@effect-agent/platform-node 0.1.0-beta.8 → 0.1.0-beta.80

package/src/NodeDurableHost.ts

@@ -0,0 +1,361 @@
+import { type ThreadId, type SubmissionId } from "@effect-agent/core/Identifiers";
+import {
+  type IntegrityReport,
+  type ObligationReport,
+  type ObligationThresholds,
+  type RecoveryExplanation,
+  type RetryCommand,
+} from "@effect-agent/thread/Admin";
+import {
+  type AgentRegistration,
+  type ResolvedBinding,
+  type DurableBindingFailure,
+} from "@effect-agent/thread/AgentRegistration";
+import {
+  DurableAgentRuntime,
+  type DurableAbortFailure,
+  type DurableAwaitFailure,
+  type DurableExplainFailure,
+  type DurableObserveOptions,
+  type DurableObligationFailure,
+  type DurableRetryFailure,
+  type DurableSubmitAgent,
+  type DurableSubmitFailure,
+  type DurableSubmitOptions,
+  type DurableVerifyFailure,
+  type DurableWorkerFailure,
+  type Receipt,
+  type RecoveryReport,
+} from "@effect-agent/thread/DurableAgentRuntime";
+import {
+  type MessageDeliveryStore,
+  MessageDeliveryDriver,
+  type MessageDeliveryError,
+} from "@effect-agent/thread/MessageDelivery";
+import { type OperationDenied } from "@effect-agent/thread/OperationAuthorizer";
+import { PreparedInputAdmission } from "@effect-agent/thread/PreparedInputAdmission";
+import { type CanonicalRecordEnvelope } from "@effect-agent/thread/Records";
+import {
+  type AbortCommand,
+  type AbortIntent,
+  type Settlement,
+} from "@effect-agent/thread/SubmissionLedger";
+import {
+  type ThreadNotMaterialized,
+  type ThreadStoreError,
+} from "@effect-agent/thread/ThreadStore";
+import { NodeCrypto } from "@effect/platform-node";
+import { type Stream, Context, Effect, Fiber, Layer, Ref, Schema } from "effect";
+
+import { runNodeMessageDeliveries } from "./internal/message-delivery.ts";
+import { makeNodePreparedInputAdmission, NodeAdmission } from "./internal/prepared-admission.ts";
+import {
+  NodeDurableAgentRuntime,
+  NodeDurableAgentRuntimeConfig,
+  type NodeDurableAgentRuntimeOptions,
+} from "./NodeDurableAgentRuntime.ts";
+
+/**
+ * Admission is not open on this host: it is shutting down (deployment §6 step 1, DEPLOY-005).
+ * Accepted work is unaffected — only NEW admissions are refused.
+ */
+export class AdmissionClosed extends Schema.TaggedError<AdmissionClosed>()("AdmissionClosed", {
+  message: Schema.String,
+}) {}
+
+const makeHost = Effect.fn("NodeDurableHost.make")(function* (startWorkers: boolean) {
+  const runtime = yield* DurableAgentRuntime;
+  const config = yield* NodeDurableAgentRuntimeConfig;
+
+  // Startup gate (deployment §5, plan §host): configuration decoding and storage compatibility
+  // already gated this Layer's dependencies; the last gate before admission opens is recovering
+  // EVERY nonterminal Submission. Work needing a live Agent Binding is reported `deferred` and
+  // stays a visible obligation for `runWorkers`; lanes durably blocked on an Unknown Outcome are
+  // reported `unknown` and wait for the authorized `resolveUnknown` path (DUR-017) — they consume
+  // no worker permit while the settlement obligation stays owed.
