@effect-agent/platform-cloudflare 0.1.0-beta.12 → 0.1.0-beta.120

package/src/{wake-scheduler.ts → WakeScheduler.ts}

@@ -1,9 +1,14 @@
-import type { ConversationId } from "@effect-agent/core";
-import { WakeScheduler } from "@effect-agent/session";
 import { Effect, Layer, PubSub, Schema, Stream } from "effect";
+import { type ThreadId } from "effect-agent/identifiers";
+import { makeWakeSubscriptionHub, WakeScheduler } from "effect-agent/wake-scheduler";
 
-import { DurableAlarmService } from "./alarm.ts";
-import { ConversationObjectIdentity, ConversationObjectNamespace } from "./bindings.ts";
+import { DurableAlarmService } from "./Alarm.ts";
+import {
+  callThreadObject,
+  ThreadObjectPlacement,
+  ThreadObjectNamespace,
+} from "./CloudflareBindings.ts";
+import { safeCauseMessage } from "./internal/boundary.ts";
 
 /**
  * Bounded in-memory wake buffer for same-incarnation `awaitSettlement` subscribers. Wake
@@ -15,7 +20,7 @@ const WAKE_BUFFER_CAPACITY = 1_024;
 
 /** A remote wake stub call failed; always swallowed and logged (hints are droppable). */
 class RemoteWakeDropped extends Schema.TaggedError<RemoteWakeDropped>()("RemoteWakeDropped", {
-  conversationId: Schema.String,
+  threadId: Schema.String,
   message: Schema.String,
   cause: Schema.optionalKey(Schema.Defect()),
 }) {}
@@ -35,17 +40,20 @@ class RemoteWakeDropped extends Schema.TaggedError<RemoteWakeDropped>()("RemoteW
 export const cloudflareWakeSchedulerLayer: Layer.Layer<
   WakeScheduler,
   never,
-  DurableAlarmService | ConversationObjectIdentity | ConversationObjectNamespace
+  DurableAlarmService | ThreadObjectPlacement | ThreadObjectNamespace
 > = Layer.effect(WakeScheduler)(
   Effect.gen(function* () {
     const alarm = yield* DurableAlarmService;
-    const identity = yield* ConversationObjectIdentity;
-    const { namespace } = yield* ConversationObjectNamespace;
-    const hints = yield* PubSub.sliding<ConversationId>(WAKE_BUFFER_CAPACITY);
+    const placement = yield* ThreadObjectPlacement;
+    const namespace = yield* ThreadObjectNamespace;
+    const hints = yield* PubSub.sliding<ThreadId>(WAKE_BUFFER_CAPACITY);
+    const progress = yield* makeWakeSubscriptionHub;
+
     yield* Effect.addFinalizer(() => PubSub.shutdown(hints));
 
-    const notifyLocal = (conversationId: ConversationId) =>
-      PubSub.publish(hints, conversationId).pipe(
+    const notifyLocal = (threadId: ThreadId) =>
+      progress.notify(threadId).pipe(
+        Effect.andThen(PubSub.publish(hints, threadId)),
         Effect.andThen(alarm.scheduleNow),
         Effect.catch((error) =>
           // `notify` never fails by contract; a failed alarm write degrades to "hint lost"
@@ -55,30 +63,28 @@ export const cloudflareWakeSchedulerLayer: Layer.Layer<
         Effect.asVoid,
       );
 
-    const notifyRemote = (conversationId: ConversationId) =>
-      Effect.tryPromise({
-        try: () => namespace.get(namespace.idFromName(conversationId)).wake(),
-        catch: (cause) =>
+    const notifyRemote = (threadId: ThreadId) =>
+      callThreadObject(
+        threadId,
+        (target) => target.wake(),
+        (cause) =>
           RemoteWakeDropped.make({
-            conversationId,
-            message: cause instanceof Error ? cause.message : String(cause),
+            threadId,
+            message: safeCauseMessage(cause, "The remote wake failed without a diagnostic"),
             cause,
           }),
-      }).pipe(
+      ).pipe(
+        Effect.provideService(ThreadObjectNamespace, namespace),
         Effect.catch((error) =>
-          Effect.logWarning(
-            `CloudflareWakeScheduler: remote wake of ${conversationId} dropped`,
-            error,
-          ),
+          Effect.logWarning(`CloudflareWakeScheduler: remote wake of ${threadId} dropped`, error),
         ),
         Effect.asVoid,
       );
 
