@systemfsoftware/effect-cell-types 1.0.1

package/LICENSE

@@ -0,0 +1,203 @@
+Copyright (c) 2026 Ryan Lee (systemfsoftware)
+
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Ryan Lee (systemfsoftware)
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,215 @@
+# @systemfsoftware/effect-cell-types
+
+The type-level contract for a `*.workflow.ts` cell. A workflow is a pure decision — a command in, a `Result` out — and `Workflow<Command, Decision, Error>` pins that shape in the type system. The contract is checked by `tsc` from the file's **content** (an exported value that violates the shape stops the build), not by a lint rule keyed on the file's **name**. Beside the types the package ships exactly one runtime value — the identity constructor `make` — and the type tests (`test-types/Workflow.tst.ts`, run by tstyche) prove the channel guards still bind.
+
+## The contract
+
+```ts
+import type { Workflow } from '@systemfsoftware/effect-cell-types'
+
+type Decide = Workflow<Command, Decision, Error>
+//          = ((command: Command) => Result<Decision, Error>) & WorkflowBrand
+```
+
+When both channels are inhabited, `Workflow<Command, Decision, Error>` is the function type
+`(command: Command) => Result<Decision, Error>` carrying the nominal `WorkflowBrand`
+conjunct — a phantom readonly TypeId-keyed field that no runtime property backs. The brand
+is what makes the workbook nominal: `Workflow.make` is the only constructor that applies
+it, and every surface that runs a decision — `Cell.decide` and the `DecidePhase` it
+demands — requires it, so a decision that skipped `make` is a compile error at the call
+site that would have run it, with the brand named in the diagnostic. A `never` channel does
+not silently collapse to that function: it resolves to a marker interface that no function
+can satisfy, so the mistake is a compile error with the remediation attached (below).
+
+## The constructor
+
+Executors build a workflow from a plain decider with `make` — runtime identity, one cast across the branded return:
+
+```ts
+import { make } from '@systemfsoftware/effect-cell-types'
+import { Result } from 'effect'
+
+export const decide = make<DecideInput, RestartDecision, RestartDecisionExhausted>(
+  (
+    input,
+  ) => (input.exitSuccess
+    ? Result.succeed(new RestartDecisionContinue())
+    : Result.fail(new RestartDecisionExhausted())),
+)
+```
+
+The parameter is the plain function type, not `Workflow<C, D, E>`: the `never`-channel conditional lives on the **return** type, so a total decision (`Result<Decision, never>`) resolves to `UninhabitedError` and the call site fails with "This expression is not callable", while a `Promise`- or bare-value-returning decider is rejected at the argument. `make` is a runtime value, so consumers need it as an ordinary import only where they construct workflows; everywhere else `import type` still erases at compile time.
+
+## Worked example
+
+`decideRestart` in `@systemfsoftware/effect-daemon-spec` (`src/internal/restart-decision.workflow.ts`) is the real consumer — a supervisor deciding what to do when a child exits. The sibling schema file, which defines `DecideInput` and `RestartStrategy`, is elided here.
+
+```ts
+import { Workflow } from '@systemfsoftware/effect-cell-types'
+import { Result } from 'effect'
+import * as Match from 'effect/Match'
+import * as S from 'effect/Schema'
+
+const RestartDecisionTypeId: unique symbol = Symbol.for(
+  '@systemfsoftware/effect-daemon/RestartDecision',
+)
+type RestartDecisionTypeId = typeof RestartDecisionTypeId
+
+export class RestartDecisionContinue extends S.TaggedClass<RestartDecisionContinue>()('Continue', {}) {
+  readonly [RestartDecisionTypeId] = RestartDecisionTypeId
+}
+
+export class RestartDecisionRestart extends S.TaggedClass<RestartDecisionRestart>()('Restart', {
+  indices: S.NonEmptyArray(S.Int),
+}) {
+  readonly [RestartDecisionTypeId] = RestartDecisionTypeId
+}
+
+export class RestartDecisionExhausted extends S.TaggedError<RestartDecisionExhausted>()('Exhausted', {}) {
+  readonly [RestartDecisionTypeId] = RestartDecisionTypeId
+}
+
+const restartIndicesFor = (
+  strategy: RestartStrategy,
+  failedIndex: number,
+  total: number,
+): readonly [number, ...readonly number[]] =>
+  Match.value(strategy).pipe(
+    Match.when('one_for_one', () => [failedIndex] as const),
+    Match.when(
+      'one_for_all',
+      () => [0, ...Array.from({ length: Math.max(0, total - 1) }, (_, i) => i + 1)] as const,
+    ),
+    Match.when(
+      'rest_for_one',
+      () =>
+        [
+          failedIndex,
+          ...Array.from({ length: Math.max(0, total - failedIndex - 1) }, (_, i) => failedIndex + 1 + i),
+        ] as const,
+    ),
+    Match.exhaustive,
+  )
+
+export const decideRestart = Workflow.make(
+  (input: DecideInput): Result.Result<
+    RestartDecisionContinue | RestartDecisionRestart,
+    RestartDecisionExhausted
+  > =>
+    Match.value(input).pipe(
+      Match.when({ exitSuccess: true }, () => Result.succeed(new RestartDecisionContinue())),
+      Match.when(
+        { exitSuccess: false, intensityExceeded: true },
+        () => Result.fail(new RestartDecisionExhausted()),
+      ),
+      Match.orElse(() =>
+        Result.succeed(
+          new RestartDecisionRestart({
+            indices: restartIndicesFor(input.strategy, input.failedIndex, input.totalChildren),
+          }),
+        )
+      ),
+    ),
+)
+```
+
+The shape to copy: one exported decision built by `Workflow.make`, whose body returns
+`Result` values via `Result.succeed` and `Result.fail`. The constructor infers the channels
+from the annotated return and is the only door to the `WorkflowBrand` conjunct — annotating
+a function `Workflow<…>` directly is now refused wherever the brand is demanded, because a
+workflow that never passed through `make` is not a decision anything may run. The error
+channel is a real variant (`RestartDecisionExhausted`) — giving up is a decision the caller
+must branch on, so declaring the error channel `never` is rejected, not allowed.
+
+## What it rejects at compile time
+
+All five violations fail `tsc`; the messages below are what `tsc` reports (verified against this package and `effect@4.0.0-rc.108`).
