@effect-agent/platform-cloudflare 0.1.0-beta.9 → 0.1.0-beta.91

package/dist/index.mjs

@@ -1,1636 +1,13 @@
-import { Clock, Context, Duration, Effect, Fiber, Layer, Option, PubSub, Random, Ref, Schema, Stream } from "effect";
-import { AbortCommand, AbortIntent, AdmissionConflict, AgentBindingResolver, AppendConflict, ApprovalConflict, ApprovalDecisionCommand, ApprovalDecisionIntent, CanonicalRecordEnvelope, CanonicalSequence, ConversationNotMaterialized, ConversationRead, ConversationStore, ConversationStoreError, DEFAULT_OWNERSHIP_LEASE_DURATION, DefinitionDigests, DeploymentId, DigestError, DurableAgentRuntime, DurableRuntimeConfig, DurableRuntimeFailpoint, DurableRuntimeFailpointError, FenceRejected, IdempotencyKey, IntegrityReport, JoinedToHost, LedgerError, ObligationReport, ObligationThresholds, OperationAuthorizationRequest, OperationAuthorizer, OperationDenied, OwnershipLost, PersistedJson, Principal, ProducerId, Receipt, RecoveryExplanation, RecoveryReport, RetryCommand, RetryRefused, RunJournalError, Settlement, SettlementConflict, SubmissionLedger, SubmissionLookupByKey, ToolReconciler, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, WakeScheduler } from "@effect-agent/session";
-import { ConversationPortTransport, DEFAULT_MAX_STORED_VALUE_BYTES, conversationStoreLayer, handleEncodedPortRequest, portTransportFailure, routedConversationStoreLayer, routedSubmissionLedgerLayer, storageConfigLayer, storageFailpointLayer, submissionLedgerLayer } from "@effect-agent/storage-cloudflare";
-import { AgentId, AgentInputError, ConversationId, SubmissionId } from "@effect-agent/core";
-import { BrowserCrypto } from "@effect/platform-browser";
-import { SqliteClient } from "@effect/sql-sqlite-do";
-import { DurableObject, DurableObjectState, WorkerEnvironment } from "effect-cf";
-import { CodeExecutionHost, CodeExecutionProtocolError, CodeExecutionResourceUse, CodeExecutionResult, CodeExecutionTimeoutError, CodeExecutor, CodeExecutorStartError, CodeExecutorTerminatedError, CodeExecutorUnsupportedError, CodeHostCall, CodeHostCallLimitError, CodeOutputLimitError, CodeProgramFailedError, CodeSourceError, SandboxImplementation } from "@effect-agent/sandbox";
-import { WorkerEntrypoint } from "cloudflare:workers";
-//#region src/bindings.ts
-/**
-* Cloudflare platform bindings as Effect services (DEPLOY-010: "Cloudflare platform bindings
-* are supplied as Effect services/Layers"). Application code never reads `env` or touches a
-* `DurableObjectState` directly — the Conversation Object class constructs these Layers once
-* per incarnation and everything downstream consumes the services.
-*/
-/** A Cloudflare platform binding was missing or carried the wrong shape (DEPLOY-003/010). */
-var CloudflareBindingError = class extends Schema.TaggedError()("CloudflareBindingError", {
-	binding: Schema.String,
-	message: Schema.String
-}) {};
-/**
-* The `DurableObjectNamespace` binding that addresses Conversation Objects. The Object
-* identity rule is `namespace.idFromName(conversationId)` (plan §1.2): Conversation IDs are
-* globally unique, so the mapping is total and deterministic and no directory service exists.
-*/
-var ConversationObjectNamespace = class ConversationObjectNamespace extends Context.Service()("@effect-agent/platform-cloudflare/ConversationObjectNamespace") {
-	static layer(namespace) {
-		return Layer.succeed(ConversationObjectNamespace)({ namespace });
-	}
-};
-/**
-* Narrow one `env` member to a `DurableObjectNamespace`. `env` is an untyped platform value,
-* and a namespace binding is a host object no Schema can decode, so this is the documented
-* narrowest-boundary check (structural probe for the namespace surface the transport uses);
-* a missing or misshaped binding fails typed before any Layer is built.
-*/
-const conversationNamespaceFromEnv = (env, binding) => Effect.suspend(() => {
-	if (typeof env !== "object" || env === null) return Effect.fail(CloudflareBindingError.make({
-		binding,
-		message: "The Worker environment is not an object; no bindings are available."
-	}));
-	const candidate = env[binding];
-	if (typeof candidate === "object" && candidate !== null && "idFromName" in candidate && typeof candidate.idFromName === "function" && "get" in candidate && typeof candidate.get === "function") return Effect.succeed(candidate);
-	return Effect.fail(CloudflareBindingError.make({
-		binding,
-		message: `env.${binding} is not a DurableObjectNamespace binding; declare the Conversation Object class under this binding in the Worker configuration.`
-	}));
-});
-/** `ConversationObjectNamespace` built from the untyped Worker `env` (fails typed). */
-const conversationNamespaceLayer = (env, binding) => Layer.effect(ConversationObjectNamespace)(Effect.map(conversationNamespaceFromEnv(env, binding), (namespace) => ({ namespace })));
-/**
-* The live Durable Object execution context of THIS incarnation. Only Layer construction and
-* the alarm service consume it; important state never lives on it (`ctx.storage` is truth,
-* everything in memory is a cache — deployment spec §11).
-*/
-var DurableObjectContext = class DurableObjectContext extends Context.Service()("@effect-agent/platform-cloudflare/DurableObjectContext") {
-	static layer(ctx, env) {
-		return Layer.succeed(DurableObjectContext)({
-			ctx,
-			env
-		});
-	}
-};
-/**
-* The Conversation identity this Object serializes and the producer identity its Attempts
-* write with (`{producerPrefix}:{conversationId}`, plan §1.4). Derived once per incarnation
-* from `ctx.id.name` — the Object identity rule guarantees the name IS the Conversation ID.
-*/
-var ConversationObjectIdentity = class extends Context.Service()("@effect-agent/platform-cloudflare/ConversationObjectIdentity") {};
-//#endregion
-//#region src/config.ts
-/**
-* Schema-validated configuration for the Cloudflare durable runtime (deployment spec §4:
-* decoded once during Layer construction, exposed as a typed service; DEPLOY-003). Every
-* cadence is in milliseconds; every bound is finite and checked before any resource opens.
-*/
-const PositiveMillis = Schema.Int.check(Schema.isGreaterThan(0));
-const NonNegativeMillis = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
-/** The supplied Cloudflare durable runtime configuration failed validation (DEPLOY-003). */
-var CloudflarePlatformConfigError = class extends Schema.TaggedError()("CloudflarePlatformConfigError", {
-	message: Schema.String,
-	cause: Schema.optionalKey(Schema.Defect())
-}) {};
-/**
-* An admission was refused by a host resource limit BEFORE any ledger row existed
-* (deployment spec §8, DEPLOY-007: "Admission has explicit bounded quota and overload
-* behavior... a typed rejection"). This is the DC analogue of `NodeDurableHost`'s
-* `AdmissionClosed` host gate: the port surface stays untouched, the refusal happens in the
-* Conversation Object's submit entry point before `DurableAgentRuntime.submit` runs, and
-* nothing was admitted or written.
-*/
-var AdmissionLimitExceeded = class extends Schema.TaggedError()("AdmissionLimitExceeded", {
-	limit: Schema.Literals([
-		"queue-depth",
-		"input-bytes",
-		"database-bytes"
-	]),
-	actual: Schema.Int,
-	maximum: Schema.Int
-}) {
-	get message() {
-		return `Admission refused before any ledger row existed: ${this.limit} ${this.actual} exceeds the configured maximum ${this.maximum}. Accepted work is unaffected; retry after the lane drains or raise the limit (DEPLOY-007).`;
-	}
-};
-/** The platform's hard per-Object database cap (10 GB, developers.cloudflare.com limits). */
-const CLOUDFLARE_DATABASE_CAP_BYTES = 1e10;
-/** Default database-size admission ceiling: a 1 GB safety margin under the platform cap. */
-const DEFAULT_MAX_DATABASE_BYTES = 9e9;
-/**
-* Explicit bounded admission quotas checked by the Conversation Object BEFORE admission
-* (exit gate "resource limits are checked before admission").
-*/
-var CloudflareAdmissionLimitsValue = class extends Schema.Class("@effect-agent/platform-cloudflare/CloudflareAdmissionLimitsValue")({
-	/** Maximum nonterminal Submissions per Conversation lane before new admissions refuse. */
-	maxQueueDepthPerLane: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(1e5)),
-	/** Maximum encoded input bytes; never above the storage per-value bound. */
-	maxInputBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2e6)),
-	/** Maximum `ctx.storage.sql.databaseSize` at admission; stays under the 10 GB platform cap. */
-	maxDatabaseBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(CLOUDFLARE_DATABASE_CAP_BYTES))
-}) {};
-/**
-* Validated Cloudflare durable runtime configuration. The producer identity of one
-* Conversation Object is `{producerPrefix}:{conversationId}` — stable across incarnations of
-* the same deployment, distinct across deployments — and producer-epoch fencing (not the
-* producer name) remains the correctness authority (DUR-006).
-*/
-var CloudflareDurableRuntimeConfigValue = class extends Schema.Class("@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfigValue")({
-	deploymentId: DeploymentId,
-	/** Head of the minted producer identity `{producerPrefix}:{conversationId}`. */
-	producerPrefix: Schema.NonEmptyString.check(Schema.isMaxLength(256)),
-	/** Submission ownership lease duration (D5); fences work across Object incarnations. */
-	ownershipLeaseDuration: PositiveMillis,
-	/** Base delay of the alarm re-arm backoff when a pass makes no progress. */
-	alarmBackoffBase: PositiveMillis,
-	/** Ceiling of the alarm re-arm backoff. */
-	alarmBackoffCap: PositiveMillis,
-	/**
-	* The maintenance-pass scan cadence and the ceiling of every re-arm delay: nonterminal
-	* work is revisited at least this often (wake/scan pairing, persistence §14).
-	*/
-	wakeScanInterval: PositiveMillis,
-	/** `awaitSettlement` ledger re-check cadence when no wake arrives. */
-	settlementPollInterval: PositiveMillis,
-	/** Worker ownership-lease renewal cadence during an active Attempt. */
-	leaseRenewalInterval: PositiveMillis,
-	/** Active-Run abort-intent poll cadence. */
-	abortPollInterval: PositiveMillis,
-	/** Canonical observation poll cadence of the Durable Object store. */
-	observationPollInterval: NonNegativeMillis,
-	/** Per-value byte bound; must stay under the platform's 2 MB SQLite value limit. */
-	maxStoredValueBytes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2e6)),
-	/** Opt-in full payload/digest-chain audit while opening the store. */
-	verifyOnOpen: Schema.Boolean,
-	limits: CloudflareAdmissionLimitsValue
-}) {};
-/** Explicit configuration authority for the assembled Cloudflare durable runtime. */
-var CloudflareDurableRuntimeConfig = class extends Context.Service()("@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfig") {};
-/** Documented production defaults applied by `CloudflareDurableRuntime.layer`. */
-const CLOUDFLARE_RUNTIME_DEFAULTS = {
-	ownershipLeaseDuration: Duration.toMillis(DEFAULT_OWNERSHIP_LEASE_DURATION),
-	alarmBackoffBase: 100,
-	alarmBackoffCap: 5e3,
-	wakeScanInterval: 1e3,
-	settlementPollInterval: 500,
-	leaseRenewalInterval: 1e4,
-	abortPollInterval: 500,
-	observationPollInterval: 25,
-	maxStoredValueBytes: DEFAULT_MAX_STORED_VALUE_BYTES,
-	verifyOnOpen: false,
-	maxQueueDepthPerLane: 256,
-	maxInputBytes: DEFAULT_MAX_STORED_VALUE_BYTES,
-	maxDatabaseBytes: DEFAULT_MAX_DATABASE_BYTES
-};
-//#endregion
-//#region src/alarm.ts
-/**
-* The single multiplexed Durable Object alarm (decision D-P6-2). A Durable Object has ONE
-* alarm slot; every cadence the Node host ran on fibers (wake scan, lease expiry, settlement
-* and abort re-checks, retry backoff) multiplexes into one idempotent maintenance pass, and
-* the slot always holds the EARLIEST deadline any caller asked for.
