@yielded/agent-storage-cloudflare 0.1.0-beta.166

package/dist/PortRouting.mjs

@@ -0,0 +1,544 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { LedgerAdmitCall, LedgerAdmitResult, LedgerInspectWorkerCall, LedgerInspectWorkerResult, LedgerLookupCall, LedgerLookupResult, LedgerMarkReadyCall, LedgerMarkReadyResult, LedgerRecordChildSettledCall, LedgerRecordChildSettledResult, LedgerRequestAbortCall, LedgerRequestAbortResult, LedgerResolveAdmissionCall, LedgerResolveAdmissionResult, LedgerStopWorkerCall, LedgerStopWorkerResult, MessageDeliveryCompleteCall, MessageDeliveryCompleteResult, MessageDeliveryListCall, MessageDeliveryListResult, PortFailed, PortProtocolError, PortSucceeded, StoreAppendCall, StoreAppendResult, StoreCountPeerMessagesCall, StoreCountPeerMessagesResult, StoreExportCall, StoreExportResult, StoreInspectTailCall, StoreInspectTailResult, StoreMaterializeCall, StoreMaterializeResult, StoreReadIdentityCall, StoreReadIdentityResult, StoreReadPageCall, StoreReadPageResult, WorkerAdmitCall, WorkerAdmitResult, boundPortDiagnostic, decodePortRequest, decodePortResponse, encodePortRequest, encodePortResponse } from "./PortProtocol.mjs";
+import { MessageDeliveryError, MessageDeliveryStore } from "@yielded/agent/message-delivery";
+import { Cause, Clock, Context, Effect, Layer, Option, Predicate, Schema, Stream } from "effect";
+import { LifecyclePublicationError } from "@yielded/agent/lifecycle-publication";
+import { AppendConflict, FenceRejected, ThreadMaterialization, ThreadNotMaterialized, ThreadStore, ThreadStoreError } from "@yielded/agent/thread-store";
+import { AdmissionConflict, AdmissionIndeterminate, AdmissionPolicyError, ChildAttachmentSnapshot, JoinedToHost, LedgerError, RecoverySnapshot, SettlementConflict, SubmissionLedger, SubmissionLookupById } from "@yielded/agent/submission-ledger";
+import { WorkerAdmissionFailure, WorkerAdmissionPort, admitWorker } from "@yielded/agent/worker-admission";
+//#region src/PortRouting.ts
+var PortRouting_exports = /* @__PURE__ */ __exportAll({
+	PortTransportError: () => PortTransportError,
+	ThreadPortTransport: () => ThreadPortTransport,
+	executePortRequest: () => executePortRequest,
+	handleEncodedPortRequest: () => handleEncodedPortRequest,
+	makeLocalSubmissionLookup: () => makeLocalSubmissionLookup,
+	portTransportFailure: () => portTransportFailure,
+	routedMessageDeliveryStoreLayer: () => routedMessageDeliveryStoreLayer,
+	routedSubmissionLedgerLayer: () => routedSubmissionLedgerLayer,
+	routedThreadStoreLayer: () => routedThreadStoreLayer,
+	routedWorkerAdmissionLayer: () => routedWorkerAdmissionLayer
+});
+const ThreadIdSchema = ThreadMaterialization.fields.threadId;
+const decodeThreadId = Schema.decodeUnknownEffect(ThreadIdSchema);
+/**
+* The ledger row bound routable Submission identities must respect (mirrors the local
+* facet's `MAX_IDENTIFIER_LENGTH`; the minting side already refuses longer identities typed
+* at admission, so a longer identity presented here cannot name any stored row).
+*/
+const MAX_ROUTABLE_SUBMISSION_ID_LENGTH = 1024;
+/** The `{uuidv7}` head of a DC-minted routable Submission identity. */
+const UUID_HEAD_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+/**
+* A transport could not deliver a port request to (or an answer from) the owning
+* Thread's Durable Object. `retryable` carries the platform's own stub signal when one
+* exists. This error never crosses the wire — it is the CALLER-side evidence that the
+* authority was unreachable, which is exactly the case `AdmissionIndeterminate` was
+* specified for (SUB-031).
+*/
+var PortTransportError = class extends Schema.TaggedError()("PortTransportError", {
+	target: Schema.String,
+	message: Schema.String,
+	retryable: Schema.optionalKey(Schema.Boolean),
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+const safeTransportDiagnostic = (cause) => {
+	try {
+		const message = cause instanceof Error ? cause.message : cause;
+		return boundPortDiagnostic(typeof message === "string" ? message : String(message));
+	} catch {
+		return "[unavailable transport diagnostic]";
+	}
+};
+const transportRetryableSignal = (cause) => {
+	if (!Predicate.isObjectKeyword(cause)) return void 0;
+	try {
+		const signal = Reflect.get(cause, "retryable");
+		return typeof signal === "boolean" ? signal : void 0;
+	} catch {
+		return;
+	}
+};
+/**
+* Build a `PortTransportError` from an arbitrary thrown transport cause, preserving the
+* platform stub's own `retryable` signal when present.