+
+| Violation                              | `tsc` reports                                                                             | Why it is rejected                                                                                                         |
+| -------------------------------------- | ----------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| A `Promise` return                     | `Type 'Promise<Decision>' is not assignable to type 'Result<Decision, Err>'`              | a workflow is a synchronous pure decision; async work belongs in the executor shell around it                              |
+| An `Effect` return                     | `Type 'Effect<Decision, never, never>' is not assignable to type 'Result<Decision, Err>'` | the workflow returns a value, not an effect handle; the executor runs effects and hands the workflow its input             |
+| `never` decision channel               | `Type '...' is not assignable to type 'UninhabitedDecision'`                              | a workflow that can never produce a decision can never succeed                                                             |
+| `never` error channel                  | `Type '...' is not assignable to type 'UninhabitedError'`                                 | a workflow that cannot fail decides nothing; move it to a `*.kernel.ts`                                                    |
+| A bare decider handed to `Cell.decide` | `Type '(command: Cmd) => Result<Dec, Err>' is not assignable to type 'WorkflowBrand'`     | only a `Workflow.make` value satisfies `DecidePhase`; a lambda that skipped `make` is not a decision a description may run |
+
+The two `never` cases are where the content-vs-filename distinction pays off. `Workflow<C, never, E>` resolves to `UninhabitedDecision` and `Workflow<C, D, never>` to `UninhabitedError` — interfaces whose only property is required and whose _type_ is the remediation, so the compile error points at the fix:
+
+```ts
+export interface UninhabitedDecision {
+  readonly __WORKFLOW_DECISION_CHANNEL_IS_NEVER__:
+    'this workflow can never succeed; give it a decision variant it can return'
+}
+
+export interface UninhabitedError {
+  readonly __WORKFLOW_ERROR_CHANNEL_IS_NEVER__:
+    'this workflow cannot fail, so it decides nothing; give it an error variant or move it to a *.kernel.ts'
+}
+```
+
+The `never` checks use `[Decision] extends [never]`, not `Decision extends never`: the tuple wrap stops conditional-type distribution, without which `never` satisfies the conditional vacuously and the marker is never reached.
+
+## Result.gen bodies work — and are checked more tightly
+
+A `Workflow.make` body may be a `Result.gen` generator, so long as it stays one path:
+the failing outcome rides an arm of an exhaustive dispatch, and the generator yields
+the outcome once:
+
+```ts
+import { Workflow } from '@systemfsoftware/effect-cell-types'
+import { Result } from 'effect'
+import * as Match from 'effect/Match'
+
+class Decision {}
+class Err {
+  constructor(readonly reason: string) {}
+}
+interface Input {
+  readonly valid: boolean
+}
+
+const decide = Workflow.make(
+  (input: Input): Result.Result<Decision, Err> =>
+    Result.gen(function*() {
+      const outcome = Match.value(input).pipe(
+        Match.when({ valid: false }, () => Result.fail(new Err('invalid input'))),
+        Match.orElse(() => Result.succeed(new Decision())),
+      )
+      return yield* outcome
+    }),
+)
+```
+
+A conditional `yield*` — an `if` or ternary that places a failing `yield*` on one path —
+opens a second path inside the decision and is refused by the `make-body-purity` lint
+rule; the failure must live on one path of the dispatch (or a first-statement guard that
+converges immediately), never behind a mid-body branch.
+
+`Result.gen` infers its error channel from the union of the `Result`s the body yields,
+so the failing arm above makes the inference exactly `Err` and the declaration holds. A
+body with **no** failing yield infers `unknown`, which does not satisfy a declared error
+type — so an unreachable error channel is rejected rather than silently allowed:
+
+```ts
+const decide = Workflow.make(
+  (input: Input): Result.Result<Decision, Err> =>
+    Result.gen(function*() {
+      return new Decision()
+    }),
+)
+// tsc: Type 'Result<Decision, unknown>' is not assignable to type 'Result<Decision, Err>'
+```
+
+If the workflow genuinely cannot fail, the error channel says so — and that is a `*.kernel.ts`, not a workflow.
+
+## A wrong channel breaks the whole consumer cone
+
+Measured on the real consumer: when `decideRestart`'s error channel was set to `never`, `tsc` produced errors in the workflow file, 11 in its property test, and 4 in a downstream executor (`supervisor-body.executor.ts`). A lint rule flags one file; a type breaks every consumer. The workflow file, its tests, and everything that calls it fail together, at compile time, before anything runs.
+
+## Install
+
+```bash
+pnpm add -D @systemfsoftware/effect-cell-types
+```
+
+A devDependency — consumers mostly use the types (`import type`), and the one runtime export, `make`, is an identity function. `effect` is a peer dependency: bring your own (you already have it).

package/dist/effect-cell-types.d.ts

@@ -0,0 +1,49 @@
+import { Either } from 'effect/Either';
+
+declare type Alt = {
+    readonly [Alternative]: true;
+};
+
+declare const Alternative: unique symbol;
+
+declare type Cmd = {
+    readonly [Command]: true;
+};
+
+declare const Command: unique symbol;
+
+declare type Dec = {
+    readonly [Decision]: true;
+};
+
+declare const Decision: unique symbol;
+
+export declare type DecisionUnionSurvivesDistribution = Holds<Identical<Workflow<Cmd, Dec | Alt, Err>, (command: Cmd) => Either<Dec | Alt, Err>>>;
+
+declare type Err = {
+    readonly [Failure]: true;
+};
+
+declare const Failure: unique symbol;
+
+declare type Holds<Claim extends true> = Claim;
+
+declare type Identical<Left, Right> = (<G>() => G extends Left ? 1 : 2) extends (<G>() => G extends Right ? 1 : 2) ? true : false;
+
+export declare type InhabitedWorkflowIsCallable = Holds<Identical<Workflow<Cmd, Dec, Err>, (command: Cmd) => Either<Dec, Err>>>;
+
+export declare type NeverDecisionIsRejected = Holds<Identical<Workflow<Cmd, never, Err>, UninhabitedDecision>>;
+
+export declare type NeverErrorIsRejected = Holds<Identical<Workflow<Cmd, Dec, never>, UninhabitedError>>;
+
+export declare interface UninhabitedDecision {
+    readonly __WORKFLOW_DECISION_CHANNEL_IS_NEVER__: 'this workflow can never succeed; give it a decision variant it can return';
+}
+
+export declare interface UninhabitedError {
+    readonly __WORKFLOW_ERROR_CHANNEL_IS_NEVER__: 'this workflow cannot fail, so it decides nothing; give it an error variant or move it to a *.kernel.ts';
+}
+
+export declare type Workflow<Command, Decision, DecisionError> = [Decision] extends [never] ? UninhabitedDecision : [DecisionError] extends [never] ? UninhabitedError : (command: Command) => Either<Decision, DecisionError>;
+
+export { }

package/dist/index.d.ts

@@ -0,0 +1,419 @@
+import * as Effect$1 from "effect/Effect";
+import { Effect } from "effect/Effect";
+import * as Result$1 from "effect/Result";
+import { Result } from "effect/Result";
+import { Schema, SchemaAST } from "effect";
+declare namespace Workflow_d_exports {
+  export { Inhabited, Tagged, UninhabitedDecision, UninhabitedError, UntaggedError, Workflow, WorkflowBrand, make };
+}
+/**
+ * The nominal brand a workflow carries. `Workflow.make` is the only door that applies it,
+ * and every surface that runs a decision — `Cell.decide`, and through it `DecideNode.run`
+ * via the `DecidePhase` conjunct — demands it, so a bare decider that skipped `make` is
+ * refused by the compiler at the call site that would have run it.
