effect-agent 0.1.0-beta.12 → 0.1.0-beta.121

package/dist/durable/Certification.mjs

@@ -0,0 +1,159 @@
+import { LedgerCapabilities } from "./SubmissionLedger.mjs";
+import { DurableRuntimeFailpointLocation } from "./DurableFailpoint.mjs";
+import { n as safeUnknownString, t as inspectForeignDiagnostic } from "../foreign-diagnostic-DBQ1XHKh.mjs";
+import { submissionLedgerConformanceCases } from "./SubmissionLedgerConformance.mjs";
+import { threadStoreConformanceCases } from "./ThreadStoreConformance.mjs";
+import { Cause, Effect, Exit, Option, Schema } from "effect";
+//#region src/durable/Certification.ts
+const BoundedCertificationDetail = Schema.String.check(Schema.isMaxLength(4096));
+/**
+* Adapter self-description carried by a certificate. `durability` is read from the candidate
+* ledger's `capabilities` — the adapter's honest claim (persistence.md), never inferred by the
+* certification runner.
+*/
+var CertifiedAdapterIdentity = class extends Schema.Class("@effect-agent/thread/CertifiedAdapterIdentity")({
+	/** Workspace/package name of the adapter pair under certification. */
+	name: Schema.NonEmptyString.check(Schema.isMaxLength(256)),
+	version: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),
+	durability: LedgerCapabilities.fields.durability
+}) {};
+/** Which shared suite one Tier-1 (or lever-driven Tier-3) case belongs to. */
+const CertificationSuite = Schema.Literals([
+	"submission-ledger",
+	"thread-store",
+	"real-loss"
+]);
+/** One executed certification case: a conformance contract case or a Tier-3 lever row. */
+var CertificationCaseResult = class extends Schema.Class("@effect-agent/thread/CertificationCaseResult")({
+	suite: CertificationSuite,
+	name: Schema.NonEmptyString.check(Schema.isMaxLength(512)),
+	status: Schema.Literals(["passed", "failed"]),
+	detail: Schema.optionalKey(BoundedCertificationDetail)
+}) {};
+/**
+* The six Tier-2 scenario shapes: each reached coordinator fault boundary is armed once
+* per shape. Locations outside a shape's path share its verified clean run.
+*/
+const CertificationScenario = Schema.Literals([
+	"plain",
+	"uncertain-tool",
+	"durable-steps",
+	"approval",
+	"join",
+	"delegation"
+]);
+/**
+* Outcome of one Tier-2 sweep cell:
+*
+* - `converged` — the armed fault fired once, recovery classified the state, and the re-drive
+*   converged to verified invariants;
+* - `not-triggered` — the location was not reached with that fault armed, or was absent from
+*   the scenario's verified clean path (shared across such locations). Never fault coverage;
+* - `failed` — anything else.
+*/
+const CertificationSweepStatus = Schema.Literals([
+	"converged",
+	"not-triggered",
+	"failed"
+]);
+/** One Tier-2 scenario/location result, including locations outside the verified path. */
+var CertificationSweepResult = class extends Schema.Class("@effect-agent/thread/CertificationSweepResult")({
+	scenario: CertificationScenario,
+	location: DurableRuntimeFailpointLocation,
+	/** The armed fault actually fired (one-shot) somewhere in the cell's drive or re-drive. */
+	failpointFired: Schema.Boolean,
+	status: CertificationSweepStatus,
+	/**
+	* Every lane's digest chain recomputed from `EMPTY_TAIL_DIGEST` and matched the exported
+	* tail — fully discharged here because the runner captures per-batch producer identity at
+	* append time (the port-only admin `verify` reports this check `skipped` instead).
+	* Unreached locations may share the scenario's clean-run verification.
+	*/
+	digestChainVerified: Schema.Boolean,
+	detail: Schema.optionalKey(BoundedCertificationDetail)
+}) {};
+/**
+* How the real-loss tier was discharged. Tier 3 is never silently claimed: an adapter either
+* exercised a real loss lever in this run (`exercised`), cites committed real-loss evidence
+* (`recorded-evidence`), honestly records that nothing exercised it (`not-exercised`), or is a
+* non-durable reference adapter with no real loss to exercise (`not-applicable`).
+*/
+const CertificationTierThreeStatus = Schema.Literals([
+	"exercised",
+	"recorded-evidence",
+	"not-exercised",
+	"not-applicable"
+]);
+/** The Tier-3 (real loss lever) section of a certificate. */
+var CertificationTierThreeReport = class extends Schema.Class("@effect-agent/thread/CertificationTierThreeReport")({
+	status: CertificationTierThreeStatus,
+	/** Cited real-loss suites. The runner does not execute or verify these references. */
+	evidence: Schema.Array(BoundedCertificationDetail),
+	/** Rows executed by a supplied crash lever in THIS run (`suite: "real-loss"`). */
+	cases: Schema.Array(CertificationCaseResult),
+	detail: Schema.optionalKey(BoundedCertificationDetail)
+}) {};
+/**
+* The Schema-encoded certification report (plan §1): Tier 1 = the two shared port contract
+* suites verbatim; Tier 2 = the coordinator failpoint convergence sweep; Tier 3 = the real
+* loss lever record. `ok` is true exactly when every EXECUTED check passed — honest scope
+* statements (`not-triggered`, `recorded-evidence`, `not-exercised`, `not-applicable`) never
+* count as failures and never count as silent coverage. `fullyCertified` additionally requires
+* a durable adapter and passing real-loss cases executed in this run. Citations alone do not
+* certify recovery. A non-durable adapter can pass conformance but is never fully certified.
+* The semantic assertions live in the runner tests.
+*/
+var CertificationReport = class extends Schema.Class("@effect-agent/thread/CertificationReport")({
+	format: Schema.Literal("effect-agent/certification@2"),
+	adapter: CertifiedAdapterIdentity,
+	generatedAt: Schema.DateTimeUtcFromString,
+	tier1: Schema.Array(CertificationCaseResult),
+	tier2: Schema.Array(CertificationSweepResult),
+	tier3: CertificationTierThreeReport,
+	ok: Schema.Boolean,
+	fullyCertified: Schema.Boolean
+}) {};
+/** Bounded operator-readable rendering of one failure Cause for a certification detail. */
+const causeDetail = (cause) => {
+	const failure = Cause.findErrorOption(cause);
+	if (Option.isSome(failure)) {
+		const diagnostic = inspectForeignDiagnostic(failure.value);
+		if (diagnostic.tag !== void 0 || diagnostic.message !== void 0) return `${diagnostic.tag ?? "Error"}${diagnostic.message === void 0 ? "" : `: ${diagnostic.message}`}`.slice(0, 4096);
+		return safeUnknownString(failure.value, "Unknown foreign failure").slice(0, 4096);
+	}
+	return `defect: ${safeUnknownString(cause, "Unknown defect")}`.slice(0, 4096);
+};
+const caseResult = (suite, name, exit) => Exit.isSuccess(exit) ? CertificationCaseResult.make({
+	suite,
+	name,
+	status: "passed"
+}) : CertificationCaseResult.make({
+	suite,
+	name,
+	status: "failed",
+	detail: causeDetail(exit.cause)
+});
+/**
+* Tier 1 — port contract (plan §1): run BOTH shared conformance case arrays verbatim against
+* the provided candidate adapters and fold every case into a typed result. Case failures are
+* captured per-case (never short-circuiting the sweep), so a certificate always reports the
+* complete contract surface. Requires the candidate `SubmissionLedger` and `ThreadStore`
+* plus `Crypto.Crypto`, and must run under a TestClock (the ledger cases drive lease expiry
+* through virtual time).