+*/
+const portTransportFailure = (target, cause) => {
+	const retryable = transportRetryableSignal(cause);
+	return PortTransportError.make({
+		target,
+		message: safeTransportDiagnostic(cause),
+		...retryable === void 0 ? {} : { retryable },
+		cause
+	});
+};
+/**
+* Delivery of Schema-encoded port envelopes to the Durable Object that owns a FOREIGN
+* Thread (plan §1.3, D-P6-3). The shipped implementation (platform-cloudflare, WP3)
+* calls the owner's `portCall` over native Durable Object JS RPC via
+* `namespace.idFromName(threadId)`; the protocol is transport-agnostic and any carrier
+* that moves the encoded envelopes verbatim satisfies this service. Implementations MUST
+* surface every delivery problem as `PortTransportError` and must never fabricate an answer.
+*/
+var ThreadPortTransport = class extends Context.Service()("@effect-agent/storage-cloudflare/ThreadPortTransport") {};
+const LOCAL = { _tag: "local" };
+/**
+* Parse a DC-minted routable Submission identity — `{uuidv7}:{threadId}`, split at the
+* FIRST `:` because the Thread tail may itself contain colons (D-P6-5). This adapter
+* minted the format at admission and is the ONLY component that parses it; identities that do
+* not carry the minted shape (no separator, non-UUID head, empty tail) fall back to the local
+* facet, which is the only authority this Object can consult without inventing an owner.
+* Identities beyond the ledger's 1,024-character row bound fail typed: the minting side
+* refused them at admission, so they cannot name any stored row anywhere.
+*/
+const routableSubmissionTarget = (ownsThread) => Effect.fn("DoPortRouting.routableSubmissionTarget")(function* (operation, submissionId) {
+	if (submissionId.length > MAX_ROUTABLE_SUBMISSION_ID_LENGTH) return yield* LedgerError.make({
+		operation,
+		message: `A Submission identity of ${submissionId.length} characters exceeds the ${MAX_ROUTABLE_SUBMISSION_ID_LENGTH}-character routable identity bound; admission refuses such identities, so it cannot name any stored row.`
+	});
+	const separator = submissionId.indexOf(":");
+	if (separator === -1) return LOCAL;
+	if (!UUID_HEAD_PATTERN.test(submissionId.slice(0, separator))) return LOCAL;
+	const tail = submissionId.slice(separator + 1);
+	return yield* decodeThreadId(tail).pipe(Effect.map((threadId) => ownsThread(threadId) ? LOCAL : {
+		_tag: "foreign",
+		threadId
+	}), Effect.orElseSucceed(() => LOCAL));
+});
+/**
+* Read a Submission only from this physical owner. Encoded foreign identities fail before
+* storage access; opaque identities still use local lookup. A returned row must also belong
+* to an owned Thread. This is placement validation, not caller authorization.
+*/
+const makeLocalSubmissionLookup = (options) => {
+	const submissionTarget = routableSubmissionTarget(options.ownsThread);
+	return Effect.fn("DoPortRouting.lookupLocalSubmission")(function* (submissionId) {
+		const operation = "local Submission lookup";
+		if ((yield* submissionTarget(operation, submissionId))._tag === "foreign") return yield* LedgerError.make({
+			operation,
+			message: "The Submission belongs to another Thread Object"
+		});
+		const submission = yield* (yield* SubmissionLedger).lookup(SubmissionLookupById.make({ submissionId }));
+		if (Option.isSome(submission) && !options.ownsThread(submission.value.threadId)) return yield* LedgerError.make({
+			operation,
+			message: "The stored Submission belongs to another Thread Object"
+		});
+		return submission;
+	});
+};
+const NoAdditionalPortFailure = Schema.Never;
+const AbortPortFailure = Schema.Union([SettlementConflict, JoinedToHost]);
+const AppendPortFailure = Schema.Union([
+	ThreadNotMaterialized,
+	AppendConflict,
+	FenceRejected
+]);
+/**
+* The fail-fast refusal for any foreign operation OUTSIDE the closed route-capable subset
+* (plan §1.3): honesty over accidental distribution.
+*/
+const crossThreadLedgerError = (operation, target) => LedgerError.make({
+	operation,
+	message: `${operation} addressed to foreign Thread ${target} is not route-capable; the closed cross-Object subset is admit, markReady, lookup, resolveAdmission, requestAbort, and recordChildSettled. Every other ledger operation is lane-local by construction and must execute inside the owning Thread's Durable Object.`
+});
+const crossThreadStoreError = (operation, target) => ThreadStoreError.make({
+	operation,
+	message: `${operation} addressed to foreign Thread ${target} is not route-capable; the closed cross-Object subset is materialize, append, read (paged), inspectTail, and export. Observation and checkpoints are lane-local by construction and must execute inside the owning Thread's Durable Object.`
+});
+const makeTransportCall = (transport) => Effect.fn("DoPortRouting.transportCall")(function* (target, call) {
+	const encoded = yield* encodePortRequest(call).pipe(Effect.mapError((error) => PortProtocolError.make({ message: boundPortDiagnostic(`The port request could not be encoded: ${error.message}`) })));
+	const raw = yield* transport.call(target, encoded);
+	return yield* decodePortResponse(raw).pipe(Effect.mapError((error) => PortProtocolError.make({ message: boundPortDiagnostic(`The port response could not be decoded: ${error.message}`) })));
+});
+const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServices")(function* (options) {
+	const local = yield* SubmissionLedger;
+	const transport = yield* ThreadPortTransport;
+	const transportCall = makeTransportCall(transport);
+	const submissionTarget = routableSubmissionTarget(options.ownsThread);
+	const routeFailure = (operation, target) => (error) => LedgerError.make({
+		operation,
+		message: boundPortDiagnostic(`Routed ${operation} to the Thread Object owning ${target} failed: ${error.message}`),
+		cause: error
+	});
+	/**
+	* One routed ledger call: encode, deliver, decode, then narrow the uniform envelope to the
+	* operation's own result and failure surface. A foreign `LedgerError` is always in-channel;
+	* any failure outside the operation's declared surface — including protocol anomalies — is
+	* folded into a `LedgerError` naming the anomaly instead of being erased or re-thrown raw.
