@effect-agent/platform-cloudflare 0.1.0-beta.24 → 0.1.0-beta.25

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { Clock, Context, Crypto, Deferred, Duration, Effect, Exit, Fiber, Layer, Option, PubSub, Queue, Random, Ref, Schema, Semaphore, Stream } from "effect";
+import { Clock, Context, Crypto, Deferred, Duration, Effect, Exit, Fiber, Layer, Option, Predicate, PubSub, Queue, Random, Ref, Schema, Semaphore, Stream } from "effect";
 import { AbortCommand, AbortIntent, AdmissionConflict, AgentBindingResolver, AppendConflict, ApprovalConflict, ApprovalDecisionCommand, ApprovalDecisionIntent, CanonicalRecordEnvelope, CanonicalSequence, ConversationNotMaterialized, ConversationRead, ConversationStore, ConversationStoreError, DEFAULT_OWNERSHIP_LEASE_DURATION, DefinitionDigests, DeploymentId, DigestError, DurableAgentRuntime, DurableRuntimeConfig, DurableRuntimeFailpoint, DurableRuntimeFailpointError, FenceRejected, IdempotencyKey, IntegrityReport, JoinedToHost, LedgerError, ObligationReport, ObligationThresholds, OperationAuthorizationRequest, OperationAuthorizer, OperationDenied, OwnershipLost, PersistedJson, Principal, ProducerId, Receipt, RecoveryExplanation, RecoveryReport, RetryCommand, RetryRefused, RunJournalError, Settlement, SettlementConflict, SubmissionLedger, SubmissionLookupByKey, ToolReconciler, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, WakeScheduler, makeWakeSubscriptionHub, operationAuthorizerLayer } from "@effect-agent/session";
-import { ConversationPortTransport, DEFAULT_MAX_STORED_VALUE_BYTES, conversationStoreLayer, handleEncodedPortRequest, portTransportFailure, routedConversationStoreLayer, routedSubmissionLedgerLayer, storageConfigLayer, storageFailpointLayer, submissionLedgerLayer } from "@effect-agent/storage-cloudflare";
+import { ConversationPortTransport, DEFAULT_MAX_STORED_VALUE_BYTES, conversationStoreLayer, decodePortRequest, encodePortResponse, executePortRequest, portTransportFailure, routedConversationStoreLayer, routedSubmissionLedgerLayer, storageConfigLayer, storageFailpointLayer, submissionLedgerLayer } from "@effect-agent/storage-cloudflare";
 import { AgentId, AgentInputError, ConversationId, SubmissionId } from "@effect-agent/core";
 import { RunContextPreparationPassthrough } from "@effect-agent/engine";
 import { BrowserCrypto } from "@effect/platform-browser";
@@ -36,17 +36,29 @@ var ConversationObjectNamespace = class ConversationObjectNamespace extends Cont
 * narrowest-boundary check (structural probe for the namespace surface the transport uses);
 * a missing or misshaped binding fails typed before any Layer is built.
 */
-const conversationNamespaceFromEnv = (env, binding) => Effect.suspend(() => {
-	if (typeof env !== "object" || env === null) return Effect.fail(CloudflareBindingError.make({
+const conversationNamespaceFromEnv = Effect.fn("conversationNamespaceFromEnv")(function* (env, binding) {
+	if (!Predicate.isObjectKeyword(env)) return yield* CloudflareBindingError.make({
 		binding,
 		message: "The Worker environment is not an object; no bindings are available."
-	}));
-	const candidate = env[binding];
-	if (typeof candidate === "object" && candidate !== null && "idFromName" in candidate && typeof candidate.idFromName === "function" && "get" in candidate && typeof candidate.get === "function") return Effect.succeed(candidate);
-	return Effect.fail(CloudflareBindingError.make({
+	});
+	const candidate = yield* Effect.try({
+		try: () => {
+			const value = Reflect.get(env, binding);
+			if (!Predicate.isObjectKeyword(value)) return void 0;
+			const idFromName = Reflect.get(value, "idFromName");
+			const get = Reflect.get(value, "get");
+			return typeof idFromName === "function" && typeof get === "function" ? value : void 0;
+		},
+		catch: () => CloudflareBindingError.make({
+			binding,
+			message: `env.${binding} could not be inspected as a DurableObjectNamespace binding.`
+		})
+	});
+	if (candidate !== void 0) return candidate;
+	return yield* CloudflareBindingError.make({
 		binding,
 		message: `env.${binding} is not a DurableObjectNamespace binding; declare the Conversation Object class under this binding in the Worker configuration.`
-	}));
+	});
 });
 /** `ConversationObjectNamespace` built from the untyped Worker `env` (fails typed). */
 const conversationNamespaceLayer = (env, binding) => Layer.effect(ConversationObjectNamespace)(Effect.map(conversationNamespaceFromEnv(env, binding), (namespace) => ({ namespace })));
@@ -174,6 +186,44 @@ const CLOUDFLARE_RUNTIME_DEFAULTS = {
 	maxDatabaseBytes: DEFAULT_MAX_DATABASE_BYTES
 };
 //#endregion
+//#region src/boundary.ts
+const MAX_FOREIGN_DIAGNOSTIC_LENGTH = 8192;
+const boundForeignDiagnostic = (message) => message.slice(0, MAX_FOREIGN_DIAGNOSTIC_LENGTH);
+/** Render a foreign failure without trusting accessors or coercion hooks on the value. */
+const safeCauseMessage = (cause, fallback) => {
+	try {
+		const message = cause instanceof Error ? cause.message : cause;
+		return boundForeignDiagnostic(typeof message === "string" ? message : String(message));
+	} catch {
+		return boundForeignDiagnostic(fallback);
+	}
+};
