@effect-agent/platform-cloudflare 0.1.0-beta.6 → 0.1.0-beta.60

package/dist/ThreadObject-s5w3V_co.mjs

@@ -0,0 +1,675 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { DurableObjectContext, ThreadObjectIdentity, ThreadObjectNamespace, threadNamespaceFromEnv } from "./CloudflareBindings.mjs";
+import { AdmissionLimitExceeded, CLOUDFLARE_RUNTIME_DEFAULTS, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError } from "./CloudflareConfig.mjs";
+import { DurableAlarmError, DurableAlarmService, ThreadMaintenance, ThreadMaintenanceFailpoint, ThreadMessageDelivery, ThreadMutationGate, ThreadPublication, publishCommitted } from "./Alarm.mjs";
+import { AbortRecorded, ApprovalRecorded, CloudflareThreadClient, HostFailed, HostProtocolError, ObservedPage, ProgressCancelled, ProgressObserved, SettlementReached, SubmissionStatusResponse, SubmitSucceeded, UnknownResolutionRecorded, boundHostDiagnostic, decodeAbortCommand, decodeApprovalDecisionCommand, decodeAwaitProgressRequest, decodeCancelProgressRequest, decodeObservePageRequest, decodeReceipt, decodeSubmitRequest, decodeUnknownResolutionCommand, encodeHostResponse } from "./CloudflareThreadClient.mjs";
+import { t as cloudflarePreparedInputAdmissionLayer } from "./prepared-admission-G7N4DDqS.mjs";
+import { cloudflareWakeSchedulerLayer } from "./WakeScheduler.mjs";
+import { compileRegistrations } from "@effect-agent/thread/AgentRegistration";
+import { DurableAgentRuntime, DurableRuntimeConfig, RecoveryReport } from "@effect-agent/thread/DurableAgentRuntime";
+import { AdmissionPolicyError, LedgerError, OwnershipLost, SettlementConflict, SubmissionLedger, SubmissionLookupByKey } from "@effect-agent/thread/SubmissionLedger";
+import { ThreadProjectionMaintenance } from "@effect-agent/thread/ThreadProjectionMaintenance";
+import { Cause, Clock, Context, Deferred, Duration, Effect, Layer, Option, Ref, Schema, Semaphore, Stream } from "effect";
+import { SubmissionId, ThreadId } from "@effect-agent/core/Identifiers";
+import { PersistedJson, ProducerId } from "@effect-agent/thread/Records";
+import { DurableObject, DurableObjectState, WorkerEnvironment } from "effect-cf";
+import { BrowserCrypto } from "@effect/platform-browser";
+import { SqliteClient } from "@effect/sql-sqlite-do";
+import { DigestError } from "@effect-agent/thread/Digest";
+import { DurableRuntimeFailpoint, DurableRuntimeFailpointError } from "@effect-agent/thread/DurableFailpoint";
+import { OperationAuthorizationRequest, OperationAuthorizer, OperationDenied, operationAuthorizerLayer } from "@effect-agent/thread/OperationAuthorizer";
+import { AppendConflict, FenceRejected, ThreadNotMaterialized, ThreadRead, ThreadStore, ThreadStoreError } from "@effect-agent/thread/ThreadStore";
+import { decodePortRequest, encodePortResponse } from "@effect-agent/storage-cloudflare/PortProtocol";
+import { IntegrityReport, ObligationReport, ObligationThresholds, RecoveryExplanation, RetryCommand, RetryRefused } from "@effect-agent/thread/Admin";
+import { RunJournalError } from "@effect-agent/thread/RunJournal";
+import { WakeScheduler } from "@effect-agent/thread/WakeScheduler";
+import { CurrentToolFailureObserver, RunContextPreparationPassthrough, RunToolAuthorization, toolFailureObserverLayer } from "@effect-agent/engine/RunOptions";
+import { doMessageDeliveryStoreLayer } from "@effect-agent/storage-cloudflare/DoMessageDeliveryStore";
+import "@effect-agent/storage-cloudflare/DoStorageFailpoint";
+import { submissionLedgerLayer } from "@effect-agent/storage-cloudflare/DoSubmissionLedger";
+import { storageConfigLayer, storageFailpointLayer, threadStoreLayer } from "@effect-agent/storage-cloudflare/DoThreadStore";
+import { ThreadPortTransport, executePortRequest, portTransportFailure, routedSubmissionLedgerLayer, routedThreadStoreLayer } from "@effect-agent/storage-cloudflare/PortRouting";
+import { MessageDeliveryDriver, MessageDeliveryError, MessageDeliveryStore } from "@effect-agent/thread/MessageDelivery";
+import { ToolReconciler } from "@effect-agent/thread/ToolReconciler";
+import { SqlClient } from "effect/unstable/sql/SqlClient";
+//#region src/internal/message-delivery.ts
+/** Every externally requested write prearms the owning Object's maintenance generation. */
+const guardedMessageDeliveryStoreLayer = Layer.effect(MessageDeliveryStore, Effect.gen(function* () {
+	const store = yield* MessageDeliveryStore;
+	const mutations = yield* ThreadMutationGate;
+	const { threadId } = yield* ThreadObjectIdentity;
+	const deadline = yield* Ref.make(void 0);
+	const cacheGate = yield* Semaphore.make(1);
+	const local = (owner, body) => owner === threadId ? body : Effect.fail(MessageDeliveryError.make({
+		reason: "validation",
+		operation: "message owner"
+	}));
+	const mutate = (body) => mutations.withMutation(cacheGate.withPermit(Ref.set(deadline, void 0).pipe(Effect.andThen(body)))).pipe(Effect.catchTag("DurableAlarmError", () => MessageDeliveryError.make({
+		reason: "storage",
+		operation: "prearm message delivery"
+	})));