+ *
+ * The brand is phantom — a readonly TypeId-keyed field that no runtime property ever
+ * backs: `assertWorkflow` narrows the same function value without touching it. The
+ * `Symbol.for` key follows the repo's branded-class idiom (the instance brands in
+ * `restart-decision.workflow.ts`, `hook-verdict.workflow.ts` and `survivors.workflow.ts`)
+ * so it is stable across realms; this is the type-level brand that subsumes those
+ * instance brands on the workflow shapes.
+ */
+declare const WorkflowTypeId: unique symbol;
+type WorkflowTypeId = typeof WorkflowTypeId;
+/** The phantom property `Workflow<C,D,E>` and `Cell.DecidePhase<P>` carry. */
+interface WorkflowBrand {
+  readonly [WorkflowTypeId]: WorkflowTypeId;
+}
+/**
+ * Marker a workflow resolves to when its decision channel is `never`. The property type is the
+ * fix, so the compiler diagnostic names it.
+ */
+interface UninhabitedDecision {
+  readonly __WORKFLOW_DECISION_CHANNEL_IS_NEVER__: 'this workflow can never succeed; give it a decision variant it can return';
+}
+/** Marker a workflow resolves to when its error channel is `never`. */
+interface UninhabitedError {
+  readonly __WORKFLOW_ERROR_CHANNEL_IS_NEVER__: 'this workflow cannot fail, so it decides nothing; give it an error variant or move it to a *.kernel.ts';
+}
+/** Marker a workflow resolves to when its error channel carries no tag to dispatch on. */
+interface UntaggedError {
+  readonly __WORKFLOW_ERROR_CHANNEL_CARRIES_NO_TAG__: 'this error carries no _tag the consumer can dispatch on; declare it as an S.TaggedError';
+}
+/** The shape an error channel must have: a tag the consumer dispatches on. */
+interface Tagged {
+  readonly _tag: string;
+}
+/**
+ * A decider whose channels are both inhabited, or the marker naming which channel is not.
+ *
+ * `[T] extends [never]` rather than `T extends never`: the tuple wrap stops distribution, without
+ * which a `never` channel satisfies the conditional vacuously and is never caught.
+ *
+ * The inhabited branch carries the nominal brand: `Workflow.make` is the only constructor that
+ * applies it, so a bare function annotated `Workflow<C, D, E>` is refused wherever the brand
+ * is demanded — which is exactly where a decision gets run.
+ */
+type Workflow<Command, Decision, DecisionError> = [Decision] extends [never] ? UninhabitedDecision : [DecisionError] extends [never] ? UninhabitedError : ((command: Command) => Result<Decision, DecisionError>) & WorkflowBrand;
+/**
+ * `unknown` when both channels are inhabited and the error carries a tag, so the intersection in
+ * {@link make} collapses to the plain `Result` and neither inference nor the authoring surface
+ * changes. Otherwise the marker the author must satisfy, which they cannot, which is the point.
+ */
+type Inhabited<Decision, DecisionError> = [Decision] extends [never] ? UninhabitedDecision : [DecisionError] extends [never] ? UninhabitedError : [DecisionError] extends [Tagged] ? unknown : UntaggedError;
+/**
+ * Builds a workflow, refusing an uninhabited or untagged channel at this call rather than at
+ * whoever first calls the result — which for a workflow nothing calls yet is never.
+ *
+ * The markers ride the parameter function's return type, not the parameter as `Workflow<C, D, E>`:
+ * a conditional type in parameter position resolves `D` and `E` to `unknown` and the markers become
+ * unreachable. On the return type both still infer from the `Result` conjunct while the marker
+ * conjunct is what an uninhabited channel fails to satisfy.
+ *
+ * `E` carries no constraint on purpose. Constraining it gives inference a fallback: where `E` would
+ * infer as `never` TypeScript substitutes the constraint instead, the conditional takes its
+ * inhabited branch, and a `never` channel passes. The tagged requirement therefore lives in
+ * {@link Inhabited}, where nothing can stand in for `never`.
+ *
+ * The narrowing goes through an assertion signature rather than an `as` cast: every narrowing
+ * assertion trips `typescript(no-unsafe-type-assertion)`, and a suppression comment would hide the
+ * one place this file could lie. It is sound rather than merely permitted — with both channels
+ * inhabited `Workflow<C, D, E>` is `(command: C) => Result<D, E>` carrying the {@link WorkflowBrand}
+ * conjunct, and otherwise the return type is a marker with no call signature, so the value handed
+ * back is unobservable through it. The brand is applied here and nowhere else: the assertion adds
+ * no runtime property, so `make` stays the identity function it always was, yet a value that did
+ * not pass through this door fails the conjunct wherever a decision is run.
+ */
+declare const make: <C, D, E>(decide: (command: C) => Result<D, E> & Inhabited<D, E>) => Workflow<C, D, E>;
+declare namespace Cell_d_exports {
+  export { Convention, DESCRIPTION_MODULE, DecideDone, DecideNode, DecidePhase, DecodeDone, DecodeNode, DecodePhase, Description, EncodeDone, EncodeNode, EncodePhase, IO_CELLS, IoCellClassification, Layer, Phase, PhaseFact, Phases, ReadDone, ReadNode, ReadPhase, Vocabulary, WriteDone, WriteNode, WritePhase, apply, canonical, decide, decode, encode, read, vocabulary, write };
+}
+/**
+ * The type bag. Every phase's input and output type travels in one record so that a
+ * stage's own type arguments are identical across stages, which leaves the sentence
+ * member as the only difference a diagnostic can report. Measured: with the payload
+ * carried per-stage instead, the compiler reports the mismatch at the argument (TS2345)
+ * and the sentence arrives only as a type argument; with the payload in one bag it
+ * reports the missing member (TS2741) and the sentence is that member's name.
+ */
+interface Phases {
+  readonly command: unknown;
+  readonly raw: unknown;
+  readonly decoded: unknown;
+  readonly decision: unknown;
+  readonly decisionError: unknown;
+  readonly output: unknown;
+  readonly response: unknown;
+  readonly decodeError: unknown;
+  readonly readError: unknown;
+  readonly writeError: unknown;
+  readonly readContext: unknown;
+  readonly writeContext: unknown;
+}
+/**
+ * A read gathers what the decision needs, and may gather a product across its interior;
+ * that interior is not type-visible, so no I/O count is claimed or enforced here. A step that
+ * mutates in order to report — bumping a counter and returning the resulting rate — is one
+ * such product, and belongs here rather than in a layer of its own.
+ */
+type ReadPhase<P extends Phases> = (command: P['command']) => Effect$1.Effect<P['raw'], P['readError'], P['readContext']>;
+/** Validation. Its `Left` is fatal: it reaches the derived error channel and no write runs. */
+type DecodePhase<P extends Phases> = (raw: P['raw']) => Result$1.Result<P['decoded'], P['decodeError']>;
+/**
+ * The decision. Its `Left` is an outcome, not a fault: both branches travel on to the write.
+ *
+ * The {@link WorkflowBrand} conjunct makes this the one surface a decision must cross
+ * branded: only a `Workflow.make` value satisfies it, so a bare lambda handed here is
+ * refused by the compiler with the brand conjunct named in the diagnostic. The `run` on
+ * a `DecideNode` inherits the conjunct through this type, which keeps the interpreter's
+ * fold sound — a description can only carry decisions that came through `make`.
