@effect-agent/platform-cloudflare 0.1.0-beta.9 → 0.1.0-beta.90

package/dist/ThreadObject-DvRG0dDz.mjs

@@ -0,0 +1,835 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { DurableObjectContext, ThreadObjectIdentity, ThreadObjectNamespace, ThreadObjectPlacement, callThreadObject, threadNamespaceFromEnv } from "./CloudflareBindings.mjs";
+import { AdmissionLimitExceeded, CLOUDFLARE_RUNTIME_DEFAULTS, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError } from "./CloudflareConfig.mjs";
+import { DurableAlarmError, DurableAlarmService, ThreadMaintenance, ThreadMaintenanceFailpoint, ThreadMessageDelivery, ThreadMutationGate, ThreadPublication, publishCommitted } from "./Alarm.mjs";
+import { AbortRecorded, ApprovalRecorded, CloudflareThreadClient, HostFailed, HostProtocolError, ObservedPage, ProgressCancelled, ProgressObserved, SettlementReached, SubmissionStatusResponse, SubmitSucceeded, UnknownResolutionRecorded, boundHostDiagnostic, decodeAbortCommand, decodeApprovalDecisionCommand, decodeAwaitProgressRequest, decodeCancelProgressRequest, decodeObservePageRequest, decodeReceipt, decodeSubmitRequest, decodeUnknownResolutionCommand, encodeHostResponse } from "./CloudflareThreadClient.mjs";
+import { t as cloudflarePreparedInputAdmissionLayer } from "./prepared-admission-DU0_T-ev.mjs";
+import { cloudflareWakeSchedulerLayer } from "./WakeScheduler.mjs";
+import { Cause, Clock, Context, Deferred, Duration, Effect, Layer, Option, Ref, Schema, Semaphore, Stream } from "effect";
+import { compileRegistrations } from "effect-agent/agent-registration";
+import { DurableAgentRuntime, DurableRuntimeConfig, RecoveryReport } from "effect-agent/durable-agent-runtime";
+import { SubmissionId, ThreadId } from "effect-agent/identifiers";
+import { AdmissionPolicyError, LedgerError, OwnershipLost, SettlementConflict, SubmissionLedger, SubmissionLookupById, SubmissionLookupByKey } from "effect-agent/submission-ledger";
+import { ThreadProjectionMaintenance } from "effect-agent/thread-projection-maintenance";
+import { SqlClient } from "effect/unstable/sql/SqlClient";
+import { PersistedJson, ProducerId } from "effect-agent/records";
+import { DurableObject, DurableObjectState, WorkerEnvironment } from "effect-cf";
+import { BrowserCrypto } from "@effect/platform-browser";
+import { SqliteClient } from "@effect/sql-sqlite-do";
+import { DigestError } from "effect-agent/digest";
+import { DurableRuntimeFailpoint, DurableRuntimeFailpointError } from "effect-agent/durable-failpoint";
+import { OperationAuthorizationRequest, OperationAuthorizer, OperationDenied, operationAuthorizerLayer } from "effect-agent/operation-authorizer";
+import { AppendConflict, FenceRejected, ThreadNotMaterialized, ThreadRead, ThreadStore, ThreadStoreError } from "effect-agent/thread-store";
+import "effect-agent/prepared-input-admission";
+import { LedgerLookupResult, PortFailed, PortProtocolError, PortSucceeded, decodePortRequest, encodePortResponse } from "@effect-agent/storage-cloudflare/port-protocol";
+import { IntegrityReport, ObligationReport, ObligationThresholds, RecoveryExplanation, RetryCommand, RetryRefused } from "effect-agent/admin";
+import { RunJournalError } from "effect-agent/run-journal";
+import { WakeScheduler } from "effect-agent/wake-scheduler";
+import { doMessageDeliveryStoreLayer } from "@effect-agent/storage-cloudflare/do-message-delivery-store";
+import "@effect-agent/storage-cloudflare/do-storage-failpoint";
+import { submissionLedgerLayer } from "@effect-agent/storage-cloudflare/do-submission-ledger";
+import { storageConfigLayer, storageFailpointLayer, threadStoreLayer } from "@effect-agent/storage-cloudflare/do-thread-store";
+import { ThreadPortTransport, executePortRequest, portTransportFailure, routedSubmissionLedgerLayer, routedThreadStoreLayer } from "@effect-agent/storage-cloudflare/port-routing";
+import { MessageDeliveryDriver, MessageDeliveryError, MessageDeliveryStore } from "effect-agent/message-delivery";
+import { CurrentToolFailureObserver, RunContextPreparationPassthrough, RunToolAuthorization, toolFailureObserverLayer } from "effect-agent/run-options";
+import { ToolReconciler } from "effect-agent/tool-reconciler";
+//#region src/internal/message-delivery.ts
+/** Every write prearms its owner; the delivery due index owns its recovery deadline. */
+const guardedMessageDeliveryStoreLayer = Layer.effect(MessageDeliveryStore, Effect.gen(function* () {
+	const store = yield* MessageDeliveryStore;
+	const mutations = yield* ThreadMutationGate;
+	const wakes = yield* WakeScheduler;
+	const { ownsThread } = yield* ThreadObjectPlacement;
+	const deadline = yield* Ref.make(void 0);
+	const cacheGate = yield* Semaphore.make(1);
+	const local = (owner, body) => owner === void 0 || ownsThread(owner) ? body : Effect.fail(MessageDeliveryError.make({
+		reason: "validation",
+		operation: "message owner"
+	}));
+	const mutate = (body) => mutations.withMutation(cacheGate.withPermit(Ref.set(deadline, void 0).pipe(Effect.andThen(body))), { invalidatesRecovery: false }).pipe(Effect.catchTag("DurableAlarmError", () => MessageDeliveryError.make({
+		reason: "storage",
+		operation: "prearm message delivery"
+	})));
+	const nextDeadline = cacheGate.withPermit(Effect.gen(function* () {
+		const cached = yield* Ref.get(deadline);
+		if (cached !== void 0) return cached;
+		const current = yield* store.nextDeadline();
+		yield* Ref.set(deadline, current);
+		return current;
+	}));
+	return MessageDeliveryStore.of({
+		limits: store.limits,
+		maxStoredValueBytes: store.maxStoredValueBytes,
+		insert: (record) => local(record.key.ownerThreadId, mutate(store.insert(record)).pipe(Effect.tap(() => wakes.notify(record.key.ownerThreadId)))),
+		get: (key) => local(key.ownerThreadId, store.get(key)),
+		list: (request) => local(request.ownerThreadId, store.list(request)),
+		change: (key, change) => local(key.ownerThreadId, mutate(store.change(key, change))),
+		due: (nowMillis, limit, owner) => local(owner, store.due(nowMillis, limit, owner)).pipe(Effect.filterOrFail((keys) => keys.every((key) => ownsThread(key.ownerThreadId)), () => MessageDeliveryError.make({
+			reason: "validation",
+			operation: "message owner"
+		}))),
