@yielded/agent-platform-cloudflare 0.1.0-beta.166 → 0.1.0-beta.168

package/src/CloudflareBindings.ts

@@ -25,7 +25,8 @@ export class CloudflareBindingError extends Schema.TaggedError<CloudflareBinding
  * and the cross-Object transport call it through `DurableObjectNamespace` stubs. Every
  * `encoded` value is a Schema-encoded envelope (`client.ts` wire schemas for host entry
  * points, `@yielded/agent-storage-cloudflare` port envelopes for `portCall`), so the RPC
- * boundary carries only structured-cloneable JSON. The optional trailing trace context is
+ * boundary carries structured-cloneable JSON, except `watchTextEncoded`, which can return
+ * a bounded, disposable byte stream. The optional trailing trace context is
  * transient native RPC metadata, stripped by an opted-in effect-cf receiver before decoding
  * the host or port envelope. It never enters durable state.
  */
@@ -35,10 +36,14 @@ export interface ThreadObjectRpc extends Rpc.DurableObjectBranded {
   /** Wake-hinted, poll-guaranteed settlement wait; answers an `AwaitSettlementResponse`. */
   submissionStatusEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   awaitSettlementEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  /** Finalized canonical settlement record; requires settlement and observation authority. */
+  awaitSettlementRecordEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   /** Event-driven durable progress wait; answers a `ProgressObserved` host response. */
   awaitProgressEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   /** Best-effort cancellation for one in-flight progress wait. */
   cancelProgressEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  /** Authorized prospective provisional text; byte stream or encoded HostFailed. */
+  watchTextEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   /** One bounded page of canonical records; answers an `ObservePageResponse`. */
   observePage(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   /** Durable abort intent; answers an `AbortResponse`. */
@@ -82,7 +87,7 @@ export class ThreadObjectNamespace extends Context.Service<
 }
 
 /** Invoke a placed Thread using the current invocation's native RPC channel. */
-export const callThreadObject = Effect.fn("callThreadObject")(function* <A, E>(
+export const callThreadObject = Effect.fnUntraced(function* <A, E>(
   threadId: ThreadId,
   invoke: (target: ThreadObjectClient) => Promise<A>,
   onError: (cause: unknown) => E,
@@ -104,7 +109,7 @@ export const callThreadObject = Effect.fn("callThreadObject")(function* <A, E>(
  * narrowest-boundary check (structural probe for the namespace surface the transport uses);
  * a missing or misshaped binding fails typed before any Layer is built.
  */
-export const threadNamespaceFromEnv = Effect.fn("threadNamespaceFromEnv")(function* (
+export const threadNamespaceFromEnv = Effect.fnUntraced(function* (
   env: unknown,
   binding: string,
 ): Effect.fn.Return<DurableObjectNamespace<ThreadObjectRpc>, CloudflareBindingError> {
@@ -195,5 +200,9 @@ export class ThreadObjectIdentity extends Context.Service<
 /** Logical Threads whose canonical stores and admission ledger live in this physical Object. */
 export class ThreadObjectPlacement extends Context.Service<
   ThreadObjectPlacement,
-  { readonly ownsThread: (threadId: ThreadId) => boolean }
+  {
+    readonly ownsThread: (threadId: ThreadId) => boolean;
+    /** Present only when this physical Object owns exactly this one Thread. */
+    readonly threadId?: ThreadId;
+  }
 >()("@effect-agent/platform-cloudflare/ThreadObjectPlacement") {}

package/src/CloudflareCodeMode.ts

@@ -410,7 +410,7 @@ const makeExecute = (
   options: DynamicWorkerCodeExecutorOptions,
   clock: Clock.Clock,
 ): CodeExecutorExecute =>
-  Effect.fn("DynamicWorkerCodeExecutor.execute")(function* (request: CodeExecutionRequest) {
+  Effect.fnUntraced(function* (request: CodeExecutionRequest) {
     if (request.network._tag !== "NetworkDisabled") {
       return yield* CodeExecutorUnsupportedError.make({
         implementation: dynamicWorkerImplementation,

package/src/CloudflareConfig.ts

@@ -1,7 +1,6 @@
 import { DEFAULT_MAX_STORED_VALUE_BYTES } from "@yielded/agent-storage-cloudflare/do-storage-config";
 import { DeploymentId } from "@yielded/agent/records";
-import { DEFAULT_OWNERSHIP_LEASE_DURATION } from "@yielded/agent/submission-ledger";
-import { Context, Duration, Schema } from "effect";
+import { Context, Schema } from "effect";
 