+  const startupRecovery = yield* runtime.runRecovery;
+
+  const admission = yield* Ref.make(true);
+
+  const requireAdmission: Effect.Effect<void, AdmissionClosed> = Ref.get(admission).pipe(
+    Effect.flatMap((open) =>
+      open
+        ? Effect.void
+        : Effect.fail(
+            AdmissionClosed.make({ message: "The host is shutting down; admission is closed." }),
+          ),
+    ),
+  );
+
+  const submit = <InputSchema extends Schema.Top>(
+    agent: DurableSubmitAgent<InputSchema>,
+    input: InputSchema["Type"],
+    options: DurableSubmitOptions,
+  ): Effect.Effect<
+    Receipt,
+    AdmissionClosed | DurableSubmitFailure,
+    InputSchema["EncodingServices"]
+  > => requireAdmission.pipe(Effect.andThen(runtime.submit(agent, input, options)));
+
+  const deliveryServices = yield* Effect.context<MessageDeliveryStore>();
+
+  const deliveryContext = yield* Layer.build(
+    MessageDeliveryDriver.layer({
+      batchSize: 100,
+      concurrency: Math.min(config.workerConcurrency, 32),
+    }).pipe(
+      Layer.provide(NodeCrypto.layer),
+      Layer.provide(
+        Layer.effect(PreparedInputAdmission, makeNodePreparedInputAdmission).pipe(
+          Layer.provide(
+            Layer.succeed(NodeAdmission, { submit, submissionStatus: runtime.submissionStatus }),
+          ),
+        ),
+      ),
+    ),
+  );
+
+  const runDeliveries = runNodeMessageDeliveries(config.wakeScanInterval).pipe(
+    Effect.provide(Context.merge(deliveryServices, deliveryContext)),
+  );
+
+  const runWorkers = <A, E, R>(worker: Effect.Effect<A, E, R>): Effect.Effect<void, E, R> =>
+    Effect.scoped(
+      // Either side exiting stops and joins the other; delivery interruption cannot leave
+      // an apparently healthy worker pool running without message recovery.
+      Effect.raceFirst(
+        Effect.forEach(
+          Array.from({ length: config.workerConcurrency }, (_, index) => index),
+          () => worker,
+          { concurrency: "unbounded", discard: true },
+        ),
+        runDeliveries,
+      ),
+    );
+
+  // S2 multi-binding pool: every claimed head resolves its exact registered Binding through
+  // the host's exact registrations, so one bounded
+  // pool serves parent and child lanes — the spec §12 smallest-pool suspension/wakeup proof
+  // runs `workerConcurrency: 1` over exactly this loop.
+  const runResolvedWorkers = runWorkers(runtime.runResolvedWorker);
+
+  const run = startWorkers
+    ? Fiber.join(
+        yield* runResolvedWorkers.pipe(
+          Effect.onExit(() => Ref.set(admission, false)),
+          Effect.forkScoped,
+        ),
+      )
+    : runResolvedWorkers;
+
+  // Register after the worker fiber: close admission, interrupt/join workers, drain
+  // runtime ownership, then close storage and captured application services.
+  yield* Effect.addFinalizer(() => Ref.set(admission, false));
+
+  return NodeDurableHost.of({
+    startupRecovery,
+    admissionOpen: Ref.get(admission),
+    submit,
+    awaitSettlement: runtime.awaitSettlement,
+    submissionStatus: runtime.submissionStatus,
+    observe: runtime.observe,
+    abort: runtime.abort,
+    explain: runtime.explain,
+    explainThread: runtime.explainThread,
+    verify: runtime.verify,
+    retry: runtime.retry,
+    wake: runtime.wake,
+    scanObligations: runtime.scanObligations,
+    runWorkers,
+    run,
+    runResolvedWorkers: run,
+  });
+});
+
+/**
+ * Operational host service. Prefer the module's `layer` and `run` for managed workers.
+ * The static constructors on this class retain explicit, manual worker ownership.
+ *
+ * Startup gates run during Layer construction, so the service existing implies readiness:
+ * configuration was schema-decoded, the SQLite file passed the exact-version compatibility check,
+ * and every nonterminal Submission went through one full recovery pass BEFORE admission opened.
+ * `startupRecovery` is the auditable evidence of that reconciliation pass.