+		nextDeadline: (owner) => local(owner, owner === void 0 ? nextDeadline : store.nextDeadline(owner))
+	});
+}));
+/** Message progress shares the native alarm slot without blocking source runtime work. */
+const threadMessageDeliveryLayer = Layer.effectContext(Effect.gen(function* () {
+	const driver = yield* MessageDeliveryDriver;
+	const store = yield* MessageDeliveryStore;
+	const wakes = yield* WakeScheduler;
+	const config = yield* CloudflareDurableRuntimeConfig;
+	const failure = (operation) => () => DurableAlarmError.make({
+		operation,
+		message: "Durable message recovery remains pending"
+	});
+	const drain = Effect.gen(function* () {
+		const deadline = yield* store.nextDeadline();
+		if (deadline !== null && deadline <= (yield* Clock.currentTimeMillis)) yield* driver.runDue();
+	}).pipe(Effect.mapError(failure("drain message delivery")));
+	return Context.make(ThreadMessageDelivery, {
+		drain,
+		drainUntil: Effect.fn("ThreadMessageDelivery.drainUntil")(function* (finished) {
+			const notified = (yield* Stream.toPull(wakes.wakes)).pipe(Effect.catch(() => Effect.never));
+			yield* Effect.gen(function* () {
+				yield* drain;
+				const deadline = yield* store.nextDeadline().pipe(Effect.mapError(failure("read message deadline")));
+				const delay = deadline === null ? config.wakeScanInterval : Math.min(config.wakeScanInterval, Math.max(1, deadline - (yield* Clock.currentTimeMillis)));
+				yield* Effect.raceFirst(Deferred.await(finished), Effect.raceFirst(notified, Effect.sleep(delay)));
+			}).pipe(Effect.repeat({ until: () => Deferred.isDone(finished) }));
+		}, Effect.scoped),
+		pendingDeadline: store.nextDeadline().pipe(Effect.map(Option.fromNullishOr), Effect.mapError(failure("read message deadline")))
+	});
+}));
+//#endregion
+//#region src/internal/progress-wait.ts
+/** Cancellation tombstones are bounded hints, never durable authority. */
+const MAX_CANCELLATION_TOMBSTONES = 1024;
+/**
+* Per-incarnation cancellation registry for long-lived progress RPCs. The public runtime owns
+* the actual wake registration; this host-only registry lets an interrupted Worker Effect ask
+* the Object to interrupt its scoped wait before the Worker execution context itself ends.
+*/
+var ProgressWaitRegistry = class ProgressWaitRegistry extends Context.Service()("@effect-agent/platform-cloudflare/ProgressWaitRegistry") {
+	static layer = Layer.effect(ProgressWaitRegistry, Effect.gen(function* () {
+		const registrations = yield* Ref.make(/* @__PURE__ */ new Map());
+		const remove = (waiterId, deferred) => Ref.update(registrations, (current) => {
+			const existing = current.get(waiterId);
+			if (existing === void 0 || existing === "cancelled" || !existing.has(deferred)) return current;
+			const next = new Map(current);
+			const active = new Set(existing);
+			active.delete(deferred);
+			if (active.size === 0) next.delete(waiterId);
+			else next.set(waiterId, active);
+			return next;
+		});
+		const subscribe = Effect.fn("ProgressWaitRegistry.subscribe")((waiterId) => Effect.gen(function* () {
+			const deferred = yield* Deferred.make();
+			yield* Effect.addFinalizer(() => remove(waiterId, deferred));
+			return {
+				cancelled: yield* Ref.modify(registrations, (current) => {
+					const existing = current.get(waiterId);
+					const next = new Map(current);
+					if (existing === "cancelled") return [true, current];
+					const active = new Set(existing ?? []);
+					active.add(deferred);
+					next.set(waiterId, active);
+					return [false, next];
+				}),
+				deferred
+			};
+		}).pipe(Effect.map(({ cancelled, deferred }) => cancelled ? Effect.void : Deferred.await(deferred))));
+		const cancel = Effect.fn("ProgressWaitRegistry.cancel")(function* (waiterId) {
+			const waiters = yield* Ref.modify(registrations, (current) => {
+				const existing = current.get(waiterId);
+				if (existing === "cancelled") return [[], current];
+				const next = new Map(current);
+				next.delete(waiterId);
+				next.set(waiterId, "cancelled");
+				let tombstones = 0;
+				for (const registration of next.values()) if (registration === "cancelled") tombstones += 1;
+				if (tombstones > MAX_CANCELLATION_TOMBSTONES) for (const [id, registration] of next) {
+					if (registration !== "cancelled") continue;
+					next.delete(id);
+					break;
+				}
+				return [existing === void 0 ? [] : [...existing], next];
+			});
+			yield* Effect.forEach(waiters, (waiter) => Deferred.succeed(waiter, void 0), { discard: true });
+		}, Effect.uninterruptible);
+		return ProgressWaitRegistry.of({
+			subscribe,
+			cancel
+		});
+	}));
+};
+//#endregion
+//#region src/internal/transport.ts
+/**
+* `ThreadPortTransport` over native Durable Object JS RPC (decision D-P6-3): one
+* `portCall(envelope)` on the stub of the Object that owns the addressed Thread
+* (`namespace.idFromName(threadId)` — the identity rule, plan §1.2). The envelopes are
+* already Schema-encoded JSON, so the RPC boundary carries only structured-cloneable values;
+* the protocol module stays transport-agnostic and fetch-with-JSON remains the documented
+* fallback carrier.
+*
+* Every delivery problem — stub construction, RPC rejection, overload, deploy-in-progress —
+* surfaces as `PortTransportError` (preserving the platform stub's own `retryable` signal
+* when present) and NEVER as a fabricated answer: on `resolveAdmission` the routing layer
+* turns exactly this error into `AdmissionIndeterminate` (SUB-031).
+*/
+const threadPortTransportLayer = Layer.effect(ThreadPortTransport)(Effect.gen(function* () {
+	const namespace = yield* ThreadObjectNamespace;
+	return ThreadPortTransport.of({ call: (threadId, request) => callThreadObject(threadId, (target) => target.portCall(request), (cause) => portTransportFailure(threadId, cause)).pipe(Effect.provideService(ThreadObjectNamespace, namespace), Effect.withSpan("CloudflarePortTransport.call", { attributes: { threadId } })) });
+}));
+//#endregion
+//#region src/internal/layers.ts
+/**
+* Owner-side execution port for a `portCall` request the wire endpoint has already decoded.
+* It executes against THIS Object's LOCAL port facets — never the routed decorators, so a
+* request cannot bounce between Objects — and returns the typed response for the endpoint to
+* encode.