+*/
+const certifyPorts = Effect.fn("Thread.certifyPorts")(function* () {
+	const results = [];
+	for (const contractCase of submissionLedgerConformanceCases) {
+		const exit = yield* Effect.exit(contractCase.run);
+		results.push(caseResult("submission-ledger", contractCase.name, exit));
+	}
+	for (const contractCase of threadStoreConformanceCases) {
+		const exit = yield* Effect.exit(contractCase.run);
+		results.push(caseResult("thread-store", contractCase.name, exit));
+	}
+	return results;
+});
+//#endregion
+export { CertificationCaseResult, CertificationReport, CertificationScenario, CertificationSuite, CertificationSweepResult, CertificationSweepStatus, CertificationTierThreeReport, CertificationTierThreeStatus, CertifiedAdapterIdentity, certifyPorts };
+
+//# sourceMappingURL=Certification.mjs.map

package/dist/durable/Certification.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Certification.mjs","names":[],"sources":["../../src/durable/Certification.ts"],"sourcesContent":["import type { Crypto } from \"effect\";\nimport { Cause, Effect, Exit, Option, Schema } from \"effect\";\n\nimport { DurableRuntimeFailpointLocation } from \"./DurableFailpoint.ts\";\nimport { inspectForeignDiagnostic, safeUnknownString } from \"./internal/foreign-diagnostic.ts\";\nimport type { SubmissionLedger } from \"./SubmissionLedger.ts\";\nimport { LedgerCapabilities } from \"./SubmissionLedger.ts\";\nimport { submissionLedgerConformanceCases } from \"./SubmissionLedgerConformance.ts\";\nimport type { ThreadStore } from \"./ThreadStore.ts\";\nimport { threadStoreConformanceCases } from \"./ThreadStoreConformance.ts\";\n\n// ---------------------------------------------------------------------------\n// Certification report vocabulary (WP2, plan §1)\n// ---------------------------------------------------------------------------\n\nconst BoundedCertificationDetail = Schema.String.check(Schema.isMaxLength(4_096));\n\n/**\n * Adapter self-description carried by a certificate. `durability` is read from the candidate\n * ledger's `capabilities` — the adapter's honest claim (persistence.md), never inferred by the\n * certification runner.\n */\nexport class CertifiedAdapterIdentity extends Schema.Class<CertifiedAdapterIdentity>(\n  \"@effect-agent/thread/CertifiedAdapterIdentity\",\n)({\n  /** Workspace/package name of the adapter pair under certification. */\n  name: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n  version: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  durability: LedgerCapabilities.fields.durability,\n}) {}\n\n/** Which shared suite one Tier-1 (or lever-driven Tier-3) case belongs to. */\nexport const CertificationSuite = Schema.Literals([\n  \"submission-ledger\",\n  \"thread-store\",\n  \"real-loss\",\n]);\n\nexport type CertificationSuite = typeof CertificationSuite.Type;\n\n/** One executed certification case: a conformance contract case or a Tier-3 lever row. */\nexport class CertificationCaseResult extends Schema.Class<CertificationCaseResult>(\n  \"@effect-agent/thread/CertificationCaseResult\",\n)({\n  suite: CertificationSuite,\n  name: Schema.NonEmptyString.check(Schema.isMaxLength(512)),\n  status: Schema.Literals([\"passed\", \"failed\"]),\n  detail: Schema.optionalKey(BoundedCertificationDetail),\n}) {}\n\n/**\n * The six Tier-2 scenario shapes: each reached coordinator fault boundary is armed once\n * per shape. Locations outside a shape's path share its verified clean run.\n */\nexport const CertificationScenario = Schema.Literals([\n  \"plain\",\n  \"uncertain-tool\",\n  \"durable-steps\",\n  \"approval\",\n  \"join\",\n  \"delegation\",\n]);\n\nexport type CertificationScenario = typeof CertificationScenario.Type;\n\n/**\n * Outcome of one Tier-2 sweep cell:\n *\n * - `converged` — the armed fault fired once, recovery classified the state, and the re-drive\n *   converged to verified invariants;\n * - `not-triggered` — the location was not reached with that fault armed, or was absent from\n *   the scenario's verified clean path (shared across such locations). Never fault coverage;\n * - `failed` — anything else.\n */\nexport const CertificationSweepStatus = Schema.Literals([\"converged\", \"not-triggered\", \"failed\"]);\nexport type CertificationSweepStatus = typeof CertificationSweepStatus.Type;\n\n/** One Tier-2 scenario/location result, including locations outside the verified path. */\nexport class CertificationSweepResult extends Schema.Class<CertificationSweepResult>(\n  \"@effect-agent/thread/CertificationSweepResult\",\n)({\n  scenario: CertificationScenario,\n  location: DurableRuntimeFailpointLocation,\n  /** The armed fault actually fired (one-shot) somewhere in the cell's drive or re-drive. */\n  failpointFired: Schema.Boolean,\n  status: CertificationSweepStatus,\n  /**\n   * Every lane's digest chain recomputed from `EMPTY_TAIL_DIGEST` and matched the exported\n   * tail — fully discharged here because the runner captures per-batch producer identity at\n   * append time (the port-only admin `verify` reports this check `skipped` instead).\n   * Unreached locations may share the scenario's clean-run verification.\n   */\n  digestChainVerified: Schema.Boolean,\n  detail: Schema.optionalKey(BoundedCertificationDetail),\n}) {}\n\n/**\n * How the real-loss tier was discharged. Tier 3 is never silently claimed: an adapter either\n * exercised a real loss lever in this run (`exercised`), cites committed real-loss evidence\n * (`recorded-evidence`), honestly records that nothing exercised it (`not-exercised`), or is a\n * non-durable reference adapter with no real loss to exercise (`not-applicable`).\n */\nexport const CertificationTierThreeStatus = Schema.Literals([\n  \"exercised\",\n  \"recorded-evidence\",\n  \"not-exercised\",\n  \"not-applicable\",\n]);\n\nexport type CertificationTierThreeStatus = typeof CertificationTierThreeStatus.Type;\n\n/** The Tier-3 (real loss lever) section of a certificate. */\nexport class CertificationTierThreeReport extends Schema.Class<CertificationTierThreeReport>(\n  \"@effect-agent/thread/CertificationTierThreeReport\",\n)({\n  status: CertificationTierThreeStatus,\n  /** Cited real-loss suites. The runner does not execute or verify these references. */\n  evidence: Schema.Array(BoundedCertificationDetail),\n  /** Rows executed by a supplied crash lever in THIS run (`suite: \"real-loss\"`). */\n  cases: Schema.Array(CertificationCaseResult),\n  detail: Schema.optionalKey(BoundedCertificationDetail),\n}) {}\n\n/**\n * The Schema-encoded certification report (plan §1): Tier 1 = the two shared port contract\n * suites verbatim; Tier 2 = the coordinator failpoint convergence sweep; Tier 3 = the real\n * loss lever record. `ok` is true exactly when every EXECUTED check passed — honest scope\n * statements (`not-triggered`, `recorded-evidence`, `not-exercised`, `not-applicable`) never\n * count as failures and never count as silent coverage. `fullyCertified` additionally requires\n * a durable adapter and passing real-loss cases executed in this run. Citations alone do not\n * certify recovery. A non-durable adapter can pass conformance but is never fully certified.\n * The semantic assertions live in the runner tests.