@effect-agent/platform-cloudflare 0.1.0-beta.79 → 0.1.0-beta.80

package/dist/Alarm.d.mts

@@ -1,4 +1,4 @@
-import { DurableObjectContext, ThreadObjectIdentity } from "./CloudflareBindings.mjs";
+import { DurableObjectContext } from "./CloudflareBindings.mjs";
 import { o as CloudflareDurableRuntimeConfig } from "./CloudflareConfig-f3CqTel1.mjs";
 import { DurableBindingFailure } from "@effect-agent/thread/AgentRegistration";
 import { DurableAgentRuntime, DurableWorkerFailure } from "@effect-agent/thread/DurableAgentRuntime";
@@ -6,7 +6,7 @@ import { SubmissionLedger } from "@effect-agent/thread/SubmissionLedger";
 import { ThreadProjectionError, ThreadProjectionMaintenance } from "@effect-agent/thread/ThreadProjectionMaintenance";
 import { Cause, Context, Deferred, Effect, Layer, Option, Schema } from "effect";
 declare namespace Alarm_d_exports {
-  export { DurableAlarmError, DurableAlarmService, MaintenancePassFailure, MaintenancePassReport, ThreadMaintenance, ThreadMaintenanceFailpoint, ThreadMaintenanceFailpointHandler, ThreadMaintenanceFailpointLocation, ThreadMessageDelivery, ThreadMutationGate, ThreadPublication, ThreadPublicationService, publishCommitted };
+  export { DurableAlarmError, DurableAlarmService, MaintenancePassFailure, MaintenancePassReport, ThreadHostMaintenance, ThreadMaintenance, ThreadMaintenanceFailpoint, ThreadMaintenanceFailpointHandler, ThreadMaintenanceFailpointLocation, ThreadMessageDelivery, ThreadMutationGate, ThreadPublication, ThreadPublicationService, publishCommitted };
 }
 declare const DurableAlarmError_base: Schema.Class<DurableAlarmError, Schema.TaggedStruct<"DurableAlarmError", {
   readonly operation: Schema.String;
@@ -74,7 +74,7 @@ declare const MaintenancePassReport_base: Schema.Class<MaintenancePassReport, Sc
 /** What one maintenance pass did — auditable evidence mirroring `NodeDurableHost`'s report. */
 declare class MaintenancePassReport extends MaintenancePassReport_base {}
 /** Fault boundaries around every maintenance-owned durable mutation. */
-type ThreadMaintenanceFailpointLocation = "maintenance:dirty:before" | "maintenance:dirty:after" | "maintenance:mutation:armed" | "maintenance:mutation:finished" | "maintenance:ensure:before" | "maintenance:ensure:after" | "maintenance:begin:before" | "maintenance:begin:after" | "maintenance:finish:before" | "maintenance:finish:after";
+type ThreadMaintenanceFailpointLocation = "maintenance:dirty:before" | "maintenance:dirty:after" | "maintenance:mutation:armed" | "maintenance:mutation:finished" | "maintenance:ensure:before" | "maintenance:ensure:after" | "maintenance:begin:before" | "maintenance:begin:after" | "maintenance:select:before" | "maintenance:select:after" | "maintenance:finish:before" | "maintenance:finish:after";
 type ThreadMaintenanceFailpointHandler = (location: ThreadMaintenanceFailpointLocation) => Effect.Effect<void>;
 declare const ThreadMaintenanceFailpoint_base: Context.ServiceClass<ThreadMaintenanceFailpoint, "@effect-agent/platform-cloudflare/ThreadMaintenanceFailpoint", {
   readonly hit: ThreadMaintenanceFailpointHandler;
@@ -119,6 +119,18 @@ declare const ThreadMessageDelivery: Context.Reference<{
   readonly drainUntil?: (finished: Deferred.Deferred<void>) => Effect.Effect<void, DurableAlarmError>;
   readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;
 }>;
+/**
+ * Application obligations sharing this Object's alarm. The deadline read is local and
+ * read-only. Drain beside the native Attempt and always finish one initial bounded wave,
+ * even when `finished` was already signalled. Then stop starting new waves on that signal
+ * and finish the bounded current wave before returning. Native maintenance joins that work
+ * before acknowledging a generation. Mutations use the same ThreadMutationGate; hooks never
+ * write the raw alarm slot. Pending host work does not defer a ready model Attempt.
+ */
+declare const ThreadHostMaintenance: Context.Reference<{
+  readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;
+  readonly drainUntil: (finished: Deferred.Deferred<void>) => Effect.Effect<void, DurableAlarmError>;
+}>;
 /** @internal A committed source operation must not become a failed operation because delivery failed. */
 declare const publishCommitted: Effect.Effect<void, never, ThreadPublication>;
 declare const ThreadMutationGate_base: Context.ServiceClass<ThreadMutationGate, "@effect-agent/platform-cloudflare/internal/ThreadMutationGate", {
@@ -164,8 +176,8 @@ declare const ThreadMaintenance_base: Context.ServiceClass<ThreadMaintenance, "@
  *    recovery states leave their generation dirty and retain bounded backoff rearming.
  */
 declare class ThreadMaintenance extends ThreadMaintenance_base {
-  static readonly layer: Layer.Layer<ThreadMaintenance, never, ThreadMutationGate | ThreadPublication | ThreadProjectionMaintenance | DurableAgentRuntime | SubmissionLedger | DurableAlarmService | ThreadMaintenanceFailpoint | CloudflareDurableRuntimeConfig | ThreadObjectIdentity | DurableObjectContext>;
+  static readonly layer: Layer.Layer<ThreadMaintenance, never, ThreadMutationGate | ThreadPublication | ThreadProjectionMaintenance | DurableAgentRuntime | SubmissionLedger | DurableAlarmService | ThreadMaintenanceFailpoint | CloudflareDurableRuntimeConfig | DurableObjectContext>;
 }
 //#endregion
-export { DurableAlarmError, DurableAlarmService, MaintenancePassFailure, MaintenancePassReport, ThreadMaintenance, ThreadMaintenanceFailpoint, ThreadMaintenanceFailpointHandler, ThreadMaintenanceFailpointLocation, ThreadMessageDelivery, ThreadMutationGate, ThreadPublication, ThreadPublicationService, publishCommitted, Alarm_d_exports as t };
+export { DurableAlarmError, DurableAlarmService, MaintenancePassFailure, MaintenancePassReport, ThreadHostMaintenance, ThreadMaintenance, ThreadMaintenanceFailpoint, ThreadMaintenanceFailpointHandler, ThreadMaintenanceFailpointLocation, ThreadMessageDelivery, ThreadMutationGate, ThreadPublication, ThreadPublicationService, publishCommitted, Alarm_d_exports as t };
 //# sourceMappingURL=Alarm.d.mts.map

package/dist/Alarm.mjs

@@ -1,7 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { DurableObjectContext, ThreadObjectIdentity } from "./CloudflareBindings.mjs";
+import { DurableObjectContext } from "./CloudflareBindings.mjs";
 import { CloudflareDurableRuntimeConfig } from "./CloudflareConfig.mjs";
 import { r as safeCauseMessage } from "./boundary-BguazVkh.mjs";
+import { ThreadId } from "@effect-agent/core/Identifiers";
 import "@effect-agent/thread/AgentRegistration";
 import { DurableAgentRuntime } from "@effect-agent/thread/DurableAgentRuntime";
 import { SubmissionLedger } from "@effect-agent/thread/SubmissionLedger";
@@ -12,6 +13,7 @@ var Alarm_exports = /* @__PURE__ */ __exportAll({
 	DurableAlarmError: () => DurableAlarmError,
 	DurableAlarmService: () => DurableAlarmService,
 	MaintenancePassReport: () => MaintenancePassReport,
+	ThreadHostMaintenance: () => ThreadHostMaintenance,
 	ThreadMaintenance: () => ThreadMaintenance,
 	ThreadMaintenanceFailpoint: () => ThreadMaintenanceFailpoint,
 	ThreadMessageDelivery: () => ThreadMessageDelivery,
@@ -112,6 +114,18 @@ const ThreadMessageDelivery = Context.Reference("@effect-agent/platform-cloudfla
 	drain: Effect.void,
 	pendingDeadline: Effect.succeed(Option.none())
 }) });
+/**
+* Application obligations sharing this Object's alarm. The deadline read is local and
+* read-only. Drain beside the native Attempt and always finish one initial bounded wave,
+* even when `finished` was already signalled. Then stop starting new waves on that signal
+* and finish the bounded current wave before returning. Native maintenance joins that work
+* before acknowledging a generation. Mutations use the same ThreadMutationGate; hooks never
+* write the raw alarm slot. Pending host work does not defer a ready model Attempt.
+*/
+const ThreadHostMaintenance = Context.Reference("@effect-agent/platform-cloudflare/ThreadHostMaintenance", { defaultValue: () => ({
+	pendingDeadline: Effect.succeed(Option.none()),
+	drainUntil: () => Effect.void
+}) });
 const earliestDeadline = (left, right) => Option.isSome(left) ? Option.isSome(right) ? Option.some(Math.min(left.value, right.value)) : left : right;
 /** @internal A committed source operation must not become a failed operation because delivery failed. */
 const publishCommitted = Effect.gen(function* () {
@@ -124,7 +138,9 @@ var ThreadMaintenanceState = class extends Schema.Class("@effect-agent/platform-
 	schemaVersion: Schema.Literal(1),
 	dirty: MaintenanceGeneration,
 	processed: MaintenanceGeneration,
-	nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+	nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** One physical-owner cursor; old single-lane records need no conversion. */
+	lastServedThreadId: Schema.optionalKey(ThreadId)
 }) {};
 const MAINTENANCE_STATE_KEY = "effect-agent:thread-maintenance:v1";
 const decodeMaintenanceState = Schema.decodeUnknownSync(ThreadMaintenanceState);
@@ -225,7 +241,6 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 		const ledger = yield* SubmissionLedger;
 		const alarm = yield* DurableAlarmService;
 		const config = yield* CloudflareDurableRuntimeConfig;
-		const identity = yield* ThreadObjectIdentity;
 		const { ctx } = yield* DurableObjectContext;
 		const failpoint = yield* ThreadMaintenanceFailpoint;
 		/**
@@ -237,9 +252,10 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 		const publication = yield* ThreadPublication;
 		const projection = yield* ThreadProjectionMaintenance;
 		const messages = yield* ThreadMessageDelivery;
+		const host = yield* ThreadHostMaintenance;
 		const projectionDeadline = projection.pendingDeadline.pipe(Effect.catchCause((cause) => Cause.hasInterrupts(cause) ? Effect.failCause(cause) : Effect.logError("Thread projection deadline unavailable", cause).pipe(Effect.as(Option.some(0)))));
 		const pendingDeadline = Effect.gen(function* () {
-			return earliestDeadline(earliestDeadline(yield* publication.pendingDeadline, yield* messages.pendingDeadline), yield* projectionDeadline);
+			return earliestDeadline(earliestDeadline(yield* publication.pendingDeadline, yield* messages.pendingDeadline), earliestDeadline(yield* projectionDeadline, yield* host.pendingDeadline));
 		});
 		const maintenancePassGate = yield* Semaphore.make(1);
 		const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
@@ -309,7 +325,8 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 			}));
 			const deliveryFinished = yield* Deferred.make();
 			const delivery = yield* Effect.forkChild(messages.drainUntil?.(deliveryFinished) ?? messages.drain);
-			const finishDelivery = Deferred.succeed(deliveryFinished, void 0).pipe(Effect.andThen(Fiber.join(delivery)));
+			const hostWork = yield* Effect.forkChild(host.drainUntil(deliveryFinished));
+			const finishDelivery = Deferred.succeed(deliveryFinished, void 0).pipe(Effect.andThen(Fiber.awaitAll([delivery, hostWork])), Effect.flatMap((outcomes) => Effect.forEach(outcomes, (outcome) => outcome, { discard: true })));
 			const projected = yield* Effect.exit(drainDue.pipe(Effect.provideService(ThreadProjectionMaintenance, projection)));
 			if (Exit.isFailure(projected) && Cause.hasInterrupts(projected.cause)) return yield* Effect.failCause(projected.cause);
 			const deadline = yield* publication.pendingDeadline;
@@ -344,15 +361,34 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 				}));
 			}
 			const recovered = yield* runtime.runRecovery;
-			const settlement = yield* runtime.processThreadHead(identity.threadId, { yieldAfter });
+			const reports = new Map(recovered.map((report) => [report.submissionId, report]));
+			const current = yield* Stream.runCollect(ledger.scanNonterminal);
+			const heads = /* @__PURE__ */ new Map();
+			for (const row of current) if (!heads.has(row.threadId)) heads.set(row.threadId, row);
+			const eligible = [...heads.values()].filter((head) => !stableExternalWait(head, reports)).map((head) => head.threadId).sort();
+			let selected = eligible[0];
+			if (heads.size > 1 && selected !== void 0) {
+				yield* failpoint.hit("maintenance:select:before");
+				selected = yield* runTransaction("select maintenance lane", () => ctx.storage.transaction(async (transaction) => {
+					const { state } = await readMaintenanceState(transaction);
+					const next = eligible.find((threadId) => state.lastServedThreadId === void 0 || threadId > state.lastServedThreadId) ?? eligible[0];
+					if (next !== void 0) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+						...state,
+						lastServedThreadId: next
+					})));
+					return next;
+				}));
+				yield* failpoint.hit("maintenance:select:after");
+			}
+			const settlement = selected === void 0 ? Option.none() : yield* runtime.processThreadHead(selected, { yieldAfter });
 			yield* finishDelivery;
 			if (Exit.isFailure(projected)) return yield* Effect.failCause(projected.cause);
 			const remaining = yield* Stream.runCollect(ledger.scanNonterminal);
-			const reports = new Map(recovered.map((report) => [report.submissionId, report]));
-			const head = remaining[0];
-			const headWaiting = head !== void 0 && stableExternalWait(head, reports);
-			const autonomous = remaining.some((snapshot, index) => {
-				if (index > 0 && headWaiting && snapshot.state === "ready" && reports.get(snapshot.submissionId)?.decision._tag === "ApplyInput") return false;
+			const waitingHeads = /* @__PURE__ */ new Map();
+			const autonomous = remaining.some((snapshot) => {
+				const headWaiting = waitingHeads.get(snapshot.threadId);
+				if (headWaiting === void 0) waitingHeads.set(snapshot.threadId, stableExternalWait(snapshot, reports));
+				if (headWaiting === true && snapshot.state === "ready" && reports.get(snapshot.submissionId)?.decision._tag === "ApplyInput") return false;
 				return !stableExternalWait(snapshot, reports);
 			});
 			const progressed = Option.isSome(settlement) || recovered.some((report) => report.disposition === "repaired");
@@ -413,6 +449,6 @@ var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effe
 	}));
 };
 //#endregion
-export { DurableAlarmError, DurableAlarmService, MaintenancePassReport, ThreadMaintenance, ThreadMaintenanceFailpoint, ThreadMessageDelivery, ThreadMutationGate, ThreadPublication, publishCommitted, Alarm_exports as t };
+export { DurableAlarmError, DurableAlarmService, MaintenancePassReport, ThreadHostMaintenance, ThreadMaintenance, ThreadMaintenanceFailpoint, ThreadMessageDelivery, ThreadMutationGate, ThreadPublication, publishCommitted, Alarm_exports as t };
 
 //# sourceMappingURL=Alarm.mjs.map

package/dist/Alarm.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Alarm.mjs","names":[],"sources":["../src/Alarm.ts"],"sourcesContent":["import { type DurableBindingFailure } from \"@effect-agent/thread/AgentRegistration\";\nimport {\n  DurableAgentRuntime,\n  type DurableWorkerFailure,\n  type RecoveryReport,\n} from \"@effect-agent/thread/DurableAgentRuntime\";\nimport { SubmissionLedger, type SubmissionSnapshot } from \"@effect-agent/thread/SubmissionLedger\";\nimport {\n  ThreadProjectionMaintenance,\n  drainDue,\n  type ThreadProjectionError,\n} from \"@effect-agent/thread/ThreadProjectionMaintenance\";\nimport {\n  Cause,\n  Clock,\n  Context,\n  DateTime,\n  Deferred,\n  Effect,\n  Exit,\n  Fiber,\n  Layer,\n  Option,\n  Random,\n  Ref,\n  Schema,\n  Semaphore,\n  Stream,\n} from \"effect\";\n\nimport { ThreadObjectIdentity, DurableObjectContext } from \"./CloudflareBindings.ts\";\nimport { CloudflareDurableRuntimeConfig } from \"./CloudflareConfig.ts\";\nimport { safeCauseMessage } from \"./internal/boundary.ts\";\n\n/**\n * The single multiplexed Durable Object alarm (decision D-P6-2). A Durable Object has ONE\n * alarm slot; every cadence the Node host ran on fibers (wake scan, lease expiry, settlement\n * and abort re-checks, retry backoff) multiplexes into one idempotent maintenance pass, and\n * the slot always holds the EARLIEST deadline any caller asked for.\n *\n * The alarm invariant (plan §1.4): every committed actionable mutation carries a newer durable\n * maintenance generation and a committed alarm. Stable externally-driven waits may be\n * nonterminal without retaining an alarm; their resolving mutation advances the generation and\n * restores the alarm atomically.\n */\n\n/** The Durable Object alarm API failed; surfaces on host entry points as a typed refusal. */\nexport class DurableAlarmError extends Schema.TaggedError<DurableAlarmError>()(\n  \"DurableAlarmError\",\n  {\n    operation: Schema.String,\n    message: Schema.String,\n    cause: Schema.optionalKey(Schema.Defect()),\n  },\n) {}\n\nconst alarmFailure =\n  (operation: string) =>\n  (cause: unknown): DurableAlarmError =>\n    DurableAlarmError.make({\n      operation,\n      message: safeCauseMessage(cause, \"The Cloudflare alarm API failed without a diagnostic\"),\n      cause,\n    });\n\n/** `ctx.storage` alarm slot as an Effect service; storage is truth, never a memory field. */\nexport class DurableAlarmService extends Context.Service<\n  DurableAlarmService,\n  {\n    /** The scheduled deadline in epoch milliseconds, if any. */\n    readonly scheduled: Effect.Effect<Option.Option<number>, DurableAlarmError>;\n    /** Replace the slot with this deadline. */\n    readonly scheduleAt: (epochMillis: number) => Effect.Effect<void, DurableAlarmError>;\n    /** Keep the EARLIER of the existing deadline and this one (the multiplexing rule). */\n    readonly ensureScheduledBy: (epochMillis: number) => Effect.Effect<void, DurableAlarmError>;\n    /**\n     * Arm an immediate alarm (the durable, coalescing local wake) — DEFERRED while a\n     * maintenance pass is executing. Workerd cancels an in-flight alarm handler when a new\n     * EARLIER deadline is written during its execution (`requestScheduledAlarm`), and the\n     * maintenance pass runs INSIDE the alarm handler: an immediate wake landing mid-pass\n     * (a routed port mutation, a sibling's `wake()`, the coordinator's own local notify)\n     * would kill the running Attempt — manufacturing an ownership loss no real eviction\n     * caused, and routing open uncertain-class Tool Calls into spurious Unknown Outcomes.