+	*/
+	const foreignLedgerCall = (operation, target, call, resultSchema, failureSchema) => {
+		const isExpectedResult = Schema.is(resultSchema);
+		const isExpectedFailure = Schema.is(failureSchema);
+		return transportCall(target, call).pipe(Effect.mapError(routeFailure(operation, target)), Effect.flatMap((response) => {
+			if (response._tag === "PortFailed") {
+				const failure = response.failure;
+				if (isExpectedFailure(failure)) return Effect.fail(failure);
+				if (failure._tag === "LedgerError") return Effect.fail(failure);
+				return Effect.fail(LedgerError.make({
+					operation,
+					message: boundPortDiagnostic(`The Thread Object owning ${target} answered ${operation} with the out-of-contract failure ${failure._tag}`),
+					cause: failure
+				}));
+			}
+			const result = response.result;
+			if (!isExpectedResult(result)) return Effect.fail(LedgerError.make({
+				operation,
+				message: `The Thread Object owning ${target} answered ${operation} with the mismatched result ${result._tag}.`
+			}));
+			return Effect.succeed(result);
+		}), Effect.withSpan("DoPortRouting.foreignLedgerCall", { attributes: {
+			operation,
+			target
+		} }));
+	};
+	/**
+	* Routed `resolveAdmission` — where the S2 tri-state becomes real (plan §1.3): when the
+	* owning Object cannot be reached, or its answer cannot be understood, the routed adapter
+	* answers `AdmissionIndeterminate{reason}` and NEVER `NotAdmitted` — an unreachable
+	* authority proves nothing, and only `NotAdmitted` permits an admission attempt (SUB-031).
+	* A typed `LedgerError` answered BY the authority still fails typed: the authority was
+	* reached and reported its own storage failure.
+	*/
+	const resolveForeignAdmission = (target, request) => transportCall(target, LedgerResolveAdmissionCall.make({ request })).pipe(Effect.flatMap((response) => {
+		if (response._tag === "PortFailed") {
+			if (response.failure._tag === "LedgerError") return Effect.fail(response.failure);
+			return Effect.succeed(AdmissionIndeterminate.make({ reason: boundPortDiagnostic(`The Thread Object owning ${target} answered resolveAdmission with the out-of-contract failure ${response.failure._tag}: ${response.failure.message}`) }));
+		}
+		if (response.result._tag !== "LedgerResolveAdmissionResult") return Effect.succeed(AdmissionIndeterminate.make({ reason: boundPortDiagnostic(`The Thread Object owning ${target} answered resolveAdmission with the mismatched result ${response.result._tag}.`) }));
+		return Effect.succeed(response.result.resolution);
+	}), Effect.catchTags({
+		PortTransportError: (error) => Effect.succeed(AdmissionIndeterminate.make({ reason: boundPortDiagnostic(`The Thread Object owning ${target} is unreachable: ${error.message}`) })),
+		PortProtocolError: (error) => Effect.succeed(AdmissionIndeterminate.make({ reason: boundPortDiagnostic(`The answer of the Thread Object owning ${target} could not be understood: ${error.message}`) }))
+	}), Effect.withSpan("DoPortRouting.resolveForeignAdmission", { attributes: { target } }));
+	const foreignLookupById = (operation, target, submissionId) => foreignLedgerCall(operation, target, LedgerLookupCall.make({ request: SubmissionLookupById.make({ submissionId }) }), LedgerLookupResult, NoAdditionalPortFailure).pipe(Effect.map((result) => result.submission === void 0 ? Option.none() : Option.some(result.submission)));
+	/**
+	* Enrich a LOCAL parent's recovery snapshot with the lane state of attached children whose
+	* rows live in other Durable Objects (plan §1.3): markers first (the local facet already
+	* consulted them), then a routed per-child `lookup` for any attached child that is neither
+	* local nor marker-settled. A transport failure surfaces as `LedgerError` so the alarm
+	* pass retries; the child's canonical Settlement remains the only authority (DUR-015).
