@effect-agent/storage-cloudflare 0.1.0-beta.39 → 0.1.0-beta.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@effect-agent/storage-cloudflare",
-  "version": "0.1.0-beta.39",
+  "version": "0.1.0-beta.41",
   "exports": {
     ".": {
       "types": "./dist/index.d.mts",
@@ -12,7 +12,8 @@
     }
   },
   "dependencies": {
-    "@effect-agent/thread": "0.1.0-beta.39",
+    "@effect-agent/core": "0.1.0-beta.41",
+    "@effect-agent/thread": "0.1.0-beta.41",
     "@effect/platform-browser": "4.0.0-rc.111",
     "@effect/sql-sqlite-do": "4.0.0-rc.111"
   },
@@ -41,11 +42,11 @@
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "0.21.3",
     "@cloudflare/workers-types": "5.20260825.1",
-    "@effect-agent/testing": "0.1.0-beta.38",
+    "@effect-agent/testing": "0.1.0-beta.40",
     "@effect/vitest": "4.0.0-rc.111",
     "effect": "4.0.0-rc.111",
     "typescript": "7.0.2",
-    "vite-plus": "0.2.6",
-    "vitest": "4.1.10"
+    "vite-plus": "0.3.0",
+    "vitest": "4.1.11"
   }
 }

package/src/do-memory-store.ts

@@ -0,0 +1,51 @@
+import { MemoryStorageError, MemoryMutationFailpoint } from "@effect-agent/core";
+import { memoryStoreLayerWithFailpoints, SqlMemoryLimits } from "@effect-agent/thread/sql-memory";
+import { SqliteClient } from "@effect/sql-sqlite-do";
+import { Effect, Layer, Schema } from "effect";
+
+export class DoMemoryStorageLimits extends Schema.Class<DoMemoryStorageLimits>(
+  "@effect-agent/storage-cloudflare/DoMemoryStorageLimits",
+)({
+  maxRowBytes: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1_900_000 })),
+  maxStorageBytes: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 536_870_912 })),
+  maxDocuments: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 100_000 })),
+  maxReceipts: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1_000_000 })),
+}) {}
+
+export const defaultDoMemoryStorageLimits = DoMemoryStorageLimits.make({
+  maxRowBytes: 1_900_000,
+  maxStorageBytes: 536_870_912,
+  maxDocuments: 10_000,
+  maxReceipts: 100_000,
+});
+
+/**
+ * Local memory only, without Thread tables. Keep one SQL client per owner and pass the
+ * full storage handle: sql-only handles cannot provide atomic receipts and revisions.
+ * Byte limits conservatively count encoded rows, not SQLite page/index overhead.
+ */
+export const doMemoryStoreLayerWithFailpoints = (
+  storage: NonNullable<SqliteClient.SqliteClientConfig["storage"]>,
+  limits: DoMemoryStorageLimits = defaultDoMemoryStorageLimits,
+) =>
+  Layer.unwrap(
+    Schema.decodeUnknownEffect(DoMemoryStorageLimits)(limits).pipe(
+      Effect.mapError(() =>
+        MemoryStorageError.make({ operation: "memory storage limits", reason: "invalid-input" }),
+      ),
+      Effect.map((validated) =>
+        memoryStoreLayerWithFailpoints.pipe(
+          Layer.provide(Layer.succeed(SqlMemoryLimits, validated)),
+          Layer.provide(SqliteClient.layer({ storage })),
+        ),
+      ),
+    ),
+  );
+
+export const doMemoryStoreLayer = (
+  storage: NonNullable<SqliteClient.SqliteClientConfig["storage"]>,
+  limits: DoMemoryStorageLimits = defaultDoMemoryStorageLimits,
+) =>
+  doMemoryStoreLayerWithFailpoints(storage, limits).pipe(
+    Layer.provide(MemoryMutationFailpoint.layer),
+  );

package/src/index.ts

@@ -32,3 +32,5 @@ export * from "./do-storage-config.ts";
 export * from "./do-storage-failpoint.ts";
 export * from "./port-protocol.ts";
 export * from "./routing.ts";
+export * from "./do-memory-store.ts";
+export * from "./memory-protocol.ts";

