@effect-agent/platform-cloudflare 0.1.0-beta.8 → 0.1.0-beta.80

package/dist/CloudflareCodeMode.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareCodeMode.mjs","names":["#dispatch"],"sources":["../src/CloudflareCodeMode.ts"],"sourcesContent":["import {\n  CodeExecutionHost,\n  CodeExecutionResourceUse,\n  CodeExecutionResult,\n  CodeExecutionTimeoutError,\n  CodeExecutor,\n  CodeExecutorStartError,\n  CodeExecutorTerminatedError,\n  CodeExecutorUnsupportedError,\n  CodeExecutionProtocolError,\n  CodeHostCall,\n  CodeHostCallLimitError,\n  CodeHostCallResult,\n  CodeOutputLimitError,\n  CodeProgramFailedError,\n  CodeSourceError,\n  type CodeExecutorExecute,\n  type CodeExecutionRequest,\n} from \"@effect-agent/sandbox/CodeExecutor\";\nimport { SandboxImplementation } from \"@effect-agent/sandbox/Sandbox\";\nimport { RpcTarget } from \"cloudflare:workers\";\nimport { Clock, Duration, Effect, Exit, Fiber, Layer, Option, Queue, Schema } from \"effect\";\n\nimport { safeCauseDiagnostic, safeCauseMessage } from \"./internal/boundary.ts\";\n\n/**\n * The Cloudflare Dynamic Worker `CodeExecutor` adapter (C4 of ADR-0017;\n * DEPLOY-011). Each pass loads one fresh Worker through the Worker Loader\n * with `globalOutbound: null`, so generated code has no ambient network,\n * bindings, or secrets; its only authority is the pass-scoped RPC target that\n * routes back into the owning event's `CodeExecutionHost` service. Platform\n * CPU limits stop synchronous runaway programs; the executor-owned wall-clock\n * deadline interrupts asynchronously suspended passes. Deployment class `E`\n * only: the adapter records no persistent state and a later pass may run in a\n * completely different isolate.\n */\nexport const dynamicWorkerImplementation = SandboxImplementation.make({\n  isolation: \"isolated\",\n  identity: \"cloudflare-dynamic-worker\",\n});\n\ninterface CodeModePassHost extends Rpc.RpcTargetBranded {\n  readonly call: (hostCall: unknown) => Promise<unknown>;\n}\n\ninterface CodeModeHarnessEntrypoint extends Rpc.WorkerEntrypointBranded {\n  readonly run: (host: CodeModePassHost) => Promise<unknown>;\n}\n\n/**\n * One object-capability endpoint for one execution pass. Workers RPC invokes\n * the target in the request context where it was created, so the native\n * Promise returned by `dispatch` and the Effect fiber that settles it share\n * one I/O owner. Passing the target as `run()`'s argument also scopes the\n * remote stub to that RPC call; no request state lives at module scope.\n */\nclass CodeModePassHostTarget extends RpcTarget implements CodeModePassHost {\n  readonly #dispatch: (hostCall: unknown) => Promise<unknown>;\n\n  constructor(dispatch: (hostCall: unknown) => Promise<unknown>) {\n    super();\n    this.#dispatch = dispatch;\n  }\n\n  call(hostCall: unknown): Promise<unknown> {\n    return this.#dispatch(hostCall);\n  }\n}\n\n/**\n * The fixed harness loaded as the dynamic worker's main module. The generated\n * source becomes `program.mjs` (`export default (<expression>);`) — a module,\n * never `eval`. The harness installs namespace globals and a bounded console,\n * imports the program, invokes it exactly once, and returns one envelope the\n * host validates through Effect Schema.\n */\nconst HARNESS_MODULE = String.raw`\nimport { WorkerEntrypoint } from \"cloudflare:workers\";\nimport programDefault from \"./program.js\";\n\nconst encoder = new TextEncoder();\nconst utf8 = (text) => encoder.encode(text).byteLength;\nconst safeText = (value) => {\n  try {\n    if (value instanceof Error) return (value.name + \": \" + value.message).slice(0, 4000);\n    if (typeof value === \"string\") return value.slice(0, 4000);\n    const encoded = JSON.stringify(value);\n    return (encoded === undefined ? String(value) : encoded).slice(0, 4000);\n  } catch {\n    return \"[unserializable value]\";\n  }\n};\nconst safeJson = (value) => {\n  try {\n    const encoded = JSON.stringify(value);\n    if (encoded !== undefined && encoded.length <= 4000) return JSON.parse(encoded);\n  } catch {}\n  return safeText(value);\n};\n\nexport default class CodeModeHarness extends WorkerEntrypoint {\n  async run(host) {\n    const config = this.env.CODE_MODE_PASS;\n    const limits = config.limits;\n    const logs = [];\n    let logBytes = 0;\n    let fatal;\n    const boundedLogs = () => logs.slice(0, 4096);\n    const write = (...values) => {\n      const joined = values.map(safeText).join(\" \");\n      const line = joined.length > 16000 ? joined.slice(0, 15999) + \"…\" : joined;\n      const bytes = utf8(line);\n      if (logs.length >= 4096 || logBytes + bytes > limits.maxLogBytes) {\n        fatal = fatal ?? { _tag: \"log-limit\", observed: logBytes + bytes, logs: boundedLogs() };\n        throw new Error(\"code-mode log limit exceeded\");\n      }\n      logs.push(line);\n      logBytes += bytes;\n    };\n    globalThis.console = { log: write, info: write, warn: write, error: write, debug: write };\n\n    let hostCalls = 0;\n    const makeMethod = (namespace, method) => async (argument) => {\n      hostCalls += 1;\n      if (hostCalls > limits.maxHostCalls) {\n        fatal = fatal ?? { _tag: \"host-call-limit\", logs: boundedLogs() };\n        throw new Error(\"code-mode host-call limit exceeded\");\n      }\n      let argText;\n      try {\n        argText = JSON.stringify(argument);\n      } catch {}\n      if (argText === undefined || utf8(argText) > limits.maxHostCallArgumentBytes) {\n        fatal = fatal ?? {\n          _tag: \"argument-limit\",\n          observed: argText === undefined ? 0 : utf8(argText),\n          logs: boundedLogs(),\n        };\n        throw new Error(\"code-mode host-call argument limit exceeded\");\n      }\n      const outcome = await host.call({\n        namespace,\n        method,\n        argument: JSON.parse(argText),\n      });\n      if (outcome !== null && typeof outcome === \"object\" && outcome._tag === \"CodeHostCallSuccess\") {\n        return outcome.value;\n      }\n      if (outcome !== null && typeof outcome === \"object\" && outcome._tag === \"CodeHostCallFailure\") {\n        throw outcome.error;\n      }\n      fatal = fatal ?? { _tag: \"protocol\", message: \"host returned an unrecognized outcome\" };\n      throw new Error(\"code-mode host protocol violation\");\n    };\n    for (const namespace of config.namespaces) {\n      const methods = {};\n      for (const method of namespace.methods) {\n        methods[method] = makeMethod(namespace.name, method);\n      }\n      globalThis[namespace.name] = methods;\n    }\n\n    // program.js is imported statically at the top of this module, so a\n    // syntactically invalid program fails the whole harness at load (mapped\n    // to a source error by the host). Using a static import keeps this module\n    // free of dynamic-import expressions, which single-script Miniflare hosts\n    // reject. The isolation boundary does NOT depend on the ordering of this\n    // import versus the console/namespace shims installed below: the loaded\n    // Worker has globalOutbound: null and no bindings, secrets, or env from\n    // the Worker Loader config BEFORE any module in the graph evaluates, so\n    // module-level program code has no ambient authority regardless. The\n    // shims below are usability wrappers (bounded console, namespace globals),\n    // and the accepted program is a single async-function expression whose\n    // body runs only when invoked here — after the shims exist.\n    const program = programDefault;\n    if (typeof program !== \"function\") {\n      return { _tag: \"source-not-a-function\", actual: typeof program };\n    }\n    try {\n      const value = await program();\n      if (fatal !== undefined) return fatal;\n      let text;\n      try {\n        text = JSON.stringify(value);\n      } catch {}\n      if (text === undefined) {\n        return {\n          _tag: \"program-failed\",\n          reason: \"non-json-result\",\n          thrown: null,\n          message: \"The program must return a JSON value\",\n          logs: boundedLogs(),\n        };\n      }\n      const resultBytes = utf8(text);\n      if (resultBytes > limits.maxResultBytes) {\n        return { _tag: \"result-limit\", observed: resultBytes, logs: boundedLogs() };\n      }\n      return {\n        _tag: \"completed\",\n        value: JSON.parse(text),\n        logs: boundedLogs(),\n        hostCalls,\n        logBytes,\n        resultBytes,\n      };\n    } catch (cause) {\n      if (fatal !