@effect-agent/storage-cloudflare 0.1.0-beta.39 → 0.1.0-beta.41

package/dist/index.mjs

@@ -1,10 +1,12 @@
 import { t as DoStorageFailpoint } from "./do-storage-failpoint-C-Qtchs7.mjs";
-import { AbortCommand, AbortIntent, AcceptedEvent, AdmissionAdmitted, AdmissionConflict, AdmissionIndeterminate, AdmissionNotAdmitted, AdmissionRequest, AdmissionResolution, AdmissionResult, AppendConflict, AppendResult, ApprovalConflict, ApprovalDecision, ApprovalDecisionCommand, ApprovalDecisionIntent, AttachChildToReservationRequest, BeginChildBudgetReleaseRequest, CanonicalBatch, CanonicalRecord, CanonicalRecordEnvelope, CanonicalSequence, CheckpointRejected, ChildAttachmentSnapshot, ChildBudgetReservationRequest, ChildBudgetReservationSnapshot, ChildReservationConflict, ChildReservationStatus, ChildSettledNotification, ChildSettledOutcome, Claim, ClaimJoiningRequest, ClaimRequest, DEFAULT_OWNERSHIP_LEASE_DURATION, DefinitionDigests, DeliveryChange, Digest, EMPTY_TAIL_DIGEST, FenceRejected, FencedAppendRequest, InputAppliedMarker, JoinSnapshot, JoinedToHost, JoiningClaim, LedgerCapabilities, LedgerError, LoadCheckpointRequest, MarkInputAppliedRequest, MarkJoinedRequest, MarkReadyRequest, MarkUnknownRequest, ObservationOffset, OwnershipLost, OwnershipRenewal, OwnershipSnapshot, ParentLinkage, PersistedJson, ProducerEpoch, QueueSequence, RecordEnvelope, RecoverySnapshot, RecoverySnapshotRequest, ReleaseChildBudgetRequest, ReleaseOwnershipRequest, RenewOwnershipRequest, ReservedChildBudget, ReservedSettlement, RevertJoiningRequest, SaveCheckpointRequest, ScheduleCapacityError, ScheduleChange, ScheduleConflict, ScheduleDueCursor, ScheduleFailpoint, ScheduleId, ScheduleInstant, ScheduleKey, ScheduleNotFound, ScheduleOwner, SchedulePageRequest, ScheduleRecord, ScheduleStorageError, ScheduleStore, Settlement, SettlementConflict, SettlementFinalization, SettlementOutcome, SettlementReservation, SettlementReservationSnapshot, SourcePartition, SubmissionLedger, SubmissionLookup, SubmissionLookupById, SubmissionLookupByKey, SubmissionSnapshot, SubmissionState, SubscriptionDelivery, SubscriptionDeliveryKey, SubscriptionError, SubscriptionFailpoint, SubscriptionKey, SubscriptionLimits, SubscriptionName, SubscriptionRecord, SubscriptionScanCursors, SubscriptionStore, SuspendRequest, SuspensionReason, SuspensionSnapshot, ThreadCheckpoint, ThreadExport, ThreadExportRequest, ThreadMaterialization, ThreadNotMaterialized, ThreadObservation, ThreadRead, ThreadStore, ThreadStoreError, ThreadTail, ThreadTailRequest, UnknownResolution, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, applyScheduleChange, applySubscriptionDeliveryChange, defaultSchedulingLimits, digestCanonicalBatch, sameAcceptedEventIdentity, sameSourcePartition, scheduleDeadline, scheduleUsesCapacity, settlementFailureFromRecord, submissionAbortRecordId, subscriptionCanSelect, subscriptionDeliveryCanSelect, subscriptionDeliveryKeyString } from "@effect-agent/thread";
-import { Clock, Context, Crypto, DateTime, Duration, Effect, Layer, Option, Predicate, Ref, Result, Schema, Stream } from "effect";