 /**
  * Schema-validated configuration for the Cloudflare durable runtime (deployment spec §4:
@@ -79,8 +78,8 @@ export class CloudflareAdmissionLimitsValue extends Schema.Class<CloudflareAdmis
 /**
  * Validated Cloudflare durable runtime configuration. The producer identity of one
  * Thread Object is `{producerPrefix}:{threadId}` — stable across incarnations of
- * the same deployment, distinct across deployments — and producer-epoch fencing (not the
- * producer name) remains the correctness authority (DUR-006).
+ * the same deployment, distinct across deployments. The Object owns its Thread exclusively;
+ * scoped local generations reject callbacks from an earlier Run owner.
  */
 export class CloudflareDurableRuntimeConfigValue extends Schema.Class<CloudflareDurableRuntimeConfigValue>(
   "@effect-agent/platform-cloudflare/CloudflareDurableRuntimeConfigValue",
@@ -88,16 +87,16 @@ export class CloudflareDurableRuntimeConfigValue extends Schema.Class<Cloudflare
   deploymentId: DeploymentId,
   /** Head of the minted producer identity `{producerPrefix}:{threadId}`. */
   producerPrefix: Schema.NonEmptyString.check(Schema.isMaxLength(256)),
-  /** Submission ownership lease duration (D5); fences work across Object incarnations. */
-  ownershipLeaseDuration: PositiveMillis,
-  /** Base delay of exponential backoff when a pass fails or makes no progress. */
+  /**
+   * Base delay of exponential backoff when a pass fails or makes no progress.
+   * Half this delay (rounded up, at least 1ms) also pre-arms mutations, including
+   * healthy admissions. `alarmBackoffCap` does not cap that pre-arm delay.
+   */
   alarmBackoffBase: PositiveMillis,
   /** Ceiling of exponential backoff after failed or no-progress maintenance passes. */
   alarmBackoffCap: PositiveMillis,
   /** `awaitSettlement` ledger re-check cadence when no wake arrives. */
   settlementPollInterval: PositiveMillis,
-  /** Worker ownership-lease renewal cadence during an active Attempt. */
-  leaseRenewalInterval: PositiveMillis,
   /** Active-Run abort-intent poll cadence. */
   abortPollInterval: PositiveMillis,
   /** Canonical observation poll cadence of the Durable Object store. */
@@ -109,7 +108,7 @@ export class CloudflareDurableRuntimeConfigValue extends Schema.Class<Cloudflare
     Schema.isGreaterThan(0),
     Schema.isLessThanOrEqualTo(2_000_000),
   ),
-  /** Opt-in full payload/digest-chain audit while opening the store. */
+  /** Opt-in full history and active-state validation while opening the store. */
   verifyOnOpen: Schema.Boolean,
   limits: CloudflareAdmissionLimitsValue,
 }) {}
@@ -122,11 +121,9 @@ export class CloudflareDurableRuntimeConfig extends Context.Service<
 
 /** Documented production defaults applied by `ThreadObject.layer`. */
 export const CLOUDFLARE_RUNTIME_DEFAULTS = {
-  ownershipLeaseDuration: Duration.toMillis(DEFAULT_OWNERSHIP_LEASE_DURATION),
   alarmBackoffBase: 100,
   alarmBackoffCap: 5_000,
   settlementPollInterval: 500,
-  leaseRenewalInterval: 10_000,
   abortPollInterval: 500,
   observationPollInterval: 25,
   projectionDispatchTimeoutMillis: 30_000,

package/src/CloudflareMemory.ts

@@ -64,9 +64,7 @@ export const memoryObjectName = (namespace: MemoryNamespace.Any): string => name
  * Interrupted callers stop waiting; the owner has its own deadline. A timed-out write
  * may have committed: reconcile by sending the identical operation ID and command.
  */
-const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
-  Namespace extends MemoryNamespace.Any,
->(
+const makeMemoryClient = Effect.fnUntraced(function* <Namespace extends MemoryNamespace.Any>(
   access: MemoryAccess<Namespace>,
   principal: Principal,
   rpcLimits: MemoryRpcLimits = defaultMemoryRpcLimits,
@@ -84,7 +82,7 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
   );
   const { namespace } = yield* MemoryObjectNamespace;
 