+*/
+var ThreadObjectPorts = class extends Context.Service()("@effect-agent/platform-cloudflare/ThreadObjectPorts") {};
+const decodeConfigValue = Schema.decodeUnknownEffect(CloudflareDurableRuntimeConfigValue);
+const decodeThreadId = Schema.decodeUnknownEffect(ThreadId);
+const decodeProducerId = Schema.decodeUnknownEffect(ProducerId);
+const configFromOptions = (options) => decodeConfigValue({
+	deploymentId: options.deploymentId,
+	producerPrefix: options.producerPrefix,
+	ownershipLeaseDuration: options.ownershipLeaseDuration ?? CLOUDFLARE_RUNTIME_DEFAULTS.ownershipLeaseDuration,
+	alarmBackoffBase: options.alarmBackoffBase ?? CLOUDFLARE_RUNTIME_DEFAULTS.alarmBackoffBase,
+	alarmBackoffCap: options.alarmBackoffCap ?? CLOUDFLARE_RUNTIME_DEFAULTS.alarmBackoffCap,
+	wakeScanInterval: options.wakeScanInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.wakeScanInterval,
+	settlementPollInterval: options.settlementPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.settlementPollInterval,
+	leaseRenewalInterval: options.leaseRenewalInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.leaseRenewalInterval,
+	abortPollInterval: options.abortPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.abortPollInterval,
+	observationPollInterval: options.observationPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.observationPollInterval,
+	maxStoredValueBytes: options.maxStoredValueBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxStoredValueBytes,
+	verifyOnOpen: options.verifyOnOpen ?? CLOUDFLARE_RUNTIME_DEFAULTS.verifyOnOpen,
+	limits: {
+		maxQueueDepthPerLane: options.maxQueueDepthPerLane ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxQueueDepthPerLane,
+		maxInputBytes: Math.min(options.maxInputBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxInputBytes, options.maxStoredValueBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxStoredValueBytes),
+		maxDatabaseBytes: options.maxDatabaseBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxDatabaseBytes
+	}
+}).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
+	message: `Invalid Cloudflare durable runtime configuration: ${error.message}`,
+	cause: error
+})));
+/**
+* The Thread this Object owns, from the Object identity rule (plan §1.2): Thread
+* Objects are addressed exclusively by `idFromName(threadId)`, so `ctx.id.name` IS the
+* Thread ID. An unnamed Object (from `newUniqueId`) is a deployment error, not a lane.
+*/
+const threadIdFromState = (ctx) => ctx.id.name === void 0 ? Effect.fail(CloudflarePlatformConfigError.make({ message: "This Durable Object was not created via idFromName(threadId); Thread Objects must be addressed by their Thread identity (plan §1.2)." })) : decodeThreadId(ctx.id.name).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
+	message: `The Durable Object name is not a valid ThreadId: ${error.message}`,
+	cause: error
+})));
+/**
+* Validate deployment settings and derive services before building application dependencies.
+* The native class factory builds this Layer inside its constructor gate. Custom Effect hosts
+* can provide it around the complete application Layer with the native context already supplied.
+*/
+const runtimeConfigLayer = (options, producerId) => Layer.unwrap(Effect.gen(function* () {
+	const { ctx } = yield* DurableObjectContext;
+	const config = yield* configFromOptions(options);
+	return Layer.mergeAll(Layer.succeed(CloudflareDurableRuntimeConfig, config), DurableRuntimeConfig.layer({
+		deploymentId: config.deploymentId,
+		producerId,
+		settlementPollInterval: Duration.millis(config.settlementPollInterval),
+		leaseRenewalInterval: Duration.millis(config.leaseRenewalInterval),
+		abortPollInterval: Duration.millis(config.abortPollInterval),
+		...options.estimateCostMicrousd === void 0 ? {} : { estimateCostMicrousd: options.estimateCostMicrousd }
+	}), BrowserCrypto.layer, storageFailpointLayer({
+		storage: ctx.storage,
+		failpoint: options.storageFailpoint?.(ctx)
+	}), options.runtimeFailpoint === void 0 ? DurableRuntimeFailpoint.layer : Layer.succeed(DurableRuntimeFailpoint, { hit: options.runtimeFailpoint(ctx) }), options.maintenanceFailpoint === void 0 ? ThreadMaintenanceFailpoint.layer : Layer.succeed(ThreadMaintenanceFailpoint, { hit: options.maintenanceFailpoint(ctx) }), options.toolReconciler ?? ToolReconciler.uncertain, options.operationAuthorizer === void 0 ? Layer.empty : operationAuthorizerLayer(options.operationAuthorizer), options.toolFailureObserver === void 0 ? Layer.succeed(CurrentToolFailureObserver, void 0) : toolFailureObserverLayer(options.toolFailureObserver), RunContextPreparationPassthrough, RunToolAuthorization.allowAll);
+}));
+const producerIdentity = (prefix, owner) => decodeProducerId(`${prefix}:${owner}`).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
+	message: `The minted producer identity is invalid: ${error.message}`,
+	cause: error
+})));
+/** Native one-Thread configuration; retains its existing producer and logical identities. */
+const layerConfig = (options) => Layer.unwrap(Effect.gen(function* () {
+	const { ctx } = yield* DurableObjectContext;
+	const threadId = yield* threadIdFromState(ctx);
+	const producerId = yield* producerIdentity(options.producerPrefix, threadId);
+	return Layer.mergeAll(runtimeConfigLayer(options, producerId), Layer.succeed(ThreadObjectIdentity, {
+		threadId,
+		producerId
+	}), Layer.succeed(ThreadObjectPlacement, { ownsThread: (target) => target === threadId }));
+}));
+/**
+* Configuration for an application Object owning several logical Threads. The producer is
+* the stable physical Object. No logical identity is installed globally: handleRpc binds and
+* validates it per request using the placement guard and this actual runtime producer.
+*/
+const layerHostConfig = (options, ownsThread) => Layer.unwrap(Effect.gen(function* () {
+	const { ctx } = yield* DurableObjectContext;
+	const producerId = yield* producerIdentity(options.producerPrefix, ctx.id.toString());
+	return Layer.merge(runtimeConfigLayer(options, producerId), Layer.succeed(ThreadObjectPlacement, { ownsThread }));
+}));
+/**
+* Register typed Agents and version declarations. Hashing and dependency capture happen in
+* this Layer's Scope, after application Layers have been provided. Every Agent's instruction,
+* Tool, Schema, and model requirements remain visible until satisfied by Layer composition.
+* Use Layer.unwrap for registration values that need effectful application setup.
+*/
+const registeredLayer = (registrations, options = {}) => Layer.unwrap(Effect.map(compileRegistrations(registrations), (bindings) => boundLayer(bindings, options)));
+function layer(registrations, options = {}) {
+	return registeredLayer(registrations, options);
+}
+/**
+* Assemble the durable runtime from already-resolved Agent Bindings.
+* Use `ThreadObject.layer` to compile typed Agent registrations instead.
+* Supply host services through `ThreadObject.make` or `ThreadObject.layerConfig` and
+* the Durable Object context and namespace Layers when composing a custom host.