\n     * Deferral is contract-safe: wakes are droppable hints, every mutating entry point\n     * pre-arms BEFORE its first durable mutation (the alarm invariant never rests on this\n     * call). The pass's durable generation check observes any racing mutation, so the\n     * in-memory hint does not need to be flushed after a stable wait is acknowledged.\n     */\n    readonly scheduleNow: Effect.Effect<void, DurableAlarmError>;\n    /**\n     * Run one maintenance pass with wake deferral (see `scheduleNow`). Calls made while `body`\n     * executes are droppable promptness hints; correctness rests on the durable generation.\n     */\n    readonly withWakesDeferred: <A, E, R>(body: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;\n    /** Clear the slot; correctness-sensitive clears live in maintenance generation transactions. */\n    readonly cancel: Effect.Effect<void, DurableAlarmError>;\n  }\n>()(\"@effect-agent/platform-cloudflare/DurableAlarmService\") {\n  static readonly layer: Layer.Layer<DurableAlarmService, never, DurableObjectContext> =\n    Layer.effect(DurableAlarmService)(\n      Effect.gen(function* () {\n        const { ctx } = yield* DurableObjectContext;\n        /**\n         * In-memory pass bookkeeping — a pure CACHE, never state: a fresh incarnation has no\n         * running pass, and a deferred wake lost to eviction was only ever a promptness hint\n         * on top of the already-committed pre-armed alarm.\n         */\n        const runningPasses = yield* Ref.make(0);\n\n        const scheduled = Effect.tryPromise({\n          try: () => ctx.storage.getAlarm(),\n          catch: alarmFailure(\"get alarm\"),\n        }).pipe(\n          Effect.map((deadline) =>\n            deadline === null ? Option.none<number>() : Option.some(deadline),\n          ),\n        );\n\n        const scheduleAt = (epochMillis: number) =>\n          Effect.tryPromise({\n            try: () => ctx.storage.setAlarm(epochMillis),\n            catch: alarmFailure(\"set alarm\"),\n          });\n\n        const ensureScheduledBy = (epochMillis: number) =>\n          scheduled.pipe(\n            Effect.flatMap((existing) =>\n              Option.isSome(existing) && existing.value <= epochMillis\n                ? Effect.void\n                : scheduleAt(epochMillis),\n            ),\n          );\n\n        const armNow = Clock.currentTimeMillis.pipe(\n          Effect.flatMap((now) => ensureScheduledBy(now)),\n        );\n\n        const scheduleNow = Ref.get(runningPasses).pipe(\n          Effect.flatMap((passes) => (passes > 0 ? Effect.void : armNow)),\n        );\n\n        const withWakesDeferred = <A, E, R>(body: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>\n          Ref.update(runningPasses, (passes) => passes + 1).pipe(\n            Effect.andThen(body),\n            Effect.ensuring(Ref.update(runningPasses, (passes) => passes - 1)),\n          );\n\n        const cancel = Effect.tryPromise({\n          try: () => ctx.storage.deleteAlarm(),\n          catch: alarmFailure(\"delete alarm\"),\n        });\n\n        return DurableAlarmService.of({\n          scheduled,\n          scheduleAt,\n          ensureScheduledBy,\n          scheduleNow,\n          withWakesDeferred,\n          cancel,\n        });\n      }),\n    );\n}\n\n/** What one maintenance pass did — auditable evidence mirroring `NodeDurableHost`'s report. */\nexport class MaintenancePassReport extends Schema.Class<MaintenancePassReport>(\n  \"@effect-agent/platform-cloudflare/MaintenancePassReport\",\n)({\n  /** `caught-up` ran no runtime work (publication may be pending); `actionable` ran recovery. */\n  phase: Schema.Literals([\"caught-up\", \"actionable\"]),\n  /** Recovery decisions executed (or deferred) BEFORE any new claim in this pass. */\n  recovered: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /** Whether the head Attempt settled. Joined input may settle with that head. */\n  settled: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /** Submissions still nonterminal after the pass (suspended/unknown lanes stay honest). */\n  nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /** `rearmed` for dirty/autonomous work, `cleared` for stable waits or settlement. */\n  alarm: Schema.Literals([\"rearmed\", \"cleared\"]),\n}) {}\n\n/** Fault boundaries around every maintenance-owned durable mutation. */\nexport type ThreadMaintenanceFailpointLocation =\n  | \"maintenance:dirty:before\"\n  | \"maintenance:dirty:after\"\n  | \"maintenance:mutation:armed\"\n  | \"maintenance:mutation:finished\"\n  | \"maintenance:ensure:before\"\n  | \"maintenance:ensure:after\"\n  | \"maintenance:begin:before\"\n  | \"maintenance:begin:after\"\n  | \"maintenance:finish:before\"\n  | \"maintenance:finish:after\";\n\nexport type ThreadMaintenanceFailpointHandler = (\n  location: ThreadMaintenanceFailpointLocation,\n) => Effect.Effect<void>;\n\n/** Test-only fault authority; production uses the inert layer. */\nexport class ThreadMaintenanceFailpoint extends Context.Service<\n  ThreadMaintenanceFailpoint,\n  {\n    readonly hit: ThreadMaintenanceFailpointHandler;\n  }\n>()(\"@effect-agent/platform-cloudflare/ThreadMaintenanceFailpoint\") {\n  static readonly layer = Layer.succeed(this)({ hit: () => Effect.void });\n}\n\n/**\n * Durable host publication of canonical records and ledger approval/abort/resolution intents.\n * The host owns schema-versioned cursors, destination idempotency and acknowledgement. Delivery\n * is at least once. Hooks must not write the alarm slot or mutate the supplied raw source ports.\n *\n * `invalidate`, `prepareGeneration` and `pendingDeadline` must be bounded local operations.\n * `prepareGeneration` durably invalidates a scan only when its generation changes; repeated\n * calls must preserve partial scan progress. It runs with no source mutation in flight.\n * `drain` performs bounded delivery and persists retries before returning. A pending deadline\n * defers runtime recovery/Attempts, allowing committed host publications to drain first.\n * Unexpected hook failures leave the prearmed generation for retry. Hooks acquire per-call\n * resources with Effect.scoped; Layer construction owns incarnation resources (eviction need\n * not run finalizers). Do not hold a local hook behind network I/O or call back into producers.\n */\nexport interface ThreadPublicationService {\n  readonly invalidate: Effect.Effect<void, DurableAlarmError>;\n  readonly prepareGeneration: (generation: bigint) => Effect.Effect<void, DurableAlarmError>;\n  readonly drain: Effect.Effect<void, DurableAlarmError>;\n  readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;\n}\n\n/** Opt in with `ThreadObject.layer(registrations, { publication: Layer.effect(ThreadPublication)(...) })`. */\nexport class ThreadPublication extends Context.Service<\n  ThreadPublication,\n  ThreadPublicationService\n>()(\"@effect-agent/platform-cloudflare/ThreadPublication\") {\n  static readonly layer = Layer.succeed(this)({\n    invalidate: Effect.void,\n    prepareGeneration: () => Effect.void,\n    drain: Effect.void,\n    pendingDeadline: Effect.succeed(Option.none()),\n  });\n}\n\n/**\n * Host-assembled message recovery, supplied by ThreadObject.layer even when the application\n * rebuilds ThreadMaintenance. These obligations outlive source Runs and never defer a ready\n * source Attempt while a destination is processing an accepted message.\n */\nexport const ThreadMessageDelivery = Context.Reference<{\n  readonly drain: Effect.Effect<void, DurableAlarmError>;\n  /** Drain inserts and due retries during source work, finishing the bounded wave on completion. */\n  readonly drainUntil?: (\n    finished: Deferred.Deferred<void>,\n  ) => Effect.Effect<void, DurableAlarmError>;\n  readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;\n}>(\"@effect-agent/platform-cloudflare/ThreadMessageDelivery\", {\n  defaultValue: () => ({ drain: Effect.void, pendingDeadline: Effect.succeed(Option.none()) }),\n});\n\nconst earliestDeadline = (\n  left: Option.Option<number>,\n  right: Option.Option<number>,\n): Option.Option<number> =>\n  Option.isSome(left)\n    ? Option.isSome(right)\n      ? Option.some(Math.min(left.value, right.value))\n      : left\n    : right;\n\n/** @internal A committed source operation must not become a failed operation because delivery failed. */\nexport const publishCommitted = Effect.gen(function* () {\n  const publication = yield* ThreadPublication;\n\n  yield* publication.invalidate.pipe(Effect.andThen(publication.drain));\n}).pipe(\n  Effect.catchCause((cause) =>\n    Cause.hasInterrupts(cause)\n      ? Effect.interrupt\n      : Effect.logError(\"Thread publication deferred after source commit\", cause),\n  ),\n);\n\nconst MaintenanceGeneration = Schema.BigIntFromString.check(\n  Schema.isGreaterThanOrEqualToBigInt(0n),\n);\n\n/** Versioned, platform-private maintenance state stored through Durable Object KV. */\nclass ThreadMaintenanceState extends Schema.Class<ThreadMaintenanceState>(\n  \"@effect-agent/platform-cloudflare/ThreadMaintenanceState\",\n)({\n  schemaVersion: Schema.Literal(1),\n  dirty: MaintenanceGeneration,\n  processed: MaintenanceGeneration,\n  nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n}) {}\n\nconst MAINTENANCE_STATE_KEY = \"effect-agent:thread-maintenance:v1\";\nconst decodeMaintenanceState = Schema.decodeUnknownSync(ThreadMaintenanceState);\nconst encodeMaintenanceState = Schema.encodeSync(ThreadMaintenanceState);\n\nconst initialMaintenanceState = (): ThreadMaintenanceState =>\n  ThreadMaintenanceState.make({\n    schemaVersion: 1,\n    // Bootstrap Objects created by the pre-generation release without scanning the ledger in\n    // the constructor. One useful pass classifies and acknowledges any existing obligation.\n    dirty: 1n,\n    processed: 0n,\n    nonterminal: 0,\n  });\n\nconst readMaintenanceState = async (\n  transaction: DurableObjectTransaction,\n): Promise<{ readonly state: ThreadMaintenanceState; readonly initialized: boolean }> => {\n  const encoded = await transaction.get(MAINTENANCE_STATE_KEY);\n\n  return encoded === undefined\n    ? { state: initialMaintenanceState(), initialized: false }\n    : { state: decodeMaintenanceState(encoded), initialized: true };\n};\n\nconst ensureTransactionAlarmBy = async (\n  transaction: DurableObjectTransaction,\n  deadline: number,\n): Promise<void> => {\n  const scheduled = await transaction.getAlarm();\n\n  if (scheduled === null || scheduled > deadline) {\n    await transaction.setAlarm(deadline);\n  }\n};\n\nconst stableExternalWait = (\n  snapshot: SubmissionSnapshot,\n  reports: ReadonlyMap<string, RecoveryReport>,\n): boolean => {\n  const decision = reports.get(snapshot.submissionId)?.decision._tag;\n\n  // An accepted abort still owes cleanup/settlement even if its claim was deferred this pass.\n  if (decision === \"SettleAborted\") return false;\n  switch (snapshot.state) {\n    case \"suspended\":\n    case \"joined\":\n      return true;\n    case \"unknown\":\n      return decision === \"AwaitUnknownResolution\" || decision === \"MarkUnknown\";\n    case \"admitted\":\n      return reports.get(snapshot.submissionId)?.decision._tag === \"AwaitParentEstablishment\";\n    case \"input-applied\":\n    case \"joining\":\n    case \"ready\":\n    case \"running\":\n    case \"settled\":\n    case \"terminalizing\":\n      return false;\n  }\n};\n\n/**\n * Shared prearm/acknowledgement boundary for ingress and runtime-owned producers.\n * `ThreadObject.layer` provides this same instance in its Services. Rebuilt runtime/maintenance\n * Layers must reuse that instance; a second gate cannot observe the native producers' activity.\n */\nexport class ThreadMutationGate extends Context.Service<\n  ThreadMutationGate,\n  {\n    readonly withMutation: <A, E, R>(\n      body: Effect.Effect<A, E, R>,\n    ) => Effect.Effect<A, E | DurableAlarmError, R>;\n    readonly withSnapshot: <A, E, R>(\n      body: (active: number) => Effect.Effect<A, E, R>,\n    ) => Effect.Effect<A, E, R>;\n  }\n>()(\"@effect-agent/platform-cloudflare/internal/ThreadMutationGate\") {\n  static readonly layer = Layer.effect(this)(\n    Effect.gen(function* () {\n      const { ctx } = yield* DurableObjectContext;\n      const config = yield* CloudflareDurableRuntimeConfig;\n      const failpoint = yield* ThreadMaintenanceFailpoint;\n      // A fresh incarnation has no live mutations; durable generations survive eviction.\n      const activeMutations = yield* Ref.make(0);\n      const generationGate = yield* Semaphore.make(1);\n      const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));\n\n      const runTransaction = <A>(operation: string, transaction: () => Promise<A>) =>\n        Effect.tryPromise({ try: transaction, catch: alarmFailure(operation) });\n\n      const beginMutation = Effect.fn(\"ThreadMaintenance.beginMutation\")(function* () {\n        yield* failpoint.hit(\"maintenance:dirty:before\");\n        const now = yield* Clock.currentTimeMillis;\n\n        yield* runTransaction(\"advance maintenance generation\", () =>\n          ctx.storage.transaction(async (transaction) => {\n            const { state } = await readMaintenanceState(transaction);\n\n            const next = ThreadMaintenanceState.make({\n              ...state,\n              dirty: state.dirty + 1n,\n            });\n\n            await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));\n            // The earliest configured retry bounds a newly actionable mutation without relying\n            // on its best-effort immediate wake hint.\n            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);\n          }),\n        );\n        yield* failpoint.hit(\"maintenance:dirty:after\");\n        yield* Ref.update(activeMutations, (active) => active + 1);\n      });\n\n      const endMutation = generationGate.withPermit(\n        Ref.update(activeMutations, (active) => Math.max(0, active - 1)),\n      );\n\n      const withMutation = <A, E, R>(\n        body: Effect.Effect<A, E, R>,\n      ): Effect.Effect<A, E | DurableAlarmError, R> =>\n        Effect.acquireUseRelease(\n          generationGate.withPermit(beginMutation()),\n          () =>\n            failpoint.hit(\"maintenance:mutation:armed\").pipe(\n              Effect.andThen(body),\n              Effect.tap(() => failpoint.hit(\"maintenance:mutation:finished\")),\n            ),\n          () => endMutation,\n        );\n\n      return ThreadMutationGate.of({\n        withMutation,\n        withSnapshot: (body) =>\n          generationGate.withPermit(Effect.flatMap(Ref.get(activeMutations), body)),\n      });\n    }),\n  );\n}\n\nexport type MaintenancePassFailure =\n  | DurableWorkerFailure\n  | DurableBindingFailure\n  | DurableAlarmError\n  | ThreadProjectionError;\n\n/**\n * Incremental, quiescent maintenance over a durable dirty/processed generation (issue #93).\n *\n * `pass` = generation snapshot/pre-arm → recovery → one head Attempt → generation acknowledgement:\n *\n * 1. One storage transaction reads dirty/processed and re-arms before work. A caught-up forced\n *    alarm takes an O(1) path without recovery, ledger scans, or canonical-history reads.\n * 2. Recovery strictly precedes a new claim. One head Attempt advances the lane and requests\n *    a safe yield after ten minutes. The whole event has a fourteen-minute cooperative timeout.\n * 3. The final transaction acknowledges only the generation observed at pass start. A racing\n *    mutation therefore remains `dirty > processed` and retains its atomically-established alarm.\n * 4. Stable external waits acknowledge and clear. Autonomous retry, indeterminate, and lease\n *    recovery states leave their generation dirty and retain bounded backoff rearming.\n */\nexport class ThreadMaintenance extends Context.Service<\n  ThreadMaintenance,\n  {\n    /** One idempotent maintenance pass; failures propagate so workerd retries the alarm. */\n    readonly pass: Effect.Effect<MaintenancePassReport, MaintenancePassFailure>;\n    /**\n     * Constructor gate: initialize/inspect only the O(1) maintenance record and ensure a dirty\n     * generation has an alarm. It never scans the ledger or canonical history.\n     */\n    readonly ensureAlarm: Effect.Effect<void, MaintenancePassFailure>;\n    /**\n     * Serialize the pre-arm boundary with pass acknowledgement, advance the durable dirty\n     * generation and arm the alarm in one transaction BEFORE running the caller's mutation.\n     * A pass cannot acknowledge while that mutation remains in flight.