+	const nextDeadline = cacheGate.withPermit(Effect.gen(function* () {
+		const cached = yield* Ref.get(deadline);
+		if (cached !== void 0) return cached;
+		const current = yield* store.nextDeadline(threadId);
+		yield* Ref.set(deadline, current);
+		return current;
+	}));
+	return MessageDeliveryStore.of({
+		insert: (record) => local(record.key.ownerThreadId, mutate(store.insert(record))),
+		get: (key) => local(key.ownerThreadId, store.get(key)),
+		list: (request) => local(request.ownerThreadId, store.list(request)),
+		change: (key, change) => local(key.ownerThreadId, mutate(store.change(key, change))),
+		due: (nowMillis, limit, owner = threadId) => local(owner, store.due(nowMillis, limit, threadId)),
+		nextDeadline: (owner = threadId) => local(owner, nextDeadline)
+	});
+}));
+/** Message progress shares the native alarm slot without blocking source runtime work. */
+const threadMessageDeliveryLayer = Layer.effectContext(Effect.gen(function* () {
+	const driver = yield* MessageDeliveryDriver;
+	const store = yield* MessageDeliveryStore;
+	const { threadId } = yield* ThreadObjectIdentity;
+	const failure = (operation) => () => DurableAlarmError.make({
+		operation,
+		message: "Durable message recovery remains pending"
+	});
+	return Context.make(ThreadMessageDelivery, {
+		drain: Effect.gen(function* () {
+			const deadline = yield* store.nextDeadline(threadId);
+			if (deadline !== null && deadline <= (yield* Clock.currentTimeMillis)) yield* driver.runDue(threadId);
+		}).pipe(Effect.mapError(failure("drain message delivery"))),
+		pendingDeadline: store.nextDeadline(threadId).pipe(Effect.map(Option.fromNullishOr), Effect.mapError(failure("read message deadline")))
+	});
+}));
+//#endregion
+//#region src/internal/progress-wait.ts
+/** Cancellation tombstones are bounded hints, never durable authority. */
+const MAX_CANCELLATION_TOMBSTONES = 1024;
+/**
+* Per-incarnation cancellation registry for long-lived progress RPCs. The public runtime owns
+* the actual wake registration; this host-only registry lets an interrupted Worker Effect ask
+* the Object to interrupt its scoped wait before the Worker execution context itself ends.
+*/
+var ProgressWaitRegistry = class ProgressWaitRegistry extends Context.Service()("@effect-agent/platform-cloudflare/ProgressWaitRegistry") {
+	static layer = Layer.effect(ProgressWaitRegistry, Effect.gen(function* () {
+		const registrations = yield* Ref.make(/* @__PURE__ */ new Map());
+		const remove = (waiterId, deferred) => Ref.update(registrations, (current) => {
+			const existing = current.get(waiterId);
+			if (existing === void 0 || existing === "cancelled" || !existing.has(deferred)) return current;
+			const next = new Map(current);
+			const active = new Set(existing);
+			active.delete(deferred);
+			if (active.size === 0) next.delete(waiterId);
+			else next.set(waiterId, active);
+			return next;
+		});
+		const subscribe = Effect.fn("ProgressWaitRegistry.subscribe")((waiterId) => Effect.gen(function* () {
+			const deferred = yield* Deferred.make();
+			yield* Effect.addFinalizer(() => remove(waiterId, deferred));
+			return {
+				cancelled: yield* Ref.modify(registrations, (current) => {
+					const existing = current.get(waiterId);
+					const next = new Map(current);
+					if (existing === "cancelled") return [true, current];
+					const active = new Set(existing ?? []);
+					active.add(deferred);
+					next.set(waiterId, active);
+					return [false, next];
+				}),
+				deferred
+			};
+		}).pipe(Effect.map(({ cancelled, deferred }) => cancelled ? Effect.void : Deferred.await(deferred))));
+		const cancel = Effect.fn("ProgressWaitRegistry.cancel")(function* (waiterId) {
+			const waiters = yield* Ref.modify(registrations, (current) => {
+				const existing = current.get(waiterId);
+				if (existing === "cancelled") return [[], current];
+				const next = new Map(current);
+				next.delete(waiterId);
+				next.set(waiterId, "cancelled");
+				let tombstones = 0;
+				for (const registration of next.values()) if (registration === "cancelled") tombstones += 1;
+				if (tombstones > MAX_CANCELLATION_TOMBSTONES) for (const [id, registration] of next) {
+					if (registration !== "cancelled") continue;
+					next.delete(id);
+					break;
+				}
+				return [existing === void 0 ? [] : [...existing], next];
+			});
+			yield* Effect.forEach(waiters, (waiter) => Deferred.succeed(waiter, void 0), { discard: true });
+		}, Effect.uninterruptible);
+		return ProgressWaitRegistry.of({
+			subscribe,
+			cancel
+		});
+	}));
+};
+//#endregion
+//#region src/internal/transport.ts
+/**
+* `ThreadPortTransport` over native Durable Object JS RPC (decision D-P6-3): one
+* `portCall(envelope)` on the stub of the Object that owns the addressed Thread
+* (`namespace.idFromName(threadId)` — the identity rule, plan §1.2). The envelopes are
+* already Schema-encoded JSON, so the RPC boundary carries only structured-cloneable values;
+* the protocol module stays transport-agnostic and fetch-with-JSON remains the documented
+* fallback carrier.
