@effect-agent/platform-cloudflare 0.1.0-beta.36 → 0.1.0-beta.38

package/dist/scheduling-B-OFqoS9.mjs

@@ -0,0 +1,1189 @@
+import { Clock, Context, Crypto, DateTime, Duration, Effect, Layer, Option, Predicate, Random, Ref, Schema, Semaphore, Stream } from "effect";
+import { AbortCommand, AbortIntent, AdmissionConflict, AgentBindingResolver, AppendConflict, ApprovalConflict, ApprovalDecisionCommand, ApprovalDecisionIntent, CanonicalRecordEnvelope, CanonicalSequence, ConversationNotMaterialized, ConversationStoreError, DEFAULT_OWNERSHIP_LEASE_DURATION, DefinitionDigests, DeploymentId, DigestError, DurableAgentRuntime, DurableRuntimeFailpointError, FenceRejected, IdempotencyKey, JoinedToHost, LedgerError, OperationDenied, PersistedJson, Principal, Receipt, ScheduleAuthorizationError, ScheduleCapacityError, ScheduleConflict, ScheduleDestination, ScheduleDriver, ScheduleFailpointError, ScheduleId, ScheduleNotFound, ScheduleOwner, ScheduleScope, ScheduleSnapshot, ScheduleSnapshotPage, ScheduleStorageError, ScheduleTimingRequest, ScheduleValidationError, ScheduleWakeNoop, ScheduledInputAdmission, ScheduledInputRetryable, Scheduling, Settlement, SettlementConflict, SubmissionLedger, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, defaultSchedulingLimits, scheduleOwnerKey } from "@effect-agent/session";
+import { DEFAULT_MAX_STORED_VALUE_BYTES, DoScheduleAlarmControl, DoScheduleTransaction, scheduleStoreLayer } from "@effect-agent/storage-cloudflare";
+import { AgentId, AgentInputError } from "@effect-agent/core";
+import { BrowserCrypto } from "@effect/platform-browser";
+import { SqliteClient } from "@effect/sql-sqlite-do";
+import { DurableObject, DurableObjectAlarm, DurableObjectState, RpcTracing } from "effect-cf";
+//#region src/bindings.ts
+/**
+* Cloudflare platform bindings as Effect services (DEPLOY-010: "Cloudflare platform bindings
+* are supplied as Effect services/Layers"). Application code never reads `env` or touches a
+* `DurableObjectState` directly — the Conversation Object class constructs these Layers once
+* per incarnation and everything downstream consumes the services.
+*/
+/** A Cloudflare platform binding was missing or carried the wrong shape (DEPLOY-003/010). */
+var CloudflareBindingError = class extends Schema.TaggedError()("CloudflareBindingError", {
+	binding: Schema.String,
+	message: Schema.String
+}) {};
+/**
+* The `DurableObjectNamespace` binding that addresses Conversation Objects. The Object
+* identity rule is `namespace.idFromName(conversationId)` (plan §1.2): Conversation IDs are
+* globally unique, so the mapping is total and deterministic and no directory service exists.
+*/
+var ConversationObjectNamespace = class ConversationObjectNamespace extends Context.Service()("@effect-agent/platform-cloudflare/ConversationObjectNamespace") {
+	static layer(namespace) {
+		return Layer.succeed(ConversationObjectNamespace)({ namespace });
+	}
+};
+/**
+* Narrow one `env` member to a `DurableObjectNamespace`. `env` is an untyped platform value,
+* and a namespace binding is a host object no Schema can decode, so this is the documented
+* narrowest-boundary check (structural probe for the namespace surface the transport uses);
+* a missing or misshaped binding fails typed before any Layer is built.
+*/
+const conversationNamespaceFromEnv = Effect.fn("conversationNamespaceFromEnv")(function* (env, binding) {
+	if (!Predicate.isObjectKeyword(env)) return yield* CloudflareBindingError.make({
+		binding,
+		message: "The Worker environment is not an object; no bindings are available."
+	});
+	const candidate = yield* Effect.try({
+		try: () => {
+			const value = Reflect.get(env, binding);
+			if (!Predicate.isObjectKeyword(value)) return void 0;
+			const idFromName = Reflect.get(value, "idFromName");
+			const get = Reflect.get(value, "get");
+			return typeof idFromName === "function" && typeof get === "function" ? value : void 0;
+		},
+		catch: () => CloudflareBindingError.make({
+			binding,
+			message: `env.${binding} could not be inspected as a DurableObjectNamespace binding.`
+		})
+	});
+	if (candidate !== void 0) return candidate;
+	return yield* CloudflareBindingError.make({
+		binding,
+		message: `env.${binding} is not a DurableObjectNamespace binding; declare the Conversation Object class under this binding in the Worker configuration.`
+	});
+});
+/**
+* Build the namespace from Worker `env` (fails typed). Enable `rpcTracing` only when the
+* receiver also opts into the effect-cf native RPC trace-context contract.
+*/
+const conversationNamespaceLayer = (env, binding, options = {}) => Layer.effect(ConversationObjectNamespace)(Effect.map(conversationNamespaceFromEnv(env, binding), (namespace) => ({
+	namespace,
+	...options.rpcTracing === true ? { rpcTracing: binding } : {}
+})));
+/**
+* The live Durable Object execution context of THIS incarnation. Only Layer construction and
+* the alarm service consume it; important state never lives on it (`ctx.storage` is truth,
+* everything in memory is a cache — deployment spec §11).
+*/
+var DurableObjectContext = class DurableObjectContext extends Context.Service()("@effect-agent/platform-cloudflare/DurableObjectContext") {
+	static layer(ctx, env) {
+		return Layer.succeed(DurableObjectContext)({
+			ctx,
+			env
+		});
+	}
+};
+/**
+* The Conversation identity this Object serializes and the producer identity its Attempts
+* write with (`{producerPrefix}:{conversationId}`, plan §1.4). Derived once per incarnation
+* from `ctx.id.name` — the Object identity rule guarantees the name IS the Conversation ID.
+*/
+var ConversationObjectIdentity = class extends Context.Service()("@effect-agent/platform-cloudflare/ConversationObjectIdentity") {};
+//#endregion
+//#region src/config.ts
+/**
+* Schema-validated configuration for the Cloudflare durable runtime (deployment spec §4:
+* decoded once during Layer construction, exposed as a typed service; DEPLOY-003). Every
+* cadence is in milliseconds; every bound is finite and checked before any resource opens.
+*/
+const PositiveMillis = Schema.Int.check(Schema.isGreaterThan(0));
+const NonNegativeMillis = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+/** The supplied Cloudflare durable runtime configuration failed validation (DEPLOY-003). */
+var CloudflarePlatformConfigError = class extends Schema.TaggedError()("CloudflarePlatformConfigError", {
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+/**
+* An admission was refused by a host resource limit BEFORE any ledger row existed
+* (deployment spec §8, DEPLOY-007: "Admission has explicit bounded quota and overload
+* behavior... a typed rejection"). This is the DC analogue of `NodeDurableHost`'s
+* `AdmissionClosed` host gate: the port surface stays untouched, the refusal happens in the
+* Conversation Object's submit entry point before `DurableAgentRuntime.submit` runs, and
+* nothing was admitted or written.
+*/
+var AdmissionLimitExceeded = class extends Schema.TaggedError()("AdmissionLimitExceeded", {
+	limit: Schema.Literals([
+		"queue-depth",
+		"input-bytes",
+		"database-bytes"
+	]),
+	actual: Schema.Int,
+	maximum: Schema.Int
+}) {
+	get message() {
+		return `Admission refused before any ledger row existed: ${this.limit} ${this.actual} exceeds the configured maximum ${this.maximum}. Accepted work is unaffected; retry after the lane drains or raise the limit (DEPLOY-007).`;
+	}
+};
+/** The platform's hard per-Object database cap (10 GB, developers.cloudflare.com limits). */
+const CLOUDFLARE_DATABASE_CAP_BYTES = 1e10;
+/** Default database-size admission ceiling: a 1 GB safety margin under the platform cap. */
+const DEFAULT_MAX_DATABASE_BYTES = 9e9;
+/**
+* Explicit bounded admission quotas checked by the Conversation Object BEFORE admission
+* (exit gate "resource limits are checked before admission").
