@mcp-b/do-runtime 0.1.0

package/dist/src/api/worker-loader.d.ts

@@ -0,0 +1,354 @@
+/**
+ * ← workerd `src/workerd/api/worker-loader.{h,c++}`
+ *
+ * The Worker Loader binding: `get(name, getCode)` and `load(code)`, the
+ * `WorkerStub` they return, and the two ways a dynamic Worker is reached —
+ * `getEntrypoint()` for a `Fetcher` and `getDurableObjectClass()` for a
+ * `DurableObjectClass`, which is the single bridge between dynamic Workers and
+ * facets. Per §1.11 Code Mode is two features composed: a dynamic Worker for
+ * execution and a facet for durable state, because "Dynamically-loaded isolates
+ * can't directly have storage" (`server/server.c++:4209`).
+ *
+ * **The scaffolding this file replaces was a hypothesis, and the C++ wants a
+ * different shape.** It declared `IsolateHost.execute({executionId, code,
+ * namespaces}, onToolCall)` plus `cancel(executionId)`, with a
+ * `SandboxNamespaceDescriptor` of `{provider, name}` and a `SandboxToolDispatch`
+ * of `(provider, name, args, toolCallId)`. Not one of those words appears in
+ * `worker-loader.{h,c++}` or in `io-channels.h`: providers, tool calls and
+ * execution ids are the *consumer's* concepts, and this package may not know
+ * about Rook, Think or agents. What upstream actually declares is
+ * `IoChannelFactory::loadIsolate(channel, name, fetchSource) ->
+ * WorkerStubChannel` (`io/io-channels.h:339-343`), with `getEntrypoint` and
+ * `getActorClass` on the channel — a Worker-shaped seam, not an
+ * execution-shaped one. The scaffolding had transcribed
+ * `OffscreenCodemodeExecutor`, which is decision 15's *subject*, not its result.
+ * `ActorPorts.isolates` went with it: a Worker Loader is a binding a host puts in
+ * `env`, exactly as `DurableObjectNamespace` and `ctx.exports` already are, not a
+ * port the container needs — upstream's own is `Global::WorkerLoader{channel}`
+ * compiled into the bindings (`server/workerd-api.c++:748`).
+ *
+ * **`get()` does not cache; the namespace behind it does.** `WorkerLoader::get`
+ * calls `loadIsolate` unconditionally and mints a fresh `WorkerStub` every call
+ * (`worker-loader.c++:63-83`). The find-or-create by name lives one layer down, in
+ * `Server::WorkerLoaderNamespace::loadIsolate` (`server.c++:4243-4281`), together
+ * with the rule that a **null or absent name mints a fresh isolate every time** —
+ * which upstream's own `isolateUniqueness` test pins at
+ * `api/tests/worker-loader-test.js:527-541`. So what this layer owns is which name
+ * reaches the seam: `load(code)` is documented as "Shortcut for `get(null, () =>
+ * code)`" and both it and `get(null)` pass none.
+ *
+ * **What `load()` owns that `get()` does not is *when* the code is validated.**
+ * `load()` builds the whole `DynamicWorkerSource` synchronously before it returns
+ * (`worker-loader.c++:88`), so a malformed module list throws out of `load()`;
+ * `get()` defers everything into the callback, so the same mistake surfaces at the
+ * first request on the stub, which is what upstream's tests assert
+ * (`worker-loader-test.js:812`, `:829`, `:856`). That eager capture is also a
+ * memory-safety fix: `data` and `wasm` bytes are copied out of the caller's buffer
+ * at that moment, because a resizable `ArrayBuffer` can be shrunk to zero
+ * afterwards (`worker-loader.c++:225-232`, `:242-245`, and
+ * `api/tests/worker-loader-rab-test.js`).
