@effect-agent/platform-cloudflare 0.1.0-beta.8 → 0.1.0-beta.80

package/dist/Alarm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Alarm.mjs","names":[],"sources":["../src/Alarm.ts"],"sourcesContent":["import { ThreadId } from \"@effect-agent/core/Identifiers\";\nimport { type DurableBindingFailure } from \"@effect-agent/thread/AgentRegistration\";\nimport {\n  DurableAgentRuntime,\n  type DurableWorkerFailure,\n  type RecoveryReport,\n} from \"@effect-agent/thread/DurableAgentRuntime\";\nimport { SubmissionLedger, type SubmissionSnapshot } from \"@effect-agent/thread/SubmissionLedger\";\nimport {\n  ThreadProjectionMaintenance,\n  drainDue,\n  type ThreadProjectionError,\n} from \"@effect-agent/thread/ThreadProjectionMaintenance\";\nimport {\n  Cause,\n  Clock,\n  Context,\n  DateTime,\n  Deferred,\n  Effect,\n  Exit,\n  Fiber,\n  Layer,\n  Option,\n  Random,\n  Ref,\n  Schema,\n  Semaphore,\n  Stream,\n} from \"effect\";\n\nimport { DurableObjectContext } from \"./CloudflareBindings.ts\";\nimport { CloudflareDurableRuntimeConfig } from \"./CloudflareConfig.ts\";\nimport { safeCauseMessage } from \"./internal/boundary.ts\";\n\n/**\n * The single multiplexed Durable Object alarm (decision D-P6-2). A Durable Object has ONE\n * alarm slot; every cadence the Node host ran on fibers (wake scan, lease expiry, settlement\n * and abort re-checks, retry backoff) multiplexes into one idempotent maintenance pass, and\n * the slot always holds the EARLIEST deadline any caller asked for.\n *\n * The alarm invariant (plan §1.4): every committed actionable mutation carries a newer durable\n * maintenance generation and a committed alarm. Stable externally-driven waits may be\n * nonterminal without retaining an alarm; their resolving mutation advances the generation and\n * restores the alarm atomically.\n */\n\n/** The Durable Object alarm API failed; surfaces on host entry points as a typed refusal. */\nexport class DurableAlarmError extends Schema.TaggedError<DurableAlarmError>()(\n  \"DurableAlarmError\",\n  {\n    operation: Schema.String,\n    message: Schema.String,\n    cause: Schema.optionalKey(Schema.Defect()),\n  },\n) {}\n\nconst alarmFailure =\n  (operation: string) =>\n  (cause: unknown): DurableAlarmError =>\n    DurableAlarmError.make({\n      operation,\n      message: safeCauseMessage(cause, \"The Cloudflare alarm API failed without a diagnostic\"),\n      cause,\n    });\n\n/** `ctx.storage` alarm slot as an Effect service; storage is truth, never a memory field. */\nexport class DurableAlarmService extends Context.Service<\n  DurableAlarmService,\n  {\n    /** The scheduled deadline in epoch milliseconds, if any. */\n    readonly scheduled: Effect.Effect<Option.Option<number>, DurableAlarmError>;\n    /** Replace the slot with this deadline. */\n    readonly scheduleAt: (epochMillis: number) => Effect.Effect<void, DurableAlarmError>;\n    /** Keep the EARLIER of the existing deadline and this one (the multiplexing rule). */\n    readonly ensureScheduledBy: (epochMillis: number) => Effect.Effect<void, DurableAlarmError>;\n    /**\n     * Arm an immediate alarm (the durable, coalescing local wake) — DEFERRED while a\n     * maintenance pass is executing. Workerd cancels an in-flight alarm handler when a new\n     * EARLIER deadline is written during its execution (`requestScheduledAlarm`), and the\n     * maintenance pass runs INSIDE the alarm handler: an immediate wake landing mid-pass\n     * (a routed port mutation, a sibling's `wake()`, the coordinator's own local notify)\n     * would kill the running Attempt — manufacturing an ownership loss no real eviction\n     * caused, and routing open uncertain-class Tool Calls into spurious Unknown Outcomes.\n     * Deferral is contract-safe: wakes are droppable hints, every mutating entry point\n     * pre-arms BEFORE its first durable mutation (the alarm invariant never rests on this\n     * call). The pass's durable generation check observes any racing mutation, so the\n     * in-memory hint does not need to be flushed after a stable wait is acknowledged.\n     */\n    readonly scheduleNow: Effect.Effect<void, DurableAlarmError>;\n    /**\n     * Run one maintenance pass with wake deferral (see `scheduleNow`). Calls made while `body`\n     * executes are droppable promptness hints; correctness rests on the durable generation.\n     */\n    readonly withWakesDeferred: <A, E, R>(body: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;\n    /** Clear the slot; correctness-sensitive clears live in maintenance generation transactions. */\n    readonly cancel: Effect.Effect<void, DurableAlarmError>;\n  }\n>()(\"@effect-agent/platform-cloudflare/DurableAlarmService\") {\n  static readonly layer: Layer.Layer<DurableAlarmService, never, DurableObjectContext> =\n    Layer.effect(DurableAlarmService)(\n      Effect.gen(function* () {\n        const { ctx } = yield* DurableObjectContext;\n        /**\n         * In-memory pass bookkeeping — a pure CACHE, never state: a fresh incarnation has no\n         * running pass, and a deferred wake lost to eviction was only ever a promptness hint\n         * on top of the already-committed pre-armed alarm.\n         */\n        const runningPasses = yield* Ref.make(0);\n\n        const scheduled = Effect.tryPromise({\n          try: () => ctx.storage.getAlarm(),\n          catch: alarmFailure(\"get alarm\"),\n        }).pipe(\n          Effect.map((deadline) =>\n            deadline === null ? Option.none<number>() : Option.some(deadline),\n          ),\n        );\n\n        const scheduleAt = (epochMillis: number) =>\n          Effect.tryPromise({\n            try: () => ctx.storage.setAlarm(epochMillis),\n            catch: alarmFailure(\"set alarm\"),\n          });\n\n        const ensureScheduledBy = (epochMillis: number) =>\n          scheduled.pipe(\n            Effect.flatMap((existing) =>\n              Option.isSome(existing) && existing.value <= epochMillis\n                ? Effect.void\n                : scheduleAt(epochMillis),\n            ),\n          );\n\n        const armNow = Clock.currentTimeMillis.pipe(\n          Effect.flatMap((now) => ensureScheduledBy(now)),\n        );\n\n        const scheduleNow = Ref.get(runningPasses).pipe(\n          Effect.flatMap((passes) => (passes > 0 ? Effect.void : armNow)),\n        );\n\n        const withWakesDeferred = <A, E, R>(body: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>\n          Ref.update(runningPasses, (passes) => passes + 1).pipe(\n            Effect.andThen(body),\n            Effect.ensuring(Ref.update(runningPasses, (passes) => passes - 1)),\n          );\n\n        const cancel = Effect.tryPromise({\n          try: () => ctx.storage.deleteAlarm(),\n          catch: alarmFailure(\"delete alarm\"),\n        });\n\n        return DurableAlarmService.of({\n          scheduled,\n          scheduleAt,\n          ensureScheduledBy,\n          scheduleNow,\n          withWakesDeferred,\n          cancel,\n        });\n      }),\n    );\n}\n\n/** What one maintenance pass did — auditable evidence mirroring `NodeDurableHost`'s report. */\nexport class MaintenancePassReport extends Schema.Class<MaintenancePassReport>(\n  \"@effect-agent/platform-cloudflare/MaintenancePassReport\",\n)({\n  /** `caught-up` ran no runtime work (publication may be pending); `actionable` ran recovery. */\n  phase: Schema.Literals([\"caught-up\", \"actionable\"]),\n  /** Recovery decisions executed (or deferred) BEFORE any new claim in this pass. */\n  recovered: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /** Whether the head Attempt settled. Joined input may settle with that head. */\n  settled: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /** Submissions still nonterminal after the pass (suspended/unknown lanes stay honest). */\n  nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /** `rearmed` for dirty/autonomous work, `cleared` for stable waits or settlement. */\n  alarm: Schema.Literals([\"rearmed\", \"cleared\"]),\n}) {}\n\n/** Fault boundaries around every maintenance-owned durable mutation. */\nexport type ThreadMaintenanceFailpointLocation =\n  | \"maintenance:dirty:before\"\n  | \"maintenance:dirty:after\"\n  | \"maintenance:mutation:armed\"\n  | \"maintenance:mutation:finished\"\n  | \"maintenance:ensure:before\"\n  | \"maintenance:ensure:after\"\n  | \"maintenance:begin:before\"\n  | \"maintenance:begin:after\"\n  | \"maintenance:select:before\"\n  | \"maintenance:select:after\"\n  | \"maintenance:finish:before\"\n  | \"maintenance:finish:after\";\n\nexport type ThreadMaintenanceFailpointHandler = (\n  location: ThreadMaintenanceFailpointLocation,\n) => Effect.Effect<void>;\n\n/** Test-only fault authority; production uses the inert layer. */\nexport class ThreadMaintenanceFailpoint extends Context.Service<\n  ThreadMaintenanceFailpoint,\n  {\n    readonly hit: ThreadMaintenanceFailpointHandler;\n  }\n>()(\"@effect-agent/platform-cloudflare/ThreadMaintenanceFailpoint\") {\n  static readonly layer = Layer.succeed(this)({ hit: () => Effect.void });\n}\n\n/**\n * Durable host publication of canonical records and ledger approval/abort/resolution intents.\n * The host owns schema-versioned cursors, destination idempotency and acknowledgement. Delivery\n * is at least once. Hooks must not write the alarm slot or mutate the supplied raw source ports.\n *\n * `invalidate`, `prepareGeneration` and `pendingDeadline` must be bounded local operations.\n * `prepareGeneration` durably invalidates a scan only when its generation changes; repeated\n * calls must preserve partial scan progress. It runs with no source mutation in flight.\n * `drain` performs bounded delivery and persists retries before returning. A pending deadline\n * defers runtime recovery/Attempts, allowing committed host publications to drain first.\n * Unexpected hook failures leave the prearmed generation for retry. Hooks acquire per-call\n * resources with Effect.scoped; Layer construction owns incarnation resources (eviction need\n * not run finalizers). Do not hold a local hook behind network I/O or call back into producers.\n */\nexport interface ThreadPublicationService {\n  readonly invalidate: Effect.Effect<void, DurableAlarmError>;\n  readonly prepareGeneration: (generation: bigint) => Effect.Effect<void, DurableAlarmError>;\n  readonly drain: Effect.Effect<void, DurableAlarmError>;\n  readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;\n}\n\n/** Opt in with `ThreadObject.layer(registrations, { publication: Layer.effect(ThreadPublication)(...) })`. */\nexport class ThreadPublication extends Context.Service<\n  ThreadPublication,\n  ThreadPublicationService\n>()(\"@effect-agent/platform-cloudflare/ThreadPublication\") {\n  static readonly layer = Layer.succeed(this)({\n    invalidate: Effect.void,\n    prepareGeneration: () => Effect.void,\n    drain: Effect.void,\n    pendingDeadline: Effect.succeed(Option.none()),\n  });\n}\n\n/**\n * Host-assembled message recovery, supplied by ThreadObject.layer even when the application\n * rebuilds ThreadMaintenance. These obligations outlive source Runs and never defer a ready\n * source Attempt while a destination is processing an accepted message.\n */\nexport const ThreadMessageDelivery = Context.Reference<{\n  readonly drain: Effect.Effect<void, DurableAlarmError>;\n  /** Drain inserts and due retries during source work, finishing the bounded wave on completion. */\n  readonly drainUntil?: (\n    finished: Deferred.Deferred<void>,\n  ) => Effect.Effect<void, DurableAlarmError>;\n  readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;\n}>(\"@effect-agent/platform-cloudflare/ThreadMessageDelivery\", {\n  defaultValue: () => ({ drain: Effect.void, pendingDeadline: Effect.succeed(Option.none()) }),\n});\n\n/**\n * Application obligations sharing this Object's alarm. The deadline read is local and\n * read-only. Drain beside the native Attempt and always finish one initial bounded wave,\n * even when `finished` was already signalled. Then stop starting new waves on that signal\n * and finish the bounded current wave before returning. Native maintenance joins that work\n * before acknowledging a generation. Mutations use the same ThreadMutationGate; hooks never\n * write the raw alarm slot. Pending host work does not defer a ready model Attempt.