+*/
+var CloudflareAdmissionLimitsValue = class extends Schema.Class("@effect-agent/platform-cloudflare/CloudflareAdmissionLimitsValue")({
+	/** Maximum nonterminal Submissions per Conversation lane before new admissions refuse. */
+	maxQueueDepthPerLane: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(1e5)),
+	/** Maximum encoded input bytes; never above the storage per-value bound. */
+	maxInputBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2e6)),
+	/** Maximum `ctx.storage.sql.databaseSize` at admission; stays under the 10 GB platform cap. */
+	maxDatabaseBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(CLOUDFLARE_DATABASE_CAP_BYTES))
+}) {};
+/**
+* Validated Cloudflare durable runtime configuration. The producer identity of one
+* Conversation Object is `{producerPrefix}:{conversationId}` — stable across incarnations of
+* the same deployment, distinct across deployments — and producer-epoch fencing (not the
+* producer name) remains the correctness authority (DUR-006).
+*/
+var CloudflareDurableRuntimeConfigValue = class extends Schema.Class("@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfigValue")({
+	deploymentId: DeploymentId,
+	/** Head of the minted producer identity `{producerPrefix}:{conversationId}`. */
+	producerPrefix: Schema.NonEmptyString.check(Schema.isMaxLength(256)),
+	/** Submission ownership lease duration (D5); fences work across Object incarnations. */
+	ownershipLeaseDuration: PositiveMillis,
+	/** Base delay of the alarm re-arm backoff when a pass makes no progress. */
+	alarmBackoffBase: PositiveMillis,
+	/** Ceiling of the alarm re-arm backoff. */
+	alarmBackoffCap: PositiveMillis,
+	/**
+	* The maintenance-pass scan cadence and the ceiling of every re-arm delay: nonterminal
+	* work is revisited at least this often (wake/scan pairing, persistence §14).
+	*/
+	wakeScanInterval: PositiveMillis,
+	/** `awaitSettlement` ledger re-check cadence when no wake arrives. */
+	settlementPollInterval: PositiveMillis,
+	/** Worker ownership-lease renewal cadence during an active Attempt. */
+	leaseRenewalInterval: PositiveMillis,
+	/** Active-Run abort-intent poll cadence. */
+	abortPollInterval: PositiveMillis,
+	/** Canonical observation poll cadence of the Durable Object store. */
+	observationPollInterval: NonNegativeMillis,
+	/** Per-value byte bound; must stay under the platform's 2 MB SQLite value limit. */
+	maxStoredValueBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2e6)),
+	/** Opt-in full payload/digest-chain audit while opening the store. */
+	verifyOnOpen: Schema.Boolean,
+	limits: CloudflareAdmissionLimitsValue
+}) {};
+/** Explicit configuration authority for the assembled Cloudflare durable runtime. */
+var CloudflareDurableRuntimeConfig = class extends Context.Service()("@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfig") {};
+/** Documented production defaults applied by `CloudflareDurableRuntime.layer`. */
+const CLOUDFLARE_RUNTIME_DEFAULTS = {
+	ownershipLeaseDuration: Duration.toMillis(DEFAULT_OWNERSHIP_LEASE_DURATION),
+	alarmBackoffBase: 100,
+	alarmBackoffCap: 5e3,
+	wakeScanInterval: 1e3,
+	settlementPollInterval: 500,
+	leaseRenewalInterval: 1e4,
+	abortPollInterval: 500,
+	observationPollInterval: 25,
+	maxStoredValueBytes: DEFAULT_MAX_STORED_VALUE_BYTES,
+	verifyOnOpen: false,
+	maxQueueDepthPerLane: 256,
+	maxInputBytes: DEFAULT_MAX_STORED_VALUE_BYTES,
+	maxDatabaseBytes: DEFAULT_MAX_DATABASE_BYTES
+};
+//#endregion
+//#region src/boundary.ts
+const MAX_FOREIGN_DIAGNOSTIC_LENGTH = 8192;
+const boundForeignDiagnostic = (message) => message.slice(0, MAX_FOREIGN_DIAGNOSTIC_LENGTH);
+/** Render a foreign failure without trusting accessors or coercion hooks on the value. */
+const safeCauseMessage = (cause, fallback) => {
+	try {
+		const message = cause instanceof Error ? cause.message : cause;
+		return boundForeignDiagnostic(typeof message === "string" ? message : String(message));
+	} catch {
+		return boundForeignDiagnostic(fallback);
+	}
+};
+/** Include an Error name when worker-failure classification needs it. */
+const safeCauseDiagnostic = (cause, fallback) => {
+	try {
+		return cause instanceof Error ? boundForeignDiagnostic(`${cause.name}: ${cause.message}`) : safeCauseMessage(cause, fallback);
+	} catch {
+		return boundForeignDiagnostic(fallback);
+	}
+};
+/** Read Cloudflare RPC classifications without letting a hostile proxy defect the client. */
+const cloudflareFailureSignals = (cause) => {
+	if (!Predicate.isObjectKeyword(cause)) return {};
+	try {
+		const retryableValue = Reflect.get(cause, "retryable");
+		const overloadedValue = Reflect.get(cause, "overloaded");
+		const resetValue = Reflect.get(cause, "durableObjectReset");
+		const retryable = typeof retryableValue === "boolean" ? retryableValue : resetValue === true ? true : void 0;
+		const overloaded = typeof overloadedValue === "boolean" ? overloadedValue : void 0;
+		return {
+			...retryable === void 0 ? {} : { retryable },
+			...overloaded === void 0 ? {} : { overloaded }
+		};
+	} catch {
+		return {};
+	}
+};
+//#endregion
+//#region src/alarm.ts
+/**
+* The single multiplexed Durable Object alarm (decision D-P6-2). A Durable Object has ONE
+* alarm slot; every cadence the Node host ran on fibers (wake scan, lease expiry, settlement
+* and abort re-checks, retry backoff) multiplexes into one idempotent maintenance pass, and
+* the slot always holds the EARLIEST deadline any caller asked for.
+*
+* The alarm invariant (plan §1.4): every committed actionable mutation carries a newer durable
+* maintenance generation and a committed alarm. Stable externally-driven waits may be
+* nonterminal without retaining an alarm; their resolving mutation advances the generation and
+* restores the alarm atomically.
+*/
+/** The Durable Object alarm API failed; surfaces on host entry points as a typed refusal. */
+var DurableAlarmError = class extends Schema.TaggedError()("DurableAlarmError", {
+	operation: Schema.String,
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+const alarmFailure = (operation) => (cause) => DurableAlarmError.make({
+	operation,
+	message: safeCauseMessage(cause, "The Cloudflare alarm API failed without a diagnostic"),
+	cause
+});
+/** `ctx.storage` alarm slot as an Effect service; storage is truth, never a memory field. */
+var DurableAlarmService = class DurableAlarmService extends Context.Service()("@effect-agent/platform-cloudflare/DurableAlarmService") {
+	static layer = Layer.effect(DurableAlarmService)(Effect.gen(function* () {
+		const { ctx } = yield* DurableObjectContext;
+		/**
+		* In-memory pass bookkeeping — a pure CACHE, never state: a fresh incarnation has no
+		* running pass, and a deferred wake lost to eviction was only ever a promptness hint
+		* on top of the already-committed pre-armed alarm.
