@smthrs/harness 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/Sandbox.js

@@ -0,0 +1,464 @@
+/**
+ * The deterministic script sandbox port.
+ *
+ * A cell is arbitrary agent-authored JavaScript, so it never runs in the host
+ * realm. It runs behind this port, which grants exactly one effectful
+ * primitive — flow invocation against the capability-narrowed catalog the run
+ * was given — and returns a serializable {@link Cell.Outcome}.
+ *
+ * The port opens a {@link Realm}, and a realm is the whole surface: it is
+ * acquired once per run and every cell of that run is evaluated in it, so a
+ * name one cell binds is still bound in the next. There is no per-cell
+ * evaluation beside it. One binding ships — `QuickJSSandbox`, the QuickJS-WASM
+ * binding that isolates a real separate realm in both Node and browsers — and a
+ * composition that offers none is refused with {@link realmUnsupported}.
+ *
+ * Cancellation is fiber interruption and teardown is scope finalization; a
+ * sandbox never installs a host abort signal.
+ *
+ * @since 0.1.0
+ */
+import * as Fault from "@smthrs/flow/Fault";
+import { Context, Effect, Exit, Layer, Schema } from "effect";
+import * as Cell from "./Cell.js";
+import * as CellValidation from "./CellValidation.js";
+import { refusal, timedOut } from "./internal/refusal.js";
+/**
+ * Stable failures raised by a sandbox binding itself, as opposed to failures
+ * of the cell it was asked to run.
+ *
+ * A cell that throws is a {@link Cell.Raised} outcome, not a sandbox error.
+ * These codes describe the sandbox being unable to do its job at all.
+ *
+ * @category models
+ * @since 0.1.0
+ * @slop
+ */
+export const SandboxErrorCode = Schema.Literals([
+    "unavailable",
+    "unsupported",
+    "runtime_failed"
+]);
+/**
+ * A failure of the sandbox binding.
+ *
+ * @category errors
+ * @since 0.1.0
+ * @slop
+ */
+export class SandboxError extends Schema.TaggedError()("flows/harness/SandboxError", {
+    code: SandboxErrorCode,
+    message: Schema.String,
+    cause: Schema.optional(Schema.Defect())
+}) {
+}
+Fault.register("flows/harness/SandboxError", {
+    unavailable: "infra",
+    runtime_failed: "infra",
+    unsupported: "bug"
+});
+/**
+ * The refusal a binding answers `ctx.checkpoint()` with when the caller wired
+ * no minter.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const mintUnavailable = () => Effect.succeed(refusal("checkpoint_unavailable", "This run pins no checkpoints."));
+/**
+ * The execution ceilings a cell runs under when the caller declares none.
+ *
+ * Agent-authored source must never acquire an unbounded frame merely because a
+ * host omitted configuration. These values are deliberately generous for a
+ * cell, whose work is choosing flow calls and shaping JSON between them. There
+ * is no spelling for "no ceiling": a host that needs more raises the relevant
+ * finite value explicitly.
+ *
+ * @category constants
+ * @since 0.1.0
+ * @slop
+ */
+export const defaultLimits = Object.freeze({
+    calls: 64,
+    memoryBytes: 128 * 1024 * 1024,
+    steps: 1000,
+    timeMs: 30_000,
+    totalMs: 900_000,
+    callMs: 120_000
+});
+/**
+ * Smallest interpreter-step budget a binding can enter a realm under.
+ *
+ * A zero budget interrupts the binding's own scaffolding before any cell source
+ * runs, which escapes as a crash rather than a ceiling report, so the sandbox
+ * boundary refuses it as `unsupported`.
+ *
+ * @category constants
+ * @since 1.0.0-rc.0
+ */
+export const minimumSteps = 1;
+/**
+ * Smallest wall-clock budget, in milliseconds, a binding can enter a realm under.
+ *
+ * A zero budget interrupts the binding's own scaffolding before any cell source
+ * runs, which escapes as a crash rather than a ceiling report, so the sandbox
+ * boundary refuses it as `unsupported`.
+ *
+ * @category constants
+ * @since 1.0.0-rc.0
+ */
+export const minimumTimeMs = 1;
+/**
+ * Smallest heap ceiling the QuickJS binding can initialize and tear down
+ * safely.
+ *
+ * QuickJS needs space for its runtime and context before cell source runs.
+ * Lower ceilings can leave a partially initialized context that aborts during
+ * disposal, so they are refused at the sandbox boundary.
+ *
+ * @category constants
+ * @since 0.1.0
+ * @slop
+ */
+export const minimumMemoryBytes = 1024 * 1024;
+// The print-channel budgets live with the channel that spends them, and are
+// re-exported here because a host reads them to size what it prints.
+export { printFrameBytes, printRetainedBytes, printStatementFloor } from "./internal/printChannel.js";
+const invalidLimit = (name, requirement) => new SandboxError({
+    code: "unsupported",
+    message: `The ${name} limit must be ${requirement}`
+});
+/** Validates caller-supplied numeric limits before a binding is entered. */
+const validateLimits = (limits) => {
+    if (limits === undefined)
+        return undefined;
+    for (const name of ["calls", "totalMs", "callMs"]) {
+        const value = limits[name];
+        if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
+            return invalidLimit(name, "a non-negative safe integer");
+        }
+    }
+    for (const [name, minimum] of [["steps", minimumSteps], ["timeMs", minimumTimeMs]]) {
+        const value = limits[name];
+        if (value !== undefined && (!Number.isSafeInteger(value) || value < minimum)) {
+            return invalidLimit(name, `a safe integer of at least ${minimum}`);
+        }
+    }
+    if (limits.memoryBytes !== undefined &&
+        (!Number.isSafeInteger(limits.memoryBytes) || limits.memoryBytes < minimumMemoryBytes)) {
+        return invalidLimit("memoryBytes", `a safe integer of at least ${minimumMemoryBytes} bytes`);
+    }
+    if (limits.pauseTotalMsFor !== undefined &&
+        (!Array.isArray(limits.pauseTotalMsFor) ||
+            limits.pauseTotalMsFor.some((name) => typeof name !== "string" || name.trim().length === 0))) {
+        return invalidLimit("pauseTotalMsFor", "an array of non-empty flow names");
+    }
+    return undefined;
+};
+/**
+ * Fills omitted ceilings from {@link defaultLimits} for limits a binding can
+ * enforce.
+ *
+ * Capability gating applies only to defaults. An explicit unsupported limit is
+ * passed through so the binding can refuse it instead of silently widening the
+ * caller's authority.
+ *
+ * @category constructors
+ * @since 0.1.0
+ * @slop
+ */
+export const withDefaults = (capabilities, limits) => ({
+    ...limits,
+    ...(capabilities.memoryBytes && limits?.memoryBytes === undefined
+        ? { memoryBytes: defaultLimits.memoryBytes }
+        : {}),
+    ...(capabilities.steps && limits?.steps === undefined ? { steps: defaultLimits.steps } : {}),
+    ...(capabilities.calls && limits?.calls === undefined ? { calls: defaultLimits.calls } : {}),
+    ...(capabilities.timeMs && limits?.timeMs === undefined ? { timeMs: defaultLimits.timeMs } : {}),
+    ...(capabilities.timeMs && limits?.totalMs === undefined ? { totalMs: defaultLimits.totalMs } : {}),
+    // Gated on `calls` rather than on `timeMs`: the per-call budget is enforced
+    // by the shared drive loop, which is exactly the loop a binding that queues
+    // flow calls runs, and not by the interpreter clock `timeMs` describes.
