@fungi.computer/braid 0.0.0-stage → 0.0.1

package/dist/cloudflare/graph-program.js

@@ -0,0 +1,528 @@
+import * as S from "effect/Schema";
+import * as Effect from "effect/Effect";
+import { executeCode } from "../code-execution.js";
+import { NonRetryableError } from "cloudflare:workflows";
+import { decodeExecutionPlan, admitRunInput, parseProjection, methodInputValue, methodOutputValues, methodOutputPorts, accepts, evaluateMapping, evaluatePredicate, readPort, contentDigest, } from "../index.js";
+import { graphParamsSchema, nodeAdmissionResultSchema, reviewAnswerSchema, reviewAnswerOutput, dispatchResultSchema, } from "../execution.js";
+const resultLimit = 64 * 1024;
+/** Durable steps one engine instance may take (Cloudflare's limit, with headroom). */
+const INSTANCE_STEP_LIMIT = 1000;
+const reviewChoices = (node) => node.choices === undefined
+    ? {}
+    : { choices: node.choices.map((choice) => choice.id) };
+const exceedsResultLimit = (output) => new TextEncoder().encode(JSON.stringify(output)).length > resultLimit;
+// Ordering dependencies include optional expressions. Only required references
+// propagate branch skips. Coalesce skips only when all its alternatives are
+// inactive; exists and templates still observe absence.
+function mappingBranchAbsent(mapping, values, absent) {
+    if ("from" in mapping)
+        return absent(mapping.from);
+    if ("coalesce" in mapping)
+        return (mapping.coalesce.length > 0 &&
+            mapping.coalesce.every((part) => mappingBranchAbsent(part, values, absent)));
+    if ("object" in mapping)
+        return Object.values(mapping.object).some((part) => mappingBranchAbsent(part, values, absent));
+    if ("array" in mapping)
+        return mapping.array.some((part) => mappingBranchAbsent(part, values, absent));
+    if ("each" in mapping) {
+        if (mappingBranchAbsent(mapping.each.over, values, absent))
+            return true;
+        const over = evaluateMapping(mapping.each.over, values);
+        return (S.is(S.Array(S.Json))(over) &&
+            over.some((value, index) => mappingBranchAbsent(mapping.each.body, { ...values, $item: { value, index } }, (ref) => ref.node !== "$item" && absent(ref))));
+    }
+    return false;
+}
+function predicateBranchAbsent(test, values, absent) {
+    if (test.op === "exists")
+        return false;
+    if ("tests" in test)
+        return test.tests.some((part) => predicateBranchAbsent(part, values, absent));
+    if ("test" in test)
+        return predicateBranchAbsent(test.test, values, absent);
+    return (mappingBranchAbsent(test.left, values, absent) ||
+        mappingBranchAbsent(test.right, values, absent));
+}
+function nodeArguments(graph, node, values) {
+    const args = {};
+    for (const edge of graph.edges)
+        if (edge.to.node === node.id && edge.to.port !== "after") {
+            const value = readPort(values, edge.from);
+            if (value !== undefined)
+                args[edge.to.port] = value;
+        }
+    for (const [key, mapping] of Object.entries(node.values)) {
+        const value = evaluateMapping(mapping, values);
+        if (value !== undefined)
+            args[key] = value;
+    }
+    return args;
+}
+function requiredRefs(graph, node) {
+    const edges = graph.edges
+        .filter((edge) => edge.to.node === node.id)
+        .map((edge) => edge.from);
+    switch (node.kind) {
+        case "transform":
+        case "condition":
+            return edges;
+        case "review":
+            return [...edges, ...node.show];
+        case "map":
+            return [...edges, node.over];
+        case "repeat":
+            return [...edges, { node: "$input", port: "item" }];
+        case "app":
+        case "code":
+        case "wait":
+            return edges;
+    }
+}
+const childCompletionSchema = S.Union([
+    S.Struct({ output: S.JsonObject }),
+    S.Struct({ refusal: S.String }),
+]);
+/** Native WorkflowStep owns checkpoints, retries, sleeps and event waits. */
+export async function runGraphWorkflow(step, params, instanceId, workflows, dispatcher, codeExecution) {
+    const checked = S.decodeUnknownSync(graphParamsSchema)(params, {
+        onExcessProperty: "error",
+    });
+    if (checked.kind === "run" && checked.runId !== instanceId)
+        throw new NonRetryableError("run_identity_mismatch");
+    const stored = await dispatcher.loadRun(checked.teamId, checked.runId);
+    const plan = await decodeExecutionPlan(stored.plan);
+    if (checked.planDigest !== plan.planDigest)
+        throw new NonRetryableError("plan_identity_mismatch");
+    const graph = checked.kind === "run"
+        ? plan.definition
+        : plan.definition.subgraphs?.[checked.body];
+    if (!graph)
+        throw new NonRetryableError("unknown_subgraph");
+    const admitted = admitRunInput(graph, checked.kind === "run" ? stored.input : checked.input);
+    if (admitted.kind === "invalid")
+        throw new NonRetryableError("invalid_input");
+    const input = admitted.input;
+    const iteration = checked.kind === "run" ? "0" : checked.iteration;
+    const values = {};
+    values.$input = input;
+    const baseEvent = (node, state, attempt = 0, poll) => {
+        let event = {
+            runId: checked.runId,
+            nodeId: node.id,