-*
-* The alarm invariant (plan §1.4): committed nonterminal work implies a committed alarm.
-* It is established by pre-arming — every mutating entry point and every pass arms the alarm
-* BEFORE its durable mutations — so an eviction at any failpoint leaves a persisted alarm
-* that workerd re-delivers to a fresh incarnation WITHOUT any incoming request. Spurious
-* alarms are harmless by design: a pass over an all-settled lane simply deletes the slot.
-*/
-/** The Durable Object alarm API failed; surfaces on host entry points as a typed refusal. */
-var DurableAlarmError = class extends Schema.TaggedError()("DurableAlarmError", {
-	operation: Schema.String,
-	message: Schema.String,
-	cause: Schema.optionalKey(Schema.Defect())
-}) {};
-const alarmFailure = (operation) => (cause) => DurableAlarmError.make({
-	operation,
-	message: cause instanceof Error ? cause.message : String(cause),
-	cause
-});
-/** `ctx.storage` alarm slot as an Effect service; storage is truth, never a memory field. */
-var DurableAlarmService = class DurableAlarmService extends Context.Service()("@effect-agent/platform-cloudflare/DurableAlarmService") {
-	static layer = Layer.effect(DurableAlarmService)(Effect.gen(function* () {
-		const { ctx } = yield* DurableObjectContext;
-		/**
-		* In-memory pass bookkeeping — a pure CACHE, never state: a fresh incarnation has no
-		* running pass, and a deferred wake lost to eviction was only ever a promptness hint
-		* on top of the already-committed pre-armed alarm.
-		*/
-		const runningPasses = yield* Ref.make(0);
-		const wakeDeferred = yield* Ref.make(false);
-		const scheduled = Effect.tryPromise({
-			try: () => ctx.storage.getAlarm(),
-			catch: alarmFailure("get alarm")
-		}).pipe(Effect.map((deadline) => deadline === null ? Option.none() : Option.some(deadline)));
-		const scheduleAt = (epochMillis) => Effect.tryPromise({
-			try: () => ctx.storage.setAlarm(epochMillis),
-			catch: alarmFailure("set alarm")
-		});
-		const ensureScheduledBy = (epochMillis) => scheduled.pipe(Effect.flatMap((existing) => Option.isSome(existing) && existing.value <= epochMillis ? Effect.void : scheduleAt(epochMillis)));
-		const armNow = Clock.currentTimeMillis.pipe(Effect.flatMap((now) => ensureScheduledBy(now)));
-		const scheduleNow = Ref.get(runningPasses).pipe(Effect.flatMap((passes) => passes > 0 ? Ref.set(wakeDeferred, true) : armNow));
-		/**
-		* Flush after the LAST concurrent pass: the re-arm lands at the very end of the alarm
-		* handler, where a superseding cancellation only re-delivers to the already-idempotent
-		* pass. Runs inside `Effect.ensuring`, so flush failures are logged, never raised.
-		*/
-		const flushDeferredWake = Ref.get(runningPasses).pipe(Effect.flatMap((passes) => passes > 0 ? Effect.void : Ref.getAndSet(wakeDeferred, false).pipe(Effect.flatMap((wanted) => wanted ? armNow : Effect.void))), Effect.catch((error) => Effect.logWarning("DurableAlarmService: deferred wake flush failed", error)));
-		const withWakesDeferred = (body) => Ref.update(runningPasses, (passes) => passes + 1).pipe(Effect.andThen(body), Effect.ensuring(Ref.update(runningPasses, (passes) => passes - 1).pipe(Effect.andThen(flushDeferredWake))));
-		const cancel = Effect.tryPromise({
-			try: () => ctx.storage.deleteAlarm(),
-			catch: alarmFailure("delete alarm")
-		});
-		return DurableAlarmService.of({
-			scheduled,
-			scheduleAt,
-			ensureScheduledBy,
-			scheduleNow,
-			withWakesDeferred,
-			cancel
-		});
-	}));
-};
-/** What one maintenance pass did — auditable evidence mirroring `NodeDurableHost`'s report. */
-var MaintenancePassReport = class extends Schema.Class("@effect-agent/platform-cloudflare/MaintenancePassReport")({
-	/** Recovery decisions executed (or deferred) BEFORE any new claim in this pass. */
-	recovered: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	/** Settlements the drain pass finalized. */
-	settled: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	/** Submissions still nonterminal after the pass (suspended/unknown lanes stay honest). */
-	nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	/** `rearmed` while nonterminal work remains, `cleared` once everything settled. */
-	alarm: Schema.Literals(["rearmed", "cleared"])
-}) {};
-/**
-* The idempotent maintenance pass and the alarm-invariant helpers (plan §1.4, D-P6-1/2).
-*
-* `pass` = pre-arm → `runRecovery` → `processConversationResolved` → re-arm-or-clear:
-*
-* 1. **Pre-arm**: the alarm is re-armed at `now + wakeScanInterval` BEFORE any work, so an
-*    eviction (or thrown failure → workerd alarm retry) at any point of the pass leaves a
-*    committed alarm and the fresh incarnation converges without an incoming request.
-* 2. **Reconcile before new work** (exit gate): every pass classifies and repairs every
-*    nonterminal Submission before the drain claims anything; the pure classifier and the
-*    repair executors are idempotent, so at-least-once alarm delivery re-runs them safely.
-* 3. **Drain**: one bounded `processConversationResolved` pass over this Object's lane — the
-*    D-P6-1 shape; no infinite `runResolvedWorker` loop ever pins the Object.
-* 4. **Re-arm policy**: nonterminal work re-arms at `now + min(backoff-with-jitter,
-*    wakeScanInterval)` — the scan interval bounds every wait (lease expiry of a dead
-*    incarnation included, since claims retry each pass) and the backoff (reset on progress,
-*    grown otherwise) keeps stuck lanes from busy-spinning; all settled clears the slot.
-*
-* Every step is a durability-protocol step that already tolerates re-execution, which is
-* what makes double-fired alarms harmless (the alarm.test.ts gate).
-*/
-var ConversationMaintenance = class ConversationMaintenance extends Context.Service()("@effect-agent/platform-cloudflare/ConversationMaintenance") {
-	static layer = Layer.effect(ConversationMaintenance)(Effect.gen(function* () {
-		const runtime = yield* DurableAgentRuntime;
-		const resolver = yield* AgentBindingResolver;
-		const ledger = yield* SubmissionLedger;
-		const alarm = yield* DurableAlarmService;
-		const config = yield* CloudflareDurableRuntimeConfig;
-		const identity = yield* ConversationObjectIdentity;
-		/**
-		* Consecutive no-progress passes — an in-memory CACHE, not state: a fresh incarnation
-		* restarts at zero and merely re-arms sooner than a long-lived one would have.
-		*/
-		const stalls = yield* Ref.make(0);
-		const preArm = Clock.currentTimeMillis.pipe(Effect.flatMap((now) => alarm.ensureScheduledBy(now + config.wakeScanInterval)));
-		const countNonterminal = Stream.runCollect(ledger.scanNonterminal).pipe(Effect.map((snapshots) => snapshots.length));
-		const rearmDelay = Effect.fn("ConversationMaintenance.rearmDelay")(function* (progressed) {
-			const priorStalls = yield* Ref.getAndUpdate(stalls, (count) => progressed ? 0 : count + 1);
-			if (progressed) return config.alarmBackoffBase;
-			const exponent = Math.min(priorStalls, 30);
-			const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** exponent);
-			const jitter = yield* Random.next;
-			const jittered = Math.ceil(backoff / 2 + backoff / 2 * jitter);
-			return Math.min(jittered, config.wakeScanInterval);
-		});
-		const pass = Effect.fn("ConversationMaintenance.pass")(function* () {
-			yield* preArm;
-			const recovered = yield* runtime.runRecovery;
-			const settlements = yield* runtime.processConversationResolved(identity.conversationId).pipe(Effect.provideService(AgentBindingResolver, resolver));
-			const nonterminal = yield* countNonterminal;
-			if (nonterminal === 0) {
-				yield* alarm.cancel;
-				yield* Ref.set(stalls, 0);
-				const appeared = yield* countNonterminal;
-				if (appeared > 0) {
-					yield* preArm;
-					return MaintenancePassReport.make({
-						recovered: recovered.length,
-						settled: settlements.length,
-						nonterminal: appeared,
-						alarm: "rearmed"
-					});
-				}
-				return MaintenancePassReport.make({
-					recovered: recovered.length,
-					settled: settlements.length,
-					nonterminal,
-					alarm: "cleared"
-				});
-			}
-			const progressed = settlements.length > 0 || recovered.some((report) => report.disposition === "repaired");
-			const delay = yield* rearmDelay(progressed);
-			const now = yield* Clock.currentTimeMillis;
-			yield* alarm.ensureScheduledBy(now + delay);
-			return MaintenancePassReport.make({
-				recovered: recovered.length,
-				settled: settlements.length,
-				nonterminal,
-				alarm: "rearmed"
-			});
-		});
-		const ensureAlarm = Effect.fn("ConversationMaintenance.ensureAlarm")(function* () {
-			if ((yield* countNonterminal) === 0) return;
-			yield* preArm;
-		});
-		return ConversationMaintenance.of({
-			pass: alarm.withWakesDeferred(pass()),
-			ensureAlarm: ensureAlarm(),
-			preArm
-		});
-	}));
-};
-//#endregion
-//#region src/wake-scheduler.ts
-/**
-* Bounded in-memory wake buffer for same-incarnation `awaitSettlement` subscribers. Wake
-* hints are droppable by contract (consumers pair every subscription with ledger polls), so
-* a full buffer slides out the oldest hint and an eviction simply loses the buffer — the
-* poll interval and the persisted alarm keep liveness (persistence §14).
-*/
-const WAKE_BUFFER_CAPACITY = 1024;
-/** A remote wake stub call failed; always swallowed and logged (hints are droppable). */
-var RemoteWakeDropped = class extends Schema.TaggedError()("RemoteWakeDropped", {
-	conversationId: Schema.String,
-	message: Schema.String,
-	cause: Schema.optionalKey(Schema.Defect())
-}) {};
-/**
-* The DC `WakeScheduler` (plan §1.4):
-*
-* - `notify(local)` → `setAlarm(now)` — durable, cheap, coalescing (the alarm slot keeps the
-*   earliest deadline) — plus a same-incarnation PubSub hint for `awaitSettlement` waiters.
-* - `notify(remote)` → fire-and-forget `wake()` on the owning Object's stub with every error
-*   swallowed and logged: hints are droppable, and the target's own alarm/scan pairing (the
-*   maintenance pass re-polls unsettled children) guarantees liveness without this call.