+    ...(capabilities.calls && limits?.callMs === undefined ? { callMs: defaultLimits.callMs } : {})
+});
+/**
+ * Merges and validates one frame's limits without changing the realm defaults.
+ * Only per-frame ceilings can be overridden; memory belongs to the realm.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const evaluationLimits = (defaults, overrides) => {
+    const limits = {
+        calls: overrides?.calls ?? defaults.calls,
+        steps: overrides?.steps ?? defaults.steps,
+        timeMs: overrides?.timeMs ?? defaults.timeMs,
+        totalMs: overrides?.totalMs ?? defaults.totalMs,
+        pauseTotalMsFor: overrides?.pauseTotalMsFor ?? defaults.pauseTotalMsFor,
+        callMs: overrides?.callMs ?? defaults.callMs
+    };
+    const invalid = validateLimits(limits);
+    return invalid === undefined ? Effect.succeed(limits) : Effect.fail(invalid);
+};
+/**
+ * Builds the durable transition one cell settled.
+ *
+ * A cell states its intent by calling, so this is the only place a
+ * {@link Cell.Transition} is constructed. The realm is the run's memory and the
+ * print buffer is what the next turn reads, so nothing is filed on the way out:
+ * the transition carries only the current intent.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const replTransition = (intent, justification) => {
+    if (intent === undefined)
+        return new Cell.Continue({ justification });
+    return intent._tag === "Done"
+        ? new Cell.Complete({ output: intent.output, value: intent.value })
+        : new Cell.Park({ reason: intent.reason, message: intent.message });
+};
+/**
+ * The bridge frontier at a frame limit. Ordinals are zero-based;
+ * minus one means no dispatch or settlement occurred. A dispatched call may
+ * have been interrupted before its settlement was delivered to JavaScript.
+ * `timeout` requires truncating replay; `settled` identifies a limit the
+ * interpreter completed itself, such as its step or call budget.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export const FrameBoundary = Schema.Struct({
+    terminal: Schema.Literals(["timeout", "settled"]),
+    dispatched: Schema.Int.check(Schema.isGreaterThanOrEqualTo(-1)),
+    settled: Schema.Int.check(Schema.isGreaterThanOrEqualTo(-1))
+});
+/**
+ * Context service for the selected sandbox binding.
+ *
+ * @category services
+ * @since 0.1.0
+ * @slop
+ */
+export const Sandbox = Context.Service("@smthrs/harness/Sandbox");
+/**
+ * Constructs a sandbox from an implementation.
+ *
+ * @category constructors
+ * @since 0.1.0
+ * @slop
+ */
+export const make = (implementation) => {
+    const openRealm = implementation.openRealm;
+    return Sandbox.of({
+        ...implementation,
+        ...(openRealm === undefined ? {} : {
+            openRealm: (options) => {
+                const invalid = validateLimits(options.limits);
+                return invalid !== undefined ? Effect.fail(invalid) : openRealm({
+                    ...options,
+                    limits: withDefaults(implementation.capabilities, options.limits)
+                });
+            }
+        })
+    });
+};
+/**
+ * Provides a sandbox implementation.
+ *
+ * @category layers
+ * @since 0.1.0
+ * @slop
+ */
+export const layer = (implementation) => Layer.succeed(Sandbox)(make(implementation));
+/**
+ * Constructs an unavailable sandbox stub, optionally overriding operations.
+ *
+ * It offers no realm, which is what a run composed against it is told: see
+ * {@link realmUnsupported}.
+ *
+ * @category constructors
+ * @since 0.1.0
+ * @slop
+ */
+export const makeNoop = (overrides = {}) => Sandbox.of({
+    capabilities: { calls: false, memoryBytes: false, steps: false, timeMs: false },
+    ...overrides
+});
+/**
+ * Provides an unavailable sandbox stub.
+ *
+ * @category layers
+ * @since 0.1.0
+ * @slop
+ */
+export const layerNoop = (overrides = {}) => Layer.succeed(Sandbox)(makeNoop(overrides));
+/**
+ * Refuses a run on a binding that has no persistent realm.
+ *
+ * Stated rather than silently downgraded: a realm is the whole surface, so a
+ * binding without one cannot run a cell at all and saying so at the open is the
+ * only honest answer.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const realmUnsupported = new SandboxError({
+    code: "unsupported",
+    message: "This sandbox has no persistent realm, so it cannot run a cell loop; select the QuickJS binding"
+});
+const seconds = (milliseconds) => {
+    const value = milliseconds / 1_000;
+    return Number.isInteger(value) ? String(value) : value.toFixed(3).replace(/0+$/, "");
+};
+/**
+ * Settles one overrunning flow call as a resolved failure envelope in the cell.
+ *
+ * The message is written for the model, because the model is who reads it: it
+ * names the flow, the budget it spent, and the one action that recovers the
+ * frame. A rejection at the whole-evaluation ceiling teaches the model nothing
+ * — the frame is already gone by the time it could act.
+ *
+ * Exported so a caller that bounds its own settlements
+ * ({@link RealmEvaluation.bounded}) synthesizes the same refusal the loop would
+ * have: one ceiling means one sentence, whichever clock enforced it.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const callTimedOut = (flow, callMs) => timedOut(`Flow ${flow} timed out after ${seconds(callMs)} seconds.`, callMs);
+/**
+ * Erases type-only syntax from a cell without evaluating or resolving modules.
+ *
+ * Only Node's strip-safe TypeScript subset is accepted. Constructs that need
+ * JavaScript emit are refused instead of being silently transformed into new
+ * runtime behaviour.
+ *
+ * The parse itself belongs to `CellValidation`, which the controller already
+ * runs at the boundary before it commits a frame; this is the same answer, for
+ * a binding that only needs the program or the reason there is none.
+ *
+ * @category conversions
+ * @since 0.1.0
+ * @slop
+ */
+export const compile = (cell) => {
+    const validation = CellValidation.validate(cell);
+    /* v8 ignore next -- `validate` returns exactly one of the two, so the coalesce never reaches its fallback; it only discharges the optional types the interface declares */
+    return validation.rejected ?? validation.compiled ?? cell.text;
+};
+/**
+ * Renders a thrown non-`Error` as the value it is.
+ *
+ * `String(value)` on an object is `[object Object]`, which is the single
+ * defect PROGRAM change 1 names verbatim: a run that threw a structured value
+ * was told nothing about it and spent a frame going back for the same value.
+ * Anything JSON can hold is rendered as JSON; anything it cannot — a symbol, a
+ * function — keeps `String`, which is the only faithful thing left.
+ *
+ * @private
+ */
+const describe = (value) => {
+    const decoded = Schema.decodeUnknownResult(Schema.Json)(value);
+    return decoded._tag === "Success" ? Cell.renderText(decoded.success) : String(value);
+};
+/**
+ * Drives one externally compiled cell to settlement: settle queued calls one at
+ * a time, in the order the cell issued them, until the cell settles.
+ *
+ * One at a time is deliberate. Data-dependent calls are the normal case, and a
+ * deterministic execution ordinal is what makes a mid-cell crash replayable.
+ *
+ * Bindings differ only in how a cell is compiled and how its promises are
+ * settled, so the interleaving lives here once rather than in each of them.