-  const call = Effect.fn("CloudflareMemoryClient.call")(function* (request: MemoryOwnerRequest) {
+  const call = Effect.fnUntraced(function* (request: MemoryOwnerRequest) {
     const decoded = yield* Schema.decodeEffect(MemoryOwnerRequest)(request).pipe(
       Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })),
     );
@@ -130,7 +128,7 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
       }),
     );
 
-  const revalidate = Effect.fn("CloudflareMemoryClient.revalidate")(function* (
+  const revalidate = Effect.fnUntraced(function* (
     lookup: MemoryLookup,
     limits: MemoryRecallLimits,
   ) {
@@ -156,9 +154,7 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
     }).pipe((effect) => withinDeadline(effect, timeoutMillis));
   });
 
-  const change = Effect.fn("CloudflareMemoryClient.change")(function* (
-    write: MemoryWrite<Namespace>,
-  ) {
+  const change = Effect.fnUntraced(function* (write: MemoryWrite<Namespace>) {
     if (!MemoryNamespace.equals(write.key.namespace, bound.namespace))
       return yield* MemoryRpcError.make({ reason: "denied" });
 
@@ -186,7 +182,7 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
    * exact-key authority and active document scopes; source-dependent provenance policy remains
    * application-owned. No extraction, job draining, embedding, discovery or rendering occurs.
    */
-  const get = Effect.fn("CloudflareMemoryClient.get")(function* (key: MemoryKey<Namespace>) {
+  const get = Effect.fnUntraced(function* (key: MemoryKey<Namespace>) {
     const decodedKey = yield* Schema.decodeUnknownEffect(MemoryKey.Wire)(key).pipe(
       Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })),
     );
@@ -225,12 +221,12 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
     }).pipe((effect) => withinDeadline(effect, validated.timeoutMillis));
   });
 
-  const revalidateSemantic = Effect.fn("CloudflareMemoryClient.revalidateSemantic")(function* (
-    found: MemoryIndexSearch<Namespace>,
-    profile: SemanticMemoryProfile,
-    limits: SemanticCandidateLimits,
-  ) {
-    return yield* Effect.gen(function* () {
+  const revalidateSemantic = Effect.fnUntraced(
+    function* (
+      found: MemoryIndexSearch<Namespace>,
+      profile: SemanticMemoryProfile,
+      limits: SemanticCandidateLimits,
+    ) {
       const response = yield* call({
         _tag: "RevalidateSemantic",
         version: 1,
@@ -245,8 +241,9 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
       if (response._tag !== "Semantic") return yield* MemoryRpcError.make({ reason: "protocol" });
 
       return response.result;
-    }).pipe((effect) => withinDeadline(effect, validated.timeoutMillis));
-  });
+    },
+    (effect) => withinDeadline(effect, validated.timeoutMillis),
+  );
 
   /**
    * Revalidate in one owner RPC, then render whole passages within the caller's budget.
@@ -255,17 +252,16 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
    * The single outcome has sourceId "memory". No embedding or candidate search is performed.
    * Use revalidate with Memory.recall for multiple readers sharing one output budget.
    */
-  const recall = Effect.fn("CloudflareMemoryClient.recall")(function* (
+  const recall = (
     lookup: MemoryLookup,
     limits: MemoryRecallLimits,
     estimateTokens?: (text: string) => number,
-  ) {
-    return yield* Memory.recall(
+  ) =>
+    Memory.recall(
       [{ id: "memory", essential: true, read: revalidate(lookup, limits) }],
       limits,
       estimateTokens,
     );
-  });
 
   return { get, recall, revalidate, revalidateSemantic, change };
 });
@@ -274,20 +270,17 @@ export const CloudflareMemoryClient = {
   /** Bind access and principal using the MemoryObjectNamespace supplied by the application. */
   make: makeMemoryClient,
   /** Use a resolved Worker or Durable Object binding without manual service provisioning. */
-  fromBinding: Effect.fn("CloudflareMemoryClient.fromBinding")(function* <
-    Namespace extends MemoryNamespace.Any,
-  >(
+  fromBinding: <Namespace extends MemoryNamespace.Any>(
     binding: DurableObjectNamespace<MemoryObjectRpc>,
     options: {
       readonly access: MemoryAccess<Namespace>;
       readonly principal: Principal;
       readonly rpcLimits?: MemoryRpcLimits;
     },
-  ) {
-    return yield* makeMemoryClient(options.access, options.principal, options.rpcLimits).pipe(
+  ) =>
+    makeMemoryClient(options.access, options.principal, options.rpcLimits).pipe(
       Effect.provideService(MemoryObjectNamespace, { namespace: binding }),
-    );
-  }),
+    ),
 };
 