+*/
+const boundLayer = (bindings, options = {}) => Layer.unwrap(Effect.map(DurableObjectContext, ({ ctx }) => sharedLayer(DurableAgentRuntime.layerWithBindings(bindings), options).pipe(Layer.provideMerge(SqliteClient.layer({ storage: ctx.storage })))));
+function layerInHost(application, options = {}) {
+	return sharedLayer(application, options);
+}
+const sharedLayer = (application, options = {}) => Layer.unwrap(Effect.gen(function* () {
+	const { ctx } = yield* DurableObjectContext;
+	const config = yield* CloudflareDurableRuntimeConfig;
+	const { ownsThread } = yield* ThreadObjectPlacement;
+	const storageOptions = {
+		storage: ctx.storage,
+		observationPollInterval: config.observationPollInterval,
+		ownershipLeaseDuration: config.ownershipLeaseDuration,
+		maxStoredValueBytes: config.maxStoredValueBytes,
+		verifyOnOpen: config.verifyOnOpen
+	};
+	const infrastructure = Layer.mergeAll(storageConfigLayer(storageOptions), Layer.effect(SqlClient)(SqlClient));
+	const rawLocalPorts = Layer.mergeAll(threadStoreLayer, submissionLedgerLayer).pipe(Layer.provide(infrastructure));
+	const base = Layer.mergeAll(DurableAlarmService.layer, ProgressWaitRegistry.layer);
+	const wakes = cloudflareWakeSchedulerLayer.pipe(Layer.provide(base));
+	const messageStore = guardedMessageDeliveryStoreLayer.pipe(Layer.provide(doMessageDeliveryStoreLayer().pipe(Layer.provide(infrastructure))), Layer.provide(wakes));
+	const messageRecovery = threadMessageDeliveryLayer.pipe(Layer.provide(MessageDeliveryDriver.layer({
+		batchSize: 4,
+		concurrency: 4
+	})), Layer.provide(cloudflarePreparedInputAdmissionLayer), Layer.provide(CloudflareThreadClient.layer), Layer.provide(messageStore), Layer.provide(wakes));
+	const publication = (options.publication ?? ThreadPublication.layer).pipe(Layer.provide(Layer.mergeAll(rawLocalPorts, Layer.effect(SqlClient)(SqlClient))));
+	const projection = (options.projection ?? ThreadProjectionMaintenance.layer).pipe(Layer.provide(Layer.mergeAll(rawLocalPorts, Layer.effect(SqlClient)(SqlClient))));
+	const localPorts = options.publication === void 0 && options.projection === void 0 ? rawLocalPorts : Layer.effectContext(Effect.gen(function* () {
+		const store = yield* ThreadStore;
+		const ledger = yield* SubmissionLedger;
+		const mutations = yield* ThreadMutationGate;
+		const index = yield* ThreadProjectionMaintenance;
+		const publish = yield* Effect.context();
+		const afterCommit = publishCommitted.pipe(Effect.provide(publish));
+		const sourceCommits = yield* Semaphore.make(1);
+		const observedStore = ThreadStore.of({
+			...store,
+			append: (request) => mutations.withMutation(sourceCommits.withPermit(store.append(request).pipe(Effect.tap((result) => index.applyCommitted(request, result).pipe(Effect.catchCause((cause) => Cause.hasInterrupts(cause) ? Effect.interrupt : Effect.logError("Thread projection deferred after source commit", cause)))))).pipe(Effect.tap(() => afterCommit))).pipe(Effect.catchTag("DurableAlarmError", (cause) => ThreadStoreError.make({
+				operation: "prearm publication append",
+				message: cause.message,
+				cause
+			})))
+		});
+		const observeIntent = (body) => mutations.withMutation(body.pipe(Effect.tap(() => afterCommit))).pipe(Effect.catchTag("DurableAlarmError", (cause) => LedgerError.make({
+			operation: "prearm publication intent",
+			message: "The publication generation could not be armed",
+			cause
+		})));
+		return Context.make(ThreadStore, observedStore).pipe(Context.add(SubmissionLedger, {
+			...ledger,
+			recordApprovalDecision: (request) => observeIntent(ledger.recordApprovalDecision(request)),
+			requestAbort: (request) => observeIntent(ledger.requestAbort(request)),
+			recordUnknownResolution: (request) => observeIntent(ledger.recordUnknownResolution(request))
+		}));
+	})).pipe(Layer.provide(rawLocalPorts));
+	const portsEndpointLayer = Layer.effect(ThreadObjectPorts)(Effect.gen(function* () {
+		const local = yield* Effect.context();
+		const ledger = Context.get(local, SubmissionLedger);
+		return ThreadObjectPorts.of({
+			handle: (request) => executePortRequest(request).pipe(Effect.provide(local)),
+			lookupSubmission: (submissionId) => ledger.lookup(SubmissionLookupById.make({ submissionId }))
+		});
+	})).pipe(Layer.provide(localPorts));
+	const routedPorts = Layer.mergeAll(routedSubmissionLedgerLayer({ ownsThread }), routedThreadStoreLayer({ ownsThread })).pipe(Layer.provide(localPorts), Layer.provide(threadPortTransportLayer));
+	const runtimeStack = application.pipe(Layer.provide(cloudflarePreparedInputAdmissionLayer.pipe(Layer.provide(CloudflareThreadClient.layer))), Layer.provideMerge(messageStore), Layer.provideMerge(routedPorts), Layer.provideMerge(wakes), Layer.provideMerge(base), Layer.provideMerge(portsEndpointLayer));
+	return Layer.mergeAll(runtimeStack, ThreadMaintenance.layer.pipe(Layer.provide(runtimeStack), Layer.provide(messageRecovery)), portsEndpointLayer, messageStore, messageRecovery).pipe(Layer.provideMerge(publication), Layer.provideMerge(projection), Layer.provideMerge(ThreadMutationGate.layer), Layer.provideMerge(infrastructure));
+}));
+//#endregion
+//#region src/ThreadObject.ts
+var ThreadObject_exports = /* @__PURE__ */ __exportAll({
+	AdminExplainRequest: () => AdminExplainRequest,
+	AdminFailed: () => AdminFailed,
+	AdminFailure: () => AdminFailure,
+	AdminResponse: () => AdminResponse,
+	AdminVerifyRequest: () => AdminVerifyRequest,
+	ExplainedRecovery: () => ExplainedRecovery,
+	ObligationsScanned: () => ObligationsScanned,
+	RetryExecuted: () => RetryExecuted,
+	ThreadObjectPorts: () => ThreadObjectPorts,
+	ThreadRpcOperation: () => ThreadRpcOperation,
+	VerifiedIntegrity: () => VerifiedIntegrity,
+	decodeAdminExplainRequest: () => decodeAdminExplainRequest,
+	decodeAdminResponse: () => decodeAdminResponse,
+	decodeAdminVerifyRequest: () => decodeAdminVerifyRequest,
+	decodeObligationThresholds: () => decodeObligationThresholds,
+	decodeRetryCommand: () => decodeRetryCommand,
+	encodeAdminResponse: () => encodeAdminResponse,