+            iteration,
+            state,
+            attempt,
+        };
+        if (poll !== undefined)
+            event = { ...event, poll };
+        return checked.kind === "map-item"
+            ? { ...event, graphId: checked.body }
+            : event;
+    };
+    const complete = async (node, output, attempt = 0, costMilliunits = 0, durationMs = 0, poll) => {
+        const ports = { ...output, after: true };
+        if (exceedsResultLimit(ports))
+            return fail(node, "step_result_limit", undefined, poll);
+        await dispatcher.recordEvent({
+            ...baseEvent(node, "complete", attempt, poll),
+            costMilliunits,
+            durationMs,
+            outputDigest: await contentDigest(ports),
+            output,
+        });
+        return ports;
+    };
+    const fail = async (node, code, cause, poll) => {
+        await dispatcher.recordEvent({
+            ...baseEvent(node, "failed", 0, poll),
+            refusal: code,
+            errorMessage: code.replaceAll("_", " "),
+        });
+        const refusal = new NonRetryableError(code);
+        if (cause !== undefined)
+            refusal.cause = cause;
+        throw refusal;
+    };
+    const skipped = new Set();
+    // Steps the static estimate did not spend may go to polling pending calls.
+    const pollBudget = INSTANCE_STEP_LIMIT - plan.estimatedSteps;
+    let pollSteps = 0;
+    const branchAbsent = (ref) => {
+        const producer = graph.nodes.find((node) => node.id === ref.node);
+        const app = producer?.kind === "app" ? plan.definition.apps[producer.app] : undefined;
+        const method = producer?.kind === "app" && app
+            ? plan.catalog[app.appId]?.methods[producer.method]
+            : undefined;
+        const output = producer?.kind === "code" ? producer.output : method?.output;
+        const appOutlets = output
+            ? methodOutputPorts(parseProjection(output))
+            : undefined;
+        const completionBranch = output &&
+            (output.anyOf !== undefined || output.oneOf !== undefined) &&
+            appOutlets &&
+            Object.hasOwn(appOutlets, "ok") &&
+            Object.hasOwn(appOutlets, "refused") &&
+            (ref.port === "ok" || ref.port === "refused");
+        return (skipped.has(ref.node) ||
+            ((producer?.kind === "condition" ||
+                producer?.kind === "review" ||
+                producer?.kind === "repeat" ||
+                completionBranch === true) &&
+                readPort(values, ref) === undefined));
+    };
+    for (const node of graph.nodes) {
+        const name = `n:${node.id}:${iteration}`;
+        const absentMapping = node.kind === "app" || node.kind === "code" || node.kind === "transform"
+            ? Object.values(node.kind === "transform" ? node.fields : node.values).some((mapping) => mappingBranchAbsent(mapping, values, branchAbsent))
+            : node.kind === "condition" &&
+                predicateBranchAbsent(node.test, values, branchAbsent);
+        if (requiredRefs(graph, node).some(branchAbsent) || absentMapping) {
+            skipped.add(node.id);
+            await step.do(name + ":skipped", async () => {
+                await dispatcher.recordEvent(baseEvent(node, "skipped"));
+                return null;
+            });
+            continue;
+        }
+        const admission = S.decodeUnknownSync(nodeAdmissionResultSchema)(await dispatcher.beforeNode(baseEvent(node, "running")), { onExcessProperty: "error" });
+        if (admission.kind === "refused")
+            return fail(node, admission.code);
+        switch (node.kind) {
+            case "code": {
+                if (!codeExecution)
+                    return fail(node, "code_execution_unavailable");
+                const host = codeExecution;
+                const outcome = await step.do(name, { retries: { limit: 0, delay: "1 second" } }, async (ctx) => {
+                    await dispatcher.recordEvent(baseEvent(node, "running", ctx.attempt));
+                    const args = nodeArguments(graph, node, values);
+                    const schema = parseProjection(node.input);
+                    const inputValue = methodInputValue(schema, args);
+                    if (inputValue === undefined || !accepts(schema, inputValue))
+                        return { kind: "refused", code: "invalid_input" };
+                    const executionId = JSON.stringify([
+                        checked.runId,
+                        checked.kind === "map-item" ? checked.body : null,
+                        node.id,
+                        iteration,
+                    ]);
+                    return Effect.runPromise(executeCode(host, node, executionId, inputValue));
+                });
+                if (outcome.kind === "refused")
+                    return fail(node, outcome.code);
+                values[node.id] = await step.do(name + ":complete", () => complete(node, outcome.ports));
+                break;
+            }
+            case "app": {
+                const app = plan.definition.apps[node.app];
+                const binding = plan.bindings[node.app];
+                const method = app
+                    ? plan.catalog[app.appId]?.methods[node.method]