+import { AbortCommand, AbortIntent, AcceptedEvent, AdmissionAdmitted, AdmissionConflict, AdmissionIndeterminate, AdmissionNotAdmitted, AdmissionRequest, AdmissionResolution, AdmissionResult, AppendConflict, AppendResult, ApprovalConflict, ApprovalDecision, ApprovalDecisionCommand, ApprovalDecisionIntent, AttachChildToReservationRequest, BeginChildBudgetReleaseRequest, CanonicalBatch, CanonicalRecord, CanonicalRecordEnvelope, CanonicalSequence, CheckpointRejected, ChildAttachmentSnapshot, ChildBudgetReservationRequest, ChildBudgetReservationSnapshot, ChildReservationConflict, ChildReservationStatus, ChildSettledNotification, ChildSettledOutcome, Claim, ClaimJoiningRequest, ClaimRequest, DEFAULT_OWNERSHIP_LEASE_DURATION, DefinitionDigests, DeliveryChange, Digest, EMPTY_TAIL_DIGEST, FenceRejected, FencedAppendRequest, InputAppliedMarker, JoinSnapshot, JoinedToHost, JoiningClaim, LedgerCapabilities, LedgerError, LoadCheckpointRequest, MarkInputAppliedRequest, MarkJoinedRequest, MarkReadyRequest, MarkUnknownRequest, ObservationOffset, OwnershipLost, OwnershipRenewal, OwnershipSnapshot, ParentLinkage, PersistedJson, Principal, ProducerEpoch, QueueSequence, RecordEnvelope, RecoverySnapshot, RecoverySnapshotRequest, ReleaseChildBudgetRequest, ReleaseOwnershipRequest, RenewOwnershipRequest, ReservedChildBudget, ReservedSettlement, RevertJoiningRequest, SaveCheckpointRequest, ScheduleCapacityError, ScheduleChange, ScheduleConflict, ScheduleDueCursor, ScheduleFailpoint, ScheduleId, ScheduleInstant, ScheduleKey, ScheduleNotFound, ScheduleOwner, SchedulePageRequest, ScheduleRecord, ScheduleStorageError, ScheduleStore, Settlement, SettlementConflict, SettlementFinalization, SettlementOutcome, SettlementReservation, SettlementReservationSnapshot, SourcePartition, SubmissionLedger, SubmissionLookup, SubmissionLookupById, SubmissionLookupByKey, SubmissionSnapshot, SubmissionState, SubscriptionDelivery, SubscriptionDeliveryKey, SubscriptionError, SubscriptionFailpoint, SubscriptionKey, SubscriptionLimits, SubscriptionName, SubscriptionRecord, SubscriptionScanCursors, SubscriptionStore, SuspendRequest, SuspensionReason, SuspensionSnapshot, ThreadCheckpoint, ThreadExport, ThreadExportRequest, ThreadMaterialization, ThreadNotMaterialized, ThreadObservation, ThreadRead, ThreadStore, ThreadStoreError, ThreadTail, ThreadTailRequest, UnknownResolution, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, applyScheduleChange, applySubscriptionDeliveryChange, defaultSchedulingLimits, digestCanonicalBatch, sameAcceptedEventIdentity, sameSourcePartition, scheduleDeadline, scheduleUsesCapacity, settlementFailureFromRecord, submissionAbortRecordId, subscriptionCanSelect, subscriptionDeliveryCanSelect, subscriptionDeliveryKeyString } from "@effect-agent/thread";
+import { Clock, Context, Crypto, DateTime, Duration, Effect, Encoding, Layer, Option, Predicate, Ref, Result, Schema, Stream } from "effect";
 import { SqliteClient, SqliteMigrator } from "@effect/sql-sqlite-do";
 import * as SqlClient from "effect/unstable/sql/SqlClient";
 import { BrowserCrypto } from "@effect/platform-browser";
 import { SqlError } from "effect/unstable/sql/SqlError";
+import { MemoryAccess, MemoryConflict, MemoryDocument, MemoryIndexError, MemoryIndexSearch, MemoryLookup, MemoryMutationFailpoint, MemoryMutationFailure, MemoryNamespace, MemoryOperationConflict, MemoryRecallError, MemoryRecallLimits, MemoryStorageError, MemoryWithdrawn, MemoryWrite, MemoryWriter, SemanticCandidateLimits, SemanticCandidateResult, SemanticMemoryError, SemanticMemoryProfile, revalidateMemoryLookup, revalidateSemanticMemoryCandidates } from "@effect-agent/core";
+import { SqlMemoryLimits, memoryStoreLayerWithFailpoints } from "@effect-agent/thread/sql-memory";
 //#region src/errors.ts
 /** The Durable Object's SQLite storage uses a private-development format this adapter cannot read. */
 var DoStorageCompatibilityError = class extends Schema.TaggedError()("DoStorageCompatibilityError", {