     return WakeScheduler.of({
-      notify: (conversationId) =>
-        conversationId === identity.conversationId
-          ? notifyLocal(conversationId)
-          : notifyRemote(conversationId),
+      notify: (threadId) =>
+        placement.ownsThread(threadId) ? notifyLocal(threadId) : notifyRemote(threadId),
+      subscribe: progress.subscribe,
       wakes: Stream.fromPubSub(hints),
     });
   }),

package/src/index.ts

@@ -1,23 +1,12 @@
-/**
- * `@effect-agent/platform-cloudflare` — the Cloudflare Layer-assembly library for deployment
- * class DC (deployment spec §12: a Layer-assembly library, not an application entrypoint).
- *
- * One SQLite-backed Durable Object per Conversation is the serialized owner (durability §6):
- * `makeConversationObjectClass` builds the class applications export from their Worker,
- * `CloudflareDurableRuntime.layer` assembles the coordinator over the storage-cloudflare
- * adapters and the WP2 cross-Object routing, `DurableAlarmService`/`ConversationMaintenance`
- * multiplex every cadence into the Object's single alarm slot (nonterminal work implies a
- * committed alarm, so eviction recovers without an incoming request), and
- * `CloudflareConversationClient` is the Worker-side ingress. Platform bindings enter ONLY
- * through the `bindings.ts` Layers (DEPLOY-010). This is the only workspace package allowed
- * to import the `cloudflare:workers` runtime module.
- */
-export * from "./bindings.ts";
-export * from "./config.ts";
-export * from "./alarm.ts";
-export * from "./wake-scheduler.ts";
-export * from "./transport.ts";
-export * from "./layers.ts";
-export * from "./conversation-object.ts";
-export * from "./client.ts";
-export * from "./code-mode-executor.ts";
+export * as Alarm from "./Alarm.ts";
+export * as CloudflareBindings from "./CloudflareBindings.ts";
+export * as CloudflareBrowser from "./CloudflareBrowser.ts";
+export * as CloudflareCodeMode from "./CloudflareCodeMode.ts";
+export * as CloudflareConfig from "./CloudflareConfig.ts";
+export * as CloudflareMemory from "./CloudflareMemory.ts";
+export * as CloudflareScheduling from "./CloudflareScheduling.ts";
+export * as CloudflareSubscriptions from "./CloudflareSubscriptions.ts";
+export * as CloudflareThreadClient from "./CloudflareThreadClient.ts";
+export * as ThreadObject from "./ThreadObject.ts";
+export * as WakeScheduler from "./WakeScheduler.ts";
+export * as CloudflareAiGateway from "./CloudflareAiGateway.ts";