+ *
+ * Shutdown runs in reverse Layer order when the owning Scope closes: `submit` starts refusing
+ * with `AdmissionClosed` first, then the runtime Layer's ownership drain releases every claim
+ * still held so another host can take over the lanes immediately, then the SQLite resources
+ * close. Forced termination at any point stays safe — the durability protocol, not graceful
+ * shutdown, provides correctness (DEPLOY-006).
+ */
+export class NodeDurableHost extends Context.Service<
+  NodeDurableHost,
+  {
+    /**
+     * The recovery decisions executed (or deferred) by this host's startup reconciliation.
+     * Reports with the `unknown` disposition identify lanes blocked on Unknown Outcomes that
+     * only the authorized DUR-017 resolution path can release.
+     */
+    readonly startupRecovery: ReadonlyArray<RecoveryReport>;
+    /** Admission-role readiness (deployment §7): true until shutdown begins. */
+    readonly admissionOpen: Effect.Effect<boolean>;
+    /** Observe the managed worker pool, preserving its failure. Manual hosts start their pool here. */
+    readonly run: Effect.Effect<void, DurableWorkerFailure | DurableBindingFailure>;
+    /** `DurableAgentRuntime.submit` behind the host admission gate. */
+    readonly submit: <InputSchema extends Schema.Top>(
+      agent: DurableSubmitAgent<InputSchema>,
+      input: InputSchema["Type"],
+      options: DurableSubmitOptions,
+    ) => Effect.Effect<
+      Receipt,
+      AdmissionClosed | DurableSubmitFailure,
+      InputSchema["EncodingServices"]
+    >;
+    readonly submissionStatus: DurableAgentRuntime["Service"]["submissionStatus"];
+    readonly awaitSettlement: (receipt: Receipt) => Effect.Effect<Settlement, DurableAwaitFailure>;
+    readonly observe: (
+      receipt: Receipt,
+      options?: DurableObserveOptions,
+    ) => Stream.Stream<
+      CanonicalRecordEnvelope,
+      ThreadStoreError | ThreadNotMaterialized | OperationDenied
+    >;
+    readonly abort: (command: AbortCommand) => Effect.Effect<AbortIntent, DurableAbortFailure>;
+    /** `DurableAgentRuntime.explain` — read-only recovery explanation of one Submission (P7). */
+    readonly explain: (
+      submissionId: SubmissionId,
+    ) => Effect.Effect<RecoveryExplanation, DurableExplainFailure>;
+    /** `DurableAgentRuntime.explainThread` — explain every nonterminal lane member. */
+    readonly explainThread: (
+      threadId: ThreadId,
+    ) => Effect.Effect<ReadonlyArray<RecoveryExplanation>, DurableExplainFailure>;
+    /** `DurableAgentRuntime.verify` — read-only integrity checks, never a repair (P7). */
+    readonly verify: (threadId: ThreadId) => Effect.Effect<IntegrityReport, DurableVerifyFailure>;
+    /** `DurableAgentRuntime.retry` — audited single-Submission re-drive with typed refusals. */
+    readonly retry: (command: RetryCommand) => Effect.Effect<RecoveryReport, DurableRetryFailure>;
+    /** `DurableAgentRuntime.wake` — the documented operator liveness nudge for one lane. */
+    readonly wake: (threadId: ThreadId) => Effect.Effect<void, OperationDenied>;
+    /** `DurableAgentRuntime.scanObligations` — the scan-based DUR-017/OPS-001 report. */
+    readonly scanObligations: (
+      thresholds: ObligationThresholds,
+    ) => Effect.Effect<ObligationReport, DurableObligationFailure>;
+    /**
+     * Run `workerConcurrency` copies of the given worker effect (typically
+     * `DurableAgentRuntime.runWorker(agent)`) until the caller's Scope interrupts them. The
+     * same Scope drives pending message admission and settlement observation independently
+     * of Submission liveness. The host never forks daemon fibers.