+ *
+ * @category constructors
+ * @since 0.1.0
+ * @slop
+ */
+export const driveCell = (options) => Effect.gen(function* () {
+    let calls = 0;
+    let settledOrdinal = -1;
+    for (;;) {
+        const next = options.pending.shift();
+        if (next !== undefined) {
+            if (options.replay !== undefined &&
+                (next.ordinal > options.replay.boundary.settled || next.ordinal > options.replay.boundary.dispatched)) {
+                // Match interruption cleanup without delivering an answer that the
+                // original cell never received. This also covers queued checkpoints.
+                next.abort("The cell was interrupted");
+                options.abort("The cell was interrupted");
+                options.flush();
+                return options.replay.outcome;
+            }
+            if (options.limits?.calls !== undefined && calls >= options.limits.calls) {
+                const message = `This cell exceeded its limit of ${options.limits.calls} flow calls`;
+                next.abort(message);
+                options.abort(message);
+                options.flush();
+                return new Cell.Rejected({ code: "limit_exceeded", message });
+            }
+            calls = calls + 1;
+            options.progress?.(next.ordinal, settledOrdinal);
+            const callMs = options.limits?.callMs ?? defaultLimits.callMs;
+            // A mint is settled here rather than on a channel of its own so that it
+            // is ordered against the calls around it. See `Minter`.
+            const settling = next.kind === "checkpoint"
+                ? (options.mint ?? mintUnavailable)({ ordinal: next.ordinal })
+                : options.handler({
+                    ordinal: next.ordinal,
+                    flow: next.flow,
+                    input: next.input,
+                    ...(next.at === undefined ? {} : { at: next.at })
+                });
+            const result = yield* (options.bounded === true
+                // The caller bounds its own settlements, inside the boundary it
+                // journals them under. Racing a second clock here would settle the
+                // call from the one reading nothing records. See `bounded`.
+                ? settling
+                : settling.pipe(
+                // The per-call ceiling, ahead of the interrupt cleanup below: a call
+                // that overruns is answered, not abandoned, so the cell sees a
+                // resolved failure and the frame keeps its remaining budget.
+                Effect.timeoutOrElse({
+                    duration: callMs,
+                    orElse: () => Effect.succeed(callTimedOut(next.flow, callMs))
+                }))).pipe(Effect.flatMap(Cell.decodeCallResult), Effect.onExit((exit) => Exit.isSuccess(exit)
+                ? Effect.void
+                : Effect.sync(() => {
+                    // `next` was shifted out of `pending` before the handler ran.
+                    // Settle that active bridge as well as calls queued behind it,
+                    // then flush the VM so a scoped runtime has no live promise
+                    // handles when a permission park or engine failure unwinds it.
+                    next.abort("The cell was interrupted");
+                    options.abort("The cell was interrupted");
+                    options.flush();
+                })));
+            next.settle(result);
+            settledOrdinal = next.ordinal;
+            options.progress?.(next.ordinal, settledOrdinal);
+            options.flush();
+            continue;
+        }
+        const outcome = options.finished();
+        if (outcome !== undefined)
+            return yield* Cell.decodeOutcome(outcome);
+        // Nothing is queued and the cell has not settled: hand the runtime a
+        // yield point so a peer fiber and an interrupt are both still observable.
+        yield* Effect.yieldNow;
+    }
+});
+/**
+ * Projects a thrown value into a stable serializable cell outcome.
+ *
+ * @category conversions
+ * @since 0.1.0
+ * @slop
+ */
+export const raisedOutcome = (error) => {
+    if (error instanceof Error) {
+        return new Cell.Raised({ name: error.name, message: error.message });
+    }
+    return new Cell.Raised({ name: "Error", message: describe(error) });
+};
+//# sourceMappingURL=Sandbox.js.map

package/dist/esm/Sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Sandbox.js","sourceRoot":"","sources":["../../src/Sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAA;AACzE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AAErD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAGzD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC9C,aAAa;IACb,aAAa;IACb,gBAAgB;CACjB,CAAC,CAAA;AAWF;;;;;;GAMG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,4BAA4B,EAAE;IACjG,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;CACxC,CAAC;CAAG;AACL,KAAK,CAAC,QAAQ,CACZ,4BAA4B,EAC5B;IACE,WAAW,EAAE,OAAO;IACpB,cAAc,EAAE,OAAO;IACvB,WAAW,EAAE,KAAK;CACoB,CACzC,CAAA;AAiED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAW,GAAG,EAAE,CAC1C,MAAM,CAAC,OAAO,CACZ,OAAO,CAAC,wBAAwB,EAAE,+BAA+B,CAAC,CACnE,CAAA;AAsHH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,EAAE;IACT,WAAW,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IAC9B,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAA;AAE7B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAA;AAE9B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAA;AAE7C,4EAA4E;AAC5E,qEAAqE;AACrE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAErG,MAAM,YAAY,GAAG,CAAC,IAAkB,EAAE,WAAmB,EAAgB,EAAE,CAC7E,IAAI,YAAY,CAAC;IACf,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,OAAO,IAAI,kBAAkB,WAAW,EAAE;CACpD,CAAC,CAAA;AAEJ,4EAA4E;AAC5E,MAAM,cAAc,GAAG,CAAC,MAA0B,EAA4B,EAAE;IAC9E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAE1C,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,YAAY,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAU,EAAE,CAAC;QAC5F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC;YAC7E,OAAO,YAAY,CAAC,IAAI,EAAE,8BAA8B,OAAO,EAAE,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,kBAAkB,CAAC,EACtF,CAAC;QACD,OAAO,YAAY,CACjB,aAAa,EACb,8BAA8B,kBAAkB,QAAQ,CACzD,CAAA;IACH,CAAC;IAED,IACE,MAAM,CAAC,eAAe,KAAK,SAAS;QACpC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YACrC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EAC9F,CAAC;QACD,OAAO,YAAY,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAA;IAC5E,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,YAA0B,EAC1B,MAA0B,EAClB,EAAE,CAAC,CAAC;IACZ,GAAG,MAAM;IACT,GAAG,CAAC,YAAY,CAAC,WAAW,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS;QAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,GAAG,CAAC,YAAY,CAAC,MAAM,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,GAAG,CAAC,YAAY,CAAC,MAAM,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAChG,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,QAAgB,EAChB,SAAuC,EACQ,EAAE;IACjD,MAAM,MAAM,GAAqB;QAC/B,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,QAAQ,CAAC,KAAK;QACzC,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,QAAQ,CAAC,KAAK;QACzC,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM;QAC5C,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO;QAC/C,eAAe,EAAE,SAAS,EAAE,eAAe,IAAI,QAAQ,CAAC,eAAe;QACvE,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM;KAC7C,CAAA;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAC9E,CAAC,CAAA;AAuBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAA0B,EAC1B,aAAiC,EAChB,EAAE;IACnB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC,CAAA;IACrE,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM;QAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACnE,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;AACvE,CAAC,CAAA;AA6DD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CAC7D,CAAC,CAAA;AA0EF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAsC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;AAEpG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,cAAuB,EAAW,EAAE;IACvD,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAA;IAC1C,OAAO,OAAO,CAAC,EAAE,CAAC;QAChB,GAAG,cAAc;QACjB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjC,SAAS,EAAE,CAAC,OAAqB,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBAC9C,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC9D,GAAG,OAAO;oBACV,MAAM,EAAE,YAAY,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC;iBAClE,CAAC,CAAA;YACJ,CAAC;SACF,CAAC;KACH,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,cAAuB,EAAwB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAA;AAEpH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,YAA8B,EAAE,EAAW,EAAE,CACpE,OAAO,CAAC,EAAE,CAAC;IACT,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;IAC/E,GAAG,SAAS;CACb,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,YAA8B,EAAE,EAAwB,EAAE,CAClF,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;AAE7C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAiB,IAAI,YAAY,CAAC;IAC7D,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,gGAAgG;CAC1G,CAAC,CAAA;AAEF,MAAM,OAAO,GAAG,CAAC,YAAoB,EAAU,EAAE;IAC/C,MAAM,KAAK,GAAG,YAAY,GAAG,KAAK,CAAA;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACtF,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,MAAc,EAAmB,EAAE,CAC5E,QAAQ,CAAC,QAAQ,IAAI,oBAAoB,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAiB,EAA0B,EAAE;IACnE,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAChD,2KAA2K;IAC3K,OAAO,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAA;AAChE,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAU,EAAE;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAA;IAC9D,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACtF,CAAC,CAAA;AA4BD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAczB,EAA4D,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IACvB,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC5B,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EACrG,CAAC;gBACD,mEAAmE;gBACnE,qEAAqE;gBACrE,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;gBACtC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;gBACzC,OAAO,CAAC,KAAK,EAAE,CAAA;gBACf,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAA;YAC/B,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACzE,MAAM,OAAO,GAAG,mCAAmC,OAAO,CAAC,MAAM,CAAC,KAAK,aAAa,CAAA;gBACpF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;gBACnB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;gBACtB,OAAO,CAAC,KAAK,EAAE,CAAA;gBACf,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;YAC/D,CAAC;YACD,KAAK,GAAG,KAAK,GAAG,CAAC,CAAA;YACjB,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;YAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,aAAa,CAAC,MAAM,CAAA;YAC7D,wEAAwE;YACxE,wDAAwD;YACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,YAAY;gBACzC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9D,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;oBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;iBAClD,CAAC,CAAA;YACJ,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI;gBAC7C,gEAAgE;gBAChE,mEAAmE;gBACnE,4DAA4D;gBAC5D,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACb,qEAAqE;gBACrE,+DAA+D;gBAC/D,6DAA6D;gBAC7D,MAAM,CAAC,aAAa,CAAC;oBACnB,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;iBAC9D,CAAC,CACH,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACrC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACrB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAClB,CAAC,CAAC,MAAM,CAAC,IAAI;gBACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBACjB,8DAA8D;oBAC9D,+DAA+D;oBAC/D,4DAA4D;oBAC5D,+DAA+D;oBAC/D,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;oBACtC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;oBACzC,OAAO,CAAC,KAAK,EAAE,CAAA;gBACjB,CAAC,CAAC,CACL,CACF,CAAA;YACH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACnB,cAAc,GAAG,IAAI,CAAC,OAAO,CAAA;YAC7B,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;YAChD,OAAO,CAAC,KAAK,EAAE,CAAA;YACf,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAA;QAClC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACpE,qEAAqE;QACrE,0EAA0E;QAC1E,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAA;IACxB,CAAC;AACH,CAAC,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAc,EAAe,EAAE;IAC3D,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AACrE,CAAC,CAAA","sourcesContent":["/**\n * The deterministic script sandbox port.\n *\n * A cell is arbitrary agent-authored JavaScript, so it never runs in the host\n * realm. It runs behind this port, which grants exactly one effectful\n * primitive — flow invocation against the capability-narrowed catalog the run\n * was given — and returns a serializable {@link Cell.Outcome}.\n *\n * The port opens a {@link Realm}, and a realm is the whole surface: it is\n * acquired once per run and every cell of that run is evaluated in it, so a\n * name one cell binds is still bound in the next. There is no per-cell\n * evaluation beside it. One binding ships — `QuickJSSandbox`, the QuickJS-WASM\n * binding that isolates a real separate realm in both Node and browsers — and a\n * composition that offers none is refused with {@link realmUnsupported}.\n *\n * Cancellation is fiber interruption and teardown is scope finalization; a\n * sandbox never installs a host abort signal.\n *\n * @since 0.1.0\n */\n\nimport * as Fault from \"@smthrs/flow/Fault\"\nimport { Context, Effect, Exit, Layer, Schema, type Scope } from \"effect\"\nimport * as Cell from \"./Cell.ts\"\nimport * as CellValidation from \"./CellValidation.ts\"\nimport type { HarnessError } from \"./HarnessError.ts\"\nimport { refusal, timedOut } from \"./internal/refusal.ts\"\nimport type * as VariablesPanel from \"./VariablesPanel.ts\"\n\n/**\n * Stable failures raised by a sandbox binding itself, as opposed to failures\n * of the cell it was asked to run.\n *\n * A cell that throws is a {@link Cell.Raised} outcome, not a sandbox error.\n * These codes describe the sandbox being unable to do its job at all.\n *\n * @category models\n * @since 0.1.0\n * @slop\n */\nexport const SandboxErrorCode = Schema.Literals([\n  \"unavailable\",\n  \"unsupported\",\n  \"runtime_failed\"\n])\n\n/**\n * Stable failures raised by a sandbox binding itself.\n *\n * @category models\n * @since 0.1.0\n * @slop\n */\nexport type SandboxErrorCode = typeof SandboxErrorCode.Type\n\n/**\n * A failure of the sandbox binding.\n *\n * @category errors\n * @since 0.1.0\n * @slop\n */\nexport class SandboxError extends Schema.TaggedError<SandboxError>()(\"flows/harness/SandboxError\", {\n  code: SandboxErrorCode,\n  message: Schema.String,\n  cause: Schema.optional(Schema.Defect())\n}) {}\nFault.register(\n  \"flows/harness/SandboxError\",\n  {\n    unavailable: \"infra\",\n    runtime_failed: \"infra\",\n    unsupported: \"bug\"\n  } satisfies Fault.Rows<SandboxErrorCode>\n)\n\n/**\n * One flow invocation requested from inside a running cell.\n *\n * `ordinal` is the zero-based execution order of the call within the cell. It\n * is the replay anchor: re-executing the same source reaches the same ordinal\n * with the same declaration, which is what lets a settled boundary replay\n * instead of re-running.\n *\n * @category models\n * @since 0.1.0\n * @slop\n */\nexport interface Invocation {\n  readonly ordinal: number\n  readonly flow: string\n  readonly input: Schema.Json\n  /**\n   * Whatever the cell passed as the call's `at` option, undecoded.