package/src/internal/boundary.ts

@@ -0,0 +1,55 @@
+import { Predicate } from "effect";
+
+const MAX_FOREIGN_DIAGNOSTIC_LENGTH = 8_192;
+
+const boundForeignDiagnostic = (message: string): string =>
+  message.slice(0, MAX_FOREIGN_DIAGNOSTIC_LENGTH);
+
+/** Render a foreign failure without trusting accessors or coercion hooks on the value. */
+export const safeCauseMessage = (cause: unknown, fallback: string): string => {
+  try {
+    const message = cause instanceof Error ? cause.message : cause;
+
+    return boundForeignDiagnostic(typeof message === "string" ? message : String(message));
+  } catch {
+    return boundForeignDiagnostic(fallback);
+  }
+};
+
+/** Include an Error name when worker-failure classification needs it. */
+export const safeCauseDiagnostic = (cause: unknown, fallback: string): string => {
+  try {
+    return cause instanceof Error
+      ? boundForeignDiagnostic(`${cause.name}: ${cause.message}`)
+      : safeCauseMessage(cause, fallback);
+  } catch {
+    return boundForeignDiagnostic(fallback);
+  }
+};
+
+export interface CloudflareFailureSignals {
+  readonly retryable?: boolean | undefined;
+  readonly overloaded?: boolean | undefined;
+}
+
+/** Read Cloudflare RPC classifications without letting a hostile proxy defect the client. */
+export const cloudflareFailureSignals = (cause: unknown): CloudflareFailureSignals => {
+  if (!Predicate.isObjectKeyword(cause)) return {};
+  try {
+    const retryableValue = Reflect.get(cause, "retryable");
+    const overloadedValue = Reflect.get(cause, "overloaded");
+    const resetValue = Reflect.get(cause, "durableObjectReset");
+
+    const retryable =
+      typeof retryableValue === "boolean" ? retryableValue : resetValue === true ? true : undefined;
+
+    const overloaded = typeof overloadedValue === "boolean" ? overloadedValue : undefined;
+
+    return {
+      ...(retryable === undefined ? {} : { retryable }),
+      ...(overloaded === undefined ? {} : { overloaded }),
+    };
+  } catch {
+    return {};
+  }
+};

package/src/internal/browser-binding.ts

@@ -0,0 +1,82 @@
+/// <reference types="@cloudflare/workers-types" />
+import puppeteer, { type Browser } from "@cloudflare/puppeteer";
+import { Context, Layer, Schema } from "effect";
+
+import { browserFailure, BrowserRunFailure } from "./browser-failure.ts";
+
+const Acquired = Schema.Struct({ sessionId: Schema.String.check(Schema.isUUID()) });
+
+/** Native transport port shared by both scoped adapters; the Layer owns the foreign binding. */
+export class BrowserRunBinding extends Context.Service<
+  BrowserRunBinding,
+  {
+    readonly acquire: (
+      keepAliveMillis: number,
+      operation: "protected.acquire" | "interactive.acquire",
+    ) => Promise<string>;
+    readonly connect: (sessionId: string, operation: string) => Promise<Browser>;
+  }
+>()("@effect-agent/platform-cloudflare/internal/BrowserRunBinding") {
+  static layer(browser: Pick<BrowserRun, "fetch">) {
+    return Layer.succeed(this)({
+      // One allocation path, with recording explicitly disabled for private sessions.
+      acquire: async (keepAliveMillis, operation) => {
+        const response = await browser.fetch(
+          `https://browser-rendering.cloudflare.com/v1/devtools/browser?keep_alive=${keepAliveMillis}&recording=false`,
+          { method: "POST" },
+        );
+
+        if (response.status !== 200) {
+          const failure = new BrowserRunFailure({
+            operation,
+            reason: "provider",
+            status: response.status,
+          });
+
+          try {
+            await response.body?.cancel();
+          } catch {
+            // Body cancellation cannot replace the acquisition refusal.
+          }
+          throw failure;
+        }
+
+        return Schema.decodeUnknownSync(Acquired)(await response.json()).sessionId;
+      },
+      // The SDK embeds bodies and session IDs in errors; retain status before that loss.
+      connect: async (sessionId, operation) => {
+        let failure: BrowserRunFailure | undefined;
+
+        try {
+          return await puppeteer.connect(
+            {
+              fetch: async (input: RequestInfo | URL, init?: RequestInit) => {
+                try {
+                  const response = await browser.fetch(input, init);
+
+                  if (response.status !== 101) {
+                    failure = new BrowserRunFailure({
+                      operation,
+                      reason: "provider",
+                      status: response.status,
+                    });
+                    await response.body?.cancel();
+                    throw failure;
+                  }
+
+                  return response;
+                } catch (cause) {
+                  failure ??= browserFailure(operation, cause);
+                  throw failure;
+                }
+              },
+            },
+            sessionId,
+          );
+        } catch (cause) {
+          throw failure ?? browserFailure(operation, cause);
+        }
+      },
+    });
+  }
+}