\n */\nexport const ThreadHostMaintenance = Context.Reference<{\n  readonly pendingDeadline: Effect.Effect<Option.Option<number>, DurableAlarmError>;\n  readonly drainUntil: (\n    finished: Deferred.Deferred<void>,\n  ) => Effect.Effect<void, DurableAlarmError>;\n}>(\"@effect-agent/platform-cloudflare/ThreadHostMaintenance\", {\n  defaultValue: () => ({\n    pendingDeadline: Effect.succeed(Option.none()),\n    drainUntil: () => Effect.void,\n  }),\n});\n\nconst earliestDeadline = (\n  left: Option.Option<number>,\n  right: Option.Option<number>,\n): Option.Option<number> =>\n  Option.isSome(left)\n    ? Option.isSome(right)\n      ? Option.some(Math.min(left.value, right.value))\n      : left\n    : right;\n\n/** @internal A committed source operation must not become a failed operation because delivery failed. */\nexport const publishCommitted = Effect.gen(function* () {\n  const publication = yield* ThreadPublication;\n\n  yield* publication.invalidate.pipe(Effect.andThen(publication.drain));\n}).pipe(\n  Effect.catchCause((cause) =>\n    Cause.hasInterrupts(cause)\n      ? Effect.interrupt\n      : Effect.logError(\"Thread publication deferred after source commit\", cause),\n  ),\n);\n\nconst MaintenanceGeneration = Schema.BigIntFromString.check(\n  Schema.isGreaterThanOrEqualToBigInt(0n),\n);\n\n/** Versioned, platform-private maintenance state stored through Durable Object KV. */\nclass ThreadMaintenanceState extends Schema.Class<ThreadMaintenanceState>(\n  \"@effect-agent/platform-cloudflare/ThreadMaintenanceState\",\n)({\n  schemaVersion: Schema.Literal(1),\n  dirty: MaintenanceGeneration,\n  processed: MaintenanceGeneration,\n  nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  /** One physical-owner cursor; old single-lane records need no conversion. */\n  lastServedThreadId: Schema.optionalKey(ThreadId),\n}) {}\n\nconst MAINTENANCE_STATE_KEY = \"effect-agent:thread-maintenance:v1\";\nconst decodeMaintenanceState = Schema.decodeUnknownSync(ThreadMaintenanceState);\nconst encodeMaintenanceState = Schema.encodeSync(ThreadMaintenanceState);\n\nconst initialMaintenanceState = (): ThreadMaintenanceState =>\n  ThreadMaintenanceState.make({\n    schemaVersion: 1,\n    // Bootstrap Objects created by the pre-generation release without scanning the ledger in\n    // the constructor. One useful pass classifies and acknowledges any existing obligation.\n    dirty: 1n,\n    processed: 0n,\n    nonterminal: 0,\n  });\n\nconst readMaintenanceState = async (\n  transaction: DurableObjectTransaction,\n): Promise<{ readonly state: ThreadMaintenanceState; readonly initialized: boolean }> => {\n  const encoded = await transaction.get(MAINTENANCE_STATE_KEY);\n\n  return encoded === undefined\n    ? { state: initialMaintenanceState(), initialized: false }\n    : { state: decodeMaintenanceState(encoded), initialized: true };\n};\n\nconst ensureTransactionAlarmBy = async (\n  transaction: DurableObjectTransaction,\n  deadline: number,\n): Promise<void> => {\n  const scheduled = await transaction.getAlarm();\n\n  if (scheduled === null || scheduled > deadline) {\n    await transaction.setAlarm(deadline);\n  }\n};\n\nconst stableExternalWait = (\n  snapshot: SubmissionSnapshot,\n  reports: ReadonlyMap<string, RecoveryReport>,\n): boolean => {\n  const decision = reports.get(snapshot.submissionId)?.decision._tag;\n\n  // An accepted abort still owes cleanup/settlement even if its claim was deferred this pass.\n  if (decision === \"SettleAborted\") return false;\n  switch (snapshot.state) {\n    case \"suspended\":\n    case \"joined\":\n      return true;\n    case \"unknown\":\n      return decision === \"AwaitUnknownResolution\" || decision === \"MarkUnknown\";\n    case \"admitted\":\n      return reports.get(snapshot.submissionId)?.decision._tag === \"AwaitParentEstablishment\";\n    case \"input-applied\":\n    case \"joining\":\n    case \"ready\":\n    case \"running\":\n    case \"settled\":\n    case \"terminalizing\":\n      return false;\n  }\n};\n\n/**\n * Shared prearm/acknowledgement boundary for ingress and runtime-owned producers.\n * `ThreadObject.layer` provides this same instance in its Services. Rebuilt runtime/maintenance\n * Layers must reuse that instance; a second gate cannot observe the native producers' activity.\n */\nexport class ThreadMutationGate extends Context.Service<\n  ThreadMutationGate,\n  {\n    readonly withMutation: <A, E, R>(\n      body: Effect.Effect<A, E, R>,\n    ) => Effect.Effect<A, E | DurableAlarmError, R>;\n    readonly withSnapshot: <A, E, R>(\n      body: (active: number) => Effect.Effect<A, E, R>,\n    ) => Effect.Effect<A, E, R>;\n  }\n>()(\"@effect-agent/platform-cloudflare/internal/ThreadMutationGate\") {\n  static readonly layer = Layer.effect(this)(\n    Effect.gen(function* () {\n      const { ctx } = yield* DurableObjectContext;\n      const config = yield* CloudflareDurableRuntimeConfig;\n      const failpoint = yield* ThreadMaintenanceFailpoint;\n      // A fresh incarnation has no live mutations; durable generations survive eviction.\n      const activeMutations = yield* Ref.make(0);\n      const generationGate = yield* Semaphore.make(1);\n      const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));\n\n      const runTransaction = <A>(operation: string, transaction: () => Promise<A>) =>\n        Effect.tryPromise({ try: transaction, catch: alarmFailure(operation) });\n\n      const beginMutation = Effect.fn(\"ThreadMaintenance.beginMutation\")(function* () {\n        yield* failpoint.hit(\"maintenance:dirty:before\");\n        const now = yield* Clock.currentTimeMillis;\n\n        yield* runTransaction(\"advance maintenance generation\", () =>\n          ctx.storage.transaction(async (transaction) => {\n            const { state } = await readMaintenanceState(transaction);\n\n            const next = ThreadMaintenanceState.make({\n              ...state,\n              dirty: state.dirty + 1n,\n            });\n\n            await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));\n            // The earliest configured retry bounds a newly actionable mutation without relying\n            // on its best-effort immediate wake hint.\n            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);\n          }),\n        );\n        yield* failpoint.hit(\"maintenance:dirty:after\");\n        yield* Ref.update(activeMutations, (active) => active + 1);\n      });\n\n      const endMutation = generationGate.withPermit(\n        Ref.update(activeMutations, (active) => Math.max(0, active - 1)),\n      );\n\n      const withMutation = <A, E, R>(\n        body: Effect.Effect<A, E, R>,\n      ): Effect.Effect<A, E | DurableAlarmError, R> =>\n        Effect.acquireUseRelease(\n          generationGate.withPermit(beginMutation()),\n          () =>\n            failpoint.hit(\"maintenance:mutation:armed\").pipe(\n              Effect.andThen(body),\n              Effect.tap(() => failpoint.hit(\"maintenance:mutation:finished\")),\n            ),\n          () => endMutation,\n        );\n\n      return ThreadMutationGate.of({\n        withMutation,\n        withSnapshot: (body) =>\n          generationGate.withPermit(Effect.flatMap(Ref.get(activeMutations), body)),\n      });\n    }),\n  );\n}\n\nexport type MaintenancePassFailure =\n  | DurableWorkerFailure\n  | DurableBindingFailure\n  | DurableAlarmError\n  | ThreadProjectionError;\n\n/**\n * Incremental, quiescent maintenance over a durable dirty/processed generation (issue #93).\n *\n * `pass` = generation snapshot/pre-arm → recovery → one head Attempt → generation acknowledgement:\n *\n * 1. One storage transaction reads dirty/processed and re-arms before work. A caught-up forced\n *    alarm takes an O(1) path without recovery, ledger scans, or canonical-history reads.\n * 2. Recovery strictly precedes a new claim. One head Attempt advances the lane and requests\n *    a safe yield after ten minutes. The whole event has a fourteen-minute cooperative timeout.\n * 3. The final transaction acknowledges only the generation observed at pass start. A racing\n *    mutation therefore remains `dirty > processed` and retains its atomically-established alarm.\n * 4. Stable external waits acknowledge and clear. Autonomous retry, indeterminate, and lease\n *    recovery states leave their generation dirty and retain bounded backoff rearming.\n */\nexport class ThreadMaintenance extends Context.Service<\n  ThreadMaintenance,\n  {\n    /** One idempotent maintenance pass; failures propagate so workerd retries the alarm. */\n    readonly pass: Effect.Effect<MaintenancePassReport, MaintenancePassFailure>;\n    /**\n     * Constructor gate: initialize/inspect only the O(1) maintenance record and ensure a dirty\n     * generation has an alarm. It never scans the ledger or canonical history.\n     */\n    readonly ensureAlarm: Effect.Effect<void, MaintenancePassFailure>;\n    /**\n     * Serialize the pre-arm boundary with pass acknowledgement, advance the durable dirty\n     * generation and arm the alarm in one transaction BEFORE running the caller's mutation.\n     * A pass cannot acknowledge while that mutation remains in flight.\n     */\n    readonly withMutation: <A, E, R>(\n      body: Effect.Effect<A, E, R>,\n    ) => Effect.Effect<A, E | DurableAlarmError, R>;\n  }\n>()(\"@effect-agent/platform-cloudflare/ThreadMaintenance\") {\n  static readonly layer: Layer.Layer<\n    ThreadMaintenance,\n    never,\n    | ThreadMutationGate\n    | ThreadPublication\n    | ThreadProjectionMaintenance\n    | DurableAgentRuntime\n    | SubmissionLedger\n    | DurableAlarmService\n    | ThreadMaintenanceFailpoint\n    | CloudflareDurableRuntimeConfig\n    | DurableObjectContext\n  > = Layer.effect(ThreadMaintenance)(\n    Effect.gen(function* () {\n      const runtime = yield* DurableAgentRuntime;\n      const ledger = yield* SubmissionLedger;\n      const alarm = yield* DurableAlarmService;\n      const config = yield* CloudflareDurableRuntimeConfig;\n      const { ctx } = yield* DurableObjectContext;\n      const failpoint = yield* ThreadMaintenanceFailpoint;\n\n      /**\n       * Consecutive no-progress passes — an in-memory CACHE, not state: a fresh incarnation\n       * restarts at zero and merely re-arms sooner than a long-lived one would have.\n       */\n      const stalls = yield* Ref.make(0);\n      const mutations = yield* ThreadMutationGate;\n      const publication = yield* ThreadPublication;\n      const projection = yield* ThreadProjectionMaintenance;\n      const messages = yield* ThreadMessageDelivery;\n      const host = yield* ThreadHostMaintenance;\n\n      // A broken disposable index still needs a retry alarm and must not prevent startup.