\n   *\n   * It arrives as the raw JSON the cell wrote rather than as an id because the\n   * boundary, not the realm, decides whether it is a checkpoint: a cell that\n   * passes a string, a failure envelope, or last frame's result gets an\n   * resolved `invalid_input` failure naming what `at` takes. Throwing from inside\n   * the sandbox would lose the calls the cell had already paid for.\n   */\n  readonly at?: Schema.Json | undefined\n}\n\n/**\n * One request to pin the workspace, issued from inside a running cell.\n *\n * It carries only its ordinal because that is the whole of its identity: the\n * cell source and the frame are the boundary's, and the ordinal is what makes\n * the pin land where the cell wrote it. See {@link Minter}.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Mint {\n  readonly ordinal: number\n}\n\n/**\n * Pins the workspace on behalf of a running cell.\n *\n * A mint travels the same queue as a flow call and is settled by the same drive\n * loop, in issue order, one at a time. That ordering is the whole contract:\n * `ctx.checkpoint()` promises the tree as it stands *at the line it is written\n * on*, and the only way a cell can move the tree is by issuing a call, so a\n * queue that settles in issue order pins exactly the tree the cell was looking\n * at. A mint that runs on its own schedule — a side channel, a host callback,\n * anything the queue does not order — would pin whichever tree happened to be\n * there when it got round to it.\n *\n * The result is a {@link Cell.CallResult} like any other, so a host with no\n * store, a run past its checkpoint bound, and a store that failed are all\n * resolved `{ ok: false, error }` refusals rather than teardown.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Minter = (mint: Mint) => Effect.Effect<Cell.CallResult, HarnessError>\n\n/**\n * The refusal a binding answers `ctx.checkpoint()` with when the caller wired\n * no minter.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const mintUnavailable: Minter = () =>\n  Effect.succeed(\n    refusal(\"checkpoint_unavailable\", \"This run pins no checkpoints.\")\n  )\n\n/**\n * Resolves one invocation on behalf of a running cell.\n *\n * A {@link Cell.CallResult} of `failure` resolves in the cell as\n * `{ ok: false, error }`, where `error` contains `code`, `message`, and `hint`;\n * it does not throw. Success resolves with the flow's own value, unwrapped.\n * Branch on `.ok === false` and `.error.code` to recover. For a flow whose\n * successful result has a `stdout` field, a cell can retry a timed-out call:\n *\n * ```ts\n * let result = await ctx.call(\"bash\", { command: \"find . -name '*.ts'\" })\n * if (result.ok === false && result.error.code === \"timeout\") {\n *   result = await ctx.call(\"bash\", { command: \"find src -name '*.ts'\" })\n * }\n * console.log(result.ok === false ? result.error.code : result.stdout)\n * ```\n *\n * Anything the cell must not observe, such as a permission park, an abort,\n * or an engine failure, travels in the effect's error channel and tears the\n * cell down.\n *\n * @category models\n * @since 0.1.0\n * @slop\n */\nexport type Handler = (\n  invocation: Invocation\n) => Effect.Effect<Cell.CallResult, HarnessError>\n\n/**\n * Realm memory ceiling and default execution limits for its evaluations.\n *\n * Bindings fill every ceiling they can enforce from {@link defaultLimits} when\n * the caller omits it. A binding that cannot honour an explicitly requested\n * limit fails with `unsupported` rather than silently ignoring it.\n *\n * @category models\n * @since 0.1.0\n * @slop\n */\nexport interface Limits {\n  /**\n   * Maximum number of flow calls one cell may make; a non-negative safe integer.\n   * A checkpoint mint settles on the same channel and counts against this budget.\n   */\n  readonly calls?: number | undefined\n  /** Maximum sandbox heap, in bytes; at least {@link minimumMemoryBytes}. */\n  readonly memoryBytes?: number | undefined\n  /**\n   * Maximum interpreter steps before the cell is stopped.\n   *\n   * A step is one interrupt check, not one bytecode operation: an interpreter\n   * polls its budget periodically, so this bounds work rather than counting\n   * individual operations. The limit is a safe integer of at least\n   * {@link minimumSteps}.\n   */\n  readonly steps?: number | undefined\n  /**\n   * Maximum cell-compute time in milliseconds; a safe integer of at least\n   * {@link minimumTimeMs}.\n   *\n   * This bounds the cell's own JavaScript execution. Time spent suspended in\n   * an outstanding `ctx.call` or `ctx.checkpoint()` does not count: host work\n   * belongs to the boundary that runs it, and charging it here rejected every cell that\n   * awaited a real test run — 57 of the 62 rejected frames in the first\n   * SWE-bench benchmark were legitimate long `bash` calls hitting this clock.\n   */\n  readonly timeMs?: number | undefined\n  /**\n   * Maximum whole-evaluation time in milliseconds, host calls included; a\n   * non-negative safe integer.\n   *\n   * The backstop for a host call that never settles. Generous on purpose: a\n   * cell awaiting a ten-minute test suite is working, not stuck.\n   */\n  readonly totalMs?: number | undefined\n  /** Flow names whose pending call time does not spend the frame backstop. */\n  readonly pauseTotalMsFor?: ReadonlyArray<string> | undefined\n  /**\n   * Maximum wall-clock time one flow call may take, in milliseconds; a\n   * non-negative safe integer.\n   *\n   * The per-call budget {@link totalMs} cannot supply. `totalMs` is the frame's\n   * last resort, and a call that overruns it takes the whole frame down with a\n   * `limit_exceeded` rejection the model never sees as an answer: on the\n   * SWE-bench django instance one broad `grep` held its cell for the entire\n   * 900,000 ms ceiling, 75% of a 1,204-second run. This ceiling settles that\n   * same call as an ordinary resolved failure instead, so the cell observes a\n   * timeout it can narrow and retry inside the frame it is already in.\n   */\n  readonly callMs?: number | undefined\n}\n\n/**\n * Per-frame overrides of a realm's opening limits. Omitted or undefined fields\n * inherit the realm defaults. The memory ceiling remains fixed for the run.\n *\n * @category models\n * @since 0.1.0\n */\nexport type EvaluationLimits = Omit<Limits, \"memoryBytes\">\n\n/**\n * Which limits a binding can actually enforce.\n *\n * @category models\n * @since 0.1.0\n * @slop\n */\nexport interface Capabilities {\n  readonly calls: boolean\n  readonly memoryBytes: boolean\n  readonly steps: boolean\n  readonly timeMs: boolean\n}\n\n/**\n * The execution ceilings a cell runs under when the caller declares none.\n *\n * Agent-authored source must never acquire an unbounded frame merely because a\n * host omitted configuration. These values are deliberately generous for a\n * cell, whose work is choosing flow calls and shaping JSON between them. There\n * is no spelling for \"no ceiling\": a host that needs more raises the relevant\n * finite value explicitly.\n *\n * @category constants\n * @since 0.1.0\n * @slop\n */\nexport const defaultLimits = Object.freeze({\n  calls: 64,\n  memoryBytes: 128 * 1024 * 1024,\n  steps: 1000,\n  timeMs: 30_000,\n  totalMs: 900_000,\n  callMs: 120_000\n})\n\n/**\n * Smallest interpreter-step budget a binding can enter a realm under.\n *\n * A zero budget interrupts the binding's own scaffolding before any cell source\n * runs, which escapes as a crash rather than a ceiling report, so the sandbox\n * boundary refuses it as `unsupported`.\n *\n * @category constants\n * @since 1.0.0-rc.0\n */\nexport const minimumSteps = 1\n\n/**\n * Smallest wall-clock budget, in milliseconds, a binding can enter a realm under.