+     */
+    readonly runWorkers: <A, E, R>(worker: Effect.Effect<A, E, R>) => Effect.Effect<void, E, R>;
+    /**
+     * Run `workerConcurrency` copies of `DurableAgentRuntime.runResolvedWorker` over the host's
+     * registered Bindings (S2): every claimed head resolves its exact stored Binding before any
+     * code runs (SUB-023), so one bounded pool serves parent and attached-child lanes.
+     * Hosts built with the module-level `layer` instead join their existing pool.
+     */
+    readonly runResolvedWorkers: Effect.Effect<void, DurableWorkerFailure | DurableBindingFailure>;
+  }
+>()("@effect-agent/platform-node/NodeDurableHost") {
+  /**
+   * Compile typed registrations and acquire the complete host in one Layer Scope.
+   * Node supplies Crypto; model, tool, instruction, and schema services remain required.
+   * Startup recovery and shutdown gates are unchanged. Workers start only when the caller
+   * runs runResolvedWorkers; this constructor never starts a background worker.
+   */
+  static layerRegistered<
+    const Entries extends ReadonlyArray<AgentRegistration>,
+    ContextError = never,
+    ContextRequirements = never,
+    AuthorizationError = never,
+    AuthorizationRequirements = never,
+    ReconcilerError = never,
+    ReconcilerRequirements = never,
+  >(
+    registrations: Entries,
+    options: NodeDurableAgentRuntimeOptions<
+      ContextError,
+      ContextRequirements,
+      AuthorizationError,
+      AuthorizationRequirements,
+      ReconcilerError,
+      ReconcilerRequirements
+    >,
+  ) {
+    return NodeDurableHost.layer.pipe(
+      Layer.provideMerge(NodeDurableAgentRuntime.layerRegistered(registrations, options)),
+    );
+  }
+
+  /**
+   * Host gates over an assembled `NodeDurableAgentRuntime` stack. The runtime Layer owns
+   * executable registrations; omission registers no Agents, so resolved work fails closed.
+   */
+  static readonly layer: Layer.Layer<
+    NodeDurableHost,
+    DurableWorkerFailure | MessageDeliveryError,
+    DurableAgentRuntime | NodeDurableAgentRuntimeConfig | MessageDeliveryStore
+  > = Layer.effect(NodeDurableHost)(makeHost(false));
+
+  /** The complete DN host: `NodeDurableAgentRuntime.layer(options)` plus the host lifecycle gates. */
+  static layerStack<
+    ContextError = never,
+    ContextRequirements = never,
+    AuthorizationError = never,
+    AuthorizationRequirements = never,
+    ReconcilerError = never,
+    ReconcilerRequirements = never,
+  >(
+    options: NodeDurableAgentRuntimeOptions<
+      ContextError,
+      ContextRequirements,
+      AuthorizationError,
+      AuthorizationRequirements,
+      ReconcilerError,
+      ReconcilerRequirements
+    > & { readonly bindings?: ReadonlyArray<ResolvedBinding> },
+  ) {
+    const { bindings = [], ...runtimeOptions } = options;
+
+    return NodeDurableHost.layer.pipe(
+      Layer.provideMerge(NodeDurableAgentRuntime.layerWithBindings(bindings, runtimeOptions)),
+    );
+  }
+}
+
+/**
+ * Acquire a complete Node host and start one bounded, scoped worker pool after recovery.
+ * Provide model, tool, instruction, and schema dependencies to this Layer. Reusing the Layer
+ * shares the same pool. A worker failure closes admission; observe it with `run` at the process
+ * boundary so the application exits and releases the host instead of remaining idle.