+	*/
+	const enrichChildAttachments = Effect.fn("DoPortRouting.enrichChildAttachments")(function* (snapshot) {
+		const operation = "ledger load recovery snapshot";
+		const attachments = new Map(snapshot.childAttachments.map((attachment) => [attachment.childSubmissionId, attachment]));
+		let enriched = false;
+		for (const reservation of snapshot.childReservations) {
+			const childSubmissionId = reservation.childSubmissionId;
+			if (childSubmissionId === void 0 || attachments.has(childSubmissionId)) continue;
+			const target = yield* submissionTarget(operation, childSubmissionId);
+			if (target._tag !== "foreign") continue;
+			const child = yield* foreignLookupById(operation, target.threadId, childSubmissionId);
+			if (Option.isNone(child)) continue;
+			attachments.set(childSubmissionId, ChildAttachmentSnapshot.make({
+				toolCallId: reservation.parentToolCallId,
+				childSubmissionId,
+				childState: child.value.state,
+				...child.value.settledOutcome === void 0 ? {} : { childOutcome: child.value.settledOutcome }
+			}));
+			enriched = true;
+		}
+		if (!enriched) return snapshot;
+		const ordered = [];
+		for (const reservation of snapshot.childReservations) {
+			if (reservation.childSubmissionId === void 0) continue;
+			const attachment = attachments.get(reservation.childSubmissionId);
+			if (attachment !== void 0) ordered.push(attachment);
+		}
+		return RecoverySnapshot.make({
+			...snapshot,
+			childAttachments: ordered
+		});
+	});
+	const routed = SubmissionLedger.of({
+		capabilities: local.capabilities,
+		admit: (request) => options.ownsThread(request.threadId) ? local.admit(request) : foreignLedgerCall("ledger admit", request.threadId, LedgerAdmitCall.make({ request }), LedgerAdmitResult, Schema.Union([AdmissionConflict, AdmissionPolicyError])).pipe(Effect.map((reply) => reply.result)),
+		markReady: (request) => submissionTarget("ledger mark ready", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.markReady(request) : foreignLedgerCall("ledger mark ready", target.threadId, LedgerMarkReadyCall.make({ request }), LedgerMarkReadyResult, NoAdditionalPortFailure).pipe(Effect.asVoid))),
+		lookup: (request) => request._tag === "SubmissionLookupById" ? submissionTarget("ledger lookup", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.lookup(request) : foreignLookupById("ledger lookup", target.threadId, request.submissionId))) : options.ownsThread(request.threadId) ? local.lookup(request) : foreignLedgerCall("ledger lookup", request.threadId, LedgerLookupCall.make({ request }), LedgerLookupResult, NoAdditionalPortFailure).pipe(Effect.map((result) => result.submission === void 0 ? Option.none() : Option.some(result.submission))),
+		resolveAdmission: (request) => options.ownsThread(request.threadId) ? local.resolveAdmission(request) : resolveForeignAdmission(request.threadId, request),
+		inspectWorker: (threadId) => options.ownsThread(threadId) ? local.inspectWorker === void 0 ? Effect.fail(LedgerError.make({
+			operation: "inspectWorker",
+			message: "Worker inspection unavailable"
+		})) : local.inspectWorker(threadId) : foreignLedgerCall("inspect worker", threadId, LedgerInspectWorkerCall.make({ request: { threadId } }), LedgerInspectWorkerResult, NoAdditionalPortFailure).pipe(Effect.map((reply) => reply.state)),
+		stopWorker: (request) => options.ownsThread(request.threadId) ? local.stopWorker === void 0 ? Effect.fail(LedgerError.make({
+			operation: "stopWorker",
+			message: "Worker stop unavailable"
+		})) : local.stopWorker(request) : foreignLedgerCall("ledger stop worker", request.threadId, LedgerStopWorkerCall.make({ request }), LedgerStopWorkerResult, NoAdditionalPortFailure).pipe(Effect.map((reply) => reply.owned)),
+		requestAbort: (request) => submissionTarget("ledger request abort", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.requestAbort(request) : foreignLedgerCall("ledger request abort", target.threadId, LedgerRequestAbortCall.make({ request }), LedgerRequestAbortResult, AbortPortFailure).pipe(Effect.map((reply) => reply.intent)))),
+		recordChildSettled: (request) => submissionTarget("ledger record child settled", request.parentSubmissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.recordChildSettled(request) : foreignLedgerCall("ledger record child settled", target.threadId, LedgerRecordChildSettledCall.make({ request }), LedgerRecordChildSettledResult, NoAdditionalPortFailure).pipe(Effect.map((reply) => reply.outcome)))),
+		claim: (request) => options.ownsThread(request.threadId) ? local.claim(request) : Effect.fail(crossThreadLedgerError("ledger claim", request.threadId)),
+		claimJoining: (request) => options.ownsThread(request.threadId) ? local.claimJoining(request) : Effect.fail(crossThreadLedgerError("ledger claim joining", request.threadId)),
+		renewOwnership: (request) => submissionTarget("ledger renew ownership", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.renewOwnership(request) : Effect.fail(crossThreadLedgerError("ledger renew ownership", target.threadId)))),
+		releaseOwnership: (request) => submissionTarget("ledger release ownership", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.releaseOwnership(request) : Effect.fail(crossThreadLedgerError("ledger release ownership", target.threadId)))),
+		markInputApplied: (request) => submissionTarget("ledger mark input applied", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.markInputApplied(request) : Effect.fail(crossThreadLedgerError("ledger mark input applied", target.threadId)))),
+		reserveSettlement: (request) => submissionTarget("ledger reserve settlement", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.reserveSettlement(request) : Effect.fail(crossThreadLedgerError("ledger reserve settlement", target.threadId)))),
+		finalizeSettlement: (request) => submissionTarget("ledger finalize settlement", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.finalizeSettlement(request) : Effect.fail(crossThreadLedgerError("ledger finalize settlement", target.threadId)))),
+		markJoined: (request) => submissionTarget("ledger mark joined", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.markJoined(request) : Effect.fail(crossThreadLedgerError("ledger mark joined", target.threadId)))),