\n      const projectionDeadline = projection.pendingDeadline.pipe(\n        Effect.catchCause((cause) =>\n          Cause.hasInterrupts(cause)\n            ? Effect.failCause(cause)\n            : Effect.logError(\"Thread projection deadline unavailable\", cause).pipe(\n                Effect.as(Option.some(0)),\n              ),\n        ),\n      );\n\n      const pendingDeadline = Effect.gen(function* () {\n        return earliestDeadline(\n          earliestDeadline(yield* publication.pendingDeadline, yield* messages.pendingDeadline),\n          earliestDeadline(yield* projectionDeadline, yield* host.pendingDeadline),\n        );\n      });\n\n      const maintenancePassGate = yield* Semaphore.make(1);\n      const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));\n\n      const runTransaction = <A>(operation: string, transaction: () => Promise<A>) =>\n        Effect.tryPromise({ try: transaction, catch: alarmFailure(operation) });\n\n      const ensureAlarm = Effect.fn(\"ThreadMaintenance.ensureAlarm\")(function* () {\n        yield* failpoint.hit(\"maintenance:ensure:before\");\n        const now = yield* Clock.currentTimeMillis;\n\n        yield* runTransaction(\"ensure maintenance alarm\", () =>\n          ctx.storage.transaction(async (transaction) => {\n            const { state, initialized } = await readMaintenanceState(transaction);\n\n            if (!initialized) {\n              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));\n            }\n            if (state.dirty > state.processed) {\n              await ensureTransactionAlarmBy(transaction, now + config.wakeScanInterval);\n            }\n          }),\n        );\n        const deadline = yield* pendingDeadline;\n\n        if (Option.isSome(deadline)) {\n          yield* runTransaction(\"ensure publication alarm\", () =>\n            ctx.storage.transaction((transaction) =>\n              ensureTransactionAlarmBy(\n                transaction,\n                Math.max(now + minimumAlarmDelay, deadline.value),\n              ),\n            ),\n          );\n        }\n        yield* failpoint.hit(\"maintenance:ensure:after\");\n      });\n\n      const beginPass = Effect.fn(\"ThreadMaintenance.beginPass\")(function* () {\n        yield* failpoint.hit(\"maintenance:begin:before\");\n        const now = yield* Clock.currentTimeMillis;\n\n        const result = yield* runTransaction(\"begin maintenance pass\", () =>\n          ctx.storage.transaction(async (transaction) => {\n            const { state, initialized } = await readMaintenanceState(transaction);\n\n            if (!initialized) {\n              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));\n            }\n            if (state.processed >= state.dirty) {\n              // Prearm even a publication-only pass before invoking any host hook.\n              await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);\n\n              return { _tag: \"CaughtUp\" as const, nonterminal: state.nonterminal };\n            }\n            // Pre-arm the earliest retry before recovery. A successful finish may move this slot\n            // LATER to its bounded backoff, which does not cancel the running handler.\n            await ensureTransactionAlarmBy(transaction, now + minimumAlarmDelay);\n\n            return {\n              _tag: \"Actionable\" as const,\n              generation: state.dirty,\n              nonterminal: state.nonterminal,\n            };\n          }),\n        );\n\n        yield* failpoint.hit(\"maintenance:begin:after\");\n\n        return result;\n      });\n\n      const rearmDelay = Effect.fn(\"ThreadMaintenance.rearmDelay\")(function* (progressed: boolean) {\n        const priorStalls = yield* Ref.getAndUpdate(stalls, (count) =>\n          progressed ? 0 : count + 1,\n        );\n\n        if (progressed) return config.alarmBackoffBase;\n        const exponent = Math.min(priorStalls, 30);\n        const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** exponent);\n        const jitter = yield* Random.next;\n        // Full jitter over [backoff/2, backoff]: desynchronizes retry storms without ever\n        // waiting longer than the deterministic bound.\n        const jittered = Math.ceil(backoff / 2 + (backoff / 2) * jitter);\n\n        return Math.min(jittered, config.wakeScanInterval);\n      });\n\n      const pass = Effect.fn(\"ThreadMaintenance.pass\")(function* (\n        yieldAfter: DateTime.Utc,\n      ): Effect.fn.Return<MaintenancePassReport, MaintenancePassFailure> {\n        const annotate = (report: MaintenancePassReport) =>\n          Effect.annotateCurrentSpan({\n            phase: report.phase,\n            recovered: report.recovered,\n            settled: report.settled,\n            nonterminal: report.nonterminal,\n            alarm: report.alarm,\n          }).pipe(Effect.as(report));\n\n        const started = yield* mutations.withSnapshot((activeAtStart) =>\n          Effect.gen(function* () {\n            const generation = yield* beginPass();\n\n            if (generation._tag === \"Actionable\" && activeAtStart === 0) {\n              // The gate excludes a producer starting between the snapshot and certification.\n              yield* publication.prepareGeneration(generation.generation);\n            }\n\n            return { ...generation, activeAtStart };\n          }),\n        );\n\n        // Deliver beside source work, including messages inserted by the running Attempt.\n        // Slow destination RPCs never consume the source execution window. Stop starting\n        // waves when source work ends, then join the bounded current wave before acknowledgement.\n        const deliveryFinished = yield* Deferred.make<void>();\n\n        const delivery = yield* Effect.forkChild(\n          messages.drainUntil?.(deliveryFinished) ?? messages.drain,\n        );\n\n        const hostWork = yield* Effect.forkChild(host.drainUntil(deliveryFinished));\n\n        const finishDelivery = Deferred.succeed(deliveryFinished, undefined).pipe(\n          Effect.andThen(Fiber.awaitAll([delivery, hostWork])),\n          Effect.flatMap((outcomes) =>\n            Effect.forEach(outcomes, (outcome) => outcome, { discard: true }),\n          ),\n        );\n\n        // Capture derived-index failures until canonical work has had its turn. Interruption\n        // still stops the event; ordinary failures and defects retain the prearmed generation.\n        const projected = yield* Effect.exit(\n          drainDue.pipe(Effect.provideService(ThreadProjectionMaintenance, projection)),\n        );\n\n        if (Exit.isFailure(projected) && Cause.hasInterrupts(projected.cause))\n          return yield* Effect.failCause(projected.cause);\n        const deadline = yield* publication.pendingDeadline;\n\n        if (\n          started._tag === \"Actionable\" ||\n          (Option.isSome(deadline) && deadline.value <= (yield* Clock.currentTimeMillis))\n        ) {\n          yield* publication.drain;\n        }\n        const pending = yield* publication.pendingDeadline;\n\n        if (started._tag === \"CaughtUp\" || Option.isSome(pending)) {\n          yield* finishDelivery;\n          if (Exit.isFailure(projected)) return yield* Effect.failCause(projected.cause);\n          yield* failpoint.hit(\"maintenance:finish:before\");\n\n          const disposition = yield* mutations.withSnapshot((active) =>\n            Effect.gen(function* () {\n              // Re-read under the producer gate: a concurrent append/host mutation cannot be\n              // cleared using a stale empty deadline. Dirty generations bound all producer races.\n              const latest = yield* pendingDeadline;\n              const now = yield* Clock.currentTimeMillis;\n\n              return yield* runTransaction(\"finish publication pass\", () =>\n                ctx.storage.transaction(async (transaction) => {\n                  const { state } = await readMaintenanceState(transaction);\n\n                  const nativeDeadline =\n                    active > 0 || state.dirty > state.processed\n                      ? now + config.wakeScanInterval\n                      : Infinity;\n\n                  const next = Option.isSome(latest)\n                    ? Math.min(nativeDeadline, latest.value)\n                    : nativeDeadline;\n\n                  if (Number.isFinite(next)) {\n                    await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next));\n\n                    return \"rearmed\" as const;\n                  }\n                  await transaction.deleteAlarm();\n\n                  return \"cleared\" as const;\n                }),\n              );\n            }),\n          );\n\n          yield* failpoint.hit(\"maintenance:finish:after\");\n\n          return yield* annotate(\n            MaintenancePassReport.make({\n              phase: \"caught-up\",\n              recovered: 0,\n              settled: 0,\n              nonterminal: started.nonterminal,\n              alarm: disposition,\n            }),\n          );\n        }\n        // Step 2 — reconciliation strictly precedes new work in this pass (exit gate).\n        const recovered: ReadonlyArray<RecoveryReport> = yield* runtime.runRecovery;\n        const reports = new Map(recovered.map((report) => [report.submissionId, report]));\n        const current = yield* Stream.runCollect(ledger.scanNonterminal);\n        const heads = new Map<ThreadId, SubmissionSnapshot>();\n\n        for (const row of current) {\n          if (!heads.has(row.threadId)) heads.set(row.threadId, row);\n        }\n\n        const eligible = [...heads.values()]\n          .filter((head) => !stableExternalWait(head, reports))\n          .map((head) => head.threadId)\n          .sort();\n\n        let selected = eligible[0];\n\n        if (heads.size > 1 && selected !== undefined) {\n          yield* failpoint.hit(\"maintenance:select:before\");\n          selected = yield* runTransaction(\"select maintenance lane\", () =>\n            ctx.storage.transaction(async (transaction) => {\n              const { state } = await readMaintenanceState(transaction);\n\n              const next =\n                eligible.find(\n                  (threadId) =>\n                    state.lastServedThreadId === undefined || threadId > state.lastServedThreadId,\n                ) ?? eligible[0];\n\n              if (next !== undefined) {\n                // Persist before the Attempt so an eviction or repeated yield cannot\n                // monopolize the first lane. The generation and prearmed alarm survive.\n                await transaction.put(\n                  MAINTENANCE_STATE_KEY,\n                  encodeMaintenanceState(\n                    ThreadMaintenanceState.make({ ...state, lastServedThreadId: next }),\n                  ),\n                );\n              }\n\n              return next;\n            }),\n          );\n          yield* failpoint.hit(\"maintenance:select:after\");\n        }\n\n        // One FIFO head per event, across all local lanes. The runtime keeps its normal\n        // bounded Attempt and recovery contracts; followers belong to another alarm.\n        const settlement =\n          selected === undefined\n            ? Option.none()\n            : yield* runtime.processThreadHead(selected, { yieldAfter });\n\n        yield* finishDelivery;\n        if (Exit.isFailure(projected)) return yield* Effect.failCause(projected.cause);\n        // Observe residual state before acknowledging this exact pass-start generation.\n        const remaining = yield* Stream.runCollect(ledger.scanNonterminal);\n        const waitingHeads = new Map<ThreadId, boolean>();\n\n        const autonomous = remaining.some((snapshot) => {\n          const headWaiting = waitingHeads.get(snapshot.threadId);\n\n          if (headWaiting === undefined)\n            waitingHeads.set(snapshot.threadId, stableExternalWait(snapshot, reports));\n          // FIFO followers cannot execute through a stable external wait. Only plain queued\n          // input is dormant here; admission repairs and accepted aborts still need a pass.