+ *
+ * **`globalOutbound: null` is the default posture, per decision 15, and what it
+ * enforces here is one hop further out than on workerd.** Upstream substitutes a
+ * `NullGlobalOutboundChannel` whose `startRequest` throws
+ * (`server.c++:4306-4331`), so ambient `fetch` inside the loaded Worker fails from
+ * inside the isolate. This layer's whole job is the same one upstream's is:
+ * collapse the three JS states — omitted, `null`, a `Fetcher` — into the two the
+ * source carries, where absent means blocked and omitted means the caller's own
+ * outbound. Enforcement belongs to whatever `loadIsolate` returns, because that is
+ * the thing with an isolate to deny.
+ *
+ * **The one thing this file refuses that upstream refuses elsewhere.**
+ * `Frankenvalue::fromJs` serializes `props` and `env` inside these methods, and a
+ * `ctx.exports` binding that has not been invoked declares no `JSG_SERIALIZABLE`,
+ * so it is refused there with a `DataCloneError` — pinned at
+ * `api/tests/worker-loader-test.js:104`. `api/export-loopback.ts`'s header records
+ * that refusal as not surviving; it survives here, because this is the layer
+ * upstream refuses at. See `requireSerializableProps` below.
+ *
+ * **There are no source or `env` size caps, and an earlier statement of this
+ * section's spec said there were** — "64 MiB of module source, 1 MiB of `env`
+ * (`worker-loader.c++:15-21`)". Those lines are `WorkerStub::getEntrypoint`'s
+ * props-and-limits prologue, and no cap of either size exists anywhere in the
+ * open-source runtime: the complete list of refusals in the load path is the ten
+ * `JSG_REQUIRE`/`JSG_FAIL_REQUIRE` sites this file ports, and none of them
+ * measures a length. Those are Cloudflare's documented *production* limits, which
+ * workerd does not reproduce — the same class of thing as `ResourceLimits`, and
+ * recorded on it. Nothing here counts bytes.
+ *
+ * Spec: §1.11, decisions 15 and 16 in
+ * docs/decisions.md.
+ */
+import type { CompatibilityDateValidation, DynamicWorkerSource, ResourceLimits, WorkerStubChannel } from "../io/io-channels.js";
+import type { IoContext } from "../io/io-context.js";
+import { DurableObjectClass } from "./actor.js";
+/** ← `JSG_REQUIRE(code.modules.fields.size() > 0, …)` (`worker-loader.c++:175-176`). */
+export declare const NO_MODULES_MESSAGE = "Dynamic Worker code must contain at least one module.";
+/** ← `JSG_FAIL_REQUIRE` at `worker-loader.c++:204-206`. */
+export declare function moduleNameMessage(name: string): string;
+/**
+ * ← `JSG_FAIL_REQUIRE` at `worker-loader.c++:197-201`, the `.ts` / `.tsx` / `.jsx`
+ * arm. Upstream's is the message above plus the bundler suggestion.
+ */
+export declare function typeScriptModuleNameMessage(name: string): string;
+/** ← `JSG_REQUIRE(fieldCount == 1, …)` (`worker-loader.c++:212-215`). */
+export declare function moduleFieldCountMessage(name: string, fieldCount: number): string;
+/** ← `JSG_FAIL_REQUIRE` at `worker-loader.c++:261-262`. */
+export declare function jsModuleInPythonWorkerMessage(name: string): string;
+/** ← `JSG_FAIL_REQUIRE` at `worker-loader.c++:266-267`. */
+export declare function pythonModuleInJsWorkerMessage(name: string): string;
+/** ← `JSG_REQUIRE` at `worker-loader.c++:152-154`. Upstream's carries no closing period. */
+export declare const STREAMING_TAILS_EXPERIMENTAL_MESSAGE: string;
+/**
+ * ← `JSG_REQUIRE_NONNULL(weakIoctx->tryGet(), Error, …)` (`worker-loader.c++:73-74`),
+ * the guard the AUTOVULN-CLOUDFLARE-WORKERD-256 fix added.