+		revertJoining: (request) => submissionTarget("ledger revert joining", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.revertJoining(request) : Effect.fail(crossThreadLedgerError("ledger revert joining", target.threadId)))),
+		suspend: (request) => submissionTarget("ledger suspend", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.suspend(request) : Effect.fail(crossThreadLedgerError("ledger suspend", target.threadId)))),
+		recordApprovalDecision: (command) => submissionTarget("ledger record approval decision", command.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.recordApprovalDecision(command) : Effect.fail(crossThreadLedgerError("ledger record approval decision", target.threadId)))),
+		markUnknown: (request) => submissionTarget("ledger mark unknown", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.markUnknown(request) : Effect.fail(crossThreadLedgerError("ledger mark unknown", target.threadId)))),
+		recordUnknownResolution: (command) => submissionTarget("ledger record unknown resolution", command.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.recordUnknownResolution(command) : Effect.fail(crossThreadLedgerError("ledger record unknown resolution", target.threadId)))),
+		reserveChildBudget: (request) => submissionTarget("ledger reserve child budget", request.parentSubmissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.reserveChildBudget(request) : Effect.fail(crossThreadLedgerError("ledger reserve child budget", target.threadId)))),
+		attachChildToReservation: local.attachChildToReservation,
+		beginChildBudgetRelease: local.beginChildBudgetRelease,
+		releaseChildBudget: local.releaseChildBudget,
+		scanNonterminal: local.scanNonterminal,
+		readAbortIntent: (request) => submissionTarget("ledger read abort intent", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.readAbortIntent(request) : Effect.fail(crossThreadLedgerError("ledger read abort intent", target.threadId)))),
+		loadRecoverySnapshot: (request) => submissionTarget("ledger load recovery snapshot", request.submissionId).pipe(Effect.flatMap((target) => target._tag === "local" ? local.loadRecoverySnapshot(request).pipe(Effect.flatMap(enrichChildAttachments)) : Effect.fail(crossThreadLedgerError("ledger load recovery snapshot", target.threadId))))
+	});
+	return Context.make(SubmissionLedger, routed);
+});
+const makeRoutedStoreServices = Effect.fn("DoPortRouting.makeRoutedStoreServices")(function* (options) {
+	const local = yield* ThreadStore;
+	const checkpoints = local.checkpoints;
+	const recoveryCheckpoints = local.recoveryCheckpoints;
+	const lifecyclePublications = local.lifecyclePublications;
+	const acknowledgeMany = lifecyclePublications?.acknowledgeMany;
+	const transport = yield* ThreadPortTransport;
+	const transportCall = makeTransportCall(transport);
+	const routeFailure = (operation, target) => (error) => ThreadStoreError.make({
+		operation,
+		message: boundPortDiagnostic(`Routed ${operation} to the Thread Object owning ${target} failed: ${error.message}`),
+		cause: error
+	});
+	/** The store twin of `foreignLedgerCall` with `ThreadStoreError` as the base error. */
+	const foreignStoreCall = (operation, target, call, resultSchema, failureSchema) => {
+		const isExpectedResult = Schema.is(resultSchema);
+		const isExpectedFailure = Schema.is(failureSchema);
+		return transportCall(target, call).pipe(Effect.mapError(routeFailure(operation, target)), Effect.flatMap((response) => {
+			if (response._tag === "PortFailed") {
+				const failure = response.failure;
+				if (isExpectedFailure(failure)) return Effect.fail(failure);
+				if (failure._tag === "ThreadStoreError") return Effect.fail(failure);
+				return Effect.fail(ThreadStoreError.make({
+					operation,
+					message: boundPortDiagnostic(`The Thread Object owning ${target} answered ${operation} with the out-of-contract failure ${failure._tag}`),
+					cause: failure
+				}));
+			}
+			const result = response.result;
+			if (!isExpectedResult(result)) return Effect.fail(ThreadStoreError.make({
+				operation,
+				message: `The Thread Object owning ${target} answered ${operation} with the mismatched result ${result._tag}.`
+			}));
+			return Effect.succeed(result);
+		}), Effect.withSpan("DoPortRouting.foreignStoreCall", { attributes: {
+			operation,
+			target
+		} }));
+	};
+	const routed = ThreadStore.of({
+		countPeerMessages: (request) => options.ownsThread(request.threadId) ? local.countPeerMessages === void 0 ? Effect.fail(crossThreadStoreError("peer count unavailable", request.threadId)) : local.countPeerMessages(request) : foreignStoreCall("thread countPeerMessages", request.threadId, StoreCountPeerMessagesCall.make({ request }), StoreCountPeerMessagesResult, ThreadNotMaterialized).pipe(Effect.map((reply) => reply.count)),
+		materialize: (request) => options.ownsThread(request.threadId) ? local.materialize(request) : foreignStoreCall("thread materialize", request.threadId, StoreMaterializeCall.make({ request }), StoreMaterializeResult, FenceRejected).pipe(Effect.asVoid),
+		append: (request) => options.ownsThread(request.threadId) ? local.append(request) : foreignStoreCall("thread append", request.threadId, StoreAppendCall.make({ request }), StoreAppendResult, AppendPortFailure).pipe(Effect.map((reply) => reply.result)),
+		read: (request) => options.ownsThread(request.threadId) ? local.read(request) : Stream.unwrap(foreignStoreCall("thread read", request.threadId, StoreReadPageCall.make({ request }), StoreReadPageResult, ThreadNotMaterialized).pipe(Effect.map((reply) => Stream.fromIterable(reply.records)))),
+		inspectTail: (request) => options.ownsThread(request.threadId) ? local.inspectTail(request) : foreignStoreCall("thread inspect tail", request.threadId, StoreInspectTailCall.make({ request }), StoreInspectTailResult, ThreadNotMaterialized).pipe(Effect.map((reply) => reply.tail)),
+		readIdentity: (request) => options.ownsThread(request.threadId) ? local.readIdentity(request) : foreignStoreCall("thread read identity", request.threadId, StoreReadIdentityCall.make({ request }), StoreReadIdentityResult, ThreadNotMaterialized).pipe(Effect.flatMap((reply) => reply.identity.threadId === request.threadId ? Effect.succeed(reply.identity) : Effect.fail(ThreadStoreError.make({
+			operation: "thread read identity",
+			message: "The identity snapshot belongs to another Thread."