+ */
+export const layer = <
+  const Entries extends ReadonlyArray<AgentRegistration>,
+  ContextError = never,
+  ContextRequirements = never,
+  AuthorizationError = never,
+  AuthorizationRequirements = never,
+  ReconcilerError = never,
+  ReconcilerRequirements = never,
+>(
+  registrations: Entries,
+  options: NodeDurableAgentRuntimeOptions<
+    ContextError,
+    ContextRequirements,
+    AuthorizationError,
+    AuthorizationRequirements,
+    ReconcilerError,
+    ReconcilerRequirements
+  >,
+) =>
+  Layer.effect(NodeDurableHost)(makeHost(true)).pipe(
+    Layer.provideMerge(NodeDurableAgentRuntime.layerRegistered(registrations, options)),
+  );
+
+/**
+ * Supervise the host's existing workers without starting another pool. Use with
+ * `Effect.provide(HostLive)` and `NodeRuntime.runMain`; race it with a server Effect when
+ * the same process also serves requests. Unlike `Layer.launch`, this observes worker failures.
+ */
+export const run = Effect.gen(function* () {
+  const host = yield* NodeDurableHost;
+
+  return yield* host.run;
+});

package/src/NodeScheduling.ts

@@ -0,0 +1,121 @@
+import {
+  type ScheduleAuthorizer,
+  type SchedulingLimits,
+  ScheduleStorageError,
+  ScheduleStore,
+  type ScheduleValidationError,
+  ScheduleWake,
+  defaultSchedulingLimits,
+} from "@effect-agent/thread/Schedule";
+import {
+  type ScheduleProcessFailure,
+  Scheduling,
+  ScheduleDriver,
+} from "@effect-agent/thread/Scheduling";
+import { NodeCrypto } from "@effect/platform-node";
+import { Cause, Duration, Effect, Layer, Option, PubSub, Result } from "effect";
+
+import type { NodeDurableHost } from "./NodeDurableHost.ts";
+import { nodeScheduledInputAdmissionLayer } from "./NodeSubscriptions.ts";
+
+/** One bounded hint slot for the single supported Node scheduler. Indexed polling repairs loss. */
+export const nodeScheduleWakeLayer: Layer.Layer<ScheduleWake> = Layer.effect(
+  ScheduleWake,
+  Effect.gen(function* () {
+    const hints = yield* PubSub.sliding<void>(1);
+    const subscription = yield* PubSub.subscribe(hints);
+
+    yield* Effect.addFinalizer(() => PubSub.shutdown(hints));
+
+    return ScheduleWake.of({
+      notify: PubSub.publish(hints, undefined).pipe(Effect.asVoid),
+      await: PubSub.take(subscription),
+    });
+  }),
+);
+
+const reportPassFailure = (cause: Cause.Cause<ScheduleProcessFailure>): Effect.Effect<boolean> =>
+  Cause.hasInterruptsOnly(cause)
+    ? Effect.interrupt
+    : Effect.logWarning("Node scheduling pass failed").pipe(
+        Effect.annotateLogs({
+          failureTag: Option.match(Cause.findErrorOption(cause), {
+            onNone: () => "Defect",
+            onSome: (error) => error._tag,
+          }),
+        }),
+        Effect.as(false),
+      );
+
+const nodeSchedulingDriverLayer = (
+  limits: SchedulingLimits,
+): Layer.Layer<never, never, ScheduleDriver | ScheduleStore | ScheduleWake> =>
+  Layer.effectDiscard(
+    Effect.gen(function* () {
+      const scheduling = yield* ScheduleDriver;
+      const store = yield* ScheduleStore;
+      const wake = yield* ScheduleWake;
+
+      const run = Effect.gen(function* () {
+        while (true) {
+          const passSucceeded = yield* scheduling.runDue().pipe(
+            Effect.map((pass) => pass.failed === 0),
+            Effect.catchCause(reportPassFailure),
+          );
+
+          const deadlineResult = passSucceeded
+            ? yield* store.nextDeadline().pipe(Effect.result)
+            : Result.fail(
+                ScheduleStorageError.make({ operation: "driver pass", reason: "unavailable" }),
+              );
+
+          if (Result.isFailure(deadlineResult) && passSucceeded) {
+            yield* Effect.logWarning("Node scheduling deadline query failed");
+          }
+          const nowMillis = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+
+          const deadlineDelay =
+            Result.isSuccess(deadlineResult) && deadlineResult.success !== null
+              ? Math.max(0, deadlineResult.success - nowMillis)
+              : limits.recoveryPollMillis;
+
+          const delay = Math.min(deadlineDelay, limits.recoveryPollMillis);
+
+          yield* Effect.raceFirst(wake.await, Effect.sleep(Duration.millis(delay)));
+        }
+      });
+
+      yield* Effect.forkScoped(run);
+    }),
+  );
+
+export interface NodeSchedulingOptions {
+  readonly limits?: SchedulingLimits | undefined;
+}
+
+/**
+ * Optional Scope-owned Node scheduling service and driver. The caller must provide the existing
+ * host, its SQLite ScheduleStore, and an explicit ScheduleAuthorizer.