+ *
+ * **The precondition differs and the failure mode nearly did too.** Upstream's
+ * `IoContext` is per REQUEST, so a stub can outlive the context that made it and
+ * the raw `&ioctx` capture was a use-after-free; the WeakRef turns that into this
+ * message. Ours is per CONTAINER and outlives every stub it made, so the
+ * destroyed case cannot happen — what remains reachable is an **aborted** actor,
+ * and for that `IoContext::awaitIo` deliberately leaves its promise unsettled
+ * ("`result` is deliberately left unsettled, as upstream leaves it",
+ * `io/io-context.ts`). Upstream can afford that because `runAlarm`'s caller and
+ * everything else in a torn-down request is being destroyed anyway; a dynamic
+ * worker load cannot, because `WorkerStubChannel`'s contract is that a failed
+ * load makes every request on the stub **fail** — a load that never settles makes
+ * every request on the stub hang instead, which is the failure this repository's
+ * own divergence 149 exists to prevent ("a JS promise has to settle, and one that
+ * never does is a hang nobody can see"). So the abort is observed explicitly and
+ * answered with upstream's own message.
+ */
+export declare const DEAD_LOAD_CONTEXT_MESSAGE = "The request which initiated this dynamic worker load has already completed.";
+/** ← `JSG_REQUIRE(!allowExperimental, …)` (`worker-loader.c++:282-284`). */
+export declare const ALLOW_EXPERIMENTAL_MESSAGE: string;
+/**
+ * ← `Serializer::throwDataCloneErrorForObject` (`jsg/ser.c++:175-183`), whose type
+ * name is `obj->GetConstructorName()` — the JSG resource type's name, which is the
+ * class name here. Pinned for `LoopbackServiceStub` at
+ * `api/tests/worker-loader-test.js:104`.
+ */
+export declare function notSerializableMessage(typeName: string): string;
+/** Not something `jsg::asBytes()` would accept for a `kj::Array<const byte>` body. */
+export declare const NOT_BYTES_MESSAGE = "A module's 'data' or 'wasm' body must be an ArrayBuffer or a view over one.";
+/**
+ * ← the two arguments `IoChannelFactory::loadIsolate` takes besides the channel
+ * number (`io/io-channels.h:339-343`). Upstream: "Use a dynamic Worker loader
+ * binding to obtain an Worker by name. If name is null, or if the named Worker
+ * doesn't already exist, the callback will be called to fetch the source code from
+ * which the Worker should be created."
+ *
+ * Upstream's own note on the callback, at `worker-loader.c++:90-94`, is the
+ * contract an implementation has to honour: "the callback we pass to
+ * `loadIsolate()` technically may be called any number of times. Yes, even though
+ * we aren't providing an ID. The runtime can actually evict the isolate while a
+ * stub still exists, as long as there is no active request on the stub, and then
+ * recreate the isolate on the next request."
+ */
+export type LoadIsolateRequest = {
+    /**
+     * ← `kj::Maybe<kj::String> name`. Absent means the isolate is not cached and a
+     * fresh one is minted per call (`server.c++:4264-4281`).
+     */
+    readonly name: string | undefined;
+    /** ← `kj::Function<kj::Promise<DynamicWorkerSource>()> fetchSource`. */
+    fetchSource(): Promise<DynamicWorkerSource>;
+};
+/**
+ * ← `IoChannelFactory`'s two dynamic-worker methods, collapsed the way
+ * `api/actor.ts` and `api/export-loopback.ts` already collapse theirs: both take a
+ * channel *number* upstream and there is no numbered channel table here, so each
+ * becomes a factory method taking an object request. Declared beside its one
+ * consumer for the same reason `ActorChannelFactory` is.
+ *
+ * This is the whole substrate seam of §1.11. A host implements it three ways — the
+ * offscreen document in the browser, an in-realm module evaluation under Node, and
+ * the real `worker_loaders` binding on workerd — and nothing above it has to know
+ * which.