\n *\n * A zero budget interrupts the binding's own scaffolding before any cell source\n * runs, which escapes as a crash rather than a ceiling report, so the sandbox\n * boundary refuses it as `unsupported`.\n *\n * @category constants\n * @since 1.0.0-rc.0\n */\nexport const minimumTimeMs = 1\n\n/**\n * Smallest heap ceiling the QuickJS binding can initialize and tear down\n * safely.\n *\n * QuickJS needs space for its runtime and context before cell source runs.\n * Lower ceilings can leave a partially initialized context that aborts during\n * disposal, so they are refused at the sandbox boundary.\n *\n * @category constants\n * @since 0.1.0\n * @slop\n */\nexport const minimumMemoryBytes = 1024 * 1024\n\n// The print-channel budgets live with the channel that spends them, and are\n// re-exported here because a host reads them to size what it prints.\nexport { printFrameBytes, printRetainedBytes, printStatementFloor } from \"./internal/printChannel.ts\"\n\nconst invalidLimit = (name: keyof Limits, requirement: string): SandboxError =>\n  new SandboxError({\n    code: \"unsupported\",\n    message: `The ${name} limit must be ${requirement}`\n  })\n\n/** Validates caller-supplied numeric limits before a binding is entered. */\nconst validateLimits = (limits: Limits | undefined): SandboxError | undefined => {\n  if (limits === undefined) return undefined\n\n  for (const name of [\"calls\", \"totalMs\", \"callMs\"] as const) {\n    const value = limits[name]\n    if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {\n      return invalidLimit(name, \"a non-negative safe integer\")\n    }\n  }\n\n  for (const [name, minimum] of [[\"steps\", minimumSteps], [\"timeMs\", minimumTimeMs]] as const) {\n    const value = limits[name]\n    if (value !== undefined && (!Number.isSafeInteger(value) || value < minimum)) {\n      return invalidLimit(name, `a safe integer of at least ${minimum}`)\n    }\n  }\n\n  if (\n    limits.memoryBytes !== undefined &&\n    (!Number.isSafeInteger(limits.memoryBytes) || limits.memoryBytes < minimumMemoryBytes)\n  ) {\n    return invalidLimit(\n      \"memoryBytes\",\n      `a safe integer of at least ${minimumMemoryBytes} bytes`\n    )\n  }\n\n  if (\n    limits.pauseTotalMsFor !== undefined &&\n    (!Array.isArray(limits.pauseTotalMsFor) ||\n      limits.pauseTotalMsFor.some((name) => typeof name !== \"string\" || name.trim().length === 0))\n  ) {\n    return invalidLimit(\"pauseTotalMsFor\", \"an array of non-empty flow names\")\n  }\n\n  return undefined\n}\n\n/**\n * Fills omitted ceilings from {@link defaultLimits} for limits a binding can\n * enforce.\n *\n * Capability gating applies only to defaults. An explicit unsupported limit is\n * passed through so the binding can refuse it instead of silently widening the\n * caller's authority.\n *\n * @category constructors\n * @since 0.1.0\n * @slop\n */\nexport const withDefaults = (\n  capabilities: Capabilities,\n  limits: Limits | undefined\n): Limits => ({\n  ...limits,\n  ...(capabilities.memoryBytes && limits?.memoryBytes === undefined\n    ? { memoryBytes: defaultLimits.memoryBytes }\n    : {}),\n  ...(capabilities.steps && limits?.steps === undefined ? { steps: defaultLimits.steps } : {}),\n  ...(capabilities.calls && limits?.calls === undefined ? { calls: defaultLimits.calls } : {}),\n  ...(capabilities.timeMs && limits?.timeMs === undefined ? { timeMs: defaultLimits.timeMs } : {}),\n  ...(capabilities.timeMs && limits?.totalMs === undefined ? { totalMs: defaultLimits.totalMs } : {}),\n  // Gated on `calls` rather than on `timeMs`: the per-call budget is enforced\n  // by the shared drive loop, which is exactly the loop a binding that queues\n  // flow calls runs, and not by the interpreter clock `timeMs` describes.\n  ...(capabilities.calls && limits?.callMs === undefined ? { callMs: defaultLimits.callMs } : {})\n})\n\n/**\n * Merges and validates one frame's limits without changing the realm defaults.\n * Only per-frame ceilings can be overridden; memory belongs to the realm.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const evaluationLimits = (\n  defaults: Limits,\n  overrides: EvaluationLimits | undefined\n): Effect.Effect<EvaluationLimits, SandboxError> => {\n  const limits: EvaluationLimits = {\n    calls: overrides?.calls ?? defaults.calls,\n    steps: overrides?.steps ?? defaults.steps,\n    timeMs: overrides?.timeMs ?? defaults.timeMs,\n    totalMs: overrides?.totalMs ?? defaults.totalMs,\n    pauseTotalMsFor: overrides?.pauseTotalMsFor ?? defaults.pauseTotalMsFor,\n    callMs: overrides?.callMs ?? defaults.callMs\n  }\n  const invalid = validateLimits(limits)\n  return invalid === undefined ? Effect.succeed(limits) : Effect.fail(invalid)\n}\n\n/**\n * What a REPL cell asked the controller to do.\n *\n * A cell runs as a global async script in a persistent realm. Top-level\n * `await` is supported; top-level `return` is invalid. The first `ctx.done`\n * or `ctx.park` that records an intent seals the frame. Later `ctx.done` and\n * `ctx.park` calls do nothing. Ordinary JavaScript continues running, but later\n * `ctx.call` and `ctx.checkpoint` calls resolve with a `run_completed` failure\n * envelope without dispatching host work.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Intent =\n  | { readonly _tag: \"Done\"; readonly output: string; readonly value?: Schema.Json | undefined }\n  | {\n    readonly _tag: \"Park\"\n    readonly reason: \"waiting-input\" | \"waiting-event\" | \"waiting-quota\"\n    readonly message: string\n  }\n\n/**\n * Builds the durable transition one cell settled.\n *\n * A cell states its intent by calling, so this is the only place a\n * {@link Cell.Transition} is constructed. The realm is the run's memory and the\n * print buffer is what the next turn reads, so nothing is filed on the way out:\n * the transition carries only the current intent.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const replTransition = (\n  intent: Intent | undefined,\n  justification: string | undefined\n): Cell.Transition => {\n  if (intent === undefined) return new Cell.Continue({ justification })\n  return intent._tag === \"Done\"\n    ? new Cell.Complete({ output: intent.output, value: intent.value })\n    : new Cell.Park({ reason: intent.reason, message: intent.message })\n}\n\n/**\n * One cell evaluated inside a realm that outlives it.\n *\n * `frame` names the evaluation for the realm's own stack traces, so a throw\n * reported in frame 7 says which cell threw.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface RealmEvaluation {\n  /** Reconstruct a timed-out frame only through its recorded bridge prefix. */\n  readonly replay?: { readonly boundary: typeof FrameBoundary.Type; readonly outcome: Cell.Outcome } | undefined\n  /** Replaces ctx.flows with this frame's frozen catalog; omitted keeps the current catalog. */\n  readonly flows?: Readonly<Record<string, Cell.FlowProjection>> | undefined\n  readonly cell: Cell.Source\n  /**\n   * The program the controller's boundary parse already compiled from `cell`.\n   *\n   * A binding evaluates this verbatim when it is present, because the parse it\n   * would do is the parse the boundary already did: a controller runs\n   * {@link compile} before it commits a frame, so a binding that parses the\n   * cell again parses every cell of the run twice. Omitted means the binding\n   * compiles the cell itself, which is what a host driving a realm directly\n   * does.\n   */\n  readonly program?: string | undefined\n  readonly frame: number\n  readonly call: Handler\n  /**\n   * Settles a `ctx.checkpoint()` issued by this cell.