+		*/
+		const runningPasses = yield* Ref.make(0);
+		const scheduled = Effect.tryPromise({
+			try: () => ctx.storage.getAlarm(),
+			catch: alarmFailure("get alarm")
+		}).pipe(Effect.map((deadline) => deadline === null ? Option.none() : Option.some(deadline)));
+		const scheduleAt = (epochMillis) => Effect.tryPromise({
+			try: () => ctx.storage.setAlarm(epochMillis),
+			catch: alarmFailure("set alarm")
+		});
+		const ensureScheduledBy = (epochMillis) => scheduled.pipe(Effect.flatMap((existing) => Option.isSome(existing) && existing.value <= epochMillis ? Effect.void : scheduleAt(epochMillis)));
+		const armNow = Clock.currentTimeMillis.pipe(Effect.flatMap((now) => ensureScheduledBy(now)));
+		const scheduleNow = Ref.get(runningPasses).pipe(Effect.flatMap((passes) => passes > 0 ? Effect.void : armNow));
+		const withWakesDeferred = (body) => Ref.update(runningPasses, (passes) => passes + 1).pipe(Effect.andThen(body), Effect.ensuring(Ref.update(runningPasses, (passes) => passes - 1)));
+		const cancel = Effect.tryPromise({
+			try: () => ctx.storage.deleteAlarm(),
+			catch: alarmFailure("delete alarm")
+		});
+		return DurableAlarmService.of({
+			scheduled,
+			scheduleAt,
+			ensureScheduledBy,
+			scheduleNow,
+			withWakesDeferred,
+			cancel
+		});
+	}));
+};
+/** What one maintenance pass did — auditable evidence mirroring `NodeDurableHost`'s report. */
+var MaintenancePassReport = class extends Schema.Class("@effect-agent/platform-cloudflare/MaintenancePassReport")({
+	/** `caught-up` is generation-only; `actionable` ran recovery and one bounded drain. */
+	phase: Schema.Literals(["caught-up", "actionable"]),
+	/** Recovery decisions executed (or deferred) BEFORE any new claim in this pass. */
+	recovered: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Settlements the drain pass finalized. */
+	settled: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Submissions still nonterminal after the pass (suspended/unknown lanes stay honest). */
+	nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** `rearmed` for dirty/autonomous work, `cleared` for stable waits or settlement. */
+	alarm: Schema.Literals(["rearmed", "cleared"])
+}) {};
+/** Test-only fault authority; production uses the inert layer. */
+var ConversationMaintenanceFailpoint = class extends Context.Service()("@effect-agent/platform-cloudflare/ConversationMaintenanceFailpoint") {
+	static layer = Layer.succeed(this)({ hit: () => Effect.void });
+};
+const MaintenanceGeneration = Schema.BigIntFromString.check(Schema.isGreaterThanOrEqualToBigInt(0n));
+/** Versioned, platform-private maintenance state stored through Durable Object KV. */
+var ConversationMaintenanceState = class extends Schema.Class("@effect-agent/platform-cloudflare/ConversationMaintenanceState")({
+	schemaVersion: Schema.Literal(1),
+	dirty: MaintenanceGeneration,
+	processed: MaintenanceGeneration,
+	nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+}) {};
+const MAINTENANCE_STATE_KEY = "effect-agent:conversation-maintenance:v1";
+const decodeMaintenanceState = Schema.decodeUnknownSync(ConversationMaintenanceState);
+const encodeMaintenanceState = Schema.encodeSync(ConversationMaintenanceState);
+const initialMaintenanceState = () => ConversationMaintenanceState.make({
+	schemaVersion: 1,
+	dirty: 1n,
+	processed: 0n,
+	nonterminal: 0
+});
+const readMaintenanceState = async (transaction) => {
+	const encoded = await transaction.get(MAINTENANCE_STATE_KEY);
+	return encoded === void 0 ? {
+		state: initialMaintenanceState(),
+		initialized: false
+	} : {
+		state: decodeMaintenanceState(encoded),
+		initialized: true
+	};
+};
+const ensureTransactionAlarmBy = async (transaction, deadline) => {
+	const scheduled = await transaction.getAlarm();
+	if (scheduled === null || scheduled > deadline) await transaction.setAlarm(deadline);
+};
+const stableExternalWait = (snapshot, reports) => {
+	const decision = reports.get(snapshot.submissionId)?.decision._tag;
+	if (decision === "SettleAborted") return false;
+	switch (snapshot.state) {
+		case "suspended":
+		case "joined": return true;
+		case "unknown": return decision === "AwaitUnknownResolution" || decision === "MarkUnknown";
+		case "admitted": return reports.get(snapshot.submissionId)?.decision._tag === "AwaitParentEstablishment";
+		case "input-applied":
+		case "joining":
+		case "ready":
+		case "running":
+		case "settled":
+		case "terminalizing": return false;
+	}
+};
+/**
+* Incremental, quiescent maintenance over a durable dirty/processed generation (issue #93).
+*
+* `pass` = generation snapshot/pre-arm → recovery → bounded drain → generation acknowledgement:
+*
+* 1. One storage transaction reads dirty/processed and re-arms before work. A caught-up forced
+*    alarm takes an O(1) path without recovery, ledger scans, or canonical-history reads.
+* 2. Recovery still strictly precedes a new claim, and one bounded drain advances the lane.
+* 3. The final transaction acknowledges only the generation observed at pass start. A racing
+*    mutation therefore remains `dirty > processed` and retains its atomically-established alarm.
+* 4. Stable external waits acknowledge and clear. Autonomous retry, indeterminate, and lease
+*    recovery states leave their generation dirty and retain bounded backoff rearming.
+*/
+var ConversationMaintenance = class ConversationMaintenance extends Context.Service()("@effect-agent/platform-cloudflare/ConversationMaintenance") {
+	static layer = Layer.effect(ConversationMaintenance)(Effect.gen(function* () {
+		const runtime = yield* DurableAgentRuntime;
+		const resolver = yield* AgentBindingResolver;
+		const ledger = yield* SubmissionLedger;
+		const alarm = yield* DurableAlarmService;
+		const config = yield* CloudflareDurableRuntimeConfig;
+		const identity = yield* ConversationObjectIdentity;
+		const { ctx } = yield* DurableObjectContext;
+		const failpoint = yield* ConversationMaintenanceFailpoint;
+		/**
+		* Consecutive no-progress passes — an in-memory CACHE, not state: a fresh incarnation
+		* restarts at zero and merely re-arms sooner than a long-lived one would have.
+		*/
+		const stalls = yield* Ref.make(0);
+		/**
+		* Incarnation-local mutation count guarded with the generation transactions below. It is
+		* deliberately not durable: after eviction every begun mutation has stopped, while its
+		* pre-armed dirty generation remains durable for recovery. The short gate never spans the
+		* caller's mutation or cross-Object I/O.
+		*/
+		const activeMutations = yield* Ref.make(0);
+		const generationGate = yield* Semaphore.make(1);
+		const maintenancePassGate = yield* Semaphore.make(1);
+		const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
+		const runTransaction = (operation, transaction) => Effect.tryPromise({
+			try: transaction,
+			catch: alarmFailure(operation)
+		});
+		const beginMutation = Effect.fn("ConversationMaintenance.beginMutation")(function* () {
+			yield* failpoint.hit("maintenance:dirty:before");
+			const now = yield* Clock.currentTimeMillis;
+			yield* runTransaction("advance maintenance generation", () => ctx.storage.transaction(async (transaction) => {
+				const { state } = await readMaintenanceState(transaction);
+				const next = ConversationMaintenanceState.make({
+					...state,
+					dirty: state.dirty + 1n
+				});
+				await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+				await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
+			}));
+			yield* failpoint.hit("maintenance:dirty:after");
+			yield* Ref.update(activeMutations, (active) => active + 1);
+		});
+		const endMutation = generationGate.withPermit(Ref.update(activeMutations, (active) => Math.max(0, active - 1)));
+		const withMutation = (body) => Effect.acquireUseRelease(generationGate.withPermit(beginMutation()), () => failpoint.hit("maintenance:mutation:armed").pipe(Effect.andThen(body), Effect.tap(() => failpoint.hit("maintenance:mutation:finished"))), () => endMutation);
+		const ensureAlarm = Effect.fn("ConversationMaintenance.ensureAlarm")(function* () {
+			yield* failpoint.hit("maintenance:ensure:before");
+			const now = yield* Clock.currentTimeMillis;
+			yield* runTransaction("ensure maintenance alarm", () => ctx.storage.transaction(async (transaction) => {
+				const { state, initialized } = await readMaintenanceState(transaction);
+				if (!initialized) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+				if (state.dirty > state.processed) await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