+	handleRpc: () => handleRpc,
+	layer: () => layer,
+	layerConfig: () => layerConfig,
+	layerHostConfig: () => layerHostConfig,
+	layerInHost: () => layerInHost,
+	make: () => make,
+	portCall: () => portCall,
+	submit: () => submit
+});
+/** Classify only a decoded port request so new protocol members cannot bypass pre-arming. */
+const isMutatingPortRequest = (request) => {
+	switch (request._tag) {
+		case "LedgerAdmit":
+		case "LedgerMarkReady":
+		case "LedgerRequestAbort":
+		case "LedgerRecordChildSettled":
+		case "StoreMaterialize":
+		case "StoreAppend": return true;
+		case "LedgerLookup":
+		case "LedgerResolveAdmission":
+		case "StoreReadPage":
+		case "StoreInspectTail":
+		case "StoreExport": return false;
+	}
+	return false;
+};
+/** The literal encoded `PortFailed(PortProtocolError)` fallback (same shape as WP2's). */
+const encodedPortProtocolFailure = (message) => ({
+	_tag: "PortFailed",
+	failure: {
+		_tag: "PortProtocolError",
+		message: boundHostDiagnostic(message)
+	}
+});
+const protocolFailure = (context) => (error) => HostProtocolError.make({ message: boundHostDiagnostic(`${context}: ${error.message}`) });
+/** Fold one endpoint's typed failures into the uniform `HostResponse` envelope. */
+const respond = (effect) => effect.pipe(Effect.map((result) => result), Effect.catch((failure) => Effect.succeed(HostFailed.make({ failure }))));
+/** Encode the response envelope; an unencodable response degrades to a protocol failure. */
+const encodeResponse = (response) => encodeHostResponse(response).pipe(Effect.catch((error) => Effect.succeed({
+	_tag: "HostFailed",
+	failure: {
+		_tag: "HostProtocolError",
+		message: boundHostDiagnostic(`The host response could not be encoded: ${error.message}`)
+	}
+})));
+const utf8Bytes = (value) => new TextEncoder().encode(JSON.stringify(value)).length;
+/**
+* The admission-limits gate, BEFORE `runtime.submit` touches the ledger (exit gate
+* "resource limits are checked before admission"; DEPLOY-007). A replayed idempotency key is
+* exempt: its accepted-work obligation already exists, and returning the original Receipt
+* consumes no new quota. Refusals are typed `AdmissionLimitExceeded` and nothing is written.
+*/
+const gateAdmissionLimits = Effect.fn("ThreadObject.gateAdmissionLimits")(function* (threadId, request) {
+	const config = yield* CloudflareDurableRuntimeConfig;
+	const ledger = yield* SubmissionLedger;
+	const { ctx } = yield* DurableObjectContext;
+	const existing = yield* ledger.lookup(SubmissionLookupByKey.make({
+		threadId,
+		principal: request.principal,
+		idempotencyKey: request.idempotencyKey
+	}));
+	if (Option.isSome(existing)) return;
+	const inputBytes = utf8Bytes(request.inputPayload);
+	if (inputBytes > config.limits.maxInputBytes) return yield* AdmissionLimitExceeded.make({
+		limit: "input-bytes",
+		actual: inputBytes,
+		maximum: config.limits.maxInputBytes
+	});
+	const nonterminal = yield* ledger.scanNonterminal.pipe(Stream.filter((submission) => submission.threadId === threadId), Stream.runCollect);
+	if (nonterminal.length >= config.limits.maxQueueDepthPerLane) return yield* AdmissionLimitExceeded.make({
+		limit: "queue-depth",
+		actual: nonterminal.length,
+		maximum: config.limits.maxQueueDepthPerLane
+	});
+	const databaseBytes = yield* Effect.sync(() => ctx.storage.sql.databaseSize);
+	if (databaseBytes > config.limits.maxDatabaseBytes) return yield* AdmissionLimitExceeded.make({
+		limit: "database-bytes",
+		actual: databaseBytes,
+		maximum: config.limits.maxDatabaseBytes
+	});
+});
+/**
+* The submit-capable projection of an Agent Binding on the OBJECT side: the input arrived
+* already encoded through the real input schema on the Worker side (`client.ts`), so the
+* Object admits the canonical `PersistedJson` payload as-is; the resolved Binding re-derives
+* everything else from the stored `(agentId, agentDigests)` at claim time (SUB-023).
+*/
+const passthroughSubmitAgent = (agentId) => ({ definition: {
+	id: agentId,
+	input: PersistedJson
+} });
+/** A physical owner may hold other Threads; an addressed request cannot act on their IDs. */
+const lookupAddressedSubmission = Effect.fn("ThreadObject.lookupAddressedSubmission")(function* (submissionId) {
+	const { threadId } = yield* ThreadObjectIdentity;
+	const submission = yield* (yield* ThreadObjectPorts).lookupSubmission(submissionId);
+	if (Option.isSome(submission) && submission.value.threadId !== threadId) return yield* HostProtocolError.make({ message: "The Submission belongs to another Thread" });
+	return submission;
+});
+const requireSubmissionThread = Effect.fn("ThreadObject.requireSubmissionThread")(function* (submissionId) {
+	const submission = yield* lookupAddressedSubmission(submissionId);
+	if (Option.isNone(submission)) return yield* LedgerError.make({
+		operation: "addressed Submission lookup",
+		message: "The addressed Thread has no such Submission"
+	});
+});
+const requireReceiptThread = Effect.fn("ThreadObject.requireReceiptThread")(function* (threadId) {
+	if (threadId !== (yield* ThreadObjectIdentity).threadId) return yield* HostProtocolError.make({ message: "The Receipt belongs to another Thread" });
+});
+const requirePortThread = (request) => {
+	switch (request._tag) {
+		case "LedgerLookup": return request.request._tag === "SubmissionLookupById" ? lookupAddressedSubmission(request.request.submissionId).pipe(Effect.asVoid) : requireReceiptThread(request.request.threadId);
+		case "LedgerMarkReady":
+		case "LedgerRequestAbort": return requireSubmissionThread(request.request.submissionId);
+		case "LedgerRecordChildSettled": return requireSubmissionThread(request.request.parentSubmissionId);
+		case "LedgerAdmit":
+		case "LedgerResolveAdmission":
+		case "StoreMaterialize":
+		case "StoreAppend":
+		case "StoreReadPage":
+		case "StoreInspectTail":
+		case "StoreExport": return requireReceiptThread(request.request.threadId);
+	}
+};
+/**
+* Admit an already Schema-decoded request to a logical Thread in this physical owner.