package/src/internal/browser-failure.ts

@@ -0,0 +1,92 @@
+import type { Effect } from "effect";
+import { Cause, Data, ErrorReporter, Predicate, Schema } from "effect";
+
+/** Source-authored stages and classifications only; never retain SDK text or session capabilities. */
+export class BrowserRunFailure extends Data.TaggedError("BrowserRunFailure")<{
+  readonly operation: string;
+  readonly reason:
+    | "provider"
+    | "timeout"
+    | "malformed"
+    | "configuration"
+    | "authorization"
+    | "rate-limited"
+    | "pending";
+  readonly status?: number;
+  readonly cause?: BrowserRunFailure | { readonly name: string };
+}> {
+  readonly [ErrorReporter.severity] = "Error" as const;
+}
+
+/** A public projection of an already reported private failure must not produce another issue. */
+export const reportedBrowserError = <A extends object>(error: A): A =>
+  Object.assign(error, { [ErrorReporter.ignore]: true });
+
+export const inheritBrowserReport = <A extends object>(original: unknown, error: A): A =>
+  ErrorReporter.isIgnored(original) ? reportedBrowserError(error) : error;
+
+const reasonSchema = Schema.Literals([
+  "provider",
+  "timeout",
+  "malformed",
+  "configuration",
+  "authorization",
+  "rate-limited",
+  "pending",
+]);
+
+const statusSchema = Schema.Int.check(Schema.isBetween({ minimum: 100, maximum: 599 }));
+
+const failureNames = new Set([
+  "TypeError",
+  "RangeError",
+  "SyntaxError",
+  "TimeoutError",
+  "SchemaError",
+]);
+
+export const browserFailure = (operation: string, cause?: unknown): BrowserRunFailure =>
+  cause instanceof BrowserRunFailure
+    ? cause
+    : new BrowserRunFailure({
+        operation,
+        reason:
+          Predicate.isObject(cause) && "reason" in cause && Schema.is(reasonSchema)(cause.reason)
+            ? cause.reason
+            : "provider",
+        ...(Predicate.isObject(cause) && "status" in cause && Schema.is(statusSchema)(cause.status)
+          ? { status: cause.status }
+          : {}),
+        ...(Predicate.isObject(cause) &&
+        "cause" in cause &&
+        cause.cause instanceof BrowserRunFailure
+          ? { cause: cause.cause }
+          : Predicate.isObject(cause) &&
+              "name" in cause &&
+              typeof cause.name === "string" &&
+              failureNames.has(cause.name)
+            ? { cause: { name: cause.name } }
+            : {}),
+      });
+
+/** Keep mixed defects and interruptions distinct while discarding all foreign diagnostic content. */
+export const reportBrowserCause = <E>(
+  operation: string,
+  cause: Cause.Cause<E>,
+): Effect.Effect<void> =>
+  ErrorReporter.report(
+    Cause.fromReasons(
+      cause.reasons
+        .filter((reason) => !Cause.isFailReason(reason) || !ErrorReporter.isIgnored(reason.error))
+        .map((reason) => {
+          switch (reason._tag) {
+            case "Fail":
+              return Cause.makeFailReason(browserFailure(operation, reason.error));
+            case "Die":
+              return Cause.makeDieReason(browserFailure(operation, reason.defect));
+            case "Interrupt":
+              return reason;
+          }
+        }),
+    ),
+  );