\n */\nexport class CertificationReport extends Schema.Class<CertificationReport>(\n  \"@effect-agent/thread/CertificationReport\",\n)({\n  format: Schema.Literal(\"effect-agent/certification@2\"),\n  adapter: CertifiedAdapterIdentity,\n  generatedAt: Schema.DateTimeUtcFromString,\n  tier1: Schema.Array(CertificationCaseResult),\n  tier2: Schema.Array(CertificationSweepResult),\n  tier3: CertificationTierThreeReport,\n  ok: Schema.Boolean,\n  fullyCertified: Schema.Boolean,\n}) {}\n\n/** Bounded operator-readable rendering of one failure Cause for a certification detail. */\nconst causeDetail = (cause: Cause.Cause<unknown>): string => {\n  const failure = Cause.findErrorOption(cause);\n\n  if (Option.isSome(failure)) {\n    const diagnostic = inspectForeignDiagnostic(failure.value);\n\n    if (diagnostic.tag !== undefined || diagnostic.message !== undefined) {\n      const tag = diagnostic.tag ?? \"Error\";\n\n      return `${tag}${diagnostic.message === undefined ? \"\" : `: ${diagnostic.message}`}`.slice(\n        0,\n        4_096,\n      );\n    }\n\n    return safeUnknownString(failure.value, \"Unknown foreign failure\").slice(0, 4_096);\n  }\n\n  return `defect: ${safeUnknownString(cause, \"Unknown defect\")}`.slice(0, 4_096);\n};\n\nconst caseResult = <A, E>(\n  suite: CertificationSuite,\n  name: string,\n  exit: Exit.Exit<A, E>,\n): CertificationCaseResult =>\n  Exit.isSuccess(exit)\n    ? CertificationCaseResult.make({ suite, name, status: \"passed\" })\n    : CertificationCaseResult.make({\n        suite,\n        name,\n        status: \"failed\",\n        detail: causeDetail(exit.cause),\n      });\n\n/**\n * Tier 1 — port contract (plan §1): run BOTH shared conformance case arrays verbatim against\n * the provided candidate adapters and fold every case into a typed result. Case failures are\n * captured per-case (never short-circuiting the sweep), so a certificate always reports the\n * complete contract surface. Requires the candidate `SubmissionLedger` and `ThreadStore`\n * plus `Crypto.Crypto`, and must run under a TestClock (the ledger cases drive lease expiry\n * through virtual time).\n */\nexport const certifyPorts = Effect.fn(\"Thread.certifyPorts\")(function* (): Effect.fn.Return<\n  ReadonlyArray<CertificationCaseResult>,\n  never,\n  SubmissionLedger | ThreadStore | Crypto.Crypto\n> {\n  const results: Array<CertificationCaseResult> = [];\n\n  for (const contractCase of submissionLedgerConformanceCases) {\n    const exit = yield* Effect.exit(contractCase.run);\n\n    results.push(caseResult(\"submission-ledger\", contractCase.name, exit));\n  }\n  for (const contractCase of threadStoreConformanceCases) {\n    const exit = yield* Effect.exit(contractCase.run);\n\n    results.push(caseResult(\"thread-store\", contractCase.name, exit));\n  }\n\n  return results;\n});\n"],"mappings":";;;;;;;AAeA,MAAM,6BAA6B,OAAO,OAAO,MAAM,OAAO,YAAY,IAAK,CAAC;;;;;;AAOhF,IAAa,2BAAb,cAA8C,OAAO,MACnD,+CACF,CAAC,CAAC;;CAEA,MAAM,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACzD,SAAS,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CACxE,YAAY,mBAAmB,OAAO;AACxC,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,qBAAqB,OAAO,SAAS;CAChD;CACA;CACA;AACF,CAAC;;AAKD,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,OAAO;CACP,MAAM,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACzD,QAAQ,OAAO,SAAS,CAAC,UAAU,QAAQ,CAAC;CAC5C,QAAQ,OAAO,YAAY,0BAA0B;AACvD,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,MAAa,wBAAwB,OAAO,SAAS;CACnD;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;;;AAaD,MAAa,2BAA2B,OAAO,SAAS;CAAC;CAAa;CAAiB;AAAQ,CAAC;;AAIhG,IAAa,2BAAb,cAA8C,OAAO,MACnD,+CACF,CAAC,CAAC;CACA,UAAU;CACV,UAAU;;CAEV,gBAAgB,OAAO;CACvB,QAAQ;;;;;;;CAOR,qBAAqB,OAAO;CAC5B,QAAQ,OAAO,YAAY,0BAA0B;AACvD,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,MAAa,+BAA+B,OAAO,SAAS;CAC1D;CACA;CACA;CACA;AACF,CAAC;;AAKD,IAAa,+BAAb,cAAkD,OAAO,MACvD,mDACF,CAAC,CAAC;CACA,QAAQ;;CAER,UAAU,OAAO,MAAM,0BAA0B;;CAEjD,OAAO,OAAO,MAAM,uBAAuB;CAC3C,QAAQ,OAAO,YAAY,0BAA0B;AACvD,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;AAYJ,IAAa,sBAAb,cAAyC,OAAO,MAC9C,0CACF,CAAC,CAAC;CACA,QAAQ,OAAO,QAAQ,8BAA8B;CACrD,SAAS;CACT,aAAa,OAAO;CACpB,OAAO,OAAO,MAAM,uBAAuB;CAC3C,OAAO,OAAO,MAAM,wBAAwB;CAC5C,OAAO;CACP,IAAI,OAAO;CACX,gBAAgB,OAAO;AACzB,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAM,eAAe,UAAwC;CAC3D,MAAM,UAAU,MAAM,gBAAgB,KAAK;CAE3C,IAAI,OAAO,OAAO,OAAO,GAAG;EAC1B,MAAM,aAAa,yBAAyB,QAAQ,KAAK;EAEzD,IAAI,WAAW,QAAQ,KAAA,KAAa,WAAW,YAAY,KAAA,GAGzD,OAAO,GAFK,WAAW,OAAO,UAEd,WAAW,YAAY,KAAA,IAAY,KAAK,KAAK,WAAW,YAAY,MAClF,GACA,IACF;EAGF,OAAO,kBAAkB,QAAQ,OAAO,yBAAyB,CAAC,CAAC,MAAM,GAAG,IAAK;CACnF;CAEA,OAAO,WAAW,kBAAkB,OAAO,gBAAgB,IAAI,MAAM,GAAG,IAAK;AAC/E;AAEA,MAAM,cACJ,OACA,MACA,SAEA,KAAK,UAAU,IAAI,IACf,wBAAwB,KAAK;CAAE;CAAO;CAAM,QAAQ;AAAS,CAAC,IAC9D,wBAAwB,KAAK;CAC3B;CACA;CACA,QAAQ;CACR,QAAQ,YAAY,KAAK,KAAK;AAChC,CAAC;;;;;;;;;AAUP,MAAa,eAAe,OAAO,GAAG,qBAAqB,CAAC,CAAC,aAI3D;CACA,MAAM,UAA0C,CAAC;CAEjD,KAAK,MAAM,gBAAgB,kCAAkC;EAC3D,MAAM,OAAO,OAAO,OAAO,KAAK,aAAa,GAAG;EAEhD,QAAQ,KAAK,WAAW,qBAAqB,aAAa,MAAM,IAAI,CAAC;CACvE;CACA,KAAK,MAAM,gBAAgB,6BAA6B;EACtD,MAAM,OAAO,OAAO,OAAO,KAAK,aAAa,GAAG;EAEhD,QAAQ,KAAK,WAAW,gBAAgB,aAAa,MAAM,IAAI,CAAC;CAClE;CAEA,OAAO;AACT,CAAC"}

package/dist/durable/CommittedActivity.d.mts

@@ -0,0 +1,62 @@
+import { Ci as DigestError, O as PersistedJson, Sn as ThreadStore, dn as ThreadNotMaterialized, l as CanonicalRecordEnvelope, wn as ThreadStoreError } from "../Records-D88mgvyS.mjs";
+import { ActivityProcessorKey, ActivityProcessorStore, ActivityStoreFailure, PreparedActivity } from "./ActivityStore.mjs";
+import { Crypto, Effect, Schema, Scope } from "effect";
+declare namespace CommittedActivity_d_exports {
+  export { ActivityPassLimits, ActivityPassResult, ActivityProcessingError, CommittedActivityProcessor, activityWorkId, processCommittedActivity };
+}
+declare const ActivityPassLimits_base: Schema.Class<ActivityPassLimits, Schema.Struct<{
+  readonly maxRecords: Schema.Int;
+  readonly pageSize: Schema.Int;
+  readonly timeoutMillis: Schema.Int;
+  readonly leaseMillis: Schema.Int;
+}>, {}>;
+export declare class ActivityPassLimits extends ActivityPassLimits_base {}
+declare const ActivityProcessingError_base: Schema.Class<ActivityProcessingError, Schema.TaggedStruct<"ActivityProcessingError", {
+  readonly reason: Schema.Literals<readonly ["invalid-input", "noncontiguous", "timeout"]>;
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ActivityProcessingError extends ActivityProcessingError_base {}
+declare const ActivityPassResult_base: Schema.Class<ActivityPassResult, Schema.Struct<{
+  readonly key: typeof ActivityProcessorKey;
+  readonly capturedTail: Schema.brand<Schema.Natural, "@effect-agent/thread/CanonicalSequence">;
+  readonly throughSequence: Schema.brand<Schema.Natural, "@effect-agent/thread/CanonicalSequence">;
+  readonly processed: Schema.Natural;
+  readonly pendingRecords: Schema.Natural;
+  readonly startedAt: Schema.Finite;
+  readonly finishedAt: Schema.Finite;
+}>, {}>;
+export declare class ActivityPassResult extends ActivityPassResult_base {}
+export interface CommittedActivityProcessor<E = never, R = never, EApply = never, RApply = never> {
+  readonly key: ActivityProcessorKey;
+  /** Unique to this worker lifetime; it is not canonical Thread ownership. */
+  readonly owner: string;
+  readonly limits: ActivityPassLimits;
+  /** Select eligibility and encode an application Schema; null can represent no output. */
+  readonly extract: (record: CanonicalRecordEnvelope) => Effect.Effect<PersistedJson, E, R>;
+  /**
+   * Must durably reconcile workId before returning, using atomic idempotency and conditional
+   * writes. This may run again after any lost acknowledgement. A stale invocation can finish
+   * only the already pinned output; it must not overwrite a later correction or withdrawal.