+ */
+export class NodeScheduling {
+  static layer(
+    options: NodeSchedulingOptions = {},
+  ): Layer.Layer<
+    Scheduling,
+    ScheduleValidationError,
+    NodeDurableHost | ScheduleStore | ScheduleAuthorizer
+  > {
+    const limits = options.limits ?? defaultSchedulingLimits;
+
+    const schedulingWithDriver = nodeSchedulingDriverLayer(limits).pipe(
+      Layer.provide(ScheduleDriver.layer(limits)),
+      Layer.merge(Scheduling.layer(limits)),
+    );
+
+    return schedulingWithDriver.pipe(
+      Layer.provide(
+        Layer.mergeAll(nodeScheduledInputAdmissionLayer, nodeScheduleWakeLayer, NodeCrypto.layer),
+      ),
+    );
+  }
+}

package/src/NodeSubscriptions.ts

@@ -0,0 +1,162 @@
+import { type EventSources } from "@effect-agent/thread/EventSource";
+import { PreparedInputAdmission } from "@effect-agent/thread/PreparedInputAdmission";
+import { type ScheduledEnvelope, ScheduledInputAdmission } from "@effect-agent/thread/Schedule";
+import {
+  type PreparedInput,
+  type SubscriptionAuthorizer,
+  type SubscriptionError,
+  type SubscriptionLimits,
+  type SubscriptionStoreFailure,
+  SubscriptionStore,
+  defaultSubscriptionLimits,
+} from "@effect-agent/thread/Subscription";
+import { type SubscriptionInputBindings } from "@effect-agent/thread/SubscriptionInput";
+import {
+  SubscriptionDriver,
+  SubscriptionIntake,
+  Subscriptions,
+} from "@effect-agent/thread/Subscriptions";
+import { NodeCrypto } from "@effect/platform-node";
+import { Cause, Duration, Effect, Exit, Layer, Option } from "effect";
+
+import { makeNodePreparedInputAdmission, NodeAdmission } from "./internal/prepared-admission.ts";
+import { NodeDurableHost } from "./NodeDurableHost.ts";
+
+/** Ordinary prepared admission through the Scope-owned Node host gate. */
+export const nodePreparedInputAdmissionLayer: Layer.Layer<
+  PreparedInputAdmission,
+  never,
+  NodeDurableHost
+> = Layer.effect(PreparedInputAdmission, makeNodePreparedInputAdmission).pipe(
+  Layer.provide(Layer.effect(NodeAdmission, NodeDurableHost)),
+);
+
+const preparedFromSchedule = (envelope: ScheduledEnvelope): PreparedInput => ({
+  schemaVersion: 1,
+  threadId: envelope.threadId,
+  deliveryPrincipal: envelope.deliveryPrincipal,
+  ...(envelope.admissionGroup === undefined ? {} : { admissionGroup: envelope.admissionGroup }),
+  ...(envelope.admissionFence === undefined ? {} : { admissionFence: envelope.admissionFence }),
+  agentId: envelope.agentId,
+  definitions: envelope.definitions,
+  input: envelope.input,
+  inputDigest: envelope.inputDigest,
+  admissionKey: envelope.admissionKey,
+  authorization: envelope.authorization,
+});
+
+/** Compatibility adapter retaining the public scheduling admission port. */
+const nodeScheduledInputAdmissionFromPreparedLayer: Layer.Layer<
+  ScheduledInputAdmission,
+  never,
+  PreparedInputAdmission
+> = Layer.effect(
+  ScheduledInputAdmission,
+  Effect.map(PreparedInputAdmission, (admission) =>
+    ScheduledInputAdmission.of({
+      submit: (envelope) => admission.submit(preparedFromSchedule(envelope)),
+    }),
+  ),
+);
+
+export const nodeScheduledInputAdmissionLayer: Layer.Layer<