\n     */\n    readonly withMutation: <A, E, R>(\n      body: Effect.Effect<A, E, R>,\n    ) => Effect.Effect<A, E | DurableAlarmError, R>;\n  }\n>()(\"@effect-agent/platform-cloudflare/ThreadMaintenance\") {\n  static readonly layer: Layer.Layer<\n    ThreadMaintenance,\n    never,\n    | ThreadMutationGate\n    | ThreadPublication\n    | ThreadProjectionMaintenance\n    | DurableAgentRuntime\n    | SubmissionLedger\n    | DurableAlarmService\n    | ThreadMaintenanceFailpoint\n    | CloudflareDurableRuntimeConfig\n    | ThreadObjectIdentity\n    | DurableObjectContext\n  > = Layer.effect(ThreadMaintenance)(\n    Effect.gen(function* () {\n      const runtime = yield* DurableAgentRuntime;\n      const ledger = yield* SubmissionLedger;\n      const alarm = yield* DurableAlarmService;\n      const config = yield* CloudflareDurableRuntimeConfig;\n      const identity = yield* ThreadObjectIdentity;\n      const { ctx } = yield* DurableObjectContext;\n      const failpoint = yield* ThreadMaintenanceFailpoint;\n\n      /**\n       * Consecutive no-progress passes — an in-memory CACHE, not state: a fresh incarnation\n       * restarts at zero and merely re-arms sooner than a long-lived one would have.\n       */\n      const stalls = yield* Ref.make(0);\n      const mutations = yield* ThreadMutationGate;\n      const publication = yield* ThreadPublication;\n      const projection = yield* ThreadProjectionMaintenance;\n      const messages = yield* ThreadMessageDelivery;\n\n      // A broken disposable index still needs a retry alarm and must not prevent startup.\n      const projectionDeadline = projection.pendingDeadline.pipe(\n        Effect.catchCause((cause) =>\n          Cause.hasInterrupts(cause)\n            ? Effect.failCause(cause)\n            : Effect.logError(\"Thread projection deadline unavailable\", cause).pipe(\n                Effect.as(Option.some(0)),\n              ),\n        ),\n      );\n\n      const pendingDeadline = Effect.gen(function* () {\n        return earliestDeadline(\n          earliestDeadline(yield* publication.pendingDeadline, yield* messages.pendingDeadline),\n          yield* projectionDeadline,\n        );\n      });\n\n      const maintenancePassGate = yield* Semaphore.make(1);\n      const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));\n\n      const runTransaction = <A>(operation: string, transaction: () => Promise<A>) =>\n        Effect.tryPromise({ try: transaction, catch: alarmFailure(operation) });\n\n      const ensureAlarm = Effect.fn(\"ThreadMaintenance.ensureAlarm\")(function* () {\n        yield* failpoint.hit(\"maintenance:ensure:before\");\n        const now = yield* Clock.currentTimeMillis;\n\n        yield* runTransaction(\"ensure maintenance alarm\", () =>\n          ctx.storage.transaction(async (transaction) => {\n            const { state, initialized } = await readMaintenanceState(transaction);\n\n            if (!initialized) {\n              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));\n            }\n            if (state.dirty > state.processed) {\n              await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);\n            }\n          }),\n        );\n        const deadline = yield* pendingDeadline;\n\n        if (Option.isSome(deadline)) {\n          yield* runTransaction(\"ensure publication alarm\", () =>\n            ctx.storage.transaction((transaction) =>\n              ensureTransactionAlarmBy(\n                transaction,\n                Math.max(now + minimumAlarmDelay, deadline.value),\n              ),\n            ),\n          );\n        }\n        yield* failpoint.hit(\"maintenance:ensure:after\");\n      });\n\n      const beginPass = Effect.fn(\"ThreadMaintenance.beginPass\")(function* () {\n        yield* failpoint.hit(\"maintenance:begin:before\");\n        const now = yield* Clock.currentTimeMillis;\n\n        const result = yield* runTransaction(\"begin maintenance pass\", () =>\n          ctx.storage.transaction(async (transaction) => {\n            const { state, initialized } = await readMaintenanceState(transaction);\n\n            if (!initialized) {\n              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));\n            }\n            if (state.processed >= state.dirty) {\n              // Prearm even a publication-only pass before invoking any host hook.\n              await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);\n\n              return { _tag: \"CaughtUp\" as const, nonterminal: state.nonterminal };\n            }\n            // Pre-arm the earliest retry before recovery. A successful finish may move this slot\n            // LATER to its bounded backoff, which does not cancel the running handler.\n            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);\n\n            return {\n              _tag: \"Actionable\" as const,\n              generation: state.dirty,\n              nonterminal: state.nonterminal,\n            };\n          }),\n        );\n\n        yield* failpoint.hit(\"maintenance:begin:after\");\n\n        return result;\n      });\n\n      const rearmDelay = Effect.fn(\"ThreadMaintenance.rearmDelay\")(function* (progressed: boolean) {\n        const priorStalls = yield* Ref.getAndUpdate(stalls, (count) =>\n          progressed ? 0 : count + 1,\n        );\n\n        if (progressed) return config.alarmBackoffBase;\n        const exponent = Math.min(priorStalls, 30);\n        const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** exponent);\n        const jitter = yield* Random.next;\n        // Full jitter over [backoff/2, backoff]: desynchronizes retry storms without ever\n        // waiting longer than the deterministic bound.\n        const jittered = Math.ceil(backoff / 2 + (backoff / 2) * jitter);\n\n        return Math.min(jittered, config.wakeScanInterval);\n      });\n\n      const pass = Effect.fn(\"ThreadMaintenance.pass\")(function* (\n        yieldAfter: DateTime.Utc,\n      ): Effect.fn.Return<MaintenancePassReport, MaintenancePassFailure> {\n        const annotate = (report: MaintenancePassReport) =>\n          Effect.annotateCurrentSpan({\n            phase: report.phase,\n            recovered: report.recovered,\n            settled: report.settled,\n            nonterminal: report.nonterminal,\n            alarm: report.alarm,\n          }).pipe(Effect.as(report));\n\n        const started = yield* mutations.withSnapshot((activeAtStart) =>\n          Effect.gen(function* () {\n            const generation = yield* beginPass();\n\n            if (generation._tag === \"Actionable\" && activeAtStart === 0) {\n              // The gate excludes a producer starting between the snapshot and certification.\n              yield* publication.prepareGeneration(generation.generation);\n            }\n\n            return { ...generation, activeAtStart };\n          }),\n        );\n\n        // Deliver beside source work, including messages inserted by the running Attempt.\n        // Slow destination RPCs never consume the source execution window. Stop starting\n        // waves when source work ends, then join the bounded current wave before acknowledgement.\n        const deliveryFinished = yield* Deferred.make<void>();\n\n        const delivery = yield* Effect.forkChild(\n          messages.drainUntil?.(deliveryFinished) ?? messages.drain,\n        );\n\n        const finishDelivery = Deferred.succeed(deliveryFinished, undefined).pipe(\n          Effect.andThen(Fiber.join(delivery)),\n        );\n\n        // Capture derived-index failures until canonical work has had its turn. Interruption\n        // still stops the event; ordinary failures and defects retain the prearmed generation.\n        const projected = yield* Effect.exit(\n          drainDue.pipe(Effect.provideService(ThreadProjectionMaintenance, projection)),\n        );\n\n        if (Exit.isFailure(projected) && Cause.hasInterrupts(projected.cause))\n          return yield* Effect.failCause(projected.cause);\n        const deadline = yield* publication.pendingDeadline;\n\n        if (\n          started._tag === \"Actionable\" ||\n          (Option.isSome(deadline) && deadline.value <= (yield* Clock.currentTimeMillis))\n        ) {\n          yield* publication.drain;\n        }\n        const pending = yield* publication.pendingDeadline;\n\n        if (started._tag === \"CaughtUp\" || Option.isSome(pending)) {\n          yield* finishDelivery;\n          if (Exit.isFailure(projected)) return yield* Effect.failCause(projected.cause);\n          yield* failpoint.hit(\"maintenance:finish:before\");\n\n          const disposition = yield* mutations.withSnapshot((active) =>\n            Effect.gen(function* () {\n              // Re-read under the producer gate: a concurrent append/host mutation cannot be\n              // cleared using a stale empty deadline. Dirty generations bound all producer races.\n              const latest = yield* pendingDeadline;\n              const now = yield* Clock.currentTimeMillis;\n\n              return yield* runTransaction(\"finish publication pass\", () =>\n                ctx.storage.transaction(async (transaction) => {\n                  const { state } = await readMaintenanceState(transaction);\n\n                  const nativeDeadline =\n                    active > 0 || state.dirty > state.processed\n                      ? now + config.wakeScanInterval\n                      : Infinity;\n\n                  const next = Option.isSome(latest)\n                    ? Math.min(nativeDeadline, latest.value)\n                    : nativeDeadline;\n\n                  if (Number.isFinite(next)) {\n                    await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next));\n\n                    return \"rearmed\" as const;\n                  }\n                  await transaction.deleteAlarm();\n\n                  return \"cleared\" as const;\n                }),\n              );\n            }),\n          );\n\n          yield* failpoint.hit(\"maintenance:finish:after\");\n\n          return yield* annotate(\n            MaintenancePassReport.make({\n              phase: \"caught-up\",\n              recovered: 0,\n              settled: 0,\n              nonterminal: started.nonterminal,\n              alarm: disposition,\n            }),\n          );\n        }\n        // Step 2 — reconciliation strictly precedes new work in this pass (exit gate).\n        const recovered: ReadonlyArray<RecoveryReport> = yield* runtime.runRecovery;\n        // One head Attempt per event. The runtime yields after a committed turn when the\n        // soft deadline is reached; queued followers belong to a subsequent alarm.\n        const settlement = yield* runtime.processThreadHead(identity.threadId, { yieldAfter });\n\n        yield* finishDelivery;\n        if (Exit.isFailure(projected)) return yield* Effect.failCause(projected.cause);\n        // Observe residual state before acknowledging this exact pass-start generation.\n        const remaining = yield* Stream.runCollect(ledger.scanNonterminal);\n        const reports = new Map(recovered.map((report) => [report.submissionId, report]));\n        const head = remaining[0];\n        const headWaiting = head !== undefined && stableExternalWait(head, reports);\n\n        const autonomous = remaining.some((snapshot, index) => {\n          // FIFO followers cannot execute through a stable external wait. Only plain queued\n          // input is dormant here; admission repairs and accepted aborts still need a pass.\n          if (\n            index > 0 &&\n            headWaiting &&\n            snapshot.state === \"ready\" &&\n            reports.get(snapshot.submissionId)?.decision._tag === \"ApplyInput\"\n          )\n            return false;\n\n          return !stableExternalWait(snapshot, reports);\n        });\n\n        const progressed =\n          Option.isSome(settlement) ||\n          recovered.some((report) => report.disposition === \"repaired\");\n\n        const delay = autonomous ? yield* rearmDelay(progressed) : 0;\n        const now = yield* Clock.currentTimeMillis;\n\n        yield* failpoint.hit(\"maintenance:finish:before\");\n\n        const alarmDisposition = yield* mutations.withSnapshot((active) =>\n          Effect.gen(function* () {\n            const publicationDeadline = yield* pendingDeadline;\n\n            return yield* runTransaction(\"finish maintenance pass\", () =>\n              ctx.storage.transaction(async (transaction) => {\n                const { state } = await readMaintenanceState(transaction);\n\n                // Autonomous work and in-flight mutations intentionally leave the observed\n                // generation dirty. Otherwise acknowledge only the pass-start generation.\n                const processed =\n                  autonomous || started.activeAtStart > 0 || active > 0\n                    ? state.processed\n                    : state.processed > started.generation\n                      ? state.processed\n                      : started.generation;\n\n                const next = ThreadMaintenanceState.make({\n                  ...state,\n                  processed,\n                  nonterminal: remaining.length,\n                });\n\n                await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));\n                if (autonomous) {\n                  // Replace the crash-fallback slot with this pass's bounded backoff. The target\n                  // is never earlier than the begin-pass fallback, so workerd does not cancel\n                  // this running alarm handler before its report/span can complete.\n                  await transaction.setAlarm(\n                    Option.isSome(publicationDeadline)\n                      ? Math.max(\n                          now + minimumAlarmDelay,\n                          Math.min(now + delay, publicationDeadline.value),\n                        )\n                      : now + delay,\n                  );\n\n                  return \"rearmed\" as const;\n                }\n                if (started.activeAtStart > 0 || active > 0 || next.dirty > next.processed) {\n                  // A mutation overlapped this pass's observation window or raced\n                  // acknowledgement. It stays dirty and its pre-armed bounded alarm survives;\n                  // unseen effects are never acknowledged. Do not accelerate that future alarm\n                  // from inside the current handler: workerd cancels a running handler when it\n                  // writes an earlier slot.\n                  await ensureTransactionAlarmBy(\n                    transaction,\n                    Option.isSome(publicationDeadline)\n                      ? Math.max(\n                          now + minimumAlarmDelay,\n                          Math.min(now + config.wakeScanInterval, publicationDeadline.value),\n                        )\n                      : now + config.wakeScanInterval,\n                  );\n\n                  return \"rearmed\" as const;\n                }\n                if (Option.isSome(publicationDeadline)) {\n                  await transaction.setAlarm(\n                    Math.max(now + minimumAlarmDelay, publicationDeadline.value),\n                  );\n\n                  return \"rearmed\" as const;\n                }\n                await transaction.deleteAlarm();\n\n                return \"cleared\" as const;\n              }),\n            );\n          }),\n        );\n\n        yield* failpoint.hit(\"maintenance:finish:after\");\n        if (alarmDisposition === \"cleared\") {\n          yield* Ref.set(stalls, 0);\n        }\n\n        return yield* annotate(\n          MaintenancePassReport.make({\n            phase: \"actionable\",\n            recovered: recovered.length,\n            settled: Option.isSome(settlement) ? 1 : 0,\n            nonterminal: remaining.length,\n            alarm: alarmDisposition,\n          }),\n        );\n      });\n\n      return ThreadMaintenance.of({\n        // A mid-pass immediate hint is droppable; durable dirty state decides the final alarm.\n        pass: Effect.gen(function* () {\n          const yieldAfter = DateTime.makeUnsafe((yield* Clock.currentTimeMillis) + 10 * 60_000);\n\n          return yield* alarm.withWakesDeferred(maintenancePassGate.withPermit(pass(yieldAfter)));\n        }).pipe(\n          // Include permit waiting, recovery and acknowledgement in the event deadline.\n          // Interruption releases Attempt ownership, leaving the prearmed dirty generation\n          // for recovery. It never changes the logical Run duration or settles a policy failure.\n          // This cooperative timer cannot preempt synchronous CPU work or stuck finalizers.