@@ -146,18 +148,11 @@ var DoStorageFailpointError = class extends Schema.TaggedError()("DoStorageFailp
 };
 //#endregion
 //#region src/migrations.ts
-/**
-* The exact-or-fresh storage version recorded in `effect_agent_meta`. Cloudflare is a fresh
-* platform, so there is exactly ONE migration carrying the complete current schema — no
-* v1→v4 history to replay (deployment spec §9: no rolling data-version promise during
-* private development).
-*/
+/** The current storage version recorded in `effect_agent_meta`. */
 const CurrentDoStorageVersion = 2;
 /**
-* The Thread Durable Object schema. Table names and columns mirror the Node/SQLite v4
-* schema byte-for-byte (`packages/storage-sqlite/src/migrations.ts`, migrations 1–4 collapsed
-* into their final shape) so the shared conformance suites and crash-matrix rows address
-* identical durable state. Two DC-specific additions:
+* The Thread Durable Object schema shares its thread and ledger tables with Node/SQLite.
+* Schedules and subscriptions use separate Durable Objects. Two DC-specific additions:
 *
 * 1. `effect_agent_meta` replaces `PRAGMA user_version` as the exact-or-fresh version gate —
 *    a meta table is portable regardless of which PRAGMAs Durable Object SQL storage allows.
@@ -393,8 +388,6 @@ const BoundedStoredText$1 = Schema.String.check(Schema.isMaxLength(2e6));
 const BoundedIdentifier$1 = Schema.NonEmptyString.check(Schema.isMaxLength(1024));
 const MAX_RECORDS_PER_THREAD = 65536;
 const MAX_IDENTIFIER_LENGTH$1 = 1024;
-/** Durable Object SQL storage allows at most 100 bound parameters per statement. */
-const MAX_BOUND_PARAMETERS = 100;
 const isSqlError = Schema.is(SqlError);
 const storedTextBytes = (value) => new TextEncoder().encode(value).byteLength;
 const chunked = (values, size) => {
@@ -730,7 +723,7 @@ const makeJournal = (sql, failpoint, maxStoredValueBytes) => {
 				message: `Thread record limit ${MAX_RECORDS_PER_THREAD} would be exceeded.`
 			});
 			const existingRecords = [];
-			for (const chunk of chunked(recordIds, MAX_BOUND_PARAMETERS - 10)) {
+			for (const chunk of chunked(recordIds, 90)) {
 				const existingRecordRows = yield* sql`
             SELECT
               thread_id,
@@ -1083,7 +1076,7 @@ var DoStorageConfigValue = class extends Schema.Class("@effect-agent/storage-clo
 var DoStorageConfig = class extends Context.Service()("@effect-agent/storage-cloudflare/DoStorageConfig") {};
 //#endregion
 //#region src/do-thread-store.ts
-const OffsetText = Schema.String.check(Schema.isMaxLength(4 * 1024));
+const OffsetText = Schema.String.check(Schema.isMaxLength(4096));
 const DO_OFFSET_PREFIX = "effect-agent-do@1:";
 const ZERO_CANONICAL_SEQUENCE = Schema.decodeSync(CanonicalSequence)(0);
 const isDigest = Schema.is(Digest);
@@ -2385,7 +2378,8 @@ const makeServices$1 = Effect.fn("DoSubmissionLedger.makeServices")(function* ()
 				submissionId: validated.submissionId,
 				existingOutcome: reservation.value.outcome
 			});
-			const settlementFailure = settlementFailureFromRecord(yield* decodeRecordEnvelopeText(reservation.value.record_json).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_settlement_reservations", validated.submissionId, error.message))));
+			const reservationRecord = yield* decodeRecordEnvelopeText(reservation.value.record_json).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_settlement_reservations", validated.submissionId, error.message)));