 /**

package/src/CloudflareScheduling.ts

@@ -1,4 +1,3 @@
-import { BrowserCrypto } from "@effect/platform-browser";
 import { SqliteClient } from "@effect/sql-sqlite-do";
 import {
   DoScheduleAlarmControl,
@@ -47,6 +46,7 @@ import {
 
 import type { ThreadObjectNamespace } from "./CloudflareBindings.ts";
 import { CloudflareThreadClient } from "./CloudflareThreadClient.ts";
+import { cloudflareCryptoLayer } from "./internal/crypto.ts";
 import {
   cloudflarePreparedInputAdmissionLayer,
   cloudflareScheduledInputAdmissionLayer,
@@ -189,7 +189,7 @@ export class CloudflareSchedulingClient {
     Effect.gen(function* () {
       const { namespace } = yield* ScheduleOwnerNamespace;
 
-      const call = Effect.fn("CloudflareSchedulingClient.call")(function* (
+      const call = Effect.fnUntraced(function* (
         owner: ScheduleOwner,
         request: ScheduleOwnerRequest,
       ): Effect.fn.Return<ScheduleOwnerResponse, ScheduleManagementFailure> {
@@ -234,9 +234,7 @@ export class CloudflareSchedulingClient {
           : response.failure;
       });
 
-      const encodeInput = Effect.fn("CloudflareSchedulingClient.encodeInput")(function* <
-        InputSchema extends Schema.Top,
-      >(
+      const encodeInput = Effect.fnUntraced(function* <InputSchema extends Schema.Top>(
         agent: DurableSubmitAgent<InputSchema>,
         input: InputSchema["Type"],
       ): Effect.fn.Return<PersistedJson, ScheduleValidationError, InputSchema["EncodingServices"]> {
@@ -392,7 +390,7 @@ export class ScheduleOwnerIdentity extends Context.Service<
   { readonly owner: ScheduleOwner }
 >()("@effect-agent/platform-cloudflare/ScheduleOwnerIdentity") {}
 
-const decodeOwnerName = Effect.fn("decodeScheduleOwnerName")(function* (
+const decodeOwnerName = Effect.fnUntraced(function* (
   name: string | null | undefined,
 ): Effect.fn.Return<ScheduleOwner, ScheduleOwnerProtocolError> {
   if (name === null || name === undefined) {
@@ -508,7 +506,7 @@ const ensureOwner = (
       );
 };
 
-const handleScheduleRequest = Effect.fn("ScheduleOwner.handleRequest")(function* (
+const handleScheduleRequest = Effect.fnUntraced(function* (
   encoded: unknown,
 ): Effect.fn.Return<unknown, never, Scheduling | ScheduleOwnerIdentity> {
   const decoded = yield* decodeScheduleOwnerRequest(encoded).pipe(Effect.result);
@@ -706,7 +704,7 @@ export const makeScheduleOwnerObjectClass = <E>(
       ),
     ),
     Layer.provide(ScheduleWakeNoop),
-    Layer.provide(BrowserCrypto.layer),
+    Layer.provide(cloudflareCryptoLayer),
     Layer.provideMerge(DurableObjectAlarm.DurableObjectAlarm.layer),
     Layer.provide(host),
     Layer.provideMerge(ownerLayer),
@@ -729,17 +727,11 @@ export const makeScheduleOwnerObjectClass = <E>(
     schedule: (encoded: unknown) => handleScheduleRequest(encoded),
   } satisfies EffectCfDurableObject.DurableObjectRpc<ScheduleRuntimeServices>;
 
-  const Base = EffectCfDurableObject.make(runtime, {
+  const ScheduleOwnerObject = EffectCfDurableObject.make(runtime, {
     initialize: Effect.void,
     rpc,
     alarms: scheduleAlarmHandler(limits),
   });
 