== undefined) return fatal;\n      return {\n        _tag: \"program-failed\",\n        reason: cause instanceof Error ? \"threw\" : \"rejected\",\n        thrown: safeJson(cause),\n        message: safeText(cause),\n        logs: boundedLogs(),\n      };\n    }\n  }\n}\n`;\n\nconst BoundedLogs = Schema.Array(Schema.String.check(Schema.isMaxLength(16 * 1024))).check(\n  Schema.isMaxLength(4_096),\n);\n\nconst HarnessCompleted = Schema.TaggedStruct(\"completed\", {\n  value: Schema.Json,\n  logs: BoundedLogs,\n  hostCalls: Schema.Natural,\n  logBytes: Schema.Natural,\n  resultBytes: Schema.Natural,\n});\n\nconst HarnessNotAFunction = Schema.TaggedStruct(\"source-not-a-function\", {\n  actual: Schema.String,\n});\n\nconst HarnessProgramFailed = Schema.TaggedStruct(\"program-failed\", {\n  reason: Schema.Literals([\"threw\", \"rejected\", \"non-json-result\"]),\n  thrown: Schema.Json,\n  message: Schema.String,\n  logs: BoundedLogs,\n});\n\nconst HarnessLogLimit = Schema.TaggedStruct(\"log-limit\", {\n  observed: Schema.Natural,\n  logs: BoundedLogs,\n});\n\nconst HarnessArgumentLimit = Schema.TaggedStruct(\"argument-limit\", {\n  observed: Schema.Natural,\n  logs: BoundedLogs,\n});\n\nconst HarnessResultLimit = Schema.TaggedStruct(\"result-limit\", {\n  observed: Schema.Natural,\n  logs: BoundedLogs,\n});\n\nconst HarnessHostCallLimit = Schema.TaggedStruct(\"host-call-limit\", {\n  logs: BoundedLogs,\n});\n\nconst HarnessProtocol = Schema.TaggedStruct(\"protocol\", {\n  message: Schema.String,\n});\n\nconst HarnessOutcome = Schema.Union([\n  HarnessCompleted,\n  HarnessNotAFunction,\n  HarnessProgramFailed,\n  HarnessLogLimit,\n  HarnessArgumentLimit,\n  HarnessResultLimit,\n  HarnessHostCallLimit,\n  HarnessProtocol,\n]);\n\nconst HarnessPassConfig = Schema.Struct({\n  namespaces: Schema.Array(\n    Schema.Struct({\n      name: Schema.NonEmptyString,\n      methods: Schema.Array(Schema.NonEmptyString).check(Schema.isMaxLength(64)),\n    }),\n  ).check(Schema.isMaxLength(32)),\n  limits: Schema.Struct({\n    maxLogBytes: Schema.Natural,\n    maxResultBytes: Schema.Natural,\n    maxHostCalls: Schema.Natural,\n    maxHostCallArgumentBytes: Schema.Natural,\n  }),\n});\n\nconst encodeHarnessPassConfig = Schema.encodeSync(HarnessPassConfig);\nconst encodeJsonPayload = Schema.encodeSync(Schema.fromJsonString(Schema.Json));\nconst decodeJsonPayload = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Json));\n\nconst decodeHarnessOutcome = (value: unknown) => {\n  try {\n    return Schema.decodeUnknownOption(HarnessOutcome)(value);\n  } catch {\n    return Option.none<typeof HarnessOutcome.Type>();\n  }\n};\n\nconst decodeHostCall = (value: unknown) => {\n  try {\n    return Schema.decodeUnknownOption(CodeHostCall)(value);\n  } catch {\n    return Option.none<CodeHostCall>();\n  }\n};\n\nconst decodeHostCallResult = (value: unknown) => {\n  try {\n    return Schema.decodeUnknownOption(CodeHostCallResult)(value);\n  } catch {\n    return Option.none<CodeHostCallResult>();\n  }\n};\n\n/** Dispose a Cloudflare RPC handle when the runtime supplies its untyped disposal hook. @internal */\nexport const disposeRpcHandle = (handle: unknown): Effect.Effect<void> =>\n  Effect.try({\n    try: () => {\n      if ((typeof handle !== \"object\" && typeof handle !== \"function\") || handle === null) return;\n      if (!(Symbol.dispose in handle)) return;\n      const dispose = Reflect.get(handle, Symbol.dispose);\n\n      if (typeof dispose === \"function\") {\n        Reflect.apply(dispose, handle, []);\n      }\n    },\n    catch: (cause) =>\n      safeCauseDiagnostic(cause, \"The Cloudflare RPC disposal hook failed without a diagnostic\"),\n  }).pipe(\n    Effect.catch((diagnostic) =>\n      Effect.logWarning(`Cloudflare RPC handle disposal failed: ${diagnostic}`).pipe(\n        Effect.ignoreCause,\n      ),\n    ),\n  );\n\n/**\n * Project a host outcome to the plain JSON envelope the harness reads. A\n * `CodeExecutionHost` may return either real `CodeHostCallResult` instances\n * (the substitute and conformance kit) or plain-object equivalents (the Code\n * Mode capability's broker route), so this reads the shared fields rather than\n * `Schema.encodeSync`, which would reject a plain object.\n */\ninterface EncodedHostResultPayload {\n  readonly encodedPayload: string;\n  readonly resultBytes: number;\n}\n\nconst encodeHostResultPayload = (\n  outcome: CodeHostCallResult,\n): EncodedHostResultPayload | undefined => {\n  try {\n    const payload = outcome._tag === \"CodeHostCallSuccess\" ? outcome.value : outcome.error;\n    const encodedPayload = encodeJsonPayload(payload);\n\n    return {\n      encodedPayload,\n      resultBytes: utf8ByteLength(encodedPayload),\n    };\n  } catch {\n    return undefined;\n  }\n};\n\nconst utf8ByteLength = (value: string): number => {\n  let total = 0;\n\n  for (const character of value) {\n    const codePoint = character.codePointAt(0) ?? 0;\n\n    total += codePoint <= 0x7f ? 1 : codePoint <= 0x7ff ? 2 : codePoint <= 0xffff ? 3 : 4;\n  }\n\n  return total;\n};\n\ninterface QueuedHostCall {\n  readonly call: CodeHostCall;\n  readonly resolve: (value: unknown) => void;\n  readonly reject: (reason: unknown) => void;\n}\n\ntype HostWork =\n  | { readonly _tag: \"call\"; readonly queued: QueuedHostCall }\n  | { readonly _tag: \"limit\" };\n\ntype HostDispatchError =\n  | CodeExecutionTimeoutError\n  | CodeOutputLimitError\n  | CodeExecutionProtocolError\n  | CodeHostCallLimitError;\n\n/** Reserved global names the harness owns inside the dynamic worker. */\nconst reservedHarnessGlobals = new Set([\"console\"]);\n\nexport interface DynamicWorkerCodeExecutorOptions {\n  /** The `worker_loader` binding. */\n  readonly loader: WorkerLoader;\n  /** Compatibility date for dynamic workers; defaults to `2025-05-01`. */\n  readonly compatibilityDate?: string | undefined;\n}\n\nconst makeExecute = (\n  options: DynamicWorkerCodeExecutorOptions,\n  clock: Clock.Clock,\n): CodeExecutorExecute =>\n  Effect.fn(\"DynamicWorkerCodeExecutor.execute\")(function* (request: CodeExecutionRequest) {\n    if (request.network._tag !== \"NetworkDisabled\") {\n      return yield* CodeExecutorUnsupportedError.make({\n        implementation: dynamicWorkerImplementation,\n        feature: \"network\",\n        message:\n          \"The Dynamic Worker executor denies all egress with globalOutbound: null; an allowlist is not supported in the first slice\",\n      });\n    }\n    const sourceBytes = utf8ByteLength(request.source);\n\n    if (sourceBytes > request.limits.maxSourceBytes) {\n      return yield* CodeSourceError.make({\n        implementation: dynamicWorkerImplementation,\n        reason: \"oversized\",\n        message: `Source is ${sourceBytes} bytes; the request allows ${request.limits.maxSourceBytes}`,\n      });\n    }\n    for (const namespace of request.namespaces) {\n      if (reservedHarnessGlobals.has(namespace.name)) {\n        return yield* CodeExecutorUnsupportedError.make({\n          implementation: dynamicWorkerImplementation,\n          feature: \"namespaces\",\n          message: `Namespace ${namespace.name} collides with a harness binding`,\n        });\n      }\n    }\n    const host = yield* CodeExecutionHost;\n\n    // This synchronous clock access is confined to callbacks that must compute a timeout\n    // immediately. The Clock service remains the authority, so tests and hosts can replace it.\n    const startedAt = clock.monotonicTimeNanosUnsafe();\n    const passDeadline = startedAt + Duration.toNanosUnsafe(request.limits.maxWallTime);\n\n    const remainingPassWallTime = (): Duration.Duration => {\n      const now = clock.monotonicTimeNanosUnsafe();\n\n      return Duration.nanos(passDeadline > now ? passDeadline - now : 0n);\n    };\n\n    let issuedHostCalls = 0;\n    let passOpen = true;\n    const queuedHostCalls: Array<QueuedHostCall> = [];\n    let passFailure: HostDispatchError | undefined;\n\n    const failPass = (error: HostDispatchError): void => {\n      if (passFailure === undefined) passFailure = error;\n    };\n\n    const rejectQueuedHostCalls = (reason: Error): void => {\n      for (const queued of queuedHostCalls.splice(0)) {\n        queued.reject(reason);\n      }\n    };\n\n    const queue = yield* Queue.unbounded<HostWork>();\n\n    const deliverHostOutcome = (\n      queued: QueuedHostCall,\n      outcome: CodeHostCallResult,\n    ): Effect.Effect<void, CodeExecutionProtocolError | CodeOutputLimitError> =>\n      Effect.gen(function* () {\n        const decoded = decodeHostCallResult(outcome);\n\n        if (Option.isNone(decoded)) {\n          const error = CodeExecutionProtocolError.make({\n            implementation: dynamicWorkerImplementation,\n            message: \"The execution host returned a value outside the CodeHostCallResult schema\",\n          });\n\n          failPass(error);\n\n          return yield* error;\n        }\n        const encoded = encodeHostResultPayload(decoded.value);\n\n        if (encoded === undefined || encoded.resultBytes > request.limits.maxHostCallResultBytes) {\n          const error = CodeOutputLimitError.make({\n            implementation: dynamicWorkerImplementation,\n            surface: \"host-call-result\",\n            limit: request.limits.maxHostCallResultBytes,\n            observed: encoded?.resultBytes ?? 