\n          if (\n            headWaiting === true &&\n            snapshot.state === \"ready\" &&\n            reports.get(snapshot.submissionId)?.decision._tag === \"ApplyInput\"\n          )\n            return false;\n\n          return !stableExternalWait(snapshot, reports);\n        });\n\n        const progressed =\n          Option.isSome(settlement) ||\n          recovered.some((report) => report.disposition === \"repaired\");\n\n        const delay = autonomous ? yield* rearmDelay(progressed) : 0;\n        const now = yield* Clock.currentTimeMillis;\n\n        yield* failpoint.hit(\"maintenance:finish:before\");\n\n        const alarmDisposition = yield* mutations.withSnapshot((active) =>\n          Effect.gen(function* () {\n            const publicationDeadline = yield* pendingDeadline;\n\n            return yield* runTransaction(\"finish maintenance pass\", () =>\n              ctx.storage.transaction(async (transaction) => {\n                const { state } = await readMaintenanceState(transaction);\n\n                // Autonomous work and in-flight mutations intentionally leave the observed\n                // generation dirty. Otherwise acknowledge only the pass-start generation.\n                const processed =\n                  autonomous || started.activeAtStart > 0 || active > 0\n                    ? state.processed\n                    : state.processed > started.generation\n                      ? state.processed\n                      : started.generation;\n\n                const next = ThreadMaintenanceState.make({\n                  ...state,\n                  processed,\n                  nonterminal: remaining.length,\n                });\n\n                await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));\n                if (autonomous) {\n                  // Replace the crash-fallback slot with this pass's bounded backoff. The target\n                  // is never earlier than the begin-pass fallback, so workerd does not cancel\n                  // this running alarm handler before its report/span can complete.\n                  await transaction.setAlarm(\n                    Option.isSome(publicationDeadline)\n                      ? Math.max(\n                          now + minimumAlarmDelay,\n                          Math.min(now + delay, publicationDeadline.value),\n                        )\n                      : now + delay,\n                  );\n\n                  return \"rearmed\" as const;\n                }\n                if (started.activeAtStart > 0 || active > 0 || next.dirty > next.processed) {\n                  // A mutation overlapped this pass's observation window or raced\n                  // acknowledgement. It stays dirty and its pre-armed bounded alarm survives;\n                  // unseen effects are never acknowledged. Do not accelerate that future alarm\n                  // from inside the current handler: workerd cancels a running handler when it\n                  // writes an earlier slot.\n                  await ensureTransactionAlarmBy(\n                    transaction,\n                    Option.isSome(publicationDeadline)\n                      ? Math.max(\n                          now + minimumAlarmDelay,\n                          Math.min(now + config.wakeScanInterval, publicationDeadline.value),\n                        )\n                      : now + config.wakeScanInterval,\n                  );\n\n                  return \"rearmed\" as const;\n                }\n                if (Option.isSome(publicationDeadline)) {\n                  await transaction.setAlarm(\n                    Math.max(now + minimumAlarmDelay, publicationDeadline.value),\n                  );\n\n                  return \"rearmed\" as const;\n                }\n                await transaction.deleteAlarm();\n\n                return \"cleared\" as const;\n              }),\n            );\n          }),\n        );\n\n        yield* failpoint.hit(\"maintenance:finish:after\");\n        if (alarmDisposition === \"cleared\") {\n          yield* Ref.set(stalls, 0);\n        }\n\n        return yield* annotate(\n          MaintenancePassReport.make({\n            phase: \"actionable\",\n            recovered: recovered.length,\n            settled: Option.isSome(settlement) ? 1 : 0,\n            nonterminal: remaining.length,\n            alarm: alarmDisposition,\n          }),\n        );\n      });\n\n      return ThreadMaintenance.of({\n        // A mid-pass immediate hint is droppable; durable dirty state decides the final alarm.\n        pass: Effect.gen(function* () {\n          const yieldAfter = DateTime.makeUnsafe((yield* Clock.currentTimeMillis) + 10 * 60_000);\n\n          return yield* alarm.withWakesDeferred(maintenancePassGate.withPermit(pass(yieldAfter)));\n        }).pipe(\n          // Include permit waiting, recovery and acknowledgement in the event deadline.\n          // Interruption releases Attempt ownership, leaving the prearmed dirty generation\n          // for recovery. It never changes the logical Run duration or settles a policy failure.\n          // This cooperative timer cannot preempt synchronous CPU work or stuck finalizers.\n          Effect.timeoutOrElse({\n            duration: \"14 minutes\",\n            orElse: () =>\n              DurableAlarmError.make({\n                operation: \"maintenance pass deadline\",\n                message:\n                  \"The maintenance event exceeded its 14 minute deadline; durable recovery remains pending\",\n              }),\n          }),\n        ),\n        ensureAlarm: mutations.withSnapshot(() => ensureAlarm()),\n        withMutation: (body) =>\n          mutations.withMutation(\n            body.pipe(\n              Effect.tap(() =>\n                publishCommitted.pipe(Effect.provideService(ThreadPublication, publication)),\n              ),\n            ),\n          ),\n      });\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,IAAa,oBAAb,cAAuC,OAAO,YAA+B,CAAC,CAC5E,qBACA;CACE,WAAW,OAAO;CAClB,SAAS,OAAO;CAChB,OAAO,OAAO,YAAY,OAAO,OAAO,CAAC;AAC3C,CACF,CAAC,CAAC,CAAC;AAEH,MAAM,gBACH,eACA,UACC,kBAAkB,KAAK;CACrB;CACA,SAAS,iBAAiB,OAAO,sDAAsD;CACvF;AACF,CAAC;;AAGL,IAAa,sBAAb,MAAa,4BAA4B,QAAQ,QA+B/C,CAAC,CAAC,uDAAuD,CAAC,CAAC;CAC3D,OAAgB,QACd,MAAM,OAAO,mBAAmB,CAAC,CAC/B,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,QAAQ,OAAO;;;;;;EAMvB,MAAM,gBAAgB,OAAO,IAAI,KAAK,CAAC;EAEvC,MAAM,YAAY,OAAO,WAAW;GAClC,WAAW,IAAI,QAAQ,SAAS;GAChC,OAAO,aAAa,WAAW;EACjC,CAAC,CAAC,CAAC,KACD,OAAO,KAAK,aACV,aAAa,OAAO,OAAO,KAAa,IAAI,OAAO,KAAK,QAAQ,CAClE,CACF;EAEA,MAAM,cAAc,gBAClB,OAAO,WAAW;GAChB,WAAW,IAAI,QAAQ,SAAS,WAAW;GAC3C,OAAO,aAAa,WAAW;EACjC,CAAC;EAEH,MAAM,qBAAqB,gBACzB,UAAU,KACR,OAAO,SAAS,aACd,OAAO,OAAO,QAAQ,KAAK,SAAS,SAAS,cACzC,OAAO,OACP,WAAW,WAAW,CAC5B,CACF;EAEF,MAAM,SAAS,MAAM,kBAAkB,KACrC,OAAO,SAAS,QAAQ,kBAAkB,GAAG,CAAC,CAChD;EAEA,MAAM,cAAc,IAAI,IAAI,aAAa,CAAC,CAAC,KACzC,OAAO,SAAS,WAAY,SAAS,IAAI,OAAO,OAAO,MAAO,CAChE;EAEA,MAAM,qBAA8B,SAClC,IAAI,OAAO,gBAAgB,WAAW,SAAS,CAAC,CAAC,CAAC,KAChD,OAAO,QAAQ,IAAI,GACnB,OAAO,SAAS,IAAI,OAAO,gBAAgB,WAAW,SAAS,CAAC,CAAC,CACnE;EAEF,MAAM,SAAS,OAAO,WAAW;GAC/B,WAAW,IAAI,QAAQ,YAAY;GACnC,OAAO,aAAa,cAAc;EACpC,CAAC;EAED,OAAO,oBAAoB,GAAG;GAC5B;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,CAAC,CACH;AACJ;;AAGA,IAAa,wBAAb,cAA2C,OAAO,MAChD,yDACF,CAAC,CAAC;;CAEA,OAAO,OAAO,SAAS,CAAC,aAAa,YAAY,CAAC;;CAElD,WAAW,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;CAE5D,SAAS,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;CAE1D,aAAa,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;CAE9D,OAAO,OAAO,SAAS,CAAC,WAAW,SAAS,CAAC;AAC/C,CAAC,CAAC,CAAC,CAAC;;AAsBJ,IAAa,6BAAb,cAAgD,QAAQ,QAKtD,CAAC,CAAC,8DAA8D,CAAC,CAAC;CAClE,OAAgB,QAAQ,MAAM,QAAQ,IAAI,CAAC,CAAC,EAAE,WAAW,OAAO,KAAK,CAAC;AACxE;;AAwBA,IAAa,oBAAb,cAAuC,QAAQ,QAG7C,CAAC,CAAC,qDAAqD,CAAC,CAAC;CACzD,OAAgB,QAAQ,MAAM,QAAQ,IAAI,CAAC,CAAC;EAC1C,YAAY,OAAO;EACnB,yBAAyB,OAAO;EAChC,OAAO,OAAO;EACd,iBAAiB,OAAO,QAAQ,OAAO,KAAK,CAAC;CAC/C,CAAC;AACH;;;;;;AAOA,MAAa,wBAAwB,QAAQ,UAO1C,2DAA2D,EAC5D,qBAAqB;CAAE,OAAO,OAAO;CAAM,iBAAiB,OAAO,QAAQ,OAAO,KAAK,CAAC;AAAE,GAC5F,CAAC;;;;;;;;;AAUD,MAAa,wBAAwB,QAAQ,UAK1C,2DAA2D,EAC5D,qBAAqB;CACnB,iBAAiB,OAAO,QAAQ,OAAO,KAAK,CAAC;CAC7C,kBAAkB,OAAO;AAC3B,GACF,CAAC;AAED,MAAM,oBACJ,MACA,UAEA,OAAO,OAAO,IAAI,IACd,OAAO,OAAO,KAAK,IACjB,OAAO,KAAK,KAAK,IAAI,KAAK,OAAO,MAAM,KAAK,CAAC,IAC7C,OACF;;AAGN,MAAa,mBAAmB,OAAO,IAAI,aAAa;CACtD,MAAM,cAAc,OAAO;CAE3B,OAAO,YAAY,WAAW,KAAK,OAAO,QAAQ,YAAY,KAAK,CAAC;AACtE,CAAC,CAAC,CAAC,KACD,OAAO,YAAY,UACjB,MAAM,cAAc,KAAK,IACrB,OAAO,YACP,OAAO,SAAS,mDAAmD,KAAK,CAC9E,CACF;AAEA,MAAM,wBAAwB,OAAO,iBAAiB,MACpD,OAAO,6BAA6B,EAAE,CACxC;;AAGA,IAAM,yBAAN,cAAqC,OAAO,MAC1C,0DACF,CAAC,CAAC;CACA,eAAe,OAAO,QAAQ,CAAC;CAC/B,OAAO;CACP,WAAW;CACX,aAAa,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;CAE9D,oBAAoB,OAAO,YAAY,QAAQ;AACjD,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,wBAAwB;AAC9B,MAAM,yBAAyB,OAAO,kBAAkB,sBAAsB;AAC9E,MAAM,yBAAyB,OAAO,WAAW,sBAAsB;AAEvE,MAAM,gCACJ,uBAAuB,KAAK;CAC1B,eAAe;CAGf,OAAO;CACP,WAAW;CACX,aAAa;AACf,CAAC;AAEH,MAAM,uBAAuB,OAC3B,gBACuF;CACvF,MAAM,UAAU,MAAM,YAAY,IAAI,qBAAqB;CAE3D,OAAO,YAAY,KAAA,IACf;EAAE,OAAO,wBAAwB;EAAG,aAAa;CAAM,IACvD;EAAE,OAAO,uBAAuB,OAAO;EAAG,aAAa;CAAK;AAClE;AAEA,MAAM,2BAA2B,OAC/B,aACA,aACkB;CAClB,MAAM,YAAY,MAAM,YAAY,SAAS;CAE7C,IAAI,cAAc,QAAQ,YAAY,UACpC,MAAM,YAAY,SAAS,QAAQ;AAEvC;AAEA,MAAM,sBACJ,UACA,YACY;CACZ,MAAM,WAAW,QAAQ,IAAI,SAAS,YAAY,CAAC,EAAE,SAAS;CAG9D,IAAI,aAAa,iBAAiB,OAAO;CACzC,QAAQ,SAAS,OAAjB;EACE,KAAK;EACL,KAAK,UACH,OAAO;EACT,KAAK,WACH,OAAO,aAAa,4BAA4B,aAAa;EAC/D,KAAK,YACH,OAAO,QAAQ,IAAI,SAAS,YAAY,CAAC,EAAE,SAAS,SAAS;EAC/D,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,iBACH,OAAO;CACX;AACF;;;;;;AAOA,IAAa,qBAAb,MAAa,2BAA2B,QAAQ,QAU9C,CAAC,CAAC,+DAA+D,CAAC,CAAC;CACnE,OAAgB,QAAQ,MAAM,OAAO,IAAI,CAAC,CACxC,OAAO,IAAI,aAAa;EACtB,MAAM,EAAE,QAAQ,OAAO;EACvB,MAAM,SAAS,OAAO;EACtB,MAAM,YAAY,OAAO;EAEzB,MAAM,kBAAkB,OAAO,IAAI,KAAK,CAAC;EACzC,MAAM,iBAAiB,OAAO,UAAU,KAAK,CAAC;EAC9C,MAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,mBAAmB,CAAC,CAAC;EAE5E,MAAM,kBAAqB,WAAmB,gBAC5C,OAAO,WAAW;GAAE,KAAK;GAAa,OAAO,aAAa,SAAS;EAAE,CAAC;EAExE,MAAM,gBAAgB,OAAO,GAAG,iCAAiC,CAAC,CAAC,aAAa;GAC9E,OAAO,UAAU,IAAI,0BAA0B;GAC/C,MAAM,MAAM,OAAO,MAAM;GAEzB,OAAO,eAAe,wCACpB,IAAI,QAAQ,YAAY,OAAO,gBAAgB;IAC7C,MAAM,EAAE,UAAU,MAAM,qBAAqB,WAAW;IAExD,MAAM,OAAO,uBAAuB,KAAK;KACvC,GAAG;KACH,OAAO,MAAM,QAAQ;IACvB,CAAC;IAED,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,IAAI,CAAC;IAGzE,MAAM,yBAAyB,aAAa,MAAM,iBAAiB;GACrE,CAAC,CACH;GACA,OAAO,UAAU,IAAI,yBAAyB;GAC9C,OAAO,IAAI,OAAO,kBAAkB,WAAW,SAAS,CAAC;EAC3D,CAAC;EAED,MAAM,cAAc,eAAe,WACjC,IAAI,OAAO,kBAAkB,WAAW,KAAK,IAAI,GAAG,SAAS,CAAC,CAAC,CACjE;EAEA,MAAM,gBACJ,SAEA,OAAO,kBACL,eAAe,WAAW,cAAc,CAAC,SAEvC,UAAU,IAAI,4BAA4B,CAAC,CAAC,KAC1C,OAAO,QAAQ,IAAI,GACnB,OAAO,UAAU,UAAU,IAAI,+BAA+B,CAAC,CACjE,SACI,WACR;EAEF,OAAO,mBAAmB,GAAG;GAC3B;GACA,eAAe,SACb,eAAe,WAAW,OAAO,QAAQ,IAAI,IAAI,eAAe,GAAG,IAAI,CAAC;EAC5E,CAAC;CACH,CAAC,CACH;AACF;;;;;;;;;;;;;;;AAsBA,IAAa,oBAAb,MAAa,0BAA0B,QAAQ,QAmB7C,CAAC,CAAC,qDAAqD,CAAC,CAAC;CACzD,OAAgB,QAYZ,MAAM,OAAO,iBAAiB,CAAC,CACjC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,OAAO;EACtB,MAAM,EAAE,QAAQ,OAAO;EACvB,MAAM,YAAY,OAAO;;;;;EAMzB,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;EAChC,MAAM,YAAY,OAAO;EACzB,MAAM,cAAc,OAAO;EAC3B,MAAM,aAAa,OAAO;EAC1B,MAAM,WAAW,OAAO;EACxB,MAAM,OAAO,OAAO;EAGpB,MAAM,qBAAqB,WAAW,gBAAgB,KACpD,OAAO,YAAY,UACjB,MAAM,cAAc,KAAK,IACrB,OAAO,UAAU,KAAK,IACtB,OAAO,SAAS,0CAA0C,KAAK,CAAC,CAAC,KAC/D,OAAO,GAAG,OAAO,KAAK,CAAC,CAAC,CAC1B,CACN,CACF;EAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;GAC9C,OAAO,iBACL,iBAAiB,OAAO,YAAY,iBAAiB,OAAO,SAAS,eAAe,GACpF,iBAAiB,OAAO,oBAAoB,OAAO,KAAK,eAAe,CACzE;EACF,CAAC;EAED,MAAM,sBAAsB,OAAO,UAAU,KAAK,CAAC;EACnD,MAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,mBAAmB,CAAC,CAAC;EAE5E,MAAM,kBAAqB,WAAmB,gBAC5C,OAAO,WAAW;GAAE,KAAK;GAAa,OAAO,aAAa,SAAS;EAAE,CAAC;EAExE,MAAM,cAAc,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;GAC1E,OAAO,UAAU,IAAI,2BAA2B;GAChD,MAAM,MAAM,OAAO,MAAM;GAEzB,OAAO,eAAe,kCACpB,IAAI,QAAQ,YAAY,OAAO,gBAAgB;IAC7C,MAAM,EAAE,OAAO,gBAAgB,MAAM,qBAAqB,WAAW;IAErE,IAAI,CAAC,aACH,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,KAAK,CAAC;IAE5E,IAAI,MAAM,QAAQ,MAAM,WACtB,MAAM,yBAAyB,aAAa,MAAM,OAAO,gBAAgB;GAE7E,CAAC,CACH;GACA,MAAM,WAAW,OAAO;GAExB,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,eAAe,kCACpB,IAAI,QAAQ,aAAa,gBACvB,yBACE,aACA