-* - `wakes` → the bounded sliding PubSub only. No important state lives in memory: the
-*   subscription accelerates waiters within one incarnation and the settlement poll interval
-*   is the correctness path.
-*/
-const cloudflareWakeSchedulerLayer = Layer.effect(WakeScheduler)(Effect.gen(function* () {
-	const alarm = yield* DurableAlarmService;
-	const identity = yield* ConversationObjectIdentity;
-	const { namespace } = yield* ConversationObjectNamespace;
-	const hints = yield* PubSub.sliding(WAKE_BUFFER_CAPACITY);
-	yield* Effect.addFinalizer(() => PubSub.shutdown(hints));
-	const notifyLocal = (conversationId) => PubSub.publish(hints, conversationId).pipe(Effect.andThen(alarm.scheduleNow), Effect.catch((error) => Effect.logWarning("CloudflareWakeScheduler: local alarm wake failed", error)), Effect.asVoid);
-	const notifyRemote = (conversationId) => Effect.tryPromise({
-		try: () => namespace.get(namespace.idFromName(conversationId)).wake(),
-		catch: (cause) => RemoteWakeDropped.make({
-			conversationId,
-			message: cause instanceof Error ? cause.message : String(cause),
-			cause
-		})
-	}).pipe(Effect.catch((error) => Effect.logWarning(`CloudflareWakeScheduler: remote wake of ${conversationId} dropped`, error)), Effect.asVoid);
-	return WakeScheduler.of({
-		notify: (conversationId) => conversationId === identity.conversationId ? notifyLocal(conversationId) : notifyRemote(conversationId),
-		wakes: Stream.fromPubSub(hints)
-	});
-}));
-//#endregion
-//#region src/transport.ts
-/**
-* `ConversationPortTransport` over native Durable Object JS RPC (decision D-P6-3): one
-* `portCall(envelope)` on the stub of the Object that owns the addressed Conversation
-* (`namespace.idFromName(conversationId)` — the identity rule, plan §1.2). The envelopes are
-* already Schema-encoded JSON, so the RPC boundary carries only structured-cloneable values;
-* the protocol module stays transport-agnostic and fetch-with-JSON remains the documented
-* fallback carrier.
-*
-* Every delivery problem — stub construction, RPC rejection, overload, deploy-in-progress —
-* surfaces as `PortTransportError` (preserving the platform stub's own `retryable` signal
-* when present) and NEVER as a fabricated answer: on `resolveAdmission` the routing layer
-* turns exactly this error into `AdmissionIndeterminate` (SUB-031).
-*/
-const conversationPortTransportLayer = Layer.effect(ConversationPortTransport)(Effect.gen(function* () {
-	const { namespace } = yield* ConversationObjectNamespace;
-	return ConversationPortTransport.of({ call: (conversationId, request) => Effect.tryPromise({
-		try: () => namespace.get(namespace.idFromName(conversationId)).portCall(request),
-		catch: (cause) => portTransportFailure(conversationId, cause)
-	}).pipe(Effect.withSpan("CloudflarePortTransport.call", { attributes: { conversationId } })) });
-}));
-//#endregion
-//#region src/layers.ts
-/**
-* Owner-side endpoint body for the Conversation Object's `portCall` (plan §1.3): decode,
-* execute against THIS Object's LOCAL port facets — never the routed decorators, so a
-* request cannot bounce between Objects — and answer the encoded response envelope. Total by
-* construction (protocol anomalies answer `PortFailed(PortProtocolError)`).
-*/
-var ConversationObjectPorts = class extends Context.Service()("@effect-agent/platform-cloudflare/ConversationObjectPorts") {};
-const decodeConfigValue = Schema.decodeUnknownEffect(CloudflareDurableRuntimeConfigValue);
-const decodeConversationId = Schema.decodeUnknownEffect(ConversationId);
-const decodeProducerId = Schema.decodeUnknownEffect(ProducerId);
-const configFromOptions = (options) => decodeConfigValue({
-	deploymentId: options.deploymentId,
-	producerPrefix: options.producerPrefix,
-	ownershipLeaseDuration: options.ownershipLeaseDuration ?? CLOUDFLARE_RUNTIME_DEFAULTS.ownershipLeaseDuration,
-	alarmBackoffBase: options.alarmBackoffBase ?? CLOUDFLARE_RUNTIME_DEFAULTS.alarmBackoffBase,
-	alarmBackoffCap: options.alarmBackoffCap ?? CLOUDFLARE_RUNTIME_DEFAULTS.alarmBackoffCap,
-	wakeScanInterval: options.wakeScanInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.wakeScanInterval,
-	settlementPollInterval: options.settlementPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.settlementPollInterval,
-	leaseRenewalInterval: options.leaseRenewalInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.leaseRenewalInterval,
-	abortPollInterval: options.abortPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.abortPollInterval,
-	observationPollInterval: options.observationPollInterval ?? CLOUDFLARE_RUNTIME_DEFAULTS.observationPollInterval,
-	maxStoredValueBytes: options.maxStoredValueBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxStoredValueBytes,
-	verifyOnOpen: options.verifyOnOpen ?? CLOUDFLARE_RUNTIME_DEFAULTS.verifyOnOpen,
-	limits: {
-		maxQueueDepthPerLane: options.maxQueueDepthPerLane ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxQueueDepthPerLane,
-		maxInputBytes: Math.min(options.maxInputBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxInputBytes, options.maxStoredValueBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxStoredValueBytes),
-		maxDatabaseBytes: options.maxDatabaseBytes ?? CLOUDFLARE_RUNTIME_DEFAULTS.maxDatabaseBytes
-	}
-}).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
-	message: `Invalid Cloudflare durable runtime configuration: ${error.message}`,
-	cause: error
-})));
-/**
-* The Conversation this Object owns, from the Object identity rule (plan §1.2): Conversation
-* Objects are addressed exclusively by `idFromName(conversationId)`, so `ctx.id.name` IS the
-* Conversation ID. An unnamed Object (from `newUniqueId`) is a deployment error, not a lane.
-*/
-const conversationIdFromState = (ctx) => ctx.id.name === void 0 ? Effect.fail(CloudflarePlatformConfigError.make({ message: "This Durable Object was not created via idFromName(conversationId); Conversation Objects must be addressed by their Conversation identity (plan §1.2)." })) : decodeConversationId(ctx.id.name).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
-	message: `The Durable Object name is not a valid ConversationId: ${error.message}`,
-	cause: error
-})));
-const resolveBindings = (source, context) => source === void 0 ? Effect.succeed([]) : Effect.isEffect(source) ? source : typeof source === "function" ? Effect.suspend(() => {
-	const bindings = source(context);
-	return Effect.isEffect(bindings) ? bindings : Effect.succeed(bindings);
-}) : Effect.succeed(source);
-/**
-* The DC Layer assembly (deployment §12: a Layer-assembly library, not an app entrypoint;
-* plan §1.4). `layer(options)` decodes the configuration, derives this Object's Conversation
-* and producer identities, opens the Object's private SQLite database through
-* `@effect/sql-sqlite-do` for BOTH the Conversation Log and the Submission Ledger (so claims
-* fence the same producer epochs — ADR-0011 D7 transposed), wraps the local port facets with
-* the WP2 cross-Object routing decorators over the Durable Object RPC transport, wires the
-* alarm-backed wake scheduler and the maintenance pass, defaults reconciliation to the
-* fail-closed `ToolReconciler.uncertain`, and provides a ready `DurableAgentRuntime` on top.
-*
-* Storage compatibility is verified during construction: an incompatible database fails the
-* Layer typed (`DoStorageCompatibilityError`) before anything is mutated (DEPLOY-008).
-*
-* Requires only the two binding services (`DurableObjectContext`,
-* `ConversationObjectNamespace`) — platform values enter exclusively through Layers
-* (DEPLOY-010).
-*/
-var CloudflareDurableRuntime = class {
-	static layer(options) {
-		return Layer.unwrap(Effect.gen(function* () {
-			const { ctx, env } = yield* DurableObjectContext;
-			const config = yield* configFromOptions(options);
-			const conversationId = yield* conversationIdFromState(ctx);
-			const producerId = yield* decodeProducerId(`${config.producerPrefix}:${conversationId}`).pipe(Effect.mapError((error) => CloudflarePlatformConfigError.make({
-				message: `The minted producer identity is invalid: ${error.message}`,
-				cause: error
-			})));
-			const identityLayer = Layer.succeed(ConversationObjectIdentity)({
-				conversationId,
-				producerId
-			});
-			const cloudflareConfigLayer = Layer.succeed(CloudflareDurableRuntimeConfig)(config);
-			const storageOptions = {
-				storage: ctx.storage,
-				observationPollInterval: config.observationPollInterval,
-				ownershipLeaseDuration: config.ownershipLeaseDuration,
-				maxStoredValueBytes: config.maxStoredValueBytes,
-				verifyOnOpen: config.verifyOnOpen,
-				failpoint: options.storageFailpoint?.(ctx)
-			};
-			const infrastructure = Layer.mergeAll(storageConfigLayer(storageOptions), storageFailpointLayer(storageOptions), SqliteClient.layer({ storage: ctx.storage }), BrowserCrypto.layer);
-			/**
-			* ONE local-facet instance (a shared Layer value) serves both the routed decorators
-			* and the owner-side `portCall` executor — the executor must never see the routed
-			* ports (plan §1.3: re-routing could bounce a request between Objects).
-			*/
-			const localPorts = Layer.mergeAll(conversationStoreLayer, submissionLedgerLayer).pipe(Layer.provide(infrastructure));
-			const portsEndpointLayer = Layer.effect(ConversationObjectPorts)(Effect.gen(function* () {
-				const local = yield* Effect.context();
-				return ConversationObjectPorts.of({ handle: (encoded) => handleEncodedPortRequest(encoded).pipe(Effect.provide(local)) });
-			})).pipe(Layer.provide(localPorts));
-			const routedPorts = Layer.mergeAll(routedSubmissionLedgerLayer({ localConversationId: conversationId }), routedConversationStoreLayer({ localConversationId: conversationId })).pipe(Layer.provide(localPorts), Layer.provide(conversationPortTransportLayer));
-			const runtimeConfigLayer = Layer.succeed(DurableRuntimeConfig)(DurableRuntimeConfig.make({
-				deploymentId: config.deploymentId,
-				producerId,
-				settlementPollInterval: Duration.millis(config.settlementPollInterval),
-				leaseRenewalInterval: Duration.millis(config.leaseRenewalInterval),
-				abortPollInterval: Duration.millis(config.abortPollInterval)
-			}));
-			const runtimeFailpointLayer = options.runtimeFailpoint === void 0 ? DurableRuntimeFailpoint.layer : Layer.succeed(DurableRuntimeFailpoint)({ hit: options.runtimeFailpoint(ctx) });
-			const reconcilerLayer = options.toolReconciler ?? ToolReconciler.uncertain;
-			const bindingResolverLayer = Layer.effect(AgentBindingResolver)(Effect.map(resolveBindings(options.bindings, {
-				ctx,
-				env,
-				conversationId,
-				producerId
-			}), (bindings) => AgentBindingResolver.fromBindings(bindings)));
-			const base = Layer.mergeAll(identityLayer, cloudflareConfigLayer, DurableAlarmService.layer);
-			const runtimeStack = DurableAgentRuntime.layer.pipe(Layer.provideMerge(routedPorts), Layer.provideMerge(cloudflareWakeSchedulerLayer), Layer.provideMerge(runtimeConfigLayer), Layer.provideMerge(bindingResolverLayer), Layer.provide(Layer.mergeAll(runtimeFailpointLayer, reconcilerLayer, BrowserCrypto.layer)), Layer.provideMerge(base));
-			return Layer.mergeAll(runtimeStack, ConversationMaintenance.layer.pipe(Layer.provide(runtimeStack)), portsEndpointLayer);
-		}));
-	}
-};
-//#endregion
-//#region src/client.ts
-/**
-* The Worker↔Conversation-Object host protocol (plan §1.4): Schema envelopes for the host
-* entry points (`submitEncoded`, `awaitSettlementEncoded`, `observePage`, `abortEncoded`,
-* `resolveApprovalEncoded`, `resolveUnknownEncoded`) plus the Worker-side client that speaks
-* it. Mirrors the WP2 port protocol: requests and responses are closed Schema unions, typed
-* failures travel as their own tagged classes and RE-DECODE to identical tags on the caller
-* (error-tag fidelity), and protocol anomalies are answered typed instead of thrown.