+                    : undefined;
+                if (!method || !binding || !("installationId" in binding))
+                    return fail(node, "unknown_method");
+                const retries = node.retry
+                    ? node.retry.attempts - 1
+                    : method.effect === "external"
+                        ? 0
+                        : 3;
+                const attemptCall = (poll) => step.do(poll === 0 ? name : `${name}:poll:${String(poll)}`, {
+                    retries: {
+                        limit: retries,
+                        delay: "1 second",
+                        backoff: "exponential",
+                    },
+                }, async (ctx) => {
+                    const start = Date.now();
+                    await dispatcher.recordEvent(baseEvent(node, "running", ctx.attempt, poll));
+                    const args = nodeArguments(graph, node, values);
+                    const inputSchema = parseProjection(method.input);
+                    const inputValue = methodInputValue(inputSchema, args);
+                    if (inputValue === undefined || !accepts(inputSchema, inputValue))
+                        return fail(node, "invalid_input", undefined, poll);
+                    let call = {
+                        teamId: checked.teamId,
+                        runId: checked.runId,
+                        nodeId: node.id,
+                        iteration,
+                        poll,
+                        installationId: binding.installationId,
+                        method: node.method,
+                        methodSpec: method,
+                        input: inputValue,
+                        idempotencyKey: `${checked.runId}:${node.id}:${iteration}`,
+                    };
+                    if (checked.kind === "map-item")
+                        call = { ...call, graphId: checked.body };
+                    let dispatched;
+                    try {
+                        dispatched = await dispatcher.dispatch(call);
+                    }
+                    catch (cause) {
+                        await dispatcher.recordEvent({
+                            ...baseEvent(node, "failed", ctx.attempt, poll),
+                            refusal: "dispatch_failed",
+                        });
+                        throw cause;
+                    }
+                    let result;
+                    try {
+                        result = S.decodeUnknownSync(dispatchResultSchema)(dispatched, {
+                            onExcessProperty: "error",
+                        });
+                    }
+                    catch (cause) {
+                        if (!S.isSchemaError(cause))
+                            throw cause;
+                        return fail(node, "invalid_output", cause, poll);
+                    }
+                    if (result.kind === "refused")
+                        return fail(node, result.code, undefined, poll);
+                    if (result.kind === "pending") {
+                        await dispatcher.recordEvent(baseEvent(node, "waiting", ctx.attempt, poll));
+                        return { pending: result.retryAfterMs };
+                    }
+                    // W3 wires approval waits at the broker; a queue must never masquerade as a result.
+                    if (result.kind === "pending_approval")
+                        return fail(node, "pending_approval_requires_w3", undefined, poll);
+                    const outputSchema = parseProjection(method.output);
+                    const ports = methodOutputValues(outputSchema, result.output);
+                    if (ports === undefined)
+                        return fail(node, "invalid_output", undefined, poll);
+                    return {
+                        ports: await complete(node, ports, ctx.attempt, result.costMilliunits, Date.now() - start, poll),
+                    };
+                });
+                // A pending App call is polled with the same idempotency key, within
+                // the steps the plan's static estimate left for this instance.
+                let outcome = await attemptCall(0);
+                for (let poll = 1; "pending" in outcome; poll++) {
+                    if (pollSteps + 2 > pollBudget)
+                        return fail(node, "pending_budget");
+                    pollSteps += 2;
+                    await step.sleep(`${name}:wait:${String(poll)}`, outcome.pending);
+                    outcome = await attemptCall(poll);
+                }
+                values[node.id] = outcome.ports;
+                break;
+            }
+            case "condition":
+                values[node.id] = await step.do(name, () => complete(node, {
+                    [evaluatePredicate(node.test, values) ? "true" : "false"]: true,
+                }));
+                break;
+            case "transform":
+                values[node.id] = await step.do(name, async () => {
+                    const output = {};
+                    for (const [key, mapping] of Object.entries(node.fields)) {
+                        const value = evaluateMapping(mapping, values);
+                        if (value === undefined)
+                            return fail(node, "missing_input");