\n          Effect.timeoutOrElse({\n            duration: \"14 minutes\",\n            orElse: () =>\n              DurableAlarmError.make({\n                operation: \"maintenance pass deadline\",\n                message:\n                  \"The maintenance event exceeded its 14 minute deadline; durable recovery remains pending\",\n              }),\n          }),\n        ),\n        ensureAlarm: mutations.withSnapshot(() => ensureAlarm()),\n        withMutation: (body) =>\n          mutations.withMutation(\n            body.pipe(\n              Effect.tap(() =>\n                publishCommitted.pipe(Effect.provideService(ThreadPublication, publication)),\n              ),\n            ),\n          ),\n      });\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,IAAa,oBAAb,cAAuC,OAAO,YAA+B,CAAC,CAC5E,qBACA;CACE,WAAW,OAAO;CAClB,SAAS,OAAO;CAChB,OAAO,OAAO,YAAY,OAAO,OAAO,CAAC;AAC3C,CACF,CAAC,CAAC,CAAC;AAEH,MAAM,gBACH,eACA,UACC,kBAAkB,KAAK;CACrB;CACA,SAAS,iBAAiB,OAAO,sDAAsD;CACvF;AACF,CAAC;;AAGL,IAAa,sBAAb,MAAa,4BAA4B,QAAQ,QA+B/C,CAAC,CAAC,uDAAuD,CAAC,CAAC;CAC3D,OAAgB,QACd,MAAM,OAAO,mBAAmB,CAAC,CAC/B,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,QAAQ,OAAO;;;;;;EAMvB,MAAM,gBAAgB,OAAO,IAAI,KAAK,CAAC;EAEvC,MAAM,YAAY,OAAO,WAAW;GAClC,WAAW,IAAI,QAAQ,SAAS;GAChC,OAAO,aAAa,WAAW;EACjC,CAAC,CAAC,CAAC,KACD,OAAO,KAAK,aACV,aAAa,OAAO,OAAO,KAAa,IAAI,OAAO,KAAK,QAAQ,CAClE,CACF;EAEA,MAAM,cAAc,gBAClB,OAAO,WAAW;GAChB,WAAW,IAAI,QAAQ,SAAS,WAAW;GAC3C,OAAO,aAAa,WAAW;EACjC,CAAC;EAEH,MAAM,qBAAqB,gBACzB,UAAU,KACR,OAAO,SAAS,aACd,OAAO,OAAO,QAAQ,KAAK,SAAS,SAAS,cACzC,OAAO,OACP,WAAW,WAAW,CAC5B,CACF;EAEF,MAAM,SAAS,MAAM,kBAAkB,KACrC,OAAO,SAAS,QAAQ,kBAAkB,GAAG,CAAC,CAChD;EAEA,MAAM,cAAc,IAAI,IAAI,aAAa,CAAC,CAAC,KACzC,OAAO,SAAS,WAAY,SAAS,IAAI,OAAO,OAAO,MAAO,CAChE;EAEA,MAAM,qBAA8B,SAClC,IAAI,OAAO,gBAAgB,WAAW,SAAS,CAAC,CAAC,CAAC,KAChD,OAAO,QAAQ,IAAI,GACnB,OAAO,SAAS,IAAI,OAAO,gBAAgB,WAAW,SAAS,CAAC,CAAC,CACnE;EAEF,MAAM,SAAS,OAAO,WAAW;GAC/B,WAAW,IAAI,QAAQ,YAAY;GACnC,OAAO,aAAa,cAAc;EACpC,CAAC;EAED,OAAO,oBAAoB,GAAG;GAC5B;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,CAAC,CACH;AACJ;;AAGA,IAAa,wBAAb,cAA2C,OAAO,MAChD,yDACF,CAAC,CAAC;;CAEA,OAAO,OAAO,SAAS,CAAC,aAAa,YAAY,CAAC;;CAElD,WAAW,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;CAE5D,SAAS,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;CAE1D,aAAa,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;CAE9D,OAAO,OAAO,SAAS,CAAC,WAAW,SAAS,CAAC;AAC/C,CAAC,CAAC,CAAC,CAAC;;AAoBJ,IAAa,6BAAb,cAAgD,QAAQ,QAKtD,CAAC,CAAC,8DAA8D,CAAC,CAAC;CAClE,OAAgB,QAAQ,MAAM,QAAQ,IAAI,CAAC,CAAC,EAAE,WAAW,OAAO,KAAK,CAAC;AACxE;;AAwBA,IAAa,oBAAb,cAAuC,QAAQ,QAG7C,CAAC,CAAC,qDAAqD,CAAC,CAAC;CACzD,OAAgB,QAAQ,MAAM,QAAQ,IAAI,CAAC,CAAC;EAC1C,YAAY,OAAO;EACnB,yBAAyB,OAAO;EAChC,OAAO,OAAO;EACd,iBAAiB,OAAO,QAAQ,OAAO,KAAK,CAAC;CAC/C,CAAC;AACH;;;;;;AAOA,MAAa,wBAAwB,QAAQ,UAO1C,2DAA2D,EAC5D,qBAAqB;CAAE,OAAO,OAAO;CAAM,iBAAiB,OAAO,QAAQ,OAAO,KAAK,CAAC;AAAE,GAC5F,CAAC;AAED,MAAM,oBACJ,MACA,UAEA,OAAO,OAAO,IAAI,IACd,OAAO,OAAO,KAAK,IACjB,OAAO,KAAK,KAAK,IAAI,KAAK,OAAO,MAAM,KAAK,CAAC,IAC7C,OACF;;AAGN,MAAa,mBAAmB,OAAO,IAAI,aAAa;CACtD,MAAM,cAAc,OAAO;CAE3B,OAAO,YAAY,WAAW,KAAK,OAAO,QAAQ,YAAY,KAAK,CAAC;AACtE,CAAC,CAAC,CAAC,KACD,OAAO,YAAY,UACjB,MAAM,cAAc,KAAK,IACrB,OAAO,YACP,OAAO,SAAS,mDAAmD,KAAK,CAC9E,CACF;AAEA,MAAM,wBAAwB,OAAO,iBAAiB,MACpD,OAAO,6BAA6B,EAAE,CACxC;;AAGA,IAAM,yBAAN,cAAqC,OAAO,MAC1C,0DACF,CAAC,CAAC;CACA,eAAe,OAAO,QAAQ,CAAC;CAC/B,OAAO;CACP,WAAW;CACX,aAAa,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,wBAAwB;AAC9B,MAAM,yBAAyB,OAAO,kBAAkB,sBAAsB;AAC9E,MAAM,yBAAyB,OAAO,WAAW,sBAAsB;AAEvE,MAAM,gCACJ,uBAAuB,KAAK;CAC1B,eAAe;CAGf,OAAO;CACP,WAAW;CACX,aAAa;AACf,CAAC;AAEH,MAAM,uBAAuB,OAC3B,gBACuF;CACvF,MAAM,UAAU,MAAM,YAAY,IAAI,qBAAqB;CAE3D,OAAO,YAAY,KAAA,IACf;EAAE,OAAO,wBAAwB;EAAG,aAAa;CAAM,IACvD;EAAE,OAAO,uBAAuB,OAAO;EAAG,aAAa;CAAK;AAClE;AAEA,MAAM,2BAA2B,OAC/B,aACA,aACkB;CAClB,MAAM,YAAY,MAAM,YAAY,SAAS;CAE7C,IAAI,cAAc,QAAQ,YAAY,UACpC,MAAM,YAAY,SAAS,QAAQ;AAEvC;AAEA,MAAM,sBACJ,UACA,YACY;CACZ,MAAM,WAAW,QAAQ,IAAI,SAAS,YAAY,CAAC,EAAE,SAAS;CAG9D,IAAI,aAAa,iBAAiB,OAAO;CACzC,QAAQ,SAAS,OAAjB;EACE,KAAK;EACL,KAAK,UACH,OAAO;EACT,KAAK,WACH,OAAO,aAAa,4BAA4B,aAAa;EAC/D,KAAK,YACH,OAAO,QAAQ,IAAI,SAAS,YAAY,CAAC,EAAE,SAAS,SAAS;EAC/D,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,iBACH,OAAO;CACX;AACF;;;;;;AAOA,IAAa,qBAAb,MAAa,2BAA2B,QAAQ,QAU9C,CAAC,CAAC,+DAA+D,CAAC,CAAC;CACnE,OAAgB,QAAQ,MAAM,OAAO,IAAI,CAAC,CACxC,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,QAAQ,OAAO;EACvB,MAAM,SAAS,OAAO;EACtB,MAAM,YAAY,OAAO;EAEzB,MAAM,kBAAkB,OAAO,IAAI,KAAK,CAAC;EACzC,MAAM,iBAAiB,OAAO,UAAU,KAAK,CAAC;EAC9C,MAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,mBAAmB,CAAC,CAAC;EAE5E,MAAM,kBAAqB,WAAmB,gBAC5C,OAAO,WAAW;GAAE,KAAK;GAAa,OAAO,aAAa,SAAS;EAAE,CAAC;EAExE,MAAM,gBAAgB,OAAO,GAAG,iCAAiC,CAAC,CAAC,aAAa;GAC9E,OAAO,UAAU,IAAI,0BAA0B;GAC/C,MAAM,MAAM,OAAO,MAAM;GAEzB,OAAO,eAAe,wCACpB,IAAI,QAAQ,YAAY,OAAO,gBAAgB;IAC7C,MAAM,EAAE,UAAU,MAAM,qBAAqB,WAAW;IAExD,MAAM,OAAO,uBAAuB,KAAK;KACvC,GAAG;KACH,OAAO,MAAM,QAAQ;IACvB,CAAC;IAED,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,IAAI,CAAC;IAGzE,MAAM,yBAAyB,aAAa,MAAM,iBAAiB;GACrE,CAAC,CACH;GACA,OAAO,UAAU,IAAI,yBAAyB;GAC9C,OAAO,IAAI,OAAO,kBAAkB,WAAW,SAAS,CAAC;EAC3D,CAAC;EAED,MAAM,cAAc,eAAe,WACjC,IAAI,OAAO,kBAAkB,WAAW,KAAK,IAAI,GAAG,SAAS,CAAC,CAAC,CACjE;EAEA,MAAM,gBACJ,SAEA,OAAO,kBACL,eAAe,WAAW,cAAc,CAAC,SAEvC,UAAU,IAAI,4BAA4B,CAAC,CAAC,KAC1C,OAAO,QAAQ,IAAI,GACnB,OAAO,UAAU,UAAU,IAAI,+BAA+B,CAAC,CACjE,SACI,WACR;EAEF,OAAO,mBAAmB,GAAG;GAC3B;GACA,eAAe,SACb,eAAe,WAAW,OAAO,QAAQ,IAAI,IAAI,eAAe,GAAG,IAAI,CAAC;EAC5E,CAAC;CACH,CAAC,CACH;AACF;;;;;;;;;;;;;;;AAsBA,IAAa,oBAAb,MAAa,0BAA0B,QAAQ,QAmB7C,CAAC,CAAC,qDAAqD,CAAC,CAAC;CACzD,OAAgB,QAaZ,MAAM,OAAO,iBAAiB,CAAC,CACjC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,MAAM,EAAE,QAAQ,OAAO;EACvB,MAAM,YAAY,OAAO;;;;;EAMzB,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;EAChC,MAAM,YAAY,OAAO;EACzB,MAAM,cAAc,OAAO;EAC3B,MAAM,aAAa,OAAO;EAC1B,MAAM,WAAW,OAAO;EAGxB,MAAM,qBAAqB,WAAW,gBAAgB,KACpD,OAAO,YAAY,UACjB,MAAM,cAAc,KAAK,IACrB,OAAO,UAAU,KAAK,IACtB,OAAO,SAAS,0CAA0C,KAAK,CAAC,CAAC,KAC/D,OAAO,GAAG,OAAO,KAAK,CAAC,CAAC,CAC1B,CACN,CACF;EAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;GAC9C,OAAO,iBACL,iBAAiB,OAAO,YAAY,iBAAiB,OAAO,SAAS,eAAe,GACpF,OAAO,kBACT;EACF,CAAC;EAED,MAAM,sBAAsB,OAAO,UAAU,KAAK,CAAC;EACnD,MAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,mBAAmB,CAAC,CAAC;EAE5E,MAAM,kBAAqB,WAAmB,gBAC5C,OAAO,WAAW;GAAE,KAAK;GAAa,OAAO,aAAa,SAAS;EAAE,CAAC;EAExE,MAAM,cAAc,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;GAC1E,OAAO,UAAU,IAAI,2BAA2B;GAChD,MAAM,MAAM,OAAO,MAAM;GAEzB,OAAO,eAAe,kCACpB,IAAI,QAAQ,YAAY,OAAO,gBAAgB;IAC7C,MAAM,EAAE,OAAO,gBAAgB,MAAM,qBAAqB,WAAW;IAErE,IAAI,CAAC,aACH,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,KAAK,CAAC;IAE5E,IAAI,MAAM,QAAQ,MAAM,WACtB,MAAM,yBAAyB,aAAa,MAAM,OAAO,gBAAgB;GAE7E,CAAC,CACH;GACA,MAAM,WAAW,OAAO;GAExB,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,eAAe,kCACpB,IAAI,QAAQ,aAAa,gBACvB,yBACE,aACA,KAAK,IAAI,MAAM,mBAAmB,SAAS,KAAK,CAClD,CACF,CACF;GAEF,OAAO,UAAU,IAAI,0BAA0B;EACjD,CAAC;EAED,MAAM,YAAY,OAAO,GAAG,6BAA6B,CAAC,CAAC,aAAa;GACtE,OAAO,UAAU,IAAI,0BAA0B;GAC/C,MAAM,MAAM,OAAO,MAAM;GAEzB,MAAM,SAAS,OAAO,eAAe,gCACnC,IAAI,QAAQ,YAAY,OAAO,gBAAgB;IAC7C,MAAM,EAAE,OAAO,gBAAgB,MAAM,qBAAqB,WAAW;IAErE,IAAI,CAAC,aACH,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,KAAK,CAAC;IAE5E,IAAI,MAAM,aAAa,MAAM,OAAO;KAElC,MAAM,yBAAyB,aAAa,MAAM,iBAAiB;KAEnE,OAAO;MAAE,MAAM;MAAqB,aAAa,MAAM;KAAY;IACrE;IAGA,MAAM,yBAAyB,aAAa,MAAM,iBAAiB;IAEnE,OAAO;KACL,MAAM;KACN,YAAY,MAAM;KAClB,aAAa,MAAM;IACrB;GACF,CAAC,CACH;GAEA,OAAO,UAAU,IAAI,yBAAyB;GAE9C,OAAO;EACT,CAAC;EAED,MAAM,aAAa,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,YAAqB;GAC3F,MAAM,cAAc,OAAO,IAAI,aAAa,SAAS,UACnD,aAAa,IAAI,QAAQ,CAC3B;GAEA,IAAI,YAAY,OAAO,OAAO;GAC9B,MAAM,WAAW,KAAK,IAAI,aAAa,EAAE;GACzC,MAAM,UAAU,KAAK,IAAI,OAAO,iBAAiB,OAAO,mBAAmB,KAAK,QAAQ;GACxF,MAAM,SAAS,OAAO,OAAO;GAG7B,MAAM,WAAW,KAAK,KAAK,UAAU,IAAK,UAAU,IAAK,MAAM;GAE/D,OAAO,KAAK,IAAI,UAAU,OAAO,gBAAgB;EACnD,CAAC;EAED,MAAM,OAAO,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAC/C,YACiE;GACjE,MAAM,YAAY,WAChB,OAAO,oBAAoB;IACzB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,SAAS,OAAO;IAChB,aAAa,OAAO;IACpB,OAAO,OAAO;GAChB,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,MAAM,CAAC;GAE3B,MAAM,UAAU,OAAO,UAAU,cAAc,kBAC7C,OAAO,IAAI,aAAa;IACtB,MAAM,aAAa,OAAO,UAAU;IAEpC,IAAI,WAAW,SAAS,gBAAgB,kBAAkB,GAExD,OAAO,YAAY,kBAAkB,WAAW,UAAU;IAG5D,OAAO;KAAE,GAAG;KAAY;IAAc;GACxC,CAAC,CACH;GAKA,MAAM,mBAAmB,OAAO,SAAS,KAAW;GAEpD,MAAM,WAAW,OAAO,OAAO,UAC7B,SAAS,aAAa,gBAAgB,KAAK,SAAS,KACtD;GAEA,MAAM,iBAAiB,SAAS,QAAQ,kBAAkB,KAAA,CAAS,CAAC,CAAC,KACnE,OAAO,QAAQ,MAAM,KAAK,QAAQ,CAAC,CACrC;GAIA,MAAM,YAAY,OAAO,OAAO,KAC9B,SAAS,KAAK,OAAO,eAAe,6BAA6B,UAAU,CAAC,CAC9E;GAEA,IAAI,KAAK,UAAU,SAAS,KAAK,MAAM,cAAc,UAAU,KAAK,GAClE,OAAO,OAAO,OAAO,UAAU,UAAU,KAAK;GAChD,MAAM,WAAW,OAAO,YAAY;GAEpC,IACE,QAAQ,SAAS,gBAChB,OAAO,OAAO,QAAQ,KAAK,SAAS,UAAU,OAAO,MAAM,oBAE5D,OAAO,YAAY;GAErB,MAAM,UAAU,OAAO,YAAY;GAEnC,IAAI,QAAQ,SAAS,cAAc,OAAO,OAAO,OAAO,GAAG;IACzD,OAAO;IACP,IAAI,KAAK,UAAU,SAAS,GAAG,OAAO,OAAO,OAAO,UAAU,UAAU,KAAK;IAC7E,OAAO,UAAU,IAAI,2BAA2B;IAEhD,MAAM,cAAc,OAAO,UAAU,cAAc,WACjD,OAAO,IAAI,aAAa;KAGtB,MAAM,SAAS,OAAO;KACtB,MAAM,MAAM,OAAO,MAAM;KAEzB,OAAO,OAAO,eAAe,iCAC3B,IAAI,QAAQ,YAAY,OAAO,gBAAgB;MAC7C,MAAM,EAAE,UAAU,MAAM,qBAAqB,WAAW;MAExD,MAAM,iBACJ,SAAS,KAAK,MAAM,QAAQ,MAAM,YAC9B,MAAM,OAAO,mBACb;MAEN,MAAM,OAAO,OAAO,OAAO,MAAM,IAC7B,KAAK,IAAI,gBAAgB,OAAO,KAAK,IACrC;MAEJ,IAAI,OAAO,SAAS,IAAI,GAAG;OACzB,MAAM,YAAY,SAAS,KAAK,IAAI,MAAM,mBAAmB,IAAI,CAAC;OAElE,OAAO;MACT;MACA,MAAM,YAAY,YAAY;MAE9B,OAAO;KACT,CAAC,CACH;IACF,CAAC,CACH;IAEA,OAAO,UAAU,IAAI,0BAA0B;IAE/C,OAAO,OAAO,SACZ,sBAAsB,KAAK;KACzB,OAAO;KACP,WAAW;KACX,SAAS;KACT,aAAa,QAAQ;KACrB,OAAO;IACT,CAAC,CACH;GACF;GAEA,MAAM,YAA2C,OAAO,QAAQ;GAGhE,MAAM,aAAa,OAAO,QAAQ,kBAAkB,SAAS,UAAU,EAAE,WAAW,CAAC;GAErF,OAAO;GACP,IAAI,KAAK,UAAU,SAAS,GAAG,OAAO,OAAO,OAAO,UAAU,UAAU,KAAK;GAE7E,MAAM,YAAY,OAAO,OAAO,WAAW,OAAO,eAAe;GACjE,MAAM,UAAU,IAAI,IAAI,UAAU,KAAK,WAAW,CAAC,OAAO,cAAc,MAAM,CAAC,CAAC;GAChF,MAAM,OAAO,UAAU;GACvB,MAAM,cAAc,SAAS,KAAA,KAAa,mBAAmB,MAAM,OAAO;GAE1E,MAAM,aAAa,UAAU,MAAM,UAAU,UAAU;IAGrD,IACE,QAAQ,KACR,eACA,SAAS,UAAU,WACnB,QAAQ,IAAI,SAAS,YAAY,CAAC,EAAE,SAAS,SAAS,cAEtD,OAAO;IAET,OAAO,CAAC,mBAAmB,UAAU,OAAO;GAC9C,CAAC;GAED,MAAM,aACJ,OAAO,OAAO,UAAU,KACxB,UAAU,MAAM,WAAW,OAAO,gBAAgB,UAAU;GAE9D,MAAM,QAAQ,aAAa,OAAO,WAAW,UAAU,IAAI;GAC3D,MAAM,MAAM,OAAO,MAAM;GAEzB,OAAO,UAAU,IAAI,2BAA2B;GAEhD,MAAM,mBAAmB,OAAO,UAAU,cAAc,WACtD,OAAO,IAAI,aAAa;IACtB,MAAM,sBAAsB,OAAO;IAEnC,OAAO,OAAO,eAAe,iCAC3B,IAAI,QAAQ,YAAY,OAAO,gBAAgB;KAC7C,MAAM,EAAE,UAAU,MAAM,qBAAqB,WAAW;KAIxD,MAAM,YACJ,cAAc,QAAQ,gBAAgB,KAAK,SAAS,IAChD,MAAM,YACN,MAAM,YAAY,QAAQ,aACxB,MAAM,YACN,QAAQ;KAEhB,MAAM,OAAO,uBAAuB,KAAK;MACvC,GAAG;MACH;MACA,aAAa,UAAU;KACzB,CAAC;KAED,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,IAAI,CAAC;KACzE,IAAI,YAAY;MAId,MAAM,YAAY,SAChB,OAAO,OAAO,mBAAmB,IAC7B,KAAK,IACH,MAAM,mBACN,KAAK,IAAI,MAAM,OAAO,oBAAoB,KAAK,CACjD,IACA,MAAM,KACZ;MAEA,OAAO;KACT;KACA,IAAI,QAAQ,gBAAgB,KAAK,SAAS,KAAK,KAAK,QAAQ,KAAK,WAAW;MAM1E,MAAM,yBACJ,aACA,OAAO,OAAO,mBAAmB,IAC7B,KAAK,IACH,MAAM,mBACN,KAAK,IAAI,MAAM,OAAO,kBAAkB,oBAAoB,KAAK,CACnE,IACA,MAAM,OAAO,gBACnB;MAEA,OAAO;KACT;KACA,IAAI,OAAO,OAAO,mBAAmB,GAAG;MACtC,MAAM,YAAY,SAChB,KAAK,IAAI,MAAM,mBAAmB,oBAAoB,KAAK,CAC7D;MAEA,OAAO;KACT;KACA,MAAM,YAAY,YAAY;KAE9B,OAAO;IACT,CAAC,CACH;GACF,CAAC,CACH;GAEA,OAAO,UAAU,IAAI,0BAA0B;GAC/C,IAAI,qBAAqB,WACvB,OAAO,IAAI,IAAI,QAAQ,CAAC;GAG1B,OAAO,OAAO,SACZ,sBAAsB,KAAK;IACzB,OAAO;IACP,WAAW,UAAU;IACrB,SAAS,OAAO,OAAO,UAAU,IAAI,IAAI;IACzC,aAAa,UAAU;IACvB,OAAO;GACT,CAAC,CACH;EACF,CAAC;EAED,OAAO,kBAAkB,GAAG;GAE1B,MAAM,OAAO,IAAI,aAAa;IAC5B,MAAM,aAAa,SAAS,YAAY,OAAO,MAAM,qBAAqB,GAAW;IAErF,OAAO,OAAO,MAAM,kBAAkB,oBAAoB,WAAW,KAAK,UAAU,CAAC,CAAC;GACxF,CAAC,CAAC,CAAC,KAKD,OAAO,cAAc;IACnB,UAAU;IACV,cACE,kBAAkB,KAAK;KACrB,WAAW;KACX,SACE;IACJ,CAAC;GACL,CAAC,CACH;GACA,aAAa,UAAU,mBAAmB,YAAY,CAAC;GACvD,eAAe,SACb,UAAU,aACR,KAAK,KACH,OAAO,UACL,iBAAiB,KAAK,OAAO,eAAe,mBAAmB,WAAW,CAAC,CAC7E,CACF,CACF;EACJ,CAAC;CACH,CAAC,CACH;AACF"}
+{"version":3,"file":"Alarm.mjs","names":[],"sources":["../src/Alarm.ts"],"sourcesContent":["import { ThreadId } from \"@effect-agent/core/Identifiers\";\nimport { type DurableBindingFailure } from \"@effect-agent/thread/AgentRegistration\";\nimport {\n  DurableAgentRuntime,\n  type DurableWorkerFailure,\n  type RecoveryReport,\n} from \"@effect-agent/thread/DurableAgentRuntime\";\nimport { SubmissionLedger, type SubmissionSnapshot } from \"@effect-agent/thread/SubmissionLedger\";\nimport {\n  ThreadProjectionMaintenance,\n  drainDue,\n  type ThreadProjectionError,\n} from \"@effect-agent/thread/ThreadProjectionMaintenance\";\nimport {\n  Cause,\n  Clock,\n  Context,\n  DateTime,\n  Deferred,\n  Effect,\n  Exit,\n  Fiber,\n  Layer,\n  Option,\n  Random,\n  Ref,\n  Schema,\n  Semaphore,\n  Stream,\n} from \"effect\";\n\nimport { DurableObjectContext } from \"./CloudflareBindings.ts\";\nimport { CloudflareDurableRuntimeConfig } from \"./CloudflareConfig.ts\";\nimport { safeCauseMessage } from \"./internal/boundary.ts\";\n\n/**\n * The single multiplexed Durable Object alarm (decision D-P6-2). A Durable Object has ONE\n * alarm slot; every cadence the Node host ran on fibers (wake scan, lease expiry, settlement\n * and abort re-checks, retry backoff) multiplexes into one idempotent maintenance pass, and\n * the slot always holds the EARLIEST deadline any caller asked for.\n *\n * The alarm invariant (plan §1.4): every committed actionable mutation carries a newer durable\n * maintenance generation and a committed alarm. Stable externally-driven waits may be\n * nonterminal without retaining an alarm; their resolving mutation advances the generation and\n * restores the alarm atomically.\n */\n\n/** The Durable Object alarm API failed; surfaces on host entry points as a typed refusal. */\nexport class DurableAlarmError extends Schema.TaggedError<DurableAlarmError>()(\n  \"DurableAlarmError\",\n  {\n    operation: Schema.String,\n    message: Schema.String,\n    cause: Schema.optionalKey(Schema.Defect()),\n  },\n) {}\n\nconst alarmFailure =\n  (operation: string) =>\n  (cause: unknown): DurableAlarmError =>\n    DurableAlarmError.make({\n      operation,\n      message: safeCauseMessage(cause, \"The Cloudflare alarm API failed without a diagnostic\"),\n      cause,\n    });\n\n/** `ctx.storage` alarm slot as an Effect service; storage is truth, never a memory field. */\nexport class DurableAlarmService extends Context.Service<\n  DurableAlarmService,\n  {\n    /** The scheduled deadline in epoch milliseconds, if any. */\n    readonly scheduled: Effect.Effect<Option.Option<number>, DurableAlarmError>;\n    /** Replace the slot with this deadline. */\n    readonly scheduleAt: (epochMillis: number) => Effect.Effect<void, DurableAlarmError>;\n    /** Keep the EARLIER of the existing deadline and this one (the multiplexing rule). */\n    readonly ensureScheduledBy: (epochMillis: number) => Effect.Effect<void, DurableAlarmError>;\n    /**\n     * Arm an immediate alarm (the durable, coalescing local wake) — DEFERRED while a\n     * maintenance pass is executing. Workerd cancels an in-flight alarm handler when a new\n     * EARLIER deadline is written during its execution (`requestScheduledAlarm`), and the\n     * maintenance pass runs INSIDE the alarm handler: an immediate wake landing mid-pass\n     * (a routed port mutation, a sibling's `wake()`, the coordinator's own local notify)\n     * would kill the running Attempt — manufacturing an ownership loss no real eviction\n     * caused, and routing open uncertain-class Tool Calls into spurious Unknown Outcomes.\n     * Deferral is contract-safe: wakes are droppable hints, every mutating entry point\n     * pre-arms BEFORE its first durable mutation (the alarm invariant never rests on this\n     * call). The pass's durable generation check observes any racing mutation, so the\n     * in-memory hint does not need to be flushed after a stable wait is acknowledged.\n     */\n    readonly scheduleNow: Effect.Effect<void, DurableAlarmError>;\n    /**\n     * Run one maintenance pass with wake deferral (see `scheduleNow`). Calls made while `body`\n     * executes are droppable promptness hints; correctness rests on the durable generation.\n     */\n    readonly withWakesDeferred: <A, E, R>(body: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;\n    /** Clear the slot; correctness-sensitive clears live in maintenance generation transactions. */\n    readonly cancel: Effect.Effect<void, DurableAlarmError>;\n  }\n>()(\"@effect-agent/platform-cloudflare/DurableAlarmService\") {\n  static readonly layer: Layer.Layer<DurableAlarmService, never, DurableObjectContext> =\n    Layer.effect(DurableAlarmService)(\n      Effect.gen(function* () {\n        const { ctx } = yield* DurableObjectContext;\n        /**\n         * In-memory pass bookkeeping — a pure CACHE, never state: a fresh incarnation has no\n         * running pass, and a deferred wake lost to eviction was only ever a promptness hint\n         * on top of the already-committed pre-armed alarm.