+			const settlementFailure = settlementFailureFromRecord(reservationRecord);
 			if (reservation.value.outcome === "failed" !== (settlementFailure !== void 0)) return yield* corruptionFailure(operation, "effect_agent_settlement_reservations", validated.submissionId, "The reserved outcome and canonical failure diagnostic disagree.");
 			const submission = yield* requireSubmission(operation, validated.submissionId);
 			if (submission.state === "settled") {
@@ -4042,7 +4036,8 @@ const makeSubscriptionStore = Effect.fn("SqliteSubscriptionStore.make")(function
 				return false;
 			}
 			yield* failpoint.hit("subscription:catch-up:before");
-			if (!subscriptionCanSelect(record, accepted, Math.max(nowMillis, yield* Clock.currentTimeMillis), true)) return yield* error("conflict", "catch-up-eligibility");
+			const effectiveNowMillis = Math.max(nowMillis, yield* Clock.currentTimeMillis);
+			if (!subscriptionCanSelect(record, accepted, effectiveNowMillis, true)) return yield* error("conflict", "catch-up-eligibility");
 			if ((yield* count(sql`SELECT COUNT(*) AS count FROM effect_agent_subscription_deliveries WHERE tenant_id=${partition.tenantId} AND source_address=${partition.address}`, "count deliveries")) >= limits.maxDeliveries) return yield* error("capacity", "deliveries");
 			if ((yield* count(sql`SELECT COUNT(*) AS count FROM effect_agent_subscription_deliveries WHERE tenant_id=${partition.tenantId} AND source_address=${partition.address} AND owner_id=${record.key.ownerId}`, "count owner deliveries")) >= limits.maxDeliveriesPerOwner) return yield* error("capacity", "owner-deliveries");
 			yield* insertDelivery(delivery);
@@ -4276,7 +4271,7 @@ const doSubscriptionStoreLayer = (partition) => Layer.effectContext(makeSubscrip
 const MAX_PORT_DIAGNOSTIC_LENGTH = 4096;
 const BoundedDiagnostic = Schema.String.check(Schema.isMaxLength(MAX_PORT_DIAGNOSTIC_LENGTH));
 /** Truncate a diagnostic string to the protocol's bounded diagnostic length. */
-const boundPortDiagnostic = (value) => value.length > 4096 ? `${value.slice(0, MAX_PORT_DIAGNOSTIC_LENGTH - 3)}...` : value;
+const boundPortDiagnostic = (value) => value.length > 4096 ? `${value.slice(0, 4093)}...` : value;
 /**
 * The envelope itself could not be honored: the receiving Object could not decode the
 * request, or a response could not be encoded/decoded. It never carries port semantics —
@@ -4484,7 +4479,8 @@ const crossThreadStoreError = (operation, target) => ThreadStoreError.make({
 });
 const makeTransportCall = (transport) => Effect.fn("DoPortRouting.transportCall")(function* (target, call) {
 	const encoded = yield* encodePortRequest(call).pipe(Effect.mapError((error) => PortProtocolError.make({ message: boundPortDiagnostic(`The port request could not be encoded: ${error.message}`) })));
-	return yield* decodePortResponse(yield* transport.call(target, encoded)).pipe(Effect.mapError((error) => PortProtocolError.make({ message: boundPortDiagnostic(`The port response could not be decoded: ${error.message}`) })));
+	const raw = yield* transport.call(target, encoded);
+	return yield* decodePortResponse(raw).pipe(Effect.mapError((error) => PortProtocolError.make({ message: boundPortDiagnostic(`The port response could not be decoded: ${error.message}`) })));
 });
 const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServices")(function* (options) {
 	const local = yield* SubmissionLedger;
@@ -4757,9 +4753,202 @@ const encodedProtocolFailure = (message) => ({
 * transport never has to interpret exceptions as protocol answers.