+   * Retain reconciliation evidence for the lifetime of pending work, including any supported
+   * backup/restore window. Returning before durable application would permit skipped output.
+   */
+  readonly apply: (work: PreparedActivity) => Effect.Effect<void, EApply, RApply>;
+}
+/** Stable work identity independent of worker claims, retry count, extraction, and clocks. */
+export declare const activityWorkId: (key: ActivityProcessorKey, sequence: number & import("effect/Brand").Brand<"@effect-agent/thread/CanonicalSequence">) => Effect.Effect<string & import("effect/Brand").Brand<"@effect-agent/thread/Digest">, DigestError, Crypto.Crypto>;
+/**
+ * Process one bounded committed prefix of one application-selected Thread. Nothing runs until
+ * invoked, and no daemon, global Thread directory, admission ledger, or engine checkpoint is
+ * involved. PersistentHistory makes a successful Run's batch visible together; durable Runs
+ * expose incremental committed records. The application decides what each record means.
+ *
+ * A durable pending output wins over a new extraction after restart. Apply finishes before
+ * progress advances, so separate output stores require durable idempotency. This does not
+ * promise exactly-once external side effects. Each callback owns a Scope; the finite pass has
+ * a timeout and a longer lease. Claim release has a separate 500ms deadline; failure leaves
+ * the bounded lease to expire.
+ */
+export declare const processCommittedActivity: <E = never, R = never, EApply = never, RApply = never>(processor: CommittedActivityProcessor<E, R, EApply, RApply>) => Effect.Effect<ActivityPassResult, E | EApply | ActivityProcessingError | DigestError | ThreadNotMaterialized | ThreadStoreError | ActivityStoreFailure, ActivityProcessorStore | Crypto.Crypto | ThreadStore | Exclude<R, Scope.Scope> | Exclude<RApply, Scope.Scope>>;
+//#endregion
+export { CommittedActivity_d_exports as t };
+//# sourceMappingURL=CommittedActivity.d.mts.map

package/dist/durable/CommittedActivity.mjs

@@ -0,0 +1,159 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { CanonicalRecordEnvelope, CanonicalSequence, PersistedJson, RecordEnvelope } from "./Records.mjs";
+import { ActivityClaim, ActivityClaimRequest, ActivityProcessorKey, ActivityProcessorStore, PreparedActivity } from "./ActivityStore.mjs";
+import { digestJson } from "./Digest.mjs";
+import { ThreadRead, ThreadStore, ThreadTail, ThreadTailRequest } from "./ThreadStore.mjs";
+import { Clock, Effect, Schema, Stream } from "effect";
+//#region src/durable/CommittedActivity.ts
+var CommittedActivity_exports = /* @__PURE__ */ __exportAll({
+	ActivityPassLimits: () => ActivityPassLimits,
+	ActivityPassResult: () => ActivityPassResult,
+	ActivityProcessingError: () => ActivityProcessingError,
+	activityWorkId: () => activityWorkId,
+	processCommittedActivity: () => processCommittedActivity
+});
+var ActivityPassLimits = class extends Schema.Class("@effect-agent/thread/ActivityPassLimits")({
+	maxRecords: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 4096
+	})),
+	pageSize: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 128
+	})),
+	timeoutMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 3e5
+	})),
+	leaseMillis: ActivityClaimRequest.fields.leaseMillis
+}) {};
+var ActivityProcessingError = class extends Schema.TaggedError()("ActivityProcessingError", {
+	reason: Schema.Literals([
+		"invalid-input",
+		"noncontiguous",
+		"timeout"
+	]),
+	message: Schema.String.check(Schema.isMaxLength(1024))
+}) {};
+var ActivityPassResult = class extends Schema.Class("@effect-agent/thread/ActivityPassResult")({
+	key: ActivityProcessorKey,
+	capturedTail: CanonicalSequence,
+	throughSequence: CanonicalSequence,
+	processed: Schema.Natural,
+	pendingRecords: Schema.Natural,
+	startedAt: Schema.Finite,
+	finishedAt: Schema.Finite
+}) {};
+const invalid = (message) => ActivityProcessingError.make({
+	reason: "invalid-input",
+	message
+});
+const contiguous = () => ActivityProcessingError.make({
+	reason: "noncontiguous",
+	message: "Committed activity does not match its captured Thread prefix or pinned record"
+});
+/** Stable work identity independent of worker claims, retry count, extraction, and clocks. */
+const activityWorkId = Effect.fn("activityWorkId")(function* (key, sequence) {
+	return yield* digestJson([
+		"effect-agent/activity@1",
+		key.processorId,
+		key.processorVersion,
+		key.threadId,
+		sequence
+	]);
+});
+/**
+* Process one bounded committed prefix of one application-selected Thread. Nothing runs until
+* invoked, and no daemon, global Thread directory, admission ledger, or engine checkpoint is
+* involved. PersistentHistory makes a successful Run's batch visible together; durable Runs
+* expose incremental committed records. The application decides what each record means.
+*
+* A durable pending output wins over a new extraction after restart. Apply finishes before
+* progress advances, so separate output stores require durable idempotency. This does not
+* promise exactly-once external side effects. Each callback owns a Scope; the finite pass has
+* a timeout and a longer lease. Claim release has a separate 500ms deadline; failure leaves
+* the bounded lease to expire.