\n         */\n        const runningPasses = yield* Ref.make(0);\n\n        const scheduled = Effect.tryPromise({\n          try: () => ctx.storage.getAlarm(),\n          catch: alarmFailure(\"get alarm\"),\n        }).pipe(\n          Effect.map((deadline) =>\n            deadline === null ? Option.none<number>() : Option.some(deadline),\n          ),\n        );\n\n        const scheduleAt = (epochMillis: number) =>\n          Effect.tryPromise({\n            try: () => ctx.storage.setAlarm(epochMillis),\n            catch: alarmFailure(\"set alarm\"),\n          });\n\n        const ensureScheduledBy = (epochMillis: number) =>\n          scheduled.pipe(\n            Effect.flatMap((existing) =>\n              Option.isSome(existing) && existing.value <= epochMillis\n                ? Effect.void\n                : scheduleAt(epochMillis),\n            ),\n          );\n\n        const armNow = Clock.currentTimeMillis.pipe(\n          Effect.flatMap((now) => ensureScheduledBy(now)),\n        );\n\n        const scheduleNow = Ref.get(runningPasses).pipe(\n          Effect.flatMap((passes) => (passes > 0 ? Effect.void : armNow)),\n        );\n\n        const withWakesDeferred = <A, E, R>(body: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>\n          Ref.update(runningPasses, (passes) => passes + 1).pipe(\n            Effect.andThen(body),\n            Effect.ensuring(Ref.update(runningPasses, (passes) => passes - 1)),\n          );\n\n        const cancel = Effect.tryPromise({\n          try: () => ctx.storage.deleteAlarm(),\n          catch: alarmFailure(\"delete alarm\"),\n        });\n\n        return DurableAlarmService.of({\n          scheduled,\n          scheduleAt,\n          ensureScheduledBy,\n          scheduleNow,\n          withWakesDeferred,\n          cancel,\n        });\n      }),\n    );\n}\n\n/** What one maintenance pass did — auditable evidence mirroring `NodeDurableHost`'s report. */\nexport class MaintenancePassReport extends Schema.Class<MaintenancePassReport>(\n  \"@effect-agent/platform-cloudflare/MaintenancePassReport\",\n)({\n  /** `caught-up` ran no runtime work (publication may be pending); `actionable` ran recovery. */\n  phase: Schema.Literals([\"caught-up\", \"actionable\"]),\n  /** Recovery decisions executed (or deferred) BEFORE any new claim in this pass. */\n  recovered: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /** Whether the head Attempt settled. Joined input may settle with that head. */\n  settled: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /** Submissions still nonterminal after the pass (suspended/unknown lanes stay honest). */\n  nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /** `rearmed` for dirty/autonomous work, `cleared` for stable waits or settlement. */\n  alarm: Schema.Literals([\"rearmed\", \"cleared\"]),\n}) {}\n\n/** Fault boundaries around every maintenance-owned durable mutation. */\nexport type ThreadMaintenanceFailpointLocation =\n  | \"maintenance:dirty:before\"\n  | \"maintenance:dirty:after\"\n  | \"maintenance:mutation:armed\"\n  | \"maintenance:mutation:finished\"\n  | \"maintenance:ensure:before\"\n  | \"maintenance:ensure:after\"\n  | \"maintenance:begin:before\"\n  | \"maintenance:begin:after\"\n  | \"maintenance:select:before\"\n  | \"maintenance:select:after\"\n  | \"maintenance:finish:before\"\n  | \"maintenance:finish:after\";\n\nexport type ThreadMaintenanceFailpointHandler = (\n  location: ThreadMaintenanceFailpointLocation,\n) => Effect.Effect<void>;\n\n/** Test-only fault authority; production uses the inert layer. */\nexport class ThreadMaintenanceFailpoint extends Context.Service<\n  ThreadMaintenanceFailpoint,\n  {\n    readonly hit: ThreadMaintenanceFailpointHandler;\n  }\n>()(\"@effect-agent/platform-cloudflare/ThreadMaintenanceFailpoint\") {\n  static readonly layer = Layer.succeed(this)({ hit: () => Effect.void });\n}\n\n/**\n * Durable host publication of canonical records and ledger approval/abort/resolution intents.\n * The host owns schema-versioned cursors, destination idempotency and acknowledgement. Delivery\n * is at least once. Hooks must not write the alarm slot or mutate the supplied raw source ports.\n *\n * `invalidate`, `prepareGeneration` and `pendingDeadline` must be bounded local operations.\n * `prepareGeneration` durably invalidates a scan only when its generation changes; repeated\n * calls must preserve partial scan progress. It runs with no source mutation in flight.\n * `drain` performs bounded delivery and persists retries before returning. A pending deadline\n * defers runtime recovery/Attempts, allowing committed host publications to drain first.\n * Unexpected hook failures leave the prearmed generation for retry. Hooks acquire per-call\n * resources with Effect.scoped; Layer construction owns incarnation resources (eviction need\n * not run finalizers). Do not hold a local hook behind network I/O or call back into producers.\n */\nexport interface ThreadPublicationService {\n  readonly invalidate: Effect.Effect<void, DurableAlarmError>;\n  readonly prepareGeneration: (generation: bigint) => Effect.Effect<void, DurableAlarmError>;\n  readonly drain: Effect.Effect<void, DurableAlarmError>;\n  readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;\n}\n\n/** Opt in with `ThreadObject.layer(registrations, { publication: Layer.effect(ThreadPublication)(...) })`. */\nexport class ThreadPublication extends Context.Service<\n  ThreadPublication,\n  ThreadPublicationService\n>()(\"@effect-agent/platform-cloudflare/ThreadPublication\") {\n  static readonly layer = Layer.succeed(this)({\n    invalidate: Effect.void,\n    prepareGeneration: () => Effect.void,\n    drain: Effect.void,\n    pendingDeadline: Effect.succeed(Option.none()),\n  });\n}\n\n/**\n * Host-assembled message recovery, supplied by ThreadObject.layer even when the application\n * rebuilds ThreadMaintenance. These obligations outlive source Runs and never defer a ready\n * source Attempt while a destination is processing an accepted message.\n */\nexport const ThreadMessageDelivery = Context.Reference<{\n  readonly drain: Effect.Effect<void, DurableAlarmError>;\n  /** Drain inserts and due retries during source work, finishing the bounded wave on completion. */\n  readonly drainUntil?: (\n    finished: Deferred.Deferred<void>,\n  ) => Effect.Effect<void, DurableAlarmError>;\n  readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;\n}>(\"@effect-agent/platform-cloudflare/ThreadMessageDelivery\", {\n  defaultValue: () => ({ drain: Effect.void, pendingDeadline: Effect.succeed(Option.none()) }),\n});\n\n/**\n * Application obligations sharing this Object's alarm. The deadline read is local and\n * read-only. Drain beside the native Attempt and always finish one initial bounded wave,\n * even when `finished` was already signalled. Then stop starting new waves on that signal\n * and finish the bounded current wave before returning. Native maintenance joins that work\n * before acknowledging a generation. Mutations use the same ThreadMutationGate; hooks never\n * write the raw alarm slot. Pending host work does not defer a ready model Attempt.\n */\nexport const ThreadHostMaintenance = Context.Reference<{\n  readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;\n  readonly drainUntil: (\n    finished: Deferred.Deferred<void>,\n  ) => Effect.Effect<void, DurableAlarmError>;\n}>(\"@effect-agent/platform-cloudflare/ThreadHostMaintenance\", {\n  defaultValue: () => ({\n    pendingDeadline: Effect.succeed(Option.none()),\n    drainUntil: () => Effect.void,\n  }),\n});\n\nconst earliestDeadline = (\n  left: Option.Option<number>,\n  right: Option.Option<number>,\n): Option.Option<number> =>\n  Option.isSome(left)\n    ? Option.isSome(right)\n      ? Option.some(Math.min(left.value, right.value))\n      : left\n    : right;\n\n/** @internal A committed source operation must not become a failed operation because delivery failed. */\nexport const publishCommitted = Effect.gen(function* () {\n  const publication = yield* ThreadPublication;\n\n  yield* publication.invalidate.pipe(Effect.andThen(publication.drain));\n}).pipe(\n  Effect.catchCause((cause) =>\n    Cause.hasInterrupts(cause)\n      ? Effect.interrupt\n      : Effect.logError(\"Thread publication deferred after source commit\", cause),\n  ),\n);\n\nconst MaintenanceGeneration = Schema.BigIntFromString.check(\n  Schema.isGreaterThanOrEqualToBigInt(0n),\n);\n\n/** Versioned, platform-private maintenance state stored through Durable Object KV. */\nclass ThreadMaintenanceState extends Schema.Class<ThreadMaintenanceState>(\n  \"@effect-agent/platform-cloudflare/ThreadMaintenanceState\",\n)({\n  schemaVersion: Schema.Literal(1),\n  dirty: MaintenanceGeneration,\n  processed: MaintenanceGeneration,\n  nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /** One physical-owner cursor; old single-lane records need no conversion. */\n  lastServedThreadId: Schema.optionalKey(ThreadId),\n}) {}\n\nconst MAINTENANCE_STATE_KEY = \"effect-agent:thread-maintenance:v1\";\nconst decodeMaintenanceState = Schema.decodeUnknownSync(ThreadMaintenanceState);\nconst encodeMaintenanceState = Schema.encodeSync(ThreadMaintenanceState);\n\nconst initialMaintenanceState = (): ThreadMaintenanceState =>\n  ThreadMaintenanceState.make({\n    schemaVersion: 1,\n    // Bootstrap Objects created by the pre-generation release without scanning the ledger in\n    // the constructor. One useful pass classifies and acknowledges any existing obligation.\n    dirty: 1n,\n    processed: 0n,\n    nonterminal: 0,\n  });\n\nconst readMaintenanceState = async (\n  transaction: DurableObjectTransaction,\n): Promise<{ readonly state: ThreadMaintenanceState; readonly initialized: boolean }> => {\n  const encoded = await transaction.get(MAINTENANCE_STATE_KEY);\n\n  return encoded === undefined\n    ? { state: initialMaintenanceState(), initialized: false }\n    : { state: decodeMaintenanceState(encoded), initialized: true };\n};\n\nconst ensureTransactionAlarmBy = async (\n  transaction: DurableObjectTransaction,\n  deadline: number,\n): Promise<void> => {\n  const scheduled = await transaction.getAlarm();\n\n  if (scheduled === null || scheduled > deadline) {\n    await transaction.setAlarm(deadline);\n  }\n};\n\nconst stableExternalWait = (\n  snapshot: SubmissionSnapshot,\n  reports: ReadonlyMap<string, RecoveryReport>,\n): boolean => {\n  const decision = reports.get(snapshot.submissionId)?.decision._tag;\n\n  // An accepted abort still owes cleanup/settlement even if its claim was deferred this pass.\n  if (decision === \"SettleAborted\") return false;\n  switch (snapshot.state) {\n    case \"suspended\":\n    case \"joined\":\n      return true;\n    case \"unknown\":\n      return decision === \"AwaitUnknownResolution\" || decision === \"MarkUnknown\";\n    case \"admitted\":\n      return reports.get(snapshot.submissionId)?.decision._tag === \"AwaitParentEstablishment\";\n    case \"input-applied\":\n    case \"joining\":\n    case \"ready\":\n    case \"running\":\n    case \"settled\":\n    case \"terminalizing\":\n      return false;\n  }\n};\n\n/**\n * Shared prearm/acknowledgement boundary for ingress and runtime-owned producers.\n * `ThreadObject.layer` provides this same instance in its Services. Rebuilt runtime/maintenance\n * Layers must reuse that instance; a second gate cannot observe the native producers' activity.\n */\nexport class ThreadMutationGate extends Context.Service<\n  ThreadMutationGate,\n  {\n    readonly withMutation: <A, E, R>(\n      body: Effect.Effect<A, E, R>,\n    ) => Effect.Effect<A, E | DurableAlarmError, R>;\n    readonly withSnapshot: <A, E, R>(\n      body: (active: number) => Effect.Effect<A, E, R>,\n    ) => Effect.Effect<A, E, R>;\n  }\n>()(\"@effect-agent/platform-cloudflare/internal/ThreadMutationGate\") {\n  static readonly layer = Layer.effect(this)(\n    Effect.gen(function* () {\n      const { ctx } = yield* DurableObjectContext;\n      const config = yield* CloudflareDurableRuntimeConfig;\n      const failpoint = yield* ThreadMaintenanceFailpoint;\n      // A fresh incarnation has no live mutations; durable generations survive eviction.\n      const activeMutations = yield* Ref.make(0);\n      const generationGate = yield* Semaphore.make(1);\n      const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));\n\n      const runTransaction = <A>(operation: string, transaction: () => Promise<A>) =>\n        Effect.tryPromise({ try: transaction, catch: alarmFailure(operation) });\n\n      const beginMutation = Effect.fn(\"ThreadMaintenance.beginMutation\")(function* () {\n        yield* failpoint.hit(\"maintenance:dirty:before\");\n        const now = yield* Clock.currentTimeMillis;\n\n        yield* runTransaction(\"advance maintenance generation\", () =>\n          ctx.storage.transaction(async (transaction) => {\n            const { state } = await readMaintenanceState(transaction);\n\n            const next = ThreadMaintenanceState.make({\n              ...state,\n              dirty: state.dirty + 1n,\n            });\n\n            await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));\n            // The earliest configured retry bounds a newly actionable mutation without relying\n            // on its best-effort immediate wake hint.\n            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);\n          }),\n        );\n        yield* failpoint.hit(\"maintenance:dirty:after\");\n        yield* Ref.update(activeMutations, (active) => active + 1);\n      });\n\n      const endMutation = generationGate.withPermit(\n        Ref.update(activeMutations, (active) => Math.max(0, active - 1)),\n      );\n\n      const withMutation = <A, E, R>(\n        body: Effect.Effect<A, E, R>,\n      ): Effect.Effect<A, E | DurableAlarmError, R> =>\n        Effect.acquireUseRelease(\n          generationGate.withPermit(beginMutation()),\n          () =>\n            failpoint.hit(\"maintenance:mutation:armed\").pipe(\n              Effect.andThen(body),\n              Effect.tap(() => failpoint.hit(\"maintenance:mutation:finished\")),\n            ),\n          () => endMutation,\n        );\n\n      return ThreadMutationGate.of({\n        withMutation,\n        withSnapshot: (body) =>\n          generationGate.withPermit(Effect.flatMap(Ref.get(activeMutations), body)),\n      });\n    }),\n  );\n}\n\nexport type MaintenancePassFailure =\n  | DurableWorkerFailure\n  | DurableBindingFailure\n  | DurableAlarmError\n  | ThreadProjectionError;\n\n/**\n * Incremental, quiescent maintenance over a durable dirty/processed generation (issue #93).\n *\n * `pass` = generation snapshot/pre-arm → recovery → one head Attempt → generation acknowledgement:\n *\n * 1. One storage transaction reads dirty/processed and re-arms before work. A caught-up forced\n *    alarm takes an O(1) path without recovery, ledger scans, or canonical-history reads.\n * 2. Recovery strictly precedes a new claim. One head Attempt advances the lane and requests\n *    a safe yield after ten minutes. The whole event has a fourteen-minute cooperative timeout.\n * 3. The final transaction acknowledges only the generation observed at pass start. A racing\n *    mutation therefore remains `dirty > processed` and retains its atomically-established alarm.\n * 4. Stable external waits acknowledge and clear. Autonomous retry, indeterminate, and lease\n *    recovery states leave their generation dirty and retain bounded backoff rearming.\n */\nexport class ThreadMaintenance extends Context.Service<\n  ThreadMaintenance,\n  {\n    /** One idempotent maintenance pass; failures propagate so workerd retries the alarm. */\n    readonly pass: Effect.Effect<MaintenancePassReport, MaintenancePassFailure>;\n    /**\n     * Constructor gate: initialize/inspect only the O(1) maintenance record and ensure a dirty\n     * generation has an alarm. It never scans the ledger or canonical history.\n     */\n    readonly ensureAlarm: Effect.Effect<void, MaintenancePassFailure>;\n    /**\n     * Serialize the pre-arm boundary with pass acknowledgement, advance the durable dirty\n     * generation and arm the alarm in one transaction BEFORE running the caller's mutation.\n     * A pass cannot acknowledge while that mutation remains in flight.\n     */\n    readonly withMutation: <A, E, R>(\n      body: Effect.Effect<A, E, R>,\n    ) => Effect.Effect<A, E | DurableAlarmError, R>;\n  }\n>()(\"@effect-agent/platform-cloudflare/ThreadMaintenance\") {\n  static readonly layer: Layer.Layer<\n    ThreadMaintenance,\n    never,\n    | ThreadMutationGate\n    | ThreadPublication\n    | ThreadProjectionMaintenance\n    | DurableAgentRuntime\n    | SubmissionLedger\n    | DurableAlarmService\n    | ThreadMaintenanceFailpoint\n    | CloudflareDurableRuntimeConfig\n    | DurableObjectContext\n  > = Layer.effect(ThreadMaintenance)(\n    Effect.gen(function* () {\n      const runtime = yield* DurableAgentRuntime;\n      const ledger = yield* SubmissionLedger;\n      const alarm = yield* DurableAlarmService;\n      const config = yield* CloudflareDurableRuntimeConfig;\n      const { ctx } = yield* DurableObjectContext;\n      const failpoint = yield* ThreadMaintenanceFailpoint;\n\n      /**\n       * Consecutive no-progress passes — an in-memory CACHE, not state: a fresh incarnation\n       * restarts at zero and merely re-arms sooner than a long-lived one would have.\n       */\n      const stalls = yield* Ref.make(0);\n      const mutations = yield* ThreadMutationGate;\n      const publication = yield* ThreadPublication;\n      const projection = yield* ThreadProjectionMaintenance;\n      const messages = yield* ThreadMessageDelivery;\n      const host = yield* ThreadHostMaintenance;\n\n      // A broken disposable index still needs a retry alarm and must not prevent startup.\n      const projectionDeadline = projection.pendingDeadline.pipe(\n        Effect.catchCause((cause) =>\n          Cause.hasInterrupts(cause)\n            ? Effect.failCause(cause)\n            : Effect.logError(\"Thread projection deadline unavailable\", cause).pipe(\n                Effect.as(Option.some(0)),\n              ),\n        ),\n      );\n\n      const pendingDeadline = Effect.gen(function* () {\n        return earliestDeadline(\n          earliestDeadline(yield* publication.pendingDeadline, yield* messages.pendingDeadline),\n          earliestDeadline(yield* projectionDeadline, yield* host.pendingDeadline),\n        );\n      });\n\n      const maintenancePassGate = yield* Semaphore.make(1);\n      const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));\n\n      const runTransaction = <A>(operation: string, transaction: () => Promise<A>) =>\n        Effect.tryPromise({ try: transaction, catch: alarmFailure(operation) });\n\n      const ensureAlarm = Effect.fn(\"ThreadMaintenance.ensureAlarm\")(function* () {\n        yield* failpoint.hit(\"maintenance:ensure:before\");\n        const now = yield* Clock.currentTimeMillis;\n\n        yield* runTransaction(\"ensure maintenance alarm\", () =>\n          ctx.storage.transaction(async (transaction) => {\n            const { state, initialized } = await readMaintenanceState(transaction);\n\n            if (!initialized) {\n              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));\n            }\n            if (state.dirty > state.processed) {\n              await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);\n            }\n          }),\n        );\n        const deadline = yield* pendingDeadline;\n\n        if (Option.isSome(deadline)) {\n          yield* runTransaction(\"ensure publication alarm\", () =>\n            ctx.storage.transaction((transaction) =>\n              ensureTransactionAlarmBy(\n                transaction,\n                Math.max(now + minimumAlarmDelay, deadline.value),\n              ),\n            ),\n          );\n        }\n        yield* failpoint.hit(\"maintenance:ensure:after\");\n      });\n\n      const beginPass = Effect.fn(\"ThreadMaintenance.beginPass\")(function* () {\n        yield* failpoint.hit(\"maintenance:begin:before\");\n        const now = yield* Clock.currentTimeMillis;\n\n        const result = yield* runTransaction(\"begin maintenance pass\", () =>\n          ctx.storage.transaction(async (transaction) => {\n            const { state, initialized } = await readMaintenanceState(transaction);\n\n            if (!initialized) {\n              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));\n            }\n            if (state.processed >= state.dirty) {\n              // Prearm even a publication-only pass before invoking any host hook.