+		})))),
+		export: (request) => options.ownsThread(request.threadId) ? local.export(request) : foreignStoreCall("thread export", request.threadId, StoreExportCall.make({ request }), StoreExportResult, ThreadNotMaterialized).pipe(Effect.map((reply) => reply.export)),
+		observe: (request) => options.ownsThread(request.threadId) ? local.observe(request) : Stream.unwrap(Effect.fail(crossThreadStoreError("thread observe", request.threadId))),
+		...lifecyclePublications === void 0 ? {} : { lifecyclePublications: {
+			...lifecyclePublications,
+			...acknowledgeMany === void 0 ? {} : { acknowledgeMany: (batches) => batches.every((batch) => batch.every((publication) => options.ownsThread(publication.ownerThreadId))) ? acknowledgeMany(batches) : Effect.fail(LifecyclePublicationError.make({ reason: "unavailable" })) },
+			acknowledge: (batch) => batch.every((publication) => options.ownsThread(publication.ownerThreadId)) ? lifecyclePublications.acknowledge(batch) : Effect.fail(LifecyclePublicationError.make({ reason: "unavailable" })),
+			claim: (batch, nowMillis, timeoutMillis) => batch.every((publication) => options.ownsThread(publication.ownerThreadId)) ? lifecyclePublications.claim(batch, nowMillis, timeoutMillis) : Effect.fail(LifecyclePublicationError.make({ reason: "unavailable" })),
+			retryParked: (ownerThreadId, nowMillis) => options.ownsThread(ownerThreadId) ? lifecyclePublications.retryParked(ownerThreadId, nowMillis) : Effect.fail(LifecyclePublicationError.make({ reason: "unavailable" }))
+		} },
+		...recoveryCheckpoints === void 0 ? {} : { recoveryCheckpoints: {
+			save: (request) => options.ownsThread(request.checkpoint.threadId) ? recoveryCheckpoints.save(request) : Effect.fail(crossThreadStoreError("thread save recovery checkpoint", request.checkpoint.threadId)),
+			load: (request) => options.ownsThread(request.threadId) ? recoveryCheckpoints.load(request) : Effect.succeed(Option.none())
+		} },
+		...checkpoints === void 0 ? {} : { checkpoints: {
+			save: (request) => options.ownsThread(request.checkpoint.threadId) ? checkpoints.save(request) : Effect.fail(crossThreadStoreError("thread save checkpoint", request.checkpoint.threadId)),
+			load: (request) => options.ownsThread(request.threadId) ? checkpoints.load(request) : Effect.fail(crossThreadStoreError("thread load checkpoint", request.threadId))
+		} }
+	});
+	return Context.make(ThreadStore, routed);
+});
+/**
+* Routing decorator over the LOCAL `SubmissionLedger` facet (plan §1.3): a request addressing
+* this Object's Thread executes locally; a route-capable request addressing another
+* Thread is Schema-encoded onto the `ThreadPortTransport` and executed by the
+* owning Object's local facet; any other foreign request fails fast typed. Provide the WP1
+* local facet (`submissionLedgerLayer`/`ledgerLayer`) and a transport to close it.
+*/
+const routedSubmissionLedgerLayer = (options) => Layer.effectContext(makeRoutedLedgerServices(options));
+/**
+* Routing decorator over the LOCAL `ThreadStore` facet (plan §1.3): this-thread
+* requests execute locally; foreign materialize/append/read/inspectTail/export travel the
+* transport. Foreign recovery-cache loads return none for canonical replay; other foreign
+* checkpoint operations and observation fail fast typed.