 */
 const handleEncodedPortRequest = Effect.fn("DoPortRouting.handleEncodedPortRequest")(function* (encoded) {
-	return yield* encodePortResponse(yield* decodePortRequest(encoded).pipe(Effect.flatMap(executePortRequest), Effect.catch((error) => Effect.succeed(PortFailed.make({ failure: PortProtocolError.make({ message: boundPortDiagnostic(`The port request could not be decoded: ${error.message}`) }) }))))).pipe(Effect.catch((error) => Effect.succeed(encodedProtocolFailure(`The port response could not be encoded: ${error.message}`))));
+	const response = yield* decodePortRequest(encoded).pipe(Effect.flatMap(executePortRequest), Effect.catch((error) => Effect.succeed(PortFailed.make({ failure: PortProtocolError.make({ message: boundPortDiagnostic(`The port request could not be decoded: ${error.message}`) }) }))));
+	return yield* encodePortResponse(response).pipe(Effect.catch((error) => Effect.succeed(encodedProtocolFailure(`The port response could not be encoded: ${error.message}`))));
+});
+//#endregion
+//#region src/do-memory-store.ts
+var DoMemoryStorageLimits = class extends Schema.Class("@effect-agent/storage-cloudflare/DoMemoryStorageLimits")({
+	maxRowBytes: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 19e5
+	})),
+	maxStorageBytes: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 536870912
+	})),
+	maxDocuments: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 1e5
+	})),
+	maxReceipts: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 1e6
+	}))
+}) {};
+const defaultDoMemoryStorageLimits = DoMemoryStorageLimits.make({
+	maxRowBytes: 19e5,
+	maxStorageBytes: 536870912,
+	maxDocuments: 1e4,
+	maxReceipts: 1e5
+});
+/**
+* Local memory only, without Thread tables. Keep one SQL client per owner and pass the
+* full storage handle: sql-only handles cannot provide atomic receipts and revisions.
+* Byte limits conservatively count encoded rows, not SQLite page/index overhead.
+*/
+const doMemoryStoreLayerWithFailpoints = (storage, limits = defaultDoMemoryStorageLimits) => Layer.unwrap(Schema.decodeUnknownEffect(DoMemoryStorageLimits)(limits).pipe(Effect.mapError(() => MemoryStorageError.make({
+	operation: "memory storage limits",
+	reason: "invalid-input"
+})), Effect.map((validated) => memoryStoreLayerWithFailpoints.pipe(Layer.provide(Layer.succeed(SqlMemoryLimits, validated)), Layer.provide(SqliteClient.layer({ storage }))))));
+const doMemoryStoreLayer = (storage, limits = defaultDoMemoryStorageLimits) => doMemoryStoreLayerWithFailpoints(storage, limits).pipe(Layer.provide(MemoryMutationFailpoint.layer));
+//#endregion
+//#region src/memory-protocol.ts
+var MemoryRpcError = class extends Schema.TaggedError()("MemoryRpcError", { reason: Schema.Literals([
+	"denied",
+	"protocol",
+	"budget",
+	"timeout",
+	"unavailable"
+]) }) {};
+var MemoryRpcLimits = class extends Schema.Class("@effect-agent/storage-cloudflare/MemoryRpcLimits")({
+	maxRequestBytes: Schema.Int.check(Schema.isBetween({
+		minimum: 256,
+		maximum: 4194304
+	})),
+	maxResponseBytes: Schema.Int.check(Schema.isBetween({
+		minimum: 256,
+		maximum: 16777216
+	})),
+	maxSourceBytes: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 67108864
+	})),
+	maxSources: MemoryRecallLimits.fields.maxSources,