\n              await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);\n\n              return { _tag: \"CaughtUp\" as const, nonterminal: state.nonterminal };\n            }\n            // Pre-arm the earliest retry before recovery. A successful finish may move this slot\n            // LATER to its bounded backoff, which does not cancel the running handler.\n            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);\n\n            return {\n              _tag: \"Actionable\" as const,\n              generation: state.dirty,\n              nonterminal: state.nonterminal,\n            };\n          }),\n        );\n\n        yield* failpoint.hit(\"maintenance:begin:after\");\n\n        return result;\n      });\n\n      const rearmDelay = Effect.fn(\"ThreadMaintenance.rearmDelay\")(function* (progressed: boolean) {\n        const priorStalls = yield* Ref.getAndUpdate(stalls, (count) =>\n          progressed ? 0 : count + 1,\n        );\n\n        if (progressed) return config.alarmBackoffBase;\n        const exponent = Math.min(priorStalls, 30);\n        const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** exponent);\n        const jitter = yield* Random.next;\n        // Full jitter over [backoff/2, backoff]: desynchronizes retry storms without ever\n        // waiting longer than the deterministic bound.\n        const jittered = Math.ceil(backoff / 2 + (backoff / 2) * jitter);\n\n        return Math.min(jittered, config.wakeScanInterval);\n      });\n\n      const pass = Effect.fn(\"ThreadMaintenance.pass\")(function* (\n        yieldAfter: DateTime.Utc,\n      ): Effect.fn.Return<MaintenancePassReport, MaintenancePassFailure> {\n        const annotate = (report: MaintenancePassReport) =>\n          Effect.annotateCurrentSpan({\n            phase: report.phase,\n            recovered: report.recovered,\n            settled: report.settled,\n            nonterminal: report.nonterminal,\n            alarm: report.alarm,\n          }).pipe(Effect.as(report));\n\n        const started = yield* mutations.withSnapshot((activeAtStart) =>\n          Effect.gen(function* () {\n            const generation = yield* beginPass();\n\n            if (generation._tag === \"Actionable\" && activeAtStart === 0) {\n              // The gate excludes a producer starting between the snapshot and certification.\n              yield* publication.prepareGeneration(generation.generation);\n            }\n\n            return { ...generation, activeAtStart };\n          }),\n        );\n\n        // Deliver beside source work, including messages inserted by the running Attempt.\n        // Slow destination RPCs never consume the source execution window. Stop starting\n        // waves when source work ends, then join the bounded current wave before acknowledgement.\n        const deliveryFinished = yield* Deferred.make<void>();\n\n        const delivery = yield* Effect.forkChild(\n          messages.drainUntil?.(deliveryFinished) ?? messages.drain,\n        );\n\n        const hostWork = yield* Effect.forkChild(host.drainUntil(deliveryFinished));\n\n        const finishDelivery = Deferred.succeed(deliveryFinished, undefined).pipe(\n          Effect.andThen(Fiber.awaitAll([delivery, hostWork])),\n          Effect.flatMap((outcomes) =>\n            Effect.forEach(outcomes, (outcome) => outcome, { discard: true }),\n          ),\n        );\n\n        // Capture derived-index failures until canonical work has had its turn. Interruption\n        // still stops the event; ordinary failures and defects retain the prearmed generation.\n        const projected = yield* Effect.exit(\n          drainDue.pipe(Effect.provideService(ThreadProjectionMaintenance, projection)),\n        );\n\n        if (Exit.isFailure(projected) && Cause.hasInterrupts(projected.cause))\n          return yield* Effect.failCause(projected.cause);\n        const deadline = yield* publication.pendingDeadline;\n\n        if (\n          started._tag === \"Actionable\" ||\n          (Option.isSome(deadline) && deadline.value <= (yield* Clock.currentTimeMillis))\n        ) {\n          yield* publication.drain;\n        }\n        const pending = yield* publication.pendingDeadline;\n\n        if (started._tag === \"CaughtUp\" || Option.isSome(pending)) {\n          yield* finishDelivery;\n          if (Exit.isFailure(projected)) return yield* Effect.failCause(projected.cause);\n          yield* failpoint.hit(\"maintenance:finish:before\");\n\n          const disposition = yield* mutations.withSnapshot((active) =>\n            Effect.gen(function* () {\n              // Re-read under the producer gate: a concurrent append/host mutation cannot be\n              // cleared using a stale empty deadline. Dirty generations bound all producer races.\n              const latest = yield* pendingDeadline;\n              const now = yield* Clock.currentTimeMillis;\n\n              return yield* runTransaction(\"finish publication pass\", () =>\n                ctx.storage.transaction(async (transaction) => {\n                  const { state } = await readMaintenanceState(transaction);\n\n                  const nativeDeadline =\n                    active > 0 || state.dirty > state.processed\n                      ? now + config.wakeScanInterval\n                      : Infinity;\n\n                  const next = Option.isSome(latest)\n                    ? Math.min(nativeDeadline, latest.value)\n                    : nativeDeadline;\n\n                  if (Number.isFinite(next)) {\n                    await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next));\n\n                    return \"rearmed\" as const;\n                  }\n                  await transaction.deleteAlarm();\n\n                  return \"cleared\" as const;\n                }),\n              );\n            }),\n          );\n\n          yield* failpoint.hit(\"maintenance:finish:after\");\n\n          return yield* annotate(\n            MaintenancePassReport.make({\n              phase: \"caught-up\",\n              recovered: 0,\n              settled: 0,\n              nonterminal: started.nonterminal,\n              alarm: disposition,\n            }),\n          );\n        }\n        // Step 2 — reconciliation strictly precedes new work in this pass (exit gate).\n        const recovered: ReadonlyArray<RecoveryReport> = yield* runtime.runRecovery;\n        const reports = new Map(recovered.map((report) => [report.submissionId, report]));\n        const current = yield* Stream.runCollect(ledger.scanNonterminal);\n        const heads = new Map<ThreadId, SubmissionSnapshot>();\n\n        for (const row of current) {\n          if (!heads.has(row.threadId)) heads.set(row.threadId, row);\n        }\n\n        const eligible = [...heads.values()]\n          .filter((head) => !stableExternalWait(head, reports))\n          .map((head) => head.threadId)\n          .sort();\n\n        let selected = eligible[0];\n\n        if (heads.size > 1 && selected !== undefined) {\n          yield* failpoint.hit(\"maintenance:select:before\");\n          selected = yield* runTransaction(\"select maintenance lane\", () =>\n            ctx.storage.transaction(async (transaction) => {\n              const { state } = await readMaintenanceState(transaction);\n\n              const next =\n                eligible.find(\n                  (threadId) =>\n                    state.lastServedThreadId === undefined || threadId > state.lastServedThreadId,\n                ) ?? eligible[0];\n\n              if (next !== undefined) {\n                // Persist before the Attempt so an eviction or repeated yield cannot\n                // monopolize the first lane. The generation and prearmed alarm survive.\n                await transaction.put(\n                  MAINTENANCE_STATE_KEY,\n                  encodeMaintenanceState(\n                    ThreadMaintenanceState.make({ ...state, lastServedThreadId: next }),\n                  ),\n                );\n              }\n\n              return next;\n            }),\n          );\n          yield* failpoint.hit(\"maintenance:select:after\");\n        }\n\n        // One FIFO head per event, across all local lanes. The runtime keeps its normal\n        // bounded Attempt and recovery contracts; followers belong to another alarm.\n        const settlement =\n          selected === undefined\n            ? Option.none()\n            : yield* runtime.processThreadHead(selected, { yieldAfter });\n\n        yield* finishDelivery;\n        if (Exit.isFailure(projected)) return yield* Effect.failCause(projected.cause);\n        // Observe residual state before acknowledging this exact pass-start generation.\n        const remaining = yield* Stream.runCollect(ledger.scanNonterminal);\n        const waitingHeads = new Map<ThreadId, boolean>();\n\n        const autonomous = remaining.some((snapshot) => {\n          const headWaiting = waitingHeads.get(snapshot.threadId);\n\n          if (headWaiting === undefined)\n            waitingHeads.set(snapshot.threadId, stableExternalWait(snapshot, reports));\n          // FIFO followers cannot execute through a stable external wait. Only plain queued\n          // input is dormant here; admission repairs and accepted aborts still need a pass.\n          if (\n            headWaiting === true &&\n            snapshot.state === \"ready\" &&\n            reports.get(snapshot.submissionId)?.decision._tag === \"ApplyInput\"\n          )\n            return false;\n\n          return !stableExternalWait(snapshot, reports);\n        });\n\n        const progressed =\n          Option.isSome(settlement) ||\n          recovered.some((report) => report.disposition === \"repaired\");\n\n        const delay = autonomous ? yield* rearmDelay(progressed) : 0;\n        const now = yield* Clock.currentTimeMillis;\n\n        yield* failpoint.hit(\"maintenance:finish:before\");\n\n        const alarmDisposition = yield* mutations.withSnapshot((active) =>\n          Effect.gen(function* () {\n            const publicationDeadline = yield* pendingDeadline;\n\n            return yield* runTransaction(\"finish maintenance pass\", () =>\n              ctx.storage.transaction(async (transaction) => {\n                const { state } = await readMaintenanceState(transaction);\n\n                // Autonomous work and in-flight mutations intentionally leave the observed\n                // generation dirty. Otherwise acknowledge only the pass-start generation.\n                const processed =\n                  autonomous || started.activeAtStart > 0 || active > 0\n                    ? state.processed\n                    : state.processed > started.generation\n                      ? state.processed\n                      : started.generation;\n\n                const next = ThreadMaintenanceState.make({\n                  ...state,\n                  processed,\n                  nonterminal: remaining.length,\n                });\n\n                await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));\n                if (autonomous) {\n                  // Replace the crash-fallback slot with this pass's bounded backoff. The target\n                  // is never earlier than the begin-pass fallback, so workerd does not cancel\n                  // this running alarm handler before its report/span can complete.\n                  await transaction.setAlarm(\n                    Option.isSome(publicationDeadline)\n                      ? Math.max(\n                          now + minimumAlarmDelay,\n                          Math.min(now + delay, publicationDeadline.value),\n                        )\n                      : now + delay,\n                  );\n\n                  return \"rearmed\" as const;\n                }\n                if (started.activeAtStart > 0 || active > 0 || next.dirty > next.processed) {\n                  // A mutation overlapped this pass's observation window or raced\n                  // acknowledgement. It stays dirty and its pre-armed bounded alarm survives;\n                  // unseen effects are never acknowledged. Do not accelerate that future alarm\n                  // from inside the current handler: workerd cancels a running handler when it\n                  // writes an earlier slot.\n                  await ensureTransactionAlarmBy(\n                    transaction,\n                    Option.isSome(publicationDeadline)\n                      ? Math.max(\n                          now + minimumAlarmDelay,\n                          Math.min(now + config.wakeScanInterval, publicationDeadline.value),\n                        )\n                      : now + config.wakeScanInterval,\n                  );\n\n                  return \"rearmed\" as const;\n                }\n                if (Option.isSome(publicationDeadline)) {\n                  await transaction.setAlarm(\n                    Math.max(now + minimumAlarmDelay, publicationDeadline.value),\n                  );\n\n                  return \"rearmed\" as const;\n                }\n                await transaction.deleteAlarm();\n\n                return \"cleared\" as const;\n              }),\n            );\n          }),\n        );\n\n        yield* failpoint.hit(\"maintenance:finish:after\");\n        if (alarmDisposition === \"cleared\") {\n          yield* Ref.set(stalls, 0);\n        }\n\n        return yield* annotate(\n          MaintenancePassReport.make({\n            phase: \"actionable\",\n            recovered: recovered.length,\n            settled: Option.isSome(settlement) ? 1 : 0,\n            nonterminal: remaining.length,\n            alarm: alarmDisposition,\n          }),\n        );\n      });\n\n      return ThreadMaintenance.of({\n        // A mid-pass immediate hint is droppable; durable dirty state decides the final alarm.\n        pass: Effect.gen(function* () {\n          const yieldAfter = DateTime.makeUnsafe((yield* Clock.currentTimeMillis) + 10 * 60_000);\n\n          return yield* alarm.withWakesDeferred(maintenancePassGate.withPermit(pass(yieldAfter)));\n        }).pipe(\n          // Include permit waiting, recovery and acknowledgement in the event deadline.\n          // Interruption releases Attempt ownership, leaving the prearmed dirty generation\n          // for recovery. It never changes the logical Run duration or settles a policy failure.\n          // This cooperative timer cannot preempt synchronous CPU work or stuck finalizers.