+ */
+export interface IsolateChannelFactory {
+    /** ← `IoChannelFactory::loadIsolate`. Returns before the Worker has loaded. */
+    loadIsolate(request: LoadIsolateRequest): WorkerStubChannel;
+    /**
+     * ← `getSubrequestChannel(IoContext::NULL_CLIENT_CHANNEL)`
+     * (`worker-loader.c++:137-138`, `io/io-context.h:753`) — the calling worker's own
+     * global outbound, which a loaded Worker inherits when `globalOutbound` is
+     * omitted. Upstream reaches it by channel number 0; with no channel table it is a
+     * method on the one factory that needs it.
+     *
+     * Upstream deliberately does not call `requireAllowsTransfer()` on this one: "if
+     * it was the global outbound of the parent, it must be OK to be the global
+     * outbound of the child."
+     */
+    getNullClientChannel(): Fetcher;
+}
+/**
+ * ← `WorkerLoader::Module` (`worker-loader.h:62-78`). "Exactly one must be filled
+ * in."
+ *
+ * `data` and `wasm` are `ArrayBuffer | ArrayBufferView` where
+ * `@cloudflare/workers-types` declares `ArrayBuffer`, because upstream unwraps
+ * them with `jsg::asBytes()`, which accepts either — and upstream's own tests pass
+ * a `Uint8Array` to both (`worker-loader-test.js:585`, `:645`). A superset of the
+ * pinned types, the same relationship `DurableObjectNamespace.getExisting` has.
+ *
+ * `serializedJson` is absent: upstream's own comment calls it a HACK for owning
+ * the string `Worker::Script::Source` only borrows, and a JS string is owned.
+ */
+export type Module = {
+    /** ES module. */
+    readonly js?: string;
+    /** Common JS module. */
+    readonly cjs?: string;
+    /** "text blob, imports as a string" */
+    readonly text?: string;
+    /** "byte blob, imports as ArrayBuffer" */
+    readonly data?: ArrayBuffer | ArrayBufferView;
+    /** "arbitrary JS value, will be serialized to JSON and then parsed again when imported" */
+    readonly json?: unknown;
+    /** Python module. */
+    readonly py?: string;
+    /** "compiled WASM module" */
+    readonly wasm?: ArrayBuffer | ArrayBufferView;
+};
+/** ← `WorkerLoader::WorkerCode` (`worker-loader.h:80-120`). */
+export type WorkerCode = {
+    readonly compatibilityDate: string;
+    readonly compatibilityFlags?: readonly string[];
+    readonly allowExperimental?: boolean;
+    readonly limits?: ResourceLimits;
+    readonly mainModule: string;
+    /**
+     * "Modules are specified as an object mapping names to content. If the content is
+     * just a string, an ES module is assumed. If it's an object, the type of module
+     * is determined based on which property is set."
+     */
+    readonly modules: Record<string, Module | string>;
+    /** "Any RPC-serializable value!" */
+    readonly env?: unknown;
+    /**
+     * "`Fetcher` (e.g. service binding) representing the loaded worker's global
+     * outbound. If omitted, inherit the current worker's global outbound. If `null`,
+     * block the global outbound (all requests throw errors)."
+     */
+    readonly globalOutbound?: Fetcher | null;
+    /** "Specify tail workers." */
+    readonly tails?: readonly Fetcher[];
+    readonly streamingTails?: readonly Fetcher[];
+};
+/** ← `WorkerStub::EntrypointOptions` (`worker-loader.h:22-27`). */
+export type EntrypointOptions = {
+    readonly props?: unknown;
+    readonly limits?: ResourceLimits;
+};
+/**
+ * ← `WorkerStub` (`worker-loader.h:15-50`). "JS stub pointing to a remote Worker
+ * loaded using WorkerLoader. This is not a stub for a specific entrypoint, but
+ * instead the entire Worker, allowing the caller to call any entrypoint (and
+ * specify arbitrary props)."