0,\n            logs: [],\n          });\n\n          failPass(error);\n\n          return yield* error;\n        }\n        const normalizedPayload = decodeJsonPayload(encoded.encodedPayload);\n\n        if (Option.isNone(normalizedPayload)) {\n          const error = CodeExecutionProtocolError.make({\n            implementation: dynamicWorkerImplementation,\n            message: \"The execution host returned a result that could not cross the JSON boundary\",\n          });\n\n          failPass(error);\n\n          return yield* error;\n        }\n        queued.resolve(\n          decoded.value._tag === \"CodeHostCallSuccess\"\n            ? { _tag: \"CodeHostCallSuccess\", value: normalizedPayload.value }\n            : { _tag: \"CodeHostCallFailure\", error: normalizedPayload.value },\n        );\n      });\n\n    // Workers RPC into the loader isolate cannot settle on the fiber blocked\n    // in `entrypoint.run()`. A Scope-owned sibling fiber keeps that\n    // independence while inheriting the pass Context and dying with the Scope.\n    const serveHostCalls = Effect.gen(function* () {\n      while (true) {\n        const work = yield* Queue.take(queue);\n\n        if (work._tag === \"limit\") {\n          const error = CodeHostCallLimitError.make({\n            implementation: dynamicWorkerImplementation,\n            limit: request.limits.maxHostCalls,\n            logs: [],\n          });\n\n          failPass(error);\n\n          return yield* error;\n        }\n        const queued = work.queued;\n\n        yield* host.call(queued.call).pipe(\n          Effect.timeoutOrElse({\n            duration: remainingPassWallTime(),\n            orElse: () => {\n              const error = CodeExecutionTimeoutError.make({\n                implementation: dynamicWorkerImplementation,\n                kind: \"wall-clock\",\n                maxWallTime: request.limits.maxWallTime,\n                logs: [],\n              });\n\n              failPass(error);\n\n              return error;\n            },\n          }),\n          Effect.flatMap((outcome) => deliverHostOutcome(queued, outcome)),\n          Effect.tapError(() =>\n            Effect.sync(() => queued.reject(new Error(\"Code Mode host call failed\"))),\n          ),\n          Effect.onInterrupt(() =>\n            Effect.sync(() => queued.reject(new Error(\"Code Mode pass is closing\"))),\n          ),\n        );\n      }\n    });\n\n    const concurrency = request.limits.maxHostCallConcurrency ?? 4;\n\n    const server = yield* Effect.all(\n      Array.from({ length: concurrency }, () => serveHostCalls),\n      { concurrency, discard: true },\n    ).pipe(Effect.andThen(Effect.never), Effect.forkScoped);\n\n    const dispatch = (hostCall: unknown): Promise<unknown> => {\n      if (!passOpen) {\n        return Promise.reject(new Error(\"Code Mode pass is closing\"));\n      }\n      issuedHostCalls += 1;\n      if (issuedHostCalls > request.limits.maxHostCalls) {\n        const error = CodeHostCallLimitError.make({\n          implementation: dynamicWorkerImplementation,\n          limit: request.limits.maxHostCalls,\n          logs: [],\n        });\n\n        failPass(error);\n        Queue.offerUnsafe(queue, { _tag: \"limit\" });\n\n        return Promise.reject(new Error(\"host-call limit exceeded\"));\n      }\n      const decoded = decodeHostCall(hostCall);\n\n      if (Option.isNone(decoded)) {\n        return Promise.reject(new TypeError(\"host calls must match the CodeHostCall schema\"));\n      }\n\n      return new Promise((resolve, reject) => {\n        const queued = { call: decoded.value, resolve, reject };\n\n        queuedHostCalls.push(queued);\n        Queue.offerUnsafe(queue, { _tag: \"call\", queued });\n      });\n    };\n\n    const closeAdmission = Effect.sync(() => {\n      passOpen = false;\n      rejectQueuedHostCalls(new Error(\"Code Mode pass is closing\"));\n    });\n\n    yield* Effect.addFinalizer(() => closeAdmission.pipe(Effect.andThen(Fiber.interrupt(server))));\n\n    // No `allowExperimental`: the runtime only accepts it when the CALLING\n    // worker carries the `experimental` compatibility flag, which deployed\n    // consumers cannot set — the option would reject every pass in\n    // production. The harness needs no experimental runtime features.\n    const workerCode: WorkerLoaderWorkerCode = {\n      compatibilityDate: options.compatibilityDate ?? \"2025-05-01\",\n      mainModule: \"harness.js\",\n      modules: {\n        \"harness.js\": HARNESS_MODULE,\n        \"program.js\": `export default (\\n${request.source}\\n);`,\n      },\n      env: {\n        CODE_MODE_PASS: encodeHarnessPassConfig({\n          namespaces: request.namespaces.map((namespace) => ({\n            name: namespace.name,\n            methods: namespace.methods,\n          })),\n          limits: {\n            maxLogBytes: request.limits.maxLogBytes,\n            maxResultBytes: request.limits.maxResultBytes,\n            maxHostCalls: request.limits.maxHostCalls,\n            maxHostCallArgumentBytes: request.limits.maxHostCallArgumentBytes,\n          },\n        }),\n      },\n      globalOutbound: null,\n      ...(request.limits.cpuMillis === undefined\n        ? {}\n        : {\n            limits: {\n              cpuMs: request.limits.cpuMillis,\n              subRequests: request.limits.maxHostCalls + 8,\n            },\n          }),\n    };\n\n    const worker = yield* Effect.acquireRelease(\n      Effect.try({\n        try: () => options.loader.load(workerCode),\n        catch: (cause) => {\n          const text = safeCauseMessage(cause, \"The Worker Loader failed without a diagnostic\");\n\n          // Blame the program's source ONLY on a genuine compile diagnostic;\n          // any other load rejection is an infrastructure start failure, not\n          // the model's fault (see classifyWorkerFailure for the same split).\n          if (/syntaxerror|failed to (compile|parse)/i.test(text)) {\n            return CodeSourceError.make({\n              implementation: dynamicWorkerImplementation,\n              reason: \"invalid\",\n              message: text.slice(0, 8_000),\n            });\n          }\n\n          return CodeExecutorStartError.make({\n            implementation: dynamicWorkerImplementation,\n            message: `The Worker Loader rejected the pass: ${text}`.slice(0, 8_000),\n            cause,\n          });\n        },\n      }),\n      disposeRpcHandle,\n    );\n\n    const entrypoint = yield* Effect.acquireRelease(\n      Effect.try({\n        try: () => worker.getEntrypoint<CodeModeHarnessEntrypoint>(),\n        catch: (cause) => classifyWorkerFailure(cause, request.limits.maxWallTime),\n      }),\n      disposeRpcHandle,\n    );\n\n    const rpc = Effect.tryPromise({\n      try: () => entrypoint.run(new CodeModePassHostTarget(dispatch)),\n      catch: (cause) => classifyWorkerFailure(cause, request.limits.maxWallTime),\n    });\n\n    const exit = yield* Effect.raceFirst(\n      rpc.pipe(\n        Effect.timeoutOrElse({\n          duration: remainingPassWallTime(),\n          orElse: () =>\n            CodeExecutionTimeoutError.make({\n              implementation: dynamicWorkerImplementation,\n              kind: \"wall-clock\",\n              maxWallTime: request.limits.maxWallTime,\n              logs: [],\n            }),\n        }),\n      ),\n      Fiber.join(server),\n    ).pipe(Effect.exit);\n\n    yield* closeAdmission;\n    yield* Fiber.interrupt(server);\n    if (passFailure !== undefined) {\n      return yield* passFailure;\n    }\n    if (Exit.isFailure(exit)) {\n      return yield* Effect.failCause(exit.cause);\n    }\n    const raw = exit.value;\n    const finishedAt = clock.monotonicTimeNanosUnsafe();\n\n    const outcome = decodeHarnessOutcome(raw);\n\n    if (Option.isNone(outcome)) {\n      return yield* CodeExecutionProtocolError.make({\n        implementation: dynamicWorkerImplementation,\n        message: \"The dynamic worker returned a value outside the harness envelope schema\",\n      });\n    }\n    switch (outcome.value._tag) {\n      case \"completed\": {\n        return CodeExecutionResult.make({\n          implementation: dynamicWorkerImplementation,\n          value: outcome.value.value,\n          logs: outcome.value.logs,\n          resourceUse: CodeExecutionResourceUse.make({\n            wallTime: Duration.nanos(finishedAt > startedAt ? finishedAt - startedAt : 0n),\n            hostCalls: outcome.value.hostCalls,\n            logBytes: outcome.value.logBytes,\n            resultBytes: outcome.value.resultBytes,\n          }),\n        });\n      }\n      case \"source-not-a-function\": {\n        return yield* CodeSourceError.make({\n          implementation: dynamicWorkerImplementation,\n          reason: \"not-a-function\",\n          message: `The source expression evaluated to ${outcome.value.actual}; it must evaluate to one async function`,\n        });\n      }\n      case \"program-failed\": {\n        return yield* CodeProgramFailedError.make({\n          