+*
+* Every delivery problem — stub construction, RPC rejection, overload, deploy-in-progress —
+* surfaces as `PortTransportError` (preserving the platform stub's own `retryable` signal
+* when present) and NEVER as a fabricated answer: on `resolveAdmission` the routing layer
+* turns exactly this error into `AdmissionIndeterminate` (SUB-031).
+*/
+const threadPortTransportLayer = Layer.effect(ThreadPortTransport)(Effect.gen(function* () {
+	const { namespace } = yield* ThreadObjectNamespace;
+	return ThreadPortTransport.of({ call: (threadId, request) => Effect.tryPromise({
+		try: () => namespace.get(namespace.idFromName(threadId)).portCall(request),
+		catch: (cause) => portTransportFailure(threadId, cause)
+	}).pipe(Effect.withSpan("CloudflarePortTransport.call", { attributes: { threadId } })) });
+}));
+//#endregion
+//#region src/internal/layers.ts
+/**
+* Owner-side execution port for a `portCall` request the wire endpoint has already decoded.
+* It executes against THIS Object's LOCAL port facets — never the routed decorators, so a
+* request cannot bounce between Objects — and returns the typed response for the endpoint to
+* encode.
+*/
+var ThreadObjectPorts = class extends Context.Service()("@effect-agent/platform-cloudflare/ThreadObjectPorts") {};
+const decodeConfigValue = Schema.decodeUnknownEffect(CloudflareDurableRuntimeConfigValue);
+const decodeThreadId = Schema.decodeUnknownEffect(ThreadId);
+const decodeProducerId = Schema.decodeUnknownEffect(ProducerId);
+const configFromOptions = (options) => decodeConfigValue({
+	deploymentId: options.deploymentId,
+	producerPrefix: options.producerPrefix,
+	ownershipLeaseDuration: options.ownershipLeaseDuration ?? CLOUDFLARE_RUNTIME_DEFAULTS.ownershipLeaseDuration,
+	alarmBackoffBase: options.alarmBackoffBase ?? CLOUDFLARE_RUNTIME_DEFAULTS.alarmBackoffBase,
+	alarmBackoffCap: options.alarmBackoffCap ?? CLOUDFLARE_RUNTIME_DEFAULTS.alarmBackoffCap,
+	wakeScanInterval: options.wakeScanInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.wakeScanInterval,
+	settlementPollInterval: options.settlementPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.settlementPollInterval,
+	leaseRenewalInterval: options.leaseRenewalInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.leaseRenewalInterval,
+	abortPollInterval: options.abortPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.abortPollInterval,
+	observationPollInterval: options.observationPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.observationPollInterval,
+	maxStoredValueBytes: options.maxStoredValueBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxStoredValueBytes,
+	verifyOnOpen: options.verifyOnOpen ?? CLOUDFLARE_RUNTIME_DEFAULTS.verifyOnOpen,
+	limits: {
+		maxQueueDepthPerLane: options.maxQueueDepthPerLane ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxQueueDepthPerLane,
+		maxInputBytes: Math.min(options.maxInputBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxInputBytes, options.maxStoredValueBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxStoredValueBytes),
+		maxDatabaseBytes: options.maxDatabaseBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxDatabaseBytes
+	}
+}).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
+	message: `Invalid Cloudflare durable runtime configuration: ${error.message}`,
+	cause: error
+})));
+/**
+* The Thread this Object owns, from the Object identity rule (plan §1.2): Thread
+* Objects are addressed exclusively by `idFromName(threadId)`, so `ctx.id.name` IS the
+* Thread ID. An unnamed Object (from `newUniqueId`) is a deployment error, not a lane.
+*/
+const threadIdFromState = (ctx) => ctx.id.name === void 0 ? Effect.fail(CloudflarePlatformConfigError.make({ message: "This Durable Object was not created via idFromName(threadId); Thread Objects must be addressed by their Thread identity (plan §1.2)." })) : decodeThreadId(ctx.id.name).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
+	message: `The Durable Object name is not a valid ThreadId: ${error.message}`,
+	cause: error
+})));
+/**
+* Validate deployment settings and derive services before building application dependencies.
+* The native class factory builds this Layer inside its constructor gate. Custom Effect hosts
+* can provide it around the complete application Layer with the native context already supplied.
+*/
+const layerConfig = (options) => Layer.unwrap(Effect.gen(function* () {
+	const { ctx } = yield* DurableObjectContext;
+	const config = yield* configFromOptions(options);
+	const threadId = yield* threadIdFromState(ctx);
+	const producerId = yield* decodeProducerId(`${config.producerPrefix}:${threadId}`).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
+		message: `The minted producer identity is invalid: ${error.message}`,
+		cause: error
+	})));
+	return Layer.mergeAll(Layer.succeed(CloudflareDurableRuntimeConfig, config), Layer.succeed(ThreadObjectIdentity, {
+		threadId,
+		producerId
+	}), DurableRuntimeConfig.layer({
+		deploymentId: config.deploymentId,
+		producerId,
+		settlementPollInterval: Duration.millis(config.settlementPollInterval),
+		leaseRenewalInterval: Duration.millis(config.leaseRenewalInterval),
+		abortPollInterval: Duration.millis(config.abortPollInterval),
+		...options.estimateCostMicrousd === void 0 ? {} : { estimateCostMicrousd: options.estimateCostMicrousd }
+	}), BrowserCrypto.layer, storageFailpointLayer({
+		storage: ctx.storage,
+		failpoint: options.storageFailpoint?.(ctx)
+	}), options.runtimeFailpoint === void 0 ? DurableRuntimeFailpoint.layer : Layer.succeed(DurableRuntimeFailpoint, { hit: options.runtimeFailpoint(ctx) }), options.maintenanceFailpoint === void 0 ? ThreadMaintenanceFailpoint.layer : Layer.succeed(ThreadMaintenanceFailpoint, { hit: options.maintenanceFailpoint(ctx) }), options.toolReconciler ?? ToolReconciler.uncertain, options.operationAuthorizer === void 0 ? Layer.empty : operationAuthorizerLayer(options.operationAuthorizer), options.toolFailureObserver === void 0 ? Layer.succeed(CurrentToolFailureObserver, void 0) : toolFailureObserverLayer(options.toolFailureObserver), RunContextPreparationPassthrough, RunToolAuthorization.allowAll);
+}));
+/**
+* Register typed Agents and version declarations. Hashing and dependency capture happen in
+* this Layer's Scope, after application Layers have been provided. Every Agent's instruction,
+* Tool, Schema, and model requirements remain visible until satisfied by Layer composition.