+ */
+export declare class WorkerStub implements globalThis.WorkerStub {
+    #private;
+    constructor(channel: WorkerStubChannel);
+    /** ← `WorkerStub::getEntrypoint` (`worker-loader.c++:13-36`). */
+    getEntrypoint<T extends Rpc.WorkerEntrypointBranded | undefined = undefined>(name?: string | null, options?: EntrypointOptions): Fetcher<T>;
+    /**
+     * ← `WorkerStub::getDurableObjectClass` (`worker-loader.c++:38-61`).
+     *
+     * **This is the bridge into facets and it is a real connection, not a named
+     * boundary.** The `ActorClassChannel` the channel answers with is the same token
+     * `DurableObjectClass.getChannel()` hands to `FacetStartInfo.actorClass`, which
+     * `FacetManager.getFacet` hands to `FacetHost.start` — so a class obtained here
+     * goes straight into `ctx.facets.get(name, () => ({ class }))` with nothing in
+     * between, which is exactly the shape upstream's `FacetTestActor` uses
+     * (`worker-loader-test.js:421-433`).
+     */
+    getDurableObjectClass<T extends Rpc.DurableObjectBranded | undefined = undefined>(name?: string | null, options?: EntrypointOptions): DurableObjectClass<T>;
+}
+/**
+ * The two constructor inputs upstream's `WorkerLoader` resolves from ambients this
+ * package does not have.
+ */
+export type WorkerLoaderOptions = {
+    /**
+     * ← `WorkerLoader`'s second constructor parameter (`worker-loader.h:58`), whose
+     * comment is "`compatDateValidation` will differ between workerd vs.
+     * production". It is carried onto the `DynamicWorkerSource` rather than consumed
+     * here, because the compilation it feeds is a substrate boundary — see
+     * `CompatibilityFlagsRequest` in `io/io-channels.ts`.
+     */
+    readonly compatDateValidation: CompatibilityDateValidation;
+    /**
+     * ← `FeatureFlags::get(js).getWorkerdExperimental()` (`worker-loader.c++:281`) —
+     * the *calling* worker's `experimental` compatibility flag, which gates
+     * `allowExperimental` on the loaded one.
+     *
+     * Every other compatibility flag this package meets was answered by "a runtime
+     * with no deployed history takes the current behaviour" (`api/actor.ts`, and the
+     * README row for `deleteAllDeletesAlarm`). That reading does not work here:
+     * `experimental` has no default-on date and never turns on by itself, so taking
+     * the current behaviour would hard-code `false`, make `allowExperimental: true`
+     * always throw, and put `streamingTails` out of reach — the feature subset the
+     * README's second paragraph forbids. So the bit moves from an ambient to an
+     * explicit input, which is what this package does with every ambient.
+     * `compileCompatibilityFlags`'s own parameter for the same bit is named
+     * `allowExperimentalFeatures`.
+     */
+    readonly allowExperimentalFeatures: boolean;
+};
+/**
+ * ← `WorkerLoader` (`worker-loader.h:52-150`). "JS interface for worker loader
+ * binding."
+ *
+ * Takes an `IoContext` where upstream reads `IoContext::current()`, which is the
+ * substitution every class in `api/` makes (`DurableObjectFacets`,
+ * `DurableObjectStorageOperations`); and an `IsolateChannelFactory` where upstream
+ * holds a channel number, which is the substitution every outgoing seam in `api/`
+ * makes.
+ */
+export declare class WorkerLoader implements globalThis.WorkerLoader {
+    #private;
+    constructor(ctx: IoContext, channel: IsolateChannelFactory, options: WorkerLoaderOptions);
+    /**
+     * ← `WorkerLoader::get` (`worker-loader.c++:63-83`).
+     *
+     * Nothing is validated here: the code callback is deferred whole into the reentry
+     * callback, so every refusal `toDynamicWorkerSource` can make surfaces at the
+     * first request on the returned stub instead. That is upstream's own behaviour
+     * and its tests depend on it.