implementation: dynamicWorkerImplementation,\n          reason: outcome.value.reason,\n          thrown: outcome.value.thrown,\n          message: outcome.value.message.slice(0, 8_000),\n          logs: outcome.value.logs,\n        });\n      }\n      case \"log-limit\": {\n        return yield* CodeOutputLimitError.make({\n          implementation: dynamicWorkerImplementation,\n          surface: \"logs\",\n          limit: request.limits.maxLogBytes,\n          observed: outcome.value.observed,\n          logs: outcome.value.logs,\n        });\n      }\n      case \"argument-limit\": {\n        return yield* CodeOutputLimitError.make({\n          implementation: dynamicWorkerImplementation,\n          surface: \"host-call-argument\",\n          limit: request.limits.maxHostCallArgumentBytes,\n          observed: outcome.value.observed,\n          logs: outcome.value.logs,\n        });\n      }\n      case \"result-limit\": {\n        return yield* CodeOutputLimitError.make({\n          implementation: dynamicWorkerImplementation,\n          surface: \"result\",\n          limit: request.limits.maxResultBytes,\n          observed: outcome.value.observed,\n          logs: outcome.value.logs,\n        });\n      }\n      case \"host-call-limit\": {\n        return yield* CodeHostCallLimitError.make({\n          implementation: dynamicWorkerImplementation,\n          limit: request.limits.maxHostCalls,\n          logs: outcome.value.logs,\n        });\n      }\n      case \"protocol\": {\n        return yield* CodeExecutionProtocolError.make({\n          implementation: dynamicWorkerImplementation,\n          message: outcome.value.message.slice(0, 8_000),\n        });\n      }\n    }\n  });\n\n/**\n * Expected worker-level failures map into the typed union with bounded\n * diagnostics; anything unrecognized stays a start/termination error rather\n * than a fabricated program result.\n */\nconst classifyWorkerFailure = (\n  cause: unknown,\n  maxWallTime: Duration.Duration,\n):\n  | CodeExecutionTimeoutError\n  | CodeExecutorTerminatedError\n  | CodeExecutorStartError\n  | CodeSourceError => {\n  const text = safeCauseDiagnostic(cause, \"[unserializable worker failure]\");\n\n  // `WorkerLoader.load()` is lazy, so a module-compile error in the generated\n  // program surfaces here at first use. Blame the program's source ONLY on a\n  // genuine compile diagnostic (a `SyntaxError` or an explicit compile\n  // failure) — the fixed harness is valid, so the fault is in program.js. A\n  // bare \"failed to start Worker\" without a compile diagnostic is an\n  // infrastructure start failure, not the model's fault, so it must NOT be\n  // misclassified as a source error.\n  if (/syntaxerror|failed to (compile|parse)/i.test(text)) {\n    return CodeSourceError.make({\n      implementation: dynamicWorkerImplementation,\n      reason: \"invalid\",\n      message: text.slice(0, 8_000),\n    });\n  }\n  if (/cpu/i.test(text)) {\n    return CodeExecutionTimeoutError.make({\n      implementation: dynamicWorkerImplementation,\n      kind: \"cpu\",\n      maxWallTime,\n      logs: [],\n    });\n  }\n  if (/failed to start worker/i.test(text)) {\n    return CodeExecutorStartError.make({\n      implementation: dynamicWorkerImplementation,\n      message: text.slice(0, 8_000),\n      cause,\n    });\n  }\n\n  return CodeExecutorTerminatedError.make({\n    implementation: dynamicWorkerImplementation,\n    message: text.slice(0, 8_000),\n  });\n};\n\n/** Layer building the Dynamic Worker `CodeExecutor` from resolved bindings. */\nexport const dynamicWorkerCodeExecutorLayer = (\n  options: DynamicWorkerCodeExecutorOptions,\n): Layer.Layer<CodeExecutor> =>\n  Layer.effect(\n    CodeExecutor,\n    Effect.gen(function* () {\n      const clock = yield* Clock.Clock;\n\n      return CodeExecutor.of({ execute: makeExecute(options, clock) });\n    }),\n  );\n\n/** Assemble Code Mode handlers with the isolated Dynamic Worker executor. */\nexport const CloudflareCodeMode = {\n  /**\n   * Provide the selected tool handlers at construction, where Code Mode captures them.\n   * Their errors and remaining dependencies stay visible. The definition still owns the\n   * allowlist and limits; the runtime supplies the live Tool broker for each scoped pass.\n   */\n  layer: <A, E, R, Handlers, HandlerError, HandlerRequirements>(\n    definition: { readonly handlers: Layer.Layer<A, E, R> },\n    options: DynamicWorkerCodeExecutorOptions & {\n      readonly handlers: Layer.Layer<Handlers, HandlerError, HandlerRequirements>;\n    },\n  ) =>\n    definition.handlers.pipe(\n      Layer.provide(options.handlers),\n      Layer.provide(dynamicWorkerCodeExecutorLayer(options)),\n    ),\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAa,8BAA8B,sBAAsB,KAAK;CACpE,WAAW;CACX,UAAU;AACZ,CAAC;;;;;;;;AAiBD,IAAM,yBAAN,cAAqC,UAAsC;CACzE;CAEA,YAAY,UAAmD;EAC7D,MAAM;EACN,KAAKA,YAAY;CACnB;CAEA,KAAK,UAAqC;EACxC,OAAO,KAAKA,UAAU,QAAQ;CAChC;AACF;;;;;;;;AASA,MAAM,iBAAiB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgJjC,MAAM,cAAc,OAAO,MAAM,OAAO,OAAO,MAAM,OAAO,YAAY,KAAS,CAAC,CAAC,CAAC,CAAC,MACnF,OAAO,YAAY,IAAK,CAC1B;AAEA,MAAM,mBAAmB,OAAO,aAAa,aAAa;CACxD,OAAO,OAAO;CACd,MAAM;CACN,WAAW,OAAO;CAClB,UAAU,OAAO;CACjB,aAAa,OAAO;AACtB,CAAC;AAED,MAAM,sBAAsB,OAAO,aAAa,yBAAyB,EACvE,QAAQ,OAAO,OACjB,CAAC;AAED,MAAM,uBAAuB,OAAO,aAAa,kBAAkB;CACjE,QAAQ,OAAO,SAAS;EAAC;EAAS;EAAY;CAAiB,CAAC;CAChE,QAAQ,OAAO;CACf,SAAS,OAAO;CAChB,MAAM;AACR,CAAC;AAED,MAAM,kBAAkB,OAAO,aAAa,aAAa;CACvD,UAAU,OAAO;CACjB,MAAM;AACR,CAAC;AAED,MAAM,uBAAuB,OAAO,aAAa,kBAAkB;CACjE,UAAU,OAAO;CACjB,MAAM;AACR,CAAC;AAED,MAAM,qBAAqB,OAAO,aAAa,gBAAgB;CAC7D,UAAU,OAAO;CACjB,MAAM;AACR,CAAC;AAED,MAAM,uBAAuB,OAAO,aAAa,mBAAmB,EAClE,MAAM,YACR,CAAC;AAED,MAAM,kBAAkB,OAAO,aAAa,YAAY,EACtD,SAAS,OAAO,OAClB,CAAC;AAED,MAAM,iBAAiB,OAAO,MAAM;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,YAAY,OAAO,MACjB,OAAO,OAAO;EACZ,MAAM,OAAO;EACb,SAAS,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAC3E,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAC9B,QAAQ,OAAO,OAAO;EACpB,aAAa,OAAO;EACpB,gBAAgB,OAAO;EACvB,cAAc,OAAO;EACrB,0BAA0B,OAAO;CACnC,CAAC;AACH,CAAC;AAED,MAAM,0BAA0B,OAAO,WAAW,iBAAiB;AACnE,MAAM,oBAAoB,OAAO,WAAW,OAAO,eAAe,OAAO,IAAI,CAAC;AAC9E,MAAM,oBAAoB,OAAO,oBAAoB,OAAO,eAAe,OAAO,IAAI,CAAC;AAEvF,MAAM,wBAAwB,UAAmB;CAC/C,IAAI;EACF,OAAO,OAAO,oBAAoB,cAAc,CAAC,CAAC,KAAK;CACzD,QAAQ;EACN,OAAO,OAAO,KAAiC;CACjD;AACF;AAEA,MAAM,kBAAkB,UAAmB;CACzC,IAAI;EACF,OAAO,OAAO,oBAAoB,YAAY,CAAC,CAAC,KAAK;CACvD,QAAQ;EACN,OAAO,OAAO,KAAmB;CACnC;AACF;AAEA,MAAM,wBAAwB,UAAmB;CAC/C,IAAI;EACF,OAAO,OAAO,oBAAoB,kBAAkB,CAAC,CAAC,KAAK;CAC7D,QAAQ;EACN,OAAO,OAAO,KAAyB;CACzC;AACF;;AAGA,MAAa,oBAAoB,WAC/B,OAAO,IAAI;CACT,WAAW;EACT,IAAK,OAAO,WAAW,YAAY,OAAO,WAAW,cAAe,WAAW,MAAM;EACrF,IAAI,EAAE,OAAO,WAAW,SAAS;EACjC,MAAM,UAAU,QAAQ,IAAI,QAAQ,OAAO,OAAO;EAElD,IAAI,OAAO,YAAY,YACrB,QAAQ,MAAM,SAAS,QAAQ,CAAC,CAAC;CAErC;CACA,QAAQ,UACN,oBAAoB,OAAO,8DAA8D;AAC7F,CAAC,CAAC,CAAC,KACD,OAAO,OAAO,eACZ,OAAO,WAAW,0CAA0C,YAAY,CAAC,CAAC,KACxE,OAAO,WACT,CACF,CACF;AAcF,MAAM,2BACJ,YACyC;CACzC,IAAI;EACF,MAAM,UAAU,QAAQ,SAAS,wBAAwB,QAAQ,QAAQ,QAAQ;EACjF,MAAM,iBAAiB,kBAAkB,OAAO;EAEhD,OAAO;GACL;GACA,aAAa,eAAe,cAAc;EAC5C;CACF,QAAQ;EACN;CACF;AACF;AAEA,MAAM,kBAAkB,UAA0B;CAChD,IAAI,QAAQ;CAEZ,KAAK,MAAM,aAAa,OAAO;EAC7B,MAAM,YAAY,UAAU,YAAY,CAAC,KAAK;EAE9C,SAAS,aAAa,MAAO,IAAI,aAAa,OAAQ,IAAI,aAAa,QAAS,IAAI;CACtF;CAEA,OAAO;AACT;;AAmBA,MAAM,yCAAyB,IAAI,IAAI,CAAC,SAAS,CAAC;AASlD,MAAM,eACJ,SACA,UAEA,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,SAA+B;CACvF,IAAI,QAAQ,QAAQ,SAAS,mBAC3B,OAAO,OAAO,6BAA6B,KAAK;EAC9C,gBAAgB;EAChB,SAAS;EACT,SACE;CACJ,CAAC;CAEH,MAAM,cAAc,eAAe,QAAQ,MAAM;CAEjD,IAAI,cAAc,QAAQ,OAAO,gBAC/B,OAAO,OAAO,gBAAgB,KAAK;EACjC,gBAAgB;EAChB,QAAQ;EACR,SAAS,aAAa,YAAY,6BAA6B,QAAQ,OAAO;CAChF,CAAC;CAEH,KAAK,MAAM,aAAa,QAAQ,YAC9B,IAAI,uBAAuB,IAAI,UAAU,IAAI,GAC3C,OAAO,OAAO,6BAA6B,KAAK;EAC9C,gBAAgB;EAChB,SAAS;EACT,SAAS,aAAa,UAAU,KAAK;CACvC,CAAC;CAGL,MAAM,OAAO,OAAO;CAIpB,MAAM,YAAY,MAAM,yBAAyB;CACjD,MAAM,eAAe,YAAY,SAAS,cAAc,QAAQ,OAAO,WAAW;CAElF,MAAM,8BAAiD;EACrD,MAAM,MAAM,MAAM,yBAAyB;EAE3C,OAAO,SAAS,MAAM,eAAe,MAAM,eAAe,MAAM,EAAE;CACpE;CAEA,IAAI,kBAAkB;CACtB,IAAI,WAAW;CACf,MAAM,kBAAyC,CAAC;CAChD,IAAI;CAEJ,MAAM,YAAY,UAAmC;EACnD,IAAI,gBAAgB,KAAA,GAAW,cAAc;CAC/C;CAEA,MAAM,yBAAyB,WAAwB;EACrD,KAAK,MAAM,UAAU,gBAAgB,OAAO,CAAC,GAC3C,OAAO,OAAO,MAAM;CAExB;CAEA,MAAM,QAAQ,OAAO,MAAM,UAAoB;CAE/C,MAAM,sBACJ,QACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,qBAAqB,OAAO;EAE5C,IAAI,OAAO,OAAO,OAAO,GAAG;GAC1B,MAAM,QAAQ,2BAA2B,KAAK;IAC5C,gBAAgB;IAChB,SAAS;GACX,CAAC;GAED,SAAS,KAAK;GAEd,OAAO,OAAO;EAChB;EACA,MAAM,UAAU,wBAAwB,QAAQ,KAAK;EAErD,IAAI,YAAY,KAAA,KAAa,QAAQ,cAAc,QAAQ,OAAO,wBAAwB;GACxF,MAAM,QAAQ,qBAAqB,KAAK;IACtC,gBAAgB;IAChB,SAAS;IACT,OAAO,QAAQ,OAAO;IACtB,UAAU,SAAS,eAAe;IAClC,MAAM,CAAC;GACT,CAAC;GAED,SAAS,KAAK;GAEd,OAAO,OAAO;EAChB;EACA,MAAM,oBAAoB,kBAAkB,QAAQ,cAAc;EAElE,IAAI,OAAO,OAAO,iBAAiB,GAAG;GACpC,MAAM,QAAQ,2BAA2B,KAAK;IAC5C,gBAAgB;IAChB,SAAS;GACX,CAAC;GAED,SAAS,KAAK;GAEd,OAAO,OAAO;EAChB;EACA,OAAO,QACL,QAAQ,MAAM,SAAS,wBACnB;GAAE,MAAM;GAAuB,OAAO,kBAAkB;EAAM,IAC9D;GAAE,MAAM;GAAuB,OAAO,kBAAkB;EAAM,CACpE;CACF,CAAC;CAKH,MAAM,iBAAiB,OAAO,IAAI,aAAa;EAC7C,OAAO,MAAM;GACX,MAAM,OAAO,OAAO,MAAM,KAAK,KAAK;GAEpC,IAAI,KAAK,SAAS,SAAS;IACzB,MAAM,QAAQ,uBAAuB,KAAK;KACxC,gBAAgB;KAChB,OAAO,QAAQ,OAAO;KACtB,MAAM,CAAC;IACT,CAAC;IAED,SAAS,KAAK;IAEd,OAAO,OAAO;GAChB;GACA,MAAM,SAAS,KAAK;GAEpB,OAAO,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,KAC5B,OAAO,cAAc;IACnB,UAAU,sBAAsB;IAChC,cAAc;KACZ,MAAM,QAAQ,0BAA0B,KAAK;MAC3C,gBAAgB;MAChB,MAAM;MACN,aAAa,QAAQ,OAAO;MAC5B,MAAM,CAAC;KACT,CAAC;KAED,SAAS,KAAK;KAEd,OAAO;IACT;GACF,CAAC,GACD,OAAO,SAAS,YAAY,mBAAmB,QAAQ,OAAO,CAAC,GAC/D,OAAO,eACL,OAAO,WAAW,OAAO,uBAAO,IAAI,MAAM,4BAA4B,CAAC,CAAC,CAC1E,GACA,OAAO,kBACL,OAAO,WAAW,OAAO,uBAAO,IAAI,MAAM,2BAA2B,CAAC,CAAC,CACzE,CACF;EACF;CACF,CAAC;CAED,MAAM,cAAc,QAAQ,OAAO,0BAA0B;CAE7D,MAAM,SAAS,OAAO,OAAO,IAC3B,MAAM,KAAK,EAAE,QAAQ,YAAY,SAAS,cAAc,GACxD;EAAE;EAAa,SAAS;CAAK,CAC/B,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,KAAK,GAAG,OAAO,UAAU;CAEtD,MAAM,YAAY,aAAwC;EACxD,IAAI,CAAC,UACH,OAAO,QAAQ,uBAAO,IAAI,MAAM,2BAA2B,CAAC;EAE9D,mBAAmB;EACnB,IAAI,kBAAkB,QAAQ,OAAO,cAAc;GACjD,MAAM,QAAQ,uBAAuB,KAAK;IACxC,gBAAgB;IAChB,OAAO,QAAQ,OAAO;IACtB,MAAM,CAAC;GACT,CAAC;GAED,SAAS,KAAK;GACd,MAAM,YAAY,OAAO,EAAE,MAAM,QAAQ,CAAC;GAE1C,OAAO,QAAQ,uBAAO,IAAI,MAAM,0BAA0B,CAAC;EAC7D;EACA,MAAM,UAAU,eAAe,QAAQ;EAEvC,IAAI,OAAO,OAAO,OAAO,GACvB,OAAO,QAAQ,uBAAO,IAAI,UAAU,+CAA+C,CAAC;EAGtF,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,SAAS;IAAE,MAAM,QAAQ;IAAO;IAAS;GAAO;GAEtD,gBAAgB,KAAK,MAAM;GAC3B,MAAM,YAAY,OAAO;IAAE,MAAM;IAAQ;GAAO,CAAC;EACnD,CAAC;CACH;CAEA,MAAM,iBAAiB,OAAO,WAAW;EACvC,WAAW;EACX,sCAAsB,IAAI,MAAM,2BAA2B,CAAC;CAC9D,CAAC;CAED,OAAO,OAAO,mBAAmB,eAAe,KAAK,OAAO,QAAQ,MAAM,UAAU,MAAM,CAAC,CAAC,CAAC;CAM7F,MAAM,aAAqC;EACzC,mBAAmB,QAAQ,qBAAqB;EAChD,YAAY;EACZ,SAAS;GACP,cAAc;GACd,cAAc,qBAAqB,QAAQ,OAAO;EACpD;EACA,KAAK,EACH,gBAAgB,wBAAwB;GACtC,YAAY,QAAQ,WAAW,KAAK,eAAe;IACjD,MAAM,UAAU;IAChB,SAAS,UAAU;GACrB,EAAE;GACF,QAAQ;IACN,aAAa,QAAQ,OAAO;IAC5B,gBAAgB,QAAQ,OAAO;IAC/B,cAAc,QAAQ,OAAO;IAC7B,0BAA0B,QAAQ,OAAO;GAC3C;EACF,CAAC,EACH;EACA,gBAAgB;EAChB,GAAI,QAAQ,OAAO,cAAc,KAAA,IAC7B,CAAC,IACD,EACE,QAAQ;GACN,OAAO,QAAQ,OAAO;GACtB,aAAa,QAAQ,OAAO,eAAe;EAC7C,EACF;CACN;CAEA,MAAM,SAAS,OAAO,OAAO,eAC3B,OAAO,IAAI;EACT,WAAW,QAAQ,OAAO,KAAK,UAAU;EACzC,QAAQ,UAAU;GAChB,MAAM,OAAO,iBAAiB,OAAO,+CAA+C;GAKpF,IAAI,yCAAyC,KAAK,IAAI,GACpD,OAAO,gBAAgB,KAAK;IAC1B,gBAAgB;IAChB,QAAQ;IACR,SAAS,KAAK,MAAM,GAAG,GAAK;GAC9B,CAAC;GAGH,OAAO,uBAAuB,KAAK;IACjC,gBAAgB;IAChB,SAAS,wCAAwC,OAAO,MAAM,GAAG,GAAK;IACtE;GACF,CAAC;EACH;CACF,CAAC,GACD,gBACF;CAEA,MAAM,aAAa,OAAO,OAAO,eAC/B,OAAO,IAAI;EACT,WAAW,OAAO,cAAyC;EAC3D,QAAQ,UAAU,sBAAsB,OAAO,QAAQ,OAAO,WAAW;CAC3E,CAAC,GACD,gBACF;CAEA,MAAM,MAAM,OAAO,WAAW;EAC5B,WAAW,WAAW,IAAI,IAAI,uBAAuB,QAAQ,CAAC;EAC9D,QAAQ,UAAU,sBAAsB,OAAO,QAAQ,OAAO,WAAW;CAC3E,CAAC;CAED,MAAM,OAAO,OAAO,OAAO,UACzB,IAAI,KACF,OAAO,cAAc;EACnB,UAAU,sBAAsB;EAChC,cACE,0BAA0B,KAAK;GAC7B,gBAAgB;GAChB,MAAM;GACN,aAAa,QAAQ,OAAO;GAC5B,MAAM,CAAC;EACT,CAAC;CACL,CAAC,CACH,GACA,MAAM,KAAK,MAAM,CACnB,CAAC,CAAC,KAAK,OAAO,IAAI;CAElB,OAAO;CACP,OAAO,MAAM,UAAU,MAAM;CAC7B,IAAI,gBAAgB,KAAA,GAClB,OAAO,OAAO;CAEhB,IAAI,KAAK,UAAU,IAAI,GACrB,OAAO,OAAO,OAAO,UAAU,KAAK,KAAK;CAE3C,MAAM,MAAM,KAAK;CACjB,MAAM,aAAa,MAAM,yBAAyB;CAElD,MAAM,UAAU,qBAAqB,GAAG;CAExC,IAAI,OAAO,OAAO,OAAO,GACvB,OAAO,OAAO,2BAA2B,KAAK;EAC5C,gBAAgB;EAChB,SAAS;CACX,CAAC;CAEH,QAAQ,QAAQ,MAAM,MAAtB;EACE,KAAK,aACH,OAAO,oBAAoB,KAAK;GAC9B,gBAAgB;GAChB,OAAO,QAAQ,MAAM;GACrB,MAAM,QAAQ,MAAM;GACpB,aAAa,yBAAyB,KAAK;IACzC,UAAU,SAAS,MAAM,aAAa,YAAY,aAAa,YAAY,EAAE;IAC7E,WAAW,QAAQ,MAAM;IACzB,UAAU,QAAQ,MAAM;IACxB,aAAa,QAAQ,MAAM;GAC7B,CAAC;EACH,CAAC;EAEH,KAAK,yBACH,OAAO,OAAO,gBAAgB,KAAK;GACjC,gBAAgB;GAChB,QAAQ;GACR,SAAS,sCAAsC,QAAQ,MAAM,OAAO;EACtE,CAAC;EAEH,KAAK,kBACH,OAAO,OAAO,uBAAuB,KAAK;GACxC,gBAAgB;GAChB,QAAQ,QAAQ,MAAM;GACtB,QAAQ,QAAQ,MAAM;GACtB,SAAS,QAAQ,MAAM,QAAQ,MAAM,GAAG,GAAK;GAC7C,MAAM,QAAQ,MAAM;EACtB,CAAC;EAEH,KAAK,aACH,OAAO,OAAO,qBAAqB,KAAK;GACtC,gBAAgB;GAChB,SAAS;GACT,OAAO,QAAQ,OAAO;GACtB,UAAU,QAAQ,MAAM;GACxB,MAAM,QAAQ,MAAM;EACtB,CAAC;EAEH,KAAK,kBACH,OAAO,OAAO,qBAAqB,KAAK;GACtC,gBAAgB;GAChB,SAAS;GACT,OAAO,QAAQ,OAAO;GACtB,UAAU,QAAQ,MAAM;GACxB,MAAM,QAAQ,MAAM;EACtB,CAAC;EAEH,KAAK,gBACH,OAAO,OAAO,qBAAqB,KAAK;GACtC,gBAAgB;GAChB,SAAS;GACT,OAAO,QAAQ,OAAO;GACtB,UAAU,QAAQ,MAAM;GACxB,MAAM,QAAQ,MAAM;EACtB,CAAC;EAEH,KAAK,mBACH,OAAO,OAAO,uBAAuB,KAAK;GACxC,gBAAgB;GAChB,OAAO,QAAQ,OAAO;GACtB,MAAM,QAAQ,MAAM;EACtB,CAAC;EAEH,KAAK,YACH,OAAO,OAAO,2BAA2B,KAAK;GAC5C,gBAAgB;GAChB,SAAS,QAAQ,MAAM,QAAQ,MAAM,GAAG,GAAK;EAC/C,CAAC;CAEL;AACF,CAAC;;;;;;AAOH,MAAM,yBACJ,OACA,gBAKqB;CACrB,MAAM,OAAO,oBAAoB,OAAO,iCAAiC;CASzE,IAAI,yCAAyC,KAAK,IAAI,GACpD,OAAO,gBAAgB,KAAK;EAC1B,gBAAgB;EAChB,QAAQ;EACR,SAAS,KAAK,MAAM,GAAG,GAAK;CAC9B,CAAC;CAEH,IAAI,OAAO,KAAK,IAAI,GAClB,OAAO,0BAA0B,KAAK;EACpC,gBAAgB;EAChB,MAAM;EACN;EACA,MAAM,CAAC;CACT,CAAC;CAEH,IAAI,0BAA0B,KAAK,IAAI,GACrC,OAAO,uBAAuB,KAAK;EACjC,gBAAgB;EAChB,SAAS,KAAK,MAAM,GAAG,GAAK;EAC5B;CACF,CAAC;CAGH,OAAO,4BAA4B,KAAK;EACtC,gBAAgB;EAChB,SAAS,KAAK,MAAM,GAAG,GAAK;CAC9B,CAAC;AACH;;AAGA,MAAa,kCACX,YAEA,MAAM,OACJ,cACA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,MAAM;CAE3B,OAAO,aAAa,GAAG,EAAE,SAAS,YAAY,SAAS,KAAK,EAAE,CAAC;AACjE,CAAC,CACH;;AAGF,MAAa,qBAAqB;;;;;;AAMhC,QACE,YACA,YAIA,WAAW,SAAS,KAClB,MAAM,QAAQ,QAAQ,QAAQ,GAC9B,MAAM,QAAQ,+BAA+B,OAAO,CAAC,CACvD,EACJ"}

package/dist/CloudflareConfig-f3CqTel1.d.mts

@@ -0,0 +1,101 @@
+import { Context, Schema } from "effect";
+declare namespace CloudflareConfig_d_exports {
+  export { AdmissionLimitExceeded, CLOUDFLARE_DATABASE_CAP_BYTES, CLOUDFLARE_RUNTIME_DEFAULTS, CloudflareAdmissionLimitsValue, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError, DEFAULT_MAX_DATABASE_BYTES };
+}
+declare const CloudflarePlatformConfigError_base: Schema.Class<CloudflarePlatformConfigError, Schema.TaggedStruct<"CloudflarePlatformConfigError", {
+  readonly message: Schema.String;
+  readonly cause: Schema.optionalKey<Schema.Defect>;
+}>, import("effect/Cause").YieldableError>;
+/** The supplied Cloudflare durable runtime configuration failed validation (DEPLOY-003). */
+declare class CloudflarePlatformConfigError extends CloudflarePlatformConfigError_base {}
+declare const AdmissionLimitExceeded_base: Schema.Class<AdmissionLimitExceeded, Schema.TaggedStruct<"AdmissionLimitExceeded", {
+  readonly limit: Schema.Literals<readonly ["queue-depth", "input-bytes", "database-bytes"]>;
+  readonly actual: Schema.Int;
+  readonly maximum: Schema.Int;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * An admission was refused by a host resource limit BEFORE any ledger row existed
+ * (deployment spec §8, DEPLOY-007: "Admission has explicit bounded quota and overload
+ * behavior... a typed rejection"). This is the DC analogue of `NodeDurableHost`'s
+ * `AdmissionClosed` host gate: the port surface stays untouched, the refusal happens in the
+ * Thread Object's submit entry point before `DurableAgentRuntime.submit` runs, and
+ * nothing was admitted or written.
+ */
+declare class AdmissionLimitExceeded extends AdmissionLimitExceeded_base {
+  get message(): string;
+}
+/** The platform's hard per-Object database cap (10 GB, developers.cloudflare.com limits). */
+declare const CLOUDFLARE_DATABASE_CAP_BYTES = 10000000000;
+/** Default database-size admission ceiling: a 1 GB safety margin under the platform cap. */
+declare const DEFAULT_MAX_DATABASE_BYTES = 9000000000;
+declare const CloudflareAdmissionLimitsValue_base: Schema.Class<CloudflareAdmissionLimitsValue, Schema.Struct<{
+  /** Maximum nonterminal Submissions per Thread lane before new admissions refuse. */
+  readonly maxQueueDepthPerLane: Schema.Int;
+  /** Maximum encoded input bytes; never above the storage per-value bound. */
+  readonly maxInputBytes: Schema.Int;
+  /** Maximum `ctx.storage.sql.databaseSize` at admission; stays under the 10 GB platform cap. */
+  readonly maxDatabaseBytes: Schema.Int;
+}>, {}>;
+/**
+ * Explicit bounded admission quotas checked by the Thread Object BEFORE admission
+ * (exit gate "resource limits are checked before admission").
+ */
+declare class CloudflareAdmissionLimitsValue extends CloudflareAdmissionLimitsValue_base {}
+declare const CloudflareDurableRuntimeConfigValue_base: Schema.Class<CloudflareDurableRuntimeConfigValue, Schema.Struct<{
+  readonly deploymentId: Schema.brand<Schema.NonEmptyString, "@effect-agent/thread/DeploymentId">;
+  /** Head of the minted producer identity `{producerPrefix}:{threadId}`. */
+  readonly producerPrefix: Schema.NonEmptyString;
+  /** Submission ownership lease duration (D5); fences work across Object incarnations. */
+  readonly ownershipLeaseDuration: Schema.Int;
+  /** Base delay of the alarm re-arm backoff when a pass makes no progress. */
+  readonly alarmBackoffBase: Schema.Int;
+  /** Ceiling of the alarm re-arm backoff. */
+  readonly alarmBackoffCap: Schema.Int;
+  /**
+   * The maintenance-pass scan cadence and the ceiling of every re-arm delay: nonterminal
+   * work is revisited at least this often (wake/scan pairing, persistence §14).