package/src/memory-protocol.ts

@@ -0,0 +1,262 @@
+import type { MemoryReader } from "@effect-agent/core";
+import {
+  MemoryAccess,
+  MemoryConflict,
+  MemoryDocument,
+  MemoryLookup,
+  MemoryMutationFailure,
+  MemoryNamespace,
+  MemoryOperationConflict,
+  MemoryRecallError,
+  MemoryRecallLimits,
+  MemoryStorageError,
+  MemoryWithdrawn,
+  MemoryWrite,
+  MemoryWriter,
+  revalidateMemoryLookup,
+  MemoryIndexSearch,
+  MemoryIndexError,
+  SemanticMemoryError,
+  SemanticMemoryProfile,
+  SemanticCandidateLimits,
+  SemanticCandidateResult,
+  revalidateSemanticMemoryCandidates,
+} from "@effect-agent/core";
+import { Principal } from "@effect-agent/thread";
+import { Clock, Context, Effect, Encoding, Schema } from "effect";
+
+export class MemoryRpcError extends Schema.TaggedError<MemoryRpcError>()("MemoryRpcError", {
+  reason: Schema.Literals(["denied", "protocol", "budget", "timeout", "unavailable"]),
+}) {}
+
+export class MemoryRpcLimits extends Schema.Class<MemoryRpcLimits>(
+  "@effect-agent/storage-cloudflare/MemoryRpcLimits",
+)({
+  maxRequestBytes: Schema.Int.check(Schema.isBetween({ minimum: 256, maximum: 4_194_304 })),
+  maxResponseBytes: Schema.Int.check(Schema.isBetween({ minimum: 256, maximum: 16_777_216 })),
+  maxSourceBytes: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 67_108_864 })),
+  maxSources: MemoryRecallLimits.fields.maxSources,
+  timeoutMillis: MemoryRecallLimits.fields.timeoutMillis,
+}) {}
+
+export const defaultMemoryRpcLimits = MemoryRpcLimits.make({
+  maxRequestBytes: 1_048_576,
+  maxResponseBytes: 4_194_304,
+  maxSourceBytes: 16_777_216,
+  maxSources: 16,
+  timeoutMillis: 10_000,
+});
+
+const RequestFields = {
+  version: Schema.Literal(1),
+  access: MemoryAccess.Wire,
+  /** Host-authenticated identity, never copied from model input. The owner still authorizes it. */
+  principal: Principal,
+  deadlineMillis: Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0)),
+};
+
+const RevalidateRequest = Schema.TaggedStruct("Revalidate", {
+  ...RequestFields,
+  lookup: MemoryLookup,
+  limits: MemoryRecallLimits,
+});
+const ChangeRequest = Schema.TaggedStruct("Change", { ...RequestFields, write: MemoryWrite.Wire });
+const SemanticRequest: Schema.TaggedStruct<
+  "RevalidateSemantic",
+  typeof RequestFields & {
+    readonly found: typeof MemoryIndexSearch.Wire;
+    readonly profile: typeof SemanticMemoryProfile;
+    readonly limits: typeof SemanticCandidateLimits;
+  }
+> = Schema.TaggedStruct("RevalidateSemantic", {
+  ...RequestFields,
+  found: MemoryIndexSearch.Wire,
+  profile: SemanticMemoryProfile,
+  limits: SemanticCandidateLimits,
+});
+export const MemoryOwnerRequest: Schema.Union<
+  [typeof RevalidateRequest, typeof ChangeRequest, typeof SemanticRequest]
+> = Schema.Union([RevalidateRequest, ChangeRequest, SemanticRequest]);
+export type MemoryOwnerRequest = typeof MemoryOwnerRequest.Type;
+
+export const MemoryOwnerFailure = Schema.Union([
+  MemoryRpcError,
+  MemoryStorageError,
+  MemoryRecallError,
+  MemoryConflict,
+  MemoryWithdrawn,
+  MemoryOperationConflict,
+  MemoryMutationFailure,
+  MemoryIndexError,
+  SemanticMemoryError,
+]);
+export type MemoryOwnerFailure = typeof MemoryOwnerFailure.Type;
+
+export const MemoryOwnerResponse = Schema.Union([
+  Schema.TaggedStruct("Lookup", { access: MemoryAccess.Wire, lookup: MemoryLookup }),
+  Schema.TaggedStruct("Changed", { access: MemoryAccess.Wire, document: MemoryDocument.Wire }),
+  Schema.TaggedStruct("Semantic", { access: MemoryAccess.Wire, result: SemanticCandidateResult }),
+  Schema.TaggedStruct("Failed", { failure: MemoryOwnerFailure }),
+]);
+export type MemoryOwnerResponse = typeof MemoryOwnerResponse.Type;
+
+/** Fail-closed application policy. Authorize the namespace, principal, scope, and full command. */
+export class MemoryOwnerAuthorizer extends Context.Service<
+  MemoryOwnerAuthorizer,
+  {
+    readonly authorize: (request: MemoryOwnerRequest) => Effect.Effect<void, MemoryRpcError>;
+  }
+>()("@effect-agent/storage-cloudflare/MemoryOwnerAuthorizer") {}
+
+/** Canonical namespace derived from this object's idFromName identity, never its request. */
+export class MemoryOwnerIdentity extends Context.Service<
+  MemoryOwnerIdentity,
+  {
+    readonly namespace: MemoryNamespace.Any;
+  }
+>()("@effect-agent/storage-cloudflare/MemoryOwnerIdentity") {}
+
+export const memoryWireBytes = (text: string): number => Encoding.encodeHex(text).length / 2;
+
+export const decodeMemoryWire = Effect.fn("decodeMemoryWire")(function* <A, I>(
+  schema: Schema.Codec<A, I, never>,
+  raw: unknown,
+  maxBytes: number,
+) {
+  const text = yield* Schema.decodeUnknownEffect(Schema.String)(raw).pipe(
+    Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })),
+  );
+  if (text.length > maxBytes || memoryWireBytes(text) > maxBytes)
+    return yield* MemoryRpcError.make({ reason: "budget" });
+  return yield* Schema.decodeEffect(Schema.fromJsonString(schema))(text).pipe(