package/src/internal/browser-file-selection.ts

@@ -0,0 +1,126 @@
+import type { Page } from "@cloudflare/puppeteer";
+import { Encoding } from "effect";
+import type { BrowserSelectFileRequest } from "effect-agent/interactive-browser";
+
+type Element = NonNullable<Awaited<ReturnType<Page["$"]>>>;
+
+// Both calls run this fixed function in Chromium. No caller-provided code or
+// filesystem path is evaluated, and none of the file bytes enter diagnostics.
+function setFileSelection(element: object, encoded: string, name: string, type: string): void {
+  if (
+    Reflect.get(element, "type") !== "file" ||
+    Reflect.get(element, "disabled") ||
+    Reflect.get(element, "webkitdirectory")
+  ) {
+    throw new Error("The target is not an enabled file input");
+  }
+  const bytes = Uint8Array.from(atob(encoded), (character) => character.charCodeAt(0));
+  const Transfer = Reflect.get(globalThis, "DataTransfer");
+  const transfer = new Transfer();
+
+  transfer.items.add(new File([bytes], name, { type }));
+  Reflect.set(element, "files", transfer.files);
+  const selected = Reflect.get(element, "files");
+
+  if (
+    selected?.length !== 1 ||
+    selected[0]?.size !== bytes.length ||
+    selected[0]?.name !== name ||
+    selected[0]?.type !== type
+  ) {
+    throw new Error("The input did not retain the selected file");
+  }
+  const dispatch = Reflect.get(element, "dispatchEvent");
+
+  Reflect.apply(dispatch, element, [new Event("input", { bubbles: true })]);
+  Reflect.apply(dispatch, element, [new Event("change", { bubbles: true })]);
+}
+
+export const makeFileSelection =
+  (page: Page) => async (request: BrowserSelectFileRequest, signal: AbortSignal) => {
+    const encoded = Encoding.encodeBase64(request.bytes);
+    const session = request.target === "chooser" ? await page.createCDPSession() : undefined;
+
+    if (session !== undefined) {
+      try {
+        await session.send("Page.enable");
+        await session.send("Page.setInterceptFileChooserDialog", { enabled: true });
+      } catch (cause) {
+        await session.detach();
+        throw cause;
+      }
+    }
+
+    const select = async (element: Element): Promise<void> => {
+      if (session === undefined)
+        return element.evaluate(setFileSelection, encoded, request.fileName, request.mediaType);
+      let onOpened: (event: { backendNodeId?: number }) => void = () => {};
+      let onAbort: () => void = () => {};
+      let timer: ReturnType<typeof setTimeout> | undefined;
+
+      const opened = new Promise<number>((resolve, reject) => {
+        onOpened = (event) =>
+          event.backendNodeId === undefined
+            ? reject(new Error("The chooser has no file input"))
+            : resolve(event.backendNodeId);
+        onAbort = () => reject(new Error("File selection interrupted"));
+        session.on("Page.fileChooserOpened", onOpened);
+        signal.addEventListener("abort", onAbort, { once: true });
+        timer = setTimeout(() => reject(new Error("No file chooser opened")), 5_000);
+        if (signal.aborted) onAbort();
+      });
+
+      try {
+        const [backendNodeId] = await Promise.all([opened, element.click()]);
+
+        if (signal.aborted) throw new Error("File selection interrupted");
+        const resolved = await session.send("DOM.resolveNode", { backendNodeId });
+
+        const objectId = resolved.object.objectId;
+
+        if (objectId === undefined) throw new Error("The chooser has no file input");
+        if (signal.aborted) throw new Error("File selection interrupted");
+
+        const result = await session.send("Runtime.callFunctionOn", {
+          objectId,
+          functionDeclaration: `function(encoded, name, type) { (${setFileSelection.toString()})(this, encoded, name, type); }`,
+          arguments: [
+            { value: encoded },
+            { value: request.fileName },
+            { value: request.mediaType },
+          ],
+          returnByValue: true,
+        });
+
+        if (result.exceptionDetails !== undefined)
+          throw new Error("The chooser did not select the file");
+      } finally {
+        clearTimeout(timer);
+        session.off("Page.fileChooserOpened", onOpened);
+        signal.removeEventListener("abort", onAbort);
+        // Detaching the owned session releases all remote object handles, including
+        // after timeout, interruption, or a navigation during change handlers.
+      }
+    };
+
+    return {
+      validate: async (element: Element): Promise<boolean> =>
+        request.target === "chooser" ||
+        (await element.evaluate(
+          (input) =>
+            Reflect.get(input, "type") === "file" &&
+            !Reflect.get(input, "disabled") &&
+            !Reflect.get(input, "webkitdirectory"),
+        )),
+      select,
+      close: async (): Promise<void> => {
+        if (session !== undefined) {
+          try {
+            await session.send("Page.setInterceptFileChooserDialog", { enabled: false });
+          } finally {
+            await session.detach();
+          }
+        }
+      },
+    };
+  };