ctx.storage })),
+      ),
+    ),
+  );
+
+/**
+ * Build the application runtime over the existing owner SqlClient and native ports, then
+ * assemble its one maintenance coordinator. The application may acquire its Bindings from
+ * those ports and expose extra services, including ThreadHostMaintenance. It must not acquire
+ * another runtime stack or require ThreadMaintenance while constructing this Layer.
+ * Supply layerHostConfig and deterministic placement; dispatch addressed ingress with handleRpc.
+ */
+export function layerInHost<A, E, R, P = never, PE = never, PR = never>(
+  application: Layer.Layer<DurableAgentRuntime | A, E, R>,
+  options: Omit<ThreadPublicationOptions<PE, PR>, "projection"> & {
+    readonly projection: Layer.Layer<ThreadProjectionMaintenance | P, PE, PR>;
+  },
+): Layer.Layer<
+  CloudflareDurableRuntimeServices | A | P,
+  Layer.Error<ReturnType<typeof sharedLayer<A, E, R, PE, PR>>>,
+  Layer.Services<ReturnType<typeof sharedLayer<A, E, Exclude<R, P>, PE, PR>>>
+>;
+
+export function layerInHost<A, E, R, PE = never, PR = never>(
+  application: Layer.Layer<DurableAgentRuntime | A, E, R>,
+  options?: ThreadPublicationOptions<PE, PR>,
+): ReturnType<typeof sharedLayer<A, E, R, PE, PR>>;
+
+export function layerInHost<A, E, R, PE = never, PR = never>(
+  application: Layer.Layer<DurableAgentRuntime | A, E, R>,
+  options: ThreadPublicationOptions<PE, PR> = {},
+) {
+  return sharedLayer(application, options);
+}
+
+type HostRuntimeServices = Exclude<
+  CloudflareDurableRuntimeServices,
+  DurableAgentRuntime | ThreadMaintenance
+>;
+
+const sharedLayer = <A, E, R, PE = never, PR = never>(
+  application: Layer.Layer<DurableAgentRuntime | A, E, R>,
+  options: ThreadPublicationOptions<PE, PR> = {},
+): Layer.Layer<
+  CloudflareDurableRuntimeServices | A,
+  DoStorageInitializationError | MessageDeliveryError | E | PE,
+  | DurableObjectContext
+  | ThreadObjectNamespace
+  | Exclude<CloudflareBootstrapServices, ThreadObjectIdentity>
+  | SqlClient
+  | Exclude<R, HostRuntimeServices | PreparedInputAdmission>
+  | Exclude<PR, ThreadStore | SubmissionLedger | SqlClient>
+> =>
+  Layer.unwrap(
+    Effect.gen(function* () {
+      const { ctx } = yield* DurableObjectContext;
+      const config = yield* CloudflareDurableRuntimeConfig;
+      const { ownsThread } = yield* ThreadObjectPlacement;
+
+      const storageOptions: DoStorageOptions = {
+        storage: ctx.storage,
+        observationPollInterval: config.observationPollInterval,
+        ownershipLeaseDuration: config.ownershipLeaseDuration,
+        maxStoredValueBytes: config.maxStoredValueBytes,
+        verifyOnOpen: config.verifyOnOpen,
+      };
+
+      const infrastructure = Layer.mergeAll(
+        storageConfigLayer(storageOptions),
+        Layer.effect(SqlClient)(SqlClient),
+      );
+
+      // The same local ports serve routed decorators and owner-side RPC execution.
+      // The RPC executor must never receive routed ports and bounce requests between Objects.
+      const rawLocalPorts = Layer.mergeAll(threadStoreLayer, submissionLedgerLayer).pipe(
+        Layer.provide(infrastructure),
+      );
+
+      const base = Layer.mergeAll(DurableAlarmService.layer, ProgressWaitRegistry.layer);
+      const wakes = cloudflareWakeSchedulerLayer.pipe(Layer.provide(base));
+
+      const messageStore = guardedMessageDeliveryStoreLayer.pipe(
+        Layer.provide(doMessageDeliveryStoreLayer().pipe(Layer.provide(infrastructure))),
+        Layer.provide(wakes),
+      );
+
+      const messageRecovery = threadMessageDeliveryLayer.pipe(
+        // Four parallel attempts per wave. Native completion stops new wake-driven waves;
+        // retained retry deadlines schedule future alarms.