,KAAK,IAAI,MAAM,mBAAmB,SAAS,KAAK,CAClD,CACF,CACF;GAEF,OAAO,UAAU,IAAI,0BAA0B;EACjD,CAAC;EAED,MAAM,YAAY,OAAO,GAAG,6BAA6B,CAAC,CAAC,aAAa;GACtE,OAAO,UAAU,IAAI,0BAA0B;GAC/C,MAAM,MAAM,OAAO,MAAM;GAEzB,MAAM,SAAS,OAAO,eAAe,gCACnC,IAAI,QAAQ,YAAY,OAAO,gBAAgB;IAC7C,MAAM,EAAE,OAAO,gBAAgB,MAAM,qBAAqB,WAAW;IAErE,IAAI,CAAC,aACH,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,KAAK,CAAC;IAE5E,IAAI,MAAM,aAAa,MAAM,OAAO;KAElC,MAAM,yBAAyB,aAAa,MAAM,iBAAiB;KAEnE,OAAO;MAAE,MAAM;MAAqB,aAAa,MAAM;KAAY;IACrE;IAGA,MAAM,yBAAyB,aAAa,MAAM,iBAAiB;IAEnE,OAAO;KACL,MAAM;KACN,YAAY,MAAM;KAClB,aAAa,MAAM;IACrB;GACF,CAAC,CACH;GAEA,OAAO,UAAU,IAAI,yBAAyB;GAE9C,OAAO;EACT,CAAC;EAED,MAAM,aAAa,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,YAAqB;GAC3F,MAAM,cAAc,OAAO,IAAI,aAAa,SAAS,UACnD,aAAa,IAAI,QAAQ,CAC3B;GAEA,IAAI,YAAY,OAAO,OAAO;GAC9B,MAAM,WAAW,KAAK,IAAI,aAAa,EAAE;GACzC,MAAM,UAAU,KAAK,IAAI,OAAO,iBAAiB,OAAO,mBAAmB,KAAK,QAAQ;GACxF,MAAM,SAAS,OAAO,OAAO;GAG7B,MAAM,WAAW,KAAK,KAAK,UAAU,IAAK,UAAU,IAAK,MAAM;GAE/D,OAAO,KAAK,IAAI,UAAU,OAAO,gBAAgB;EACnD,CAAC;EAED,MAAM,OAAO,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAC/C,YACiE;GACjE,MAAM,YAAY,WAChB,OAAO,oBAAoB;IACzB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,SAAS,OAAO;IAChB,aAAa,OAAO;IACpB,OAAO,OAAO;GAChB,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,MAAM,CAAC;GAE3B,MAAM,UAAU,OAAO,UAAU,cAAc,kBAC7C,OAAO,IAAI,aAAa;IACtB,MAAM,aAAa,OAAO,UAAU;IAEpC,IAAI,WAAW,SAAS,gBAAgB,kBAAkB,GAExD,OAAO,YAAY,kBAAkB,WAAW,UAAU;IAG5D,OAAO;KAAE,GAAG;KAAY;IAAc;GACxC,CAAC,CACH;GAKA,MAAM,mBAAmB,OAAO,SAAS,KAAW;GAEpD,MAAM,WAAW,OAAO,OAAO,UAC7B,SAAS,aAAa,gBAAgB,KAAK,SAAS,KACtD;GAEA,MAAM,WAAW,OAAO,OAAO,UAAU,KAAK,WAAW,gBAAgB,CAAC;GAE1E,MAAM,iBAAiB,SAAS,QAAQ,kBAAkB,KAAA,CAAS,CAAC,CAAC,KACnE,OAAO,QAAQ,MAAM,SAAS,CAAC,UAAU,QAAQ,CAAC,CAAC,GACnD,OAAO,SAAS,aACd,OAAO,QAAQ,WAAW,YAAY,SAAS,EAAE,SAAS,KAAK,CAAC,CAClE,CACF;GAIA,MAAM,YAAY,OAAO,OAAO,KAC9B,SAAS,KAAK,OAAO,eAAe,6BAA6B,UAAU,CAAC,CAC9E;GAEA,IAAI,KAAK,UAAU,SAAS,KAAK,MAAM,cAAc,UAAU,KAAK,GAClE,OAAO,OAAO,OAAO,UAAU,UAAU,KAAK;GAChD,MAAM,WAAW,OAAO,YAAY;GAEpC,IACE,QAAQ,SAAS,gBAChB,OAAO,OAAO,QAAQ,KAAK,SAAS,UAAU,OAAO,MAAM,oBAE5D,OAAO,YAAY;GAErB,MAAM,UAAU,OAAO,YAAY;GAEnC,IAAI,QAAQ,SAAS,cAAc,OAAO,OAAO,OAAO,GAAG;IACzD,OAAO;IACP,IAAI,KAAK,UAAU,SAAS,GAAG,OAAO,OAAO,OAAO,UAAU,UAAU,KAAK;IAC7E,OAAO,UAAU,IAAI,2BAA2B;IAEhD,MAAM,cAAc,OAAO,UAAU,cAAc,WACjD,OAAO,IAAI,aAAa;KAGtB,MAAM,SAAS,OAAO;KACtB,MAAM,MAAM,OAAO,MAAM;KAEzB,OAAO,OAAO,eAAe,iCAC3B,IAAI,QAAQ,YAAY,OAAO,gBAAgB;MAC7C,MAAM,EAAE,UAAU,MAAM,qBAAqB,WAAW;MAExD,MAAM,iBACJ,SAAS,KAAK,MAAM,QAAQ,MAAM,YAC9B,MAAM,OAAO,mBACb;MAEN,MAAM,OAAO,OAAO,OAAO,MAAM,IAC7B,KAAK,IAAI,gBAAgB,OAAO,KAAK,IACrC;MAEJ,IAAI,OAAO,SAAS,IAAI,GAAG;OACzB,MAAM,YAAY,SAAS,KAAK,IAAI,MAAM,mBAAmB,IAAI,CAAC;OAElE,OAAO;MACT;MACA,MAAM,YAAY,YAAY;MAE9B,OAAO;KACT,CAAC,CACH;IACF,CAAC,CACH;IAEA,OAAO,UAAU,IAAI,0BAA0B;IAE/C,OAAO,OAAO,SACZ,sBAAsB,KAAK;KACzB,OAAO;KACP,WAAW;KACX,SAAS;KACT,aAAa,QAAQ;KACrB,OAAO;IACT,CAAC,CACH;GACF;GAEA,MAAM,YAA2C,OAAO,QAAQ;GAChE,MAAM,UAAU,IAAI,IAAI,UAAU,KAAK,WAAW,CAAC,OAAO,cAAc,MAAM,CAAC,CAAC;GAChF,MAAM,UAAU,OAAO,OAAO,WAAW,OAAO,eAAe;GAC/D,MAAM,wBAAQ,IAAI,IAAkC;GAEpD,KAAK,MAAM,OAAO,SAChB,IAAI,CAAC,MAAM,IAAI,IAAI,QAAQ,GAAG,MAAM,IAAI,IAAI,UAAU,GAAG;GAG3D,MAAM,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CACjC,QAAQ,SAAS,CAAC,mBAAmB,MAAM,OAAO,CAAC,CAAC,CACpD,KAAK,SAAS,KAAK,QAAQ,CAAC,CAC5B,KAAK;GAER,IAAI,WAAW,SAAS;GAExB,IAAI,MAAM,OAAO,KAAK,aAAa,KAAA,GAAW;IAC5C,OAAO,UAAU,IAAI,2BAA2B;IAChD,WAAW,OAAO,eAAe,iCAC/B,IAAI,QAAQ,YAAY,OAAO,gBAAgB;KAC7C,MAAM,EAAE,UAAU,MAAM,qBAAqB,WAAW;KAExD,MAAM,OACJ,SAAS,MACN,aACC,MAAM,uBAAuB,KAAA,KAAa,WAAW,MAAM,kBAC/D,KAAK,SAAS;KAEhB,IAAI,SAAS,KAAA,GAGX,MAAM,YAAY,IAChB,uBACA,uBACE,uBAAuB,KAAK;MAAE,GAAG;MAAO,oBAAoB;KAAK,CAAC,CACpE,CACF;KAGF,OAAO;IACT,CAAC,CACH;IACA,OAAO,UAAU,IAAI,0BAA0B;GACjD;GAIA,MAAM,aACJ,aAAa,KAAA,IACT,OAAO,KAAK,IACZ,OAAO,QAAQ,kBAAkB,UAAU,EAAE,WAAW,CAAC;GAE/D,OAAO;GACP,IAAI,KAAK,UAAU,SAAS,GAAG,OAAO,OAAO,OAAO,UAAU,UAAU,KAAK;GAE7E,MAAM,YAAY,OAAO,OAAO,WAAW,OAAO,eAAe;GACjE,MAAM,+BAAe,IAAI,IAAuB;GAEhD,MAAM,aAAa,UAAU,MAAM,aAAa;IAC9C,MAAM,cAAc,aAAa,IAAI,SAAS,QAAQ;IAEtD,IAAI,gBAAgB,KAAA,GAClB,aAAa,IAAI,SAAS,UAAU,mBAAmB,UAAU,OAAO,CAAC;IAG3E,IACE,gBAAgB,QAChB,SAAS,UAAU,WACnB,QAAQ,IAAI,SAAS,YAAY,CAAC,EAAE,SAAS,SAAS,cAEtD,OAAO;IAET,OAAO,CAAC,mBAAmB,UAAU,OAAO;GAC9C,CAAC;GAED,MAAM,aACJ,OAAO,OAAO,UAAU,KACxB,UAAU,MAAM,WAAW,OAAO,gBAAgB,UAAU;GAE9D,MAAM,QAAQ,aAAa,OAAO,WAAW,UAAU,IAAI;GAC3D,MAAM,MAAM,OAAO,MAAM;GAEzB,OAAO,UAAU,IAAI,2BAA2B;GAEhD,MAAM,mBAAmB,OAAO,UAAU,cAAc,WACtD,OAAO,IAAI,aAAa;IACtB,MAAM,sBAAsB,OAAO;IAEnC,OAAO,OAAO,eAAe,iCAC3B,IAAI,QAAQ,YAAY,OAAO,gBAAgB;KAC7C,MAAM,EAAE,UAAU,MAAM,qBAAqB,WAAW;KAIxD,MAAM,YACJ,cAAc,QAAQ,gBAAgB,KAAK,SAAS,IAChD,MAAM,YACN,MAAM,YAAY,QAAQ,aACxB,MAAM,YACN,QAAQ;KAEhB,MAAM,OAAO,uBAAuB,KAAK;MACvC,GAAG;MACH;MACA,aAAa,UAAU;KACzB,CAAC;KAED,MAAM,YAAY,IAAI,uBAAuB,uBAAuB,IAAI,CAAC;KACzE,IAAI,YAAY;MAId,MAAM,YAAY,SAChB,OAAO,OAAO,mBAAmB,IAC7B,KAAK,IACH,MAAM,mBACN,KAAK,IAAI,MAAM,OAAO,oBAAoB,KAAK,CACjD,IACA,MAAM,KACZ;MAEA,OAAO;KACT;KACA,IAAI,QAAQ,gBAAgB,KAAK,SAAS,KAAK,KAAK,QAAQ,KAAK,WAAW;MAM1E,MAAM,yBACJ,aACA,OAAO,OAAO,mBAAmB,IAC7B,KAAK,IACH,MAAM,mBACN,KAAK,IAAI,MAAM,OAAO,kBAAkB,oBAAoB,KAAK,CACnE,IACA,MAAM,OAAO,gBACnB;MAEA,OAAO;KACT;KACA,IAAI,OAAO,OAAO,mBAAmB,GAAG;MACtC,MAAM,YAAY,SAChB,KAAK,IAAI,MAAM,mBAAmB,oBAAoB,KAAK,CAC7D;MAEA,OAAO;KACT;KACA,MAAM,YAAY,YAAY;KAE9B,OAAO;IACT,CAAC,CACH;GACF,CAAC,CACH;GAEA,OAAO,UAAU,IAAI,0BAA0B;GAC/C,IAAI,qBAAqB,WACvB,OAAO,IAAI,IAAI,QAAQ,CAAC;GAG1B,OAAO,OAAO,SACZ,sBAAsB,KAAK;IACzB,OAAO;IACP,WAAW,UAAU;IACrB,SAAS,OAAO,OAAO,UAAU,IAAI,IAAI;IACzC,aAAa,UAAU;IACvB,OAAO;GACT,CAAC,CACH;EACF,CAAC;EAED,OAAO,kBAAkB,GAAG;GAE1B,MAAM,OAAO,IAAI,aAAa;IAC5B,MAAM,aAAa,SAAS,YAAY,OAAO,MAAM,qBAAqB,GAAW;IAErF,OAAO,OAAO,MAAM,kBAAkB,oBAAoB,WAAW,KAAK,UAAU,CAAC,CAAC;GACxF,CAAC,CAAC,CAAC,KAKD,OAAO,cAAc;IACnB,UAAU;IACV,cACE,kBAAkB,KAAK;KACrB,WAAW;KACX,SACE;IACJ,CAAC;GACL,CAAC,CACH;GACA,aAAa,UAAU,mBAAmB,YAAY,CAAC;GACvD,eAAe,SACb,UAAU,aACR,KAAK,KACH,OAAO,UACL,iBAAiB,KAAK,OAAO,eAAe,mBAAmB,WAAW,CAAC,CAC7E,CACF,CACF;EACJ,CAAC;CACH,CAAC,CACH;AACF"}

package/dist/BrowserRestCapture.d.mts

@@ -0,0 +1,35 @@
+import { o as BrowserQuickActionWorkersAi, s as BrowserQuickActionWorkersAiPolicy } from "./CloudflareBrowser-DJq53niJ.mjs";
+import { Layer, Redacted } from "effect";
+import { PageCapture } from "@effect-agent/sandbox/PageCapture";
+import { SandboxImplementation } from "@effect-agent/sandbox/Sandbox";
+import { HttpClient } from "effect/unstable/http";
+//#region src/BrowserRestCapture.d.ts
+/** Node-safe REST PageCapture implementation; it never imports Worker runtime modules. */
+declare const browserRestCaptureImplementation: SandboxImplementation;
+/** Explicit construction inputs; credentials are only projected into the fixed-origin Authorization header. */
+interface BrowserRestCaptureOptions {
+  readonly accountId: string;
+  readonly apiToken: Redacted.Redacted<string>;
+}
+/** REST PageCapture layer for Node and other non-Worker composition roots. */
+declare const browserRestCaptureLayer: (options: BrowserRestCaptureOptions) => Layer.Layer<PageCapture, never, HttpClient.HttpClient>;
+/** REST structured extraction additionally requires explicit Workers AI authorization/accounting. */
+declare const browserRestWorkersAiCaptureLayer: (options: BrowserRestCaptureOptions) => Layer.Layer<PageCapture, never, HttpClient.HttpClient | BrowserQuickActionWorkersAi>;
+/** Explicit REST credentials and optional authorization for separately billed extraction. */
+interface CloudflareBrowserRestOptions extends BrowserRestCaptureOptions {
+  readonly workersAi?: BrowserQuickActionWorkersAiPolicy;
+}
+/** Node-safe WebCapture handler assembly; the application supplies its HttpClient. */
+declare const CloudflareBrowserRest: {
+  /**
+   * Supports capture, scrape, and extraction definitions. Only PageCapture is supplied;
+   * handler errors and other services remain visible. Extraction fails closed without
+   * workersAi. Existing host policies, response limits, and scoped cleanup are unchanged.
+   */
+  layer: <A, E, R>(definition: {
+    readonly handlers: Layer.Layer<A, E, R>;
+  }, options: CloudflareBrowserRestOptions) => Layer.Layer<A, E, Exclude<R, PageCapture> | HttpClient.HttpClient>;
+};
+//#endregion
+export { BrowserRestCaptureOptions, CloudflareBrowserRest, CloudflareBrowserRestOptions, browserRestCaptureImplementation, browserRestCaptureLayer, browserRestWorkersAiCaptureLayer };
+//# sourceMappingURL=BrowserRestCapture.d.mts.map

package/dist/BrowserRestCapture.mjs

@@ -0,0 +1,238 @@
+import { i as BrowserQuickActionWorkersAi } from "./CloudflareBrowser-D4YqaTAl.mjs";
+import { Effect, Layer, Option, Redacted, Schema, Stream } from "effect";
+import { PageCapture, PageCaptureInferencePolicyError, PageCaptureInferenceUse, PageCaptureNavigationError, PageCaptureOutputLimitError, PageCaptureProtocolError, PageCaptureRateLimitedError, PageCaptureResourceUse, PageCaptureResult, PageCaptureUnsupportedError, PageContentCaptured, PageLinksCaptured, PageMarkdownCaptured, PageScrapeCaptured, PageStructuredCaptured } from "@effect-agent/sandbox/PageCapture";
+import { SandboxImplementation } from "@effect-agent/sandbox/Sandbox";
+import { HttpClient, HttpClientRequest } from "effect/unstable/http";
+//#region src/BrowserRestCapture.ts
+/** Node-safe REST PageCapture implementation; it never imports Worker runtime modules. */
+const browserRestCaptureImplementation = SandboxImplementation.make({
+	isolation: "isolated",
+	identity: "cloudflare-browser-rest"
+});
+const API_ORIGIN = "https://api.cloudflare.com";
+const MAX_DIAGNOSTIC_LENGTH = 8e3;
+const boundedDiagnostic = (message) => message.slice(0, MAX_DIAGNOSTIC_LENGTH);
+const RestSuccessEnvelope = Schema.Struct({
+	success: Schema.Literal(true),
+	result: Schema.Json,
+	errors: Schema.optionalKey(Schema.Array(Schema.Unknown)),
+	meta: Schema.optionalKey(Schema.Unknown)
+});
+const RestErrorEnvelope = Schema.Struct({
+	success: Schema.Literal(false),
+	errors: Schema.Array(Schema.Struct({
+		message: Schema.String,
+		code: Schema.optionalKey(Schema.Number)
+	})),
+	result: Schema.optionalKey(Schema.Json),
+	meta: Schema.optionalKey(Schema.Unknown)
+});
+const RestEnvelope = Schema.Union([RestSuccessEnvelope, RestErrorEnvelope]);
+const decodeEnvelope = Schema.decodeUnknownOption(Schema.fromJsonString(RestEnvelope));
+const protocolError = (message, cause) => PageCaptureProtocolError.make({
+	implementation: browserRestCaptureImplementation,
+	message: boundedDiagnostic(message),
+	...cause === void 0 ? {} : { cause }
+});
+const navigationError = (message, cause) => PageCaptureNavigationError.make({
+	implementation: browserRestCaptureImplementation,
+	message: boundedDiagnostic(message),
+	...cause === void 0 ? {} : { cause }
+});
+const privateResponseCause = (bodyText, apiToken) => {
+	if (bodyText.length === 0) return void 0;
+	const token = Redacted.value(apiToken);
+	const diagnostic = boundedDiagnostic(bodyText);
+	return new Error(token.length === 0 ? diagnostic : diagnostic.replaceAll(token, "[REDACTED]"));
+};
+const requestBody = (request) => {
+	const body = request.target._tag === "PageUrlTarget" ? { url: request.target.url } : { html: request.target.html };
+	if (request.navigation !== void 0) {
+		const goto = {};
+		if (request.navigation.waitUntil !== void 0) goto.waitUntil = request.navigation.waitUntil;
+		if (request.navigation.timeoutMillis !== void 0) goto.timeout = request.navigation.timeoutMillis;
+		if (Object.keys(goto).length > 0) body.gotoOptions = goto;
+		if (request.navigation.waitForSelector !== void 0) body.waitForSelector = {
+			selector: request.navigation.waitForSelector.selector,
+			...request.navigation.waitForSelector.timeoutMillis === void 0 ? {} : { timeout: request.navigation.waitForSelector.timeoutMillis }
+		};
+	}
+	if (request.viewport !== void 0) body.viewport = request.viewport;
+	if (request.resourcePolicy?.rejectResourceTypes !== void 0) body.rejectResourceTypes = [...request.resourcePolicy.rejectResourceTypes];