-*/
-/** Ceiling for host protocol diagnostic strings. */
-const MAX_HOST_DIAGNOSTIC_LENGTH = 4096;
-const BoundedDiagnostic = Schema.String.check(Schema.isMaxLength(MAX_HOST_DIAGNOSTIC_LENGTH));
-/** Truncate a diagnostic string to the host protocol's bounded length. */
-const boundHostDiagnostic = (value) => value.length > MAX_HOST_DIAGNOSTIC_LENGTH ? `${value.slice(0, MAX_HOST_DIAGNOSTIC_LENGTH - 3)}...` : value;
-/**
-* The envelope itself could not be honored: the Object could not decode the request, or a
-* response could not be encoded/decoded. Never carries operation semantics.
-*/
-var HostProtocolError = class extends Schema.TaggedError()("HostProtocolError", { message: BoundedDiagnostic }) {};
-/** The Worker-side stub call itself failed (RPC rejection, overload, eviction mid-call). */
-var ConversationClientError = class extends Schema.TaggedError()("ConversationClientError", {
-	conversationId: Schema.String,
-	message: Schema.String,
-	cause: Schema.optionalKey(Schema.Defect())
-}) {};
-/**
-* One durable submission, input ALREADY encoded by the caller through the Agent Binding's
-* input schema (the Worker bundles the same Agent definitions as the Object, so schema
-* validation happens client-side; the resolved Binding re-validates at claim time). The
-* Conversation identity is deliberately absent — the addressed Object IS the lane.
-*/
-var SubmitRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/SubmitRequest")({
-	agentId: AgentId,
-	principal: Principal,
-	idempotencyKey: IdempotencyKey,
-	definitions: DefinitionDigests,
-	inputPayload: PersistedJson
-}) {};
-/** One bounded page of canonical records after an optional sequence. */
-var ObservePageRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/ObservePageRequest")({
-	afterSequence: Schema.optionalKey(CanonicalSequence),
-	limit: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(1024))
-}) {};
-/**
-* Every typed failure a host entry point can produce, plus the protocol's own errors. Same
-* closed-union discipline as the WP2 `PortFailure`: members re-decode to the SAME tagged
-* classes on the Worker side; `cause` chains travel as Schema defects without instance
-* fidelity (plan §2.8).
-*/
-const HostFailure = Schema.Union([
-	AgentInputError,
-	DigestError,
-	AdmissionConflict,
-	SettlementConflict,
-	ApprovalConflict,
-	UnknownResolutionConflict,
-	JoinedToHost,
-	LedgerError,
-	ConversationStoreError,
-	ConversationNotMaterialized,
-	AppendConflict,
-	FenceRejected,
-	DurableRuntimeFailpointError,
-	AdmissionLimitExceeded,
-	DurableAlarmError,
-	HostProtocolError
-]);
-var SubmitSucceeded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/SubmitSucceeded")("SubmitSucceeded", { receipt: Receipt }) {};
-var SettlementReached = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/SettlementReached")("SettlementReached", { settlement: Settlement }) {};
-var ObservedPage = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ObservedPage")("ObservedPage", { records: Schema.Array(CanonicalRecordEnvelope).check(Schema.isMaxLength(1024)) }) {};
-var AbortRecorded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/AbortRecorded")("AbortRecorded", { intent: AbortIntent }) {};
-var ApprovalRecorded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ApprovalRecorded")("ApprovalRecorded", { intent: ApprovalDecisionIntent }) {};
-var UnknownResolutionRecorded = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/UnknownResolutionRecorded")("UnknownResolutionRecorded", { intent: UnknownResolutionIntent }) {};
-/** The entry point failed TYPED on the Object; the failure re-decodes verbatim. */
-var HostFailed = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/HostFailed")("HostFailed", { failure: HostFailure }) {};
-/** The uniform answer of one host entry point. Callers narrow by the tag their call implies. */
-const HostResponse = Schema.Union([
-	SubmitSucceeded,
-	SettlementReached,
-	ObservedPage,
-	AbortRecorded,
-	ApprovalRecorded,
-	UnknownResolutionRecorded,
-	HostFailed
-]);
-const decodeSubmitRequest = Schema.decodeUnknownEffect(SubmitRequest);
-const encodeSubmitRequest = Schema.encodeEffect(SubmitRequest);
-const decodeReceipt = Schema.decodeUnknownEffect(Receipt);
-const encodeReceipt = Schema.encodeEffect(Receipt);
-const decodeObservePageRequest = Schema.decodeUnknownEffect(ObservePageRequest);
-const encodeObservePageRequest = Schema.encodeEffect(ObservePageRequest);
-const decodeAbortCommand = Schema.decodeUnknownEffect(AbortCommand);
-const encodeAbortCommand = Schema.encodeEffect(AbortCommand);
-const decodeApprovalDecisionCommand = Schema.decodeUnknownEffect(ApprovalDecisionCommand);
-const encodeApprovalDecisionCommand = Schema.encodeEffect(ApprovalDecisionCommand);
-const decodeUnknownResolutionCommand = Schema.decodeUnknownEffect(UnknownResolutionCommand);
-const encodeUnknownResolutionCommand = Schema.encodeEffect(UnknownResolutionCommand);
-const encodeHostResponse = Schema.encodeEffect(HostResponse);
-const decodeHostResponse = Schema.decodeUnknownEffect(HostResponse);
-const SUBMIT_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"AgentInputError",
-	"DigestError",
-	"AdmissionConflict",
-	"LedgerError",
-	"ConversationStoreError",
-	"ConversationNotMaterialized",
-	"AppendConflict",
-	"FenceRejected",
-	"DurableRuntimeFailpointError",
-	"AdmissionLimitExceeded",
-	"DurableAlarmError",
-	"HostProtocolError"
-]);
-const AWAIT_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"LedgerError",
-	"SettlementConflict",
-	"HostProtocolError"
-]);
-const OBSERVE_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"ConversationStoreError",
-	"ConversationNotMaterialized",
-	"HostProtocolError"
-]);
-const ABORT_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"LedgerError",
-	"SettlementConflict",
-	"JoinedToHost",
-	"DurableRuntimeFailpointError",
-	"DurableAlarmError",
-	"HostProtocolError"
-]);
-const APPROVAL_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"LedgerError",
-	"SettlementConflict",
-	"ApprovalConflict",
-	"DurableAlarmError",
-	"HostProtocolError"
-]);
-const UNKNOWN_FAILURE_TAGS = /* @__PURE__ */ new Set([
-	"LedgerError",
-	"SettlementConflict",
-	"UnknownResolutionConflict",
-	"JoinedToHost",
-	"DurableRuntimeFailpointError",
-	"DurableAlarmError",
-	"HostProtocolError"
-]);
-const outOfContract = (conversationId, operation, observed) => ConversationClientError.make({
-	conversationId,
-	message: boundHostDiagnostic(`The Conversation Object answered ${operation} with the out-of-contract ${observed}.`)
-});
-/**
-* Narrow one decoded `HostFailed.failure` to the operation's declared failure family; an
-* out-of-contract tag folds into `ConversationClientError` instead of being erased or
-* re-thrown raw (the WP2 discipline). The predicate is the single documented narrowing over
-* the closed `HostFailure` union.