+                        output[key] = value;
+                    }
+                    return complete(node, output);
+                });
+                break;
+            case "wait": {
+                await step.sleep(name, node.for);
+                values[node.id] = await step.do(name + ":complete", () => complete(node, {}));
+                break;
+            }
+            case "review": {
+                const eventType = "review_" +
+                    (await contentDigest([instanceId, node.id, iteration])).slice(7);
+                const expiresAt = await step.do(name + ":pending", async () => {
+                    const deadline = await dispatcher.openReview({
+                        runId: checked.runId,
+                        nodeId: node.id,
+                        iteration,
+                        instanceId,
+                        eventType,
+                        title: node.title,
+                        reviewers: node.reviewers,
+                        timeout: node.timeout,
+                        show: node.show.map((ref) => readPort(values, ref) ?? null),
+                        ...reviewChoices(node),
+                    });
+                    await dispatcher.recordEvent(baseEvent(node, "waiting"));
+                    return deadline;
+                });
+                let answer;
+                try {
+                    const event = await step.waitForEvent(name + ":answer", {
+                        type: eventType,
+                        timeout: node.timeout,
+                    });
+                    answer = S.decodeUnknownSync(reviewAnswerSchema)(event.payload, {
+                        onExcessProperty: "error",
+                    });
+                }
+                catch (cause) {
+                    if (S.isSchemaError(cause))
+                        return fail(node, "invalid_input", cause);
+                    // RPC strips the native timeout subtype. The review owner already
+                    // owns expiry; handle that expected outcome without inspecting text,
+                    // retaining the original failure for diagnostics. Early failures escape.
+                    if (Date.now() >= expiresAt)
+                        return fail(node, "review_timeout", cause);
+                    throw cause;
+                }
+                const shown = node.show[0];
+                const item = shown ? (readPort(values, shown) ?? null) : true;
+                values[node.id] = await step.do(name + ":complete", () => complete(node, reviewAnswerOutput(answer, item)));
+                break;
+            }
+            case "repeat": {
+                const item = readPort(values, { node: "$input", port: "item" });
+                if (item === undefined)
+                    return fail(node, "invalid_input");
+                let previous = {};
+                let outlet = "exhausted";
+                for (let round = 0; round < node.maxRounds; round++) {
+                    const childIteration = (await contentDigest([iteration, node.id, "repeat", round])).slice(7);
+                    const childId = (await contentDigest([
+                        checked.runId,
+                        node.id,
+                        childIteration,
+                        plan.planDigest,
+                    ])).slice(7);
+                    const eventType = "round_" +
+                        (await contentDigest([
+                            checked.runId,
+                            checked.kind === "map-item" ? checked.body : "root",
+                            node.id,
+                            iteration,
+                            round,
+                        ])).slice(7);
+                    await step.do(`${name}:round:${String(round)}`, async () => {
+                        const params = {
+                            kind: "map-item",
+                            teamId: checked.teamId,
+                            runId: checked.runId,
+                            planDigest: plan.planDigest,
+                            body: node.body,
+                            iteration: childIteration,
+                            parentInstanceId: instanceId,
+                            completionEvent: eventType,
+                            input: { item, round, previous },
+                        };
+                        try {
+                            await workflows.create({ id: childId, params });
+                        }
+                        catch (cause) {
+                            const existing = await workflows.get(childId);
+                            if ((await existing.status()).status === "unknown")
+                                throw cause;
+                        }
+                        await dispatcher.recordEvent(baseEvent(node, "waiting"));
+                        return null;
+                    });
+                    const event = await step.waitForEvent(eventType, {
+                        type: eventType,
+                        timeout: "7 days",
+                    });
+                    const completed = S.decodeUnknownSync(childCompletionSchema)(event.payload, { onExcessProperty: "error" });
+                    if ("refusal" in completed)