+    Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })),
+  );
+});
+
+export const encodeMemoryWire = Effect.fn("encodeMemoryWire")(function* <A, I>(
+  schema: Schema.Codec<A, I, never, never>,
+  value: A,
+  maxBytes: number,
+) {
+  const encoded = yield* Schema.encodeEffect(Schema.fromJsonString(schema))(value).pipe(
+    Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })),
+  );
+  if (encoded.length > maxBytes || memoryWireBytes(encoded) > maxBytes)
+    return yield* MemoryRpcError.make({ reason: "budget" });
+  return encoded;
+});
+
+/** One local read per distinct candidate source, with no per-document network calls. */
+export const handleMemoryOwnerRequest = Effect.fn("MemoryOwner.handleRequest")(function* (
+  raw: unknown,
+  limits: MemoryRpcLimits = defaultMemoryRpcLimits,
+): Effect.fn.Return<
+  string,
+  never,
+  MemoryOwnerIdentity | MemoryOwnerAuthorizer | MemoryReader | MemoryWriter
+> {
+  const result = yield* Effect.gen(function* (): Effect.fn.Return<
+    MemoryOwnerResponse,
+    MemoryOwnerFailure,
+    MemoryOwnerIdentity | MemoryOwnerAuthorizer | MemoryReader | MemoryWriter
+  > {
+    limits = yield* Schema.decodeUnknownEffect(MemoryRpcLimits)(limits).pipe(
+      Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })),
+    );
+    const request = yield* decodeMemoryWire(MemoryOwnerRequest, raw, limits.maxRequestBytes);
+    const { namespace } = yield* MemoryOwnerIdentity;
+    if (
+      !MemoryNamespace.equals(namespace, request.access.namespace) ||
+      (request._tag === "Change" &&
+        !MemoryNamespace.equals(namespace, request.write.key.namespace)) ||
+      (request._tag === "RevalidateSemantic" &&
+        request.found.candidates.some(
+          (candidate) => !MemoryNamespace.equals(namespace, candidate.key.namespace),
+        ))
+    )
+      return yield* MemoryRpcError.make({ reason: "denied" });
+    const remaining = Math.min(
+      limits.timeoutMillis,
+      request.deadlineMillis - (yield* Clock.currentTimeMillis),
+    );
+    if (remaining <= 0) return yield* MemoryRpcError.make({ reason: "timeout" });
+    return yield* Effect.gen(function* (): Effect.fn.Return<
+      MemoryOwnerResponse,
+      MemoryOwnerFailure,
+      MemoryOwnerAuthorizer | MemoryReader | MemoryWriter
+    > {
+      const authorizer = yield* MemoryOwnerAuthorizer;
+      yield* authorizer.authorize(request);
+      if (request._tag === "Change") {
+        const writer = yield* MemoryWriter;
+        return {
+          _tag: "Changed",
+          access: request.access,
+          document: yield* writer.change(request.write),
+        };
+      }
+      if (request._tag === "RevalidateSemantic") {
+        if (
+          new Set(request.found.candidates.map((candidate) => candidate.key.id)).size >
+          limits.maxSources
+        )
+          return yield* MemoryRpcError.make({ reason: "budget" });
+        const result = yield* revalidateSemanticMemoryCandidates(
+          request.found,
+          request.access,
+          request.profile,
+          {
+            ...request.limits,
+            maxSourceBytes: Math.min(
+              limits.maxSourceBytes,
+              request.limits.maxSourceBytes ?? 16_777_216,
+            ),
+            maxOutputBytes: Math.min(
+              limits.maxResponseBytes,
+              request.limits.maxOutputBytes ?? 16_777_216,
+            ),
+          },
+        );
+        return { _tag: "Semantic", access: request.access, result };
+      }
+      const count =
+        request.lookup._tag === "Found"
+          ? new Set(request.lookup.passages.map((passage) => passage.source.id)).size
+          : 0;
+      if (count > Math.min(limits.maxSources, request.limits.maxSources))
+        return yield* MemoryRpcError.make({ reason: "budget" });
+      const lookup = yield* revalidateMemoryLookup(request.lookup, request.access, {
+        maxSourceBytes: limits.maxSourceBytes,
+        maxInputBytes: Math.min(limits.maxSourceBytes, request.limits.maxInputBytes ?? 16_777_216),
+      });
+      return { _tag: "Lookup", access: request.access, lookup };
+    }).pipe(
+      Effect.scoped,
+      Effect.timeoutOrElse({
+        duration: remaining,
+        orElse: () => Effect.fail(MemoryRpcError.make({ reason: "timeout" })),
+      }),
+    );
+  }).pipe(
+    Effect.flatMap((response) =>
+      encodeMemoryWire(MemoryOwnerResponse, response, limits.maxResponseBytes),
+    ),
+    Effect.result,
+  );
+  if (result._tag === "Success") return result.success;
+  return yield* encodeMemoryWire(
+    MemoryOwnerResponse,
+    {
+      _tag: "Failed",
+      failure: result.failure,
+    },
+    limits.maxResponseBytes,
+  ).pipe(
+    Effect.catch(() =>
+      Schema.encodeEffect(Schema.fromJsonString(MemoryOwnerResponse))({
+        _tag: "Failed",
+        failure: MemoryRpcError.make({ reason: "budget" }),
+      }).pipe(Effect.orDie),
+    ),
+  );
+});