+* Custom hosts validate local placement before calling this Effect and provide their same
+* runtime/maintenance instances. The native endpoint uses this path too: queue limits,
+* idempotent receipts and the pre-admission generation/alarm commit have one owner.
+*/
+const submit = Effect.fn("ThreadObject.submit")(function* (threadId, request) {
+	if (!(yield* ThreadObjectPlacement).ownsThread(threadId)) return yield* HostProtocolError.make({ message: "The Thread belongs to another Object" });
+	const mutations = yield* ThreadMutationGate;
+	const runtime = yield* DurableAgentRuntime;
+	yield* gateAdmissionLimits(threadId, request);
+	return yield* mutations.withMutation(runtime.submit(passthroughSubmitAgent(request.agentId), request.inputPayload, {
+		threadId,
+		principal: request.principal,
+		idempotencyKey: request.idempotencyKey,
+		...request.admissionGroup === void 0 ? {} : { admissionGroup: request.admissionGroup },
+		...request.admissionFence === void 0 ? {} : { admissionFence: request.admissionFence },
+		...request.workerAdmission === void 0 ? {} : { workerAdmission: request.workerAdmission },
+		...request.messageAdmission === void 0 ? {} : { messageAdmission: request.messageAdmission },
+		definitions: request.definitions
+	}).pipe(Effect.tap(() => publishCommitted)));
+});
+const submitEndpoint = (encoded) => decodeSubmitRequest(encoded).pipe(Effect.mapError(protocolFailure("The submit request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	const receipt = yield* submit(identity.threadId, request);
+	return SubmitSucceeded.make({ receipt });
+})), respond, Effect.flatMap(encodeResponse));
+const submissionStatusEndpoint = (encoded) => decodeReceipt(encoded).pipe(Effect.mapError(protocolFailure("The receipt could not be decoded")), Effect.flatMap((receipt) => Effect.gen(function* () {
+	yield* (yield* OperationAuthorizer).authorize(OperationAuthorizationRequest.make({
+		operation: "awaitSettlement",
+		threadId: receipt.threadId,
+		submissionId: receipt.submissionId
+	}));
+	yield* requireReceiptThread(receipt.threadId);
+	yield* requireSubmissionThread(receipt.submissionId);
+	const runtime = yield* DurableAgentRuntime;
+	return SubmissionStatusResponse.make({ status: yield* runtime.submissionStatus(receipt) });
+})), respond, Effect.flatMap(encodeResponse));
+const awaitSettlementEndpoint = (encoded) => decodeReceipt(encoded).pipe(Effect.mapError(protocolFailure("The receipt could not be decoded")), Effect.flatMap((receipt) => Effect.gen(function* () {
+	yield* (yield* OperationAuthorizer).authorize(OperationAuthorizationRequest.make({
+		operation: "awaitSettlement",
+		threadId: receipt.threadId,
+		submissionId: receipt.submissionId
+	}));
+	yield* requireReceiptThread(receipt.threadId);
+	yield* requireSubmissionThread(receipt.submissionId);
+	const settlement = yield* (yield* DurableAgentRuntime).awaitSettlement(receipt);
+	return SettlementReached.make({ settlement });
+})), respond, Effect.flatMap(encodeResponse));
+const awaitProgressEndpoint = (encoded) => decodeAwaitProgressRequest(encoded).pipe(Effect.mapError(protocolFailure("The progress request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	const runtime = yield* DurableAgentRuntime;
+	const registry = yield* ProgressWaitRegistry;
+	yield* Effect.scoped(Effect.gen(function* () {
+		const cancelled = yield* registry.subscribe(JSON.stringify([identity.threadId, request.waiterId]));
+		yield* Effect.raceFirst(runtime.awaitProgress(identity.threadId, request.afterSequence), cancelled);
+	}));
+	return ProgressObserved.make();
+})), respond, Effect.flatMap(encodeResponse));
+const cancelProgressEndpoint = (encoded) => decodeCancelProgressRequest(encoded).pipe(Effect.mapError(protocolFailure("The progress cancellation could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	yield* (yield* ProgressWaitRegistry).cancel(JSON.stringify([identity.threadId, request.waiterId]));
+	return ProgressCancelled.make();
+})), respond, Effect.flatMap(encodeResponse));
+const observePageEndpoint = (encoded) => decodeObservePageRequest(encoded).pipe(Effect.mapError(protocolFailure("The observe request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	const store = yield* ThreadStore;
+	yield* (yield* OperationAuthorizer).authorize(OperationAuthorizationRequest.make({
+		operation: "observe",
+		threadId: identity.threadId
+	}));
+	const records = yield* Stream.runCollect(store.read(ThreadRead.make({
+		threadId: identity.threadId,
+		...request.afterSequence === void 0 ? {} : { afterSequence: request.afterSequence },
+		limit: request.limit
+	})));
+	return ObservedPage.make({ records: [...records] });
+})), respond, Effect.flatMap(encodeResponse));
+const abortEndpoint = (encoded) => decodeAbortCommand(encoded).pipe(Effect.mapError(protocolFailure("The abort command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	yield* (yield* OperationAuthorizer).authorize(OperationAuthorizationRequest.make({
+		operation: "abort",
+		submissionId: command.submissionId
+	}));
+	yield* requireSubmissionThread(command.submissionId);
+	const maintenance = yield* ThreadMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	const intent = yield* maintenance.withMutation(runtime.abort(command));
+	return AbortRecorded.make({ intent });
+})), respond, Effect.flatMap(encodeResponse));
+const resolveApprovalEndpoint = (encoded) => decodeApprovalDecisionCommand(encoded).pipe(Effect.mapError(protocolFailure("The approval command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	yield* (yield* OperationAuthorizer).authorize(OperationAuthorizationRequest.make({
+		operation: "resolveApproval",
+		submissionId: command.submissionId
+	}));
+	yield* requireSubmissionThread(command.submissionId);
+	const maintenance = yield* ThreadMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	const intent = yield* maintenance.withMutation(runtime.resolveApproval(command));
+	return ApprovalRecorded.make({ intent });
+})), respond, Effect.flatMap(encodeResponse));
+const resolveUnknownEndpoint = (encoded) => decodeUnknownResolutionCommand(encoded).pipe(Effect.mapError(protocolFailure("The resolution command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	yield* (yield* OperationAuthorizer).authorize(OperationAuthorizationRequest.make({
+		operation: "resolveUnknown",
+		submissionId: command.submissionId
+	}));
+	yield* requireSubmissionThread(command.submissionId);
+	const maintenance = yield* ThreadMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	const intent = yield* maintenance.withMutation(runtime.resolveUnknown(command));
+	return UnknownResolutionRecorded.make({ intent });
+})), respond, Effect.flatMap(encodeResponse));
+/** Explain one Submission (`submissionId` present) or every nonterminal lane member. */
+var AdminExplainRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/AdminExplainRequest")({ submissionId: Schema.optionalKey(SubmissionId) }) {};
+/** Verify carries no parameters — the addressed Object IS the lane. */
+var AdminVerifyRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/AdminVerifyRequest")({}) {};
+/** Every typed failure of the four admin entry points, plus the protocol's own errors. */
+const AdminFailure = Schema.Union([
+	AdmissionPolicyError,
+	OperationDenied,
+	RetryRefused,
+	LedgerError,
+	RunJournalError,
+	DigestError,
+	OwnershipLost,
+	SettlementConflict,
+	ThreadStoreError,
+	ThreadNotMaterialized,
+	AppendConflict,
+	FenceRejected,
+	DurableRuntimeFailpointError,
+	DurableAlarmError,
+	HostProtocolError
+]);
+var ExplainedRecovery = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ExplainedRecovery")("ExplainedRecovery", { explanations: Schema.Array(RecoveryExplanation).check(Schema.isMaxLength(1024)) }) {};