+*/
+const routedThreadStoreLayer = (options) => Layer.effectContext(makeRoutedStoreServices(options));
+/** Route validated worker admission as one operation; source policy hooks stay at the caller. */
+const routedWorkerAdmissionLayer = (options) => Layer.effect(WorkerAdmissionPort, Effect.gen(function* () {
+	const call = makeTransportCall(yield* ThreadPortTransport);
+	return WorkerAdmissionPort.of({ admit: (request) => options.ownsThread(request.threadId) ? admitWorker(request) : call(request.threadId, WorkerAdmitCall.make({ request })).pipe(Effect.mapError((cause) => LedgerError.make({
+		operation: "admit worker",
+		message: "Worker admission transport failed",
+		cause
+	})), Effect.flatMap((response) => {
+		if (response._tag === "PortSucceeded" && response.result._tag === "WorkerAdmitResult") return Effect.succeed(response.result.result);
+		return Effect.fail(response._tag === "PortFailed" && Schema.is(WorkerAdmissionFailure)(response.failure) ? response.failure : LedgerError.make({
+			operation: "admit worker",
+			message: "Unexpected worker admission response",
+			cause: response
+		}));
+	})) });
+}));
+/** Route the existing owner-scoped list; delivery mutations remain source local. */
+const routedMessageDeliveryStoreLayer = (options) => Layer.effect(MessageDeliveryStore, Effect.gen(function* () {
+	const local = yield* MessageDeliveryStore;
+	const call = makeTransportCall(yield* ThreadPortTransport);
+	return MessageDeliveryStore.of({
+		...local,
+		change: (key, change) => options.ownsThread(key.ownerThreadId) || change._tag !== "Complete" ? local.change(key, change) : call(key.ownerThreadId, MessageDeliveryCompleteCall.make({
+			key,
+			completion: change
+		})).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (failure) => MessageDeliveryError.make({
+			reason: "storage",
+			operation: "route delivery completion",
+			cause: failure
+		})))), Effect.flatMap((response) => {
+			if (response._tag === "PortSucceeded" && response.result._tag === "MessageDeliveryCompleteResult") return Effect.succeed(response.result.record);
+			if (response._tag === "PortFailed" && (response.failure._tag === "MessageDeliveryError" || response.failure._tag === "MessageDeliveryFailpointError")) return Effect.fail(response.failure);
+			return Effect.fail(MessageDeliveryError.make({
+				reason: "storage",
+				operation: "route delivery completion",
+				cause: response
+			}));
+		})),
+		list: (request) => options.ownsThread(request.ownerThreadId) ? local.list(request) : call(request.ownerThreadId, MessageDeliveryListCall.make({ request })).pipe(Effect.mapError(() => MessageDeliveryError.make({
+			reason: "storage",
+			operation: "route delivery list"
+		})), Effect.flatMap((response) => {
+			if (response._tag === "PortSucceeded" && response.result._tag === "MessageDeliveryListResult") return Effect.succeed(response.result.page);
+			return Effect.fail(response._tag === "PortFailed" && response.failure._tag === "MessageDeliveryError" ? response.failure : MessageDeliveryError.make({
+				reason: "storage",
+				operation: "route delivery list"
+			}));
+		}))
+	});
+}));
+/** Fold one port operation's typed failures into the uniform response envelope. */
+const capture = (effect) => effect.pipe(Effect.map((result) => PortSucceeded.make({ result })), Effect.catch((failure) => Effect.succeed(PortFailed.make({ failure }))));
+/**
+* Execute one decoded port request against THIS Object's LOCAL facets — the owner-side half
+* of the routed ports (plan §1.3). Callers must provide the WP1 local facets, never the
+* routed decorators: the routing layer already established that this Object owns the
+* addressed Thread, and re-routing here could bounce a request between Objects.
+* Failures never escape — every typed port failure becomes a `PortFailed` envelope that
+* re-decodes on the caller side.
+*/
+const executePortRequest = Effect.fn("DoPortRouting.executePortRequest")(function* (request) {
+	switch (request._tag) {
+		case "MessageDeliveryComplete": {
+			const store = yield* MessageDeliveryStore;
+			return yield* capture(store.change(request.key, {
+				_tag: "Complete",
+				...request.completion,
+				nowMillis: yield* Clock.currentTimeMillis
+			}).pipe(Effect.map((record) => MessageDeliveryCompleteResult.make({ record }))));
+		}
+		case "WorkerAdmit": return yield* capture(admitWorker(request.request).pipe(Effect.map((result) => WorkerAdmitResult.make({ result }))));
+		case "MessageDeliveryList": {
+			const store = yield* MessageDeliveryStore;
+			return yield* capture(store.list(request.request).pipe(Effect.map((page) => MessageDeliveryListResult.make({ page }))));
+		}
+		case "StoreCountPeerMessages": {
+			const store = yield* ThreadStore;
+			return yield* capture(store.countPeerMessages === void 0 ? Effect.fail(crossThreadStoreError("native read unavailable", request.request.threadId)) : store.countPeerMessages(request.request).pipe(Effect.map((count) => StoreCountPeerMessagesResult.make({ count }))));
+		}
+		case "LedgerAdmit": {
+			const ledger = yield* SubmissionLedger;