-  class ScheduleOwnerObject extends Base {
-    override alarm(alarmInfo?: AlarmInvocationInfo): Promise<void> | void {
-      return super.alarm?.(alarmInfo);
-    }
-  }
-
   return ScheduleOwnerObject;
 };

package/src/CloudflareSubscriptions.ts

@@ -1,4 +1,3 @@
-import { BrowserCrypto } from "@effect/platform-browser";
 import { SqliteClient } from "@effect/sql-sqlite-do";
 import {
   DoSubscriptionAlarmControl,
@@ -41,6 +40,7 @@ import {
 
 import { type ThreadObjectNamespace } from "./CloudflareBindings.ts";
 import { CloudflareThreadClient } from "./CloudflareThreadClient.ts";
+import { cloudflareCryptoLayer } from "./internal/crypto.ts";
 import { cloudflarePreparedInputAdmissionLayer } from "./internal/prepared-admission.ts";
 
 const SUBSCRIPTION_ALARM_TAG = "effect-agent/SubscriptionPartitionWake";
@@ -90,9 +90,10 @@ export const SubscriptionPartitionAlarmExtension = Context.Reference<{
  * Callback failures stay typed. Defects and interruption reach the native alarm multiplexer.
  * The host owns durable idempotency, prearming and external-effect uncertainty.
  */
-export const makeSubscriptionPartitionAlarmHandler = Effect.fn(
-  "makeSubscriptionPartitionAlarmHandler",
-)(function* <Payload extends Schema.Top, R>(options: {
+export const makeSubscriptionPartitionAlarmHandler = Effect.fnUntraced(function* <
+  Payload extends Schema.Top,
+  R,
+>(options: {
   readonly tag: string;
   readonly payload: Payload;
   readonly timeoutMillis: number;
@@ -367,7 +368,7 @@ export class CloudflareSubscriptionsClient {
       Effect.gen(function* () {
         const { namespace } = yield* SubscriptionPartitionNamespace;
 
-        const call = Effect.fn("CloudflareSubscriptionsClient.call")(function* (
+        const call = Effect.fnUntraced(function* (
           addressedPartition: SourcePartition,
           request: SubscriptionPartitionRequest,
         ) {
@@ -402,7 +403,7 @@ export class CloudflareSubscriptionsClient {
         const asProtocolError = (): SubscriptionError =>
           corruptFailure("subscription-partition-protocol");
 
-        const changeState = Effect.fn("CloudflareSubscriptions.changeState")(function* (
+        const changeState = Effect.fnUntraced(function* (
           scope: typeof SubscriptionScope.Type,
           key: typeof SubscriptionKey.Type,
           expectedRevision: number,
@@ -620,9 +621,7 @@ export class SubscriptionPartitionIdentity extends Context.Service<
   { readonly partition: SourcePartition }
 >()("@effect-agent/platform-cloudflare/SubscriptionPartitionIdentity") {}
 
-const decodePartitionName = Effect.fn("decodeSubscriptionPartitionName")(function* (
-  name: string | null | undefined,
-) {
+const decodePartitionName = Effect.fnUntraced(function* (name: string | null | undefined) {
   if (name === null || name === undefined) {
     return yield* SubscriptionPartitionProtocolError.make({
       message: "Subscription Partition objects require an idFromName identity",
@@ -658,9 +657,7 @@ const requestPartition = (request: SubscriptionPartitionRequest): SourcePartitio
     ? request.partition
     : request.scope.partition;
 
-const handleRequest = Effect.fn("SubscriptionPartition.handleRequest")(function* (
-  encoded: unknown,
-) {
+const handleRequest = Effect.fnUntraced(function* (encoded: unknown) {
   const decoded = yield* decodeRequest(encoded).pipe(Effect.result);
 
   if (decoded._tag === "Failure") {
@@ -1001,7 +998,7 @@ export const makeSubscriptionPartitionObjectClass = <E>(
     Layer.provide(
       cloudflarePreparedInputAdmissionLayer.pipe(Layer.provide(CloudflareThreadClient.layer)),
     ),
-    Layer.provide(BrowserCrypto.layer),
+    Layer.provide(cloudflareCryptoLayer),
     Layer.provideMerge(DurableObjectAlarm.DurableObjectAlarm.layer),
     Layer.provide(host),
     Layer.provideMerge(identityLayer),
@@ -1028,17 +1025,11 @@ export const makeSubscriptionPartitionObjectClass = <E>(
     subscription: (encoded: unknown) => handleRequest(encoded),
   } satisfies EffectCfDurableObject.DurableObjectRpc<SubscriptionRuntimeServices>;
 
-  const Base = EffectCfDurableObject.make(runtime, {
+  const SubscriptionPartitionObject = EffectCfDurableObject.make(runtime, {
     initialize: Effect.void,
     rpc,
     alarms: alarmHandler(limits),
   });
 
-  class SubscriptionPartitionObject extends Base {
-    override alarm(alarmInfo?: AlarmInvocationInfo): Promise<void> | void {
-      return super.alarm?.(alarmInfo);
-    }
-  }
-
   return SubscriptionPartitionObject;
 };