+* Use Layer.unwrap for registration values that need effectful application setup.
+*/
+const registeredLayer = (registrations, options = {}) => Layer.unwrap(Effect.map(compileRegistrations(registrations), (bindings) => boundLayer(bindings, options)));
+function layer(registrations, options = {}) {
+	return registeredLayer(registrations, options);
+}
+/**
+* Assemble the durable runtime from already-resolved Agent Bindings.
+* Use `ThreadObject.layer` to compile typed Agent registrations instead.
+* Supply host services through `ThreadObject.make` or `ThreadObject.layerConfig` and
+* the Durable Object context and namespace Layers when composing a custom host.
+*/
+const boundLayer = (bindings, options = {}) => Layer.unwrap(Effect.gen(function* () {
+	const { ctx } = yield* DurableObjectContext;
+	const config = yield* CloudflareDurableRuntimeConfig;
+	const { threadId } = yield* ThreadObjectIdentity;
+	const storageOptions = {
+		storage: ctx.storage,
+		observationPollInterval: config.observationPollInterval,
+		ownershipLeaseDuration: config.ownershipLeaseDuration,
+		maxStoredValueBytes: config.maxStoredValueBytes,
+		verifyOnOpen: config.verifyOnOpen
+	};
+	const infrastructure = Layer.mergeAll(storageConfigLayer(storageOptions), SqliteClient.layer({ storage: ctx.storage }));
+	const rawLocalPorts = Layer.mergeAll(threadStoreLayer, submissionLedgerLayer).pipe(Layer.provide(infrastructure));
+	const messageStore = guardedMessageDeliveryStoreLayer.pipe(Layer.provide(doMessageDeliveryStoreLayer().pipe(Layer.provide(infrastructure))));
+	const messageRecovery = threadMessageDeliveryLayer.pipe(Layer.provide(MessageDeliveryDriver.layer({
+		batchSize: 4,
+		concurrency: 4
+	})), Layer.provide(cloudflarePreparedInputAdmissionLayer), Layer.provide(CloudflareThreadClient.layer), Layer.provide(messageStore));
+	const publication = (options.publication ?? ThreadPublication.layer).pipe(Layer.provide(Layer.mergeAll(rawLocalPorts, Layer.effect(SqlClient)(SqlClient))));
+	const projection = (options.projection ?? ThreadProjectionMaintenance.layer).pipe(Layer.provide(Layer.mergeAll(rawLocalPorts, Layer.effect(SqlClient)(SqlClient))));
+	const localPorts = options.publication === void 0 && options.projection === void 0 ? rawLocalPorts : Layer.effectContext(Effect.gen(function* () {
+		const store = yield* ThreadStore;
+		const ledger = yield* SubmissionLedger;
+		const mutations = yield* ThreadMutationGate;
+		const index = yield* ThreadProjectionMaintenance;
+		const publish = yield* Effect.context();
+		const afterCommit = publishCommitted.pipe(Effect.provide(publish));
+		const sourceCommits = yield* Semaphore.make(1);
+		const observedStore = ThreadStore.of({
+			...store,
+			append: (request) => mutations.withMutation(sourceCommits.withPermit(store.append(request).pipe(Effect.tap((result) => index.applyCommitted(request, result).pipe(Effect.catchCause((cause) => Cause.hasInterrupts(cause) ? Effect.interrupt : Effect.logError("Thread projection deferred after source commit", cause)))))).pipe(Effect.tap(() => afterCommit))).pipe(Effect.catchTag("DurableAlarmError", (cause) => ThreadStoreError.make({
+				operation: "prearm publication append",
+				message: cause.message,
+				cause
+			})))
+		});
+		const observeIntent = (body) => mutations.withMutation(body.pipe(Effect.tap(() => afterCommit))).pipe(Effect.catchTag("DurableAlarmError", (cause) => LedgerError.make({
+			operation: "prearm publication intent",
+			message: "The publication generation could not be armed",
+			cause
+		})));
+		return Context.make(ThreadStore, observedStore).pipe(Context.add(SubmissionLedger, {
+			...ledger,
+			recordApprovalDecision: (request) => observeIntent(ledger.recordApprovalDecision(request)),
+			requestAbort: (request) => observeIntent(ledger.requestAbort(request)),
+			recordUnknownResolution: (request) => observeIntent(ledger.recordUnknownResolution(request))
+		}));
+	})).pipe(Layer.provide(rawLocalPorts));
+	const portsEndpointLayer = Layer.effect(ThreadObjectPorts)(Effect.gen(function* () {
+		const local = yield* Effect.context();
+		return ThreadObjectPorts.of({ handle: (request) => executePortRequest(request).pipe(Effect.provide(local)) });
+	})).pipe(Layer.provide(localPorts));
+	const routedPorts = Layer.mergeAll(routedSubmissionLedgerLayer({ localThreadId: threadId }), routedThreadStoreLayer({ localThreadId: threadId })).pipe(Layer.provide(localPorts), Layer.provide(threadPortTransportLayer));
+	const base = Layer.mergeAll(DurableAlarmService.layer, ProgressWaitRegistry.layer);
+	const runtimeStack = DurableAgentRuntime.layerWithBindings(bindings).pipe(Layer.provide(cloudflarePreparedInputAdmissionLayer.pipe(Layer.provide(CloudflareThreadClient.layer))), Layer.provideMerge(messageStore), Layer.provideMerge(routedPorts), Layer.provideMerge(cloudflareWakeSchedulerLayer), Layer.provideMerge(base));