\n   *\n   * Optional, and absent means the caller pins no trees — which the cell is\n   * told through a resolved failure envelope at the line it asked. It is a\n   * separate collaborator from `call` because a checkpoint is not a flow:\n   * it is neither in the catalog nor\n   * subject to the capability envelope, and the run's own bound on how many\n   * trees it may pin is the controller's, not any flow's.\n   */\n  readonly mint?: Minter | undefined\n  /**\n   * Whether the caller bounds each settlement itself.\n   *\n   * The loop's own {@link Limits.callMs} ceiling is a clock race it synthesizes\n   * a failure from, and that failure is journaled nowhere: the call it\n   * interrupted never settled, so nothing downstream holds a result for it. A\n   * re-executed cell runs the same call again against a world that has moved\n   * on, gets an answer this time, and takes a branch the original attempt never\n   * took — with every irreversible effect below the fork bought twice.\n   *\n   * A caller that journals its settlements applies the same ceiling itself, in\n   * front of the boundary that records what the ceiling produced, and sets this\n   * so the loop adds none of its own — because two clocks racing one call means\n   * the unrecorded one wins: the loop's starts first.\n   */\n  readonly bounded?: boolean | undefined\n  /** Validated overrides for this frame only; memory is fixed when the realm opens. */\n  readonly limits?: EvaluationLimits | undefined\n}\n\n/**\n * The bridge frontier at a frame limit. Ordinals are zero-based;\n * minus one means no dispatch or settlement occurred. A dispatched call may\n * have been interrupted before its settlement was delivered to JavaScript.\n * `timeout` requires truncating replay; `settled` identifies a limit the\n * interpreter completed itself, such as its step or call budget.\n *\n * @category schemas\n * @since 0.1.0\n */\nexport const FrameBoundary = Schema.Struct({\n  terminal: Schema.Literals([\"timeout\", \"settled\"]),\n  dispatched: Schema.Int.check(Schema.isGreaterThanOrEqualTo(-1)),\n  settled: Schema.Int.check(Schema.isGreaterThanOrEqualTo(-1))\n})\n\n/**\n * Everything one REPL frame produced.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface RealmFrame {\n  /** Present when evaluation ended at a frame limit. */\n  readonly boundary?: typeof FrameBoundary.Type | undefined\n  readonly outcome: Cell.Outcome\n  /** What the cell printed, already bounded; empty when it printed nothing. */\n  readonly prints: string\n  /** Every name the realm holds after the cell ran. */\n  readonly bindings: ReadonlyArray<VariablesPanel.Binding>\n}\n\n/**\n * A JavaScript realm that persists across the cells of one run.\n *\n * Teardown is scope closure, so a realm is acquired by the loop that uses it and\n * cancellation is still fiber interruption.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface Realm {\n  readonly evaluate: (\n    evaluation: RealmEvaluation\n  ) => Effect.Effect<RealmFrame, SandboxError | HarnessError>\n}\n\n/**\n * The initial catalog and limits a realm is opened with.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface RealmOptions {\n  readonly flows: Readonly<Record<string, Cell.FlowProjection>>\n  /**\n   * The ceilings the realm enforces. `memoryBytes` becomes a **run** budget once\n   * a realm outlives a cell, judged at each frame's start against what the\n   * realm's own names weigh; a frame that opens over it runs nothing and is told\n   * which names to free. Every other ceiling stays per-frame, because they are\n   * counters the interrupt handler reads rather than properties of the runtime.\n   */\n  readonly limits?: Limits | undefined\n}\n\n/**\n * The deterministic script sandbox.\n *\n * @category services\n * @since 0.1.0\n * @slop\n */\nexport interface Sandbox {\n  readonly capabilities: Capabilities\n  /**\n   * Opens the realm the run's cells share.\n   *\n   * Absent on a binding that has no persistent realm to offer, which is what a\n   * host composing such a binding is told when the run opens rather than in the\n   * middle of a frame. A realm is the only way a cell runs: there is no\n   * per-frame evaluation beside it, because a cell that could not see what the\n   * cell before it bound was the surface this harness deleted.\n   */\n  readonly openRealm?: (\n    options: RealmOptions\n  ) => Effect.Effect<Realm, SandboxError, Scope.Scope>\n}\n\n/**\n * Context service for the selected sandbox binding.\n *\n * @category services\n * @since 0.1.0\n * @slop\n */\nexport const Sandbox: Context.Service<Sandbox, Sandbox> = Context.Service(\"@smthrs/harness/Sandbox\")\n\n/**\n * Constructs a sandbox from an implementation.\n *\n * @category constructors\n * @since 0.1.0\n * @slop\n */\nexport const make = (implementation: Sandbox): Sandbox => {\n  const openRealm = implementation.openRealm\n  return Sandbox.of({\n    ...implementation,\n    ...(openRealm === undefined ? {} : {\n      openRealm: (options: RealmOptions) => {\n        const invalid = validateLimits(options.limits)\n        return invalid !== undefined ? Effect.fail(invalid) : openRealm({\n          ...options,\n          limits: withDefaults(implementation.capabilities, options.limits)\n        })\n      }\n    })\n  })\n}\n\n/**\n * Provides a sandbox implementation.\n *\n * @category layers\n * @since 0.1.0\n * @slop\n */\nexport const layer = (implementation: Sandbox): Layer.Layer<Sandbox> => Layer.succeed(Sandbox)(make(implementation))\n\n/**\n * Constructs an unavailable sandbox stub, optionally overriding operations.\n *\n * It offers no realm, which is what a run composed against it is told: see\n * {@link realmUnsupported}.\n *\n * @category constructors\n * @since 0.1.0\n * @slop\n */\nexport const makeNoop = (overrides: Partial<Sandbox> = {}): Sandbox =>\n  Sandbox.of({\n    capabilities: { calls: false, memoryBytes: false, steps: false, timeMs: false },\n    ...overrides\n  })\n\n/**\n * Provides an unavailable sandbox stub.\n *\n * @category layers\n * @since 0.1.0\n * @slop\n */\nexport const layerNoop = (overrides: Partial<Sandbox> = {}): Layer.Layer<Sandbox> =>\n  Layer.succeed(Sandbox)(makeNoop(overrides))\n\n/**\n * Refuses a run on a binding that has no persistent realm.\n *\n * Stated rather than silently downgraded: a realm is the whole surface, so a\n * binding without one cannot run a cell at all and saying so at the open is the\n * only honest answer.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const realmUnsupported: SandboxError = new SandboxError({\n  code: \"unsupported\",\n  message: \"This sandbox has no persistent realm, so it cannot run a cell loop; select the QuickJS binding\"\n})\n\nconst seconds = (milliseconds: number): string => {\n  const value = milliseconds / 1_000\n  return Number.isInteger(value) ? String(value) : value.toFixed(3).replace(/0+$/, \"\")\n}\n\n/**\n * Settles one overrunning flow call as a resolved failure envelope in the cell.\n *\n * The message is written for the model, because the model is who reads it: it\n * names the flow, the budget it spent, and the one action that recovers the\n * frame. A rejection at the whole-evaluation ceiling teaches the model nothing\n * — the frame is already gone by the time it could act.\n *\n * Exported so a caller that bounds its own settlements\n * ({@link RealmEvaluation.bounded}) synthesizes the same refusal the loop would\n * have: one ceiling means one sentence, whichever clock enforced it.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const callTimedOut = (flow: string, callMs: number): Cell.CallResult =>\n  timedOut(`Flow ${flow} timed out after ${seconds(callMs)} seconds.`, callMs)\n\n/**\n * Erases type-only syntax from a cell without evaluating or resolving modules.