+     */
+    get(name: string | null | undefined, getCode: () => WorkerCode | Promise<WorkerCode>): WorkerStub;
+    /**
+     * ← `WorkerLoader::load` (`worker-loader.c++:85-107`). "Shortcut for `get(null,
+     * () => code)`."
+     *
+     * A shortcut with two consequences upstream states outright. The source is built
+     * **now**, synchronously, so every refusal below throws from this call rather
+     * than from the first request; and `name` is `kj::none`, so the isolate is not
+     * cached and a fresh Worker is minted per call.
+     *
+     * Upstream's clone-per-invocation is absent because a JS source object is
+     * immutable and shared safely — see `io/worker-source.ts`'s header. The
+     * atomic-refcount wrapper it needs for that ("it may ultimately destroy the
+     * `ownContent` in another thread ... Ugh!") goes with it.
+     */
+    load(code: WorkerCode): WorkerStub;
+}
+/** `Value` must be assignable to `Declared`; declaring the constraint is the check. */
+type Assignable<Value extends Declared, Declared> = Value;
+/**
+ * §2.4's no-cast rule: these reach a consumer as `env` bindings typed by
+ * `@cloudflare/workers-types`, so the type system checks the surface rather than a
+ * cast doing it. The three struct rows point the other way, because a struct is an
+ * argument: what has to hold is that every code a consumer can write against the
+ * pinned type is one this file accepts. `Module` is a strict superset by the two
+ * byte fields, for the reason its own comment gives.
+ */
+export type PinnedWorkerLoaderTypes = [
+    Assignable<WorkerLoader, globalThis.WorkerLoader>,
+    Assignable<WorkerStub, globalThis.WorkerStub>,
+    Assignable<globalThis.WorkerLoaderWorkerCode, WorkerCode>,
+    Assignable<globalThis.WorkerLoaderModule, Module>,
+    Assignable<globalThis.WorkerStubEntrypointOptions, EntrypointOptions>
+];
+export {};

package/dist/src/index.d.ts

@@ -0,0 +1,130 @@
+/**
+ * `@mcp-b/do-runtime` — the browser implementation of the workerd Durable
+ * Object contract. No knowledge of any host application.
+ *
+ * NO upstream correspondence: this file is the package facade. Everything it
+ * re-exports has one.
+ *
+ * Gates, `IoContext`, storage internals, the facet index, and deletion receipts
+ * stay private. Hosts use the `ActorContainer` lifecycle rather than holding a
+ * runtime lock or table directly.
+ *
+ * The `api/` classes are not exported either, for the same reason and one more.
+ * `DurableObjectStorage`, `DurableObjectState`, `SqlStorage` and `SyncKvStorage`
+ * reach a consumer as `container.state` and its properties, already typed by
+ * workers-types; handing out the constructors would let one be built over a
+ * gate the container does not own. `FacetManager` is internal for the mirror
+ * reason: it is what `server/` implements and `api/` consumes, and the seam a
+ * consumer fills is `FacetHost` below it.
+ *
+ * Refusal messages used by conformance tests are exported so their specified
+ * fail-closed behavior cannot drift. `createActorContainer` is asynchronous
+ * because `SqlDatabaseProvider.open` is asynchronous; a returned container has
+ * usable state and no hidden half-started storage phase.
+ */
+export type { SqlDatabase, SqlDatabaseProvider, SqlDatabaseSnapshot, SqlDatabaseSnapshotProvider, SqlResult, SqlValue, } from "./util/sqlite.js";
+export type { ReadOptions, WriteOptions } from "./io/actor-cache.js";
+export type { AlarmOutlet } from "./io/actor-sqlite.js";
+export type { Timer } from "./io/io-context.js";
+/**
+ * The Worker Loader (§1.11, decision 15). Exported where the `api/` classes are
+ * not, and for the reason `AlarmScheduler` is: this one is a **binding**, so a
+ * host has to construct it and put it in `env` — upstream compiles it from
+ * `Global::WorkerLoader{channel}` the same way (`server/workerd-api.c++:748`) —
+ * where every other `api/` class reaches a consumer through `container.state`.