+			}));
+			yield* failpoint.hit("maintenance:ensure:after");
+		});
+		const beginPass = Effect.fn("ConversationMaintenance.beginPass")(function* () {
+			yield* failpoint.hit("maintenance:begin:before");
+			const now = yield* Clock.currentTimeMillis;
+			const result = yield* runTransaction("begin maintenance pass", () => ctx.storage.transaction(async (transaction) => {
+				const { state, initialized } = await readMaintenanceState(transaction);
+				if (!initialized) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+				if (state.processed >= state.dirty) {
+					await transaction.deleteAlarm();
+					return {
+						_tag: "CaughtUp",
+						nonterminal: state.nonterminal
+					};
+				}
+				await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);
+				return {
+					_tag: "Actionable",
+					generation: state.dirty
+				};
+			}));
+			yield* failpoint.hit("maintenance:begin:after");
+			return result;
+		});
+		const rearmDelay = Effect.fn("ConversationMaintenance.rearmDelay")(function* (progressed) {
+			const priorStalls = yield* Ref.getAndUpdate(stalls, (count) => progressed ? 0 : count + 1);
+			if (progressed) return config.alarmBackoffBase;
+			const exponent = Math.min(priorStalls, 30);
+			const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** exponent);
+			const jitter = yield* Random.next;
+			const jittered = Math.ceil(backoff / 2 + backoff / 2 * jitter);
+			return Math.min(jittered, config.wakeScanInterval);
+		});
+		const pass = Effect.fn("ConversationMaintenance.pass")(function* () {
+			const annotate = (report) => Effect.annotateCurrentSpan({
+				phase: report.phase,
+				recovered: report.recovered,
+				settled: report.settled,
+				nonterminal: report.nonterminal,
+				alarm: report.alarm
+			}).pipe(Effect.as(report));
+			const started = yield* generationGate.withPermit(Effect.gen(function* () {
+				const activeAtStart = yield* Ref.get(activeMutations);
+				return {
+					...yield* beginPass(),
+					activeAtStart
+				};
+			}));
+			if (started._tag === "CaughtUp") return yield* annotate(MaintenancePassReport.make({
+				phase: "caught-up",
+				recovered: 0,
+				settled: 0,
+				nonterminal: started.nonterminal,
+				alarm: "cleared"
+			}));
+			const recovered = yield* runtime.runRecovery;
+			const settlements = yield* runtime.processConversationResolved(identity.conversationId).pipe(Effect.provideService(AgentBindingResolver, resolver));
+			const remaining = yield* Stream.runCollect(ledger.scanNonterminal);
+			const reports = new Map(recovered.map((report) => [report.submissionId, report]));
+			const head = remaining[0];
+			const headWaiting = head !== void 0 && stableExternalWait(head, reports);
+			const autonomous = remaining.some((snapshot, index) => {
+				if (index > 0 && headWaiting && snapshot.state === "ready" && reports.get(snapshot.submissionId)?.decision._tag === "ApplyInput") return false;
+				return !stableExternalWait(snapshot, reports);
+			});
+			const progressed = settlements.length > 0 || recovered.some((report) => report.disposition === "repaired");
+			const delay = autonomous ? yield* rearmDelay(progressed) : 0;
+			const now = yield* Clock.currentTimeMillis;
+			yield* failpoint.hit("maintenance:finish:before");
+			const alarmDisposition = yield* generationGate.withPermit(Effect.gen(function* () {
+				const active = yield* Ref.get(activeMutations);
+				return yield* runTransaction("finish maintenance pass", () => ctx.storage.transaction(async (transaction) => {
+					const { state } = await readMaintenanceState(transaction);
+					const processed = autonomous || started.activeAtStart > 0 || active > 0 ? state.processed : state.processed > started.generation ? state.processed : started.generation;
+					const next = ConversationMaintenanceState.make({
+						...state,
+						processed,
+						nonterminal: remaining.length
+					});
+					await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+					if (autonomous) {
+						await transaction.setAlarm(now + delay);
+						return "rearmed";
+					}
+					if (started.activeAtStart > 0 || active > 0 || next.dirty > next.processed) {
+						await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);
+						return "rearmed";
+					}
+					await transaction.deleteAlarm();
+					return "cleared";
+				}));
+			}));
+			yield* failpoint.hit("maintenance:finish:after");
+			if (alarmDisposition === "cleared") yield* Ref.set(stalls, 0);
+			return yield* annotate(MaintenancePassReport.make({
+				phase: "actionable",
+				recovered: recovered.length,
+				settled: settlements.length,
+				nonterminal: remaining.length,
+				alarm: alarmDisposition
+			}));
+		});
+		return ConversationMaintenance.of({
+			pass: alarm.withWakesDeferred(maintenancePassGate.withPermit(pass())),
+			ensureAlarm: ensureAlarm(),
+			withMutation
+		});
+	}));
+};
+//#endregion
+//#region src/client.ts
+/**
+* The Worker↔Conversation-Object host protocol (plan §1.4): Schema envelopes for the host
+* entry points (`submitEncoded`, `awaitSettlementEncoded`, `observePage`, `abortEncoded`,
+* `resolveApprovalEncoded`, `resolveUnknownEncoded`) plus the Worker-side client that speaks
+* it. Mirrors the WP2 port protocol: requests and responses are closed Schema unions, typed
+* failures travel as their own tagged classes and RE-DECODE to identical tags on the caller
+* (error-tag fidelity), and protocol anomalies are answered typed instead of thrown.
+*/
+/** Ceiling for host protocol diagnostic strings. */
+const MAX_HOST_DIAGNOSTIC_LENGTH = 4096;
+const BoundedDiagnostic = Schema.String.check(Schema.isMaxLength(MAX_HOST_DIAGNOSTIC_LENGTH));
+/** Truncate a diagnostic string to the host protocol's bounded length. */
+const boundHostDiagnostic = (value) => value.length > MAX_HOST_DIAGNOSTIC_LENGTH ? `${value.slice(0, MAX_HOST_DIAGNOSTIC_LENGTH - 3)}...` : value;
+/**
+* The envelope itself could not be honored: the Object could not decode the request, or a
+* response could not be encoded/decoded. Never carries operation semantics.
+*/
+var HostProtocolError = class extends Schema.TaggedError()("HostProtocolError", { message: BoundedDiagnostic }) {};
+/** The Worker-side stub call itself failed (RPC rejection, overload, eviction mid-call). */
+var ConversationClientError = class extends Schema.TaggedError()("ConversationClientError", {
+	conversationId: Schema.String,
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect()),
+	/** Cloudflare's own classification for a failure safe to retry with a fresh stub. */
+	retryable: Schema.optionalKey(Schema.Boolean),
+	/** Cloudflare overloads are surfaced immediately instead of adding retry pressure. */
+	overloaded: Schema.optionalKey(Schema.Boolean)
+}) {};
+/**
+* One durable submission, input ALREADY encoded by the caller through the Agent Binding's
+* input schema (the Worker bundles the same Agent definitions as the Object, so schema
+* validation happens client-side; the resolved Binding re-validates at claim time). The
+* Conversation identity is deliberately absent — the addressed Object IS the lane.
+*/
+var SubmitRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/SubmitRequest")({
+	agentId: AgentId,
+	principal: Principal,
+	idempotencyKey: IdempotencyKey,
+	definitions: DefinitionDigests,
+	inputPayload: PersistedJson
+}) {};
+/** One bounded page of canonical records after an optional sequence. */
+var ObservePageRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/ObservePageRequest")({
+	afterSequence: Schema.optionalKey(CanonicalSequence),
+	limit: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(1024))
+}) {};
+/** One event-driven wait for canonical progress strictly after this sequence. */
+var AwaitProgressRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/AwaitProgressRequest")({
+	afterSequence: CanonicalSequence,
+	waiterId: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256))
+}) {};
+/** Best-effort cancellation of one in-flight progress RPC. */
+var CancelProgressRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/CancelProgressRequest")({ waiterId: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256)) }) {};
+/**
+* Every typed failure a host entry point can produce, plus the protocol's own errors. Same
+* closed-union discipline as the WP2 `PortFailure`: members re-decode to the SAME tagged
+* classes on the Worker side; `cause` chains travel as Schema defects without instance
+* fidelity (plan §2.8).