+/** Include an Error name when worker-failure classification needs it. */
+const safeCauseDiagnostic = (cause, fallback) => {
+	try {
+		return cause instanceof Error ? boundForeignDiagnostic(`${cause.name}: ${cause.message}`) : safeCauseMessage(cause, fallback);
+	} catch {
+		return boundForeignDiagnostic(fallback);
+	}
+};
+/** Read Cloudflare RPC classifications without letting a hostile proxy defect the client. */
+const cloudflareFailureSignals = (cause) => {
+	if (!Predicate.isObjectKeyword(cause)) return {};
+	try {
+		const retryableValue = Reflect.get(cause, "retryable");
+		const overloadedValue = Reflect.get(cause, "overloaded");
+		const resetValue = Reflect.get(cause, "durableObjectReset");
+		const retryable = typeof retryableValue === "boolean" ? retryableValue : resetValue === true ? true : void 0;
+		const overloaded = typeof overloadedValue === "boolean" ? overloadedValue : void 0;
+		return {
+			...retryable === void 0 ? {} : { retryable },
+			...overloaded === void 0 ? {} : { overloaded }
+		};
+	} catch {
+		return {};
+	}
+};
+//#endregion
 //#region src/alarm.ts
 /**
 * The single multiplexed Durable Object alarm (decision D-P6-2). A Durable Object has ONE
@@ -194,7 +244,7 @@ var DurableAlarmError = class extends Schema.TaggedError()("DurableAlarmError",
 }) {};
 const alarmFailure = (operation) => (cause) => DurableAlarmError.make({
 	operation,
-	message: cause instanceof Error ? cause.message : String(cause),
+	message: safeCauseMessage(cause, "The Cloudflare alarm API failed without a diagnostic"),
 	cause
 });
 /** `ctx.storage` alarm slot as an Effect service; storage is truth, never a memory field. */
@@ -505,7 +555,7 @@ const cloudflareWakeSchedulerLayer = Layer.effect(WakeScheduler)(Effect.gen(func
 		try: () => namespace.get(namespace.idFromName(conversationId)).wake(),
 		catch: (cause) => RemoteWakeDropped.make({
 			conversationId,
-			message: cause instanceof Error ? cause.message : String(cause),
+			message: safeCauseMessage(cause, "The remote wake failed without a diagnostic"),
 			cause
 		})
 	}).pipe(Effect.catch((error) => Effect.logWarning(`CloudflareWakeScheduler: remote wake of ${conversationId} dropped`, error)), Effect.asVoid);
@@ -605,10 +655,10 @@ const conversationPortTransportLayer = Layer.effect(ConversationPortTransport)(E
 //#endregion
 //#region src/layers.ts
 /**
-* Owner-side endpoint body for the Conversation Object's `portCall` (plan §1.3): decode,
-* execute against THIS Object's LOCAL port facets — never the routed decorators, so a
-* request cannot bounce between Objects — and answer the encoded response envelope. Total by
-* construction (protocol anomalies answer `PortFailed(PortProtocolError)`).
+* Owner-side execution port for a `portCall` request the wire endpoint has already decoded.
+* It executes against THIS Object's LOCAL port facets — never the routed decorators, so a
+* request cannot bounce between Objects — and returns the typed response for the endpoint to
+* encode.
 */
 var ConversationObjectPorts = class extends Context.Service()("@effect-agent/platform-cloudflare/ConversationObjectPorts") {};
 const decodeConfigValue = Schema.decodeUnknownEffect(CloudflareDurableRuntimeConfigValue);
@@ -645,10 +695,7 @@ const conversationIdFromState = (ctx) => ctx.id.name === void 0 ? Effect.fail(Cl
 	message: `The Durable Object name is not a valid ConversationId: ${error.message}`,
 	cause: error
 })));
-const resolveBindings = (source, context) => source === void 0 ? Effect.succeed([]) : Effect.isEffect(source) ? source : typeof source === "function" ? Effect.suspend(() => {
-	const bindings = source(context);
-	return Effect.isEffect(bindings) ? bindings : Effect.succeed(bindings);
-}) : Effect.succeed(source);
+const resolveBindings = (source, context) => source === void 0 ? Effect.succeed([]) : Effect.suspend(() => source(context));
 const resolveRunContext = (source, context) => typeof source === "function" ? source(context) : source;
 /**
 * The DC Layer assembly (deployment §12: a Layer-assembly library, not an app entrypoint;
@@ -699,7 +746,7 @@ var CloudflareDurableRuntime = class {
 			const localPorts = Layer.mergeAll(conversationStoreLayer, submissionLedgerLayer).pipe(Layer.provide(infrastructure));
 			const portsEndpointLayer = Layer.effect(ConversationObjectPorts)(Effect.gen(function* () {
 				const local = yield* Effect.context();
-				return ConversationObjectPorts.of({ handle: (encoded) => handleEncodedPortRequest(encoded).pipe(Effect.provide(local)) });
+				return ConversationObjectPorts.of({ handle: (request) => executePortRequest(request).pipe(Effect.provide(local)) });
 			})).pipe(Layer.provide(localPorts));
 			const routedPorts = Layer.mergeAll(routedSubmissionLedgerLayer({ localConversationId: conversationId }), routedConversationStoreLayer({ localConversationId: conversationId })).pipe(Layer.provide(localPorts), Layer.provide(conversationPortTransportLayer));
 			const runtimeConfigLayer = Layer.succeed(DurableRuntimeConfig)(DurableRuntimeConfig.make({
@@ -852,107 +899,88 @@ const decodeUnknownResolutionCommand = Schema.decodeUnknownEffect(UnknownResolut