+	return Layer.mergeAll(runtimeStack, ThreadMaintenance.layer.pipe(Layer.provide(runtimeStack), Layer.provide(messageRecovery)), portsEndpointLayer, messageStore).pipe(Layer.provideMerge(publication), Layer.provideMerge(projection), Layer.provideMerge(ThreadMutationGate.layer), Layer.provideMerge(infrastructure));
+}));
+//#endregion
+//#region src/ThreadObject.ts
+var ThreadObject_exports = /* @__PURE__ */ __exportAll({
+	AdminExplainRequest: () => AdminExplainRequest,
+	AdminFailed: () => AdminFailed,
+	AdminFailure: () => AdminFailure,
+	AdminResponse: () => AdminResponse,
+	AdminVerifyRequest: () => AdminVerifyRequest,
+	ExplainedRecovery: () => ExplainedRecovery,
+	ObligationsScanned: () => ObligationsScanned,
+	RetryExecuted: () => RetryExecuted,
+	VerifiedIntegrity: () => VerifiedIntegrity,
+	decodeAdminExplainRequest: () => decodeAdminExplainRequest,
+	decodeAdminResponse: () => decodeAdminResponse,
+	decodeAdminVerifyRequest: () => decodeAdminVerifyRequest,
+	decodeObligationThresholds: () => decodeObligationThresholds,
+	decodeRetryCommand: () => decodeRetryCommand,
+	encodeAdminResponse: () => encodeAdminResponse,
+	layer: () => layer,
+	layerConfig: () => layerConfig,
+	make: () => make
+});
+/** Classify only a decoded port request so new protocol members cannot bypass pre-arming. */
+const isMutatingPortRequest = (request) => {
+	switch (request._tag) {
+		case "LedgerAdmit":
+		case "LedgerMarkReady":
+		case "LedgerRequestAbort":
+		case "LedgerRecordChildSettled":
+		case "StoreMaterialize":
+		case "StoreAppend": return true;
+		case "LedgerLookup":
+		case "LedgerResolveAdmission":
+		case "StoreReadPage":
+		case "StoreInspectTail":
+		case "StoreExport": return false;
+	}
+	return false;
+};
+/** The literal encoded `PortFailed(PortProtocolError)` fallback (same shape as WP2's). */
+const encodedPortProtocolFailure = (message) => ({
+	_tag: "PortFailed",
+	failure: {
+		_tag: "PortProtocolError",
+		message: boundHostDiagnostic(message)
+	}
+});
+const protocolFailure = (context) => (error) => HostProtocolError.make({ message: boundHostDiagnostic(`${context}: ${error.message}`) });
+/** Fold one endpoint's typed failures into the uniform `HostResponse` envelope. */
+const respond = (effect) => effect.pipe(Effect.map((result) => result), Effect.catch((failure) => Effect.succeed(HostFailed.make({ failure }))));
+/** Encode the response envelope; an unencodable response degrades to a protocol failure. */
+const encodeResponse = (response) => encodeHostResponse(response).pipe(Effect.catch((error) => Effect.succeed({
+	_tag: "HostFailed",
+	failure: {
+		_tag: "HostProtocolError",
+		message: boundHostDiagnostic(`The host response could not be encoded: ${error.message}`)
+	}
+})));
+const utf8Bytes = (value) => new TextEncoder().encode(JSON.stringify(value)).length;
+/**
+* The admission-limits gate, BEFORE `runtime.submit` touches the ledger (exit gate
+* "resource limits are checked before admission"; DEPLOY-007). A replayed idempotency key is
+* exempt: its accepted-work obligation already exists, and returning the original Receipt
+* consumes no new quota. Refusals are typed `AdmissionLimitExceeded` and nothing is written.
+*/
+const gateAdmissionLimits = Effect.fn("ThreadObject.gateAdmissionLimits")(function* (request) {
+	const identity = yield* ThreadObjectIdentity;
+	const config = yield* CloudflareDurableRuntimeConfig;
+	const ledger = yield* SubmissionLedger;
+	const { ctx } = yield* DurableObjectContext;
+	const existing = yield* ledger.lookup(SubmissionLookupByKey.make({
+		threadId: identity.threadId,
+		principal: request.principal,
+		idempotencyKey: request.idempotencyKey
+	}));
+	if (Option.isSome(existing)) return;
+	const inputBytes = utf8Bytes(request.inputPayload);
+	if (inputBytes > config.limits.maxInputBytes) return yield* AdmissionLimitExceeded.make({
+		limit: "input-bytes",
+		actual: inputBytes,
+		maximum: config.limits.maxInputBytes
+	});
+	const nonterminal = yield* Stream.runCollect(ledger.scanNonterminal);
+	if (nonterminal.length >= config.limits.maxQueueDepthPerLane) return yield* AdmissionLimitExceeded.make({
+		limit: "queue-depth",
+		actual: nonterminal.length,
+		maximum: config.limits.maxQueueDepthPerLane
+	});
+	const databaseBytes = yield* Effect.sync(() => ctx.storage.sql.databaseSize);
+	if (databaseBytes > config.limits.maxDatabaseBytes) return yield* AdmissionLimitExceeded.make({
+		limit: "database-bytes",
+		actual: databaseBytes,
+		maximum: config.limits.maxDatabaseBytes
+	});
+});
+/**
+* The submit-capable projection of an Agent Binding on the OBJECT side: the input arrived
+* already encoded through the real input schema on the Worker side (`client.ts`), so the
+* Object admits the canonical `PersistedJson` payload as-is; the resolved Binding re-derives
+* everything else from the stored `(agentId, agentDigests)` at claim time (SUB-023).