+*/
+const HostFailure = Schema.Union([
+	AgentInputError,
+	DigestError,
+	AdmissionConflict,
+	SettlementConflict,
+	ApprovalConflict,
+	UnknownResolutionConflict,
+	JoinedToHost,
+	LedgerError,
+	ConversationStoreError,
+	ConversationNotMaterialized,
+	AppendConflict,
+	FenceRejected,
+	DurableRuntimeFailpointError,
+	AdmissionLimitExceeded,
+	DurableAlarmError,
+	OperationDenied,
+	HostProtocolError
+]);
+var SubmitSucceeded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/SubmitSucceeded")("SubmitSucceeded", { receipt: Receipt }) {};
+var SettlementReached = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/SettlementReached")("SettlementReached", { settlement: Settlement }) {};
+var ObservedPage = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ObservedPage")("ObservedPage", { records: Schema.Array(CanonicalRecordEnvelope).check(Schema.isMaxLength(1024)) }) {};
+/** A record was already committed or an incarnation-local hint says the caller should re-read. */
+var ProgressObserved = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ProgressObserved")("ProgressObserved", {}) {};
+var ProgressCancelled = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ProgressCancelled")("ProgressCancelled", {}) {};
+var AbortRecorded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/AbortRecorded")("AbortRecorded", { intent: AbortIntent }) {};
+var ApprovalRecorded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ApprovalRecorded")("ApprovalRecorded", { intent: ApprovalDecisionIntent }) {};
+var UnknownResolutionRecorded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/UnknownResolutionRecorded")("UnknownResolutionRecorded", { intent: UnknownResolutionIntent }) {};
+/** The entry point failed TYPED on the Object; the failure re-decodes verbatim. */
+var HostFailed = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/HostFailed")("HostFailed", { failure: HostFailure }) {};
+/** The uniform answer of one host entry point. Callers narrow by the tag their call implies. */
+const HostResponse = Schema.Union([
+	SubmitSucceeded,
+	SettlementReached,
+	ObservedPage,
+	ProgressObserved,
+	ProgressCancelled,
+	AbortRecorded,
+	ApprovalRecorded,
+	UnknownResolutionRecorded,
+	HostFailed
+]);
+const decodeSubmitRequest = Schema.decodeUnknownEffect(SubmitRequest);
+const encodeSubmitRequest = Schema.encodeEffect(SubmitRequest);
+const decodeReceipt = Schema.decodeUnknownEffect(Receipt);
+const encodeReceipt = Schema.encodeEffect(Receipt);
+const decodeObservePageRequest = Schema.decodeUnknownEffect(ObservePageRequest);
+const encodeObservePageRequest = Schema.encodeEffect(ObservePageRequest);
+const decodeAwaitProgressRequest = Schema.decodeUnknownEffect(AwaitProgressRequest);
+const encodeAwaitProgressRequest = Schema.encodeEffect(AwaitProgressRequest);
+const decodeCancelProgressRequest = Schema.decodeUnknownEffect(CancelProgressRequest);
+const encodeCancelProgressRequest = Schema.encodeEffect(CancelProgressRequest);
+const decodeAbortCommand = Schema.decodeUnknownEffect(AbortCommand);
+const encodeAbortCommand = Schema.encodeEffect(AbortCommand);
+const decodeApprovalDecisionCommand = Schema.decodeUnknownEffect(ApprovalDecisionCommand);
+const encodeApprovalDecisionCommand = Schema.encodeEffect(ApprovalDecisionCommand);
+const decodeUnknownResolutionCommand = Schema.decodeUnknownEffect(UnknownResolutionCommand);
+const encodeUnknownResolutionCommand = Schema.encodeEffect(UnknownResolutionCommand);
+const encodeHostResponse = Schema.encodeEffect(HostResponse);
+const decodeHostResponse = Schema.decodeUnknownEffect(HostResponse);
+/** Failure surface of `CloudflareConversationClient.submit`. */
+const ClientSubmitHostFailure = Schema.Union([
+	AgentInputError,
+	DigestError,
+	AdmissionConflict,
+	LedgerError,
+	ConversationStoreError,
+	ConversationNotMaterialized,
+	AppendConflict,
+	FenceRejected,
+	DurableRuntimeFailpointError,
+	AdmissionLimitExceeded,
+	DurableAlarmError,
+	HostProtocolError
+]);
+const ClientAwaitHostFailure = Schema.Union([
+	LedgerError,
+	SettlementConflict,
+	HostProtocolError
+]);
+const ClientObserveHostFailure = Schema.Union([
+	ConversationStoreError,
+	ConversationNotMaterialized,
+	OperationDenied,
+	HostProtocolError
+]);
+const ClientAbortHostFailure = Schema.Union([
+	LedgerError,
+	SettlementConflict,
+	JoinedToHost,
+	DurableRuntimeFailpointError,
+	DurableAlarmError,
+	HostProtocolError
+]);
+const ClientApprovalHostFailure = Schema.Union([
+	LedgerError,
+	SettlementConflict,
+	ApprovalConflict,
+	OperationDenied,
+	DurableAlarmError,
+	HostProtocolError
+]);
+const ClientUnknownHostFailure = Schema.Union([
+	LedgerError,
+	SettlementConflict,
+	UnknownResolutionConflict,
+	JoinedToHost,
+	DurableRuntimeFailpointError,
+	OperationDenied,
+	DurableAlarmError,
+	HostProtocolError
+]);
+const outOfContract = (conversationId, operation, observed) => ConversationClientError.make({
+	conversationId,
+	message: boundHostDiagnostic(`The Conversation Object answered ${operation} with the out-of-contract ${observed}.`)
+});
+const hostRpcMethods = {
+	submit: "submitEncoded",
+	awaitSettlement: "awaitSettlementEncoded",
+	awaitProgress: "awaitProgressEncoded",
+	cancelProgress: "cancelProgressEncoded",
+	observePage: "observePage",
+	abort: "abortEncoded",
+	resolveApproval: "resolveApprovalEncoded",
+	resolveUnknown: "resolveUnknownEncoded"
+};
+/** Worker-side client over the Conversation Object namespace (DEPLOY-010). */
+var CloudflareConversationClient = class CloudflareConversationClient extends Context.Service()("@effect-agent/platform-cloudflare/CloudflareConversationClient") {
+	static layer = Layer.effect(CloudflareConversationClient)(Effect.gen(function* () {
+		const { namespace, rpcTracing } = yield* ConversationObjectNamespace;
+		const crypto = yield* Crypto.Crypto;
+		const call = Effect.fn(function* (conversationId, operation, encoded) {
+			const traceArgs = rpcTracing === void 0 ? [] : yield* RpcTracing.withRpcTraceContext([]);
+			const raw = yield* Effect.tryPromise({
+				try: () => {
+					return namespace.get(namespace.idFromName(conversationId))[hostRpcMethods[operation]](encoded, ...traceArgs);
+				},
+				catch: (cause) => ConversationClientError.make({
+					conversationId,
+					message: boundHostDiagnostic(`${operation} did not reach the Conversation Object: ${safeCauseMessage(cause, "the RPC failed without a diagnostic")}`),
+					cause,
+					...cloudflareFailureSignals(cause)
+				})
+			});
+			return yield* decodeHostResponse(raw).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`The ${operation} answer could not be decoded: ${error.message}`) })));
+		}, (effect, conversationId, operation) => rpcTracing === void 0 ? Effect.withSpan(effect, "CloudflareConversationClient.call", { attributes: {
+			conversationId,
+			operation
+		} }) : RpcTracing.withRpcClientSpan(effect, rpcTracing, hostRpcMethods[operation]));
+		const expect = (conversationId, operation, resultSchema, failureSchema) => {
+			const isExpectedResult = Schema.is(resultSchema);
+			const isExpectedFailure = Schema.is(failureSchema);
+			return (response) => {
+				if (response._tag === "HostFailed") {
+					const failure = response.failure;
+					return isExpectedFailure(failure) ? Effect.fail(failure) : Effect.fail(outOfContract(conversationId, operation, `failure ${failure._tag}`));
+				}
+				if (!isExpectedResult(response)) return Effect.fail(outOfContract(conversationId, operation, `result ${response._tag}`));
+				return Effect.succeed(response);
+			};
+		};
+		const readPage = (conversationId, options) => Effect.gen(function* () {
+			const request = ObservePageRequest.make({
+				...options?.afterSequence === void 0 ? {} : { afterSequence: options.afterSequence },
+				limit: options?.limit ?? 256
+			});
+			const encoded = yield* encodeObservePageRequest(request).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`observePage request encode failed: ${error.message}`) })));
+			const response = yield* call(conversationId, "observePage", encoded);
+			return (yield* expect(conversationId, "observePage", ObservedPage, ClientObserveHostFailure)(response)).records;
+		});
+		const cancelProgress = (conversationId, waiterId) => encodeCancelProgressRequest(CancelProgressRequest.make({ waiterId })).pipe(Effect.mapError(() => void 0), Effect.flatMap((encoded) => call(conversationId, "cancelProgress", encoded)), Effect.asVoid, Effect.ignore);
+		return CloudflareConversationClient.of({
+			submit: (agent, input, options) => Effect.gen(function* () {
+				const encodedInput = yield* Schema.encodeEffect(agent.definition.input)(input).pipe(Effect.mapError((cause) => AgentInputError.make({ message: `Unable to encode Agent input: ${cause.message}` })));
+				const inputPayload = yield* Schema.decodeUnknownEffect(PersistedJson)(encodedInput).pipe(Effect.mapError(() => AgentInputError.make({ message: "Agent input does not satisfy the canonical persistence bounds" })));
+				const request = SubmitRequest.make({
+					agentId: agent.definition.id,
+					principal: options.principal,
+					idempotencyKey: options.idempotencyKey,
+					definitions: options.definitions,
+					inputPayload
+				});
+				const encoded = yield* encodeSubmitRequest(request).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`submit request encode failed: ${error.message}`) })));
+				const response = yield* call(options.conversationId, "submit", encoded);
+				return (yield* expect(options.conversationId, "submit", SubmitSucceeded, ClientSubmitHostFailure)(response)).receipt;
+			}),
+			awaitSettlement: (receipt) => Effect.gen(function* () {
+				const encoded = yield* encodeReceipt(receipt).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`receipt encode failed: ${error.message}`) })));
+				const response = yield* call(receipt.conversationId, "awaitSettlement", encoded);
+				return (yield* expect(receipt.conversationId, "awaitSettlement", SettlementReached, ClientAwaitHostFailure)(response)).settlement;
+			}),
+			awaitProgress: (conversationId, afterSequence) => Effect.gen(function* () {
+				const waiterId = yield* crypto.randomUUIDv4.pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`awaitProgress cancellation identity generation failed: ${error.message}`) })));
+				const request = AwaitProgressRequest.make({
+					afterSequence,
+					waiterId
+				});
+				const encoded = yield* encodeAwaitProgressRequest(request).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`awaitProgress request encode failed: ${error.message}`) })));
+				const attempt = (retry) => call(conversationId, "awaitProgress", encoded).pipe(Effect.flatMap(expect(conversationId, "awaitProgress", ProgressObserved, ClientObserveHostFailure)), Effect.asVoid, Effect.catchTag("ConversationClientError", (error) => error.retryable === true && error.overloaded !== true && retry < 5 ? Effect.sleep(Duration.millis(10 * 2 ** retry)).pipe(Effect.andThen(attempt(retry + 1))) : Effect.fail(error)));
+				yield* attempt(0).pipe(Effect.onInterrupt(() => cancelProgress(conversationId, waiterId)));
+			}),
+			readPage,
+			readAll: (conversationId) => Effect.gen(function* () {
+				const all = [];
+				let after;
+				for (;;) {
+					const page = yield* readPage(conversationId, {
+						afterSequence: after,
+						limit: 1024
+					});
+					all.push(...page);
+					const last = page.at(-1);
+					if (page.length < 1024 || last === void 0) return all;
+					after = last.sequence;
+				}
+			}),
+			abort: (conversationId, command) => Effect.gen(function* () {
+				const encoded = yield* encodeAbortCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`abort command encode failed: ${error.message}`) })));
+				const response = yield* call(conversationId, "abort", encoded);
+				return (yield* expect(conversationId, "abort", AbortRecorded, ClientAbortHostFailure)(response)).intent;
+			}),
+			resolveApproval: (conversationId, command) => Effect.gen(function* () {
+				const encoded = yield* encodeApprovalDecisionCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`approval command encode failed: ${error.message}`) })));
+				const response = yield* call(conversationId, "resolveApproval", encoded);
+				return (yield* expect(conversationId, "resolveApproval", ApprovalRecorded, ClientApprovalHostFailure)(response)).intent;
+			}),
+			resolveUnknown: (conversationId, command) => Effect.gen(function* () {
+				const encoded = yield* encodeUnknownResolutionCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`resolution command encode failed: ${error.message}`) })));
+				const response = yield* call(conversationId, "resolveUnknown", encoded);
+				return (yield* expect(conversationId, "resolveUnknown", UnknownResolutionRecorded, ClientUnknownHostFailure)(response)).intent;
+			})
+		});
+	}));
+};
+//#endregion
+//#region src/scheduling.ts
+const SCHEDULE_ALARM_TAG = "effect-agent/ScheduleOwnerWake";
+const SCHEDULE_ALARM_ID = "driver";
+const ScheduleAlarmPayload = Schema.Struct({
+	schemaVersion: Schema.Literal(1),
+	generation: Schema.Int.check(Schema.isGreaterThan(0))
+});
+var ScheduleAlarmProtocolError = class extends Schema.TaggedError()("ScheduleAlarmProtocolError", { message: Schema.String }) {};
+const boundedProtocolMessage = (message) => message.length <= 4096 ? message : `${message.slice(0, 4093)}...`;
+var ScheduleOwnerProtocolError = class extends Schema.TaggedError()("ScheduleOwnerProtocolError", { message: Schema.String.check(Schema.isMaxLength(4096)) }) {};
+const ScheduleMutationRequestFields = {
+	schemaVersion: Schema.Literal(1),
+	agentId: AgentId,
+	input: PersistedJson,
+	scope: ScheduleScope,
+	scheduleId: ScheduleId,
+	timing: ScheduleTimingRequest,
+	destination: ScheduleDestination,
+	deliveryPrincipal: ScheduleScope.fields.principal,
+	definitions: DefinitionDigests
+};
+const ScheduleCreateRequest = Schema.TaggedStruct("Create", ScheduleMutationRequestFields);
+const ScheduleUpdateRequest = Schema.TaggedStruct("Update", {
+	...ScheduleMutationRequestFields,
+	expectedRevision: Schema.Int.check(Schema.isGreaterThan(0))
+});
+const ScheduleGetRequest = Schema.TaggedStruct("Get", {
+	schemaVersion: Schema.Literal(1),
+	scope: ScheduleScope,
+	scheduleId: ScheduleId
+});
+const ScheduleListRequest = Schema.TaggedStruct("List", {
+	schemaVersion: Schema.Literal(1),
+	scope: ScheduleScope,
+	after: Schema.optionalKey(ScheduleId),
+	limit: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(100)))
+});
+const ScheduleControlRequest = Schema.TaggedStruct("Control", {
+	schemaVersion: Schema.Literal(1),
+	operation: Schema.Literals([
+		"pause",
+		"resume",
+		"cancel"
+	]),
+	scope: ScheduleScope,
+	scheduleId: ScheduleId,
+	expectedRevision: Schema.Int.check(Schema.isGreaterThan(0))
+});
+const ScheduleOwnerRequest = Schema.Union([
+	ScheduleCreateRequest,
+	ScheduleUpdateRequest,
+	ScheduleGetRequest,
+	ScheduleListRequest,
+	ScheduleControlRequest
+]);
+const ScheduleOwnerFailure = Schema.Union([
+	ScheduleValidationError,
+	ScheduleAuthorizationError,
+	ScheduleConflict,
+	ScheduleNotFound,
+	ScheduleCapacityError,
+	ScheduleStorageError,
+	ScheduleFailpointError,
+	ScheduleOwnerProtocolError
+]);
+const ScheduleOwnerResponse = Schema.Union([
+	Schema.TaggedStruct("Snapshot", { value: ScheduleSnapshot }),
+	Schema.TaggedStruct("Page", { value: ScheduleSnapshotPage }),
+	Schema.TaggedStruct("Failed", { failure: ScheduleOwnerFailure })
+]);
+const decodeScheduleOwnerRequest = Schema.decodeUnknownEffect(ScheduleOwnerRequest);
+const encodeScheduleOwnerRequest = Schema.encodeEffect(ScheduleOwnerRequest);
+const decodeScheduleOwnerResponse = Schema.decodeUnknownEffect(ScheduleOwnerResponse);
+const encodeScheduleOwnerResponse = Schema.encodeEffect(ScheduleOwnerResponse);
+const scheduleProtocolFailure = (message) => ({
+	_tag: "Failed",
+	failure: ScheduleOwnerProtocolError.make({ message: boundedProtocolMessage(message) })
+});
+var ScheduleOwnerNamespace = class extends Context.Service()("@effect-agent/platform-cloudflare/ScheduleOwnerNamespace") {};
+const passthroughAgent = (agentId) => ({ definition: {