+var VerifiedIntegrity = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/VerifiedIntegrity")("VerifiedIntegrity", { report: IntegrityReport }) {};
+var RetryExecuted = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/RetryExecuted")("RetryExecuted", { report: RecoveryReport }) {};
+var ObligationsScanned = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ObligationsScanned")("ObligationsScanned", { report: ObligationReport }) {};
+/** The admin entry point failed TYPED on the Object; the failure re-decodes verbatim. */
+var AdminFailed = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/AdminFailed")("AdminFailed", { failure: AdminFailure }) {};
+/** The uniform answer of one admin entry point. Callers narrow by the tag their call implies. */
+const AdminResponse = Schema.Union([
+	ExplainedRecovery,
+	VerifiedIntegrity,
+	RetryExecuted,
+	ObligationsScanned,
+	AdminFailed
+]);
+const decodeAdminExplainRequest = Schema.decodeUnknownEffect(AdminExplainRequest);
+const decodeAdminVerifyRequest = Schema.decodeUnknownEffect(AdminVerifyRequest);
+const decodeRetryCommand = Schema.decodeUnknownEffect(RetryCommand);
+const decodeObligationThresholds = Schema.decodeUnknownEffect(ObligationThresholds);
+const encodeAdminResponse = Schema.encodeEffect(AdminResponse);
+const decodeAdminResponse = Schema.decodeUnknownEffect(AdminResponse);
+/** Fold one admin endpoint's typed failures into the uniform `AdminResponse` envelope. */
+const respondAdmin = (effect) => effect.pipe(Effect.map((result) => result), Effect.catch((failure) => Effect.succeed(AdminFailed.make({ failure }))));
+/** Encode the admin response envelope; an unencodable response degrades to a protocol failure. */
+const encodeAdminResponseTotal = (response) => encodeAdminResponse(response).pipe(Effect.catch((error) => Effect.succeed({
+	_tag: "AdminFailed",
+	failure: {
+		_tag: "HostProtocolError",
+		message: boundHostDiagnostic(`The admin response could not be encoded: ${error.message}`)
+	}
+})));
+const explainEndpoint = (encoded) => decodeAdminExplainRequest(encoded).pipe(Effect.mapError(protocolFailure("The explain request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	const runtime = yield* DurableAgentRuntime;
+	const explanations = request.submissionId === void 0 ? yield* runtime.explainThread(identity.threadId) : [yield* runtime.explain(request.submissionId)];
+	return ExplainedRecovery.make({ explanations });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+const verifyEndpoint = (encoded) => decodeAdminVerifyRequest(encoded).pipe(Effect.mapError(protocolFailure("The verify request could not be decoded")), Effect.flatMap(() => Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	const report = yield* (yield* DurableAgentRuntime).verify(identity.threadId);
+	return VerifiedIntegrity.make({ report });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+const retryEndpoint = (encoded) => decodeRetryCommand(encoded).pipe(Effect.mapError(protocolFailure("The retry command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
+	const maintenance = yield* ThreadMaintenance;
+	const runtime = yield* DurableAgentRuntime;
+	const report = yield* maintenance.withMutation(runtime.retry(command));
+	return RetryExecuted.make({ report });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+const obligationsEndpoint = (encoded) => decodeObligationThresholds(encoded).pipe(Effect.mapError(protocolFailure("The obligation thresholds could not be decoded")), Effect.flatMap((thresholds) => Effect.gen(function* () {
+	const report = yield* (yield* DurableAgentRuntime).scanObligations(thresholds);
+	return ObligationsScanned.make({ report });
+})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
+/**
+* Owner-side `portCall`: wrap a mutating envelope in the same pre-armed generation protocol as
+* public RPC (a routed mutation committed by THIS Object must already carry the alarm that will
+* finish it), execute on the LOCAL facets (never the routed decorators), then arm an immediate
+* alarm so the mutated lane is processed promptly. Protocol anomalies answer
+* `PortFailed(PortProtocolError)`.
+*/
+const encodePortResponseTotal = (response) => encodePortResponse(response).pipe(Effect.catch((error) => Effect.succeed(encodedPortProtocolFailure(`The port response could not be encoded: ${error.message}`))));
+const portGuardFailure = (failure) => PortFailed.make({ failure: failure._tag === "LedgerError" ? failure : PortProtocolError.make({ message: "The port request is not for the addressed Thread" }) });
+const portCall = (encoded) => Effect.gen(function* () {
+	const ports = yield* ThreadObjectPorts;
+	const maintenance = yield* ThreadMaintenance;
+	const alarm = yield* DurableAlarmService;
+	const decoded = yield* decodePortRequest(encoded).pipe(Effect.map((request) => ({
+		_tag: "success",
+		request
+	})), Effect.catch((error) => Effect.succeed({
+		_tag: "failure",
+		message: error.message
+	})));
+	if (decoded._tag === "failure") return encodedPortProtocolFailure(`The port request could not be decoded: ${decoded.message}`);
+	if (decoded.request._tag === "LedgerLookup" && decoded.request.request._tag === "SubmissionLookupById") {
+		const response = yield* lookupAddressedSubmission(decoded.request.request.submissionId).pipe(Effect.map((submission) => PortSucceeded.make({ result: LedgerLookupResult.make(Option.isSome(submission) ? { submission: submission.value } : {}) })), Effect.catch((failure) => Effect.succeed(portGuardFailure(failure))));
+		return yield* encodePortResponseTotal(response);
+	}
+	const identityCheck = yield* requirePortThread(decoded.request).pipe(Effect.result);
+	if (identityCheck._tag === "Failure") return yield* encodePortResponseTotal(portGuardFailure(identityCheck.failure));
+	const mutating = isMutatingPortRequest(decoded.request);
+	const handled = yield* (mutating ? maintenance.withMutation(ports.handle(decoded.request)) : ports.handle(decoded.request)).pipe(Effect.exit);
+	if (handled._tag === "Failure") return encodedPortProtocolFailure("The owner Object could not arm its maintenance alarm before the mutation.");
+	const response = yield* encodePortResponseTotal(handled.value);
+	if (mutating) yield* alarm.scheduleNow.pipe(Effect.catch((error) => Effect.logWarning("ThreadObject.portCall: immediate re-arm failed", error)));
+	return response;
+});
+const wakeEndpoint = Effect.gen(function* () {
+	const identity = yield* ThreadObjectIdentity;
+	yield* (yield* WakeScheduler).notify(identity.threadId);
+});
+/** The per-Thread wire operations supported by native and application-owned endpoints. */
+const ThreadRpcOperation = Schema.Literals([
+	"submitEncoded",
+	"submissionStatusEncoded",
+	"awaitSettlementEncoded",
+	"awaitProgressEncoded",
+	"cancelProgressEncoded",
+	"observePage",
+	"abortEncoded",
+	"resolveApprovalEncoded",
+	"resolveUnknownEncoded",
+	"portCall",
+	"wake"
+]);
+const threadRpc = {
+	submitEncoded: submitEndpoint,
+	submissionStatusEncoded: submissionStatusEndpoint,
+	awaitSettlementEncoded: awaitSettlementEndpoint,
+	awaitProgressEncoded: awaitProgressEndpoint,
+	cancelProgressEncoded: cancelProgressEndpoint,
+	observePage: observePageEndpoint,
+	abortEncoded: abortEndpoint,
+	resolveApprovalEncoded: resolveApprovalEndpoint,
+	resolveUnknownEncoded: resolveUnknownEndpoint,
+	portCall,
+	wake: () => wakeEndpoint
+};
+/**
+* Bind an addressed request to its logical Thread while sharing one physical runtime. This
+* validates local placement before invoking the same native handlers. Receipts, Submission
+* commands and port envelopes must match this identity; progress cancellation is Thread-scoped.