 const encodeUnknownResolutionCommand = Schema.encodeEffect(UnknownResolutionCommand);
 const encodeHostResponse = Schema.encodeEffect(HostResponse);
 const decodeHostResponse = Schema.decodeUnknownEffect(HostResponse);
-const SUBMIT_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"AgentInputError",
-	"DigestError",
-	"AdmissionConflict",
-	"LedgerError",
-	"ConversationStoreError",
-	"ConversationNotMaterialized",
-	"AppendConflict",
-	"FenceRejected",
-	"DurableRuntimeFailpointError",
-	"AdmissionLimitExceeded",
-	"DurableAlarmError",
-	"HostProtocolError"
+/** Failure surface of `CloudflareConversationClient.submit`. */
+const ClientSubmitHostFailure = Schema.Union([
+	AgentInputError,
+	DigestError,
+	AdmissionConflict,
+	LedgerError,
+	ConversationStoreError,
+	ConversationNotMaterialized,
+	AppendConflict,
+	FenceRejected,
+	DurableRuntimeFailpointError,
+	AdmissionLimitExceeded,
+	DurableAlarmError,
+	HostProtocolError
 ]);
-const AWAIT_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"LedgerError",
-	"SettlementConflict",
-	"HostProtocolError"
+const ClientAwaitHostFailure = Schema.Union([
+	LedgerError,
+	SettlementConflict,
+	HostProtocolError
 ]);
-const OBSERVE_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"ConversationStoreError",
-	"ConversationNotMaterialized",
-	"OperationDenied",
-	"HostProtocolError"
+const ClientObserveHostFailure = Schema.Union([
+	ConversationStoreError,
+	ConversationNotMaterialized,
+	OperationDenied,
+	HostProtocolError
 ]);
-const PROGRESS_FAILURE_TAGS = OBSERVE_FAILURE_TAGS;
-const ABORT_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"LedgerError",
-	"SettlementConflict",
-	"JoinedToHost",
-	"DurableRuntimeFailpointError",
-	"DurableAlarmError",
-	"HostProtocolError"
+const ClientAbortHostFailure = Schema.Union([
+	LedgerError,
+	SettlementConflict,
+	JoinedToHost,
+	DurableRuntimeFailpointError,
+	DurableAlarmError,
+	HostProtocolError
 ]);
-const APPROVAL_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"LedgerError",
-	"SettlementConflict",
-	"ApprovalConflict",
-	"OperationDenied",
-	"DurableAlarmError",
-	"HostProtocolError"
+const ClientApprovalHostFailure = Schema.Union([
+	LedgerError,
+	SettlementConflict,
+	ApprovalConflict,
+	OperationDenied,
+	DurableAlarmError,
+	HostProtocolError
 ]);
-const UNKNOWN_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"LedgerError",
-	"SettlementConflict",
-	"UnknownResolutionConflict",
-	"JoinedToHost",
-	"DurableRuntimeFailpointError",
-	"OperationDenied",
-	"DurableAlarmError",
-	"HostProtocolError"
+const ClientUnknownHostFailure = Schema.Union([
+	LedgerError,
+	SettlementConflict,
+	UnknownResolutionConflict,
+	JoinedToHost,
+	DurableRuntimeFailpointError,
+	OperationDenied,
+	DurableAlarmError,
+	HostProtocolError
 ]);
 const outOfContract = (conversationId, operation, observed) => ConversationClientError.make({
 	conversationId,
 	message: boundHostDiagnostic(`The Conversation Object answered ${operation} with the out-of-contract ${observed}.`)
 });
-/**
-* Narrow one decoded `HostFailed.failure` to the operation's declared failure family; an
-* out-of-contract tag folds into `ConversationClientError` instead of being erased or
-* re-thrown raw (the WP2 discipline). The predicate is the single documented narrowing over
-* the closed `HostFailure` union.
-*/
-const narrowFailure = (tags) => (failure) => tags.has(failure._tag);
 /** Worker-side client over the Conversation Object namespace (DEPLOY-010). */
 var CloudflareConversationClient = class CloudflareConversationClient extends Context.Service()("@effect-agent/platform-cloudflare/CloudflareConversationClient") {
 	static layer = Layer.effect(CloudflareConversationClient)(Effect.gen(function* () {
 		const { namespace } = yield* ConversationObjectNamespace;
 		const crypto = yield* Crypto.Crypto;
-		const platformSignals = (cause) => {
-			let retryable;
-			let overloaded;
-			if (typeof cause === "object" && cause !== null) {
-				if ("retryable" in cause && typeof cause.retryable === "boolean") retryable = cause.retryable;
-				if ("overloaded" in cause && typeof cause.overloaded === "boolean") overloaded = cause.overloaded;
-				if (retryable === void 0 && "durableObjectReset" in cause && cause.durableObjectReset === true) retryable = true;
-			}
-			return {
-				...retryable === void 0 ? {} : { retryable },
-				...overloaded === void 0 ? {} : { overloaded }
-			};
-		};
 		const call = (conversationId, operation, invoke) => Effect.tryPromise({
 			try: () => invoke(namespace.get(namespace.idFromName(conversationId))),
 			catch: (cause) => ConversationClientError.make({
 				conversationId,
-				message: boundHostDiagnostic(`${operation} did not reach the Conversation Object: ${cause instanceof Error ? cause.message : String(cause)}`),
+				message: boundHostDiagnostic(`${operation} did not reach the Conversation Object: ${safeCauseMessage(cause, "the RPC failed without a diagnostic")}`),
 				cause,
-				...platformSignals(cause)
+				...cloudflareFailureSignals(cause)
 			})