-*/
-const narrowFailure = (tags) => (failure) => tags.has(failure._tag);
-/** Worker-side client over the Conversation Object namespace (DEPLOY-010). */
-var CloudflareConversationClient = class CloudflareConversationClient extends Context.Service()("@effect-agent/platform-cloudflare/CloudflareConversationClient") {
-	static layer = Layer.effect(CloudflareConversationClient)(Effect.gen(function* () {
-		const { namespace } = yield* ConversationObjectNamespace;
-		const call = (conversationId, operation, invoke) => Effect.tryPromise({
-			try: () => invoke(namespace.get(namespace.idFromName(conversationId))),
-			catch: (cause) => ConversationClientError.make({
-				conversationId,
-				message: boundHostDiagnostic(`${operation} did not reach the Conversation Object: ${cause instanceof Error ? cause.message : String(cause)}`),
-				cause
-			})
-		}).pipe(Effect.flatMap((raw) => decodeHostResponse(raw).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`The ${operation} answer could not be decoded: ${error.message}`) })))), Effect.withSpan("CloudflareConversationClient.call", { attributes: {
-			conversationId,
-			operation
-		} }));
-		const expect = (conversationId, operation, resultTag, tags) => {
-			const isExpected = narrowFailure(tags);
-			return (response) => {
-				if (response._tag === "HostFailed") {
-					const failure = response.failure;
-					return isExpected(failure) ? Effect.fail(failure) : Effect.fail(outOfContract(conversationId, operation, `failure ${failure._tag}`));
-				}
-				if (response._tag !== resultTag) return Effect.fail(outOfContract(conversationId, operation, `result ${response._tag}`));
-				return Effect.succeed(response);
-			};
-		};
-		const readPage = (conversationId, options) => Effect.gen(function* () {
-			const request = ObservePageRequest.make({
-				...options?.afterSequence === void 0 ? {} : { afterSequence: options.afterSequence },
-				limit: options?.limit ?? 256
-			});
-			const encoded = yield* encodeObservePageRequest(request).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`observePage request encode failed: ${error.message}`) })));
-			const response = yield* call(conversationId, "observePage", (stub) => stub.observePage(encoded));
-			return (yield* expect(conversationId, "observePage", "ObservedPage", OBSERVE_FAILURE_TAGS)(response)).records;
-		});
-		return CloudflareConversationClient.of({
-			submit: (agent, input, options) => Effect.gen(function* () {
-				const encodedInput = yield* Schema.encodeEffect(agent.definition.input)(input).pipe(Effect.mapError((cause) => AgentInputError.make({ message: `Unable to encode Agent input: ${cause.message}` })));
-				const inputPayload = yield* Schema.decodeUnknownEffect(PersistedJson)(encodedInput).pipe(Effect.mapError(() => AgentInputError.make({ message: "Agent input does not satisfy the canonical persistence bounds" })));
-				const request = SubmitRequest.make({
-					agentId: agent.definition.id,
-					principal: options.principal,
-					idempotencyKey: options.idempotencyKey,
-					definitions: options.definitions,
-					inputPayload
-				});
-				const encoded = yield* encodeSubmitRequest(request).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`submit request encode failed: ${error.message}`) })));
-				const response = yield* call(options.conversationId, "submit", (stub) => stub.submitEncoded(encoded));
-				return (yield* expect(options.conversationId, "submit", "SubmitSucceeded", SUBMIT_FAILURE_TAGS)(response)).receipt;
-			}),
-			awaitSettlement: (receipt) => Effect.gen(function* () {
-				const encoded = yield* encodeReceipt(receipt).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`receipt encode failed: ${error.message}`) })));
-				const response = yield* call(receipt.conversationId, "awaitSettlement", (stub) => stub.awaitSettlementEncoded(encoded));
-				return (yield* expect(receipt.conversationId, "awaitSettlement", "SettlementReached", AWAIT_FAILURE_TAGS)(response)).settlement;
-			}),
-			readPage,
-			readAll: (conversationId) => Effect.gen(function* () {
-				const all = [];
-				let after;
-				for (;;) {
-					const page = yield* readPage(conversationId, {
-						afterSequence: after,
-						limit: 1024
-					});
-					all.push(...page);
-					const last = page.at(-1);
-					if (page.length < 1024 || last === void 0) return all;
-					after = last.sequence;
-				}
-			}),
-			abort: (conversationId, command) => Effect.gen(function* () {
-				const encoded = yield* encodeAbortCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`abort command encode failed: ${error.message}`) })));
-				const response = yield* call(conversationId, "abort", (stub) => stub.abortEncoded(encoded));
-				return (yield* expect(conversationId, "abort", "AbortRecorded", ABORT_FAILURE_TAGS)(response)).intent;
-			}),
-			resolveApproval: (conversationId, command) => Effect.gen(function* () {
-				const encoded = yield* encodeApprovalDecisionCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`approval command encode failed: ${error.message}`) })));
-				const response = yield* call(conversationId, "resolveApproval", (stub) => stub.resolveApprovalEncoded(encoded));
-				return (yield* expect(conversationId, "resolveApproval", "ApprovalRecorded", APPROVAL_FAILURE_TAGS)(response)).intent;
-			}),
-			resolveUnknown: (conversationId, command) => Effect.gen(function* () {
-				const encoded = yield* encodeUnknownResolutionCommand(command).pipe(Effect.mapError((error) => HostProtocolError.make({ message: boundHostDiagnostic(`resolution command encode failed: ${error.message}`) })));
-				const response = yield* call(conversationId, "resolveUnknown", (stub) => stub.resolveUnknownEncoded(encoded));
-				return (yield* expect(conversationId, "resolveUnknown", "UnknownResolutionRecorded", UNKNOWN_FAILURE_TAGS)(response)).intent;
-			})
-		});
-	}));
-};
-//#endregion
-//#region src/conversation-object.ts
-/** Port envelope tags whose owner-side execution durably mutates this Object's lane. */
-const MUTATING_PORT_TAGS = /* @__PURE__ */ new Set([
-	"LedgerAdmit",
-	"LedgerMarkReady",
-	"LedgerRequestAbort",
-	"LedgerRecordChildSettled",
-	"StoreMaterialize",
-	"StoreAppend"
-]);
-const isMutatingPortRequest = (encoded) => typeof encoded === "object" && encoded !== null && "_tag" in encoded && typeof encoded._tag === "string" && MUTATING_PORT_TAGS.has(encoded._tag);
-/** The literal encoded `PortFailed(PortProtocolError)` fallback (same shape as WP2's). */
-const encodedPortProtocolFailure = (message) => ({
-	_tag: "PortFailed",
-	failure: {
-		_tag: "PortProtocolError",
-		message: boundHostDiagnostic(message)
-	}
-});
-const protocolFailure = (context) => (error) => HostProtocolError.make({ message: boundHostDiagnostic(`${context}: ${error.message}`) });
-/** Fold one endpoint's typed failures into the uniform `HostResponse` envelope. */
-const respond = (effect) => effect.pipe(Effect.map((result) => result), Effect.catch((failure) => Effect.succeed(HostFailed.make({ failure }))));
-/** Encode the response envelope; an unencodable response degrades to a protocol failure. */
-const encodeResponse = (response) => encodeHostResponse(response).pipe(Effect.catch((error) => Effect.succeed({
-	_tag: "HostFailed",
-	failure: {
-		_tag: "HostProtocolError",
-		message: boundHostDiagnostic(`The host response could not be encoded: ${error.message}`)
-	}
-})));
-const utf8Bytes = (value) => new TextEncoder().encode(JSON.stringify(value)).length;
-/**
-* The admission-limits gate, BEFORE `runtime.submit` touches the ledger (exit gate
-* "resource limits are checked before admission"; DEPLOY-007). A replayed idempotency key is
-* exempt: its accepted-work obligation already exists, and returning the original Receipt
-* consumes no new quota. Refusals are typed `AdmissionLimitExceeded` and nothing is written.
-*/
-const gateAdmissionLimits = Effect.fn("ConversationObject.gateAdmissionLimits")(function* (request) {
-	const identity = yield* ConversationObjectIdentity;
-	const config = yield* CloudflareDurableRuntimeConfig;
-	const ledger = yield* SubmissionLedger;
-	const { ctx } = yield* DurableObjectContext;
-	const existing = yield* ledger.lookup(SubmissionLookupByKey.make({
-		conversationId: identity.conversationId,
-		principal: request.principal,
-		idempotencyKey: request.idempotencyKey
-	}));
-	if (Option.isSome(existing)) return;
-	const inputBytes = utf8Bytes(request.inputPayload);
-	if (inputBytes > config.limits.maxInputBytes) return yield* AdmissionLimitExceeded.make({
-		limit: "input-bytes",
-		actual: inputBytes,
-		maximum: config.limits.maxInputBytes
-	});
-	const nonterminal = yield* Stream.runCollect(ledger.scanNonterminal);
-	if (nonterminal.length >= config.limits.maxQueueDepthPerLane) return yield* AdmissionLimitExceeded.make({
-		limit: "queue-depth",
-		actual: nonterminal.length,
-		maximum: config.limits.maxQueueDepthPerLane
-	});
-	const databaseBytes = yield* Effect.sync(() => ctx.storage.sql.databaseSize);
-	if (databaseBytes > config.limits.maxDatabaseBytes) return yield* AdmissionLimitExceeded.make({
-		limit: "database-bytes",
-		actual: databaseBytes,
-		maximum: config.limits.maxDatabaseBytes
-	});
-});
-/**
-* The submit-capable projection of an Agent Binding on the OBJECT side: the input arrived
-* already encoded through the real input schema on the Worker side (`client.ts`), so the
-* Object admits the canonical `PersistedJson` payload as-is; the resolved Binding re-derives
-* everything else from the stored `(agentId, agentDigests)` at claim time (SUB-023).
-*/
-const passthroughSubmitAgent = (agentId) => ({ definition: {
-	id: agentId,
-	input: PersistedJson
-} });
-const submitEndpoint = (encoded) => decodeSubmitRequest(encoded).pipe(Effect.mapError(protocolFailure("The submit request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
-	const identity = yield* ConversationObjectIdentity;
-	const maintenance = yield* ConversationMaintenance;
-	const runtime = yield* DurableAgentRuntime;
-	yield* gateAdmissionLimits(request);
-	yield* maintenance.preArm;
-	const receipt = yield* runtime.submit(passthroughSubmitAgent(request.agentId), request.inputPayload, {
-		conversationId: identity.conversationId,
-		principal: request.principal,
-		idempotencyKey: request.idempotencyKey,
-		definitions: request.definitions
-	});
-	return SubmitSucceeded.make({ receipt });
-})), respond, Effect.flatMap(encodeResponse));
-const awaitSettlementEndpoint = (encoded) => decodeReceipt(encoded).pipe(Effect.mapError(protocolFailure("The receipt could not be decoded")), Effect.flatMap((receipt) => Effect.gen(function* () {
-	const settlement = yield* (yield* DurableAgentRuntime).awaitSettlement(receipt);
-	return SettlementReached.make({ settlement });
-})), respond, Effect.flatMap(encodeResponse));
-const observePageEndpoint = (encoded) => decodeObservePageRequest(encoded).pipe(Effect.mapError(protocolFailure("The observe request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
-	const identity = yield* ConversationObjectIdentity;
-	const store = yield* ConversationStore;
-	yield* (yield* OperationAuthorizer).authorize(OperationAuthorizationRequest.make({
-		operation: "observe",
-		conversationId: identity.conversationId
-	})).pipe(Effect.catchTag("OperationDenied", deniedToProtocolFailure));
-	const records = yield* Stream.runCollect(store.read(ConversationRead.make({
-		conversationId: identity.conversationId,
-		...request.afterSequence === void 0 ? {} : { afterSequence: request.afterSequence },
-		limit: request.limit
-	})));
-	return ObservedPage.make({ records: [...records] });
-})), respond, Effect.flatMap(encodeResponse));
-const abortEndpoint = (encoded) => decodeAbortCommand(encoded).pipe(Effect.mapError(protocolFailure("The abort command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
-	const maintenance = yield* ConversationMaintenance;
-	const runtime = yield* DurableAgentRuntime;
-	yield* maintenance.preArm;
-	const intent = yield* runtime.abort(command);
-	return AbortRecorded.make({ intent });
-})), respond, Effect.flatMap(encodeResponse));
-/**
-* The pre-P7 host protocol's failure union does not carry `OperationDenied` (the Worker client
-* predates the authorizer). This assembly always runs the default possession authorizer — no
-* `CloudflareDurableRuntimeOptions` authorizer lever exists yet — so a denial here is
-* unreachable today; if one ever surfaces it degrades to the protocol failure instead of an
-* out-of-contract throw. The four P7 admin entry points below carry `OperationDenied` typed.