+	if (request.resourcePolicy?.allowRequestPatterns !== void 0) body.allowRequestPattern = [...request.resourcePolicy.allowRequestPatterns];
+	return body;
+};
+const actionName = (action) => {
+	switch (action._tag) {
+		case "CapturePageContent": return "content";
+		case "CapturePageMarkdown": return "markdown";
+		case "CapturePageLinks": return "links";
+		case "CapturePageScrape": return "scrape";
+		case "CapturePageStructured": return "json";
+	}
+};
+const actionBody = (request) => {
+	const body = requestBody(request);
+	switch (request.action._tag) {
+		case "CapturePageContent":
+		case "CapturePageMarkdown": return body;
+		case "CapturePageLinks": return {
+			...body,
+			...request.action.visibleLinksOnly === void 0 ? {} : { visibleLinksOnly: request.action.visibleLinksOnly }
+		};
+		case "CapturePageScrape": return {
+			...body,
+			elements: request.action.selectors.map((selector) => ({ selector }))
+		};
+		case "CapturePageStructured": return {
+			...body,
+			response_format: {
+				type: "json_schema",
+				json_schema: request.action.responseFormat
+			},
+			...request.action.prompt === void 0 ? {} : { prompt: request.action.prompt }
+		};
+	}
+};
+const retryAfterMillis = (headers) => {
+	const seconds = Number(headers["retry-after"]);
+	if (!Number.isSafeInteger(seconds) || seconds < 0) return void 0;
+	const millis = seconds * 1e3;
+	return Number.isSafeInteger(millis) ? millis : void 0;
+};
+const browserMillis = (headers) => {
+	const millis = Number(headers["x-browser-ms-used"]);
+	return Number.isSafeInteger(millis) && millis >= 0 ? millis : void 0;
+};
+/** Response framing is provider metadata, never content controlled by the rendered page. */
+const isJsonResponse = (headers) => {
+	const contentType = headers["content-type"];
+	if (contentType === void 0) return false;
+	const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase();
+	return mediaType === "application/json" || mediaType?.endsWith("+json") === true;
+};
+const readBoundedResponse = Effect.fn("BrowserRestCapture.readResponse")(function* (response, request) {
+	const decoder = new TextDecoder("utf-8", {
+		fatal: true,
+		ignoreBOM: false
+	});
+	const chunks = yield* Stream.runFoldEffect(response.stream, () => ({
+		observed: 0,
+		text: ""
+	}), (state, chunk) => {
+		const observed = state.observed + chunk.byteLength;
+		if (observed > request.limits.maxOutputBytes) return Effect.fail(PageCaptureOutputLimitError.make({
+			implementation: browserRestCaptureImplementation,
+			limit: request.limits.maxOutputBytes,
+			observed
+		}));
+		return Effect.try({
+			try: () => ({
+				observed,
+				text: state.text + decoder.decode(chunk, { stream: true })
+			}),
+			catch: (cause) => protocolError("Decoding the Browser Run response failed", cause)
+		});
+	}).pipe(Effect.mapError((error) => Schema.is(PageCaptureOutputLimitError)(error) || Schema.is(PageCaptureProtocolError)(error) ? error : protocolError("Reading the Browser Run response failed", error)));
+	return yield* Effect.try({
+		try: () => chunks.text + decoder.decode(),
+		catch: (cause) => protocolError("Decoding the Browser Run response failed", cause)
+	});
+});
+const parseOutput = (action, bodyText, apiToken) => {
+	const envelope = decodeEnvelope(bodyText);
+	if (Option.isNone(envelope)) return protocolError("The Browser Run response did not carry a valid response envelope", privateResponseCause(bodyText, apiToken));
+	if (!envelope.value.success) return navigationError("Browser Run reported a navigation failure", privateResponseCause(bodyText, apiToken));
+	switch (action._tag) {
+		case "CapturePageContent":
+		case "CapturePageMarkdown":
+			if (typeof envelope.value.result !== "string") return protocolError("The Browser Run response envelope carried a non-text result");
+			return action._tag === "CapturePageContent" ? PageContentCaptured.make({ html: envelope.value.result }) : PageMarkdownCaptured.make({ markdown: envelope.value.result });
+		case "CapturePageLinks": {
+			const decoded = Schema.decodeUnknownOption(PageLinksCaptured)({
+				_tag: "PageLinksCaptured",
+				links: envelope.value.result
+			});
+			return Option.isSome(decoded) ? decoded.value : protocolError("Browser Run links did not return a bounded array of valid URLs");
+		}
+		case "CapturePageScrape": {
+			const decoded = Schema.decodeUnknownOption(PageScrapeCaptured)({
+				_tag: "PageScrapeCaptured",
+				groups: envelope.value.result
+			});
+			return Option.isSome(decoded) ? decoded.value : protocolError("Browser Run scrape did not return bounded grouped element records");
+		}
+		case "CapturePageStructured": return PageStructuredCaptured.make({ value: envelope.value.result });
+	}
+};
+const isQuotaMessage = (text) => /time limit|daily|quota/i.test(text);
+const makeCapture = (client, options, workersAi) => Effect.fn("BrowserRestCapture.capture")(function* (request) {
+	const usesWorkersAi = request.action._tag === "CapturePageStructured";
+	if (usesWorkersAi) {
+		if (workersAi === void 0) return yield* PageCaptureUnsupportedError.make({
+			implementation: browserRestCaptureImplementation,
+			feature: "action",
+			message: "Structured capture invokes separately billed Workers AI and requires an explicit authorization and accounting policy"
+		});
+		yield* workersAi.authorizeAndAccount(request).pipe(Effect.mapError((cause) => PageCaptureInferencePolicyError.make({
+			implementation: browserRestCaptureImplementation,
+			provider: "cloudflare-workers-ai",
+			reason: cause.reason,
+			message: cause.reason === "authorization" ? "Workers AI extraction was not authorized" : "Workers AI extraction could not be accounted for",
+			cause
+		})));
+	}
+	const action = actionName(request.action);
+	const path = `${API_ORIGIN}/client/v4/accounts/${encodeURIComponent(options.accountId)}/browser-rendering/${action}`;
+	const requestWithBody = yield* HttpClientRequest.post(path).pipe(request.engine === "kitesurf" ? HttpClientRequest.setUrlParam("browser", "kitesurf") : (value) => value, HttpClientRequest.bearerToken(options.apiToken), HttpClientRequest.acceptJson, HttpClientRequest.bodyJson(actionBody(request)), Effect.mapError((cause) => protocolError("Encoding the Browser Run request failed", cause)));
+	const response = yield* client.execute(requestWithBody).pipe(Effect.mapError((cause) => protocolError("Calling the Browser Run REST API failed", cause)));
+	const bodyText = yield* readBoundedResponse(response, request);
+	if (response.status === 429) {
+		const reason = isQuotaMessage(bodyText) ? "quota" : "rate";
+		return yield* PageCaptureRateLimitedError.make({
+			implementation: browserRestCaptureImplementation,
+			reason,
+			...retryAfterMillis(response.headers) === void 0 ? {} : { retryAfterMillis: retryAfterMillis(response.headers) },
+			...privateResponseCause(bodyText, options.apiToken) === void 0 ? {} : { cause: privateResponseCause(bodyText, options.apiToken) },
+			message: reason === "quota" ? "Browser Run exceeded its browser quota" : "Browser Run was rate limited"
+		});
+	}
+	if (response.status < 200 || response.status >= 300) return yield* response.status >= 500 ? protocolError(`Browser Run answered HTTP ${String(response.status)}`, privateResponseCause(bodyText, options.apiToken)) : navigationError(`Browser Run answered HTTP ${String(response.status)}`, privateResponseCause(bodyText, options.apiToken));
+	if (!isJsonResponse(response.headers)) return yield* protocolError("The Browser Run success response was not a JSON response envelope", privateResponseCause(bodyText, options.apiToken));
+	const output = parseOutput(request.action, bodyText, options.apiToken);
+	if (output._tag === "PageCaptureNavigationError" || output._tag === "PageCaptureProtocolError") return yield* output;
+	return PageCaptureResult.make({
+		implementation: browserRestCaptureImplementation,
+		output,
+		resourceUse: PageCaptureResourceUse.make({
+			...browserMillis(response.headers) === void 0 ? {} : { browserMillis: browserMillis(response.headers) },
+			...usesWorkersAi ? { inference: PageCaptureInferenceUse.make({
+				provider: "cloudflare-workers-ai",
+				modelCalls: 1
+			}) } : {}
+		})
+	});
+});
+/** REST PageCapture layer for Node and other non-Worker composition roots. */
+const browserRestCaptureLayer = (options) => Layer.effect(PageCapture, Effect.map(HttpClient.HttpClient, (client) => PageCapture.of({ capture: makeCapture(client, options) })));
+/** REST structured extraction additionally requires explicit Workers AI authorization/accounting. */
+const browserRestWorkersAiCaptureLayer = (options) => Layer.effect(PageCapture, Effect.gen(function* () {
+	const client = yield* HttpClient.HttpClient;
+	const workersAi = yield* BrowserQuickActionWorkersAi;
+	return PageCapture.of({ capture: makeCapture(client, options, workersAi) });
+}));
+/** Node-safe WebCapture handler assembly; the application supplies its HttpClient. */
+const CloudflareBrowserRest = { 
+/**
+* Supports capture, scrape, and extraction definitions. Only PageCapture is supplied;
+* handler errors and other services remain visible. Extraction fails closed without
+* workersAi. Existing host policies, response limits, and scoped cleanup are unchanged.
+*/
+layer: (definition, options) => {
+	const capture = options.workersAi === void 0 ? browserRestCaptureLayer(options) : browserRestWorkersAiCaptureLayer(options).pipe(Layer.provide(BrowserQuickActionWorkersAi.layer(options.workersAi)));
+	return definition.handlers.pipe(Layer.provide(capture));
+} };
+//#endregion
+export { CloudflareBrowserRest, browserRestCaptureImplementation, browserRestCaptureLayer, browserRestWorkersAiCaptureLayer };
+
+//# sourceMappingURL=BrowserRestCapture.mjs.map

package/dist/BrowserRestCapture.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserRestCapture.mjs","names":[],"sources":["../src/BrowserRestCapture.ts"],"sourcesContent":["import {\n  PageCapture,\n  PageCaptureInferencePolicyError,\n  PageCaptureInferenceUse,\n  PageCaptureNavigationError,\n  PageCaptureOutputLimitError,\n  PageCaptureProtocolError,\n  PageCaptureRateLimitedError,\n  PageCaptureResourceUse,\n  PageCaptureResult,\n  PageContentCaptured,\n  PageLinksCaptured,\n  PageMarkdownCaptured,\n  PageScrapeCaptured,\n  PageStructuredCaptured,\n  PageCaptureUnsupportedError,\n  type PageCaptureAction,\n  type PageCaptureCapture,\n  type PageCaptureError,\n  type PageCaptureOutput,\n  type PageCaptureRequest,\n} from \"@effect-agent/sandbox/PageCapture\";\nimport { SandboxImplementation } from \"@effect-agent/sandbox/Sandbox\";\nimport { Effect, Layer, Option, Redacted, Schema, Stream } from \"effect\";\nimport { HttpClient, HttpClientRequest, type HttpClientError } from \"effect/unstable/http\";\n\nimport {\n  BrowserQuickActionWorkersAi,\n  type BrowserQuickActionWorkersAiPolicy,\n} from \"./CloudflareBrowser.ts\";\n\n/** Node-safe REST PageCapture implementation; it never imports Worker runtime modules. */\nexport const browserRestCaptureImplementation = SandboxImplementation.make({\n  isolation: \"isolated\",\n  identity: \"cloudflare-browser-rest\",\n});\n\nconst API_ORIGIN = \"https://api.cloudflare.com\";\nconst MAX_DIAGNOSTIC_LENGTH = 8_000;\nconst boundedDiagnostic = (message: string): string => message.slice(0, MAX_DIAGNOSTIC_LENGTH);\n\n/** Explicit construction inputs; credentials are only projected into the fixed-origin Authorization header. */\nexport interface BrowserRestCaptureOptions {\n  readonly accountId: string;\n  readonly apiToken: Redacted.Redacted<string>;\n}\n\nconst RestSuccessEnvelope = Schema.Struct({\n  success: Schema.Literal(true),\n  result: Schema.Json,\n  errors: Schema.optionalKey(Schema.Array(Schema.Unknown)),\n  meta: Schema.optionalKey(Schema.Unknown),\n});\n\nconst RestErrorEnvelope = Schema.Struct({\n  success: Schema.Literal(false),\n  errors: Schema.Array(\n    Schema.Struct({\n      message: Schema.String,\n      code: Schema.optionalKey(Schema.Number),\n    }),\n  ),\n  result: Schema.optionalKey(Schema.Json),\n  meta: Schema.optionalKey(Schema.Unknown),\n});\n\nconst RestEnvelope = Schema.Union([RestSuccessEnvelope, RestErrorEnvelope]);\nconst decodeEnvelope = Schema.decodeUnknownOption(Schema.fromJsonString(RestEnvelope));\n\nconst protocolError = (message: string, cause?: unknown): PageCaptureProtocolError =>\n  PageCaptureProtocolError.make({\n    implementation: browserRestCaptureImplementation,\n    message: boundedDiagnostic(message),\n    ...