+ */
+type DecidePhase<P extends Phases> = ((decoded: P['decoded']) => Result$1.Result<P['decision'], P['decisionError']>) & WorkflowBrand;
+/** Shapes what the write consumes. Total, so it receives both branches of the decision. */
+type EncodePhase<P extends Phases> = (outcome: Result$1.Result<P['decision'], P['decisionError']>) => P['output'];
+type WritePhase<P extends Phases> = (output: P['output']) => Effect$1.Effect<P['response'], P['writeError'], P['writeContext']>;
+/**
+ * The invocation shape a folding consumer must use to call a phase's `run`:
+ * - `'effect'` — `run` returns an `Effect`; yield it. (read, write)
+ * - `'either-fail'` — `run` returns a `Result` whose `Failure` is fatal; fail on `Failure`. (decode)
+ * - `'either-pass'` — `run` returns a `Result` that travels forward whole. (decide)
+ * - `'total'` — `run` is a plain total function; call it directly. (encode)
+ *
+ * This is structural data on the record, not one of the five axes: it lets an executing
+ * consumer fold the description without knowing which phase it is looking at. The
+ * interpreter's switch over `convention` is exhaustively defaulted, so a phase with an
+ * invocation shape this module does not know fails at compile time at one named location.
+ */
+type Convention = 'effect' | 'either-fail' | 'either-pass' | 'total';
+/**
+ * One phase record: `name` (the phase name, as data), `kind` (purity), `convention`
+ * (the invocation shape), and the phase's `run`. Each phase type has its own record
+ * interface so `run` keeps its exact signature. Nothing here discriminates on `name`:
+ * the interpreter dispatches on `convention`, and other consumers read `name` as data.
+ * A hand-written `_tag` is deliberately absent — a manual `_tag` member is forbidden
+ * here (the schema rule prescribes `TaggedStruct`, which cannot describe a function
+ * member), and an ordered sequence of phase records is not a `Match`-style tagged union.
+ */
+interface ReadNode<P extends Phases> {
+  readonly name: 'read';
+  readonly kind: 'impure';
+  readonly convention: 'effect';
+  readonly run: ReadPhase<P>;
+}
+interface DecodeNode<P extends Phases> {
+  readonly name: 'decode';
+  readonly kind: 'pure';
+  readonly convention: 'either-fail';
+  readonly run: DecodePhase<P>;
+}
+interface DecideNode<P extends Phases> {
+  readonly name: 'decide';
+  readonly kind: 'pure';
+  readonly convention: 'either-pass';
+  readonly run: DecidePhase<P>;
+}
+interface EncodeNode<P extends Phases> {
+  readonly name: 'encode';
+  readonly kind: 'pure';
+  readonly convention: 'total';
+  readonly run: EncodePhase<P>;
+}
+interface WriteNode<P extends Phases> {
+  readonly name: 'write';
+  readonly kind: 'impure';
+  readonly convention: 'effect';
+  readonly run: WritePhase<P>;
+}
+type Phase<P extends Phases> = ReadNode<P> | DecodeNode<P> | DecideNode<P> | EncodeNode<P> | WriteNode<P>;
+/**
+ * One impure/pure layer: its phase records in intra-layer execution order. The order is
+ * data — the interpreter folds this array and runs each record as its `convention`
+ * says, holding no phase sequence of its own. The stage brands are what make a legal
+ * description well-ordered at build time; the value's declared order is its execution
+ * order.
+ */
+interface Layer<P extends Phases> {
+  readonly phases: readonly Phase<P>[];
+}
+/** The description package's own module name — what an import edge would match. */
+declare const DESCRIPTION_MODULE: '@systemfsoftware/effect-cell-types';
+/**
+ * The I/O-cell classification: the cells whose calls are I/O, plus the non-cell module
+ * sources whose calls are I/O. Written once here; a consumer folds it off the value.
+ */
+declare const IO_CELLS: {
+  readonly cells: readonly ['store', 'adapter'];
+  readonly sources: readonly ['effect/Clock', 'effect/System'];
+};
+/**
+ * Derived from the value rather than restated beside it: a hand-written twin is a second
+ * declaration of axis 5, and the two drift the moment a cell is reclassified in only one.
+ */
+type IoCellClassification = typeof IO_CELLS;
+/**
+ * The description root, carried by every stage. A consumer folds a stage value to
+ * recover the description's whole vocabulary: the phase names and kinds on each
+ * record, the intra-layer order in each `phases` array, the package's own module
+ * name, and the I/O-cell classification. Nothing about the shape of a legal
+ * description is written down anywhere else.
+ */
+interface Description<P extends Phases> {
+  readonly module: typeof DESCRIPTION_MODULE;
+  readonly ioCells: IoCellClassification;
+  readonly layers: readonly Layer<P>[];
+}
+/**
+ * The stages are siblings, never a hierarchy. Each carries exactly the sentence naming the
+ * call that must come next, and none extends another. Measured: under a hierarchy a later
+ * stage is assignable to an earlier parameter, so an inversion — decoding what was already
+ * decided — compiles. As siblings both the forward skip and the backward inversion are
+ * rejected, each diagnostic naming the sentence it is missing.
+ *
+ * The carrier is deliberately the same type on every stage — `Description` — so the
+ * compiler reports the argument rather than the member only when the carrier itself is
+ * wrong, and the sentence stays the name a diagnostic reports.
+ */
+interface ReadDone<P extends Phases> extends Description<P> {
+  readonly 'call read(command) before decode(raw)': true;
+}
+interface DecodeDone<P extends Phases> extends Description<P> {
+  readonly 'call decode(raw) before decide(decoded)': true;
+}
+interface DecideDone<P extends Phases> extends Description<P> {
+  readonly 'call decide(decoded) before encode(decision)': true;
+}
+interface EncodeDone<P extends Phases> extends Description<P> {
+  readonly 'call encode(decision) before write(output)': true;
+}
+/** Terminal. A description is applied from here, and a further layer opens from here. */
+interface WriteDone<P extends Phases> extends Description<P> {
+  readonly 'call write(output) before applying the description': true;
+}
+/**
+ * Opens a layer. Passing a prior `WriteDone` opens a second layer over the same bag, so a
+ * call site whose real order writes before it can classify is one description carrying two
+ * layers rather than two descriptions composed by hand.
+ *
+ * This one is not dual: it starts the chain, so on the opening layer it has no `self` to
+ * receive. Every phase after it is dual, which is what lets a description be written in the
+ * order it runs.
+ */
+declare const read: <P extends Phases>(run: ReadPhase<P>, previous?: WriteDone<P>) => ReadDone<P>;
+/**
+ * The chaining phases are dual, data-last overload declared first. Nesting the constructors
+ * reads innermost-first — backwards from the order the phases run — which defeats the point of
+ * a type that exists to make that order legible. In `pipe` the call site reads in phase order,
+ * and the sentence still arrives as a missing member through it.