+  ScheduledInputAdmission,
+  never,
+  NodeDurableHost
+> = nodeScheduledInputAdmissionFromPreparedLayer.pipe(
+  Layer.provide(nodePreparedInputAdmissionLayer),
+);
+
+const reportPassFailure = (cause: Cause.Cause<SubscriptionStoreFailure>): Effect.Effect<boolean> =>
+  Cause.hasInterruptsOnly(cause)
+    ? Effect.interrupt
+    : Effect.logWarning("Node subscription pass failed").pipe(
+        Effect.annotateLogs({
+          failureTag: Option.match(Cause.findErrorOption(cause), {
+            onNone: () => "Defect",
+            onSome: (error) => error._tag,
+          }),
+        }),
+        Effect.as(false),
+      );
+
+const nodeSubscriptionDriverLayer = (
+  limits: SubscriptionLimits,
+): Layer.Layer<never, never, SubscriptionDriver | SubscriptionStore> =>
+  Layer.effectDiscard(
+    Effect.gen(function* () {
+      const driver = yield* SubscriptionDriver;
+      const store = yield* SubscriptionStore;
+
+      const run = Effect.gen(function* () {
+        while (true) {
+          const passSucceeded = yield* driver.runDue.pipe(
+            Effect.map((pass) => pass.failed === 0),
+            Effect.catchCause(reportPassFailure),
+          );
+
+          if (!passSucceeded) {
+            yield* Effect.sleep(Duration.millis(limits.retryMillis));
+            continue;
+          }
+
+          const deadline = yield* store.nextDeadline.pipe(Effect.exit);
+
+          if (Exit.isFailure(deadline)) {
+            yield* reportPassFailure(deadline.cause);
+            yield* Effect.sleep(Duration.millis(limits.retryMillis));
+            continue;
+          }
+
+          const nowMillis = yield* Effect.clockWith((clock) => clock.currentTimeMillis);
+
+          const delay =
+            deadline.value === null
+              ? limits.retryMillis
+              : Math.max(1, Math.min(deadline.value - nowMillis, limits.retryMillis));
+
+          yield* Effect.sleep(Duration.millis(delay));
+        }
+      });
+
+      yield* Effect.forkScoped(run);
+    }),
+  );
+
+export interface NodeSubscriptionsOptions {
+  readonly limits?: SubscriptionLimits | undefined;
+}
+
+/**
+ * One Scope-owned subscription partition in the sole process owning its SQLite database.
+ * Indexed polling repairs restart and lost wake state; closing the Scope interrupts the driver.
+ */
+export class NodeSubscriptions {
+  static layer(
+    options: NodeSubscriptionsOptions = {},
+  ): Layer.Layer<
+    Subscriptions | SubscriptionIntake,
+    SubscriptionError,
+    | NodeDurableHost
+    | SubscriptionStore
+    | SubscriptionAuthorizer
+    | EventSources
+    | SubscriptionInputBindings
+  > {
+    const limits = options.limits ?? defaultSubscriptionLimits;
+
+    const publicServices = Layer.merge(
+      Subscriptions.layer(limits),
+      SubscriptionIntake.layer(limits),
+    );
+
+    const driver = nodeSubscriptionDriverLayer(limits).pipe(
+      Layer.provide(SubscriptionDriver.layer(limits)),
+    );
+
+    return Layer.merge(publicServices, driver).pipe(
+      Layer.provide(nodePreparedInputAdmissionLayer),
+      Layer.provide(NodeCrypto.layer),
+    );
+  }
+}