+*/
+const passthroughSubmitAgent = (agentId) => ({ definition: {
+	id: agentId,
+	input: PersistedJson
+} });
+const submitEndpoint = (encoded) => decodeSubmitRequest(encoded).pipe(Effect.mapError(protocolFailure("The submit request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	const maintenance = yield* ThreadMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	yield* gateAdmissionLimits(request);
+	const receipt = yield* maintenance.withMutation(runtime.submit(passthroughSubmitAgent(request.agentId), request.inputPayload, {
+		threadId: identity.threadId,
+		principal: request.principal,
+		idempotencyKey: request.idempotencyKey,
+		...request.admissionGroup === void 0 ? {} : { admissionGroup: request.admissionGroup },
+		...request.admissionFence === void 0 ? {} : { admissionFence: request.admissionFence },
+		...request.workerAdmission === void 0 ? {} : { workerAdmission: request.workerAdmission },
+		...request.messageAdmission === void 0 ? {} : { messageAdmission: request.messageAdmission },
+		definitions: request.definitions
+	}));
+	return SubmitSucceeded.make({ receipt });
+})), respond, Effect.flatMap(encodeResponse));
+const submissionStatusEndpoint = (encoded) => decodeReceipt(encoded).pipe(Effect.mapError(protocolFailure("The receipt could not be decoded")), Effect.flatMap((receipt) => Effect.gen(function* () {
+	const runtime = yield* DurableAgentRuntime;
+	return SubmissionStatusResponse.make({ status: yield* runtime.submissionStatus(receipt) });
+})), respond, Effect.flatMap(encodeResponse));
+const awaitSettlementEndpoint = (encoded) => decodeReceipt(encoded).pipe(Effect.mapError(protocolFailure("The receipt could not be decoded")), Effect.flatMap((receipt) => Effect.gen(function* () {
+	const settlement = yield* (yield* DurableAgentRuntime).awaitSettlement(receipt);
+	return SettlementReached.make({ settlement });
+})), respond, Effect.flatMap(encodeResponse));
+const awaitProgressEndpoint = (encoded) => decodeAwaitProgressRequest(encoded).pipe(Effect.mapError(protocolFailure("The progress request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	const runtime = yield* DurableAgentRuntime;
+	const registry = yield* ProgressWaitRegistry;
+	yield* Effect.scoped(Effect.gen(function* () {
+		const cancelled = yield* registry.subscribe(request.waiterId);
+		yield* Effect.raceFirst(runtime.awaitProgress(identity.threadId, request.afterSequence), cancelled);
+	}));
+	return ProgressObserved.make();
+})), respond, Effect.flatMap(encodeResponse));
+const cancelProgressEndpoint = (encoded) => decodeCancelProgressRequest(encoded).pipe(Effect.mapError(protocolFailure("The progress cancellation could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	yield* (yield* ProgressWaitRegistry).cancel(request.waiterId);
+	return ProgressCancelled.make();
+})), respond, Effect.flatMap(encodeResponse));
+const observePageEndpoint = (encoded) => decodeObservePageRequest(encoded).pipe(Effect.mapError(protocolFailure("The observe request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	const store = yield* ThreadStore;
+	yield* (yield* OperationAuthorizer).authorize(OperationAuthorizationRequest.make({
+		operation: "observe",
+		threadId: identity.threadId
+	}));
+	const records = yield* Stream.runCollect(store.read(ThreadRead.make({
+		threadId: identity.threadId,
+		...request.afterSequence === void 0 ? {} : { afterSequence: request.afterSequence },
+		limit: request.limit
+	})));
+	return ObservedPage.make({ records: [...records] });
+})), respond, Effect.flatMap(encodeResponse));
+const abortEndpoint = (encoded) => decodeAbortCommand(encoded).pipe(Effect.mapError(protocolFailure("The abort command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	const maintenance = yield* ThreadMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	const intent = yield* maintenance.withMutation(runtime.abort(command));
+	return AbortRecorded.make({ intent });
+})), respond, Effect.flatMap(encodeResponse));
+const resolveApprovalEndpoint = (encoded) => decodeApprovalDecisionCommand(encoded).pipe(Effect.mapError(protocolFailure("The approval command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	const maintenance = yield* ThreadMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	const intent = yield* maintenance.withMutation(runtime.resolveApproval(command));
+	return ApprovalRecorded.make({ intent });
+})), respond, Effect.flatMap(encodeResponse));
+const resolveUnknownEndpoint = (encoded) => decodeUnknownResolutionCommand(encoded).pipe(Effect.mapError(protocolFailure("The resolution command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	const maintenance = yield* ThreadMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	const intent = yield* maintenance.withMutation(runtime.resolveUnknown(command));
+	return UnknownResolutionRecorded.make({ intent });
+})), respond, Effect.flatMap(encodeResponse));
+/** Explain one Submission (`submissionId` present) or every nonterminal lane member. */