+	timeoutMillis: MemoryRecallLimits.fields.timeoutMillis
+}) {};
+const defaultMemoryRpcLimits = MemoryRpcLimits.make({
+	maxRequestBytes: 1048576,
+	maxResponseBytes: 4194304,
+	maxSourceBytes: 16777216,
+	maxSources: 16,
+	timeoutMillis: 1e4
+});
+const RequestFields = {
+	version: Schema.Literal(1),
+	access: MemoryAccess.Wire,
+	/** Host-authenticated identity, never copied from model input. The owner still authorizes it. */
+	principal: Principal,
+	deadlineMillis: Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0))
+};
+const RevalidateRequest = Schema.TaggedStruct("Revalidate", {
+	...RequestFields,
+	lookup: MemoryLookup,
+	limits: MemoryRecallLimits
+});
+const ChangeRequest = Schema.TaggedStruct("Change", {
+	...RequestFields,
+	write: MemoryWrite.Wire
+});
+const SemanticRequest = Schema.TaggedStruct("RevalidateSemantic", {
+	...RequestFields,
+	found: MemoryIndexSearch.Wire,
+	profile: SemanticMemoryProfile,
+	limits: SemanticCandidateLimits
+});
+const MemoryOwnerRequest = Schema.Union([
+	RevalidateRequest,
+	ChangeRequest,
+	SemanticRequest
+]);
+const MemoryOwnerFailure = Schema.Union([
+	MemoryRpcError,
+	MemoryStorageError,
+	MemoryRecallError,
+	MemoryConflict,
+	MemoryWithdrawn,
+	MemoryOperationConflict,
+	MemoryMutationFailure,
+	MemoryIndexError,
+	SemanticMemoryError
+]);
+const MemoryOwnerResponse = Schema.Union([
+	Schema.TaggedStruct("Lookup", {
+		access: MemoryAccess.Wire,
+		lookup: MemoryLookup
+	}),
+	Schema.TaggedStruct("Changed", {
+		access: MemoryAccess.Wire,
+		document: MemoryDocument.Wire
+	}),
+	Schema.TaggedStruct("Semantic", {
+		access: MemoryAccess.Wire,
+		result: SemanticCandidateResult
+	}),
+	Schema.TaggedStruct("Failed", { failure: MemoryOwnerFailure })
+]);
+/** Fail-closed application policy. Authorize the namespace, principal, scope, and full command. */
+var MemoryOwnerAuthorizer = class extends Context.Service()("@effect-agent/storage-cloudflare/MemoryOwnerAuthorizer") {};
+/** Canonical namespace derived from this object's idFromName identity, never its request. */
+var MemoryOwnerIdentity = class extends Context.Service()("@effect-agent/storage-cloudflare/MemoryOwnerIdentity") {};
+const memoryWireBytes = (text) => Encoding.encodeHex(text).length / 2;
+const decodeMemoryWire = Effect.fn("decodeMemoryWire")(function* (schema, raw, maxBytes) {
+	const text = yield* Schema.decodeUnknownEffect(Schema.String)(raw).pipe(Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })));
+	if (text.length > maxBytes || memoryWireBytes(text) > maxBytes) return yield* MemoryRpcError.make({ reason: "budget" });
+	return yield* Schema.decodeEffect(Schema.fromJsonString(schema))(text).pipe(Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })));
+});
+const encodeMemoryWire = Effect.fn("encodeMemoryWire")(function* (schema, value, maxBytes) {
+	const encoded = yield* Schema.encodeEffect(Schema.fromJsonString(schema))(value).pipe(Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })));
+	if (encoded.length > maxBytes || memoryWireBytes(encoded) > maxBytes) return yield* MemoryRpcError.make({ reason: "budget" });
+	return encoded;
+});
+/** One local read per distinct candidate source, with no per-document network calls. */
+const handleMemoryOwnerRequest = Effect.fn("MemoryOwner.handleRequest")(function* (raw, limits = defaultMemoryRpcLimits) {