-*/
-const deniedToProtocolFailure = (denied) => Effect.fail(HostProtocolError.make({ message: boundHostDiagnostic(`The ${denied.operation} operation was denied: ${denied.reason}`) }));
-const resolveApprovalEndpoint = (encoded) => decodeApprovalDecisionCommand(encoded).pipe(Effect.mapError(protocolFailure("The approval command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
-	const maintenance = yield* ConversationMaintenance;
-	const runtime = yield* DurableAgentRuntime;
-	yield* maintenance.preArm;
-	const intent = yield* runtime.resolveApproval(command).pipe(Effect.catchTag("OperationDenied", deniedToProtocolFailure));
-	return ApprovalRecorded.make({ intent });
-})), respond, Effect.flatMap(encodeResponse));
-const resolveUnknownEndpoint = (encoded) => decodeUnknownResolutionCommand(encoded).pipe(Effect.mapError(protocolFailure("The resolution command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
-	const maintenance = yield* ConversationMaintenance;
-	const runtime = yield* DurableAgentRuntime;
-	yield* maintenance.preArm;
-	const intent = yield* runtime.resolveUnknown(command).pipe(Effect.catchTag("OperationDenied", deniedToProtocolFailure));
-	return UnknownResolutionRecorded.make({ intent });
-})), respond, Effect.flatMap(encodeResponse));
-/** Explain one Submission (`submissionId` present) or every nonterminal lane member. */
-var AdminExplainRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/AdminExplainRequest")({ submissionId: Schema.optionalKey(SubmissionId) }) {};
-/** Verify carries no parameters — the addressed Object IS the lane. */
-var AdminVerifyRequest = class extends Schema.Class("@effect-agent/platform-cloudflare/AdminVerifyRequest")({}) {};
-/** Every typed failure of the four admin entry points, plus the protocol's own errors. */
-const AdminFailure = Schema.Union([
-	OperationDenied,
-	RetryRefused,
-	LedgerError,
-	RunJournalError,
-	DigestError,
-	OwnershipLost,
-	SettlementConflict,
-	ConversationStoreError,
-	ConversationNotMaterialized,
-	AppendConflict,
-	FenceRejected,
-	DurableRuntimeFailpointError,
-	DurableAlarmError,
-	HostProtocolError
-]);
-var ExplainedRecovery = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ExplainedRecovery")("ExplainedRecovery", { explanations: Schema.Array(RecoveryExplanation).check(Schema.isMaxLength(1024)) }) {};
-var VerifiedIntegrity = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/VerifiedIntegrity")("VerifiedIntegrity", { report: IntegrityReport }) {};
-var RetryExecuted = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/RetryExecuted")("RetryExecuted", { report: RecoveryReport }) {};
-var ObligationsScanned = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/ObligationsScanned")("ObligationsScanned", { report: ObligationReport }) {};
-/** The admin entry point failed TYPED on the Object; the failure re-decodes verbatim. */
-var AdminFailed = class extends Schema.TaggedClass("@effect-agent/platform-cloudflare/AdminFailed")("AdminFailed", { failure: AdminFailure }) {};
-/** The uniform answer of one admin entry point. Callers narrow by the tag their call implies. */
-const AdminResponse = Schema.Union([
-	ExplainedRecovery,
-	VerifiedIntegrity,
-	RetryExecuted,
-	ObligationsScanned,
-	AdminFailed
-]);
-const decodeAdminExplainRequest = Schema.decodeUnknownEffect(AdminExplainRequest);
-const decodeAdminVerifyRequest = Schema.decodeUnknownEffect(AdminVerifyRequest);
-const decodeRetryCommand = Schema.decodeUnknownEffect(RetryCommand);
-const decodeObligationThresholds = Schema.decodeUnknownEffect(ObligationThresholds);
-const encodeAdminResponse = Schema.encodeEffect(AdminResponse);
-const decodeAdminResponse = Schema.decodeUnknownEffect(AdminResponse);
-/** Fold one admin endpoint's typed failures into the uniform `AdminResponse` envelope. */
-const respondAdmin = (effect) => effect.pipe(Effect.map((result) => result), Effect.catch((failure) => Effect.succeed(AdminFailed.make({ failure }))));
-/** Encode the admin response envelope; an unencodable response degrades to a protocol failure. */
-const encodeAdminResponseTotal = (response) => encodeAdminResponse(response).pipe(Effect.catch((error) => Effect.succeed({
-	_tag: "AdminFailed",
-	failure: {
-		_tag: "HostProtocolError",
-		message: boundHostDiagnostic(`The admin response could not be encoded: ${error.message}`)
-	}
-})));
-const explainEndpoint = (encoded) => decodeAdminExplainRequest(encoded).pipe(Effect.mapError(protocolFailure("The explain request could not be decoded")), Effect.flatMap((request) => Effect.gen(function* () {
-	const identity = yield* ConversationObjectIdentity;
-	const runtime = yield* DurableAgentRuntime;
-	const explanations = request.submissionId === void 0 ? yield* runtime.explainConversation(identity.conversationId) : [yield* runtime.explain(request.submissionId)];
-	return ExplainedRecovery.make({ explanations });
-})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
-const verifyEndpoint = (encoded) => decodeAdminVerifyRequest(encoded).pipe(Effect.mapError(protocolFailure("The verify request could not be decoded")), Effect.flatMap(() => Effect.gen(function* () {
-	const identity = yield* ConversationObjectIdentity;
-	const report = yield* (yield* DurableAgentRuntime).verify(identity.conversationId);
-	return VerifiedIntegrity.make({ report });
-})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
-const retryEndpoint = (encoded) => decodeRetryCommand(encoded).pipe(Effect.mapError(protocolFailure("The retry command could not be decoded")), Effect.flatMap((command) => Effect.gen(function* () {
-	const maintenance = yield* ConversationMaintenance;
-	const runtime = yield* DurableAgentRuntime;
-	yield* maintenance.preArm;
-	const report = yield* runtime.retry(command);
-	return RetryExecuted.make({ report });
-})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
-const obligationsEndpoint = (encoded) => decodeObligationThresholds(encoded).pipe(Effect.mapError(protocolFailure("The obligation thresholds could not be decoded")), Effect.flatMap((thresholds) => Effect.gen(function* () {
-	const report = yield* (yield* DurableAgentRuntime).scanObligations(thresholds);
-	return ObligationsScanned.make({ report });
-})), respondAdmin, Effect.flatMap(encodeAdminResponseTotal));
-/**
-* Owner-side `portCall`: pre-arm before a mutating envelope (a routed admission committed by
-* THIS Object must already carry the alarm that will finish it), execute on the LOCAL facets
-* (never the routed decorators), then arm an immediate alarm so the mutated lane is
-* processed promptly. Protocol anomalies answer `PortFailed(PortProtocolError)`.
-*/
-const portCallEndpoint = (encoded) => Effect.gen(function* () {
-	const ports = yield* ConversationObjectPorts;
-	const maintenance = yield* ConversationMaintenance;
-	const alarm = yield* DurableAlarmService;
-	const mutating = isMutatingPortRequest(encoded);
-	if (mutating) {
-		if ((yield* maintenance.preArm.pipe(Effect.exit))._tag === "Failure") return encodedPortProtocolFailure("The owner Object could not arm its maintenance alarm before the mutation.");
-	}
-	const response = yield* ports.handle(encoded);
-	if (mutating) yield* alarm.scheduleNow.pipe(Effect.catch((error) => Effect.logWarning("ConversationObject.portCall: immediate re-arm failed", error)));
-	return response;
-});
-const wakeEndpoint = Effect.gen(function* () {
-	yield* (yield* DurableAlarmService).scheduleNow.pipe(Effect.catch((error) => Effect.logWarning("ConversationObject.wake dropped", error)));
-});
-const alarmEndpoint = Effect.gen(function* () {
-	yield* (yield* ConversationMaintenance).pass;
-});
-const gateEndpoint = Effect.gen(function* () {
-	yield* (yield* ConversationMaintenance).ensureAlarm;
-});
-/**
-* Adapter from effect-cf's native Durable Object services to Effect Agent's existing platform
-* ports. effect-cf owns the cached ManagedRuntime and supplies these values once per Object
-* incarnation; the durable runtime continues to depend only on the narrow services below.
-*/
-const effectCfPlatformLayer = (namespaceBinding) => {
-	const context = Layer.effect(DurableObjectContext)(Effect.gen(function* () {
-		const state = yield* DurableObjectState.DurableObjectState;
-		const env = yield* WorkerEnvironment;
-		return DurableObjectContext.of({
-			ctx: state.raw,
-			env
-		});
-	}));
-	const namespace = Layer.effect(ConversationObjectNamespace)(Effect.gen(function* () {
-		const binding = yield* conversationNamespaceFromEnv(yield* WorkerEnvironment, namespaceBinding);
-		return ConversationObjectNamespace.of({ namespace: binding });
-	}));
-	return Layer.merge(context, namespace);
-};
-/**
-* Build the application's Conversation Object class (export it from the Worker entry).
-* effect-cf owns the cached ManagedRuntime, native RPC methods, event scopes, and post-handler
-* OTLP flush scheduling for RPC and alarm events. The optional outer Layer is built per native
-* event, so a host can install Tracer/Logger/Metric services and `OtlpExporter.Flusher` without
-* Effect Agent owning exporter lifecycle machinery.
-*/
-const makeConversationObjectClass = (options, observability) => {
-	const application = CloudflareDurableRuntime.layer(options).pipe(Layer.provideMerge(effectCfPlatformLayer(options.namespaceBinding)));
-	const runtime = Layer.effectContext(Effect.gen(function* () {
-		const state = yield* DurableObjectState.DurableObjectState;
-		const scope = yield* Effect.scope;
-		return yield* state.blockConcurrencyWhile(Effect.gen(function* () {
-			const services = yield* Layer.buildWithScope(application, scope);
-			yield* gateEndpoint.pipe(Effect.provide(services));
-			return services;
-		}));
-	}));
-	const rpc = {
-		submitEncoded: (encoded) => submitEndpoint(encoded),
-		awaitSettlementEncoded: (encoded) => awaitSettlementEndpoint(encoded),
-		observePage: (encoded) => observePageEndpoint(encoded),
-		abortEncoded: (encoded) => abortEndpoint(encoded),
-		resolveApprovalEncoded: (encoded) => resolveApprovalEndpoint(encoded),
-		resolveUnknownEncoded: (encoded) => resolveUnknownEndpoint(encoded),
-		explainEncoded: (encoded) => explainEndpoint(encoded),
-		verifyEncoded: (encoded) => verifyEndpoint(encoded),
-		retryEncoded: (encoded) => retryEndpoint(encoded),
-		obligationsEncoded: (encoded) => obligationsEndpoint(encoded),
-		portCall: (encoded) => portCallEndpoint(encoded),
-		wake: () => wakeEndpoint
-	};
-	const EffectCfConversationObject = DurableObject.make(runtime, {
-		...observability === void 0 ? {} : { eventLayer: observability },
-		initialize: Effect.void,
-		rpc,
-		alarm: () => alarmEndpoint
-	});
-	class ConversationObject extends EffectCfConversationObject {
-		alarm(alarmInfo) {
-			return super.alarm?.(alarmInfo);
-		}
-	}
-	return ConversationObject;
-};
-//#endregion
-//#region src/code-mode-executor.ts
-/**
-* The Cloudflare Dynamic Worker `CodeExecutor` adapter (C4 of ADR-0017;
-* DEPLOY-011). Each pass loads one fresh Worker through the Worker Loader
-* with `globalOutbound: null`, so generated code has no ambient network,
-* bindings, or secrets; its only authority is the pass-scoped host stub that
-* routes back to `CodeModeHostEntrypoint` and, from there, into the pass's
-* `CodeExecutionHost` service. Platform CPU limits stop synchronous runaway
-* programs; the executor-owned wall-clock deadline interrupts asynchronously
-* suspended passes. Deployment class `E` only: the adapter records no
-* persistent state and a later pass may run in a completely different
-* isolate.
-*/
-const dynamicWorkerImplementation = SandboxImplementation.make({
-	isolation: "isolated",
-	identity: "cloudflare-dynamic-worker"
-});
-/**
-* Live passes by identity. Entries are Scope-managed: registered when a pass
-* opens and removed by its finalizer, so a stale harness (or a forged
-* `passId`) cannot reach any host authority.
-*/
-const passRegistry = /* @__PURE__ */ new Map();
-/**
-* The host-side RPC target for dynamic workers. The application exposes it
-* from its Worker entry (`export { CodeModeHostEntrypoint }`) and hands the
-* adapter a same-instance stub — `ctx.exports.CodeModeHostEntrypoint()` in
-* production (a self service binding may reach a different instance and must
-* not be used there); tests bind it through Miniflare's `kCurrentWorker`.
-*/
-var CodeModeHostEntrypoint = class extends WorkerEntrypoint {
-	async call(passId, hostCall) {
-		const pass = passRegistry.get(String(passId));
-		if (pass === void 0) throw new Error("Unknown Code Mode pass");
-		return pass.dispatch(hostCall);
-	}
-};
-/**
-* The fixed harness loaded as the dynamic worker's main module. The generated
-* source becomes `program.mjs` (`export default (<expression>);`) — a module,
-* never `eval`. The harness installs namespace globals and a bounded console,
-* imports the program, invokes it exactly once, and returns one envelope the
-* host validates through Effect Schema.