+*/
+const processCommittedActivity = Effect.fn("processCommittedActivity")(function* (processor) {
+	const key = yield* Schema.decodeEffect(ActivityProcessorKey)(processor.key).pipe(Effect.mapError(() => invalid("Invalid activity processor key")));
+	const limits = yield* Schema.decodeEffect(ActivityPassLimits)(processor.limits).pipe(Effect.mapError(() => invalid("Invalid activity pass limits")));
+	if (limits.leaseMillis < limits.timeoutMillis + 1e3) return yield* invalid("The activity lease must exceed the pass timeout by at least 1000ms");
+	const request = yield* ActivityClaimRequest.makeEffect({
+		key,
+		owner: processor.owner,
+		leaseMillis: limits.leaseMillis
+	}).pipe(Effect.mapError(() => invalid("Invalid activity worker identity")));
+	const progress = yield* ActivityProcessorStore;
+	const threads = yield* ThreadStore;
+	return yield* Effect.scoped(Effect.gen(function* () {
+		const acquired = yield* Effect.acquireRelease(progress.claim(request).pipe(Effect.interruptible), (claim) => progress.release(claim).pipe(Effect.interruptible, Effect.timeoutOption(500), Effect.ignore));
+		let claim = yield* Schema.decodeEffect(ActivityClaim)(acquired).pipe(Effect.mapError(() => invalid("Malformed activity claim")));
+		if (!Schema.toEquivalence(ActivityProcessorKey)(claim.key, key) || claim.owner !== request.owner) return yield* invalid("Activity claim identity does not match its request");
+		const startedAt = yield* Clock.currentTimeMillis;
+		const tail = yield* threads.inspectTail(ThreadTailRequest.make({ threadId: key.threadId })).pipe(Effect.flatMap((value) => Schema.decodeEffect(ThreadTail)(value).pipe(Effect.mapError(contiguous))));
+		if (tail.threadId !== key.threadId || tail.tailSequence < claim.throughSequence || claim.pending !== null && tail.tailSequence < claim.pending.sequence) return yield* contiguous();
+		const through = Math.min(tail.tailSequence, claim.throughSequence + limits.maxRecords);
+		let processed = 0;
+		while (claim.throughSequence < through) {
+			const limit = Math.min(limits.pageSize, through - claim.throughSequence);
+			const page = yield* threads.read(ThreadRead.make({
+				threadId: key.threadId,
+				afterSequence: claim.throughSequence,
+				limit
+			})).pipe(Stream.take(limit + 1), Stream.runCollect);
+			if (page.length !== limit) return yield* contiguous();
+			for (const rawRecord of page) {
+				const record = yield* Schema.decodeEffect(Schema.toType(CanonicalRecordEnvelope))(rawRecord).pipe(Effect.mapError(contiguous));
+				if (record.threadId !== key.threadId || record.sequence !== claim.throughSequence + 1) return yield* contiguous();
+				const workId = yield* activityWorkId(key, record.sequence);
+				const encodedRecord = yield* Schema.encodeEffect(RecordEnvelope)(record.record).pipe(Effect.mapError(contiguous));
+				const recordDigest = yield* digestJson(encodedRecord);
+				let work = claim.pending;
+				if (work === null) {
+					const output = yield* Effect.scoped(processor.extract(record)).pipe(Effect.flatMap((value) => Schema.decodeEffect(PersistedJson)(value).pipe(Effect.mapError(() => invalid("Malformed activity output")))));
+					work = yield* progress.prepare({
+						claim,
+						work: PreparedActivity.make({
+							version: 1,
+							key,
+							sequence: record.sequence,
+							workId,
+							recordId: record.record.recordId,
+							recordDigest,
+							output
+						})
+					});
+				}
+				const prepared = yield* Schema.decodeEffect(PreparedActivity)(work).pipe(Effect.mapError(() => invalid("Malformed prepared activity")));
+				if (!Schema.toEquivalence(ActivityProcessorKey)(prepared.key, key) || prepared.sequence !== record.sequence || prepared.workId !== workId || prepared.recordId !== record.record.recordId || prepared.recordDigest !== recordDigest) return yield* contiguous();
+				yield* Effect.scoped(processor.apply(prepared));
+				const next = yield* progress.advance({
+					claim,
+					workId
+				}).pipe(Effect.flatMap((value) => Schema.decodeEffect(ActivityClaim)(value).pipe(Effect.mapError(() => invalid("Malformed activity progress")))));
+				if (!Schema.toEquivalence(ActivityProcessorKey)(next.key, key) || next.owner !== claim.owner || next.epoch !== claim.epoch || next.throughSequence !== record.sequence || next.pending !== null) return yield* invalid("Activity progress advanced outside the claimed record");
+				claim = next;
+				processed += 1;
+			}
+		}
+		return ActivityPassResult.make({
+			key,
+			capturedTail: tail.tailSequence,
+			throughSequence: claim.throughSequence,
+			processed,
+			pendingRecords: tail.tailSequence - claim.throughSequence,
+			startedAt,
+			finishedAt: yield* Clock.currentTimeMillis
+		});
+	})).pipe(Effect.timeoutOrElse({
+		duration: limits.timeoutMillis,
+		orElse: () => Effect.fail(ActivityProcessingError.make({
+			reason: "timeout",
+			message: "Activity pass timed out"
+		}))
+	}));
+});
+//#endregion
+export { ActivityPassLimits, ActivityPassResult, ActivityProcessingError, activityWorkId, processCommittedActivity, CommittedActivity_exports as t };
+
+//# sourceMappingURL=CommittedActivity.mjs.map

package/dist/durable/CommittedActivity.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommittedActivity.mjs","names":[],"sources":["../../src/durable/CommittedActivity.ts"],"sourcesContent":["import { Clock, Effect, Schema, Stream, type Crypto, type Scope } from \"effect\";\n\nimport {\n  ActivityClaim,\n  ActivityClaimRequest,\n  ActivityProcessorKey,\n  ActivityProcessorStore,\n  PreparedActivity,\n  type ActivityStoreFailure,\n} from \"./ActivityStore.ts\";\nimport { digestJson, type DigestError } from \"./Digest.ts\";\nimport {\n  CanonicalRecordEnvelope,\n  CanonicalSequence,\n  PersistedJson,\n  RecordEnvelope,\n} from \"./Records.ts\";\nimport {\n  ThreadRead,\n  ThreadStore,\n  ThreadTail,\n  ThreadTailRequest,\n  type ThreadNotMaterialized,\n  type ThreadStoreError,\n} from \"./ThreadStore.ts\";\n\nexport class ActivityPassLimits extends Schema.Class<ActivityPassLimits>(\n  \"@effect-agent/thread/ActivityPassLimits\",\n)({\n  maxRecords: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 4_096 })),\n  pageSize: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 128 })),\n  timeoutMillis: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 300_000 })),\n  leaseMillis: ActivityClaimRequest.fields.leaseMillis,\n}) {}\n\nexport class ActivityProcessingError extends Schema.TaggedError<ActivityProcessingError>()(\n  \"ActivityProcessingError\",\n  {\n    reason: Schema.Literals([\"invalid-input\", \"noncontiguous\", \"timeout\"]),\n    message: Schema.String.check(Schema.isMaxLength(1_024)),\n  },\n) {}\n\nexport class ActivityPassResult extends Schema.Class<ActivityPassResult>(\n  \"@effect-agent/thread/ActivityPassResult\",\n)({\n  key: ActivityProcessorKey,\n  capturedTail: CanonicalSequence,\n  throughSequence: CanonicalSequence,\n  processed: Schema.Natural,\n  pendingRecords: Schema.Natural,\n  startedAt: Schema.Finite,\n  finishedAt: Schema.Finite,\n}) {}\n\nexport interface CommittedActivityProcessor<E = never, R = never, EApply = never, RApply = never> {\n  readonly key: ActivityProcessorKey;\n  /** Unique to this worker lifetime; it is not canonical Thread ownership. */\n  readonly owner: string;\n  readonly limits: ActivityPassLimits;\n  /** Select eligibility and encode an application Schema; null can represent no output. */\n  readonly extract: (record: CanonicalRecordEnvelope) => Effect.Effect<PersistedJson, E, R>;\n  /**\n   * Must durably reconcile workId before returning, using atomic idempotency and conditional\n   * writes. This may run again after any lost acknowledgement. A stale invocation can finish\n   * only the already pinned output; it must not overwrite a later correction or withdrawal.