+	const result = yield* Effect.gen(function* () {
+		limits = yield* Schema.decodeUnknownEffect(MemoryRpcLimits)(limits).pipe(Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })));
+		const request = yield* decodeMemoryWire(MemoryOwnerRequest, raw, limits.maxRequestBytes);
+		const { namespace } = yield* MemoryOwnerIdentity;
+		if (!MemoryNamespace.equals(namespace, request.access.namespace) || request._tag === "Change" && !MemoryNamespace.equals(namespace, request.write.key.namespace) || request._tag === "RevalidateSemantic" && request.found.candidates.some((candidate) => !MemoryNamespace.equals(namespace, candidate.key.namespace))) return yield* MemoryRpcError.make({ reason: "denied" });
+		const remaining = Math.min(limits.timeoutMillis, request.deadlineMillis - (yield* Clock.currentTimeMillis));
+		if (remaining <= 0) return yield* MemoryRpcError.make({ reason: "timeout" });
+		return yield* Effect.gen(function* () {
+			yield* (yield* MemoryOwnerAuthorizer).authorize(request);
+			if (request._tag === "Change") {
+				const writer = yield* MemoryWriter;
+				return {
+					_tag: "Changed",
+					access: request.access,
+					document: yield* writer.change(request.write)
+				};
+			}
+			if (request._tag === "RevalidateSemantic") {
+				if (new Set(request.found.candidates.map((candidate) => candidate.key.id)).size > limits.maxSources) return yield* MemoryRpcError.make({ reason: "budget" });
+				const result = yield* revalidateSemanticMemoryCandidates(request.found, request.access, request.profile, {
+					...request.limits,
+					maxSourceBytes: Math.min(limits.maxSourceBytes, request.limits.maxSourceBytes ?? 16777216),
+					maxOutputBytes: Math.min(limits.maxResponseBytes, request.limits.maxOutputBytes ?? 16777216)
+				});
+				return {
+					_tag: "Semantic",
+					access: request.access,
+					result
+				};
+			}
+			if ((request.lookup._tag === "Found" ? new Set(request.lookup.passages.map((passage) => passage.source.id)).size : 0) > Math.min(limits.maxSources, request.limits.maxSources)) return yield* MemoryRpcError.make({ reason: "budget" });
+			const lookup = yield* revalidateMemoryLookup(request.lookup, request.access, {
+				maxSourceBytes: limits.maxSourceBytes,
+				maxInputBytes: Math.min(limits.maxSourceBytes, request.limits.maxInputBytes ?? 16777216)
+			});
+			return {
+				_tag: "Lookup",
+				access: request.access,
+				lookup
+			};
+		}).pipe(Effect.scoped, Effect.timeoutOrElse({
+			duration: remaining,
+			orElse: () => Effect.fail(MemoryRpcError.make({ reason: "timeout" }))
+		}));
+	}).pipe(Effect.flatMap((response) => encodeMemoryWire(MemoryOwnerResponse, response, limits.maxResponseBytes)), Effect.result);
+	if (result._tag === "Success") return result.success;
+	return yield* encodeMemoryWire(MemoryOwnerResponse, {
+		_tag: "Failed",
+		failure: result.failure
+	}, limits.maxResponseBytes).pipe(Effect.catch(() => Schema.encodeEffect(Schema.fromJsonString(MemoryOwnerResponse))({
+		_tag: "Failed",
+		failure: MemoryRpcError.make({ reason: "budget" })
+	}).pipe(Effect.orDie)));
 });
 //#endregion