+ *
+ * A `Do`-notation scope binding each phase's result for later phases to read was measured as
+ * an alternative: the sentence survives it, even with the scope varying per stage, because an
+ * absent member is reported before type arguments are compared. It was not adopted, because a
+ * scope the interpreter folds over is type-erased, and reading a phase back out of it needs an
+ * assertion this design does not.
+ */
+declare const decode: {
+  <P extends Phases>(run: DecodePhase<P>): (previous: ReadDone<P>) => DecodeDone<P>;
+  <P extends Phases>(previous: ReadDone<P>, run: DecodePhase<P>): DecodeDone<P>;
+};
+declare const decide: {
+  <P extends Phases>(run: DecidePhase<P>): (previous: DecodeDone<P>) => DecideDone<P>;
+  <P extends Phases>(previous: DecodeDone<P>, run: DecidePhase<P>): DecideDone<P>;
+};
+declare const encode: {
+  <P extends Phases>(run: EncodePhase<P>): (previous: DecideDone<P>) => EncodeDone<P>;
+  <P extends Phases>(previous: DecideDone<P>, run: EncodePhase<P>): EncodeDone<P>;
+};
+declare const write: {
+  <P extends Phases>(run: WritePhase<P>): (previous: EncodeDone<P>) => WriteDone<P>;
+  <P extends Phases>(previous: EncodeDone<P>, run: WritePhase<P>): WriteDone<P>;
+};
+/**
+ * Applies a description. The return type is deliberately not annotated: `gen` accumulates
+ * `E` and `R` from the union of what is actually yielded, so an over-claimed channel is
+ * unrepresentable rather than merely discouraged. Annotating it here would let this module
+ * promise a failure that no phase can produce.
+ *
+ * The parameter keeps the terminal `WriteDone<P>` brand. It is not decoration: it is what
+ * makes applying a half-built chain — a `ReadDone`, say — a compile error rather than a
+ * runtime death, which `test-types/Cell.tst.ts` pins. The brand does not constrain the
+ * phases array's order (a literal satisfies it in any order, which is why the interpreter
+ * reads the order off the value), but it does constrain chain completion, and that is a
+ * guarantee worth the narrower parameter.
+ *
+ * `forEach` takes no concurrency option here, so the layers run in declared order and the
+ * sequence is structural rather than something a caller could pass differently; the
+ * description's response is the last layer's. No scope is opened and interruptibility is
+ * untouched, so a `Scope.Scope` a phase requires reaches the caller as part of the derived `R`.
+ */
+declare const apply: <P extends Phases>(description: WriteDone<P>, command: P['command']) => Effect$1.Effect<P["response"], P["decodeError"] | P["readError"] | P["writeError"], P["readContext"] | P["writeContext"]>;
+/** One phase's vocabulary entry: what it is called, its purity, its invocation shape. */
+interface PhaseFact {
+  readonly name: Phase<Phases>['name'];
+  readonly kind: Phase<Phases>['kind'];
+  readonly convention: Convention;
+}
+/**
+ * The five axes as data, for a consumer that has no description of its own to fold.
+ *
+ * `byKind` groups the walked phase names by their purity. It is here rather than left to
+ * each consumer because which phases are pure is this module's own fact, and a consumer
+ * that reconstructs it has to pick a proxy — inferring purity from the invocation shape,
+ * say — which is a different axis and silently disagrees the moment a pure phase is given
+ * an effectful shape or an impure one is not.
+ */
+interface Vocabulary {
+  readonly module: typeof DESCRIPTION_MODULE;
+  readonly ioCells: IoCellClassification;
+  readonly phases: readonly PhaseFact[];
+  readonly byKind: Readonly<Record<PhaseFact['kind'], readonly PhaseFact['name'][]>>;
+  /**
+   * The export that runs a finished description. A consumer deciding which calls on this module
+   * belong to a description needs the phases *and* the applier; without it the applier is the one
+   * name it has to write down for itself, and one restated name is enough to drift.
+   */
+  readonly applier: 'apply';
+}
+/**
+ * A canonical description, built through the public constructors with phases that do
+ * nothing. It is exported so a consumer — a generator, a lint rule, a documenter — can
+ * obtain a real branded description without replaying the constructor chain: spread it
+ * and substitute its phase records' `run`s. The records it carries are the same literals
+ * the constructors write for real call sites, so the vocabulary below cannot drift from
+ * them.
+ *
+ * Its order is not a choice this module makes. The stage brands admit exactly one chain, so
+ * any other sequence fails to typecheck here — which is what keeps the derived order
+ * non-circular: it is read off a value, and the value's shape is enforced by the types.
+ */
+declare const canonical: WriteDone<Phases>;
+declare const vocabulary: Vocabulary;
+declare namespace Policy_d_exports {
+  export { Policy };
+}
+type Policy<A, E, R> = (self: Effect<A, E, R>) => Effect<A, E, R>;
+declare namespace Wire_d_exports {
+  export { AnyMinted, Fields, Mark, Minted, MintedField, array, boolean, integer, literal, mint, nullOr, nullishOr, number, optional, record, refine, string, suspend, tuple, undefinedOr, union, wire };
+}
+/**
+ * Marker a wire member carries once this workspace declares its type. The property type is the
+ * fix, so the compiler diagnostic names it.
+ *
+ * It sits on the schema, never on the decoded value: `Schema.Type<typeof Wire.string>` is `string`.
+ */
+interface Mark {
+  readonly __WIRE_MEMBER_IS_NOT_BUILT_FROM_THE_ALPHABET__: 'this member names a type this workspace does not declare; build it from Wire, or admit a foreign schema deliberately with Wire.mint';
+}
+/**
+ * A schema this workspace declares the type of. In v4 the encoded side lives on the schema
+ * itself, so the second parameter is carried for API stability rather than as a separate
+ * type argument: `Minted<A, I>` reads "decodes `A` from the wire's `I`-shaped payload".
+ */
+type Minted<A, I = A> = Schema.Codec<A, I> & Mark;
+/** Any marked schema, for constraint positions. */
+type AnyMinted = Schema.Top & Mark;
+/**
+ * Any marked struct member — a schema, or a property signature from {@link optional}.
+ *
+ * The permissive `Constraint` arm rather than a narrower schema type, whose `never` variants
+ * would fail the assignability check before the marker is reached, leaving the diagnostic to
+ * report an unrelated type error.
+ */
+type MintedField = Schema.Constraint & Mark;
+/**
+ * Mark a member whose type this workspace declares.
+ *
+ * Prefer the alphabet below; reach for this only to admit a schema the alphabet cannot express,
+ * including a vendor's own. The value returned is the one passed in, and its concrete type is
+ * preserved, so a marked struct stays a struct and Effect's inference keeps working.