+        Layer.provide(MessageDeliveryDriver.layer({ batchSize: 4, concurrency: 4 })),
+        Layer.provide(cloudflarePreparedInputAdmissionLayer),
+        Layer.provide(CloudflareThreadClient.layer),
+        Layer.provide(messageStore),
+        Layer.provide(wakes),
+      );
+
+      const publication = (options.publication ?? ThreadPublication.layer).pipe(
+        Layer.provide(Layer.mergeAll(rawLocalPorts, Layer.effect(SqlClient)(SqlClient))),
+      );
+
+      const projection = (options.projection ?? ThreadProjectionMaintenance.layer).pipe(
+        Layer.provide(Layer.mergeAll(rawLocalPorts, Layer.effect(SqlClient)(SqlClient))),
+      );
+
+      const localPorts =
+        options.publication === undefined && options.projection === undefined
+          ? rawLocalPorts
+          : Layer.effectContext(
+              Effect.gen(function* () {
+                const store = yield* ThreadStore;
+                const ledger = yield* SubmissionLedger;
+                const mutations = yield* ThreadMutationGate;
+                const index = yield* ThreadProjectionMaintenance;
+                const publish = yield* Effect.context<ThreadPublication>();
+                const afterCommit = publishCommitted.pipe(Effect.provide(publish));
+                // A later append cannot mistake its still-projecting predecessor for old backlog.
+                // Publication remains outside this local source/index critical section.
+                const sourceCommits = yield* Semaphore.make(1);
+
+                // Every runtime-owned producer prearms too: a crash between commit and invalidation
+                // leaves a NEW, uncertified generation. Source errors keep their native port types.
+                const observedStore = ThreadStore.of({
+                  ...store,
+                  append: (request) =>
+                    mutations
+                      .withMutation(
+                        sourceCommits
+                          .withPermit(
+                            store
+                              .append(request)
+                              .pipe(
+                                Effect.tap((result) =>
+                                  index
+                                    .applyCommitted(request, result)
+                                    .pipe(
+                                      Effect.catchCause((cause) =>
+                                        Cause.hasInterrupts(cause)
+                                          ? Effect.interrupt
+                                          : Effect.logError(
+                                              "Thread projection deferred after source commit",
+                                              cause,
+                                            ),
+                                      ),
+                                    ),
+                                ),
+                              ),
+                          )
+                          .pipe(Effect.tap(() => afterCommit)),
+                      )
+                      .pipe(
+                        Effect.catchTag("DurableAlarmError", (cause) =>
+                          ThreadStoreError.make({
+                            operation: "prearm publication append",
+                            message: cause.message,
+                            cause,
+                          }),
+                        ),
+                      ),
+                });
+
+                const observeIntent = <A, Failure>(body: Effect.Effect<A, Failure>) =>
+                  mutations.withMutation(body.pipe(Effect.tap(() => afterCommit))).pipe(
+                    Effect.catchTag("DurableAlarmError", (cause) =>
+                      LedgerError.make({
+                        operation: "prearm publication intent",
+                        message: "The publication generation could not be armed",
+                        cause,
+                      }),
+                    ),
+                  );
+
+                return Context.make(ThreadStore, observedStore).pipe(
+                  Context.add(SubmissionLedger, {
+                    ...ledger,
+                    recordApprovalDecision: (request) =>
+                      observeIntent(ledger.recordApprovalDecision(request)),
+                    requestAbort: (request) => observeIntent(ledger.requestAbort(request)),
+                    recordUnknownResolution: (request) =>
+                      observeIntent(ledger.recordUnknownResolution(request)),
+                  }),
+                );
+              }),
+            ).pipe(Layer.provide(rawLocalPorts));
+
+      const portsEndpointLayer = Layer.effect(ThreadObjectPorts)(
+        Effect.gen(function* () {
+          const local = yield* Effect.context<SubmissionLedger | ThreadStore>();
+          const ledger = Context.get(local, SubmissionLedger);
+
+          return ThreadObjectPorts.of({
+            handle: (request) => executePortRequest(request).pipe(Effect.provide(local)),
+            lookupSubmission: (submissionId) =>
+              ledger.lookup(SubmissionLookupById.make({ submissionId })),
+          });
+        }),
+      ).pipe(Layer.provide(localPorts));
+
+      const routedPorts = Layer.mergeAll(
+        routedSubmissionLedgerLayer({ ownsThread }),
+        routedThreadStoreLayer({ ownsThread }),
+      ).pipe(Layer.provide(localPorts), Layer.provide(threadPortTransportLayer));
+
+      const runtimeStack = application.pipe(
+        Layer.provide(
+          cloudflarePreparedInputAdmissionLayer.pipe(Layer.provide(CloudflareThreadClient.layer)),
+        ),
+        Layer.provideMerge(messageStore),
+        Layer.provideMerge(routedPorts),
+        Layer.provideMerge(wakes),
+        Layer.provideMerge(base),
+        Layer.provideMerge(portsEndpointLayer),
+      );
+
+      return Layer.mergeAll(
+        runtimeStack,
+        ThreadMaintenance.layer.pipe(Layer.provide(runtimeStack), Layer.provide(messageRecovery)),
+        portsEndpointLayer,
+        messageStore,
+        messageRecovery,
+      ).pipe(
+        Layer.provideMerge(publication),
+        Layer.provideMerge(projection),
+        Layer.provideMerge(ThreadMutationGate.layer),
+        Layer.provideMerge(infrastructure),
+      );
+    }),
+  );