+var AdminExplainRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/AdminExplainRequest")({ submissionId: Schema.optionalKey(SubmissionId) }) {};
+/** Verify carries no parameters — the addressed Object IS the lane. */
+var AdminVerifyRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/AdminVerifyRequest")({}) {};
+/** Every typed failure of the four admin entry points, plus the protocol's own errors. */
+const AdminFailure = Schema.Union([
+	AdmissionPolicyError,
+	OperationDenied,
+	RetryRefused,
+	LedgerError,
+	RunJournalError,
+	DigestError,
+	OwnershipLost,
+	SettlementConflict,
+	ThreadStoreError,
+	ThreadNotMaterialized,
+	AppendConflict,
+	FenceRejected,
+	DurableRuntimeFailpointError,
+	DurableAlarmError,
+	HostProtocolError
+]);
+var ExplainedRecovery = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ExplainedRecovery")("ExplainedRecovery", { explanations: Schema.Array(RecoveryExplanation).check(Schema.isMaxLength(1024)) }) {};
+var VerifiedIntegrity = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/VerifiedIntegrity")("VerifiedIntegrity", { report: IntegrityReport }) {};
+var RetryExecuted = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/RetryExecuted")("RetryExecuted", { report: RecoveryReport }) {};
+var ObligationsScanned = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ObligationsScanned")("ObligationsScanned", { report: ObligationReport }) {};
+/** The admin entry point failed TYPED on the Object; the failure re-decodes verbatim. */
+var AdminFailed = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/AdminFailed")("AdminFailed", { failure: AdminFailure }) {};
+/** The uniform answer of one admin entry point. Callers narrow by the tag their call implies. */
+const AdminResponse = Schema.Union([
+	ExplainedRecovery,
+	VerifiedIntegrity,
+	RetryExecuted,
+	ObligationsScanned,
+	AdminFailed
+]);
+const decodeAdminExplainRequest = Schema.decodeUnknownEffect(AdminExplainRequest);
+const decodeAdminVerifyRequest = Schema.decodeUnknownEffect(AdminVerifyRequest);
+const decodeRetryCommand = Schema.decodeUnknownEffect(RetryCommand);
+const decodeObligationThresholds = Schema.decodeUnknownEffect(ObligationThresholds);
+const encodeAdminResponse = Schema.encodeEffect(AdminResponse);
+const decodeAdminResponse = Schema.decodeUnknownEffect(AdminResponse);
+/** Fold one admin endpoint's typed failures into the uniform `AdminResponse` envelope. */
+const respondAdmin = (effect) => effect.pipe(Effect.map((result) => result), Effect.catch((failure) => Effect.succeed(AdminFailed.make({ failure }))));
+/** Encode the admin response envelope; an unencodable response degrades to a protocol failure. */
+const encodeAdminResponseTotal = (response) => encodeAdminResponse(response).pipe(Effect.catch((error) => Effect.succeed({
+	_tag: "AdminFailed",
+	failure: {
+		_tag: "HostProtocolError",
+		message: boundHostDiagnostic(`The admin response could not be encoded: ${error.message}`)
+	}
+})));
+const explainEndpoint = (encoded) => decodeAdminExplainRequest(encoded).pipe(Effect.mapError(protocolFailure("The explain request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	const runtime = yield* DurableAgentRuntime;
+	const explanations = request.submissionId === void 0 ? yield* runtime.explainThread(identity.threadId) : [yield* runtime.explain(request.submissionId)];
+	return ExplainedRecovery.make({ explanations });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+const verifyEndpoint = (encoded) => decodeAdminVerifyRequest(encoded).pipe(Effect.mapError(protocolFailure("The verify request could not be decoded")), Effect.flatMap(() => Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	const report = yield* (yield* DurableAgentRuntime).verify(identity.threadId);
+	return VerifiedIntegrity.make({ report });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+const retryEndpoint = (encoded) => decodeRetryCommand(encoded).pipe(Effect.mapError(protocolFailure("The retry command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	const maintenance = yield* ThreadMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	const report = yield* maintenance.withMutation(runtime.retry(command));
+	return RetryExecuted.make({ report });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+const obligationsEndpoint = (encoded) => decodeObligationThresholds(encoded).pipe(Effect.mapError(protocolFailure("The obligation thresholds could not be decoded")), Effect.flatMap((thresholds) => Effect.gen(function* () {
+	const report = yield* (yield* DurableAgentRuntime).scanObligations(thresholds);
+	return ObligationsScanned.make({ report });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+/**
+* Owner-side `portCall`: wrap a mutating envelope in the same pre-armed generation protocol as
+* public RPC (a routed mutation committed by THIS Object must already carry the alarm that will
+* finish it), execute on the LOCAL facets (never the routed decorators), then arm an immediate
+* alarm so the mutated lane is processed promptly. Protocol anomalies answer
+* `PortFailed(PortProtocolError)`.