\n          Effect.timeoutOrElse({\n            duration: \"14 minutes\",\n            orElse: () =>\n              DurableAlarmError.make({\n                operation: \"maintenance pass deadline\",\n                message:\n                  \"The maintenance event exceeded its 14 minute deadline; durable recovery remains pending\",\n              }),\n          }),\n        ),\n        ensureAlarm: mutations.withSnapshot(() => ensureAlarm()),\n        withMutation: (body) =>\n          mutations.withMutation(\n            body.pipe(\n              Effect.tap(() =>\n                publishCommitted.pipe(Effect.provideService(ThreadPublication, publication)),\n              ),\n            ),\n          ),\n      });\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,IAAa,oBAAb,cAAuC,OAAO,YAA+B,CAAC,CAC5E,qBACA;CACE,WAAW,OAAO;CAClB,SAAS,OAAO;CAChB,OAAO,OAAO,YAAY,OAAO,OAAO,CAAC;AAC3C,CACF,CAAC,CAAC,CAAC;AAEH,MAAM,gBACH,eACA,UACC,kBAAkB,KAAK;CACrB;CACA,SAAS,iBAAiB,OAAO,sDAAsD;CACvF;AACF,CAAC;;AAGL,IAAa,sBAAb,MAAa,4BAA4B,QAAQ,QA+B/C,CAAC,CAAC,uDAAuD,CAAC,CAAC;CAC3D,OAAgB,QACd,MAAM,OAAO,mBAAmB,CAAC,CAC/B,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,QAAQ,OAAO;;;;;;EAMvB,MAAM,gBAAgB,OAAO,IAAI,KAAK,CAAC;EAEvC,MAAM,YAAY,OAAO,WAAW;GAClC,WAAW,IAAI,QAAQ,SAAS;GAChC,OAAO,aAAa,WAAW;EACjC,CAAC,CAAC,CAAC,KACD,OAAO,KAAK,aACV,aAAa,OAAO,OAAO,KAAa,IAAI,OAAO,KAAK,QAAQ,CAClE,CACF;EAEA,MAAM,cAAc,gBAClB,OAAO,WAAW;GAChB,WAAW,IAAI,QAAQ,SAAS,WAAW;GAC3C,OAAO,aAAa,WAAW;EACjC,CAAC;EAEH,MAAM,qBAAqB,gBACzB,UAAU,KACR,OAAO,SAAS,aACd,OAAO,OAAO,QAAQ,KAAK,SAAS,SAAS,cACzC,OAAO,OACP,WAAW,WAAW,CAC5B,CACF;EAEF,MAAM,SAAS,MAAM,kBAAkB,KACrC,OAAO,SAAS,QAAQ,kBAAkB,GAAG,CAAC,CAChD;EAEA,MAAM,cAAc,IAAI,IAAI,aAAa,CAAC,CAAC,KACzC,OAAO,SAAS,WAAY,SAAS,IAAI,OAAO,OAAO,MAAO,CAChE;EAEA,MAAM,qBAA8B,SAClC,IAAI,OAAO,gBAAgB,WAAW,SAAS,CAAC,CAAC,CAAC,KAChD,OAAO,QAAQ,IAAI,GACnB,OAAO,SAAS,IAAI,OAAO,gBAAgB,WAAW,SAAS,CAAC,CAAC,CACnE;EAEF,MAAM,SAAS,OAAO,WAAW;GAC/B,WAAW,IAAI,QAAQ,YAAY;GACnC,OAAO,aAAa,cAAc;EACpC,CAAC;EAED,OAAO,oBAAoB,GAAG;GAC5B;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,CAAC,CACH;AACJ;;AAGA,IAAa,wBAAb,cAA2C,OAAO,MAChD,yDACF,CAAC,CAAC;;CAEA,OAAO,OAAO,SAAS,CAAC,aAAa,YAAY,CAAC;;CAElD,WAAW,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;CAE5D,SAAS,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;CAE1D,aAAa,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;CAE9D,OAAO,OAAO,SAAS,CAAC,WAAW,SAAS,CAAC;AAC/C,CAAC,CAAC,CAAC,CAAC;;AAsBJ,IAAa,6BAAb,cAAgD,QAAQ,QAKtD,CAAC,CAAC,8DAA8D,CAAC,CAAC;CAClE,OAAgB,QAAQ,MAAM,QAAQ,IAAI,CAAC,CAAC,EAAE,WAAW,OAAO,KAAK,CAAC;AACxE;;AAwBA,IAAa,oBAAb,cAAuC,QAAQ,QAG7C,CAAC,CAAC,qDAAqD,CAAC,CAAC;CACzD,OAAgB,QAAQ,MAAM,QAAQ,IAAI,CAAC,CAAC;EAC1C,YAAY,OAAO;EACnB,yBAAyB,OAAO;EAChC,OAAO,OAAO;EACd,iBAAiB,OAAO,QAAQ,OAAO,KAAK,CAAC;CAC/C,CAAC;AACH;;;;;;AAOA,MAAa,wBAAwB,QAAQ,UAO1C,2DAA2D,EAC5D,qBAAqB;CAAE,OAAO,OAAO;CAAM,iBAAiB,OAAO,QAAQ,OAAO,KAAK,CAAC;AAAE,GAC5F,CAAC;;;;;;;;;AAUD,MAAa,wBAAwB,QAAQ,UAK1C,2DAA2D,EAC5D,qBAAqB;CACnB,iBAAiB,OAAO,QAAQ,OAAO,KAAK,CAAC;CAC7C,kBAAkB,OAAO;AAC3B,GACF,CAAC;AAED,MAAM,oBACJ,MACA,UAEA,OAAO,OAAO,IAAI,IACd,OAAO,OAAO,KAAK,IACjB,OAAO,KAAK,KAAK,IAAI,KAAK,OAAO,MAAM,KAAK,CAAC,IAC7C,OACF;;AAGN,MAAa,mBAAmB,OAAO,IAAI,aAAa;CACtD,MAAM,cAAc,OAAO;CAE3B,OAAO,YAAY,WAAW,KAAK,OAAO,QAAQ,YAAY,KAAK,CAAC;AACtE,CAAC,CAAC,CAAC,KACD,OAAO,YAAY,UACjB,MAAM,cAAc,KAAK,IACrB,OAAO,YACP,OAAO,SAAS,mDAAmD,KAAK,CAC9E,CACF;AAEA,MAAM,wBAAwB,OAAO,iBAAiB,MACpD,OAAO,6BAA6B,EAAE,CACxC;;AAGA,IAAM,yBAAN,cAAqC,OAAO,MAC1C,0DACF,CAAC,CAAC;CACA,eAAe,OAAO,QAAQ,CAAC;CAC/B,OAAO;CACP,WAAW;CACX,aAAa,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;CAE9D,oBAAoB,OAAO,YAAY,QAAQ;AACjD,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,wBAAwB;AAC9B,MAAM,yBAAyB,OAAO,kBAAkB,sBAAsB;AAC9E,MAAM,yBAAyB,OAAO,WAAW,sBAAsB;AAEvE,MAAM,gCACJ,uBAAuB,KAAK;CAC1B,eAAe;CAGf,OAAO;CACP,WAAW;CACX,aAAa;AACf,CAAC;AAEH,MAAM,uBAAuB,OAC3B,gBACuF;CACvF,MAAM,UAAU,MAAM,YAAY,IAAI,qBAAqB;CAE3D,OAAO,YAAY,KAAA,IACf;EAAE,OAAO,wBAAwB;EAAG,aAAa;CAAM,IACvD;EAAE,OAAO,uBAAuB,OAAO;EAAG,aAAa;CAAK;AAClE;AAEA,MAAM,2BAA2B,OAC/B,aACA,aACkB;CAClB,MAAM,YAAY,MAAM,YAAY,SAAS;CAE7C,IAAI,cAAc,QAAQ,YAAY,UACpC,MAAM,YAAY,SAAS,QAAQ;AAEvC;AAEA,MAAM,sBACJ,UACA,YACY;CACZ,MAAM,WAAW,QAAQ,IAAI,SAAS,YAAY,CAAC,EAAE,SAAS;CAG9D,IAAI,aAAa,iBAAiB,OAAO;CACzC,QAAQ,SAAS,OAAjB;EACE,KAAK;EACL,KAAK,UACH,OAAO;EACT,KAAK,WACH,OAAO,aAAa,4BAA4B,aAAa;EAC/D,KAAK,YACH,OAAO,QAAQ,IAAI,SAAS,YAAY,CAAC,EAAE,SAAS,SAAS;EAC/D,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,iBACH,OAAO;CACX;AACF;;;;;;AAOA,IAAa,qBAAb,MAAa,2BAA2B,QAAQ,QAU9C,CAAC,CAAC,+DAA+D,CAAC,CAAC;CACnE,OAAgB,QAAQ,MAAM,OAAO,IAAI,CAAC,CACxC,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,QAAQ,OAAO;EACvB,MAAM,SAAS,OAAO;EACtB,MAAM,YAAY,OAAO;EAEzB,MAAM,kBAAkB,OAAO,IAAI,KAAK,CAAC;EACzC,MAAM,iBAAiB,OAAO,UAAU,KAAK,CAAC;EAC9C,MAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,mBAAmB,CAAC,CAAC;EAE5E,MAAM,kBAAqB,WAAmB,gBAC5C,OAAO,WAAW;GAAE,KAAK;GAAa,OAAO,aAAa,SAAS;EAAE,CAAC;EAExE,MAAM,gBAAgB,OAAO,GAAG,iCAAiC,CAAC,CAAC,aAAa;GAC9E,OAAO,UAAU,IAAI,0BAA0B;GAC/C,MAAM,MAAM,OAAO,MAAM;GAEzB,OAAO,eAAe,wCACpB,IAAI,QAAQ,YAAY,OAAO,gBAAgB;IAC7C,MAAM,EAAE,UAAU,MAAM,qBAAqB,WAAW;IAExD,MAAM,OAAO,uBAAuB,KAAK;KACvC,GAAG;KACH,OAAO,MAAM,QAAQ;IACvB,CAAC;IAED,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,IAAI,CAAC;IAGzE,MAAM,yBAAyB,aAAa,MAAM,iBAAiB;GACrE,CAAC,CACH;GACA,OAAO,UAAU,IAAI,yBAAyB;GAC9C,OAAO,IAAI,OAAO,kBAAkB,WAAW,SAAS,CAAC;EAC3D,CAAC;EAED,MAAM,cAAc,eAAe,WACjC,IAAI,OAAO,kBAAkB,WAAW,KAAK,IAAI,GAAG,SAAS,CAAC,CAAC,CACjE;EAEA,MAAM,gBACJ,SAEA,OAAO,kBACL,eAAe,WAAW,cAAc,CAAC,SAEvC,UAAU,IAAI,4BAA4B,CAAC,CAAC,KAC1C,OAAO,QAAQ,IAAI,GACnB,OAAO,UAAU,UAAU,IAAI,+BAA+B,CAAC,CACjE,SACI,WACR;EAEF,OAAO,mBAAmB,GAAG;GAC3B;GACA,eAAe,SACb,eAAe,WAAW,OAAO,QAAQ,IAAI,IAAI,eAAe,GAAG,IAAI,CAAC;EAC5E,CAAC;CACH,CAAC,CACH;AACF;;;;;;;;;;;;;;;AAsBA,IAAa,oBAAb,MAAa,0BAA0B,QAAQ,QAmB7C,CAAC,CAAC,qDAAqD,CAAC,CAAC;CACzD,OAAgB,QAYZ,MAAM,OAAO,iBAAiB,CAAC,CACjC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,OAAO;EACtB,MAAM,EAAE,QAAQ,OAAO;EACvB,MAAM,YAAY,OAAO;;;;;EAMzB,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;EAChC,MAAM,YAAY,OAAO;EACzB,MAAM,cAAc,OAAO;EAC3B,MAAM,aAAa,OAAO;EAC1B,MAAM,WAAW,OAAO;EACxB,MAAM,OAAO,OAAO;EAGpB,MAAM,qBAAqB,WAAW,gBAAgB,KACpD,OAAO,YAAY,UACjB,MAAM,cAAc,KAAK,IACrB,OAAO,UAAU,KAAK,IACtB,OAAO,SAAS,0CAA0C,KAAK,CAAC,CAAC,KAC/D,OAAO,GAAG,OAAO,KAAK,CAAC,CAAC,CAC1B,CACN,CACF;EAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;GAC9C,OAAO,iBACL,iBAAiB,OAAO,YAAY,iBAAiB,OAAO,SAAS,eAAe,GACpF,iBAAiB,OAAO,oBAAoB,OAAO,KAAK,eAAe,CACzE;EACF,CAAC;EAED,MAAM,sBAAsB,OAAO,UAAU,KAAK,CAAC;EACnD,MAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,mBAAmB,CAAC,CAAC;EAE5E,MAAM,kBAAqB,WAAmB,gBAC5C,OAAO,WAAW;GAAE,KAAK;GAAa,OAAO,aAAa,SAAS;EAAE,CAAC;EAExE,MAAM,cAAc,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;GAC1E,OAAO,UAAU,IAAI,2BAA2B;GAChD,MAAM,MAAM,OAAO,MAAM;GAEzB,OAAO,eAAe,kCACpB,IAAI,QAAQ,YAAY,OAAO,gBAAgB;IAC7C,MAAM,EAAE,OAAO,gBAAgB,MAAM,qBAAqB,WAAW;IAErE,IAAI,CAAC,aACH,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,KAAK,CAAC;IAE5E,IAAI,MAAM,QAAQ,MAAM,WACtB,MAAM,yBAAyB,aAAa,MAAM,OAAO,gBAAgB;GAE7E,CAAC,CACH;GACA,MAAM,WAAW,OAAO;GAExB,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,eAAe,kCACpB,IAAI,QAAQ,aAAa,gBACvB,yBACE,aACA,KAAK,IAAI,MAAM,mBAAmB,SAAS,KAAK,CAClD,CACF,CACF;GAEF,OAAO,UAAU,IAAI,0BAA0B;EACjD,CAAC;EAED,MAAM,YAAY,OAAO,GAAG,6BAA6B,CAAC,CAAC,aAAa;GACtE,OAAO,UAAU,IAAI,0BAA0B;GAC/C,MAAM,MAAM,OAAO,MAAM;GAEzB,MAAM,SAAS,OAAO,eAAe,gCACnC,IAAI,QAAQ,YAAY,OAAO,gBAAgB;IAC7C,MAAM,EAAE,OAAO,gBAAgB,MAAM,qBAAqB,WAAW;IAErE,IAAI,CAAC,aACH,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,KAAK,CAAC;IAE5E,IAAI,MAAM,aAAa,MAAM,OAAO;KAElC,MAAM,yBAAyB,aAAa,MAAM,iBAAiB;KAEnE,OAAO;MAAE,MAAM;MAAqB,aAAa,MAAM;KAAY;IACrE;IAGA,MAAM,yBAAyB,aAAa,MAAM,iBAAiB;IAEnE,OAAO;KACL,MAAM;KACN,YAAY,MAAM;KAClB,aAAa,MAAM;IACrB;GACF,CAAC,CACH;GAEA,OAAO,UAAU,IAAI,yBAAyB;GAE9C,OAAO;EACT,CAAC;EAED,MAAM,aAAa,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,YAAqB;GAC3F,MAAM,cAAc,OAAO,IAAI,aAAa,SAAS,UACnD,aAAa,IAAI,QAAQ,CAC3B;GAEA,IAAI,YAAY,OAAO,OAAO;GAC9B,MAAM,WAAW,KAAK,IAAI,aAAa,EAAE;GACzC,MAAM,UAAU,KAAK,IAAI,OAAO,iBAAiB,OAAO,mBAAmB,KAAK,QAAQ;GACxF,MAAM,SAAS,OAAO,OAAO;GAG7B,MAAM,WAAW,KAAK,KAAK,UAAU,IAAK,UAAU,IAAK,MAAM;GAE/D,OAAO,KAAK,IAAI,UAAU,OAAO,gBAAgB;EACnD,CAAC;EAED,MAAM,OAAO,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAC/C,YACiE;GACjE,MAAM,YAAY,WAChB,OAAO,oBAAoB;IACzB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,SAAS,OAAO;IAChB,aAAa,OAAO;IACpB,OAAO,OAAO;GAChB,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,MAAM,CAAC;GAE3B,MAAM,UAAU,OAAO,UAAU,cAAc,kBAC7C,OAAO,IAAI,aAAa;IACtB,MAAM,aAAa,OAAO,UAAU;IAEpC,IAAI,WAAW,SAAS,gBAAgB,kBAAkB,GAExD,OAAO,YAAY,kBAAkB,WAAW,UAAU;IAG5D,OAAO;KAAE,GAAG;KAAY;IAAc;GACxC,CAAC,CACH;GAKA,MAAM,mBAAmB,OAAO,SAAS,KAAW;GAEpD,MAAM,WAAW,OAAO,OAAO,UAC7B,SAAS,aAAa,gBAAgB,KAAK,SAAS,KACtD;GAEA,MAAM,WAAW,OAAO,OAAO,UAAU,KAAK,WAAW,gBAAgB,CAAC;GAE1E,MAAM,iBAAiB,SAAS,QAAQ,kBAAkB,KAAA,CAAS,CAAC,CAAC,KACnE,OAAO,QAAQ,MAAM,SAAS,CAAC,UAAU,QAAQ,CAAC,CAAC,GACnD,OAAO,SAAS,aACd,OAAO,QAAQ,WAAW,YAAY,SAAS,EAAE,SAAS,KAAK,CAAC,CAClE,CACF;GAIA,MAAM,YAAY,OAAO,OAAO,KAC9B,SAAS,KAAK,OAAO,eAAe,6BAA6B,UAAU,CAAC,CAC9E;GAEA,IAAI,KAAK,UAAU,SAAS,KAAK,MAAM,cAAc,UAAU,KAAK,GAClE,OAAO,OAAO,OAAO,UAAU,UAAU,KAAK;GAChD,MAAM,WAAW,OAAO,YAAY;GAEpC,IACE,QAAQ,SAAS,gBAChB,OAAO,OAAO,QAAQ,KAAK,SAAS,UAAU,OAAO,MAAM,oBAE5D,OAAO,YAAY;GAErB,MAAM,UAAU,OAAO,YAAY;GAEnC,IAAI,QAAQ,SAAS,cAAc,OAAO,OAAO,OAAO,GAAG;IACzD,OAAO;IACP,IAAI,KAAK,UAAU,SAAS,GAAG,OAAO,OAAO,OAAO,UAAU,UAAU,KAAK;IAC7E,OAAO,UAAU,IAAI,2BAA2B;IAEhD,MAAM,cAAc,OAAO,UAAU,cAAc,WACjD,OAAO,IAAI,aAAa;KAGtB,MAAM,SAAS,OAAO;KACtB,MAAM,MAAM,OAAO,MAAM;KAEzB,OAAO,OAAO,eAAe,iCAC3B,IAAI,QAAQ,YAAY,OAAO,gBAAgB;MAC7C,MAAM,EAAE,UAAU,MAAM,qBAAqB,WAAW;MAExD,MAAM,iBACJ,SAAS,KAAK,MAAM,QAAQ,MAAM,YAC9B,MAAM,OAAO,mBACb;MAEN,MAAM,OAAO,OAAO,OAAO,MAAM,IAC7B,KAAK,IAAI,gBAAgB,OAAO,KAAK,IACrC;MAEJ,IAAI,OAAO,SAAS,IAAI,GAAG;OACzB,MAAM,YAAY,SAAS,KAAK,IAAI,MAAM,mBAAmB,IAAI,CAAC;OAElE,OAAO;MACT;MACA,MAAM,YAAY,YAAY;MAE9B,OAAO;KACT,CAAC,CACH;IACF,CAAC,CACH;IAEA,OAAO,UAAU,IAAI,0BAA0B;IAE/C,OAAO,OAAO,SACZ,sBAAsB,KAAK;KACzB,OAAO;KACP,WAAW;KACX,SAAS;KACT,aAAa,QAAQ;KACrB,OAAO;IACT,CAAC,CACH;GACF;GAEA,MAAM,YAA2C,OAAO,QAAQ;GAChE,MAAM,UAAU,IAAI,IAAI,UAAU,KAAK,WAAW,CAAC,OAAO,cAAc,MAAM,CAAC,CAAC;GAChF,MAAM,UAAU,OAAO,OAAO,WAAW,OAAO,eAAe;GAC/D,MAAM,wBAAQ,IAAI,IAAkC;GAEpD,KAAK,MAAM,OAAO,SAChB,IAAI,CAAC,MAAM,IAAI,IAAI,QAAQ,GAAG,MAAM,IAAI,IAAI,UAAU,GAAG;GAG3D,MAAM,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CACjC,QAAQ,SAAS,CAAC,mBAAmB,MAAM,OAAO,CAAC,CAAC,CACpD,KAAK,SAAS,KAAK,QAAQ,CAAC,CAC5B,KAAK;GAER,IAAI,WAAW,SAAS;GAExB,IAAI,MAAM,OAAO,KAAK,aAAa,KAAA,GAAW;IAC5C,OAAO,UAAU,IAAI,2BAA2B;IAChD,WAAW,OAAO,eAAe,iCAC/B,IAAI,QAAQ,YAAY,OAAO,gBAAgB;KAC7C,MAAM,EAAE,UAAU,MAAM,qBAAqB,WAAW;KAExD,MAAM,OACJ,SAAS,MACN,aACC,MAAM,uBAAuB,KAAA,KAAa,WAAW,MAAM,kBAC/D,KAAK,SAAS;KAEhB,IAAI,SAAS,KAAA,GAGX,MAAM,YAAY,IAChB,uBACA,uBACE,uBAAuB,KAAK;MAAE,GAAG;MAAO,oBAAoB;KAAK,CAAC,CACpE,CACF;KAGF,OAAO;IACT,CAAC,CACH;IACA,OAAO,UAAU,IAAI,0BAA0B;GACjD;GAIA,MAAM,aACJ,aAAa,KAAA,IACT,OAAO,KAAK,IACZ,OAAO,QAAQ,kBAAkB,UAAU,EAAE,WAAW,CAAC;GAE/D,OAAO;GACP,IAAI,KAAK,UAAU,SAAS,GAAG,OAAO,OAAO,OAAO,UAAU,UAAU,KAAK;GAE7E,MAAM,YAAY,OAAO,OAAO,WAAW,OAAO,eAAe;GACjE,MAAM,+BAAe,IAAI,IAAuB;GAEhD,MAAM,aAAa,UAAU,MAAM,aAAa;IAC9C,MAAM,cAAc,aAAa,IAAI,SAAS,QAAQ;IAEtD,IAAI,gBAAgB,KAAA,GAClB,aAAa,IAAI,SAAS,UAAU,mBAAmB,UAAU,OAAO,CAAC;IAG3E,IACE,gBAAgB,QAChB,SAAS,UAAU,WACnB,QAAQ,IAAI,SAAS,YAAY,CAAC,EAAE,SAAS,SAAS,cAEtD,OAAO;IAET,OAAO,CAAC,mBAAmB,UAAU,OAAO;GAC9C,CAAC;GAED,MAAM,aACJ,OAAO,OAAO,UAAU,KACxB,UAAU,MAAM,WAAW,OAAO,gBAAgB,UAAU;GAE9D,MAAM,QAAQ,aAAa,OAAO,WAAW,UAAU,IAAI;GAC3D,MAAM,MAAM,OAAO,MAAM;GAEzB,OAAO,UAAU,IAAI,2BAA2B;GAEhD,MAAM,mBAAmB,OAAO,UAAU,cAAc,WACtD,OAAO,IAAI,aAAa;IACtB,MAAM,sBAAsB,OAAO;IAEnC,OAAO,OAAO,eAAe,iCAC3B,IAAI,QAAQ,YAAY,OAAO,gBAAgB;KAC7C,MAAM,EAAE,UAAU,MAAM,qBAAqB,WAAW;KAIxD,MAAM,YACJ,cAAc,QAAQ,gBAAgB,KAAK,SAAS,IAChD,MAAM,YACN,MAAM,YAAY,QAAQ,aACxB,MAAM,YACN,QAAQ;KAEhB,MAAM,OAAO,uBAAuB,KAAK;MACvC,GAAG;MACH;MACA,aAAa,UAAU;KACzB,CAAC;KAED,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,IAAI,CAAC;KACzE,IAAI,YAAY;MAId,MAAM,YAAY,SAChB,OAAO,OAAO,mBAAmB,IAC7B,KAAK,IACH,MAAM,mBACN,KAAK,IAAI,MAAM,OAAO,oBAAoB,KAAK,CACjD,IACA,MAAM,KACZ;MAEA,OAAO;KACT;KACA,IAAI,QAAQ,gBAAgB,KAAK,SAAS,KAAK,KAAK,QAAQ,KAAK,WAAW;MAM1E,MAAM,yBACJ,aACA,OAAO,OAAO,mBAAmB,IAC7B,KAAK,IACH,MAAM,mBACN,KAAK,IAAI,MAAM,OAAO,kBAAkB,oBAAoB,KAAK,CACnE,IACA,MAAM,OAAO,gBACnB;MAEA,OAAO;KACT;KACA,IAAI,OAAO,OAAO,mBAAmB,GAAG;MACtC,MAAM,YAAY,SAChB,KAAK,IAAI,MAAM,mBAAmB,oBAAoB,KAAK,CAC7D;MAEA,OAAO;KACT;KACA,MAAM,YAAY,YAAY;KAE9B,OAAO;IACT,CAAC,CACH;GACF,CAAC,CACH;GAEA,OAAO,UAAU,IAAI,0BAA0B;GAC/C,IAAI,qBAAqB,WACvB,OAAO,IAAI,IAAI,QAAQ,CAAC;GAG1B,OAAO,OAAO,SACZ,sBAAsB,KAAK;IACzB,OAAO;IACP,WAAW,UAAU;IACrB,SAAS,OAAO,OAAO,UAAU,IAAI,IAAI;IACzC,aAAa,UAAU;IACvB,OAAO;GACT,CAAC,CACH;EACF,CAAC;EAED,OAAO,kBAAkB,GAAG;GAE1B,MAAM,OAAO,IAAI,aAAa;IAC5B,MAAM,aAAa,SAAS,YAAY,OAAO,MAAM,qBAAqB,GAAW;IAErF,OAAO,OAAO,MAAM,kBAAkB,oBAAoB,WAAW,KAAK,UAAU,CAAC,CAAC;GACxF,CAAC,CAAC,CAAC,KAKD,OAAO,cAAc;IACnB,UAAU;IACV,cACE,kBAAkB,KAAK;KACrB,WAAW;KACX,SACE;IACJ,CAAC;GACL,CAAC,CACH;GACA,aAAa,UAAU,mBAAmB,YAAY,CAAC;GACvD,eAAe,SACb,UAAU,aACR,KAAK,KACH,OAAO,UACL,iBAAiB,KAAK,OAAO,eAAe,mBAAmB,WAAW,CAAC,CAC7E,CACF,CACF;EACJ,CAAC;CACH,CAAC,CACH;AACF"}

package/dist/CloudflareBindings.d.mts

@@ -1,8 +1,8 @@
-import { Context, Effect, Layer, Schema } from "effect";
 import { ThreadId } from "@effect-agent/core/Identifiers";
+import { Context, Effect, Layer, Schema } from "effect";
 import { ProducerId } from "@effect-agent/thread/Records";
 declare namespace CloudflareBindings_d_exports {
-  export { CloudflareBindingError, DurableObjectContext, ThreadObjectIdentity, ThreadObjectNamespace, ThreadObjectRpc, threadNamespaceFromEnv, threadNamespaceLayer };
+  export { CloudflareBindingError, DurableObjectContext, ThreadObjectClient, ThreadObjectIdentity, ThreadObjectNamespace, ThreadObjectPlacement, ThreadObjectRpc, threadNamespaceFromEnv, threadNamespaceLayer };
 }
 declare const CloudflareBindingError_base: Schema.Class<CloudflareBindingError, Schema.TaggedStruct<"CloudflareBindingError", {
   readonly binding: Schema.String;
@@ -49,15 +49,17 @@ interface ThreadObjectRpc extends Rpc.DurableObjectBranded {
   /** Droppable liveness hint from another Object: arms an immediate alarm. */
   wake(): Promise<void>;
 }
+/** A logical Thread endpoint may be bound to an application Object without forging its brand. */
+type ThreadObjectClient = Omit<ThreadObjectRpc, keyof Rpc.DurableObjectBranded>;
 declare const ThreadObjectNamespace_base: Context.ServiceClass<ThreadObjectNamespace, "@effect-agent/platform-cloudflare/ThreadObjectNamespace", {
-  readonly namespace: DurableObjectNamespace<ThreadObjectRpc>;
+  readonly get: (threadId: ThreadId) => ThreadObjectClient;
   /** Stable binding name for opted-in native RPC tracing; absent by default. */
   readonly rpcTracing?: string;
 }>;
 /**
- * The `DurableObjectNamespace` binding that addresses Thread Objects. The Object
- * identity rule is `namespace.idFromName(threadId)` (plan §1.2): Thread IDs are
- * globally unique, so the mapping is total and deterministic and no directory service exists.
+ * Deterministic logical Thread placement. The native adapter uses `idFromName(threadId)`;
+ * a shared application owner can bind that logical identity into its RPC adapter instead.
+ * Lookup performs no I/O and grants no authority. Every call resolves its target afresh.
  */
 declare class ThreadObjectNamespace extends ThreadObjectNamespace_base {
   static layer(namespace: DurableObjectNamespace<ThreadObjectRpc>, options?: {
@@ -100,6 +102,11 @@ declare const ThreadObjectIdentity_base: Context.ServiceClass<ThreadObjectIdenti
  * from `ctx.id.name` — the Object identity rule guarantees the name IS the Thread ID.
  */
 declare class ThreadObjectIdentity extends ThreadObjectIdentity_base {}
+declare const ThreadObjectPlacement_base: Context.ServiceClass<ThreadObjectPlacement, "@effect-agent/platform-cloudflare/ThreadObjectPlacement", {
+  readonly ownsThread: (threadId: ThreadId) => boolean;
+}>;
+/** Logical Threads whose canonical stores and admission ledger live in this physical Object. */
+declare class ThreadObjectPlacement extends ThreadObjectPlacement_base {}
 //#endregion
-export { CloudflareBindingError, DurableObjectContext, ThreadObjectIdentity, ThreadObjectNamespace, ThreadObjectRpc, CloudflareBindings_d_exports as t, threadNamespaceFromEnv, threadNamespaceLayer };
+export { CloudflareBindingError, DurableObjectContext, ThreadObjectClient, ThreadObjectIdentity, ThreadObjectNamespace, ThreadObjectPlacement, ThreadObjectRpc, CloudflareBindings_d_exports as t, threadNamespaceFromEnv, threadNamespaceLayer };
 //# sourceMappingURL=CloudflareBindings.d.mts.map

package/dist/CloudflareBindings.mjs

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { Context, Effect, Layer, Predicate, Schema } from "effect";
 import "@effect-agent/core/Identifiers";
+import { Context, Effect, Layer, Predicate, Schema } from "effect";
 import "@effect-agent/thread/Records";
 //#region src/CloudflareBindings.ts
 var CloudflareBindings_exports = /* @__PURE__ */ __exportAll({
@@ -8,6 +8,7 @@ var CloudflareBindings_exports = /* @__PURE__ */ __exportAll({
 	DurableObjectContext: () => DurableObjectContext,
 	ThreadObjectIdentity: () => ThreadObjectIdentity,
 	ThreadObjectNamespace: () => ThreadObjectNamespace,
+	ThreadObjectPlacement: () => ThreadObjectPlacement,
 	threadNamespaceFromEnv: () => threadNamespaceFromEnv,
 	threadNamespaceLayer: () => threadNamespaceLayer
 });
@@ -23,14 +24,14 @@ var CloudflareBindingError = class extends Schema.TaggedError()("CloudflareBindi
 	message: Schema.String
 }) {};
 /**
-* The `DurableObjectNamespace` binding that addresses Thread Objects. The Object
-* identity rule is `namespace.idFromName(threadId)` (plan §1.2): Thread IDs are
-* globally unique, so the mapping is total and deterministic and no directory service exists.
+* Deterministic logical Thread placement. The native adapter uses `idFromName(threadId)`;
+* a shared application owner can bind that logical identity into its RPC adapter instead.
+* Lookup performs no I/O and grants no authority. Every call resolves its target afresh.
 */
 var ThreadObjectNamespace = class ThreadObjectNamespace extends Context.Service()("@effect-agent/platform-cloudflare/ThreadObjectNamespace") {
 	static layer(namespace, options = {}) {
 		return Layer.succeed(ThreadObjectNamespace)({
-			namespace,
+			get: (threadId) => namespace.get(namespace.idFromName(threadId)),
 			...options.rpcTracing === void 0 ? {} : { rpcTracing: options.rpcTracing }
 		});
 	}
@@ -70,7 +71,7 @@ const threadNamespaceFromEnv = Effect.fn("threadNamespaceFromEnv")(function* (en
 * receiver also opts into the effect-cf native RPC trace-context contract.
 */
 const threadNamespaceLayer = (env, binding, options = {}) => Layer.effect(ThreadObjectNamespace)(Effect.map(threadNamespaceFromEnv(env, binding), (namespace) => ({
-	namespace,
+	get: (threadId) => namespace.get(namespace.idFromName(threadId)),
 	...options.rpcTracing === true ? { rpcTracing: binding } : {}
 })));
 /**
@@ -92,7 +93,9 @@ var DurableObjectContext = class DurableObjectContext extends Context.Service()(
 * from `ctx.id.name` — the Object identity rule guarantees the name IS the Thread ID.