+ *
+ * What a host supplies is `IsolateChannelFactory`, which is the whole substrate
+ * seam: `loadIsolate` and the calling worker's own outbound. The scaffolding's
+ * `IsolateHost` / `SandboxExecuteRequest` / `SandboxNamespaceDescriptor` /
+ * `SandboxToolDispatch` are gone — see `api/worker-loader.ts`'s header for what
+ * the C++ wanted instead.
+ */
+export type { EntrypointOptions, IsolateChannelFactory, LoadIsolateRequest, Module, WorkerCode, WorkerLoaderOptions, } from "./api/worker-loader.js";
+export { ALLOW_EXPERIMENTAL_MESSAGE, DEAD_LOAD_CONTEXT_MESSAGE, NO_MODULES_MESSAGE, NOT_BYTES_MESSAGE, STREAMING_TAILS_EXPERIMENTAL_MESSAGE, WorkerLoader, WorkerStub, jsModuleInPythonWorkerMessage, moduleFieldCountMessage, moduleNameMessage, notSerializableMessage, pythonModuleInJsWorkerMessage, typeScriptModuleNameMessage, } from "./api/worker-loader.js";
+export type { ActorClassChannel, CompatibilityDateValidation, CompatibilityFlagsRequest, DynamicWorkerSource, EntrypointRequest, ResourceLimits, WorkerStubChannel, } from "./io/io-channels.js";
+export type { Module as SourceModule, ModuleContent, ModulesSource, WorkerSource, } from "./io/worker-source.js";
+/**
+ * The container's own surface. Every one of these is DECLARED in
+ * `server/actor-container.ts` rather than here, and re-exported, because
+ * TypeScript's project references run the same way workerd's Bazel targets do:
+ * `src/` references `src/server/`, so a declaration in this file is one
+ * `server/` may not import.
+ */
+export type { ActorContainer, ActorContainerOptions, ActorEntry, ActorPorts, FacetHandle, FacetHost, FacetId, FacetStartRequest, FacetTree, } from "./server/actor-container.js";
+export { createActorContainer, FACET_ALARM_UNIMPLEMENTED_MESSAGE, noFacets, } from "./server/actor-container.js";
+export { ACTOR_CLASS_SERIALIZATION_UNIMPLEMENTED_MESSAGE } from "./api/actor.js";
+/**
+ * The `ctx.exports` entries, exported where the rest of `api/` is not — for the
+ * reason `WorkerLoader` and `AlarmScheduler` are: a HOST has to construct these.
+ *
+ * `ActorContainerOptions.exports` is a `Record<string, unknown>` a host fills,
+ * and `DurableObjectFacets.get` discriminates its class switch by `instanceof`
+ * against exactly these types (`api/actor-state.ts`). So a host that cannot build
+ * one cannot register an actor class at all, and every consumer would have to
+ * reach into `src/api/` past this facade to do it — which is worse than saying
+ * here that these are the two a host is meant to have.
+ *
+ * They carry no gate and no context: a `LoopbackDurableObjectClass` holds an
+ * `ActorClassChannelFactory`, which answers a `className` and nothing else. That
+ * is why exporting them cannot reproduce the hazard the rest of `api/` is withheld
+ * for — there is no container for one to be built over the wrong one of.