\n   * Retain reconciliation evidence for the lifetime of pending work, including any supported\n   * backup/restore window. Returning before durable application would permit skipped output.\n   */\n  readonly apply: (work: PreparedActivity) => Effect.Effect<void, EApply, RApply>;\n}\n\nconst invalid = (message: string) =>\n  ActivityProcessingError.make({ reason: \"invalid-input\", message });\n\nconst contiguous = () =>\n  ActivityProcessingError.make({\n    reason: \"noncontiguous\",\n    message: \"Committed activity does not match its captured Thread prefix or pinned record\",\n  });\n\n/** Stable work identity independent of worker claims, retry count, extraction, and clocks. */\nexport const activityWorkId = Effect.fn(\"activityWorkId\")(function* (\n  key: ActivityProcessorKey,\n  sequence: CanonicalSequence,\n) {\n  return yield* digestJson([\n    \"effect-agent/activity@1\",\n    key.processorId,\n    key.processorVersion,\n    key.threadId,\n    sequence,\n  ]);\n});\n\n/**\n * Process one bounded committed prefix of one application-selected Thread. Nothing runs until\n * invoked, and no daemon, global Thread directory, admission ledger, or engine checkpoint is\n * involved. PersistentHistory makes a successful Run's batch visible together; durable Runs\n * expose incremental committed records. The application decides what each record means.\n *\n * A durable pending output wins over a new extraction after restart. Apply finishes before\n * progress advances, so separate output stores require durable idempotency. This does not\n * promise exactly-once external side effects. Each callback owns a Scope; the finite pass has\n * a timeout and a longer lease. Claim release has a separate 500ms deadline; failure leaves\n * the bounded lease to expire.\n */\nexport const processCommittedActivity = Effect.fn(\"processCommittedActivity\")(function* <\n  E = never,\n  R = never,\n  EApply = never,\n  RApply = never,\n>(\n  processor: CommittedActivityProcessor<E, R, EApply, RApply>,\n): Effect.fn.Return<\n  ActivityPassResult,\n  | E\n  | EApply\n  | ActivityStoreFailure\n  | ActivityProcessingError\n  | DigestError\n  | ThreadStoreError\n  | ThreadNotMaterialized,\n  ActivityProcessorStore | ThreadStore | Crypto.Crypto | Exclude<R | RApply, Scope.Scope>\n> {\n  const key = yield* Schema.decodeEffect(ActivityProcessorKey)(processor.key).pipe(\n    Effect.mapError(() => invalid(\"Invalid activity processor key\")),\n  );\n\n  const limits = yield* Schema.decodeEffect(ActivityPassLimits)(processor.limits).pipe(\n    Effect.mapError(() => invalid(\"Invalid activity pass limits\")),\n  );\n\n  if (limits.leaseMillis < limits.timeoutMillis + 1_000) {\n    return yield* invalid(\"The activity lease must exceed the pass timeout by at least 1000ms\");\n  }\n\n  const request = yield* ActivityClaimRequest.makeEffect({\n    key,\n    owner: processor.owner,\n    leaseMillis: limits.leaseMillis,\n  }).pipe(Effect.mapError(() => invalid(\"Invalid activity worker identity\")));\n\n  const progress = yield* ActivityProcessorStore;\n  const threads = yield* ThreadStore;\n\n  return yield* Effect.scoped(\n    Effect.gen(function* () {\n      const acquired = yield* Effect.acquireRelease(\n        progress.claim(request).pipe(Effect.interruptible),\n        (claim) =>\n          progress\n            .release(claim)\n            .pipe(Effect.interruptible, Effect.timeoutOption(500), Effect.ignore),\n      );\n\n      let claim = yield* Schema.decodeEffect(ActivityClaim)(acquired).pipe(\n        Effect.mapError(() => invalid(\"Malformed activity claim\")),\n      );\n\n      if (\n        !Schema.toEquivalence(ActivityProcessorKey)(claim.key, key) ||\n        claim.owner !== request.owner\n      )\n        return yield* invalid(\"Activity claim identity does not match its request\");\n      const startedAt = yield* Clock.currentTimeMillis;\n\n      const tail = yield* threads\n        .inspectTail(ThreadTailRequest.make({ threadId: key.threadId }))\n        .pipe(\n          Effect.flatMap((value) =>\n            Schema.decodeEffect(ThreadTail)(value).pipe(Effect.mapError(contiguous)),\n          ),\n        );\n\n      if (\n        tail.threadId !== key.threadId ||\n        tail.tailSequence < claim.throughSequence ||\n        (claim.pending !== null && tail.tailSequence < claim.pending.sequence)\n      ) {\n        return yield* contiguous();\n      }\n      const through = Math.min(tail.tailSequence, claim.throughSequence + limits.maxRecords);\n      let processed = 0;\n\n      while (claim.throughSequence < through) {\n        const limit = Math.min(limits.pageSize, through - claim.throughSequence);\n\n        const page = yield* threads\n          .read(\n            ThreadRead.make({\n              threadId: key.threadId,\n              afterSequence: claim.throughSequence,\n              limit,\n            }),\n          )\n          .pipe(Stream.take(limit + 1), Stream.runCollect);\n\n        if (page.length !== limit) return yield* contiguous();\n        for (const rawRecord of page) {\n          const record = yield* Schema.decodeEffect(Schema.toType(CanonicalRecordEnvelope))(\n            rawRecord,\n          ).pipe(Effect.mapError(contiguous));\n\n          if (record.threadId !== key.threadId || record.sequence !== claim.throughSequence + 1) {\n            return yield* contiguous();\n          }\n          const workId = yield* activityWorkId(key, record.sequence);\n\n          const encodedRecord = yield* Schema.encodeEffect(RecordEnvelope)(record.record).pipe(\n            Effect.mapError(contiguous),\n          );\n\n          const recordDigest = yield* digestJson(encodedRecord);\n          let work = claim.pending;\n\n          if (work === null) {\n            const output = yield* Effect.scoped(processor.extract(record)).pipe(\n              Effect.flatMap((value) =>\n                Schema.decodeEffect(PersistedJson)(value).pipe(\n                  Effect.mapError(() => invalid(\"Malformed activity output\")),\n                ),\n              ),\n            );\n\n            work = yield* progress.prepare({\n              claim,\n              work: PreparedActivity.make({\n                version: 1,\n                key,\n                sequence: record.sequence,\n                workId,\n                recordId: record.record.recordId,\n                recordDigest,\n                output,\n              }),\n            });\n          }\n\n          const prepared = yield* Schema.decodeEffect(PreparedActivity)(work).pipe(\n            Effect.mapError(() => invalid(\"Malformed prepared activity\")),\n          );\n\n          if (\n            !Schema.toEquivalence(ActivityProcessorKey)(prepared.key, key) ||\n            prepared.sequence !