 		}).pipe(Effect.flatMap((raw) => decodeHostResponse(raw).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`The ${operation} answer could not be decoded: ${error.message}`) })))), Effect.withSpan("CloudflareConversationClient.call", { attributes: {
 			conversationId,
 			operation
 		} }));
-		const expect = (conversationId, operation, resultTag, tags) => {
-			const isExpected = narrowFailure(tags);
+		const expect = (conversationId, operation, resultSchema, failureSchema) => {
+			const isExpectedResult = Schema.is(resultSchema);
+			const isExpectedFailure = Schema.is(failureSchema);
 			return (response) => {
 				if (response._tag === "HostFailed") {
 					const failure = response.failure;
-					return isExpected(failure) ? Effect.fail(failure) : Effect.fail(outOfContract(conversationId, operation, `failure ${failure._tag}`));
+					return isExpectedFailure(failure) ? Effect.fail(failure) : Effect.fail(outOfContract(conversationId, operation, `failure ${failure._tag}`));
 				}
-				if (response._tag !== resultTag) return Effect.fail(outOfContract(conversationId, operation, `result ${response._tag}`));
+				if (!isExpectedResult(response)) return Effect.fail(outOfContract(conversationId, operation, `result ${response._tag}`));
 				return Effect.succeed(response);
 			};
 		};
@@ -963,7 +991,7 @@ var CloudflareConversationClient = class CloudflareConversationClient extends Co
 			});
 			const encoded = yield* encodeObservePageRequest(request).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`observePage request encode failed: ${error.message}`) })));
 			const response = yield* call(conversationId, "observePage", (stub) => stub.observePage(encoded));
-			return (yield* expect(conversationId, "observePage", "ObservedPage", OBSERVE_FAILURE_TAGS)(response)).records;
+			return (yield* expect(conversationId, "observePage", ObservedPage, ClientObserveHostFailure)(response)).records;
 		});
 		const cancelProgress = (conversationId, waiterId) => encodeCancelProgressRequest(CancelProgressRequest.make({ waiterId })).pipe(Effect.mapError(() => void 0), Effect.flatMap((encoded) => call(conversationId, "cancelProgress", (stub) => stub.cancelProgressEncoded(encoded))), Effect.asVoid, Effect.ignore);
 		return CloudflareConversationClient.of({
@@ -979,12 +1007,12 @@ var CloudflareConversationClient = class CloudflareConversationClient extends Co
 				});
 				const encoded = yield* encodeSubmitRequest(request).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`submit request encode failed: ${error.message}`) })));
 				const response = yield* call(options.conversationId, "submit", (stub) => stub.submitEncoded(encoded));
-				return (yield* expect(options.conversationId, "submit", "SubmitSucceeded", SUBMIT_FAILURE_TAGS)(response)).receipt;
+				return (yield* expect(options.conversationId, "submit", SubmitSucceeded, ClientSubmitHostFailure)(response)).receipt;
 			}),
 			awaitSettlement: (receipt) => Effect.gen(function* () {
 				const encoded = yield* encodeReceipt(receipt).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`receipt encode failed: ${error.message}`) })));
 				const response = yield* call(receipt.conversationId, "awaitSettlement", (stub) => stub.awaitSettlementEncoded(encoded));
-				return (yield* expect(receipt.conversationId, "awaitSettlement", "SettlementReached", AWAIT_FAILURE_TAGS)(response)).settlement;
+				return (yield* expect(receipt.conversationId, "awaitSettlement", SettlementReached, ClientAwaitHostFailure)(response)).settlement;
 			}),
 			awaitProgress: (conversationId, afterSequence) => Effect.gen(function* () {
 				const waiterId = yield* crypto.randomUUIDv4.pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`awaitProgress cancellation identity generation failed: ${error.message}`) })));
@@ -993,7 +1021,7 @@ var CloudflareConversationClient = class CloudflareConversationClient extends Co
 					waiterId
 				});
 				const encoded = yield* encodeAwaitProgressRequest(request).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`awaitProgress request encode failed: ${error.message}`) })));
-				const attempt = (retry) => call(conversationId, "awaitProgress", (stub) => stub.awaitProgressEncoded(encoded)).pipe(Effect.flatMap(expect(conversationId, "awaitProgress", "ProgressObserved", PROGRESS_FAILURE_TAGS)), Effect.asVoid, Effect.catchTag("ConversationClientError", (error) => error.retryable === true && error.overloaded !== true && retry < 5 ? Effect.sleep(Duration.millis(10 * 2 ** retry)).pipe(Effect.andThen(attempt(retry + 1))) : Effect.fail(error)));
+				const attempt = (retry) => call(conversationId, "awaitProgress", (stub) => stub.awaitProgressEncoded(encoded)).pipe(Effect.flatMap(expect(conversationId, "awaitProgress", ProgressObserved, ClientObserveHostFailure)), Effect.asVoid, Effect.catchTag("ConversationClientError", (error) => error.retryable === true && error.overloaded !== true && retry < 5 ? Effect.sleep(Duration.millis(10 * 2 ** retry)).pipe(Effect.andThen(attempt(retry + 1))) : Effect.fail(error)));
 				yield* attempt(0).pipe(Effect.onInterrupt(() => cancelProgress(conversationId, waiterId)));
 			}),
 			readPage,
@@ -1014,33 +1042,40 @@ var CloudflareConversationClient = class CloudflareConversationClient extends Co