+ */
+export type { LoopbackDurableObjectClassOptions, LoopbackDurableObjectClassValue, ActorClassChannelFactory, } from "./api/export-loopback.js";
+export { asLoopbackDurableObjectClass, LoopbackDurableObjectClass } from "./api/export-loopback.js";
+export { FACET_NAME_MAX_LENGTH, FACET_TREE_MAX_DEPTH, HIBERNATION_UNIMPLEMENTED_MESSAGE, } from "./api/actor-state.js";
+export { PITR_UNIMPLEMENTED_MESSAGE, REPLICATION_UNIMPLEMENTED_MESSAGE } from "./io/actor-cache.js";
+/**
+ * The alarm scheduler is exported where the gate is not, and the difference is
+ * upstream's own: `AlarmScheduler` is a per-NAMESPACE object a supervisor builds
+ * and wires into each actor's storage hooks (`server.c++:2325-2350`,
+ * `:3199-3219`), not a per-actor internal. A host has to construct it, because a
+ * host is what knows how to resolve an actor id to a container — so it is the
+ * implementation a host puts behind `ActorPorts.alarms`, via `hooks(actorId)`,
+ * rather than something `createActorContainer` could build for itself.
+ */
+export type { AlarmResult, AlarmSchedulerOptions, AlarmTarget, EventOutcome, GetActorFn, } from "./server/alarm-scheduler.js";
+export { ALARM_RETRY_MAX_TRIES, ALARM_RETRY_START_SECONDS, AlarmScheduler, RETRY_BACKOFF_MAX, RETRY_JITTER_FACTOR, alarmRetryDelayMs, } from "./server/alarm-scheduler.js";
+/**
+ * The refusing outlet (`ActorSqlite::Hooks::DEFAULT` upstream) — the
+ * `ports.alarms` for a host that schedules nothing, as `noFacets` is its
+ * `ports.facets`. A real root actor gets `AlarmScheduler.hooks(id)` instead.
+ */
+export { DEFAULT_ALARM_OUTLET } from "./io/actor-sqlite.js";
+/** The object an `alarm()` handler is called with (`api/global-scope.h:386-412`). */
+export { AlarmInvocationInfo } from "./api/global-scope.js";
+/**
+ * The async primitives, which a host INSTALLS rather than constructs.
+ *
+ * `ActorGlobalScope` is exported as a type only, and `Scheduler` with it: both
+ * reach a consumer as `container.globals`, already bound to that container's
+ * `IoContext`. Handing out the constructor would let one be built over a context
+ * the container does not own, which is the reason `DurableObjectState` and the
+ * rest of `api/` are not exported either — and here it would be worse, because
+ * the value would look right and gate the wrong actor.
+ *
+ * The two refusal messages ARE exported, for the reason the substrate-boundary
+ * messages above are: they are the specified behaviour, and a message a test
+ * re-types by hand is one that drifts.
+ *
+ * `acceptWebSocket` reaches a consumer as `container.acceptWebSocket` for the
+ * same reason, so only its types are here.
+ */
+export type { ActorGlobalScope, ActorGlobalScopeOptions, ActorScopeBindings, FetchPort, Scheduler, SchedulerWaitOptions, } from "./api/global-scope.js";
+export { actorScopeBindings, FOREIGN_SLICE_MESSAGE, installActorScope, NO_GLOBAL_OUTBOUND_MESSAGE, } from "./api/global-scope.js";
+export type { AcceptedWebSocket, RawWebSocket } from "./api/web-socket.js";
+export { ALREADY_ACCEPTED_MESSAGE } from "./api/web-socket.js";
+export { BYOB_READER_UNGATABLE_MESSAGE, gateRequestBody } from "./api/http.js";
+/**
+ * The transport, for the same reason the loader binding and the scheduler are
+ * here: the hops a host owns are not something `createActorContainer` could
+ * construct for it. `newRpcSession` is the door onto capnweb, and a host still
+ * needs it — the browser conformance lane's page↔actor session and its
+ * actor↔actor routing through the page are both one — because those hops are
+ * between SUPERVISED actors, which is a different question from where a facet
+ * sits.
+ *
+ * `newRpcSession` is exported so that going around it is deliberate. It applies
+ * decision 18's identity graft immediately before opening each session; see
+ * `transport/rpc-session.ts`.
+ */
+export { newRpcSession } from "./transport/rpc-session.js";