+ */
+declare const mint: <Field extends Schema.Constraint>(field: Field) => Field & Mark;
+declare const string: Schema.String & Mark;
+declare const number: Schema.Finite & Mark;
+declare const boolean: Schema.Boolean & Mark;
+declare const integer: Schema.Int & Mark;
+declare const literal: <const Literals extends ReadonlyArray<SchemaAST.LiteralValue>>(...literals: Literals) => Schema.Literals<Literals> & Mark;
+declare const nullOr: <A, I>(member: Minted<A, I>) => Minted<A | null, I | null>;
+declare const undefinedOr: <A, I>(member: Minted<A, I>) => Minted<A | undefined, I | undefined>;
+declare const nullishOr: <A, I>(member: Minted<A, I>) => Minted<A | null | undefined, I | null | undefined>;
+declare const array: <A, I>(member: Minted<A, I>) => Minted<ReadonlyArray<A>, ReadonlyArray<I>>;
+/** A field that may be absent from the payload entirely, as distinct from present and `undefined`. */
+declare const optional: <Member extends AnyMinted>(member: Member) => Schema.optional<Member> & Mark;
+declare const record: <K extends Schema.Record.Key & Mark, V extends AnyMinted>(key: K, value: V) => Schema.$Record<K, V> & Mark;
+declare const union: <Members extends readonly [AnyMinted, AnyMinted, ...Array<AnyMinted>]>(...members: Members) => Schema.Union<Members> & Mark;
+declare const tuple: <Elements extends ReadonlyArray<AnyMinted>>(...elements: Elements) => Schema.Tuple<Elements> & Mark;
+declare const suspend: <A, I>(thunk: () => Minted<A, I>) => Minted<A, I>;
+/**
+ * Constrain a member's values. Effect's own `member.pipe(Schema.check(Schema.isMinLength(1)))`
+ * preserves the mark, but returns the schema with the concrete decode/encode pair fused; this
+ * combinator is the alphabet's own shape for the same operation, so a refined member keeps the
+ * declaration this workspace makes of its type.
+ *
+ * `S.refine` needs a type-guard as its predicate argument; the workspace's predicate is a plain
+ * `(a: A) => boolean` that narrows nothing, so a truth-preserving `value is A` guard is written
+ * at this one call site rather than widening the public signature.
+ */
+declare const refine: <A, I>(member: Minted<A, I>, predicate: (a: A) => boolean, annotations?: Schema.Annotations.Filter) => Minted<A, I>;
+type Fields = Record<string, MintedField>;
+declare const wire: <F extends Fields>(fields: F) => Schema.Struct<F> & Mark;
+//#endregion
+export { Cell_d_exports as Cell, Policy_d_exports as Policy, Wire_d_exports as Wire, Workflow_d_exports as Workflow };

package/dist/index.mjs

@@ -0,0 +1,359 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import * as Arr from "effect/Array";
+import * as Effect$1 from "effect/Effect";
+import { dual } from "effect/Function";
+import * as Option from "effect/Option";
+import * as Result$1 from "effect/Result";
+import { Schema } from "effect";
+//#region src/Workflow.ts
+var Workflow_exports = /* @__PURE__ */ __exportAll({ make: () => make });
+/**
+* Builds a workflow, refusing an uninhabited or untagged channel at this call rather than at
+* whoever first calls the result — which for a workflow nothing calls yet is never.
+*
+* The markers ride the parameter function's return type, not the parameter as `Workflow<C, D, E>`:
+* a conditional type in parameter position resolves `D` and `E` to `unknown` and the markers become
+* unreachable. On the return type both still infer from the `Result` conjunct while the marker
+* conjunct is what an uninhabited channel fails to satisfy.
+*
+* `E` carries no constraint on purpose. Constraining it gives inference a fallback: where `E` would
+* infer as `never` TypeScript substitutes the constraint instead, the conditional takes its
+* inhabited branch, and a `never` channel passes. The tagged requirement therefore lives in
+* {@link Inhabited}, where nothing can stand in for `never`.
+*
+* The narrowing goes through an assertion signature rather than an `as` cast: every narrowing
+* assertion trips `typescript(no-unsafe-type-assertion)`, and a suppression comment would hide the
+* one place this file could lie. It is sound rather than merely permitted — with both channels
+* inhabited `Workflow<C, D, E>` is `(command: C) => Result<D, E>` carrying the {@link WorkflowBrand}
+* conjunct, and otherwise the return type is a marker with no call signature, so the value handed
+* back is unobservable through it. The brand is applied here and nowhere else: the assertion adds
+* no runtime property, so `make` stays the identity function it always was, yet a value that did
+* not pass through this door fails the conjunct wherever a decision is run.
+*/
+const make = (decide) => {
+	return decide;
+};
+//#endregion
+//#region src/CanonicalDecide.workflow.ts
+/**
+* The canonical decider. Extracted so `make-file-location` only sees it inside a
+* single-segment `.workflow.ts` file, satisfying the restored taxonomy while
+* preserving the exact phantom-channel contract the `DecidePhase` brand and
+* the interpreter rely on.
+*/
+const canonicalDecide = make((_decoded) => Result$1.succeed(void 0));
+//#endregion
+//#region src/Cell.ts
+var Cell_exports = /* @__PURE__ */ __exportAll({
+	DESCRIPTION_MODULE: () => DESCRIPTION_MODULE,
+	IO_CELLS: () => IO_CELLS,
+	apply: () => apply,
+	canonical: () => canonical,
+	decide: () => decide,
+	decode: () => decode,
+	encode: () => encode,
+	read: () => read,
+	vocabulary: () => vocabulary,
+	write: () => write
+});
+/** The description package's own module name — what an import edge would match. */
+const DESCRIPTION_MODULE = "@systemfsoftware/effect-cell-types";
+/**
+* The I/O-cell classification: the cells whose calls are I/O, plus the non-cell module
+* sources whose calls are I/O. Written once here; a consumer folds it off the value.
+*/
+const IO_CELLS = {
+	cells: ["store", "adapter"],
+	sources: ["effect/Clock", "effect/System"]
+};
+const READ_DONE = "call read(command) before decode(raw)";
+const DECODE_DONE = "call decode(raw) before decide(decoded)";
+const DECIDE_DONE = "call decide(decoded) before encode(decision)";
+const ENCODE_DONE = "call encode(decision) before write(output)";
+const WRITE_DONE = "call write(output) before applying the description";
+/** Replaces the open layer with itself plus one more phase record. */
+const intoOpenLayer = (description, phase) => {
+	const layers = description.layers;
+	const last = layers[layers.length - 1];
+	return {
+		module: description.module,
+		ioCells: description.ioCells,
+		layers: [...layers.slice(0, -1), {
+			...last,
+			phases: [...last?.phases ?? [], phase]
+		}]
+	};
+};
+/**
+* Opens a layer. Passing a prior `WriteDone` opens a second layer over the same bag, so a
+* call site whose real order writes before it can classify is one description carrying two
+* layers rather than two descriptions composed by hand.
+*
+* This one is not dual: it starts the chain, so on the opening layer it has no `self` to
+* receive. Every phase after it is dual, which is what lets a description be written in the
+* order it runs.