+* The producer comes from the actual runtime configuration, never from caller input. These
+* guards supplement the existing current model/Tool and operation authorization policies.
+*/
+const handleRpc = Effect.fn("ThreadObject.handleRpc")(function* (threadId, operation, encoded) {
+	if (!(yield* ThreadObjectPlacement).ownsThread(threadId)) return yield* HostProtocolError.make({ message: "The Thread belongs to another Object" });
+	const { producerId } = yield* DurableRuntimeConfig;
+	return yield* threadRpc[operation](encoded).pipe(Effect.provideService(ThreadObjectIdentity, {
+		threadId,
+		producerId
+	}));
+});
+const alarmEndpoint = Effect.gen(function* () {
+	yield* (yield* ThreadMaintenance).pass;
+});
+const gateEndpoint = Effect.gen(function* () {
+	yield* (yield* ThreadMaintenance).ensureAlarm;
+});
+/**
+* Adapter from effect-cf's native Durable Object services to Effect Agent's existing platform
+* ports. effect-cf owns the cached ManagedRuntime and supplies these values once per Object
+* incarnation; the durable runtime continues to depend only on the narrow services below.
+*/
+const effectCfPlatformLayer = (namespaceBinding, rpcTracing = false) => {
+	const context = Layer.effect(DurableObjectContext)(Effect.gen(function* () {
+		const state = yield* DurableObjectState.DurableObjectState;
+		const env = yield* WorkerEnvironment;
+		return DurableObjectContext.of({
+			ctx: state.raw,
+			env
+		});
+	}));
+	const namespace = Layer.effect(ThreadObjectNamespace)(Effect.gen(function* () {
+		const env = yield* WorkerEnvironment;
+		const binding = yield* threadNamespaceFromEnv(env, namespaceBinding);
+		return ThreadObjectNamespace.of({
+			get: (threadId) => binding.get(binding.idFromName(threadId)),
+			...rpcTracing === true ? { rpcTracing: namespaceBinding } : {}
+		});
+	}));
+	return Layer.merge(context, namespace);
+};
+/**
+* Export a composed application Layer as a native Durable Object class.
+* Bootstrap services are provided to the whole graph before it acquires, so application Layers
+* can yield effect-cf's WorkerEnvironment and DurableObjectState, derived identity, and Crypto.
+* Effect Config reads scalar Worker vars and secrets through effect-cf's environment provider;
+* WorkerEnvironment exposes resource bindings without a separate config Layer.
+* Application dependencies remain visible until Layer.provide satisfies them. effect-cf owns the
+* cached ManagedRuntime, native RPC methods, event scopes, and telemetry flushing.
+* Initialization is local and bounded inside the constructor gate. Cloudflare eviction does not
+* guarantee finalizers; put resources requiring timely release in scoped operations or eventLayer.
+*/
+const make = (applicationLayer, options) => {
+	const application = applicationLayer.pipe(Layer.provideMerge(layerConfig(options)), Layer.provideMerge(effectCfPlatformLayer(options.namespaceBinding, options.rpcTracing)));
+	const runtime = Layer.effectContext(Effect.gen(function* () {
+		const state = yield* DurableObjectState.DurableObjectState;
+		const scope = yield* Effect.scope;
+		return yield* state.blockConcurrencyWhile(Effect.gen(function* () {
+			const services = yield* Layer.buildWithScope(application, scope);
+			yield* gateEndpoint.pipe(Effect.provide(services));
+			return services;
+		}));
+	}));
+	const rpc = {
+		...threadRpc,
+		explainEncoded: (encoded) => explainEndpoint(encoded),
+		verifyEncoded: (encoded) => verifyEndpoint(encoded),
+		retryEncoded: (encoded) => retryEndpoint(encoded),
+		obligationsEncoded: (encoded) => obligationsEndpoint(encoded)
+	};
+	const EffectCfThreadObject = DurableObject.make(runtime, {
+		...options.rpcTracing === true ? { rpcTracing: { service: options.namespaceBinding } } : {},
+		...options.eventLayer === void 0 ? {} : { eventLayer: options.eventLayer },
+		initialize: Effect.void,
+		rpc,
+		alarm: () => alarmEndpoint
+	});
+	class ThreadObject extends EffectCfThreadObject {
+		alarm(alarmInfo) {
+			return super.alarm?.(alarmInfo);
+		}
+	}
+	return ThreadObject;
+};
+//#endregion
+export { layer as C, layerInHost as E, ThreadObjectPorts as S, layerHostConfig as T, encodeAdminResponse as _, AdminVerifyRequest as a, portCall as b, RetryExecuted as c, VerifiedIntegrity as d, decodeAdminExplainRequest as f, decodeRetryCommand as g, decodeObligationThresholds as h, AdminResponse as i, ThreadObject_exports as l, decodeAdminVerifyRequest as m, AdminFailed as n, ExplainedRecovery as o, decodeAdminResponse as p, AdminFailure as r, ObligationsScanned as s, AdminExplainRequest as t, ThreadRpcOperation as u, handleRpc as v, layerConfig as w, submit as x, make as y };
+
+//# sourceMappingURL=ThreadObject-DvRG0dDz.mjs.map