 			abort: (conversationId, command) => Effect.gen(function* () {
 				const encoded = yield* encodeAbortCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`abort command encode failed: ${error.message}`) })));
 				const response = yield* call(conversationId, "abort", (stub) => stub.abortEncoded(encoded));
-				return (yield* expect(conversationId, "abort", "AbortRecorded", ABORT_FAILURE_TAGS)(response)).intent;
+				return (yield* expect(conversationId, "abort", AbortRecorded, ClientAbortHostFailure)(response)).intent;
 			}),
 			resolveApproval: (conversationId, command) => Effect.gen(function* () {
 				const encoded = yield* encodeApprovalDecisionCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`approval command encode failed: ${error.message}`) })));
 				const response = yield* call(conversationId, "resolveApproval", (stub) => stub.resolveApprovalEncoded(encoded));
-				return (yield* expect(conversationId, "resolveApproval", "ApprovalRecorded", APPROVAL_FAILURE_TAGS)(response)).intent;
+				return (yield* expect(conversationId, "resolveApproval", ApprovalRecorded, ClientApprovalHostFailure)(response)).intent;
 			}),
 			resolveUnknown: (conversationId, command) => Effect.gen(function* () {
 				const encoded = yield* encodeUnknownResolutionCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`resolution command encode failed: ${error.message}`) })));
 				const response = yield* call(conversationId, "resolveUnknown", (stub) => stub.resolveUnknownEncoded(encoded));
-				return (yield* expect(conversationId, "resolveUnknown", "UnknownResolutionRecorded", UNKNOWN_FAILURE_TAGS)(response)).intent;
+				return (yield* expect(conversationId, "resolveUnknown", UnknownResolutionRecorded, ClientUnknownHostFailure)(response)).intent;
 			})
 		});
 	}));
 };
 //#endregion
 //#region src/conversation-object.ts
-/** Port envelope tags whose owner-side execution durably mutates this Object's lane. */
-const MUTATING_PORT_TAGS = /* @__PURE__ */ new Set([
-	"LedgerAdmit",
-	"LedgerMarkReady",
-	"LedgerRequestAbort",
-	"LedgerRecordChildSettled",
-	"StoreMaterialize",
-	"StoreAppend"
-]);
-const isMutatingPortRequest = (encoded) => typeof encoded === "object" && encoded !== null && "_tag" in encoded && typeof encoded._tag === "string" && MUTATING_PORT_TAGS.has(encoded._tag);
+/** Classify only a decoded port request so new protocol members cannot bypass pre-arming. */
+const isMutatingPortRequest = (request) => {
+	switch (request._tag) {
+		case "LedgerAdmit":
+		case "LedgerMarkReady":
+		case "LedgerRequestAbort":
+		case "LedgerRecordChildSettled":
+		case "StoreMaterialize":
+		case "StoreAppend": return true;
+		case "LedgerLookup":
+		case "LedgerResolveAdmission":
+		case "StoreReadPage":
+		case "StoreInspectTail":
+		case "StoreExport": return false;
+	}
+	return false;
+};
 /** The literal encoded `PortFailed(PortProtocolError)` fallback (same shape as WP2's). */
 const encodedPortProtocolFailure = (message) => ({
 	_tag: "PortFailed",
@@ -1253,10 +1288,18 @@ const portCallEndpoint = (encoded) => Effect.gen(function* () {
 	const ports = yield* ConversationObjectPorts;
 	const maintenance = yield* ConversationMaintenance;
 	const alarm = yield* DurableAlarmService;
-	const mutating = isMutatingPortRequest(encoded);
-	const handled = yield* (mutating ? maintenance.withMutation(ports.handle(encoded)) : ports.handle(encoded)).pipe(Effect.exit);
+	const decoded = yield* decodePortRequest(encoded).pipe(Effect.map((request) => ({
+		_tag: "success",
+		request
+	})), Effect.catch((error) => Effect.succeed({
+		_tag: "failure",
+		message: error.message
+	})));
+	if (decoded._tag === "failure") return encodedPortProtocolFailure(`The port request could not be decoded: ${decoded.message}`);
+	const mutating = isMutatingPortRequest(decoded.request);
+	const handled = yield* (mutating ? maintenance.withMutation(ports.handle(decoded.request)) : ports.handle(decoded.request)).pipe(Effect.exit);
 	if (handled._tag === "Failure") return encodedPortProtocolFailure("The owner Object could not arm its maintenance alarm before the mutation.");
-	const response = handled.value;
+	const response = yield* encodePortResponse(handled.value).pipe(Effect.catch((error) => Effect.succeed(encodedPortProtocolFailure(`The port response could not be encoded: ${error.message}`))));
 	if (mutating) yield* alarm.scheduleNow.pipe(Effect.catch((error) => Effect.logWarning("ConversationObject.portCall: immediate re-arm failed", error)));
 	return response;
 });
@@ -1370,7 +1413,8 @@ const passRegistry = /* @__PURE__ */ new Map();
 */
 var CodeModeHostEntrypoint = class extends WorkerEntrypoint {
 	async call(passId, hostCall) {
-		const pass = passRegistry.get(String(passId));
+		if (typeof passId !== "string") throw new TypeError("Code Mode pass identities must be strings");
+		const pass = passRegistry.get(passId);
 		if (pass === void 0) throw new Error("Unknown Code Mode pass");
 		return pass.dispatch(hostCall);
 	}
@@ -1408,7 +1452,7 @@ const safeJson = (value) => {
 
 export default class CodeModeHarness extends WorkerEntrypoint {