+*/
+const read = (run, previous) => ({
+	[READ_DONE]: true,
+	module: DESCRIPTION_MODULE,
+	ioCells: IO_CELLS,
+	layers: [...previous?.layers ?? [], { phases: [{
+		name: "read",
+		kind: "impure",
+		convention: "effect",
+		run
+	}] }]
+});
+/**
+* The chaining phases are dual, data-last overload declared first. Nesting the constructors
+* reads innermost-first — backwards from the order the phases run — which defeats the point of
+* a type that exists to make that order legible. In `pipe` the call site reads in phase order,
+* and the sentence still arrives as a missing member through it.
+*
+* A `Do`-notation scope binding each phase's result for later phases to read was measured as
+* an alternative: the sentence survives it, even with the scope varying per stage, because an
+* absent member is reported before type arguments are compared. It was not adopted, because a
+* scope the interpreter folds over is type-erased, and reading a phase back out of it needs an
+* assertion this design does not.
+*/
+const decode = dual(2, (previous, run) => ({
+	[DECODE_DONE]: true,
+	...intoOpenLayer(previous, {
+		name: "decode",
+		kind: "pure",
+		convention: "either-fail",
+		run
+	})
+}));
+const decide = dual(2, (previous, run) => ({
+	[DECIDE_DONE]: true,
+	...intoOpenLayer(previous, {
+		name: "decide",
+		kind: "pure",
+		convention: "either-pass",
+		run
+	})
+}));
+const encode = dual(2, (previous, run) => ({
+	[ENCODE_DONE]: true,
+	...intoOpenLayer(previous, {
+		name: "encode",
+		kind: "pure",
+		convention: "total",
+		run
+	})
+}));
+const write = dual(2, (previous, run) => ({
+	[WRITE_DONE]: true,
+	...intoOpenLayer(previous, {
+		name: "write",
+		kind: "impure",
+		convention: "effect",
+		run
+	})
+}));
+/**
+* The runtime guard that lets the `'total'` case call `EncodePhase` soundly: an encode
+* phase is chained only after a decide, so the value reaching it is the outcome `Result`
+* and `Result.isResult` certifies exactly that. The specific `decision`/`decisionError`
+* members are not observable at runtime, so the guard narrows to them by construction —
+* the same trust the fold places in the chain's order.
+*/
+const isOutcome = (value) => Result$1.isResult(value);
+/**
+* Runs one layer as the sandwich the value declares: the phase records run in array
+* order, each dispatched on its carried `convention`. There is no phase sequence here —
+* the order is the `phases` array and the invocation shape is the `convention` field,
+* so a description's declared order IS its execution order. The convention switch is
+* exhaustive over the union via its `never` default: a future phase with an invocation
+* shape this module does not know fails at compile time, at this one location.
+*
+* The two `Failure` rules are carried by the phase types rather than chosen here. A `decode`
+* Failure has no downstream consumer — nothing accepts `decodeError` — so its only route is a
+* failure, which is what puts it in the derived error channel. A `decide` Failure cannot be
+* unwrapped, because `EncodePhase` takes the whole `Result`, so its only route is forward as
+* a value. Neither is a decision the interpreter makes.
+*
+* Every layer reachable from a `WriteDone` was built by the five constructors in order, so
+* its last phase is a write and every slot is filled. A layer that is nonetheless empty or
+* not closed by a write is a defect in this module, never a domain outcome, so it dies —
+* the same guard the name-keyed layer used for unfilled slots. `Effect.die` returns
+* `Effect<never>`, which is why the guards cost the derived `E` and `R` nothing.
+*/
+const runLayer = (layer, command) => Effect$1.gen(function* () {
+	const phases = layer.phases;
+	const last = phases[phases.length - 1];
+	if (!last || last.name !== "write") return yield* Effect$1.die(/* @__PURE__ */ new Error("effect-cell-types: a layer reached the interpreter without a write phase closing it"));
+	let value = command;
+	for (const phase of phases.slice(0, -1)) switch (phase.convention) {
+		case "effect":
+			value = yield* phase.run(value);
+			break;
+		case "either-fail":
+			value = yield* Result$1.match(phase.run(value), {
+				onFailure: Effect$1.fail,
+				onSuccess: Effect$1.succeed
+			});
+			break;
+		case "either-pass":
+			value = phase.run(value);
+			break;
+		case "total":
+			if (!isOutcome(value)) return yield* Effect$1.die(/* @__PURE__ */ new Error("effect-cell-types: an encode phase received a value that is not the decide outcome"));
+			value = phase.run(value);
+			break;
+		default: {
+			const unreachable = phase;
+			return yield* Effect$1.die(/* @__PURE__ */ new Error(`effect-cell-types: unknown phase convention ${String(unreachable)}`));
+		}
+	}
+	return yield* last.run(value);
+});
+/**
+* Applies a description. The return type is deliberately not annotated: `gen` accumulates
+* `E` and `R` from the union of what is actually yielded, so an over-claimed channel is
+* unrepresentable rather than merely discouraged. Annotating it here would let this module
+* promise a failure that no phase can produce.
+*
+* The parameter keeps the terminal `WriteDone<P>` brand. It is not decoration: it is what
+* makes applying a half-built chain — a `ReadDone`, say — a compile error rather than a
+* runtime death, which `test-types/Cell.tst.ts` pins. The brand does not constrain the
+* phases array's order (a literal satisfies it in any order, which is why the interpreter
+* reads the order off the value), but it does constrain chain completion, and that is a
+* guarantee worth the narrower parameter.
+*
+* `forEach` takes no concurrency option here, so the layers run in declared order and the
+* sequence is structural rather than something a caller could pass differently; the
+* description's response is the last layer's. No scope is opened and interruptibility is
+* untouched, so a `Scope.Scope` a phase requires reaches the caller as part of the derived `R`.
+*/
+const apply = (description, command) => Effect$1.gen(function* () {
+	const responses = yield* Effect$1.forEach(description.layers, (layer) => runLayer(layer, command));
+	return yield* Option.match(Arr.last(responses), {
+		onNone: () => Effect$1.die(/* @__PURE__ */ new Error("effect-cell-types: a description reached the interpreter with no layers")),
+		onSome: Effect$1.succeed
+	});
+});
+/**
+* A canonical description, built through the public constructors with phases that do
+* nothing. It is exported so a consumer — a generator, a lint rule, a documenter — can
+* obtain a real branded description without replaying the constructor chain: spread it
+* and substitute its phase records' `run`s. The records it carries are the same literals
+* the constructors write for real call sites, so the vocabulary below cannot drift from
+* them.
+*
+* Its order is not a choice this module makes. The stage brands admit exactly one chain, so
+* any other sequence fails to typecheck here — which is what keeps the derived order
+* non-circular: it is read off a value, and the value's shape is enforced by the types.
+*/
+const canonical = write(encode(decide(decode(read(() => Effect$1.void), () => Result$1.succeed(void 0)), canonicalDecide), () => void 0), () => Effect$1.void);
+/**
+* The phase vocabulary, obtained by walking `canonical`. A consumer that needs the phase
+* names, their purity, or their order — a lint rule, a generator, a document — reads them
+* from here instead of restating them, so there is one place a phase is described and the
+* description is the place.