(cause === undefined ? {} : { cause }),\n  });\n\nconst navigationError = (message: string, cause?: unknown): PageCaptureNavigationError =>\n  PageCaptureNavigationError.make({\n    implementation: browserRestCaptureImplementation,\n    message: boundedDiagnostic(message),\n    ...(cause === undefined ? {} : { cause }),\n  });\n\nconst privateResponseCause = (\n  bodyText: string,\n  apiToken: Redacted.Redacted<string>,\n): Error | undefined => {\n  if (bodyText.length === 0) return undefined;\n  const token = Redacted.value(apiToken);\n  const diagnostic = boundedDiagnostic(bodyText);\n\n  return new Error(token.length === 0 ? diagnostic : diagnostic.replaceAll(token, \"[REDACTED]\"));\n};\n\nconst requestBody = (request: PageCaptureRequest): Record<string, unknown> => {\n  const body: Record<string, unknown> =\n    request.target._tag === \"PageUrlTarget\"\n      ? { url: request.target.url }\n      : { html: request.target.html };\n\n  if (request.navigation !== undefined) {\n    const goto: Record<string, unknown> = {};\n\n    if (request.navigation.waitUntil !== undefined) goto.waitUntil = request.navigation.waitUntil;\n    if (request.navigation.timeoutMillis !== undefined)\n      goto.timeout = request.navigation.timeoutMillis;\n    if (Object.keys(goto).length > 0) body.gotoOptions = goto;\n    if (request.navigation.waitForSelector !== undefined) {\n      body.waitForSelector = {\n        selector: request.navigation.waitForSelector.selector,\n        ...(request.navigation.waitForSelector.timeoutMillis === undefined\n          ? {}\n          : { timeout: request.navigation.waitForSelector.timeoutMillis }),\n      };\n    }\n  }\n  if (request.viewport !== undefined) body.viewport = request.viewport;\n  if (request.resourcePolicy?.rejectResourceTypes !== undefined) {\n    body.rejectResourceTypes = [...request.resourcePolicy.rejectResourceTypes];\n  }\n  if (request.resourcePolicy?.allowRequestPatterns !== undefined) {\n    body.allowRequestPattern = [...request.resourcePolicy.allowRequestPatterns];\n  }\n\n  return body;\n};\n\nconst actionName = (\n  action: PageCaptureAction,\n): \"content\" | \"markdown\" | \"links\" | \"scrape\" | \"json\" => {\n  switch (action._tag) {\n    case \"CapturePageContent\":\n      return \"content\";\n    case \"CapturePageMarkdown\":\n      return \"markdown\";\n    case \"CapturePageLinks\":\n      return \"links\";\n    case \"CapturePageScrape\":\n      return \"scrape\";\n    case \"CapturePageStructured\":\n      return \"json\";\n  }\n};\n\nconst actionBody = (request: PageCaptureRequest): Record<string, unknown> => {\n  const body = requestBody(request);\n\n  switch (request.action._tag) {\n    case \"CapturePageContent\":\n    case \"CapturePageMarkdown\":\n      return body;\n    case \"CapturePageLinks\":\n      return {\n        ...body,\n        ...(request.action.visibleLinksOnly === undefined\n          ? {}\n          : { visibleLinksOnly: request.action.visibleLinksOnly }),\n      };\n    case \"CapturePageScrape\":\n      return {\n        ...body,\n        elements: request.action.selectors.map((selector) => ({ selector })),\n      };\n    case \"CapturePageStructured\":\n      return {\n        ...body,\n        response_format: { type: \"json_schema\", json_schema: request.action.responseFormat },\n        ...(request.action.prompt === undefined ? {} : { prompt: request.action.prompt }),\n      };\n  }\n};\n\nconst retryAfterMillis = (\n  headers: Readonly<Record<string, string | undefined>>,\n): number | undefined => {\n  const seconds = Number(headers[\"retry-after\"]);\n\n  if (!Number.isSafeInteger(seconds) || seconds < 0) return undefined;\n  const millis = seconds * 1_000;\n\n  return Number.isSafeInteger(millis) ? millis : undefined;\n};\n\nconst browserMillis = (\n  headers: Readonly<Record<string, string | undefined>>,\n): number | undefined => {\n  const millis = Number(headers[\"x-browser-ms-used\"]);\n\n  return Number.isSafeInteger(millis) && millis >= 0 ? millis : undefined;\n};\n\n/** Response framing is provider metadata, never content controlled by the rendered page. */\nconst isJsonResponse = (headers: Readonly<Record<string, string | undefined>>): boolean => {\n  const contentType = headers[\"content-type\"];\n\n  if (contentType === undefined) return false;\n  const mediaType = contentType.split(\";\", 1)[0]?.trim().toLowerCase();\n\n  return mediaType === \"application/json\" || mediaType?.endsWith(\"+json\") === true;\n};\n\nconst readBoundedResponse = Effect.fn(\"BrowserRestCapture.readResponse\")(function* (\n  response: { readonly stream: Stream.Stream<Uint8Array, HttpClientError.HttpClientError> },\n  request: PageCaptureRequest,\n): Effect.fn.Return<string, PageCaptureError> {\n  const decoder = new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: false });\n\n  const chunks = yield* Stream.runFoldEffect<\n    Uint8Array,\n    HttpClientError.HttpClientError,\n    never,\n    { readonly observed: number; readonly text: string },\n    PageCaptureOutputLimitError | PageCaptureProtocolError,\n    never\n  >(\n    response.stream,\n    () => ({ observed: 0, text: \"\" }),\n    (state, chunk) => {\n      const observed = state.observed + chunk.byteLength;\n\n      if (observed > request.limits.maxOutputBytes) {\n        return Effect.fail(\n          PageCaptureOutputLimitError.make({\n            implementation: browserRestCaptureImplementation,\n            limit: request.limits.maxOutputBytes,\n            observed,\n          }),\n        );\n      }\n\n      return Effect.try({\n        try: () => ({ observed, text: state.text + decoder.decode(chunk, { stream: true }) }),\n        catch: (cause) => protocolError(\"Decoding the Browser Run response failed\", cause),\n      });\n    },\n  ).pipe(\n    Effect.mapError((error) =>\n      Schema.is(PageCaptureOutputLimitError)(error) || Schema.is(PageCaptureProtocolError)(error)\n        ? error\n        : protocolError(\"Reading the Browser Run response failed\", error),\n    ),\n  );\n\n  return yield* Effect.try({\n    try: () => chunks.text + decoder.decode(),\n    catch: (cause) => protocolError(\"Decoding the Browser Run response failed\", cause),\n  });\n});\n\nconst parseOutput = (\n  action: PageCaptureAction,\n  bodyText: string,\n  apiToken: Redacted.Redacted<string>,\n): PageCaptureOutput | PageCaptureNavigationError | PageCaptureProtocolError => {\n  const envelope = decodeEnvelope(bodyText);\n\n  if (Option.isNone(envelope)) {\n    return protocolError(\n      \"The Browser Run response did not carry a valid response envelope\",\n      privateResponseCause(bodyText, apiToken),\n    );\n  }\n  if (!envelope.value.success) {\n    return navigationError(\n      \"Browser Run reported a navigation failure\",\n      privateResponseCause(bodyText, apiToken),\n    );\n  }\n  switch (action._tag) {\n    case \"CapturePageContent\":\n    case \"CapturePageMarkdown\":\n      if (typeof envelope.value.result !== \"string\") {\n        return protocolError(\"The Browser Run response envelope carried a non-text result\");\n      }\n\n      return action._tag === \"CapturePageContent\"\n        ? PageContentCaptured.make({ html: envelope.value.result })\n        : PageMarkdownCaptured.make({ markdown: envelope.value.result });\n    case \"CapturePageLinks\": {\n      const decoded = Schema.decodeUnknownOption(PageLinksCaptured)({\n        _tag: \"PageLinksCaptured\",\n        links: envelope.value.result,\n      });\n\n      return Option.isSome(decoded)\n        ? decoded.value\n        : protocolError(\"Browser Run links did not return a bounded array of valid URLs\");\n    }\n    case \"CapturePageScrape\": {\n      const decoded = Schema.decodeUnknownOption(PageScrapeCaptured)({\n        _tag: \"PageScrapeCaptured\",\n        groups: envelope.value.result,\n      });\n\n      return Option.isSome(decoded)\n        ? decoded.value\n        : protocolError(\"Browser Run scrape did not return bounded grouped element records\");\n    }\n    case \"CapturePageStructured\":\n      return PageStructuredCaptured.make({ value: envelope.value.result });\n  }\n};\n\nconst isQuotaMessage = (text: string): boolean => /time limit|daily|quota/i.test(text);\n\nconst makeCapture = (\n  client: HttpClient.HttpClient,\n  options: BrowserRestCaptureOptions,\n  workersAi?: BrowserQuickActionWorkersAiPolicy,\n): PageCaptureCapture =>\n  Effect.fn(\"BrowserRestCapture.capture\")(function* (\n    request: PageCaptureRequest,\n  ): Effect.fn.Return<PageCaptureResult, PageCaptureError> {\n    const usesWorkersAi = request.action._tag === \"CapturePageStructured\";\n\n    if (usesWorkersAi) {\n      if (workersAi === undefined) {\n        return yield* PageCaptureUnsupportedError.make({\n          implementation: browserRestCaptureImplementation,\n          feature: \"action\",\n          message:\n            \"Structured capture invokes separately billed Workers AI and requires an explicit authorization and accounting policy\",\n        });\n      }\n      yield* workersAi.authorizeAndAccount(request).pipe(\n        Effect.mapError((cause) =>\n          PageCaptureInferencePolicyError.make({\n            implementation: browserRestCaptureImplementation,\n            provider: \"cloudflare-workers-ai\",\n            reason: cause.reason,\n            message:\n              cause.reason === \"authorization\"\n                ? \"Workers AI extraction was not authorized\"\n                : \"Workers AI extraction could not be accounted for\",\n            cause,\n          }),\n        ),\n      );\n    }\n    const action = actionName(request.action);\n    const path = `${API_ORIGIN}/client/v4/accounts/${encodeURIComponent(options.accountId)}/browser-rendering/${action}`;\n\n    const requestWithBody = yield* HttpClientRequest.post(path).pipe(\n      request.engine === \"kitesurf\"\n        ? HttpClientRequest.setUrlParam(\"browser\", \"kitesurf\")\n        : (value) => value,\n      HttpClientRequest.bearerToken(options.apiToken),\n      HttpClientRequest.acceptJson,\n      HttpClientRequest.bodyJson(actionBody(request)),\n      Effect.mapError((cause) => protocolError(\"Encoding the Browser Run request failed\", cause)),\n    );\n\n    const response = yield* client\n      .execute(requestWithBody)\n      .pipe(\n        Effect.mapError((cause) => protocolError(\"Calling the Browser Run REST API failed\", cause)),\n      );\n\n    const bodyText = yield* readBoundedResponse(response, request);\n\n    if (response.status === 429) {\n      const reason = isQuotaMessage(bodyText) ? \"quota\" : \"rate\";\n\n      return yield* PageCaptureRateLimitedError.make({\n        implementation: browserRestCaptureImplementation,\n        reason,\n        ...(retryAfterMillis(response.headers) === undefined\n          ? {}\n          : { retryAfterMillis: retryAfterMillis(response.headers) }),\n        ...