   async run() {
-    const config = JSON.parse(this.env.CODE_MODE_PASS);
+    const config = this.env.CODE_MODE_PASS;
     const host = this.env.CODE_MODE_HOST;
     const limits = config.limits;
     const logs = [];
@@ -1527,24 +1571,16 @@ export default class CodeModeHarness extends WorkerEntrypoint {
 }
 `;
 const BoundedLogs = Schema.Array(Schema.String.check(Schema.isMaxLength(16 * 1024))).check(Schema.isMaxLength(4096));
-const HarnessCompleted = Schema.Struct({
-	_tag: Schema.Literal("completed"),
+const HarnessCompleted = Schema.TaggedStruct("completed", {
 	value: Schema.Json,
 	logs: BoundedLogs,
 	hostCalls: Schema.Natural,
 	logBytes: Schema.Natural,
 	resultBytes: Schema.Natural
 });
-const HarnessSourceInvalid = Schema.Struct({
-	_tag: Schema.Literal("source-invalid"),
-	message: Schema.String
-});
-const HarnessNotAFunction = Schema.Struct({
-	_tag: Schema.Literal("source-not-a-function"),
-	actual: Schema.String
-});
-const HarnessProgramFailed = Schema.Struct({
-	_tag: Schema.Literal("program-failed"),
+const HarnessSourceInvalid = Schema.TaggedStruct("source-invalid", { message: Schema.String });
+const HarnessNotAFunction = Schema.TaggedStruct("source-not-a-function", { actual: Schema.String });
+const HarnessProgramFailed = Schema.TaggedStruct("program-failed", {
 	reason: Schema.Literals([
 		"threw",
 		"rejected",
@@ -1554,29 +1590,20 @@ const HarnessProgramFailed = Schema.Struct({
 	message: Schema.String,
 	logs: BoundedLogs
 });
-const HarnessLogLimit = Schema.Struct({
-	_tag: Schema.Literal("log-limit"),
+const HarnessLogLimit = Schema.TaggedStruct("log-limit", {
 	observed: Schema.Natural,
 	logs: BoundedLogs
 });
-const HarnessArgumentLimit = Schema.Struct({
-	_tag: Schema.Literal("argument-limit"),
+const HarnessArgumentLimit = Schema.TaggedStruct("argument-limit", {
 	observed: Schema.Natural,
 	logs: BoundedLogs
 });
-const HarnessResultLimit = Schema.Struct({
-	_tag: Schema.Literal("result-limit"),
+const HarnessResultLimit = Schema.TaggedStruct("result-limit", {
 	observed: Schema.Natural,
 	logs: BoundedLogs
 });
-const HarnessHostCallLimit = Schema.Struct({
-	_tag: Schema.Literal("host-call-limit"),
-	logs: BoundedLogs
-});
-const HarnessProtocol = Schema.Struct({
-	_tag: Schema.Literal("protocol"),
-	message: Schema.String
-});
+const HarnessHostCallLimit = Schema.TaggedStruct("host-call-limit", { logs: BoundedLogs });
+const HarnessProtocol = Schema.TaggedStruct("protocol", { message: Schema.String });
 const HarnessOutcome = Schema.Union([
 	HarnessCompleted,
 	HarnessSourceInvalid,
@@ -1588,6 +1615,22 @@ const HarnessOutcome = Schema.Union([
 	HarnessHostCallLimit,
 	HarnessProtocol
 ]);
+const HarnessPassConfig = Schema.Struct({
+	passId: Schema.NonEmptyString,
+	namespaces: Schema.Array(Schema.Struct({
+		name: Schema.NonEmptyString,
+		methods: Schema.Array(Schema.NonEmptyString).check(Schema.isMaxLength(64))
+	})).check(Schema.isMaxLength(32)),
+	limits: Schema.Struct({
+		maxLogBytes: Schema.Natural,
+		maxResultBytes: Schema.Natural,
+		maxHostCalls: Schema.Natural,
+		maxHostCallArgumentBytes: Schema.Natural
+	})
+});
+const encodeHarnessPassConfig = Schema.encodeSync(HarnessPassConfig);
+const encodeJsonPayload = Schema.encodeSync(Schema.fromJsonString(Schema.Json));
+const decodeJsonPayload = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Json));
 const decodeHarnessOutcome = (value) => {
 	try {
 		return Schema.decodeUnknownOption(HarnessOutcome)(value);
@@ -1609,11 +1652,20 @@ const decodeHostCallResult = (value) => {
 		return Option.none();
 	}
 };
+/** Dispose a Cloudflare RPC handle when the runtime supplies its untyped disposal hook. @internal */
+const disposeRpcHandle = (handle) => Effect.try({
+	try: () => {
+		if (typeof handle !== "object" && typeof handle !== "function" || handle === null) return;
+		if (!(Symbol.dispose in handle)) return;
+		const dispose = Reflect.get(handle, Symbol.dispose);
+		if (typeof dispose === "function") Reflect.apply(dispose, handle, []);
+	},
+	catch: (cause) => safeCauseDiagnostic(cause, "The Cloudflare RPC disposal hook failed without a diagnostic")
+}).pipe(Effect.catch((diagnostic) => Effect.logWarning(`Cloudflare RPC handle disposal failed: ${diagnostic}`).pipe(Effect.ignoreCause)));
 const encodeHostResultPayload = (outcome) => {
 	try {
 		const payload = outcome._tag === "CodeHostCallSuccess" ? outcome.value : outcome.error;
-		const encodedPayload = JSON.stringify(payload);
-		if (encodedPayload === void 0) return void 0;
+		const encodedPayload = encodeJsonPayload(payload);
 		return {
 			encodedPayload,
 			resultBytes: utf8ByteLength(encodedPayload)
@@ -1632,8 +1684,7 @@ const utf8ByteLength = (value) => {
 };
 /** Reserved global names the harness owns inside the dynamic worker. */
 const reservedHarnessGlobals = /* @__PURE__ */ new Set(["console"]);
-const passCounterState = { next: 0 };
-const makeExecute = (options) => Effect.fn("DynamicWorkerCodeExecutor.execute")(function* (request) {
+const makeExecute = (options, crypto, clock) => Effect.fn("DynamicWorkerCodeExecutor.execute")(function* (request) {