\n *\n * Only Node's strip-safe TypeScript subset is accepted. Constructs that need\n * JavaScript emit are refused instead of being silently transformed into new\n * runtime behaviour.\n *\n * The parse itself belongs to `CellValidation`, which the controller already\n * runs at the boundary before it commits a frame; this is the same answer, for\n * a binding that only needs the program or the reason there is none.\n *\n * @category conversions\n * @since 0.1.0\n * @slop\n */\nexport const compile = (cell: Cell.Source): string | Cell.Rejected => {\n  const validation = CellValidation.validate(cell)\n  /* v8 ignore next -- `validate` returns exactly one of the two, so the coalesce never reaches its fallback; it only discharges the optional types the interface declares */\n  return validation.rejected ?? validation.compiled ?? cell.text\n}\n\n/**\n * Renders a thrown non-`Error` as the value it is.\n *\n * `String(value)` on an object is `[object Object]`, which is the single\n * defect PROGRAM change 1 names verbatim: a run that threw a structured value\n * was told nothing about it and spent a frame going back for the same value.\n * Anything JSON can hold is rendered as JSON; anything it cannot — a symbol, a\n * function — keeps `String`, which is the only faithful thing left.\n *\n * @private\n */\nconst describe = (value: unknown): string => {\n  const decoded = Schema.decodeUnknownResult(Schema.Json)(value)\n  return decoded._tag === \"Success\" ? Cell.renderText(decoded.success) : String(value)\n}\n\n/**\n * A queued call awaiting resolution by a binding's driver.\n *\n * @category models\n * @since 0.1.0\n * @slop\n */\nexport interface PendingCall {\n  readonly ordinal: number\n  readonly flow: string\n  readonly input: Schema.Json\n  /** Undecoded `at` option; see {@link Invocation.at}. */\n  readonly at?: Schema.Json | undefined\n  /**\n   * Whether this entry is a flow call or a request to pin the tree.\n   *\n   * Both ride one queue because both have to be ordered against each other: a\n   * mint that overtook an edit, or an edit that overtook a mint, would pin the\n   * wrong tree. Absent means `call`, so every binding that queues an ordinary\n   * call is unchanged.\n   */\n  readonly kind?: \"call\" | \"checkpoint\" | undefined\n  readonly settle: (result: Cell.CallResult) => void\n  readonly abort: (message: string) => void\n}\n\n/**\n * Drives one externally compiled cell to settlement: settle queued calls one at\n * a time, in the order the cell issued them, until the cell settles.\n *\n * One at a time is deliberate. Data-dependent calls are the normal case, and a\n * deterministic execution ordinal is what makes a mid-cell crash replayable.\n *\n * Bindings differ only in how a cell is compiled and how its promises are\n * settled, so the interleaving lives here once rather than in each of them.\n *\n * @category constructors\n * @since 0.1.0\n * @slop\n */\nexport const driveCell = (options: {\n  readonly replay?: RealmEvaluation[\"replay\"]\n  readonly progress?: ((dispatched: number, settled: number) => void) | undefined\n  readonly pending: Array<PendingCall>\n  /** Called after each resolved call so a binding may flush its job queue. */\n  readonly flush: () => void\n  readonly finished: () => Cell.Outcome | undefined\n  readonly abort: (message: string) => void\n  readonly handler: Handler\n  /** Settles a `ctx.checkpoint()`; omitted means the run pins none. */\n  readonly mint?: Minter | undefined\n  /** Whether the caller bounds each settlement itself; see {@link RealmEvaluation.bounded}. */\n  readonly bounded?: boolean | undefined\n  readonly limits?: Limits | undefined\n}): Effect.Effect<Cell.Outcome, SandboxError | HarnessError> =>\n  Effect.gen(function*() {\n    let calls = 0\n    let settledOrdinal = -1\n    for (;;) {\n      const next = options.pending.shift()\n      if (next !== undefined) {\n        if (\n          options.replay !== undefined &&\n          (next.ordinal > options.replay.boundary.settled || next.ordinal > options.replay.boundary.dispatched)\n        ) {\n          // Match interruption cleanup without delivering an answer that the\n          // original cell never received. This also covers queued checkpoints.\n          next.abort(\"The cell was interrupted\")\n          options.abort(\"The cell was interrupted\")\n          options.flush()\n          return options.replay.outcome\n        }\n        if (options.limits?.calls !== undefined && calls >= options.limits.calls) {\n          const message = `This cell exceeded its limit of ${options.limits.calls} flow calls`\n          next.abort(message)\n          options.abort(message)\n          options.flush()\n          return new Cell.Rejected({ code: \"limit_exceeded\", message })\n        }\n        calls = calls + 1\n        options.progress?.(next.ordinal, settledOrdinal)\n        const callMs = options.limits?.callMs ?? defaultLimits.callMs\n        // A mint is settled here rather than on a channel of its own so that it\n        // is ordered against the calls around it. See `Minter`.\n        const settling = next.kind === \"checkpoint\"\n          ? (options.mint ?? mintUnavailable)({ ordinal: next.ordinal })\n          : options.handler({\n            ordinal: next.ordinal,\n            flow: next.flow,\n            input: next.input,\n            ...(next.at === undefined ? {} : { at: next.at })\n          })\n        const result = yield* (options.bounded === true\n          // The caller bounds its own settlements, inside the boundary it\n          // journals them under. Racing a second clock here would settle the\n          // call from the one reading nothing records. See `bounded`.\n          ? settling\n          : settling.pipe(\n            // The per-call ceiling, ahead of the interrupt cleanup below: a call\n            // that overruns is answered, not abandoned, so the cell sees a\n            // resolved failure and the frame keeps its remaining budget.\n            Effect.timeoutOrElse({\n              duration: callMs,\n              orElse: () => Effect.succeed(callTimedOut(next.flow, callMs))\n            })\n          )).pipe(\n            Effect.flatMap(Cell.decodeCallResult),\n            Effect.onExit((exit) =>\n              Exit.isSuccess(exit)\n                ? Effect.void\n                : Effect.sync(() => {\n                  // `next` was shifted out of `pending` before the handler ran.\n                  // Settle that active bridge as well as calls queued behind it,\n                  // then flush the VM so a scoped runtime has no live promise\n                  // handles when a permission park or engine failure unwinds it.\n                  next.abort(\"The cell was interrupted\")\n                  options.abort(\"The cell was interrupted\")\n                  options.flush()\n                })\n            )\n          )\n        next.settle(result)\n        settledOrdinal = next.ordinal\n        options.progress?.(next.ordinal, settledOrdinal)\n        options.flush()\n        continue\n      }\n      const outcome = options.finished()\n      if (outcome !== undefined) return yield* Cell.decodeOutcome(outcome)\n      // Nothing is queued and the cell has not settled: hand the runtime a\n      // yield point so a peer fiber and an interrupt are both still observable.\n      yield* Effect.yieldNow\n    }\n  })\n\n/**\n * Projects a thrown value into a stable serializable cell outcome.\n *\n * @category conversions\n * @since 0.1.0\n * @slop\n */\nexport const raisedOutcome = (error: unknown): Cell.Raised => {\n  if (error instanceof Error) {\n    return new Cell.Raised({ name: error.name, message: error.message })\n  }\n  return new Cell.Raised({ name: \"Error\", message: describe(error) })\n}\n"]}