== record.sequence ||\n            prepared.workId !== workId ||\n            prepared.recordId !== record.record.recordId ||\n            prepared.recordDigest !== recordDigest\n          )\n            return yield* contiguous();\n          yield* Effect.scoped(processor.apply(prepared));\n\n          const next = yield* progress\n            .advance({ claim, workId })\n            .pipe(\n              Effect.flatMap((value) =>\n                Schema.decodeEffect(ActivityClaim)(value).pipe(\n                  Effect.mapError(() => invalid(\"Malformed activity progress\")),\n                ),\n              ),\n            );\n\n          if (\n            !Schema.toEquivalence(ActivityProcessorKey)(next.key, key) ||\n            next.owner !== claim.owner ||\n            next.epoch !== claim.epoch ||\n            next.throughSequence !== record.sequence ||\n            next.pending !== null\n          )\n            return yield* invalid(\"Activity progress advanced outside the claimed record\");\n          claim = next;\n          processed += 1;\n        }\n      }\n\n      return ActivityPassResult.make({\n        key,\n        capturedTail: tail.tailSequence,\n        throughSequence: claim.throughSequence,\n        processed,\n        pendingRecords: tail.tailSequence - claim.throughSequence,\n        startedAt,\n        finishedAt: yield* Clock.currentTimeMillis,\n      });\n    }),\n  ).pipe(\n    Effect.timeoutOrElse({\n      duration: limits.timeoutMillis,\n      orElse: () =>\n        Effect.fail(\n          ActivityProcessingError.make({ reason: \"timeout\", message: \"Activity pass timed out\" }),\n        ),\n    }),\n  );\n});\n"],"mappings":";;;;;;;;;;;;;;AA0BA,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,YAAY,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAM,CAAC,CAAC;CAC7E,UAAU,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAI,CAAC,CAAC;CACzE,eAAe,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAQ,CAAC,CAAC;CAClF,aAAa,qBAAqB,OAAO;AAC3C,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA;CACE,QAAQ,OAAO,SAAS;EAAC;EAAiB;EAAiB;CAAS,CAAC;CACrE,SAAS,OAAO,OAAO,MAAM,OAAO,YAAY,IAAK,CAAC;AACxD,CACF,CAAC,CAAC,CAAC;AAEH,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,KAAK;CACL,cAAc;CACd,iBAAiB;CACjB,WAAW,OAAO;CAClB,gBAAgB,OAAO;CACvB,WAAW,OAAO;CAClB,YAAY,OAAO;AACrB,CAAC,CAAC,CAAC,CAAC;AAmBJ,MAAM,WAAW,YACf,wBAAwB,KAAK;CAAE,QAAQ;CAAiB;AAAQ,CAAC;AAEnE,MAAM,mBACJ,wBAAwB,KAAK;CAC3B,QAAQ;CACR,SAAS;AACX,CAAC;;AAGH,MAAa,iBAAiB,OAAO,GAAG,gBAAgB,CAAC,CAAC,WACxD,KACA,UACA;CACA,OAAO,OAAO,WAAW;EACvB;EACA,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ;CACF,CAAC;AACH,CAAC;;;;;;;;;;;;;AAcD,MAAa,2BAA2B,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAM5E,WAWA;CACA,MAAM,MAAM,OAAO,OAAO,aAAa,oBAAoB,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAC1E,OAAO,eAAe,QAAQ,gCAAgC,CAAC,CACjE;CAEA,MAAM,SAAS,OAAO,OAAO,aAAa,kBAAkB,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,KAC9E,OAAO,eAAe,QAAQ,8BAA8B,CAAC,CAC/D;CAEA,IAAI,OAAO,cAAc,OAAO,gBAAgB,KAC9C,OAAO,OAAO,QAAQ,oEAAoE;CAG5F,MAAM,UAAU,OAAO,qBAAqB,WAAW;EACrD;EACA,OAAO,UAAU;EACjB,aAAa,OAAO;CACtB,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,QAAQ,kCAAkC,CAAC,CAAC;CAE1E,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAO;CAEvB,OAAO,OAAO,OAAO,OACnB,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,OAAO,eAC7B,SAAS,MAAM,OAAO,CAAC,CAAC,KAAK,OAAO,aAAa,IAChD,UACC,SACG,QAAQ,KAAK,CAAC,CACd,KAAK,OAAO,eAAe,OAAO,cAAc,GAAG,GAAG,OAAO,MAAM,CAC1E;EAEA,IAAI,QAAQ,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC9D,OAAO,eAAe,QAAQ,0BAA0B,CAAC,CAC3D;EAEA,IACE,CAAC,OAAO,cAAc,oBAAoB,CAAC,CAAC,MAAM,KAAK,GAAG,KAC1D,MAAM,UAAU,QAAQ,OAExB,OAAO,OAAO,QAAQ,oDAAoD;EAC5E,MAAM,YAAY,OAAO,MAAM;EAE/B,MAAM,OAAO,OAAO,QACjB,YAAY,kBAAkB,KAAK,EAAE,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,CAC/D,KACC,OAAO,SAAS,UACd,OAAO,aAAa,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,CAAC,CACzE,CACF;EAEF,IACE,KAAK,aAAa,IAAI,YACtB,KAAK,eAAe,MAAM,mBACzB,MAAM,YAAY,QAAQ,KAAK,eAAe,MAAM,QAAQ,UAE7D,OAAO,OAAO,WAAW;EAE3B,MAAM,UAAU,KAAK,IAAI,KAAK,cAAc,MAAM,kBAAkB,OAAO,UAAU;EACrF,IAAI,YAAY;EAEhB,OAAO,MAAM,kBAAkB,SAAS;GACtC,MAAM,QAAQ,KAAK,IAAI,OAAO,UAAU,UAAU,MAAM,eAAe;GAEvE,MAAM,OAAO,OAAO,QACjB,KACC,WAAW,KAAK;IACd,UAAU,IAAI;IACd,eAAe,MAAM;IACrB;GACF,CAAC,CACH,CAAC,CACA,KAAK,OAAO,KAAK,QAAQ,CAAC,GAAG,OAAO,UAAU;GAEjD,IAAI,KAAK,WAAW,OAAO,OAAO,OAAO,WAAW;GACpD,KAAK,MAAM,aAAa,MAAM;IAC5B,MAAM,SAAS,OAAO,OAAO,aAAa,OAAO,OAAO,uBAAuB,CAAC,CAAC,CAC/E,SACF,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,CAAC;IAElC,IAAI,OAAO,aAAa,IAAI,YAAY,OAAO,aAAa,MAAM,kBAAkB,GAClF,OAAO,OAAO,WAAW;IAE3B,MAAM,SAAS,OAAO,eAAe,KAAK,OAAO,QAAQ;IAEzD,MAAM,gBAAgB,OAAO,OAAO,aAAa,cAAc,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,KAC9E,OAAO,SAAS,UAAU,CAC5B;IAEA,MAAM,eAAe,OAAO,WAAW,aAAa;IACpD,IAAI,OAAO,MAAM;IAEjB,IAAI,SAAS,MAAM;KACjB,MAAM,SAAS,OAAO,OAAO,OAAO,UAAU,QAAQ,MAAM,CAAC,CAAC,CAAC,KAC7D,OAAO,SAAS,UACd,OAAO,aAAa,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KACxC,OAAO,eAAe,QAAQ,2BAA2B,CAAC,CAC5D,CACF,CACF;KAEA,OAAO,OAAO,SAAS,QAAQ;MAC7B;MACA,MAAM,iBAAiB,KAAK;OAC1B,SAAS;OACT;OACA,UAAU,OAAO;OACjB;OACA,UAAU,OAAO,OAAO;OACxB;OACA;MACF,CAAC;KACH,CAAC;IACH;IAEA,MAAM,WAAW,OAAO,OAAO,aAAa,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,KAClE,OAAO,eAAe,QAAQ,6BAA6B,CAAC,CAC9D;IAEA,IACE,CAAC,OAAO,cAAc,oBAAoB,CAAC,CAAC,SAAS,KAAK,GAAG,KAC7D,SAAS,aAAa,OAAO,YAC7B,SAAS,WAAW,UACpB,SAAS,aAAa,OAAO,OAAO,YACpC,SAAS,iBAAiB,cAE1B,OAAO,OAAO,WAAW;IAC3B,OAAO,OAAO,OAAO,UAAU,MAAM,QAAQ,CAAC;IAE9C,MAAM,OAAO,OAAO,SACjB,QAAQ;KAAE;KAAO;IAAO,CAAC,CAAC,CAC1B,KACC,OAAO,SAAS,UACd,OAAO,aAAa,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KACxC,OAAO,eAAe,QAAQ,6BAA6B,CAAC,CAC9D,CACF,CACF;IAEF,IACE,CAAC,OAAO,cAAc,oBAAoB,CAAC,CAAC,KAAK,KAAK,GAAG,KACzD,KAAK,UAAU,MAAM,SACrB,KAAK,UAAU,MAAM,SACrB,KAAK,oBAAoB,OAAO,YAChC,KAAK,YAAY,MAEjB,OAAO,OAAO,QAAQ,uDAAuD;IAC/E,QAAQ;IACR,aAAa;GACf;EACF;EAEA,OAAO,mBAAmB,KAAK;GAC7B;GACA,cAAc,KAAK;GACnB,iBAAiB,MAAM;GACvB;GACA,gBAAgB,KAAK,eAAe,MAAM;GAC1C;GACA,YAAY,OAAO,MAAM;EAC3B,CAAC;CACH,CAAC,CACH,CAAC,CAAC,KACA,OAAO,cAAc;EACnB,UAAU,OAAO;EACjB,cACE,OAAO,KACL,wBAAwB,KAAK;GAAE,QAAQ;GAAW,SAAS;EAA0B,CAAC,CACxF;CACJ,CAAC,CACH;AACF,CAAC"}

package/dist/durable/Digest.d.mts

@@ -0,0 +1,2 @@
+import { Ci as DigestError, Di as digestDefinition, Ei as digestCanonicalBatch, Oi as digestDefinitions, Ti as EMPTY_TAIL_DIGEST, ki as digestJson } from "../Records-D88mgvyS.mjs";
+export { DigestError, EMPTY_TAIL_DIGEST, digestCanonicalBatch, digestDefinition, digestDefinitions, digestJson };

package/dist/durable/Digest.mjs

@@ -0,0 +1,50 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { CanonicalBatch, DefinitionDigests, Digest } from "./Records.mjs";