-*/
-const HARNESS_MODULE = String.raw`
-import { WorkerEntrypoint } from "cloudflare:workers";
-import programDefault from "./program.js";
-
-const encoder = new TextEncoder();
-const utf8 = (text) => encoder.encode(text).byteLength;
-const safeText = (value) => {
-  try {
-    if (value instanceof Error) return (value.name + ": " + value.message).slice(0, 4000);
-    if (typeof value === "string") return value.slice(0, 4000);
-    const encoded = JSON.stringify(value);
-    return (encoded === undefined ? String(value) : encoded).slice(0, 4000);
-  } catch {
-    return "[unserializable value]";
-  }
-};
-const safeJson = (value) => {
-  try {
-    const encoded = JSON.stringify(value);
-    if (encoded !== undefined && encoded.length <= 4000) return JSON.parse(encoded);
-  } catch {}
-  return safeText(value);
-};
-
-export default class CodeModeHarness extends WorkerEntrypoint {
-  async run() {
-    const config = JSON.parse(this.env.CODE_MODE_PASS);
-    const host = this.env.CODE_MODE_HOST;
-    const limits = config.limits;
-    const logs = [];
-    let logBytes = 0;
-    let fatal;
-    const boundedLogs = () => logs.slice(0, 4096);
-    const write = (...values) => {
-      const joined = values.map(safeText).join(" ");
-      const line = joined.length > 16000 ? joined.slice(0, 15999) + "…" : joined;
-      const bytes = utf8(line);
-      if (logs.length >= 4096 || logBytes + bytes > limits.maxLogBytes) {
-        fatal = fatal ?? { _tag: "log-limit", observed: logBytes + bytes, logs: boundedLogs() };
-        throw new Error("code-mode log limit exceeded");
-      }
-      logs.push(line);
-      logBytes += bytes;
-    };
-    globalThis.console = { log: write, info: write, warn: write, error: write, debug: write };
-
-    let hostCalls = 0;
-    const makeMethod = (namespace, method) => async (argument) => {
-      hostCalls += 1;
-      if (hostCalls > limits.maxHostCalls) {
-        fatal = fatal ?? { _tag: "host-call-limit", logs: boundedLogs() };
-        throw new Error("code-mode host-call limit exceeded");
-      }
-      let argText;
-      try {
-        argText = JSON.stringify(argument);
-      } catch {}
-      if (argText === undefined || utf8(argText) > limits.maxHostCallArgumentBytes) {
-        fatal = fatal ?? {
-          _tag: "argument-limit",
-          observed: argText === undefined ? 0 : utf8(argText),
-          logs: boundedLogs(),
-        };
-        throw new Error("code-mode host-call argument limit exceeded");
-      }
-      const outcome = await host.call(config.passId, {
-        namespace,
-        method,
-        argument: JSON.parse(argText),
-      });
-      if (outcome !== null && typeof outcome === "object" && outcome._tag === "CodeHostCallSuccess") {
-        return outcome.value;
-      }
-      if (outcome !== null && typeof outcome === "object" && outcome._tag === "CodeHostCallFailure") {
-        throw outcome.error;
-      }
-      fatal = fatal ?? { _tag: "protocol", message: "host returned an unrecognized outcome" };
-      throw new Error("code-mode host protocol violation");
-    };
-    for (const namespace of config.namespaces) {
-      const methods = {};
-      for (const method of namespace.methods) {
-        methods[method] = makeMethod(namespace.name, method);
-      }
-      globalThis[namespace.name] = methods;
-    }
-
-    // program.js is imported statically at the top of this module, so a
-    // syntactically invalid program fails the whole harness at load (mapped
-    // to a source error by the host). Using a static import keeps this module
-    // free of dynamic-import expressions, which single-script Miniflare hosts
-    // reject. The isolation boundary does NOT depend on the ordering of this
-    // import versus the console/namespace shims installed below: the loaded
-    // Worker has globalOutbound: null and no bindings, secrets, or env from
-    // the Worker Loader config BEFORE any module in the graph evaluates, so
-    // module-level program code has no ambient authority regardless. The
-    // shims below are usability wrappers (bounded console, namespace globals),
-    // and the accepted program is a single async-function expression whose
-    // body runs only when invoked here — after the shims exist.
-    const program = programDefault;
-    if (typeof program !== "function") {
-      return { _tag: "source-not-a-function", actual: typeof program };
-    }
-    try {
-      const value = await program();
-      if (fatal !== undefined) return fatal;
-      let text;
-      try {
-        text = JSON.stringify(value);
-      } catch {}
-      if (text === undefined) {
-        return {
-          _tag: "program-failed",
-          reason: "non-json-result",
-          thrown: null,
-          message: "The program must return a JSON value",
-          logs: boundedLogs(),
-        };
-      }
-      const resultBytes = utf8(text);
-      if (resultBytes > limits.maxResultBytes) {
-        return { _tag: "result-limit", observed: resultBytes, logs: boundedLogs() };
-      }
-      return {
-        _tag: "completed",
-        value: JSON.parse(text),
-        logs: boundedLogs(),
-        hostCalls,
-        logBytes,
-        resultBytes,
-      };
-    } catch (cause) {
-      if (fatal !== undefined) return fatal;
-      return {
-        _tag: "program-failed",
-        reason: cause instanceof Error ? "threw" : "rejected",
-        thrown: safeJson(cause),
-        message: safeText(cause),
-        logs: boundedLogs(),
-      };
-    }
-  }
-}
-`;
-const BoundedLogs = Schema.Array(Schema.String.check(Schema.isMaxLength(16 * 1024))).check(Schema.isMaxLength(4096));
-const HarnessCompleted = Schema.Struct({
-	_tag: Schema.Literal("completed"),
-	value: Schema.Json,
-	logs: BoundedLogs,
-	hostCalls: Schema.Natural,
-	logBytes: Schema.Natural,
-	resultBytes: Schema.Natural
-});
-const HarnessSourceInvalid = Schema.Struct({
-	_tag: Schema.Literal("source-invalid"),
-	message: Schema.String
-});
-const HarnessNotAFunction = Schema.Struct({
-	_tag: Schema.Literal("source-not-a-function"),
-	actual: Schema.String
-});
-const HarnessProgramFailed = Schema.Struct({
-	_tag: Schema.Literal("program-failed"),
-	reason: Schema.Literals([
-		"threw",
-		"rejected",
-		"non-json-result"
-	]),
-	thrown: Schema.Json,
-	message: Schema.String,
-	logs: BoundedLogs
-});
-const HarnessLogLimit = Schema.Struct({
-	_tag: Schema.Literal("log-limit"),
-	observed: Schema.Natural,
-	logs: BoundedLogs
-});
-const HarnessArgumentLimit = Schema.Struct({
-	_tag: Schema.Literal("argument-limit"),
-	observed: Schema.Natural,
-	logs: BoundedLogs
-});
-const HarnessResultLimit = Schema.Struct({
-	_tag: Schema.Literal("result-limit"),
-	observed: Schema.Natural,
-	logs: BoundedLogs
-});
-const HarnessHostCallLimit = Schema.Struct({
-	_tag: Schema.Literal("host-call-limit"),
-	logs: BoundedLogs
-});
-const HarnessProtocol = Schema.Struct({
-	_tag: Schema.Literal("protocol"),
-	message: Schema.String
-});
-const HarnessOutcome = Schema.Union([
-	HarnessCompleted,
-	HarnessSourceInvalid,
-	HarnessNotAFunction,
-	HarnessProgramFailed,
-	HarnessLogLimit,
-	HarnessArgumentLimit,
-	HarnessResultLimit,
-	HarnessHostCallLimit,
-	HarnessProtocol
-]);
-const decodeHarnessOutcome = (value) => {
-	try {
-		return Schema.decodeUnknownOption(HarnessOutcome)(value);
-	} catch {
-		return Option.none();
-	}
-};
-const decodeHostCall = (value) => {
-	try {
-		return Schema.decodeUnknownOption(CodeHostCall)(value);
-	} catch {
-		return Option.none();
-	}
-};
-/**
-* Project a host outcome to the plain JSON envelope the harness reads. A
-* `CodeExecutionHost` may return either real `CodeHostCallResult` instances
-* (the substitute and conformance kit) or plain-object equivalents (the Code
-* Mode capability's broker route), so this reads the shared fields rather than
-* `Schema.encodeSync`, which would reject a plain object.
-*/
-const hostResultEnvelope = (outcome) => outcome._tag === "CodeHostCallSuccess" ? {
-	_tag: "CodeHostCallSuccess",
-	value: outcome.value
-} : {
-	_tag: "CodeHostCallFailure",
-	error: outcome.error
-};
-const utf8ByteLength = (value) => {
-	let total = 0;
-	for (const character of value) {
-		const codePoint = character.codePointAt(0) ?? 0;
-		total += codePoint <= 127 ? 1 : codePoint <= 2047 ? 2 : codePoint <= 65535 ? 3 : 4;
-	}
-	return total;
-};
-const encodedJsonByteLength = (value) => {
-	try {
-		const encoded = JSON.stringify(value);
-		return encoded === void 0 ? void 0 : utf8ByteLength(encoded);
-	} catch {
-		return;
-	}
-};
-/** Reserved global names the harness owns inside the dynamic worker. */
-const reservedHarnessGlobals = /* @__PURE__ */ new Set(["console"]);
-const passCounterState = { next: 0 };
-const makeExecute = (options) => Effect.fn("DynamicWorkerCodeExecutor.execute")(function* (request) {
-	if (request.network._tag !== "NetworkDisabled") return yield* CodeExecutorUnsupportedError.make({
-		implementation: dynamicWorkerImplementation,
-		feature: "network",
-		message: "The Dynamic Worker executor denies all egress with globalOutbound: null; an allowlist is not supported in the first slice"
-	});
-	const sourceBytes = utf8ByteLength(request.source);
-	if (sourceBytes > request.limits.maxSourceBytes) return yield* CodeSourceError.make({
-		implementation: dynamicWorkerImplementation,
-		reason: "oversized",
-		message: `Source is ${sourceBytes} bytes; the request allows ${request.limits.maxSourceBytes}`
-	});
-	for (const namespace of request.namespaces) if (reservedHarnessGlobals.has(namespace.name)) return yield* CodeExecutorUnsupportedError.make({
-		implementation: dynamicWorkerImplementation,
-		feature: "namespaces",
-		message: `Namespace ${namespace.name} collides with a harness binding`
-	});
-	const host = yield* CodeExecutionHost;
-	passCounterState.next += 1;
-	const passId = `code-mode-pass-${passCounterState.next}-${crypto.randomUUID()}`;
-	const pending = [];
-	let wake;
-	let issuedHostCalls = 0;
-	const dispatch = (hostCall) => new Promise((resolve, reject) => {
-		issuedHostCalls += 1;
-		if (issuedHostCalls > request.limits.maxHostCalls + 1) {
-			reject(/* @__PURE__ */ new Error("host-call limit exceeded"));
-			return;
-		}
-		pending.push({
-			hostCall,
-			resolve,
-			reject
-		});
-		wake?.();
-	});
-	yield* Effect.acquireRelease(Effect.sync(() => {
-		passRegistry.set(passId, { dispatch });
-	}), () => Effect.sync(() => {
-		passRegistry.delete(passId);
-	}));
-	const nextPending = Effect.suspend(() => {
-		const item = pending.shift();
-		if (item !== void 0) return Effect.succeed(item);