+   */
+  readonly wakeScanInterval: Schema.Int;
+  /** `awaitSettlement` ledger re-check cadence when no wake arrives. */
+  readonly settlementPollInterval: Schema.Int;
+  /** Worker ownership-lease renewal cadence during an active Attempt. */
+  readonly leaseRenewalInterval: Schema.Int;
+  /** Active-Run abort-intent poll cadence. */
+  readonly abortPollInterval: Schema.Int;
+  /** Canonical observation poll cadence of the Durable Object store. */
+  readonly observationPollInterval: Schema.Int;
+  /** Per-value byte bound; must stay under the platform's 2 MB SQLite value limit. */
+  readonly maxStoredValueBytes: Schema.Int;
+  /** Opt-in full payload/digest-chain audit while opening the store. */
+  readonly verifyOnOpen: Schema.Boolean;
+  readonly limits: typeof CloudflareAdmissionLimitsValue;
+}>, {}>;
+/**
+ * Validated Cloudflare durable runtime configuration. The producer identity of one
+ * Thread Object is `{producerPrefix}:{threadId}` — stable across incarnations of
+ * the same deployment, distinct across deployments — and producer-epoch fencing (not the
+ * producer name) remains the correctness authority (DUR-006).
+ */
+declare class CloudflareDurableRuntimeConfigValue extends CloudflareDurableRuntimeConfigValue_base {}
+declare const CloudflareDurableRuntimeConfig_base: Context.ServiceClass<CloudflareDurableRuntimeConfig, "@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfig", CloudflareDurableRuntimeConfigValue>;
+/** Explicit configuration authority for the assembled Cloudflare durable runtime. */
+declare class CloudflareDurableRuntimeConfig extends CloudflareDurableRuntimeConfig_base {}
+/** Documented production defaults applied by `ThreadObject.layer`. */
+declare const CLOUDFLARE_RUNTIME_DEFAULTS: {
+  readonly ownershipLeaseDuration: number;
+  readonly alarmBackoffBase: 100;
+  readonly alarmBackoffCap: 5000;
+  readonly wakeScanInterval: 1000;
+  readonly settlementPollInterval: 500;
+  readonly leaseRenewalInterval: 10000;
+  readonly abortPollInterval: 500;
+  readonly observationPollInterval: 25;
+  readonly maxStoredValueBytes: 1900000;
+  readonly verifyOnOpen: false;
+  readonly maxQueueDepthPerLane: 256;
+  readonly maxInputBytes: 1900000;
+  readonly maxDatabaseBytes: 9000000000;
+};
+//#endregion
+export { CloudflareConfig_d_exports as a, CloudflarePlatformConfigError as c, CloudflareAdmissionLimitsValue as i, DEFAULT_MAX_DATABASE_BYTES as l, CLOUDFLARE_DATABASE_CAP_BYTES as n, CloudflareDurableRuntimeConfig as o, CLOUDFLARE_RUNTIME_DEFAULTS as r, CloudflareDurableRuntimeConfigValue as s, AdmissionLimitExceeded as t };
+//# sourceMappingURL=CloudflareConfig-f3CqTel1.d.mts.map

package/dist/CloudflareConfig.d.mts

@@ -0,0 +1,2 @@
+import { c as CloudflarePlatformConfigError, i as CloudflareAdmissionLimitsValue, l as DEFAULT_MAX_DATABASE_BYTES, n as CLOUDFLARE_DATABASE_CAP_BYTES, o as CloudflareDurableRuntimeConfig, r as CLOUDFLARE_RUNTIME_DEFAULTS, s as CloudflareDurableRuntimeConfigValue, t as AdmissionLimitExceeded } from "./CloudflareConfig-f3CqTel1.mjs";
+export { AdmissionLimitExceeded, CLOUDFLARE_DATABASE_CAP_BYTES, CLOUDFLARE_RUNTIME_DEFAULTS, CloudflareAdmissionLimitsValue, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError, DEFAULT_MAX_DATABASE_BYTES };

package/dist/CloudflareConfig.mjs

@@ -0,0 +1,122 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { DEFAULT_OWNERSHIP_LEASE_DURATION } from "@effect-agent/thread/SubmissionLedger";
+import { Context, Duration, Schema } from "effect";
+import { DeploymentId } from "@effect-agent/thread/Records";
+import { DEFAULT_MAX_STORED_VALUE_BYTES } from "@effect-agent/storage-cloudflare/DoStorageConfig";
+//#region src/CloudflareConfig.ts
+var CloudflareConfig_exports = /* @__PURE__ */ __exportAll({
+	AdmissionLimitExceeded: () => AdmissionLimitExceeded,
+	CLOUDFLARE_DATABASE_CAP_BYTES: () => CLOUDFLARE_DATABASE_CAP_BYTES,
+	CLOUDFLARE_RUNTIME_DEFAULTS: () => CLOUDFLARE_RUNTIME_DEFAULTS,
+	CloudflareAdmissionLimitsValue: () => CloudflareAdmissionLimitsValue,
+	CloudflareDurableRuntimeConfig: () => CloudflareDurableRuntimeConfig,
+	CloudflareDurableRuntimeConfigValue: () => CloudflareDurableRuntimeConfigValue,
+	CloudflarePlatformConfigError: () => CloudflarePlatformConfigError,
+	DEFAULT_MAX_DATABASE_BYTES: () => DEFAULT_MAX_DATABASE_BYTES
+});
+/**
+* Schema-validated configuration for the Cloudflare durable runtime (deployment spec §4:
+* decoded once during Layer construction, exposed as a typed service; DEPLOY-003). Every
+* cadence is in milliseconds; every bound is finite and checked before any resource opens.
+*/
+const PositiveMillis = Schema.Int.check(Schema.isGreaterThan(0));
+const NonNegativeMillis = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+/** The supplied Cloudflare durable runtime configuration failed validation (DEPLOY-003). */
+var CloudflarePlatformConfigError = class extends Schema.TaggedError()("CloudflarePlatformConfigError", {
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+/**
+* An admission was refused by a host resource limit BEFORE any ledger row existed
+* (deployment spec §8, DEPLOY-007: "Admission has explicit bounded quota and overload
+* behavior... a typed rejection"). This is the DC analogue of `NodeDurableHost`'s
+* `AdmissionClosed` host gate: the port surface stays untouched, the refusal happens in the
+* Thread Object's submit entry point before `DurableAgentRuntime.submit` runs, and
+* nothing was admitted or written.
+*/
+var AdmissionLimitExceeded = class extends Schema.TaggedError()("AdmissionLimitExceeded", {
+	limit: Schema.Literals([
+		"queue-depth",
+		"input-bytes",
+		"database-bytes"
+	]),
+	actual: Schema.Int,
+	maximum: Schema.Int
+}) {
+	get message() {
+		return `Admission refused before any ledger row existed: ${this.limit} ${this.actual} exceeds the configured maximum ${this.maximum}. Accepted work is unaffected; retry after the lane drains or raise the limit (DEPLOY-007).`;
+	}
+};
+/** The platform's hard per-Object database cap (10 GB, developers.cloudflare.com limits). */
+const CLOUDFLARE_DATABASE_CAP_BYTES = 1e10;
+/** Default database-size admission ceiling: a 1 GB safety margin under the platform cap. */
+const DEFAULT_MAX_DATABASE_BYTES = 9e9;
+/**
+* Explicit bounded admission quotas checked by the Thread Object BEFORE admission
+* (exit gate "resource limits are checked before admission").
+*/
+var CloudflareAdmissionLimitsValue = class extends Schema.Class("@effect-agent/platform-cloudflare/CloudflareAdmissionLimitsValue")({
+	/** Maximum nonterminal Submissions per Thread lane before new admissions refuse. */
+	maxQueueDepthPerLane: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(1e5)),
+	/** Maximum encoded input bytes; never above the storage per-value bound. */
+	maxInputBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2e6)),
+	/** Maximum `ctx.storage.sql.databaseSize` at admission; stays under the 10 GB platform cap. */
+	maxDatabaseBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(CLOUDFLARE_DATABASE_CAP_BYTES))
+}) {};
+/**
+* Validated Cloudflare durable runtime configuration. The producer identity of one
+* Thread Object is `{producerPrefix}:{threadId}` — stable across incarnations of
+* the same deployment, distinct across deployments — and producer-epoch fencing (not the
+* producer name) remains the correctness authority (DUR-006).
+*/
+var CloudflareDurableRuntimeConfigValue = class extends Schema.Class("@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfigValue")({
+	deploymentId: DeploymentId,
+	/** Head of the minted producer identity `{producerPrefix}:{threadId}`. */
+	producerPrefix: Schema.NonEmptyString.check(Schema.isMaxLength(256)),
+	/** Submission ownership lease duration (D5); fences work across Object incarnations. */
+	ownershipLeaseDuration: PositiveMillis,
+	/** Base delay of the alarm re-arm backoff when a pass makes no progress. */
+	alarmBackoffBase: PositiveMillis,
+	/** Ceiling of the alarm re-arm backoff. */
+	alarmBackoffCap: PositiveMillis,
+	/**
+	* The maintenance-pass scan cadence and the ceiling of every re-arm delay: nonterminal
+	* work is revisited at least this often (wake/scan pairing, persistence §14).