+*/
+const WALKED_PHASES = Arr.flatMap(canonical.layers, (layer) => layer.phases.map(({ convention, kind, name }) => ({
+	convention,
+	kind,
+	name
+})));
+const vocabulary = {
+	module: canonical.module,
+	ioCells: canonical.ioCells,
+	phases: WALKED_PHASES,
+	byKind: {
+		pure: WALKED_PHASES.filter((phase) => phase.kind === "pure").map((phase) => phase.name),
+		impure: WALKED_PHASES.filter((phase) => phase.kind === "impure").map((phase) => phase.name)
+	},
+	applier: "apply"
+};
+//#endregion
+//#region src/Policy.ts
+var Policy_exports = /* @__PURE__ */ __exportAll({});
+//#endregion
+//#region src/Wire.ts
+/**
+* The wire alphabet — build a schema for a foreign payload out of members you declare, so no
+* vendor type can be named inside it.
+*
+* ```ts
+* import { Wire } from '@systemfsoftware/effect-cell-types'
+* import { Schema } from 'effect'
+*
+* const Invoice = Wire.wire({
+*   id: Wire.string,
+*   amountDue: Wire.nullOr(Wire.number),
+*   status: Wire.literal('draft', 'open', 'paid'),
+*   lineItems: Wire.array(Wire.string),
+*   metadata: Wire.record(Wire.string, Wire.string),
+*   deleted: Wire.optional(Wire.boolean),
+* })
+*
+* // Decodes to your own type — `{ id: string; amountDue: number | null; ... }`.
+* const invoice = Schema.decodeUnknownSync(Invoice)(payload)
+* ```
+*
+* Only declarations that use the alphabet are constrained, and {@link mint} admits a foreign
+* schema deliberately. It is a guardrail, not a security boundary.
+*/
+var Wire_exports = /* @__PURE__ */ __exportAll({
+	array: () => array,
+	boolean: () => boolean,
+	integer: () => integer,
+	literal: () => literal,
+	mint: () => mint,
+	nullOr: () => nullOr,
+	nullishOr: () => nullishOr,
+	number: () => number,
+	optional: () => optional,
+	record: () => record,
+	refine: () => refine,
+	string: () => string,
+	suspend: () => suspend,
+	tuple: () => tuple,
+	undefinedOr: () => undefinedOr,
+	union: () => union,
+	wire: () => wire
+});
+/**
+* Mark a member whose type this workspace declares.
+*
+* Prefer the alphabet below; reach for this only to admit a schema the alphabet cannot express,
+* including a vendor's own. The value returned is the one passed in, and its concrete type is
+* preserved, so a marked struct stays a struct and Effect's inference keeps working.
+*/
+const mint = (field) => {
+	assertMinted(field);
+	return field;
+};
+function assertMinted(_field) {}
+const string = mint(Schema.String);
+const number = mint(Schema.Finite);
+const boolean = mint(Schema.Boolean);
+const integer = mint(Schema.Int);
+const literal = (...literals) => mint(Schema.Literals(literals));
+const nullOr = (member) => mint(Schema.NullOr(member));
+const undefinedOr = (member) => mint(Schema.UndefinedOr(member));
+const nullishOr = (member) => mint(Schema.NullishOr(member));
+const array = (member) => mint(Schema.Array(member));
+/** A field that may be absent from the payload entirely, as distinct from present and `undefined`. */
+const optional = (member) => mint(Schema.optional(member));
+const record = (key, value) => mint(Schema.Record(key, value));
+const union = (...members) => mint(Schema.Union(members));
+const tuple = (...elements) => mint(Schema.Tuple(elements));
+const suspend = (thunk) => mint(Schema.suspend(thunk));
+/**
+* Constrain a member's values. Effect's own `member.pipe(Schema.check(Schema.isMinLength(1)))`
+* preserves the mark, but returns the schema with the concrete decode/encode pair fused; this
+* combinator is the alphabet's own shape for the same operation, so a refined member keeps the
+* declaration this workspace makes of its type.
+*
+* `S.refine` needs a type-guard as its predicate argument; the workspace's predicate is a plain
+* `(a: A) => boolean` that narrows nothing, so a truth-preserving `value is A` guard is written
+* at this one call site rather than widening the public signature.
+*/
+const refine = (member, predicate, annotations) => mint(Schema.refine((value) => predicate(value), annotations)(member));
+const wire = (fields) => mint(Schema.Struct(fields));
+//#endregion
+export { Cell_exports as Cell, Policy_exports as Policy, Wire_exports as Wire, Workflow_exports as Workflow };

package/dist/rolldown-runtime-D7D4PA-g.mjs

@@ -0,0 +1,13 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+export { __exportAll as t };

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@systemfsoftware/effect-cell-types",
+  "license": "Apache-2.0",
+  "version": "1.0.1",
+  "author": "Ryan Lee <drdgvhbh@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/systemfsoftware/systemfsoftware.git",
+    "directory": "packages/effect-cell-types"
+  },
+  "homepage": "https://github.com/systemfsoftware/systemfsoftware/tree/main/packages/effect-cell-types#readme",
+  "bugs": "https://github.com/systemfsoftware/systemfsoftware/issues",
+  "description": "Type-level contracts for the repo's cell taxonomy, starting with the Workflow decision channel — branded Workflow<C, D, E> types plus a runtime make constructor every effect kernel can share.",
+  "keywords": [
+    "effect",
+    "effect-ts",
+    "typescript",
+    "architecture",
+    "workflow",
+    "either",
+    "type-contracts"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.mjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@effect/vitest": "4.0.0-rc.108",
+    "@microsoft/api-extractor": "^7.58.7",
+    "@systemfsoftware/arethetypeswrong-cli": "^1.1.1",
+    "@types/node": "^24",
+    "effect": "4.0.0-rc.108",
+    "oxlint": "^1.77.0",
+    "rimraf": "^6.1.3",
+    "tsdown": "^0.22.14",
+    "tstyche": "^7.1.0",
+    "vitest": "^4.1.10",
+    "@systemfsoftware/oxlint-config": "^0.1.0",
+    "@systemfsoftware/effect-gherkin-spec": "0.5.1",
+    "@systemfsoftware/vitest-config": "^0.1.0",
+    "@systemfsoftware/tsconfig": "^1.3.1"
+  },
+  "peerDependencies": {
+    "effect": "4.0.0-rc.108"
+  },
+  "publishConfig": {
+    "provenance": true
+  },
+  "scripts": {
+    "clean": "rimraf dist",
+    "build": "tsdown && pnpm api:check",
+    "typecheck": "tsc --noEmit --incremental",
+    "test": "vitest run --passWithNoTests",
+    "test:run": "vitest run --passWithNoTests",
+    "test:types": "TSTYCHE_TYPESCRIPT_MODULE=tstyche-typescript tstyche",
+    "api:check": "api-extractor run",
+    "api:update": "api-extractor run --local",
+    "lint": "f=${OXLINT_FORMAT:-${AGENT:+agent}}; oxlint . --format=${f:-default}",
+    "attw": "attw --pack ."
+  }
+}