 	if (request.network._tag !== "NetworkDisabled") return yield* CodeExecutorUnsupportedError.make({
 		implementation: dynamicWorkerImplementation,
 		feature: "network",
@@ -1651,11 +1702,17 @@ const makeExecute = (options) => Effect.fn("DynamicWorkerCodeExecutor.execute")(
 		message: `Namespace ${namespace.name} collides with a harness binding`
 	});
 	const host = yield* CodeExecutionHost;
-	passCounterState.next += 1;
-	const passId = `code-mode-pass-${passCounterState.next}-${crypto.randomUUID()}`;
-	const startedAt = performance.now();
-	const passDeadline = startedAt + Duration.toMillis(request.limits.maxWallTime);
-	const remainingPassWallTime = () => Duration.millis(Math.max(0, passDeadline - performance.now()));
+	const passId = yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => CodeExecutorStartError.make({
+		implementation: dynamicWorkerImplementation,
+		message: `Could not mint the Code Mode pass identity: ${safeCauseMessage(cause, "the crypto service failed without a diagnostic")}`.slice(0, 8e3),
+		cause
+	})), Effect.map((uuid) => `code-mode-pass-${uuid}`));
+	const startedAt = clock.monotonicTimeNanosUnsafe();
+	const passDeadline = startedAt + Duration.toNanosUnsafe(request.limits.maxWallTime);
+	const remainingPassWallTime = () => {
+		const now = clock.monotonicTimeNanosUnsafe();
+		return Duration.nanos(passDeadline > now ? passDeadline - now : 0n);
+	};
 	let issuedHostCalls = 0;
 	let passOpen = true;
 	const queuedHostCalls = [];
@@ -1689,13 +1746,21 @@ const makeExecute = (options) => Effect.fn("DynamicWorkerCodeExecutor.execute")(
 			failPass(error);
 			return yield* error;
 		}
-		const normalizedPayload = JSON.parse(encoded.encodedPayload);
+		const normalizedPayload = decodeJsonPayload(encoded.encodedPayload);
+		if (Option.isNone(normalizedPayload)) {
+			const error = CodeExecutionProtocolError.make({
+				implementation: dynamicWorkerImplementation,
+				message: "The execution host returned a result that could not cross the JSON boundary"
+			});
+			failPass(error);
+			return yield* error;
+		}
 		queued.resolve(decoded.value._tag === "CodeHostCallSuccess" ? {
 			_tag: "CodeHostCallSuccess",
-			value: normalizedPayload
+			value: normalizedPayload.value
 		} : {
 			_tag: "CodeHostCallFailure",
-			error: normalizedPayload
+			error: normalizedPayload.value
 		});
 	});
 	const server = yield* Effect.gen(function* () {
@@ -1771,7 +1836,7 @@ const makeExecute = (options) => Effect.fn("DynamicWorkerCodeExecutor.execute")(
 		},
 		env: {
 			CODE_MODE_HOST: options.hostStub,
-			CODE_MODE_PASS: JSON.stringify({
+			CODE_MODE_PASS: encodeHarnessPassConfig({
 				passId,
 				namespaces: request.namespaces.map((namespace) => ({
 					name: namespace.name,
@@ -1794,7 +1859,7 @@ const makeExecute = (options) => Effect.fn("DynamicWorkerCodeExecutor.execute")(
 	const worker = yield* Effect.acquireRelease(Effect.try({
 		try: () => options.loader.load(workerCode),
 		catch: (cause) => {
-			const text = cause instanceof Error ? cause.message : String(cause);
+			const text = safeCauseMessage(cause, "The Worker Loader failed without a diagnostic");
 			if (/syntaxerror|failed to (compile|parse)/i.test(text)) return CodeSourceError.make({
 				implementation: dynamicWorkerImplementation,
 				reason: "invalid",
@@ -1806,13 +1871,13 @@ const makeExecute = (options) => Effect.fn("DynamicWorkerCodeExecutor.execute")(
 				cause
 			});
 		}
-	}), (stub) => Effect.sync(() => {
-		stub[Symbol.dispose]?.();
-	}));
+	}), disposeRpcHandle);
+	const entrypoint = yield* Effect.acquireRelease(Effect.try({
+		try: () => worker.getEntrypoint(),
+		catch: (cause) => classifyWorkerFailure(cause, request.limits.maxWallTime)
+	}), disposeRpcHandle);
 	const rpc = Effect.tryPromise({
-		try: async () => {
-			return await worker.getEntrypoint().run();
-		},
+		try: () => entrypoint.run(),
 		catch: (cause) => classifyWorkerFailure(cause, request.limits.maxWallTime)
 	});
 	const exit = yield* Effect.raceFirst(rpc.pipe(Effect.timeoutOrElse({
@@ -1829,7 +1894,7 @@ const makeExecute = (options) => Effect.fn("DynamicWorkerCodeExecutor.execute")(
 	if (passFailure !== void 0) return yield* passFailure;
 	if (Exit.isFailure(exit)) return yield* Effect.failCause(exit.cause);
 	const raw = exit.value;
-	const finishedAt = performance.now();
+	const finishedAt = clock.monotonicTimeNanosUnsafe();
 	const outcome = decodeHarnessOutcome(raw);
 	if (Option.isNone(outcome)) return yield* CodeExecutionProtocolError.make({
 		implementation: dynamicWorkerImplementation,
@@ -1841,7 +1906,7 @@ const makeExecute = (options) => Effect.fn("DynamicWorkerCodeExecutor.execute")(
 			value: outcome.value.value,
 			logs: outcome.value.logs,
 			resourceUse: CodeExecutionResourceUse.make({
-				wallTime: Duration.millis(Math.max(0, finishedAt - startedAt)),
+				wallTime: Duration.nanos(finishedAt > startedAt ? finishedAt - startedAt : 0n),
 				hostCalls: outcome.value.hostCalls,
 				logBytes: outcome.value.logBytes,
 				resultBytes: outcome.value.resultBytes
@@ -1902,13 +1967,7 @@ const makeExecute = (options) => Effect.fn("DynamicWorkerCodeExecutor.execute")(
 * than a fabricated program result.