+                        return fail(node, completed.refusal);
+                    previous = completed.output;
+                    if (evaluatePredicate(node.until, { $input: previous })) {
+                        outlet = "result";
+                        break;
+                    }
+                }
+                values[node.id] = await step.do(name + ":complete", () => complete(node, { [outlet]: previous }));
+                break;
+            }
+            case "map": {
+                const items = readPort(values, node.over);
+                if (!S.is(S.Array(S.Json))(items) || items.length > node.maxItems)
+                    return fail(node, "map_item_limit");
+                const list = S.decodeUnknownSync(S.Array(S.Json))(items);
+                const results = [];
+                for (let offset = 0; offset < list.length; offset += node.concurrency) {
+                    const wave = list.slice(offset, offset + node.concurrency);
+                    await step.do(name + ":wave:" + String(offset), async () => {
+                        await Promise.all(wave.map(async (item, index) => {
+                            const itemIndex = offset + index;
+                            const childIteration = (await contentDigest([iteration, node.id, itemIndex])).slice(7);
+                            const childId = (await contentDigest([
+                                checked.runId,
+                                node.id,
+                                childIteration,
+                                plan.planDigest,
+                            ])).slice(7);
+                            const childParams = {
+                                kind: "map-item",
+                                teamId: checked.teamId,
+                                runId: checked.runId,
+                                planDigest: plan.planDigest,
+                                body: node.body,
+                                iteration: childIteration,
+                                parentInstanceId: instanceId,
+                                completionEvent: "item_" +
+                                    (await contentDigest([
+                                        checked.runId,
+                                        checked.kind === "map-item" ? checked.body : "root",
+                                        node.id,
+                                        iteration,
+                                        itemIndex,
+                                    ])).slice(7),
+                                input: { item, index: itemIndex },
+                            };
+                            try {
+                                await workflows.create({ id: childId, params: childParams });
+                            }
+                            catch (cause) {
+                                const existing = await workflows.get(childId);
+                                if ((await existing.status()).status === "unknown")
+                                    throw cause;
+                            }
+                        }));
+                        await dispatcher.recordEvent(baseEvent(node, "waiting"));
+                        return null;
+                    });
+                    const completed = await Promise.all(wave.map(async (_, index) => {
+                        const eventType = "item_" +
+                            (await contentDigest([
+                                checked.runId,
+                                checked.kind === "map-item" ? checked.body : "root",
+                                node.id,
+                                iteration,
+                                offset + index,
+                            ])).slice(7);
+                        const event = await step.waitForEvent(eventType, {
+                            type: eventType,
+                            timeout: "7 days",
+                        });
+                        const completed = S.decodeUnknownSync(childCompletionSchema)(event.payload, { onExcessProperty: "error" });
+                        if ("refusal" in completed)
+                            return fail(node, completed.refusal);
+                        return completed.output;
+                    }));
+                    results.push(...completed);
+                }
+                values[node.id] = await step.do(name + ":complete", () => complete(node, { items: results }));
+                break;
+            }
+        }
+    }
+    const output = {};
+    for (const [key, ref] of Object.entries(graph.output)) {
+        const value = readPort(values, ref);
+        if (value === undefined && !branchAbsent(ref))
+            return fail({ id: "$output" }, "missing_output");
+        if (value !== undefined)
+            output[key] = value;
+    }
+    if (exceedsResultLimit(output))
+        return fail({ id: "$output" }, "step_result_limit");
+    if (checked.kind === "map-item")
+        await step.do("notify-parent", async () => {
+            const parent = await workflows.get(checked.parentInstanceId);
+            await parent.sendEvent({
+                type: checked.completionEvent,
+                payload: { output },
+            });
+            return null;
+        });
+    return output;
+}