 */
 var ThreadObjectIdentity = class extends Context.Service()("@effect-agent/platform-cloudflare/ThreadObjectIdentity") {};
+/** Logical Threads whose canonical stores and admission ledger live in this physical Object. */
+var ThreadObjectPlacement = class extends Context.Service()("@effect-agent/platform-cloudflare/ThreadObjectPlacement") {};
 //#endregion
-export { CloudflareBindingError, DurableObjectContext, ThreadObjectIdentity, ThreadObjectNamespace, CloudflareBindings_exports as t, threadNamespaceFromEnv, threadNamespaceLayer };
+export { CloudflareBindingError, DurableObjectContext, ThreadObjectIdentity, ThreadObjectNamespace, ThreadObjectPlacement, CloudflareBindings_exports as t, threadNamespaceFromEnv, threadNamespaceLayer };
 
 //# sourceMappingURL=CloudflareBindings.mjs.map

package/dist/CloudflareBindings.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"CloudflareBindings.mjs","names":[],"sources":["../src/CloudflareBindings.ts"],"sourcesContent":["import { type ThreadId } from \"@effect-agent/core/Identifiers\";\nimport { type ProducerId } from \"@effect-agent/thread/Records\";\nimport { Context, Effect, Layer, Predicate, Schema } from \"effect\";\n\n/**\n * Cloudflare platform bindings as Effect services (DEPLOY-010: \"Cloudflare platform bindings\n * are supplied as Effect services/Layers\"). Application code never reads `env` or touches a\n * `DurableObjectState` directly — the Thread Object class constructs these Layers once\n * per incarnation and everything downstream consumes the services.\n */\n\n/** A Cloudflare platform binding was missing or carried the wrong shape (DEPLOY-003/010). */\nexport class CloudflareBindingError extends Schema.TaggedError<CloudflareBindingError>()(\n  \"CloudflareBindingError\",\n  {\n    binding: Schema.String,\n    message: Schema.String,\n  },\n) {}\n\n/**\n * The RPC surface one Thread Durable Object exposes to Workers and to sibling\n * Thread Objects. `ThreadObject.make` implements it; the Worker-side client\n * and the cross-Object transport call it through `DurableObjectNamespace` stubs. Every\n * `encoded` value is a Schema-encoded envelope (`client.ts` wire schemas for host entry\n * points, `@effect-agent/storage-cloudflare` port envelopes for `portCall`), so the RPC\n * boundary carries only structured-cloneable JSON. The optional trailing trace context is\n * transient native RPC metadata, stripped by an opted-in effect-cf receiver before decoding\n * the host envelope. It never enters durable state.\n */\nexport interface ThreadObjectRpc extends Rpc.DurableObjectBranded {\n  /** Admission-limits gate + `DurableAgentRuntime.submit`; answers a `SubmitResponse`. */\n  submitEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Wake-hinted, poll-guaranteed settlement wait; answers an `AwaitSettlementResponse`. */\n  submissionStatusEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  awaitSettlementEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Event-driven durable progress wait; answers a `ProgressObserved` host response. */\n  awaitProgressEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Best-effort cancellation for one in-flight progress wait. */\n  cancelProgressEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** One bounded page of canonical records; answers an `ObservePageResponse`. */\n  observePage(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Durable abort intent; answers an `AbortResponse`. */\n  abortEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Durable approval decision (plan §2.6); answers a `ResolveApprovalResponse`. */\n  resolveApprovalEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Authorized DUR-017 Unknown-Outcome resolution; answers a `ResolveUnknownResponse`. */\n  resolveUnknownEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Owner-side cross-Object port endpoint (WP2 envelopes, executed on LOCAL facets). */\n  portCall(encoded: unknown): Promise<unknown>;\n  /** Droppable liveness hint from another Object: arms an immediate alarm. */\n  wake(): Promise<void>;\n}\n\n/**\n * The `DurableObjectNamespace` binding that addresses Thread Objects. The Object\n * identity rule is `namespace.idFromName(threadId)` (plan §1.2): Thread IDs are\n * globally unique, so the mapping is total and deterministic and no directory service exists.\n */\nexport class ThreadObjectNamespace extends Context.Service<\n  ThreadObjectNamespace,\n  {\n    readonly namespace: DurableObjectNamespace<ThreadObjectRpc>;\n    /** Stable binding name for opted-in native RPC tracing; absent by default. */\n    readonly rpcTracing?: string;\n  }\n>()(\"@effect-agent/platform-cloudflare/ThreadObjectNamespace\") {\n  static layer(\n    namespace: DurableObjectNamespace<ThreadObjectRpc>,\n    options: { readonly rpcTracing?: string } = {},\n  ): Layer.Layer<ThreadObjectNamespace> {\n    return Layer.succeed(ThreadObjectNamespace)({\n      namespace,\n      ...(options.rpcTracing === undefined ? {} : { rpcTracing: options.rpcTracing }),\n    });\n  }\n}\n\n/**\n * Narrow one `env` member to a `DurableObjectNamespace`. `env` is an untyped platform value,\n * and a namespace binding is a host object no Schema can decode, so this is the documented\n * narrowest-boundary check (structural probe for the namespace surface the transport uses);\n * a missing or misshaped binding fails typed before any Layer is built.\n */\nexport const threadNamespaceFromEnv = Effect.fn(\"threadNamespaceFromEnv\")(function* (\n  env: unknown,\n  binding: string,\n): Effect.fn.Return<DurableObjectNamespace<ThreadObjectRpc>, CloudflareBindingError> {\n  if (!Predicate.isObjectKeyword(env)) {\n    return yield* CloudflareBindingError.make({\n      binding,\n      message: \"The Worker environment is not an object; no bindings are available.\",\n    });\n  }\n\n  const candidate = yield* Effect.try({\n    try: () => {\n      const value: unknown = Reflect.get(env, binding);\n\n      if (!Predicate.isObjectKeyword(value)) return undefined;\n      const idFromName: unknown = Reflect.get(value, \"idFromName\");\n      const get: unknown = Reflect.get(value, \"get\");\n\n      return typeof idFromName === \"function\" && typeof get === \"function\" ? value : undefined;\n    },\n    catch: () =>\n      CloudflareBindingError.make({\n        binding,\n        message: `env.${binding} could not be inspected as a DurableObjectNamespace binding.`,\n      }),\n  });\n\n  if (candidate !== undefined) {\n    // The structural probe above is the entire runtime contract this package relies on;\n    // the assertion records that `idFromName`/`get` name a DurableObjectNamespace.\n    return candidate as unknown as DurableObjectNamespace<ThreadObjectRpc>;\n  }\n\n  return yield* CloudflareBindingError.make({\n    binding,\n    message:\n      `env.${binding} is not a DurableObjectNamespace binding; declare the Thread ` +\n      \"Object class under this binding in the Worker configuration.\",\n  });\n});\n\n/**\n * Build the namespace from Worker `env` (fails typed). Enable `rpcTracing` only when the\n * receiver also opts into the effect-cf native RPC trace-context contract.\n */\nexport const threadNamespaceLayer = (\n  env: unknown,\n  binding: string,\n  options: { readonly rpcTracing?: boolean } = {},\n): Layer.Layer<ThreadObjectNamespace, CloudflareBindingError> =>\n  Layer.effect(ThreadObjectNamespace)(\n    Effect.map(threadNamespaceFromEnv(env, binding), (namespace) => ({\n      namespace,\n      ...(options.rpcTracing === true ? { rpcTracing: binding } : {}),\n    })),\n  );\n\n/**\n * The live Durable Object execution context of THIS incarnation. Only Layer construction and\n * the alarm service consume it; important state never lives on it (`ctx.storage` is truth,\n * everything in memory is a cache — deployment spec §11).\n */\nexport class DurableObjectContext extends Context.Service<\n  DurableObjectContext,\n  {\n    readonly ctx: DurableObjectState;\n    readonly env: unknown;\n  }\n>()(\"@effect-agent/platform-cloudflare/DurableObjectContext\") {\n  static layer(ctx: DurableObjectState, env: unknown): Layer.Layer<DurableObjectContext> {\n    return Layer.succeed(DurableObjectContext)({ ctx, env });\n  }\n}\n\n/**\n * The Thread identity this Object serializes and the producer identity its Attempts\n * write with (`{producerPrefix}:{threadId}`, plan §1.4). Derived once per incarnation\n * from `ctx.id.name` — the Object identity rule guarantees the name IS the Thread ID.\n */\nexport class ThreadObjectIdentity extends Context.Service<\n  ThreadObjectIdentity,\n  {\n    readonly threadId: ThreadId;\n    readonly producerId: ProducerId;\n  }\n>()(\"@effect-agent/platform-cloudflare/ThreadObjectIdentity\") {}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAYA,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA;CACE,SAAS,OAAO;CAChB,SAAS,OAAO;AAClB,CACF,CAAC,CAAC,CAAC;;;;;;AAyCH,IAAa,wBAAb,MAAa,8BAA8B,QAAQ,QAOjD,CAAC,CAAC,yDAAyD,CAAC,CAAC;CAC7D,OAAO,MACL,WACA,UAA4C,CAAC,GACT;EACpC,OAAO,MAAM,QAAQ,qBAAqB,CAAC,CAAC;GAC1C;GACA,GAAI,QAAQ,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;EAC/E,CAAC;CACH;AACF;;;;;;;AAQA,MAAa,yBAAyB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACxE,KACA,SACmF;CACnF,IAAI,CAAC,UAAU,gBAAgB,GAAG,GAChC,OAAO,OAAO,uBAAuB,KAAK;EACxC;EACA,SAAS;CACX,CAAC;CAGH,MAAM,YAAY,OAAO,OAAO,IAAI;EAClC,WAAW;GACT,MAAM,QAAiB,QAAQ,IAAI,KAAK,OAAO;GAE/C,IAAI,CAAC,UAAU,gBAAgB,KAAK,GAAG,OAAO,KAAA;GAC9C,MAAM,aAAsB,QAAQ,IAAI,OAAO,YAAY;GAC3D,MAAM,MAAe,QAAQ,IAAI,OAAO,KAAK;GAE7C,OAAO,OAAO,eAAe,cAAc,OAAO,QAAQ,aAAa,QAAQ,KAAA;EACjF;EACA,aACE,uBAAuB,KAAK;GAC1B;GACA,SAAS,OAAO,QAAQ;EAC1B,CAAC;CACL,CAAC;CAED,IAAI,cAAc,KAAA,GAGhB,OAAO;CAGT,OAAO,OAAO,uBAAuB,KAAK;EACxC;EACA,SACE,OAAO,QAAQ;CAEnB,CAAC;AACH,CAAC;;;;;AAMD,MAAa,wBACX,KACA,SACA,UAA6C,CAAC,MAE9C,MAAM,OAAO,qBAAqB,CAAC,CACjC,OAAO,IAAI,uBAAuB,KAAK,OAAO,IAAI,eAAe;CAC/D;CACA,GAAI,QAAQ,eAAe,OAAO,EAAE,YAAY,QAAQ,IAAI,CAAC;AAC/D,EAAE,CACJ;;;;;;AAOF,IAAa,uBAAb,MAAa,6BAA6B,QAAQ,QAMhD,CAAC,CAAC,wDAAwD,CAAC,CAAC;CAC5D,OAAO,MAAM,KAAyB,KAAiD;EACrF,OAAO,MAAM,QAAQ,oBAAoB,CAAC,CAAC;GAAE;GAAK;EAAI,CAAC;CACzD;AACF;;;;;;AAOA,IAAa,uBAAb,cAA0C,QAAQ,QAMhD,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC"}
+{"version":3,"file":"CloudflareBindings.mjs","names":[],"sources":["../src/CloudflareBindings.ts"],"sourcesContent":["import { type ThreadId } from \"@effect-agent/core/Identifiers\";\nimport { type ProducerId } from \"@effect-agent/thread/Records\";\nimport { Context, Effect, Layer, Predicate, Schema } from \"effect\";\n\n/**\n * Cloudflare platform bindings as Effect services (DEPLOY-010: \"Cloudflare platform bindings\n * are supplied as Effect services/Layers\"). Application code never reads `env` or touches a\n * `DurableObjectState` directly — the Thread Object class constructs these Layers once\n * per incarnation and everything downstream consumes the services.\n */\n\n/** A Cloudflare platform binding was missing or carried the wrong shape (DEPLOY-003/010). */\nexport class CloudflareBindingError extends Schema.TaggedError<CloudflareBindingError>()(\n  \"CloudflareBindingError\",\n  {\n    binding: Schema.String,\n    message: Schema.String,\n  },\n) {}\n\n/**\n * The RPC surface one Thread Durable Object exposes to Workers and to sibling\n * Thread Objects. `ThreadObject.make` implements it; the Worker-side client\n * and the cross-Object transport call it through `DurableObjectNamespace` stubs. Every\n * `encoded` value is a Schema-encoded envelope (`client.ts` wire schemas for host entry\n * points, `@effect-agent/storage-cloudflare` port envelopes for `portCall`), so the RPC\n * boundary carries only structured-cloneable JSON. The optional trailing trace context is\n * transient native RPC metadata, stripped by an opted-in effect-cf receiver before decoding\n * the host envelope. It never enters durable state.\n */\nexport interface ThreadObjectRpc extends Rpc.DurableObjectBranded {\n  /** Admission-limits gate + `DurableAgentRuntime.submit`; answers a `SubmitResponse`. */\n  submitEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Wake-hinted, poll-guaranteed settlement wait; answers an `AwaitSettlementResponse`. */\n  submissionStatusEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  awaitSettlementEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Event-driven durable progress wait; answers a `ProgressObserved` host response. */\n  awaitProgressEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Best-effort cancellation for one in-flight progress wait. */\n  cancelProgressEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** One bounded page of canonical records; answers an `ObservePageResponse`. */\n  observePage(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Durable abort intent; answers an `AbortResponse`. */\n  abortEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Durable approval decision (plan §2.6); answers a `ResolveApprovalResponse`. */\n  resolveApprovalEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Authorized DUR-017 Unknown-Outcome resolution; answers a `ResolveUnknownResponse`. */\n  resolveUnknownEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;\n  /** Owner-side cross-Object port endpoint (WP2 envelopes, executed on LOCAL facets). */\n  portCall(encoded: unknown): Promise<unknown>;\n  /** Droppable liveness hint from another Object: arms an immediate alarm. */\n  wake(): Promise<void>;\n}\n\n/** A logical Thread endpoint may be bound to an application Object without forging its brand. */\nexport type ThreadObjectClient = Omit<ThreadObjectRpc, keyof Rpc.DurableObjectBranded>;\n\n/**\n * Deterministic logical Thread placement. The native adapter uses `idFromName(threadId)`;\n * a shared application owner can bind that logical identity into its RPC adapter instead.\n * Lookup performs no I/O and grants no authority. Every call resolves its target afresh.\n */\nexport class ThreadObjectNamespace extends Context.Service<\n  ThreadObjectNamespace,\n  {\n    readonly get: (threadId: ThreadId) => ThreadObjectClient;\n    /** Stable binding name for opted-in native RPC tracing; absent by default. */\n    readonly rpcTracing?: string;\n  }\n>()(\"@effect-agent/platform-cloudflare/ThreadObjectNamespace\") {\n  static layer(\n    namespace: DurableObjectNamespace<ThreadObjectRpc>,\n    options: { readonly rpcTracing?: string } = {},\n  ): Layer.Layer<ThreadObjectNamespace> {\n    return Layer.succeed(ThreadObjectNamespace)({\n      get: (threadId) => namespace.get(namespace.idFromName(threadId)),\n      ...(options.rpcTracing === undefined ? {} : { rpcTracing: options.rpcTracing }),\n    });\n  }\n}\n\n/**\n * Narrow one `env` member to a `DurableObjectNamespace`. `env` is an untyped platform value,\n * and a namespace binding is a host object no Schema can decode, so this is the documented\n * narrowest-boundary check (structural probe for the namespace surface the transport uses);\n * a missing or misshaped binding fails typed before any Layer is built.\n */\nexport const threadNamespaceFromEnv = Effect.fn(\"threadNamespaceFromEnv\")(function* (\n  env: unknown,\n  binding: string,\n): Effect.fn.Return<DurableObjectNamespace<ThreadObjectRpc>, CloudflareBindingError> {\n  if (!Predicate.isObjectKeyword(env)) {\n    return yield* CloudflareBindingError.make({\n      binding,\n      message: \"The Worker environment is not an object; no bindings are available.\",\n    });\n  }\n\n  const candidate = yield* Effect.try({\n    try: () => {\n      const value: unknown = Reflect.get(env, binding);\n\n      if (!Predicate.isObjectKeyword(value)) return undefined;\n      const idFromName: unknown = Reflect.get(value, \"idFromName\");\n      const get: unknown = Reflect.get(value, \"get\");\n\n      return typeof idFromName === \"function\" && typeof get === \"function\" ? value : undefined;\n    },\n    catch: () =>\n      CloudflareBindingError.make({\n        binding,\n        message: `env.${binding} could not be inspected as a DurableObjectNamespace binding.`,\n      }),\n  });\n\n  if (candidate !== undefined) {\n    // The structural probe above is the entire runtime contract this package relies on;\n    // the assertion records that `idFromName`/`get` name a DurableObjectNamespace.\n    return candidate as unknown as DurableObjectNamespace<ThreadObjectRpc>;\n  }\n\n  return yield* CloudflareBindingError.make({\n    binding,\n    message:\n      `env.${binding} is not a DurableObjectNamespace binding; declare the Thread ` +\n      \"Object class under this binding in the Worker configuration.\",\n  });\n});\n\n/**\n * Build the namespace from Worker `env` (fails typed). Enable `rpcTracing` only when the\n * receiver also opts into the effect-cf native RPC trace-context contract.\n */\nexport const threadNamespaceLayer = (\n  env: unknown,\n  binding: string,\n  options: { readonly rpcTracing?: boolean } = {},\n): Layer.Layer<ThreadObjectNamespace, CloudflareBindingError> =>\n  Layer.effect(ThreadObjectNamespace)(\n    Effect.map(threadNamespaceFromEnv(env, binding), (namespace) => ({\n      get: (threadId) => namespace.get(namespace.idFromName(threadId)),\n      ...(options.rpcTracing === true ? { rpcTracing: binding } : {}),\n    })),\n  );\n\n/**\n * The live Durable Object execution context of THIS incarnation. Only Layer construction and\n * the alarm service consume it; important state never lives on it (`ctx.storage` is truth,\n * everything in memory is a cache — deployment spec §11).\n */\nexport class DurableObjectContext extends Context.Service<\n  DurableObjectContext,\n  {\n    readonly ctx: DurableObjectState;\n    readonly env: unknown;\n  }\n>()(\"@effect-agent/platform-cloudflare/DurableObjectContext\") {\n  static layer(ctx: DurableObjectState, env: unknown): Layer.Layer<DurableObjectContext> {\n    return Layer.succeed(DurableObjectContext)({ ctx, env });\n  }\n}\n\n/**\n * The Thread identity this Object serializes and the producer identity its Attempts\n * write with (`{producerPrefix}:{threadId}`, plan §1.4). Derived once per incarnation\n * from `ctx.id.name` — the Object identity rule guarantees the name IS the Thread ID.\n */\nexport class ThreadObjectIdentity extends Context.Service<\n  ThreadObjectIdentity,\n  {\n    readonly threadId: ThreadId;\n    readonly producerId: ProducerId;\n  }\n>()(\"@effect-agent/platform-cloudflare/ThreadObjectIdentity\") {}\n\n/** Logical Threads whose canonical stores and admission ledger live in this physical Object. */\nexport class ThreadObjectPlacement extends Context.Service<\n  ThreadObjectPlacement,\n  { readonly ownsThread: (threadId: ThreadId) => boolean }\n>()(\"@effect-agent/platform-cloudflare/ThreadObjectPlacement\") {}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYA,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA;CACE,SAAS,OAAO;CAChB,SAAS,OAAO;AAClB,CACF,CAAC,CAAC,CAAC;;;;;;AA4CH,IAAa,wBAAb,MAAa,8BAA8B,QAAQ,QAOjD,CAAC,CAAC,yDAAyD,CAAC,CAAC;CAC7D,OAAO,MACL,WACA,UAA4C,CAAC,GACT;EACpC,OAAO,MAAM,QAAQ,qBAAqB,CAAC,CAAC;GAC1C,MAAM,aAAa,UAAU,IAAI,UAAU,WAAW,QAAQ,CAAC;GAC/D,GAAI,QAAQ,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;EAC/E,CAAC;CACH;AACF;;;;;;;AAQA,MAAa,yBAAyB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACxE,KACA,SACmF;CACnF,IAAI,CAAC,UAAU,gBAAgB,GAAG,GAChC,OAAO,OAAO,uBAAuB,KAAK;EACxC;EACA,SAAS;CACX,CAAC;CAGH,MAAM,YAAY,OAAO,OAAO,IAAI;EAClC,WAAW;GACT,MAAM,QAAiB,QAAQ,IAAI,KAAK,OAAO;GAE/C,IAAI,CAAC,UAAU,gBAAgB,KAAK,GAAG,OAAO,KAAA;GAC9C,MAAM,aAAsB,QAAQ,IAAI,OAAO,YAAY;GAC3D,MAAM,MAAe,QAAQ,IAAI,OAAO,KAAK;GAE7C,OAAO,OAAO,eAAe,cAAc,OAAO,QAAQ,aAAa,QAAQ,KAAA;EACjF;EACA,aACE,uBAAuB,KAAK;GAC1B;GACA,SAAS,OAAO,QAAQ;EAC1B,CAAC;CACL,CAAC;CAED,IAAI,cAAc,KAAA,GAGhB,OAAO;CAGT,OAAO,OAAO,uBAAuB,KAAK;EACxC;EACA,SACE,OAAO,QAAQ;CAEnB,CAAC;AACH,CAAC;;;;;AAMD,MAAa,wBACX,KACA,SACA,UAA6C,CAAC,MAE9C,MAAM,OAAO,qBAAqB,CAAC,CACjC,OAAO,IAAI,uBAAuB,KAAK,OAAO,IAAI,eAAe;CAC/D,MAAM,aAAa,UAAU,IAAI,UAAU,WAAW,QAAQ,CAAC;CAC/D,GAAI,QAAQ,eAAe,OAAO,EAAE,YAAY,QAAQ,IAAI,CAAC;AAC/D,EAAE,CACJ;;;;;;AAOF,IAAa,uBAAb,MAAa,6BAA6B,QAAQ,QAMhD,CAAC,CAAC,wDAAwD,CAAC,CAAC;CAC5D,OAAO,MAAM,KAAyB,KAAiD;EACrF,OAAO,MAAM,QAAQ,oBAAoB,CAAC,CAAC;GAAE;GAAK;EAAI,CAAC;CACzD;AACF;;;;;;AAOA,IAAa,uBAAb,cAA0C,QAAQ,QAMhD,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC;;AAG/D,IAAa,wBAAb,cAA2C,QAAQ,QAGjD,CAAC,CAAC,yDAAyD,CAAC,CAAC,CAAC"}

package/dist/CloudflareScheduling.mjs

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { CloudflareThreadClient } from "./CloudflareThreadClient.mjs";
-import { n as cloudflareScheduledInputAdmissionLayer, t as cloudflarePreparedInputAdmissionLayer } from "./prepared-admission-G7N4DDqS.mjs";
+import { n as cloudflareScheduledInputAdmissionLayer, t as cloudflarePreparedInputAdmissionLayer } from "./prepared-admission-DSi55W-7.mjs";
+import { AgentId } from "@effect-agent/core/Identifiers";
 import "@effect-agent/thread/DurableAgentRuntime";
 import { AdmissionFence } from "@effect-agent/thread/SubmissionLedger";
 import { Clock, Context, DateTime, Effect, Layer, Schema } from "effect";
-import { AgentId } from "@effect-agent/core/Identifiers";
 import { DefinitionDigests, PersistedJson } from "@effect-agent/thread/Records";
 import { DurableObject, DurableObjectAlarm, DurableObjectState } from "effect-cf";
 import { DoScheduleAlarmControl, DoScheduleTransaction, scheduleStoreLayer } from "@effect-agent/storage-cloudflare/DoScheduleStore";