+	id: agentId,
+	input: PersistedJson
+} });
+const requestOwner = (request) => request.scope.owner;
+/** Provides the same authorized management service as NodeScheduling.layer. */
+var CloudflareSchedulingClient = class {
+	static layer = Layer.effect(Scheduling, Effect.gen(function* () {
+		const { namespace } = yield* ScheduleOwnerNamespace;
+		const call = Effect.fn("CloudflareSchedulingClient.call")(function* (owner, request) {
+			const encoded = yield* encodeScheduleOwnerRequest(request).pipe(Effect.mapError(() => ScheduleStorageError.make({
+				operation: "Schedule Owner protocol",
+				reason: "corrupt"
+			})));
+			const raw = yield* Effect.tryPromise({
+				try: () => namespace.get(namespace.idFromName(scheduleOwnerKey(owner))).schedule(encoded),
+				catch: () => ScheduleStorageError.make({
+					operation: "call Schedule Owner",
+					reason: "unavailable"
+				})
+			});
+			const response = yield* decodeScheduleOwnerResponse(raw).pipe(Effect.mapError(() => ScheduleStorageError.make({
+				operation: "Schedule Owner protocol",
+				reason: "corrupt"
+			})));
+			if (response._tag !== "Failed") return response;
+			return yield* response.failure._tag === "ScheduleOwnerProtocolError" ? ScheduleStorageError.make({
+				operation: "Schedule Owner protocol",
+				reason: "corrupt"
+			}) : response.failure;
+		});
+		const encodeInput = Effect.fn("CloudflareSchedulingClient.encodeInput")(function* (agent, input) {
+			const encoded = yield* Schema.encodeEffect(agent.definition.input)(input).pipe(Effect.mapError(() => ScheduleValidationError.make({ message: "Unable to encode Agent input" })));
+			return yield* Schema.decodeUnknownEffect(PersistedJson)(encoded).pipe(Effect.mapError(() => ScheduleValidationError.make({ message: "Agent input does not satisfy the canonical persistence bounds" })));
+		});
+		const create = (agent, input, options) => Effect.gen(function* () {
+			const payload = yield* encodeInput(agent, input);
+			const response = yield* call(options.scope.owner, {
+				_tag: "Create",
+				schemaVersion: 1,
+				agentId: agent.definition.id,
+				input: payload,
+				...options
+			});
+			return response._tag === "Snapshot" ? response.value : yield* ScheduleStorageError.make({
+				operation: "Schedule Owner protocol",
+				reason: "corrupt"
+			});
+		});
+		const update = (agent, input, options) => Effect.gen(function* () {
+			const payload = yield* encodeInput(agent, input);
+			const response = yield* call(options.scope.owner, {
+				_tag: "Update",
+				schemaVersion: 1,
+				agentId: agent.definition.id,
+				input: payload,
+				...options
+			});
+			return response._tag === "Snapshot" ? response.value : yield* ScheduleStorageError.make({
+				operation: "Schedule Owner protocol",
+				reason: "corrupt"
+			});
+		});
+		const get = (scope, scheduleId) => Effect.gen(function* () {
+			const response = yield* call(scope.owner, {
+				_tag: "Get",
+				schemaVersion: 1,
+				scope,
+				scheduleId
+			});
+			return response._tag === "Snapshot" ? response.value : yield* ScheduleStorageError.make({
+				operation: "Schedule Owner protocol",
+				reason: "corrupt"
+			});
+		});
+		const list = (scope, options = {}) => Effect.gen(function* () {
+			const response = yield* call(scope.owner, {
+				_tag: "List",
+				schemaVersion: 1,
+				scope,
+				...options.after === void 0 ? {} : { after: options.after },
+				...options.limit === void 0 ? {} : { limit: options.limit }
+			});
+			return response._tag === "Page" ? response.value : yield* ScheduleStorageError.make({
+				operation: "Schedule Owner protocol",
+				reason: "corrupt"
+			});
+		});
+		const control = (operation, scope, scheduleId, expectedRevision) => Effect.gen(function* () {
+			const response = yield* call(scope.owner, {
+				_tag: "Control",
+				schemaVersion: 1,
+				operation,
+				scope,
+				scheduleId,
+				expectedRevision
+			});
+			return response._tag === "Snapshot" ? response.value : yield* ScheduleStorageError.make({
+				operation: "Schedule Owner protocol",
+				reason: "corrupt"
+			});
+		});
+		return Scheduling.of({
+			create,
+			update,
+			get,
+			list,
+			pause: (scope, id, revision) => control("pause", scope, id, revision),
+			resume: (scope, id, revision) => control("resume", scope, id, revision),
+			cancel: (scope, id, revision) => control("cancel", scope, id, revision)
+		});
+	}));
+};
+var ScheduleOwnerIdentity = class extends Context.Service()("@effect-agent/platform-cloudflare/ScheduleOwnerIdentity") {};
+const decodeOwnerName = Effect.fn("decodeScheduleOwnerName")(function* (name) {
+	if (name === null || name === void 0) return yield* ScheduleOwnerProtocolError.make({ message: "Schedule Owner objects require an idFromName identity" });
+	const tuple = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Tuple([Schema.String, Schema.String])))(name).pipe(Effect.mapError(() => ScheduleOwnerProtocolError.make({ message: "Schedule Owner object name is malformed" })));
+	return yield* Schema.decodeUnknownEffect(ScheduleOwner)({
+		tenantId: tuple[0],
+		ownerId: tuple[1]
+	}).pipe(Effect.mapError(() => ScheduleOwnerProtocolError.make({ message: "Schedule Owner object identity is invalid" })));
+});
+const alarmStorageError = (operation) => (error) => ScheduleStorageError.make({
+	operation,
+	reason: error._tag === "StorageOperationError" ? "unavailable" : "corrupt"
+});
+const transactionLayer = Layer.effect(DoScheduleTransaction, Effect.gen(function* () {
+	const alarms = yield* DurableObjectAlarm.DurableObjectAlarm;
+	return DoScheduleTransaction.of({ run: (body) => Effect.gen(function* () {
+		const nowMillis = yield* Clock.currentTimeMillis;
+		return yield* alarms.transaction((transaction) => body((replacement) => replacement.deadlineAtMillis === null ? transaction.cancelAlarm({
+			id: SCHEDULE_ALARM_ID,
+			tag: SCHEDULE_ALARM_TAG
+		}).pipe(Effect.mapError(alarmStorageError("cancel Schedule Owner alarm"))) : Effect.fromOption(DateTime.make(Math.max(replacement.deadlineAtMillis, nowMillis + 1))).pipe(Effect.mapError(() => ScheduleStorageError.make({
+			operation: "validate Schedule Owner alarm deadline",
+			reason: "corrupt"
+		})), Effect.flatMap((runAt) => transaction.scheduleAlarm({
+			id: SCHEDULE_ALARM_ID,
+			tag: SCHEDULE_ALARM_TAG,
+			runAt,
+			payload: {
+				schemaVersion: 1,
+				generation: replacement.generation
+			}
+		}).pipe(Effect.mapError(alarmStorageError("schedule Schedule Owner alarm"))))))).pipe(Effect.catchTag("StorageOperationError", () => ScheduleStorageError.make({
+			operation: "commit Schedule Owner transaction",
+			reason: "unavailable"
+		})));
+	}) });
+}));
+const admissionLayer = Layer.effect(ScheduledInputAdmission, Effect.gen(function* () {
+	const client = yield* CloudflareConversationClient;
+	const submit = (envelope) => client.submit(passthroughAgent(envelope.agentId), envelope.input, {
+		conversationId: envelope.conversationId,
+		principal: envelope.deliveryPrincipal,
+		idempotencyKey: envelope.admissionKey,
+		definitions: envelope.definitions
+	}).pipe(Effect.catchTags({
+		AdmissionConflict: () => ScheduleStorageError.make({
+			operation: "scheduled admission",
+			reason: "corrupt"
+		}),
+		AdmissionLimitExceeded: () => ScheduledInputRetryable.make({ reason: "capacity" }),
+		ConversationClientError: (error) => ScheduledInputRetryable.make({ reason: error.overloaded === true ? "capacity" : "transport" }),
+		HostProtocolError: () => ScheduledInputRetryable.make({ reason: "ambiguous" }),
+		LedgerError: () => ScheduledInputRetryable.make({ reason: "storage" }),
+		ConversationStoreError: () => ScheduledInputRetryable.make({ reason: "storage" }),
+		DurableAlarmError: () => ScheduledInputRetryable.make({ reason: "storage" }),
+		AgentInputError: () => ScheduleStorageError.make({
+			operation: "scheduled admission",
+			reason: "corrupt"
+		}),
+		DigestError: () => ScheduleStorageError.make({
+			operation: "scheduled admission",
+			reason: "corrupt"
+		}),
+		ConversationNotMaterialized: () => ScheduledInputRetryable.make({ reason: "storage" }),