(privateResponseCause(bodyText, options.apiToken) === undefined\n          ? {}\n          : { cause: privateResponseCause(bodyText, options.apiToken) }),\n        message:\n          reason === \"quota\"\n            ? \"Browser Run exceeded its browser quota\"\n            : \"Browser Run was rate limited\",\n      });\n    }\n    if (response.status < 200 || response.status >= 300) {\n      const error =\n        response.status >= 500\n          ? protocolError(\n              `Browser Run answered HTTP ${String(response.status)}`,\n              privateResponseCause(bodyText, options.apiToken),\n            )\n          : navigationError(\n              `Browser Run answered HTTP ${String(response.status)}`,\n              privateResponseCause(bodyText, options.apiToken),\n            );\n\n      return yield* error;\n    }\n    if (!isJsonResponse(response.headers)) {\n      return yield* protocolError(\n        \"The Browser Run success response was not a JSON response envelope\",\n        privateResponseCause(bodyText, options.apiToken),\n      );\n    }\n    const output = parseOutput(request.action, bodyText, options.apiToken);\n\n    if (\n      output._tag === \"PageCaptureNavigationError\" ||\n      output._tag === \"PageCaptureProtocolError\"\n    ) {\n      return yield* output;\n    }\n\n    return PageCaptureResult.make({\n      implementation: browserRestCaptureImplementation,\n      output,\n      resourceUse: PageCaptureResourceUse.make({\n        ...(browserMillis(response.headers) === undefined\n          ? {}\n          : { browserMillis: browserMillis(response.headers) }),\n        ...(usesWorkersAi\n          ? {\n              inference: PageCaptureInferenceUse.make({\n                provider: \"cloudflare-workers-ai\",\n                modelCalls: 1,\n              }),\n            }\n          : {}),\n      }),\n    });\n  });\n\n/** REST PageCapture layer for Node and other non-Worker composition roots. */\nexport const browserRestCaptureLayer = (\n  options: BrowserRestCaptureOptions,\n): Layer.Layer<PageCapture, never, HttpClient.HttpClient> =>\n  Layer.effect(\n    PageCapture,\n    Effect.map(HttpClient.HttpClient, (client) =>\n      PageCapture.of({ capture: makeCapture(client, options) }),\n    ),\n  );\n\n/** REST structured extraction additionally requires explicit Workers AI authorization/accounting. */\nexport const browserRestWorkersAiCaptureLayer = (\n  options: BrowserRestCaptureOptions,\n): Layer.Layer<PageCapture, never, HttpClient.HttpClient | BrowserQuickActionWorkersAi> =>\n  Layer.effect(\n    PageCapture,\n    Effect.gen(function* () {\n      const client = yield* HttpClient.HttpClient;\n      const workersAi = yield* BrowserQuickActionWorkersAi;\n\n      return PageCapture.of({ capture: makeCapture(client, options, workersAi) });\n    }),\n  );\n\n/** Explicit REST credentials and optional authorization for separately billed extraction. */\nexport interface CloudflareBrowserRestOptions extends BrowserRestCaptureOptions {\n  readonly workersAi?: BrowserQuickActionWorkersAiPolicy;\n}\n\n/** Node-safe WebCapture handler assembly; the application supplies its HttpClient. */\nexport const CloudflareBrowserRest = {\n  /**\n   * Supports capture, scrape, and extraction definitions. Only PageCapture is supplied;\n   * handler errors and other services remain visible. Extraction fails closed without\n   * workersAi. Existing host policies, response limits, and scoped cleanup are unchanged.\n   */\n  layer: <A, E, R>(\n    definition: { readonly handlers: Layer.Layer<A, E, R> },\n    options: CloudflareBrowserRestOptions,\n  ): Layer.Layer<A, E, Exclude<R, PageCapture> | HttpClient.HttpClient> => {\n    const capture =\n      options.workersAi === undefined\n        ? browserRestCaptureLayer(options)\n        : browserRestWorkersAiCaptureLayer(options).pipe(\n            Layer.provide(BrowserQuickActionWorkersAi.layer(options.workersAi)),\n          );\n\n    return definition.handlers.pipe(Layer.provide(capture));\n  },\n};\n"],"mappings":";;;;;;;AAgCA,MAAa,mCAAmC,sBAAsB,KAAK;CACzE,WAAW;CACX,UAAU;AACZ,CAAC;AAED,MAAM,aAAa;AACnB,MAAM,wBAAwB;AAC9B,MAAM,qBAAqB,YAA4B,QAAQ,MAAM,GAAG,qBAAqB;AAQ7F,MAAM,sBAAsB,OAAO,OAAO;CACxC,SAAS,OAAO,QAAQ,IAAI;CAC5B,QAAQ,OAAO;CACf,QAAQ,OAAO,YAAY,OAAO,MAAM,OAAO,OAAO,CAAC;CACvD,MAAM,OAAO,YAAY,OAAO,OAAO;AACzC,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,SAAS,OAAO,QAAQ,KAAK;CAC7B,QAAQ,OAAO,MACb,OAAO,OAAO;EACZ,SAAS,OAAO;EAChB,MAAM,OAAO,YAAY,OAAO,MAAM;CACxC,CAAC,CACH;CACA,QAAQ,OAAO,YAAY,OAAO,IAAI;CACtC,MAAM,OAAO,YAAY,OAAO,OAAO;AACzC,CAAC;AAED,MAAM,eAAe,OAAO,MAAM,CAAC,qBAAqB,iBAAiB,CAAC;AAC1E,MAAM,iBAAiB,OAAO,oBAAoB,OAAO,eAAe,YAAY,CAAC;AAErF,MAAM,iBAAiB,SAAiB,UACtC,yBAAyB,KAAK;CAC5B,gBAAgB;CAChB,SAAS,kBAAkB,OAAO;CAClC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AACzC,CAAC;AAEH,MAAM,mBAAmB,SAAiB,UACxC,2BAA2B,KAAK;CAC9B,gBAAgB;CAChB,SAAS,kBAAkB,OAAO;CAClC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AACzC,CAAC;AAEH,MAAM,wBACJ,UACA,aACsB;CACtB,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;CAClC,MAAM,QAAQ,SAAS,MAAM,QAAQ;CACrC,MAAM,aAAa,kBAAkB,QAAQ;CAE7C,OAAO,IAAI,MAAM,MAAM,WAAW,IAAI,aAAa,WAAW,WAAW,OAAO,YAAY,CAAC;AAC/F;AAEA,MAAM,eAAe,YAAyD;CAC5E,MAAM,OACJ,QAAQ,OAAO,SAAS,kBACpB,EAAE,KAAK,QAAQ,OAAO,IAAI,IAC1B,EAAE,MAAM,QAAQ,OAAO,KAAK;CAElC,IAAI,QAAQ,eAAe,KAAA,GAAW;EACpC,MAAM,OAAgC,CAAC;EAEvC,IAAI,QAAQ,WAAW,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ,WAAW;EACpF,IAAI,QAAQ,WAAW,kBAAkB,KAAA,GACvC,KAAK,UAAU,QAAQ,WAAW;EACpC,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,GAAG,KAAK,cAAc;EACrD,IAAI,QAAQ,WAAW,oBAAoB,KAAA,GACzC,KAAK,kBAAkB;GACrB,UAAU,QAAQ,WAAW,gBAAgB;GAC7C,GAAI,QAAQ,WAAW,gBAAgB,kBAAkB,KAAA,IACrD,CAAC,IACD,EAAE,SAAS,QAAQ,WAAW,gBAAgB,cAAc;EAClE;CAEJ;CACA,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;CAC5D,IAAI,QAAQ,gBAAgB,wBAAwB,KAAA,GAClD,KAAK,sBAAsB,CAAC,GAAG,QAAQ,eAAe,mBAAmB;CAE3E,IAAI,QAAQ,gBAAgB,yBAAyB,KAAA,GACnD,KAAK,sBAAsB,CAAC,GAAG,QAAQ,eAAe,oBAAoB;CAG5E,OAAO;AACT;AAEA,MAAM,cACJ,WACyD;CACzD,QAAQ,OAAO,MAAf;EACE,KAAK,sBACH,OAAO;EACT,KAAK,uBACH,OAAO;EACT,KAAK,oBACH,OAAO;EACT,KAAK,qBACH,OAAO;EACT,KAAK,yBACH,OAAO;CACX;AACF;AAEA,MAAM,cAAc,YAAyD;CAC3E,MAAM,OAAO,YAAY,OAAO;CAEhC,QAAQ,QAAQ,OAAO,MAAvB;EACE,KAAK;EACL,KAAK,uBACH,OAAO;EACT,KAAK,oBACH,OAAO;GACL,GAAG;GACH,GAAI,QAAQ,OAAO,qBAAqB,KAAA,IACpC,CAAC,IACD,EAAE,kBAAkB,QAAQ,OAAO,iBAAiB;EAC1D;EACF,KAAK,qBACH,OAAO;GACL,GAAG;GACH,UAAU,QAAQ,OAAO,UAAU,KAAK,cAAc,EAAE,SAAS,EAAE;EACrE;EACF,KAAK,yBACH,OAAO;GACL,GAAG;GACH,iBAAiB;IAAE,MAAM;IAAe,aAAa,QAAQ,OAAO;GAAe;GACnF,GAAI,QAAQ,OAAO,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO,OAAO;EACjF;CACJ;AACF;AAEA,MAAM,oBACJ,YACuB;CACvB,MAAM,UAAU,OAAO,QAAQ,cAAc;CAE7C,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,UAAU,GAAG,OAAO,KAAA;CAC1D,MAAM,SAAS,UAAU;CAEzB,OAAO,OAAO,cAAc,MAAM,IAAI,SAAS,KAAA;AACjD;AAEA,MAAM,iBACJ,YACuB;CACvB,MAAM,SAAS,OAAO,QAAQ,oBAAoB;CAElD,OAAO,OAAO,cAAc,MAAM,KAAK,UAAU,IAAI,SAAS,KAAA;AAChE;;AAGA,MAAM,kBAAkB,YAAmE;CACzF,MAAM,cAAc,QAAQ;CAE5B,IAAI,gBAAgB,KAAA,GAAW,OAAO;CACtC,MAAM,YAAY,YAAY,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY;CAEnE,OAAO,cAAc,sBAAsB,WAAW,SAAS,OAAO,MAAM;AAC9E;AAEA,MAAM,sBAAsB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACvE,UACA,SAC4C;CAC5C,MAAM,UAAU,IAAI,YAAY,SAAS;EAAE,OAAO;EAAM,WAAW;CAAM,CAAC;CAE1E,MAAM,SAAS,OAAO,OAAO,cAQ3B,SAAS,eACF;EAAE,UAAU;EAAG,MAAM;CAAG,KAC9B,OAAO,UAAU;EAChB,MAAM,WAAW,MAAM,WAAW,MAAM;EAExC,IAAI,WAAW,QAAQ,OAAO,gBAC5B,OAAO,OAAO,KACZ,4BAA4B,KAAK;GAC/B,gBAAgB;GAChB,OAAO,QAAQ,OAAO;GACtB;EACF,CAAC,CACH;EAGF,OAAO,OAAO,IAAI;GAChB,YAAY;IAAE;IAAU,MAAM,MAAM,OAAO,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;GAAE;GACnF,QAAQ,UAAU,cAAc,4CAA4C,KAAK;EACnF,CAAC;CACH,CACF,CAAC,CAAC,KACA,OAAO,UAAU,UACf,OAAO,GAAG,2BAA2B,CAAC,CAAC,KAAK,KAAK,OAAO,GAAG,wBAAwB,CAAC,CAAC,KAAK,IACtF,QACA,cAAc,2CAA2C,KAAK,CACpE,CACF;CAEA,OAAO,OAAO,OAAO,IAAI;EACvB,WAAW,OAAO,OAAO,QAAQ,OAAO;EACxC,QAAQ,UAAU,cAAc,4CAA4C,KAAK;CACnF,CAAC;AACH,CAAC;AAED,MAAM,eACJ,QACA,UACA,aAC8E;CAC9E,MAAM,WAAW,eAAe,QAAQ;CAExC,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,cACL,oEACA,qBAAqB,UAAU,QAAQ,CACzC;CAEF,IAAI,CAAC,SAAS,MAAM,SAClB,OAAO,gBACL,6CACA,qBAAqB,UAAU,QAAQ,CACzC;CAEF,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK;GACH,IAAI,OAAO,SAAS,MAAM,WAAW,UACnC,OAAO,cAAc,6DAA6D;GAGpF,OAAO,OAAO,SAAS,uBACnB,oBAAoB,KAAK,EAAE,MAAM,SAAS,MAAM,OAAO,CAAC,IACxD,qBAAqB,KAAK,EAAE,UAAU,SAAS,MAAM,OAAO,CAAC;EACnE,KAAK,oBAAoB;GACvB,MAAM,UAAU,OAAO,oBAAoB,iBAAiB,CAAC,CAAC;IAC5D,MAAM;IACN,OAAO,SAAS,MAAM;GACxB,CAAC;GAED,OAAO,OAAO,OAAO,OAAO,IACxB,QAAQ,QACR,cAAc,gEAAgE;EACpF;EACA,KAAK,qBAAqB;GACxB,MAAM,UAAU,OAAO,oBAAoB,kBAAkB,CAAC,CAAC;IAC7D,MAAM;IACN,QAAQ,SAAS,MAAM;GACzB,CAAC;GAED,OAAO,OAAO,OAAO,OAAO,IACxB,QAAQ,QACR,cAAc,mEAAmE;EACvF;EACA,KAAK,yBACH,OAAO,uBAAuB,KAAK,EAAE,OAAO,SAAS,MAAM,OAAO,CAAC;CACvE;AACF;AAEA,MAAM,kBAAkB,SAA0B,0BAA0B,KAAK,IAAI;AAErF,MAAM,eACJ,QACA,SACA,cAEA,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACtC,SACuD;CACvD,MAAM,gBAAgB,QAAQ,OAAO,SAAS;CAE9C,IAAI,eAAe;EACjB,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,4BAA4B,KAAK;GAC7C,gBAAgB;GAChB,SAAS;GACT,SACE;EACJ,CAAC;EAEH,OAAO,UAAU,oBAAoB,OAAO,CAAC,CAAC,KAC5C,OAAO,UAAU,UACf,gCAAgC,KAAK;GACnC,gBAAgB;GAChB,UAAU;GACV,QAAQ,MAAM;GACd,SACE,MAAM,WAAW,kBACb,6CACA;GACN;EACF,CAAC,CACH,CACF;CACF;CACA,MAAM,SAAS,WAAW,QAAQ,MAAM;CACxC,MAAM,OAAO,GAAG,WAAW,sBAAsB,mBAAmB,QAAQ,SAAS,EAAE,qBAAqB;CAE5G,MAAM,kBAAkB,OAAO,kBAAkB,KAAK,IAAI,CAAC,CAAC,KAC1D,QAAQ,WAAW,aACf,kBAAkB,YAAY,WAAW,UAAU,KAClD,UAAU,OACf,kBAAkB,YAAY,QAAQ,QAAQ,GAC9C,kBAAkB,YAClB,kBAAkB,SAAS,WAAW,OAAO,CAAC,GAC9C,OAAO,UAAU,UAAU,cAAc,2CAA2C,KAAK,CAAC,CAC5F;CAEA,MAAM,WAAW,OAAO,OACrB,QAAQ,eAAe,CAAC,CACxB,KACC,OAAO,UAAU,UAAU,cAAc,2CAA2C,KAAK,CAAC,CAC5F;CAEF,MAAM,WAAW,OAAO,oBAAoB,UAAU,OAAO;CAE7D,IAAI,SAAS,WAAW,KAAK;EAC3B,MAAM,SAAS,eAAe,QAAQ,IAAI,UAAU;EAEpD,OAAO,OAAO,4BAA4B,KAAK;GAC7C,gBAAgB;GAChB;GACA,GAAI,iBAAiB,SAAS,OAAO,MAAM,KAAA,IACvC,CAAC,IACD,EAAE,kBAAkB,iBAAiB,SAAS,OAAO,EAAE;GAC3D,GAAI,qBAAqB,UAAU,QAAQ,QAAQ,MAAM,KAAA,IACrD,CAAC,IACD,EAAE,OAAO,qBAAqB,UAAU,QAAQ,QAAQ,EAAE;GAC9D,SACE,WAAW,UACP,2CACA;EACR,CAAC;CACH;CACA,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAY9C,OAAO,OAVL,SAAS,UAAU,MACf,cACE,6BAA6B,OAAO,SAAS,MAAM,KACnD,qBAAqB,UAAU,QAAQ,QAAQ,CACjD,IACA,gBACE,6BAA6B,OAAO,SAAS,MAAM,KACnD,qBAAqB,UAAU,QAAQ,QAAQ,CACjD;CAIR,IAAI,CAAC,eAAe,SAAS,OAAO,GAClC,OAAO,OAAO,cACZ,qEACA,qBAAqB,UAAU,QAAQ,QAAQ,CACjD;CAEF,MAAM,SAAS,YAAY,QAAQ,QAAQ,UAAU,QAAQ,QAAQ;CAErE,IACE,OAAO,SAAS,gCAChB,OAAO,SAAS,4BAEhB,OAAO,OAAO;CAGhB,OAAO,kBAAkB,KAAK;EAC5B,gBAAgB;EAChB;EACA,aAAa,uBAAuB,KAAK;GACvC,GAAI,cAAc,SAAS,OAAO,MAAM,KAAA,IACpC,CAAC,IACD,EAAE,eAAe,cAAc,SAAS,OAAO,EAAE;GACrD,GAAI,gBACA,EACE,WAAW,wBAAwB,KAAK;IACtC,UAAU;IACV,YAAY;GACd,CAAC,EACH,IACA,CAAC;EACP,CAAC;CACH,CAAC;AACH,CAAC;;AAGH,MAAa,2BACX,YAEA,MAAM,OACJ,aACA,OAAO,IAAI,WAAW,aAAa,WACjC,YAAY,GAAG,EAAE,SAAS,YAAY,QAAQ,OAAO,EAAE,CAAC,CAC1D,CACF;;AAGF,MAAa,oCACX,YAEA,MAAM,OACJ,aACA,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAO,WAAW;CACjC,MAAM,YAAY,OAAO;CAEzB,OAAO,YAAY,GAAG,EAAE,SAAS,YAAY,QAAQ,SAAS,SAAS,EAAE,CAAC;AAC5E,CAAC,CACH;;AAQF,MAAa,wBAAwB;;;;;;AAMnC,QACE,YACA,YACuE;CACvE,MAAM,UACJ,QAAQ,cAAc,KAAA,IAClB,wBAAwB,OAAO,IAC/B,iCAAiC,OAAO,CAAC,CAAC,KACxC,MAAM,QAAQ,4BAA4B,MAAM,QAAQ,SAAS,CAAC,CACpE;CAEN,OAAO,WAAW,SAAS,KAAK,MAAM,QAAQ,OAAO,CAAC;AACxD,EACF"}

package/dist/BrowserRestCrawl.d.mts

@@ -0,0 +1,17 @@
+import { Layer, Redacted } from "effect";
+import { SandboxImplementation } from "@effect-agent/sandbox/Sandbox";
+import { HttpClient } from "effect/unstable/http";
+import { PageCrawl } from "@effect-agent/sandbox/PageCrawl";
+//#region src/BrowserRestCrawl.d.ts
+/** Node-safe REST crawl implementation. It never exposes or persists provider job identity. */
+declare const browserRestCrawlImplementation: SandboxImplementation;
+/** Explicit credentials. The token is projected only into fixed-origin Authorization headers. */
+interface BrowserRestCrawlOptions {
+  readonly accountId: string;
+  readonly apiToken: Redacted.Redacted<string>;
+}
+/** Cloudflare REST PageCrawl Layer for Node and other non-Worker composition roots. */
+declare const browserRestCrawlLayer: (options: BrowserRestCrawlOptions) => Layer.Layer<PageCrawl, never, HttpClient.HttpClient>;
+//#endregion
+export { BrowserRestCrawlOptions, browserRestCrawlImplementation, browserRestCrawlLayer };
+//# sourceMappingURL=BrowserRestCrawl.d.mts.map