+	*/
+	wakeScanInterval: PositiveMillis,
+	/** `awaitSettlement` ledger re-check cadence when no wake arrives. */
+	settlementPollInterval: PositiveMillis,
+	/** Worker ownership-lease renewal cadence during an active Attempt. */
+	leaseRenewalInterval: PositiveMillis,
+	/** Active-Run abort-intent poll cadence. */
+	abortPollInterval: PositiveMillis,
+	/** Canonical observation poll cadence of the Durable Object store. */
+	observationPollInterval: NonNegativeMillis,
+	/** Per-value byte bound; must stay under the platform's 2 MB SQLite value limit. */
+	maxStoredValueBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2e6)),
+	/** Opt-in full payload/digest-chain audit while opening the store. */
+	verifyOnOpen: Schema.Boolean,
+	limits: CloudflareAdmissionLimitsValue
+}) {};
+/** Explicit configuration authority for the assembled Cloudflare durable runtime. */
+var CloudflareDurableRuntimeConfig = class extends Context.Service()("@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfig") {};
+/** Documented production defaults applied by `ThreadObject.layer`. */
+const CLOUDFLARE_RUNTIME_DEFAULTS = {
+	ownershipLeaseDuration: Duration.toMillis(DEFAULT_OWNERSHIP_LEASE_DURATION),
+	alarmBackoffBase: 100,
+	alarmBackoffCap: 5e3,
+	wakeScanInterval: 1e3,
+	settlementPollInterval: 500,
+	leaseRenewalInterval: 1e4,
+	abortPollInterval: 500,
+	observationPollInterval: 25,
+	maxStoredValueBytes: DEFAULT_MAX_STORED_VALUE_BYTES,
+	verifyOnOpen: false,
+	maxQueueDepthPerLane: 256,
+	maxInputBytes: DEFAULT_MAX_STORED_VALUE_BYTES,
+	maxDatabaseBytes: DEFAULT_MAX_DATABASE_BYTES
+};
+//#endregion
+export { AdmissionLimitExceeded, CLOUDFLARE_DATABASE_CAP_BYTES, CLOUDFLARE_RUNTIME_DEFAULTS, CloudflareAdmissionLimitsValue, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError, DEFAULT_MAX_DATABASE_BYTES, CloudflareConfig_exports as t };
+
+//# sourceMappingURL=CloudflareConfig.mjs.map

package/dist/CloudflareConfig.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareConfig.mjs","names":[],"sources":["../src/CloudflareConfig.ts"],"sourcesContent":["import { DEFAULT_MAX_STORED_VALUE_BYTES } from \"@effect-agent/storage-cloudflare/DoStorageConfig\";\nimport { DeploymentId } from \"@effect-agent/thread/Records\";\nimport { DEFAULT_OWNERSHIP_LEASE_DURATION } from \"@effect-agent/thread/SubmissionLedger\";\nimport { Context, Duration, Schema } from \"effect\";\n\n/**\n * Schema-validated configuration for the Cloudflare durable runtime (deployment spec §4:\n * decoded once during Layer construction, exposed as a typed service; DEPLOY-003). Every\n * cadence is in milliseconds; every bound is finite and checked before any resource opens.\n */\n\nconst PositiveMillis = Schema.Int.check(Schema.isGreaterThan(0));\nconst NonNegativeMillis = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));\n\n/** The supplied Cloudflare durable runtime configuration failed validation (DEPLOY-003). */\nexport class CloudflarePlatformConfigError extends Schema.TaggedError<CloudflarePlatformConfigError>()(\n  \"CloudflarePlatformConfigError\",\n  {\n    message: Schema.String,\n    cause: Schema.optionalKey(Schema.Defect()),\n  },\n) {}\n\n/**\n * An admission was refused by a host resource limit BEFORE any ledger row existed\n * (deployment spec §8, DEPLOY-007: \"Admission has explicit bounded quota and overload\n * behavior... a typed rejection\"). This is the DC analogue of `NodeDurableHost`'s\n * `AdmissionClosed` host gate: the port surface stays untouched, the refusal happens in the\n * Thread Object's submit entry point before `DurableAgentRuntime.submit` runs, and\n * nothing was admitted or written.\n */\nexport class AdmissionLimitExceeded extends Schema.TaggedError<AdmissionLimitExceeded>()(\n  \"AdmissionLimitExceeded\",\n  {\n    limit: Schema.Literals([\"queue-depth\", \"input-bytes\", \"database-bytes\"]),\n    actual: Schema.Int,\n    maximum: Schema.Int,\n  },\n) {\n  override get message() {\n    return (\n      `Admission refused before any ledger row existed: ${this.limit} ${this.actual} exceeds ` +\n      `the configured maximum ${this.maximum}. Accepted work is unaffected; retry after the ` +\n      \"lane drains or raise the limit (DEPLOY-007).\"\n    );\n  }\n}\n\n/** The platform's hard per-Object database cap (10 GB, developers.cloudflare.com limits). */\nexport const CLOUDFLARE_DATABASE_CAP_BYTES = 10_000_000_000;\n\n/** Default database-size admission ceiling: a 1 GB safety margin under the platform cap. */\nexport const DEFAULT_MAX_DATABASE_BYTES = 9_000_000_000;\n\n/**\n * Explicit bounded admission quotas checked by the Thread Object BEFORE admission\n * (exit gate \"resource limits are checked before admission\").\n */\nexport class CloudflareAdmissionLimitsValue extends Schema.Class<CloudflareAdmissionLimitsValue>(\n  \"@effect-agent/platform-cloudflare/CloudflareAdmissionLimitsValue\",\n)({\n  /** Maximum nonterminal Submissions per Thread lane before new admissions refuse. */\n  maxQueueDepthPerLane: Schema.Int.check(\n    Schema.isGreaterThan(0),\n    Schema.isLessThanOrEqualTo(100_000),\n  ),\n  /** Maximum encoded input bytes; never above the storage per-value bound. */\n  maxInputBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2_000_000)),\n  /** Maximum `ctx.storage.sql.databaseSize` at admission; stays under the 10 GB platform cap. */\n  maxDatabaseBytes: Schema.Int.check(\n    Schema.isGreaterThan(0),\n    Schema.isLessThanOrEqualTo(CLOUDFLARE_DATABASE_CAP_BYTES),\n  ),\n}) {}\n\n/**\n * Validated Cloudflare durable runtime configuration. The producer identity of one\n * Thread Object is `{producerPrefix}:{threadId}` — stable across incarnations of\n * the same deployment, distinct across deployments — and producer-epoch fencing (not the\n * producer name) remains the correctness authority (DUR-006).\n */\nexport class CloudflareDurableRuntimeConfigValue extends Schema.Class<CloudflareDurableRuntimeConfigValue>(\n  \"@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfigValue\",\n)({\n  deploymentId: DeploymentId,\n  /** Head of the minted producer identity `{producerPrefix}:{threadId}`. */\n  producerPrefix: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n  /** Submission ownership lease duration (D5); fences work across Object incarnations. */\n  ownershipLeaseDuration: PositiveMillis,\n  /** Base delay of the alarm re-arm backoff when a pass makes no progress. */\n  alarmBackoffBase: PositiveMillis,\n  /** Ceiling of the alarm re-arm backoff. */\n  alarmBackoffCap: PositiveMillis,\n  /**\n   * The maintenance-pass scan cadence and the ceiling of every re-arm delay: nonterminal\n   * work is revisited at least this often (wake/scan pairing, persistence §14).\n   */\n  wakeScanInterval: PositiveMillis,\n  /** `awaitSettlement` ledger re-check cadence when no wake arrives. */\n  settlementPollInterval: PositiveMillis,\n  /** Worker ownership-lease renewal cadence during an active Attempt. */\n  leaseRenewalInterval: PositiveMillis,\n  /** Active-Run abort-intent poll cadence. */\n  abortPollInterval: PositiveMillis,\n  /** Canonical observation poll cadence of the Durable Object store. */\n  observationPollInterval: NonNegativeMillis,\n  /** Per-value byte bound; must stay under the platform's 2 MB SQLite value limit. */\n  maxStoredValueBytes: Schema.Int.check(\n    Schema.isGreaterThan(0),\n    Schema.isLessThanOrEqualTo(2_000_000),\n  ),\n  /** Opt-in full payload/digest-chain audit while opening the store. */\n  verifyOnOpen: Schema.Boolean,\n  limits: CloudflareAdmissionLimitsValue,\n}) {}\n\n/** Explicit configuration authority for the assembled Cloudflare durable runtime. */\nexport class CloudflareDurableRuntimeConfig extends Context.Service<\n  CloudflareDurableRuntimeConfig,\n  CloudflareDurableRuntimeConfigValue\n>()(\"@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfig\") {}\n\n/** Documented production defaults applied by `ThreadObject.layer`. */\nexport const CLOUDFLARE_RUNTIME_DEFAULTS = {\n  ownershipLeaseDuration: Duration.toMillis(DEFAULT_OWNERSHIP_LEASE_DURATION),\n  alarmBackoffBase: 100,\n  alarmBackoffCap: 5_000,\n  wakeScanInterval: 1_000,\n  settlementPollInterval: 500,\n  leaseRenewalInterval: 10_000,\n  abortPollInterval: 500,\n  observationPollInterval: 25,\n  maxStoredValueBytes: DEFAULT_MAX_STORED_VALUE_BYTES,\n  verifyOnOpen: false,\n  maxQueueDepthPerLane: 256,\n  maxInputBytes: DEFAULT_MAX_STORED_VALUE_BYTES,\n  maxDatabaseBytes: DEFAULT_MAX_DATABASE_BYTES,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAWA,MAAM,iBAAiB,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AAC/D,MAAM,oBAAoB,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;AAG3E,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA;CACE,SAAS,OAAO;CAChB,OAAO,OAAO,YAAY,OAAO,OAAO,CAAC;AAC3C,CACF,CAAC,CAAC,CAAC;;;;;;;;;AAUH,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA;CACE,OAAO,OAAO,SAAS;EAAC;EAAe;EAAe;CAAgB,CAAC;CACvE,QAAQ,OAAO;CACf,SAAS,OAAO;AAClB,CACF,CAAC,CAAC;CACA,IAAa,UAAU;EACrB,OACE,oDAAoD,KAAK,MAAM,GAAG,KAAK,OAAO,kCACpD,KAAK,QAAQ;CAG3C;AACF;;AAGA,MAAa,gCAAgC;;AAG7C,MAAa,6BAA6B;;;;;AAM1C,IAAa,iCAAb,cAAoD,OAAO,MACzD,kEACF,CAAC,CAAC;;CAEA,sBAAsB,OAAO,IAAI,MAC/B,OAAO,cAAc,CAAC,GACtB,OAAO,oBAAoB,GAAO,CACpC;;CAEA,eAAe,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,GAAG,OAAO,oBAAoB,GAAS,CAAC;;CAE9F,kBAAkB,OAAO,IAAI,MAC3B,OAAO,cAAc,CAAC,GACtB,OAAO,oBAAoB,6BAA6B,CAC1D;AACF,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,sCAAb,cAAyD,OAAO,MAC9D,uEACF,CAAC,CAAC;CACA,cAAc;;CAEd,gBAAgB,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;;CAEnE,wBAAwB;;CAExB,kBAAkB;;CAElB,iBAAiB;;;;;CAKjB,kBAAkB;;CAElB,wBAAwB;;CAExB,sBAAsB;;CAEtB,mBAAmB;;CAEnB,yBAAyB;;CAEzB,qBAAqB,OAAO,IAAI,MAC9B,OAAO,cAAc,CAAC,GACtB,OAAO,oBAAoB,GAAS,CACtC;;CAEA,cAAc,OAAO;CACrB,QAAQ;AACV,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,iCAAb,cAAoD,QAAQ,QAG1D,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC;;AAGzE,MAAa,8BAA8B;CACzC,wBAAwB,SAAS,SAAS,gCAAgC;CAC1E,kBAAkB;CAClB,iBAAiB;CACjB,kBAAkB;CAClB,wBAAwB;CACxB,sBAAsB;CACtB,mBAAmB;CACnB,yBAAyB;CACzB,qBAAqB;CACrB,cAAc;CACd,sBAAsB;CACtB,eAAe;CACf,kBAAkB;AACpB"}

package/dist/CloudflareMemory.d.mts

@@ -0,0 +1,142 @@
+import { Principal } from "@effect-agent/thread/SubmissionLedger";
+import { Context, Effect, Layer } from "effect";
+import * as Memory from "@effect-agent/core/Memory";
+import * as MemoryNamespace from "@effect-agent/core/MemoryNamespace";
+import { MemoryRecallLimits } from "@effect-agent/core/MemoryReference";
+import { MemoryAccess } from "@effect-agent/core/MemoryRevalidation";
+import { MemoryDocument, MemoryKey, MemoryMutationFailpoint, MemoryReader, MemoryStorageError, MemoryWrite, MemoryWriter } from "@effect-agent/core/MemoryStore";
+import { MemoryIndexSearch, SemanticMemoryProfile } from "@effect-agent/core/SemanticMemoryIndex";
+import { SemanticCandidateLimits } from "@effect-agent/core/SemanticMemoryRevalidation";
+import { DoMemoryStorageLimits } from "@effect-agent/storage-cloudflare/DoMemoryStore";
+import { MemoryOwnerAuthorizer, MemoryOwnerIdentity, MemoryRpcError, MemoryRpcLimits } from "@effect-agent/storage-cloudflare/MemoryProtocol";
+import { DurableObject, DurableObjectState, WorkerEnvironment } from "effect-cf";
+declare namespace CloudflareMemory_d_exports {
+  export { CloudflareMemoryClient, MemoryObject, MemoryObjectClass, MemoryObjectInstance, MemoryObjectNamespace, MemoryObjectRpc, cloudflareMemoryWriterLayer, memoryObjectName };
+}
+interface MemoryObjectRpc extends Rpc.DurableObjectBranded {
+  memory(encoded: string): Promise<string>;
+}