+		AppendConflict: () => ScheduledInputRetryable.make({ reason: "ambiguous" }),
+		FenceRejected: () => ScheduledInputRetryable.make({ reason: "ambiguous" }),
+		DurableRuntimeFailpointError: () => ScheduledInputRetryable.make({ reason: "ambiguous" })
+	}));
+	return ScheduledInputAdmission.of({ submit });
+}));
+const ensureOwner = (expected, request) => {
+	const observed = requestOwner(request);
+	return observed.tenantId === expected.tenantId && observed.ownerId === expected.ownerId ? Effect.void : Effect.fail(ScheduleOwnerProtocolError.make({ message: "The request owner does not match the addressed Schedule Owner object" }));
+};
+const handleScheduleRequest = Effect.fn("ScheduleOwner.handleRequest")(function* (encoded) {
+	const decoded = yield* decodeScheduleOwnerRequest(encoded).pipe(Effect.result);
+	if (decoded._tag === "Failure") return yield* encodeScheduleOwnerResponse(scheduleProtocolFailure("The Schedule request could not be decoded")).pipe(Effect.orDie);
+	const request = decoded.success;
+	const { owner } = yield* ScheduleOwnerIdentity;
+	const scheduling = yield* Scheduling;
+	const response = yield* Effect.gen(function* () {
+		yield* ensureOwner(owner, request);
+		switch (request._tag) {
+			case "Create": return {
+				_tag: "Snapshot",
+				value: yield* scheduling.create(passthroughAgent(request.agentId), request.input, {
+					scope: request.scope,
+					scheduleId: request.scheduleId,
+					timing: request.timing,
+					destination: request.destination,
+					deliveryPrincipal: request.deliveryPrincipal,
+					definitions: request.definitions
+				})
+			};
+			case "Update": return {
+				_tag: "Snapshot",
+				value: yield* scheduling.update(passthroughAgent(request.agentId), request.input, {
+					scope: request.scope,
+					scheduleId: request.scheduleId,
+					timing: request.timing,
+					destination: request.destination,
+					deliveryPrincipal: request.deliveryPrincipal,
+					definitions: request.definitions,
+					expectedRevision: request.expectedRevision
+				})
+			};
+			case "Get": return {
+				_tag: "Snapshot",
+				value: yield* scheduling.get(request.scope, request.scheduleId)
+			};
+			case "List": return {
+				_tag: "Page",
+				value: yield* scheduling.list(request.scope, {
+					...request.after === void 0 ? {} : { after: request.after },
+					...request.limit === void 0 ? {} : { limit: request.limit }
+				})
+			};
+			case "Control": return {
+				_tag: "Snapshot",
+				value: request.operation === "pause" ? yield* scheduling.pause(request.scope, request.scheduleId, request.expectedRevision) : request.operation === "resume" ? yield* scheduling.resume(request.scope, request.scheduleId, request.expectedRevision) : yield* scheduling.cancel(request.scope, request.scheduleId, request.expectedRevision)
+			};
+		}
+	}).pipe(Effect.map((value) => value), Effect.catch((failure) => Schema.is(ScheduleOwnerFailure)(failure) ? Effect.succeed({
+		_tag: "Failed",
+		failure
+	}) : Effect.succeed(scheduleProtocolFailure("The Schedule operation failed outside its public contract"))));
+	return yield* encodeScheduleOwnerResponse(response).pipe(Effect.orDie);
+});
+const scheduleAlarmHandler = (limits) => DurableObjectAlarm.processDue((event) => Effect.gen(function* () {
+	if (event.tag !== SCHEDULE_ALARM_TAG || event.id !== SCHEDULE_ALARM_ID) return yield* ScheduleAlarmProtocolError.make({ message: `Unsupported Schedule Owner alarm ${event.tag}/${event.id}` });
+	yield* Schema.decodeUnknownEffect(ScheduleAlarmPayload)(event.payload).pipe(Effect.mapError(() => ScheduleAlarmProtocolError.make({ message: "Unsupported Schedule Owner alarm payload version" })));
+	const scheduling = yield* ScheduleDriver;
+	const alarmControl = yield* DoScheduleAlarmControl;
+	const { owner } = yield* ScheduleOwnerIdentity;
+	const nowMillis = yield* Clock.currentTimeMillis;
+	yield* alarmControl.prearm(nowMillis + limits.recoveryPollMillis);
+	if ((yield* scheduling.runDue(owner)).failed > 0) yield* alarmControl.prearm((yield* Clock.currentTimeMillis) + limits.recoveryPollMillis);
+	else yield* alarmControl.reconcile;
+}), { mode: "ordered" }).pipe(Effect.asVoid);
+/**
+* The host Layer supplies authorization and routing and is cached for the object incarnation.
+* Cloudflare eviction does not guarantee its finalizers run. Do not acquire resources requiring
+* cleanup in this Layer; acquire them inside scoped `manage` / `prepare` operations instead.
+* Native services belong to effect-cf; the database and alarm runtime remain instance-owned.
+*/
+const makeScheduleOwnerObjectClass = (host, limits = defaultSchedulingLimits) => {
+	const ownerLayer = Layer.effect(ScheduleOwnerIdentity, Effect.gen(function* () {
+		const state = yield* DurableObjectState.DurableObjectState;
+		return ScheduleOwnerIdentity.of({ owner: yield* decodeOwnerName(state.raw.id.name) });
+	}));
+	const sqlLayer = Layer.unwrap(Effect.map(DurableObjectState.DurableObjectState, (state) => SqliteClient.layer({ storage: state.raw.storage })));
+	const application = Layer.merge(Scheduling.layer(limits), ScheduleDriver.layer(limits)).pipe(Layer.provideMerge(scheduleStoreLayer.pipe(Layer.provide(transactionLayer), Layer.provide(sqlLayer))), Layer.provide(admissionLayer.pipe(Layer.provide(CloudflareConversationClient.layer))), Layer.provide(ScheduleWakeNoop), Layer.provide(BrowserCrypto.layer), Layer.provideMerge(DurableObjectAlarm.DurableObjectAlarm.layer), Layer.provide(host), Layer.provideMerge(ownerLayer));
+	const runtime = Layer.effectContext(Effect.gen(function* () {
+		const state = yield* DurableObjectState.DurableObjectState;
+		const scope = yield* Effect.scope;
+		return yield* state.blockConcurrencyWhile(Layer.buildWithScope(application, scope));
+	}));
+	const Base = DurableObject.make(runtime, {
+		initialize: Effect.void,
+		rpc: { schedule: (encoded) => handleScheduleRequest(encoded) },
+		alarms: scheduleAlarmHandler(limits)
+	});
+	class ScheduleOwnerObject extends Base {
+		alarm(alarmInfo) {
+			return super.alarm?.(alarmInfo);
+		}
+	}
+	return ScheduleOwnerObject;
+};
+//#endregion
+export { CLOUDFLARE_RUNTIME_DEFAULTS as $, decodeHostResponse as A, encodeObservePageRequest as B, SubmitSucceeded as C, decodeApprovalDecisionCommand as D, decodeAbortCommand as E, encodeAbortCommand as F, ConversationMaintenanceFailpoint as G, encodeSubmitRequest as H, encodeApprovalDecisionCommand as I, MaintenancePassReport as J, DurableAlarmError as K, encodeAwaitProgressRequest as L, decodeReceipt as M, decodeSubmitRequest as N, decodeAwaitProgressRequest as O, decodeUnknownResolutionCommand as P, CLOUDFLARE_DATABASE_CAP_BYTES as Q, encodeCancelProgressRequest as R, SubmitRequest as S, boundHostDiagnostic as T, encodeUnknownResolutionCommand as U, encodeReceipt as V, ConversationMaintenance as W, safeCauseMessage as X, safeCauseDiagnostic as Y, AdmissionLimitExceeded as Z, ObservePageRequest as _, ScheduleOwnerProtocolError as a, CloudflareBindingError as at, ProgressObserved as b, ApprovalRecorded as c, DurableObjectContext as ct, CloudflareConversationClient as d, CloudflareAdmissionLimitsValue as et, ConversationClientError as f, HostResponse as g, HostProtocolError as h, ScheduleOwnerNamespace as i, DEFAULT_MAX_DATABASE_BYTES as it, decodeObservePageRequest as j, decodeCancelProgressRequest as k, AwaitProgressRequest as l, conversationNamespaceFromEnv as lt, HostFailure as m, ScheduleAlarmProtocolError as n, CloudflareDurableRuntimeConfigValue as nt, makeScheduleOwnerObjectClass as o, ConversationObjectIdentity as ot, HostFailed as p, DurableAlarmService as q, ScheduleOwnerIdentity as r, CloudflarePlatformConfigError as rt, AbortRecorded as s, ConversationObjectNamespace as st, CloudflareSchedulingClient as t, CloudflareDurableRuntimeConfig as tt, CancelProgressRequest as u, conversationNamespaceLayer as ut, ObservedPage as v, UnknownResolutionRecorded as w, SettlementReached as x, ProgressCancelled as y, encodeHostResponse as z };
+
+//# sourceMappingURL=scheduling-B-OFqoS9.mjs.map