package/src/migrations.ts

@@ -2,19 +2,12 @@ import { SqliteMigrator } from "@effect/sql-sqlite-do";
 import { Effect } from "effect";
 import * as SqlClient from "effect/unstable/sql/SqlClient";
 
-/**
- * The exact-or-fresh storage version recorded in `effect_agent_meta`. Cloudflare is a fresh
- * platform, so there is exactly ONE migration carrying the complete current schema — no
- * v1→v4 history to replay (deployment spec §9: no rolling data-version promise during
- * private development).
- */
+/** The current storage version recorded in `effect_agent_meta`. */
 export const CurrentDoStorageVersion = 2;
 
 /**
- * The Thread Durable Object schema. Table names and columns mirror the Node/SQLite v4
- * schema byte-for-byte (`packages/storage-sqlite/src/migrations.ts`, migrations 1–4 collapsed
- * into their final shape) so the shared conformance suites and crash-matrix rows address
- * identical durable state. Two DC-specific additions:
+ * The Thread Durable Object schema shares its thread and ledger tables with Node/SQLite.
+ * Schedules and subscriptions use separate Durable Objects. Two DC-specific additions:
  *
  * 1. `effect_agent_meta` replaces `PRAGMA user_version` as the exact-or-fresh version gate —
  *    a meta table is portable regardless of which PRAGMAs Durable Object SQL storage allows.