-export { CurrentDoStorageVersion, DEFAULT_MAX_STORED_VALUE_BYTES, DoAppendConflict, DoCheckpointConflict, DoFenceRejected, DoLedgerError, DoScheduleAlarmControl, DoScheduleTransaction, DoStorageCompatibilityError, DoStorageConfig, DoStorageConfigValue, DoStorageCorruptionError, DoStorageError, DoStorageFailpoint, DoStorageFailpointError, DoStorageFailpointLocation, DoSubscriptionAlarmControl, DoSubscriptionTransaction, DoValueBoundExceeded, LedgerAdmitCall, LedgerAdmitResult, LedgerLookupCall, LedgerLookupResult, LedgerMarkReadyCall, LedgerMarkReadyResult, LedgerRecordChildSettledCall, LedgerRecordChildSettledResult, LedgerRequestAbortCall, LedgerRequestAbortResult, LedgerResolveAdmissionCall, LedgerResolveAdmissionResult, MAX_PORT_DIAGNOSTIC_LENGTH, PortFailed, PortFailure, PortProtocolError, PortRequest, PortResponse, PortResult, PortSucceeded, PortTransportError, StoreAppendCall, StoreAppendResult, StoreExportCall, StoreExportResult, StoreInspectTailCall, StoreInspectTailResult, StoreMaterializeCall, StoreMaterializeResult, StoreReadPageCall, StoreReadPageResult, ThreadPortTransport, boundPortDiagnostic, decodePortRequest, decodePortResponse, doSubscriptionStoreLayer, encodePortRequest, encodePortResponse, executePortRequest, handleEncodedPortRequest, layer, ledgerLayer, observationOffsetAt, portTransportFailure, routedSubmissionLedgerLayer, routedThreadStoreLayer, scheduleStoreLayer, storageConfigLayer, storageFailpointLayer, submissionLedgerLayer, threadStoreLayer };
+export { CurrentDoStorageVersion, DEFAULT_MAX_STORED_VALUE_BYTES, DoAppendConflict, DoCheckpointConflict, DoFenceRejected, DoLedgerError, DoMemoryStorageLimits, DoScheduleAlarmControl, DoScheduleTransaction, DoStorageCompatibilityError, DoStorageConfig, DoStorageConfigValue, DoStorageCorruptionError, DoStorageError, DoStorageFailpoint, DoStorageFailpointError, DoStorageFailpointLocation, DoSubscriptionAlarmControl, DoSubscriptionTransaction, DoValueBoundExceeded, LedgerAdmitCall, LedgerAdmitResult, LedgerLookupCall, LedgerLookupResult, LedgerMarkReadyCall, LedgerMarkReadyResult, LedgerRecordChildSettledCall, LedgerRecordChildSettledResult, LedgerRequestAbortCall, LedgerRequestAbortResult, LedgerResolveAdmissionCall, LedgerResolveAdmissionResult, MAX_PORT_DIAGNOSTIC_LENGTH, MemoryOwnerAuthorizer, MemoryOwnerFailure, MemoryOwnerIdentity, MemoryOwnerRequest, MemoryOwnerResponse, MemoryRpcError, MemoryRpcLimits, PortFailed, PortFailure, PortProtocolError, PortRequest, PortResponse, PortResult, PortSucceeded, PortTransportError, StoreAppendCall, StoreAppendResult, StoreExportCall, StoreExportResult, StoreInspectTailCall, StoreInspectTailResult, StoreMaterializeCall, StoreMaterializeResult, StoreReadPageCall, StoreReadPageResult, ThreadPortTransport, boundPortDiagnostic, decodeMemoryWire, decodePortRequest, decodePortResponse, defaultDoMemoryStorageLimits, defaultMemoryRpcLimits, doMemoryStoreLayer, doMemoryStoreLayerWithFailpoints, doSubscriptionStoreLayer, encodeMemoryWire, encodePortRequest, encodePortResponse, executePortRequest, handleEncodedPortRequest, handleMemoryOwnerRequest, layer, ledgerLayer, memoryWireBytes, observationOffsetAt, portTransportFailure, routedSubmissionLedgerLayer, routedThreadStoreLayer, scheduleStoreLayer, storageConfigLayer, storageFailpointLayer, submissionLedgerLayer, threadStoreLayer };
 
 //# sourceMappingURL=index.mjs.map