+declare const MemoryObjectNamespace_base: Context.ServiceClass<MemoryObjectNamespace, "@effect-agent/platform-cloudflare/MemoryObjectNamespace", {
+  readonly namespace: DurableObjectNamespace<MemoryObjectRpc>;
+}>;
+declare class MemoryObjectNamespace extends MemoryObjectNamespace_base {}
+/** Namespace version and identity are already canonicalized by MemoryNamespace. */
+declare const memoryObjectName: (namespace: MemoryNamespace.Any) => string;
+declare const CloudflareMemoryClient: {
+  /** Bind access and principal using the MemoryObjectNamespace supplied by the application. */
+  make: <Namespace extends MemoryNamespace.Any>(access: MemoryAccess<Namespace>, principal: string & import("effect/Brand").Brand<"@effect-agent/thread/Principal">, rpcLimits?: MemoryRpcLimits | undefined) => Effect.Effect<{
+    get: (key: MemoryKey<Namespace>) => Effect.Effect<MemoryDocument<Namespace> | null, import("@effect-agent/core/MemoryStore").MemoryConflict | import("@effect-agent/core/SemanticMemoryIndex").MemoryIndexError | import("@effect-agent/core/MemoryStore").MemoryMutationFailure | import("@effect-agent/core/MemoryStore").MemoryOperationConflict | import("@effect-agent/core/MemoryReference").MemoryRecallError | MemoryRpcError | MemoryStorageError | import("@effect-agent/core/MemoryStore").MemoryWithdrawn | import("@effect-agent/core/SemanticMemoryRevalidation").SemanticMemoryError, never>;
+    recall: (lookup: {
+      readonly _tag: "Found";
+      readonly passages: readonly import("@effect-agent/core/MemoryReference").MemoryPassage[];
+    } | {
+      readonly _tag: "NoMatch";
+    } | {
+      readonly _tag: "Unavailable";
+      readonly message: string;
+    } | {
+      readonly _tag: "InsufficientFreshness";
+      readonly message: string;
+    }, limits: MemoryRecallLimits, estimateTokens?: ((text: string) => number) | undefined) => Effect.Effect<Memory.RecalledMemory, import("@effect-agent/core/MemoryStore").MemoryConflict | import("@effect-agent/core/SemanticMemoryIndex").MemoryIndexError | import("@effect-agent/core/MemoryStore").MemoryMutationFailure | import("@effect-agent/core/MemoryStore").MemoryOperationConflict | import("@effect-agent/core/MemoryReference").MemoryRecallError | MemoryRpcError | MemoryStorageError | import("@effect-agent/core/MemoryStore").MemoryWithdrawn | import("@effect-agent/core/SemanticMemoryRevalidation").SemanticMemoryError, never>;
+    revalidate: (lookup: {
+      readonly _tag: "Found";
+      readonly passages: readonly import("@effect-agent/core/MemoryReference").MemoryPassage[];
+    } | {
+      readonly _tag: "NoMatch";
+    } | {
+      readonly _tag: "Unavailable";
+      readonly message: string;
+    } | {
+      readonly _tag: "InsufficientFreshness";
+      readonly message: string;
+    }, limits: MemoryRecallLimits) => Effect.Effect<{
+      readonly _tag: "Found";
+      readonly passages: readonly import("@effect-agent/core/MemoryReference").MemoryPassage[];
+    } | {
+      readonly _tag: "NoMatch";
+    } | {
+      readonly _tag: "Unavailable";
+      readonly message: string;
+    } | {
+      readonly _tag: "InsufficientFreshness";
+      readonly message: string;
+    }, import("@effect-agent/core/MemoryStore").MemoryConflict | import("@effect-agent/core/SemanticMemoryIndex").MemoryIndexError | import("@effect-agent/core/MemoryStore").MemoryMutationFailure | import("@effect-agent/core/MemoryStore").MemoryOperationConflict | import("@effect-agent/core/MemoryReference").MemoryRecallError | MemoryRpcError | MemoryStorageError | import("@effect-agent/core/MemoryStore").MemoryWithdrawn | import("@effect-agent/core/SemanticMemoryRevalidation").SemanticMemoryError, never>;
+    revalidateSemantic: (found: MemoryIndexSearch<Namespace>, profile: SemanticMemoryProfile, limits: SemanticCandidateLimits) => Effect.Effect<import("@effect-agent/core/SemanticMemoryRevalidation").SemanticCandidateResult, import("@effect-agent/core/MemoryStore").MemoryConflict | import("@effect-agent/core/SemanticMemoryIndex").MemoryIndexError | import("@effect-agent/core/MemoryStore").MemoryMutationFailure | import("@effect-agent/core/MemoryStore").MemoryOperationConflict | import("@effect-agent/core/MemoryReference").MemoryRecallError | MemoryRpcError | MemoryStorageError | import("@effect-agent/core/MemoryStore").MemoryWithdrawn | import("@effect-agent/core/SemanticMemoryRevalidation").SemanticMemoryError, never>;
+    change: (write: MemoryWrite<Namespace>) => Effect.Effect<MemoryDocument<Namespace>, import("@effect-agent/core/MemoryStore").MemoryConflict | import("@effect-agent/core/SemanticMemoryIndex").MemoryIndexError | import("@effect-agent/core/MemoryStore").MemoryMutationFailure | import("@effect-agent/core/MemoryStore").MemoryOperationConflict | import("@effect-agent/core/MemoryReference").MemoryRecallError | MemoryRpcError | MemoryStorageError | import("@effect-agent/core/MemoryStore").MemoryWithdrawn | import("@effect-agent/core/SemanticMemoryRevalidation").SemanticMemoryError, never>;
+  }, MemoryRpcError, MemoryObjectNamespace>;
+  /** Use a resolved Worker or Durable Object binding without manual service provisioning. */
+  fromBinding: <Namespace extends MemoryNamespace.Any>(binding: DurableObjectNamespace<MemoryObjectRpc>, options: {
+    readonly access: MemoryAccess<Namespace>;
+    readonly principal: Principal;
+    readonly rpcLimits?: MemoryRpcLimits;
+  }) => Effect.Effect<{
+    get: (key: MemoryKey<Namespace>) => Effect.Effect<MemoryDocument<Namespace> | null, import("@effect-agent/core/MemoryStore").MemoryConflict | import("@effect-agent/core/SemanticMemoryIndex").MemoryIndexError | import("@effect-agent/core/MemoryStore").MemoryMutationFailure | import("@effect-agent/core/MemoryStore").MemoryOperationConflict | import("@effect-agent/core/MemoryReference").MemoryRecallError | MemoryRpcError | MemoryStorageError | import("@effect-agent/core/MemoryStore").MemoryWithdrawn | import("@effect-agent/core/SemanticMemoryRevalidation").SemanticMemoryError, never>;
+    recall: (lookup: {
+      readonly _tag: "Found";
+      readonly passages: readonly import("@effect-agent/core/MemoryReference").MemoryPassage[];
+    } | {
+      readonly _tag: "NoMatch";
+    } | {
+      readonly _tag: "Unavailable";
+      readonly message: string;
+    } | {
+      readonly _tag: "InsufficientFreshness";
+      readonly message: string;
+    }, limits: MemoryRecallLimits, estimateTokens?: ((text: string) => number) | undefined) => Effect.Effect<Memory.RecalledMemory, import("@effect-agent/core/MemoryStore").MemoryConflict | import("@effect-agent/core/SemanticMemoryIndex").MemoryIndexError | import("@effect-agent/core/MemoryStore").MemoryMutationFailure | import("@effect-agent/core/MemoryStore").MemoryOperationConflict | import("@effect-agent/core/MemoryReference").MemoryRecallError | MemoryRpcError | MemoryStorageError | import("@effect-agent/core/MemoryStore").MemoryWithdrawn | import("@effect-agent/core/SemanticMemoryRevalidation").SemanticMemoryError, never>;
+    revalidate: (lookup: {
+      readonly _tag: "Found";
+      readonly passages: readonly import("@effect-agent/core/MemoryReference").MemoryPassage[];
+    } | {
+      readonly _tag: "NoMatch";
+    } | {
+      readonly _tag: "Unavailable";
+      readonly message: string;
+    } | {
+      readonly _tag: "InsufficientFreshness";
+      readonly message: string;
+    }, limits: MemoryRecallLimits) => Effect.Effect<{
+      readonly _tag: "Found";
+      readonly passages: readonly import("@effect-agent/core/MemoryReference").MemoryPassage[];
+    } | {
+      readonly _tag: "NoMatch";
+    } | {
+      readonly _tag: "Unavailable";
+      readonly message: string;
+    } | {
+      readonly _tag: "InsufficientFreshness";
+      readonly message: string;
+    }, import("@effect-agent/core/MemoryStore").MemoryConflict | import("@effect-agent/core/SemanticMemoryIndex").MemoryIndexError | import("@effect-agent/core/MemoryStore").MemoryMutationFailure | import("@effect-agent/core/MemoryStore").MemoryOperationConflict | import("@effect-agent/core/MemoryReference").MemoryRecallError | MemoryRpcError | MemoryStorageError | import("@effect-agent/core/MemoryStore").MemoryWithdrawn | import("@effect-agent/core/SemanticMemoryRevalidation").SemanticMemoryError, never>;
+    revalidateSemantic: (found: MemoryIndexSearch<Namespace>, profile: SemanticMemoryProfile, limits: SemanticCandidateLimits) => Effect.Effect<import("@effect-agent/core/SemanticMemoryRevalidation").SemanticCandidateResult, import("@effect-agent/core/MemoryStore").MemoryConflict | import("@effect-agent/core/SemanticMemoryIndex").MemoryIndexError | import("@effect-agent/core/MemoryStore").MemoryMutationFailure | import("@effect-agent/core/MemoryStore").MemoryOperationConflict | import("@effect-agent/core/MemoryReference").MemoryRecallError | MemoryRpcError | MemoryStorageError | import("@effect-agent/core/MemoryStore").MemoryWithdrawn | import("@effect-agent/core/SemanticMemoryRevalidation").SemanticMemoryError, never>;
+    change: (write: MemoryWrite<Namespace>) => Effect.Effect<MemoryDocument<Namespace>, import("@effect-agent/core/MemoryStore").MemoryConflict | import("@effect-agent/core/SemanticMemoryIndex").MemoryIndexError | import("@effect-agent/core/MemoryStore").MemoryMutationFailure | import("@effect-agent/core/MemoryStore").MemoryOperationConflict | import("@effect-agent/core/MemoryReference").MemoryRecallError | MemoryRpcError | MemoryStorageError | import("@effect-agent/core/MemoryStore").MemoryWithdrawn | import("@effect-agent/core/SemanticMemoryRevalidation").SemanticMemoryError, never>;
+  }, MemoryRpcError, never>;
+};
+/**
+ * Optional activity-processor destination. Keeps domain write errors intact; transport,
+ * authorization and deadline failures become the existing MemoryStorageError contract.
+ * Receipts remain authoritative, including after caller interruption or lost replies.
+ */
+declare const cloudflareMemoryWriterLayer: (access: MemoryAccess, principal: Principal, limits?: MemoryRpcLimits) => Layer.Layer<MemoryWriter, MemoryRpcError, MemoryObjectNamespace>;
+type OwnerServices = MemoryReader | MemoryWriter | MemoryOwnerAuthorizer | MemoryOwnerIdentity;
+interface MemoryObjectInstance extends InstanceType<DurableObject.DurableObjectClass<Record<never, never>, OwnerServices>> {
+  memory(encoded: string): Promise<string>;
+}
+interface MemoryObjectClass {
+  new (ctx: globalThis.DurableObjectState, env: Cloudflare.Env): MemoryObjectInstance;
+}
+/**
+ * Dedicated SQLite owner, independent of Thread lifetimes. The host binds authorization
+ * after restoring its namespace definition from MemoryOwnerIdentity. Do not retain
+ * cleanup-scoped resources in the host Layer; it lives for the DO incarnation.
+ */
+declare const makeMemoryObject: <E>(host: Layer.Layer<MemoryOwnerAuthorizer, E, MemoryOwnerIdentity | DurableObjectState.DurableObjectState | WorkerEnvironment>, options?: {
+  readonly storageLimits?: DoMemoryStorageLimits;
+  readonly rpcLimits?: MemoryRpcLimits;
+  readonly failpoints?: Layer.Layer<MemoryMutationFailpoint, never, DurableObjectState.DurableObjectState>;
+}) => MemoryObjectClass;
+declare const MemoryObject: {
+  /** Build the SQLite Durable Object class with the application's owner authorization Layer. */
+  make: typeof makeMemoryObject;
+};
+//#endregion
+export { CloudflareMemoryClient, MemoryObject, MemoryObjectClass, MemoryObjectInstance, MemoryObjectNamespace, MemoryObjectRpc, cloudflareMemoryWriterLayer, memoryObjectName, CloudflareMemory_d_exports as t };
+//# sourceMappingURL=CloudflareMemory.d.mts.map