+			return yield* capture(ledger.admit(request.request).pipe(Effect.map((result) => LedgerAdmitResult.make({ result }))));
+		}
+		case "LedgerMarkReady": {
+			const ledger = yield* SubmissionLedger;
+			return yield* capture(ledger.markReady(request.request).pipe(Effect.map(() => LedgerMarkReadyResult.make({}))));
+		}
+		case "LedgerLookup": {
+			const ledger = yield* SubmissionLedger;
+			return yield* capture(ledger.lookup(request.request).pipe(Effect.map((submission) => Option.isSome(submission) ? LedgerLookupResult.make({ submission: submission.value }) : LedgerLookupResult.make({}))));
+		}
+		case "LedgerResolveAdmission": {
+			const ledger = yield* SubmissionLedger;
+			return yield* capture(ledger.resolveAdmission(request.request).pipe(Effect.map((resolution) => LedgerResolveAdmissionResult.make({ resolution }))));
+		}
+		case "LedgerInspectWorker": {
+			const ledger = yield* SubmissionLedger;
+			return yield* capture(ledger.inspectWorker === void 0 ? Effect.fail(LedgerError.make({
+				operation: "inspectWorker",
+				message: "Worker inspection unavailable"
+			})) : ledger.inspectWorker(request.request.threadId).pipe(Effect.map((state) => LedgerInspectWorkerResult.make({ state }))));
+		}
+		case "LedgerStopWorker": {
+			const ledger = yield* SubmissionLedger;
+			return yield* capture(ledger.stopWorker === void 0 ? Effect.fail(LedgerError.make({
+				operation: "stopWorker",
+				message: "Worker stop unavailable"
+			})) : ledger.stopWorker(request.request).pipe(Effect.map((owned) => LedgerStopWorkerResult.make({ owned }))));
+		}
+		case "LedgerRequestAbort": {
+			const ledger = yield* SubmissionLedger;
+			return yield* capture(ledger.requestAbort(request.request).pipe(Effect.map((intent) => LedgerRequestAbortResult.make({ intent }))));
+		}
+		case "LedgerRecordChildSettled": {
+			const ledger = yield* SubmissionLedger;
+			return yield* capture(ledger.recordChildSettled(request.request).pipe(Effect.map((outcome) => LedgerRecordChildSettledResult.make({ outcome }))));
+		}
+		case "StoreMaterialize": {
+			const store = yield* ThreadStore;
+			return yield* capture(store.materialize(request.request).pipe(Effect.map(() => StoreMaterializeResult.make({}))));
+		}
+		case "StoreAppend": {
+			const store = yield* ThreadStore;
+			return yield* capture(store.append(request.request).pipe(Effect.map((result) => StoreAppendResult.make({ result }))));
+		}
+		case "StoreReadPage": {
+			const store = yield* ThreadStore;
+			return yield* capture(store.read(request.request).pipe(Stream.runCollect, Effect.map((records) => StoreReadPageResult.make({ records: [...records] }))));
+		}
+		case "StoreInspectTail": {
+			const store = yield* ThreadStore;
+			return yield* capture(store.inspectTail(request.request).pipe(Effect.map((tail) => StoreInspectTailResult.make({ tail }))));
+		}
+		case "StoreReadIdentity": {
+			const store = yield* ThreadStore;
+			return yield* capture(store.readIdentity(request.request).pipe(Effect.map((identity) => StoreReadIdentityResult.make({ identity }))));
+		}
+		case "StoreExport": {
+			const store = yield* ThreadStore;
+			return yield* capture(store.export(request.request).pipe(Effect.map((threadExport) => StoreExportResult.make({ export: threadExport }))));
+		}
+	}
+});
+/**
+* The last-resort wire fallback when even encoding a response fails: the literal encoded
+* form of `PortFailed(PortProtocolError)` — tagged classes of bounded strings encode to
+* exactly this shape, so no Schema round trip is needed to produce it.
+*/
+const encodedProtocolFailure = (message) => ({
+	_tag: "PortFailed",
+	failure: {
+		_tag: "PortProtocolError",
+		message: boundPortDiagnostic(message)
+	}
+});
+/**
+* The complete owner-side endpoint body for `portCall` (D-P6-3): decode the wire request,
+* execute it against this Object's LOCAL facets, and answer with the encoded response
+* envelope. Total by construction — a request that cannot be decoded, or a response that
+* cannot be encoded, answers `PortFailed(PortProtocolError)` instead of throwing, so the
+* transport never has to interpret exceptions as protocol answers.
+*/
+const handleEncodedPortRequest = Effect.fn("DoPortRouting.handleEncodedPortRequest")(function* (encoded) {
+	const response = yield* decodePortRequest(encoded).pipe(Effect.flatMap(executePortRequest), Effect.catch((error) => Effect.succeed(PortFailed.make({ failure: PortProtocolError.make({ message: boundPortDiagnostic(`The port request could not be decoded: ${error.message}`) }) }))));
+	return yield* encodePortResponse(response).pipe(Effect.catch((error) => Effect.succeed(encodedProtocolFailure(`The port response could not be encoded: ${error.message}`))));
+});
+//#endregion
+export { PortTransportError, ThreadPortTransport, executePortRequest, handleEncodedPortRequest, makeLocalSubmissionLookup, portTransportFailure, routedMessageDeliveryStoreLayer, routedSubmissionLedgerLayer, routedThreadStoreLayer, routedWorkerAdmissionLayer, PortRouting_exports as t };
+
+//# sourceMappingURL=PortRouting.mjs.map