package/dist/cloudflare/index.d.ts

@@ -0,0 +1 @@
+export { GraphWorkflow, type GraphRunEnding, type GraphWorkflowBindings, } from "./graph-engine.js";

package/dist/cloudflare/index.js

@@ -0,0 +1 @@
+export { GraphWorkflow, } from "./graph-engine.js";

package/dist/code-execution.d.ts

@@ -0,0 +1,16 @@
+import * as Effect from "effect/Effect";
+import type { Sandbox } from "@fungi.computer/mycelium/sandbox";
+import { type CodeResult } from "./code-result.js";
+import type { CodeNode, Json } from "./schema.js";
+/** Host-owned execution policy; no Workflow field can change this budget. */
+export type CodeExecution = Readonly<{
+    sandbox: Sandbox;
+    timeoutMs: number;
+}>;
+export type CodeFailure = "invalid_source" | "guest_exception" | "deadline_exceeded" | "cancelled" | "sandbox_failed" | "invalid_output" | "result_limit";
+export type CodeOutcome = CodeResult | Readonly<{
+    kind: "refused";
+    code: CodeFailure;
+}>;
+/** Only mapped JSON crosses into Code; only a closed checkpoint crosses out. */
+export declare function executeCode(host: CodeExecution, node: CodeNode, executionId: string, input: Json): Effect.Effect<CodeOutcome>;