 */
 const classifyWorkerFailure = (cause, maxWallTime) => {
-	const text = (() => {
-		try {
-			return cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause);
-		} catch {
-			return "[unserializable worker failure]";
-		}
-	})();
+	const text = safeCauseDiagnostic(cause, "[unserializable worker failure]");
 	if (/syntaxerror|failed to (compile|parse)/i.test(text)) return CodeSourceError.make({
 		implementation: dynamicWorkerImplementation,
 		reason: "invalid",
@@ -1931,8 +1990,12 @@ const classifyWorkerFailure = (cause, maxWallTime) => {
 	});
 };
 /** Layer building the Dynamic Worker `CodeExecutor` from resolved bindings. */
-const dynamicWorkerCodeExecutorLayer = (options) => Layer.succeed(CodeExecutor)(CodeExecutor.of({ execute: makeExecute(options) }));
+const dynamicWorkerCodeExecutorLayer = (options) => Layer.effect(CodeExecutor, Effect.gen(function* () {
+	const crypto = yield* Crypto.Crypto;
+	const clock = yield* Clock.Clock;
+	return CodeExecutor.of({ execute: makeExecute(options, crypto, clock) });
+})).pipe(Layer.provide(BrowserCrypto.layer));
 //#endregion
-export { AbortRecorded, AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, AdmissionLimitExceeded, ApprovalRecorded, AwaitProgressRequest, CLOUDFLARE_DATABASE_CAP_BYTES, CLOUDFLARE_RUNTIME_DEFAULTS, CancelProgressRequest, CloudflareAdmissionLimitsValue, CloudflareBindingError, CloudflareConversationClient, CloudflareDurableRuntime, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError, CodeModeHostEntrypoint, ConversationClientError, ConversationMaintenance, ConversationMaintenanceFailpoint, ConversationObjectIdentity, ConversationObjectNamespace, ConversationObjectPorts, DEFAULT_MAX_DATABASE_BYTES, DurableAlarmError, DurableAlarmService, DurableObjectContext, ExplainedRecovery, HostFailed, HostFailure, HostProtocolError, HostResponse, MaintenancePassReport, ObligationsScanned, ObservePageRequest, ObservedPage, ProgressCancelled, ProgressObserved, ProgressWaitRegistry, RetryExecuted, SettlementReached, SubmitRequest, SubmitSucceeded, UnknownResolutionRecorded, VerifiedIntegrity, boundHostDiagnostic, cloudflareWakeSchedulerLayer, conversationNamespaceFromEnv, conversationNamespaceLayer, conversationPortTransportLayer, decodeAbortCommand, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeApprovalDecisionCommand, decodeAwaitProgressRequest, decodeCancelProgressRequest, decodeHostResponse, decodeObligationThresholds, decodeObservePageRequest, decodeReceipt, decodeRetryCommand, decodeSubmitRequest, decodeUnknownResolutionCommand, dynamicWorkerCodeExecutorLayer, dynamicWorkerImplementation, encodeAbortCommand, encodeAdminResponse, encodeApprovalDecisionCommand, encodeAwaitProgressRequest, encodeCancelProgressRequest, encodeHostResponse, encodeObservePageRequest, encodeReceipt, encodeSubmitRequest, encodeUnknownResolutionCommand, makeConversationObjectClass };
+export { AbortRecorded, AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, AdmissionLimitExceeded, ApprovalRecorded, AwaitProgressRequest, CLOUDFLARE_DATABASE_CAP_BYTES, CLOUDFLARE_RUNTIME_DEFAULTS, CancelProgressRequest, CloudflareAdmissionLimitsValue, CloudflareBindingError, CloudflareConversationClient, CloudflareDurableRuntime, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError, CodeModeHostEntrypoint, ConversationClientError, ConversationMaintenance, ConversationMaintenanceFailpoint, ConversationObjectIdentity, ConversationObjectNamespace, ConversationObjectPorts, DEFAULT_MAX_DATABASE_BYTES, DurableAlarmError, DurableAlarmService, DurableObjectContext, ExplainedRecovery, HostFailed, HostFailure, HostProtocolError, HostResponse, MaintenancePassReport, ObligationsScanned, ObservePageRequest, ObservedPage, ProgressCancelled, ProgressObserved, ProgressWaitRegistry, RetryExecuted, SettlementReached, SubmitRequest, SubmitSucceeded, UnknownResolutionRecorded, VerifiedIntegrity, boundHostDiagnostic, cloudflareWakeSchedulerLayer, conversationNamespaceFromEnv, conversationNamespaceLayer, conversationPortTransportLayer, decodeAbortCommand, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeApprovalDecisionCommand, decodeAwaitProgressRequest, decodeCancelProgressRequest, decodeHostResponse, decodeObligationThresholds, decodeObservePageRequest, decodeReceipt, decodeRetryCommand, decodeSubmitRequest, decodeUnknownResolutionCommand, disposeRpcHandle, dynamicWorkerCodeExecutorLayer, dynamicWorkerImplementation, encodeAbortCommand, encodeAdminResponse, encodeApprovalDecisionCommand, encodeAwaitProgressRequest, encodeCancelProgressRequest, encodeHostResponse, encodeObservePageRequest, encodeReceipt, encodeSubmitRequest, encodeUnknownResolutionCommand, makeConversationObjectClass };
 
 //# sourceMappingURL=index.mjs.map