-		return Effect.callback((resume) => {
-			wake = () => {
-				wake = void 0;
-				const next = pending.shift();
-				if (next !== void 0) resume(Effect.succeed(next));
-			};
-		});
-	});
-	const serveHostCalls = Effect.gen(function* () {
-		let served = 0;
-		while (true) {
-			const item = yield* nextPending;
-			served += 1;
-			if (served > request.limits.maxHostCalls) return yield* CodeHostCallLimitError.make({
-				implementation: dynamicWorkerImplementation,
-				limit: request.limits.maxHostCalls,
-				logs: []
-			});
-			const decoded = decodeHostCall(item.hostCall);
-			if (Option.isNone(decoded)) {
-				item.reject(/* @__PURE__ */ new TypeError("host calls must match the CodeHostCall schema"));
-				continue;
-			}
-			const outcome = yield* host.call(decoded.value);
-			if (outcome._tag === "CodeHostCallSuccess") {
-				const bytes = encodedJsonByteLength(outcome.value);
-				if (bytes === void 0 || bytes > request.limits.maxHostCallResultBytes) return yield* CodeOutputLimitError.make({
-					implementation: dynamicWorkerImplementation,
-					surface: "host-call-result",
-					limit: request.limits.maxHostCallResultBytes,
-					observed: bytes ?? 0,
-					logs: []
-				});
-			}
-			item.resolve(hostResultEnvelope(outcome));
-		}
-	});
-	const workerCode = {
-		compatibilityDate: options.compatibilityDate ?? "2025-05-01",
-		allowExperimental: true,
-		mainModule: "harness.js",
-		modules: {
-			"harness.js": HARNESS_MODULE,
-			"program.js": `export default (\n${request.source}\n);`
-		},
-		env: {
-			CODE_MODE_HOST: options.hostStub,
-			CODE_MODE_PASS: JSON.stringify({
-				passId,
-				namespaces: request.namespaces.map((namespace) => ({
-					name: namespace.name,
-					methods: namespace.methods
-				})),
-				limits: {
-					maxLogBytes: request.limits.maxLogBytes,
-					maxResultBytes: request.limits.maxResultBytes,
-					maxHostCalls: request.limits.maxHostCalls,
-					maxHostCallArgumentBytes: request.limits.maxHostCallArgumentBytes
-				}
-			})
-		},
-		globalOutbound: null,
-		...request.limits.cpuMillis === void 0 ? {} : { limits: {
-			cpuMs: request.limits.cpuMillis,
-			subRequests: request.limits.maxHostCalls + 8
-		} }
-	};
-	const startedAt = yield* Clock.currentTimeMillis;
-	const worker = yield* Effect.acquireRelease(Effect.try({
-		try: () => options.loader.load(workerCode),
-		catch: (cause) => {
-			const text = cause instanceof Error ? cause.message : String(cause);
-			if (/syntaxerror|failed to (compile|parse)/i.test(text)) return CodeSourceError.make({
-				implementation: dynamicWorkerImplementation,
-				reason: "invalid",
-				message: text.slice(0, 8e3)
-			});
-			return CodeExecutorStartError.make({
-				implementation: dynamicWorkerImplementation,
-				message: `The Worker Loader rejected the pass: ${text}`.slice(0, 8e3),
-				cause
-			});
-		}
-	}), (stub) => Effect.sync(() => {
-		stub[Symbol.dispose]?.();
-	}));
-	const server = yield* serveHostCalls.pipe(Effect.forkScoped);
-	const rpc = Effect.tryPromise({
-		try: async () => {
-			return await worker.getEntrypoint().run();
-		},
-		catch: (cause) => classifyWorkerFailure(cause, request.limits.maxWallTime)
-	});
-	const raw = yield* Effect.raceFirst(rpc, Fiber.join(server)).pipe(Effect.timeoutOrElse({
-		duration: request.limits.maxWallTime,
-		orElse: () => CodeExecutionTimeoutError.make({
-			implementation: dynamicWorkerImplementation,
-			kind: "wall-clock",
-			maxWallTime: request.limits.maxWallTime,
-			logs: []
-		})
-	}), Effect.ensuring(Fiber.interrupt(server)));
-	const finishedAt = yield* Clock.currentTimeMillis;
-	const outcome = decodeHarnessOutcome(raw);
-	if (Option.isNone(outcome)) return yield* CodeExecutionProtocolError.make({
-		implementation: dynamicWorkerImplementation,
-		message: "The dynamic worker returned a value outside the harness envelope schema"
-	});
-	switch (outcome.value._tag) {
-		case "completed": return CodeExecutionResult.make({
-			implementation: dynamicWorkerImplementation,
-			value: outcome.value.value,
-			logs: outcome.value.logs,
-			resourceUse: CodeExecutionResourceUse.make({
-				wallTime: Duration.millis(Math.max(0, finishedAt - startedAt)),
-				hostCalls: outcome.value.hostCalls,
-				logBytes: outcome.value.logBytes,
-				resultBytes: outcome.value.resultBytes
-			})
-		});
-		case "source-invalid": return yield* CodeSourceError.make({
-			implementation: dynamicWorkerImplementation,
-			reason: "invalid",
-			message: outcome.value.message.slice(0, 8e3)
-		});
-		case "source-not-a-function": return yield* CodeSourceError.make({
-			implementation: dynamicWorkerImplementation,
-			reason: "not-a-function",
-			message: `The source expression evaluated to ${outcome.value.actual}; it must evaluate to one async function`
-		});
-		case "program-failed": return yield* CodeProgramFailedError.make({
-			implementation: dynamicWorkerImplementation,
-			reason: outcome.value.reason,
-			thrown: outcome.value.thrown,
-			message: outcome.value.message.slice(0, 8e3),
-			logs: outcome.value.logs
-		});
-		case "log-limit": return yield* CodeOutputLimitError.make({
-			implementation: dynamicWorkerImplementation,
-			surface: "logs",
-			limit: request.limits.maxLogBytes,
-			observed: outcome.value.observed,
-			logs: outcome.value.logs
-		});
-		case "argument-limit": return yield* CodeOutputLimitError.make({
-			implementation: dynamicWorkerImplementation,
-			surface: "host-call-argument",
-			limit: request.limits.maxHostCallArgumentBytes,
-			observed: outcome.value.observed,
-			logs: outcome.value.logs
-		});
-		case "result-limit": return yield* CodeOutputLimitError.make({
-			implementation: dynamicWorkerImplementation,
-			surface: "result",
-			limit: request.limits.maxResultBytes,
-			observed: outcome.value.observed,
-			logs: outcome.value.logs
-		});
-		case "host-call-limit": return yield* CodeHostCallLimitError.make({
-			implementation: dynamicWorkerImplementation,
-			limit: request.limits.maxHostCalls,
-			logs: outcome.value.logs
-		});
-		case "protocol": return yield* CodeExecutionProtocolError.make({
-			implementation: dynamicWorkerImplementation,
-			message: outcome.value.message.slice(0, 8e3)
-		});
-	}
-});
-/**
-* Expected worker-level failures map into the typed union with bounded
-* diagnostics; anything unrecognized stays a start/termination error rather
-* than a fabricated program result.
-*/
-const classifyWorkerFailure = (cause, maxWallTime) => {
-	const text = (() => {
-		try {
-			return cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause);
-		} catch {
-			return "[unserializable worker failure]";
-		}
-	})();
-	if (/syntaxerror|failed to (compile|parse)/i.test(text)) return CodeSourceError.make({
-		implementation: dynamicWorkerImplementation,
-		reason: "invalid",
-		message: text.slice(0, 8e3)
-	});
-	if (/cpu/i.test(text)) return CodeExecutionTimeoutError.make({
-		implementation: dynamicWorkerImplementation,
-		kind: "cpu",
-		maxWallTime,
-		logs: []
-	});
-	if (/failed to start worker/i.test(text)) return CodeExecutorStartError.make({
-		implementation: dynamicWorkerImplementation,
-		message: text.slice(0, 8e3),
-		cause
-	});
-	return CodeExecutorTerminatedError.make({
-		implementation: dynamicWorkerImplementation,
-		message: text.slice(0, 8e3)
-	});
-};
-/** Layer building the Dynamic Worker `CodeExecutor` from resolved bindings. */
-const dynamicWorkerCodeExecutorLayer = (options) => Layer.succeed(CodeExecutor)(CodeExecutor.of({ execute: makeExecute(options) }));
-//#endregion
-export { AbortRecorded, AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, AdmissionLimitExceeded, ApprovalRecorded, CLOUDFLARE_DATABASE_CAP_BYTES, CLOUDFLARE_RUNTIME_DEFAULTS, CloudflareAdmissionLimitsValue, CloudflareBindingError, CloudflareConversationClient, CloudflareDurableRuntime, CloudflareDurableRuntimeConfig, CloudflareDurableRuntimeConfigValue, CloudflarePlatformConfigError, CodeModeHostEntrypoint, ConversationClientError, ConversationMaintenance, ConversationObjectIdentity, ConversationObjectNamespace, ConversationObjectPorts, DEFAULT_MAX_DATABASE_BYTES, DurableAlarmError, DurableAlarmService, DurableObjectContext, ExplainedRecovery, HostFailed, HostFailure, HostProtocolError, HostResponse, MaintenancePassReport, ObligationsScanned, ObservePageRequest, ObservedPage, RetryExecuted, SettlementReached, SubmitRequest, SubmitSucceeded, UnknownResolutionRecorded, VerifiedIntegrity, boundHostDiagnostic, cloudflareWakeSchedulerLayer, conversationNamespaceFromEnv, conversationNamespaceLayer, conversationPortTransportLayer, decodeAbortCommand, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeApprovalDecisionCommand, decodeHostResponse, decodeObligationThresholds, decodeObservePageRequest, decodeReceipt, decodeRetryCommand, decodeSubmitRequest, decodeUnknownResolutionCommand, dynamicWorkerCodeExecutorLayer, dynamicWorkerImplementation, encodeAbortCommand, encodeAdminResponse, encodeApprovalDecisionCommand, encodeHostResponse, encodeObservePageRequest, encodeReceipt, encodeSubmitRequest, encodeUnknownResolutionCommand, makeConversationObjectClass };
-
-//# sourceMappingURL=index.mjs.map
+import { t as CloudflareBindings_exports } from "./CloudflareBindings.mjs";
+import { t as CloudflareConfig_exports } from "./CloudflareConfig.mjs";
+import { t as Alarm_exports } from "./Alarm.mjs";
+import { t as CloudflareBrowser_exports } from "./CloudflareBrowser-DV6kya1H.mjs";
+import { t as CloudflareCodeMode_exports } from "./CloudflareCodeMode.mjs";
+import { t as CloudflareMemory_exports } from "./CloudflareMemory.mjs";
+import { t as CloudflareThreadClient_exports } from "./CloudflareThreadClient.mjs";
+import { t as CloudflareScheduling_exports } from "./CloudflareScheduling.mjs";
+import { t as CloudflareSubscriptions_exports } from "./CloudflareSubscriptions.mjs";
+import { t as WakeScheduler_exports } from "./WakeScheduler.mjs";
+import { l as ThreadObject_exports } from "./ThreadObject-DvRG0dDz.mjs";
+import { t as CloudflareAiGateway_exports } from "./CloudflareAiGateway.mjs";
+export { Alarm_exports as Alarm, CloudflareAiGateway_exports as CloudflareAiGateway, CloudflareBindings_exports as CloudflareBindings, CloudflareBrowser_exports as CloudflareBrowser, CloudflareCodeMode_exports as CloudflareCodeMode, CloudflareConfig_exports as CloudflareConfig, CloudflareMemory_exports as CloudflareMemory, CloudflareScheduling_exports as CloudflareScheduling, CloudflareSubscriptions_exports as CloudflareSubscriptions, CloudflareThreadClient_exports as CloudflareThreadClient, ThreadObject_exports as ThreadObject, WakeScheduler_exports as WakeScheduler };