package/dist/code-execution.js

@@ -0,0 +1,50 @@
+import * as Effect from "effect/Effect";
+import * as S from "effect/Schema";
+import { callCodeSandbox } from "./code-sandbox.js";
+import { codeResult } from "./code-result.js";
+const emptyInput = S.Record(S.String, S.Never);
+const jsonCopy = S.decodeUnknownSync(S.fromJsonString(S.MutableJson));
+const failureCode = (failure) => {
+    switch (failure._tag) {
+        case "SourceInvalid":
+            return "invalid_source";
+        case "GuestThrew":
+            return "guest_exception";
+        case "DeadlineExceeded":
+            return "deadline_exceeded";
+        case "Cancelled":
+            return "cancelled";
+        case "ResultNotJson":
+            return "invalid_output";
+        case "ResultTooLarge":
+            return "result_limit";
+        case "DispatchLost":
+        case "SandboxCrashed":
+        case "BadResponse":
+        case "CapabilityFailed":
+        case "Unknown":
+            return "sandbox_failed";
+    }
+};
+/** Only mapped JSON crosses into Code; only a closed checkpoint crosses out. */
+export function executeCode(host, node, executionId, input) {
+    const serialized = JSON.stringify(input);
+    return callCodeSandbox(host.sandbox, {
+        executionId,
+        code: node.source,
+        timeoutMs: host.timeoutMs,
+        bindings: {
+            INPUT: {
+                read: (request) => {
+                    S.decodeUnknownSync(emptyInput)(request, {
+                        onExcessProperty: "error",
+                    });
+                    return Promise.resolve(jsonCopy(serialized));
+                },
+            },
+        },
+    }).pipe(Effect.map((value) => codeResult(node.output, value)), Effect.catch((failure) => Effect.succeed({
+        kind: "refused",
+        code: failureCode(failure),
+    })));
+}

package/dist/code-result.d.ts

@@ -0,0 +1,11 @@
+import type { Json, JsonSchemaProjection } from "./schema.js";
+/** Persisted Code completion: execution refusals never select an authored outlet. */
+export type CodeResult = Readonly<{
+    kind: "complete";
+    ports: Readonly<Record<string, Json>>;
+}> | Readonly<{
+    kind: "refused";
+    code: "invalid_output" | "result_limit";
+}>;
+/** Validate guest JSON and project it through the declared completion grammar. */
+export declare function codeResult(output: JsonSchemaProjection, value: unknown): CodeResult;

package/dist/code-result.js

@@ -0,0 +1,19 @@
+import * as S from "effect/Schema";
+import * as Result from "effect/Result";
+import { methodOutputValues, parseProjection } from "./ports.js";
+/** Validate guest JSON and project it through the declared completion grammar. */
+export function codeResult(output, value) {
+    const decoded = S.decodeUnknownResult(S.Json)(value);
+    if (Result.isFailure(decoded))
+        return { kind: "refused", code: "invalid_output" };
+    const ports = methodOutputValues(parseProjection(output), decoded.success);
+    if (ports === undefined)
+        return { kind: "refused", code: "invalid_output" };
+    const result = {
+        kind: "complete",
+        ports: { ...ports, after: true },
+    };
+    if (new TextEncoder().encode(JSON.stringify(result)).length > 64 * 1024)
+        return { kind: "refused", code: "result_limit" };
+    return result;
+}

package/dist/code-sandbox.d.ts

@@ -0,0 +1,9 @@
+import * as Effect from "effect/Effect";
+import type { Sandbox, SandboxRequest, SandboxValue } from "@fungi.computer/mycelium/sandbox";
+import type { SandboxFailure } from "@fungi.computer/mycelium/sandbox-failure";
+/**
+ * A Code step abandons its call when its owning Effect is interrupted. The
+ * sandbox receives Effect's local abort signal; trusted host budgets remain
+ * responsible for backing work that cannot acknowledge cancellation.
+ */
+export declare function callCodeSandbox(sandbox: Sandbox, request: SandboxRequest): Effect.Effect<SandboxValue, SandboxFailure>;

package/dist/code-sandbox.js

@@ -0,0 +1,13 @@
+import * as Effect from "effect/Effect";
+import { sandboxFailure } from "@fungi.computer/mycelium/sandbox-boundary";
+/**
+ * A Code step abandons its call when its owning Effect is interrupted. The
+ * sandbox receives Effect's local abort signal; trusted host budgets remain
+ * responsible for backing work that cannot acknowledge cancellation.
+ */
+export function callCodeSandbox(sandbox, request) {
+    return Effect.tryPromise({
+        try: (signal) => sandbox.execute(request, signal),
+        catch: sandboxFailure,
+    });
+}