+*/
+const portCallEndpoint = (encoded) => Effect.gen(function* () {
+	const ports = yield* ThreadObjectPorts;
+	const maintenance = yield* ThreadMaintenance;
+	const alarm = yield* DurableAlarmService;
+	const decoded = yield* decodePortRequest(encoded).pipe(Effect.map((request) => ({
+		_tag: "success",
+		request
+	})), Effect.catch((error) => Effect.succeed({
+		_tag: "failure",
+		message: error.message
+	})));
+	if (decoded._tag === "failure") return encodedPortProtocolFailure(`The port request could not be decoded: ${decoded.message}`);
+	const mutating = isMutatingPortRequest(decoded.request);
+	const handled = yield* (mutating ? maintenance.withMutation(ports.handle(decoded.request)) : ports.handle(decoded.request)).pipe(Effect.exit);
+	if (handled._tag === "Failure") return encodedPortProtocolFailure("The owner Object could not arm its maintenance alarm before the mutation.");
+	const response = yield* encodePortResponse(handled.value).pipe(Effect.catch((error) => Effect.succeed(encodedPortProtocolFailure(`The port response could not be encoded: ${error.message}`))));
+	if (mutating) yield* alarm.scheduleNow.pipe(Effect.catch((error) => Effect.logWarning("ThreadObject.portCall: immediate re-arm failed", error)));
+	return response;
+});
+const wakeEndpoint = Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	yield* (yield* WakeScheduler).notify(identity.threadId);
+});
+const alarmEndpoint = Effect.gen(function* () {
+	yield* (yield* ThreadMaintenance).pass;
+});
+const gateEndpoint = Effect.gen(function* () {
+	yield* (yield* ThreadMaintenance).ensureAlarm;
+});
+/**
+* Adapter from effect-cf's native Durable Object services to Effect Agent's existing platform
+* ports. effect-cf owns the cached ManagedRuntime and supplies these values once per Object
+* incarnation; the durable runtime continues to depend only on the narrow services below.
+*/
+const effectCfPlatformLayer = (namespaceBinding, rpcTracing = false) => {
+	const context = Layer.effect(DurableObjectContext)(Effect.gen(function* () {
+		const state = yield* DurableObjectState.DurableObjectState;
+		const env = yield* WorkerEnvironment;
+		return DurableObjectContext.of({
+			ctx: state.raw,
+			env
+		});
+	}));
+	const namespace = Layer.effect(ThreadObjectNamespace)(Effect.gen(function* () {
+		const env = yield* WorkerEnvironment;
+		const binding = yield* threadNamespaceFromEnv(env, namespaceBinding);
+		return ThreadObjectNamespace.of({
+			namespace: binding,
+			...rpcTracing === true ? { rpcTracing: namespaceBinding } : {}
+		});
+	}));
+	return Layer.merge(context, namespace);
+};
+/**
+* Export a composed application Layer as a native Durable Object class.
+* Bootstrap services are provided to the whole graph before it acquires, so application Layers
+* can yield effect-cf's WorkerEnvironment and DurableObjectState, derived identity, and Crypto.
+* Application dependencies remain visible until Layer.provide satisfies them. effect-cf owns the
+* cached ManagedRuntime, native RPC methods, event scopes, and telemetry flushing.
+* Initialization is local and bounded inside the constructor gate. Cloudflare eviction does not
+* guarantee finalizers; put resources requiring timely release in scoped operations or eventLayer.
+*/
+const make = (applicationLayer, options) => {
+	const application = applicationLayer.pipe(Layer.provideMerge(layerConfig(options)), Layer.provideMerge(effectCfPlatformLayer(options.namespaceBinding, options.rpcTracing)));
+	const runtime = Layer.effectContext(Effect.gen(function* () {
+		const state = yield* DurableObjectState.DurableObjectState;
+		const scope = yield* Effect.scope;
+		return yield* state.blockConcurrencyWhile(Effect.gen(function* () {
+			const services = yield* Layer.buildWithScope(application, scope);
+			yield* gateEndpoint.pipe(Effect.provide(services));
+			return services;
+		}));
+	}));
+	const rpc = {
+		submitEncoded: (encoded) => submitEndpoint(encoded),
+		submissionStatusEncoded: (encoded) => submissionStatusEndpoint(encoded),
+		awaitSettlementEncoded: (encoded) => awaitSettlementEndpoint(encoded),
+		awaitProgressEncoded: (encoded) => awaitProgressEndpoint(encoded),
+		cancelProgressEncoded: (encoded) => cancelProgressEndpoint(encoded),
+		observePage: (encoded) => observePageEndpoint(encoded),
+		abortEncoded: (encoded) => abortEndpoint(encoded),
+		resolveApprovalEncoded: (encoded) => resolveApprovalEndpoint(encoded),
+		resolveUnknownEncoded: (encoded) => resolveUnknownEndpoint(encoded),
+		explainEncoded: (encoded) => explainEndpoint(encoded),
+		verifyEncoded: (encoded) => verifyEndpoint(encoded),
+		retryEncoded: (encoded) => retryEndpoint(encoded),
+		obligationsEncoded: (encoded) => obligationsEndpoint(encoded),
+		portCall: (encoded) => portCallEndpoint(encoded),
+		wake: () => wakeEndpoint
+	};
+	const EffectCfThreadObject = DurableObject.make(runtime, {
+		...options.rpcTracing === true ? { rpcTracing: { service: options.namespaceBinding } } : {},
+		...options.eventLayer === void 0 ? {} : { eventLayer: options.eventLayer },
+		initialize: Effect.void,
+		rpc,
+		alarm: () => alarmEndpoint
+	});
+	class ThreadObject extends EffectCfThreadObject {
+		alarm(alarmInfo) {
+			return super.alarm?.(alarmInfo);
+		}
+	}
+	return ThreadObject;
+};
+//#endregion
+export { make as _, AdminVerifyRequest as a, RetryExecuted as c, decodeAdminExplainRequest as d, decodeAdminResponse as f, encodeAdminResponse as g, decodeRetryCommand as h, AdminResponse as i, ThreadObject_exports as l, decodeObligationThresholds as m, AdminFailed as n, ExplainedRecovery as o, decodeAdminVerifyRequest as p, AdminFailure as r, ObligationsScanned as s, AdminExplainRequest as t, VerifiedIntegrity as u, layer as v, layerConfig as y };
+
+//# sourceMappingURL=ThreadObject-s5w3V_co.mjs.map