+import { Array, Crypto, Effect, Encoding, Schema } from "effect";
+//#region src/durable/Digest.ts
+var Digest_exports = /* @__PURE__ */ __exportAll({
+	DigestError: () => DigestError,
+	EMPTY_TAIL_DIGEST: () => EMPTY_TAIL_DIGEST,
+	digestCanonicalBatch: () => digestCanonicalBatch,
+	digestDefinition: () => digestDefinition,
+	digestDefinitions: () => digestDefinitions,
+	digestJson: () => digestJson
+});
+var DigestError = class extends Schema.TaggedError()("DigestError", {
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+const utf8 = new TextEncoder();
+const canonicalJson = (value) => {
+	if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${globalThis.Array.from(value, canonicalJson).join(",")}]`;
+	return `{${Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
+};
+/** Digest a JSON value using a stable, locale-independent object-key ordering (UTF-16 code units, RFC 8785 style). */
+const digestJson = Effect.fnUntraced(function* (value) {
+	const crypto = yield* Crypto.Crypto;
+	const bytes = utf8.encode(canonicalJson(value));
+	const digest = yield* crypto.digest("SHA-256", bytes).pipe(Effect.mapError((error) => DigestError.make({
+		message: `SHA-256 failed: ${error.message}`,
+		cause: error
+	})));
+	return yield* Schema.decodeEffect(Digest)(Encoding.encodeHex(digest)).pipe(Effect.mapError(() => DigestError.make({ message: "SHA-256 returned an invalid digest" })));
+});
+/** Digest a canonical batch together with the prior tail to form an append-only hash chain. */
+const digestCanonicalBatch = (previousTailDigest, batch) => Schema.encodeEffect(CanonicalBatch)(batch).pipe(Effect.mapError(() => DigestError.make({ message: "Canonical batch encoding failed" })), Effect.flatMap((encoded) => digestJson({
+	previousTailDigest,
+	batch: encoded
+})));
+/** Digest one schema-encoded Agent, Model, or Toolkit definition. */
+const digestDefinition = (definition) => digestJson(definition);
+/** Digest all replay-relevant definitions without hiding which authority changed. */
+const digestDefinitions = (definitions) => Effect.all({
+	agent: digestDefinition(definitions.agent),
+	model: digestDefinition(definitions.model),
+	tools: digestDefinition(definitions.tools)
+}).pipe(Effect.map((digests) => DefinitionDigests.make(digests)));
+const EMPTY_TAIL_DIGEST = Schema.decodeSync(Digest)("0000000000000000000000000000000000000000000000000000000000000000");
+//#endregion
+export { DigestError, EMPTY_TAIL_DIGEST, digestCanonicalBatch, digestDefinition, digestDefinitions, digestJson, Digest_exports as t };
+
+//# sourceMappingURL=Digest.mjs.map

package/dist/durable/Digest.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Digest.mjs","names":[],"sources":["../../src/durable/Digest.ts"],"sourcesContent":["import type { PlatformError } from \"effect\";\nimport { Array, Crypto, Effect, Encoding, Schema } from \"effect\";\n\nimport type { DefinitionDigestInput } from \"./Records.ts\";\nimport { CanonicalBatch, DefinitionDigests, Digest } from \"./Records.ts\";\n\nexport class DigestError extends Schema.TaggedError<DigestError>()(\"DigestError\", {\n  message: Schema.String,\n  cause: Schema.optionalKey(Schema.Defect()),\n}) {}\n\nconst utf8 = new TextEncoder();\n\nconst canonicalJson = (value: Schema.Json): string => {\n  if (\n    value === null ||\n    typeof value === \"boolean\" ||\n    typeof value === \"number\" ||\n    typeof value === \"string\"\n  ) {\n    return JSON.stringify(value);\n  }\n  if (Array.isArray<Schema.Json>(value)) {\n    return `[${globalThis.Array.from(value, canonicalJson).join(\",\")}]`;\n  }\n\n  const entries = Object.entries(value).sort(([left], [right]) =>\n    left < right ? -1 : left > right ? 1 : 0,\n  );\n\n  return `{${entries\n    .map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`)\n    .join(\",\")}}`;\n};\n\n/** Digest a JSON value using a stable, locale-independent object-key ordering (UTF-16 code units, RFC 8785 style). */\nexport const digestJson = Effect.fnUntraced(function* (\n  value: Schema.Json,\n): Effect.fn.Return<Digest, DigestError, Crypto.Crypto> {\n  const crypto = yield* Crypto.Crypto;\n\n  const bytes = utf8.encode(canonicalJson(value));\n\n  const digest = yield* crypto\n    .digest(\"SHA-256\", bytes)\n    .pipe(\n      Effect.mapError((error: PlatformError.PlatformError) =>\n        DigestError.make({ message: `SHA-256 failed: ${error.message}`, cause: error }),\n      ),\n    );\n\n  return yield* Schema.decodeEffect(Digest)(Encoding.encodeHex(digest)).pipe(\n    Effect.mapError(() => DigestError.make({ message: \"SHA-256 returned an invalid digest\" })),\n  );\n});\n\n/** Digest a canonical batch together with the prior tail to form an append-only hash chain. */\nexport const digestCanonicalBatch = (\n  previousTailDigest: Digest,\n  batch: CanonicalBatch,\n): Effect.Effect<Digest, DigestError, Crypto.Crypto> =>\n  Schema.encodeEffect(CanonicalBatch)(batch).pipe(\n    Effect.mapError(() => DigestError.make({ message: \"Canonical batch encoding failed\" })),\n    Effect.flatMap((encoded) =>\n      digestJson({\n        previousTailDigest,\n        batch: encoded,\n      }),\n    ),\n  );\n\n/** Digest one schema-encoded Agent, Model, or Toolkit definition. */\nexport const digestDefinition = (definition: Schema.Json) => digestJson(definition);\n\n/** Digest all replay-relevant definitions without hiding which authority changed. */\nexport const digestDefinitions = (\n  definitions: DefinitionDigestInput,\n): Effect.Effect<DefinitionDigests, DigestError, Crypto.Crypto> =>\n  Effect.all({\n    agent: digestDefinition(definitions.agent),\n    model: digestDefinition(definitions.model),\n    tools: digestDefinition(definitions.tools),\n  }).pipe(Effect.map((digests) => DefinitionDigests.make(digests)));\n\nexport const EMPTY_TAIL_DIGEST = Schema.decodeSync(Digest)(\n  \"0000000000000000000000000000000000000000000000000000000000000000\",\n);\n"],"mappings":";;;;;;;;;;;;AAMA,IAAa,cAAb,cAAiC,OAAO,YAAyB,CAAC,CAAC,eAAe;CAChF,SAAS,OAAO;CAChB,OAAO,OAAO,YAAY,OAAO,OAAO,CAAC;AAC3C,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,OAAO,IAAI,YAAY;AAE7B,MAAM,iBAAiB,UAA+B;CACpD,IACE,UAAU,QACV,OAAO,UAAU,aACjB,OAAO,UAAU,YACjB,OAAO,UAAU,UAEjB,OAAO,KAAK,UAAU,KAAK;CAE7B,IAAI,MAAM,QAAqB,KAAK,GAClC,OAAO,IAAI,WAAW,MAAM,KAAK,OAAO,aAAa,CAAC,CAAC,KAAK,GAAG,EAAE;CAOnE,OAAO,IAJS,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WACnD,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAGxB,CAAC,CACf,KAAK,CAAC,KAAK,WAAW,GAAG,KAAK,UAAU,GAAG,EAAE,GAAG,cAAc,KAAK,GAAG,CAAC,CACvE,KAAK,GAAG,EAAE;AACf;;AAGA,MAAa,aAAa,OAAO,WAAW,WAC1C,OACsD;CACtD,MAAM,SAAS,OAAO,OAAO;CAE7B,MAAM,QAAQ,KAAK,OAAO,cAAc,KAAK,CAAC;CAE9C,MAAM,SAAS,OAAO,OACnB,OAAO,WAAW,KAAK,CAAC,CACxB,KACC,OAAO,UAAU,UACf,YAAY,KAAK;EAAE,SAAS,mBAAmB,MAAM;EAAW,OAAO;CAAM,CAAC,CAChF,CACF;CAEF,OAAO,OAAO,OAAO,aAAa,MAAM,CAAC,CAAC,SAAS,UAAU,MAAM,CAAC,CAAC,CAAC,KACpE,OAAO,eAAe,YAAY,KAAK,EAAE,SAAS,qCAAqC,CAAC,CAAC,CAC3F;AACF,CAAC;;AAGD,MAAa,wBACX,oBACA,UAEA,OAAO,aAAa,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,KACzC,OAAO,eAAe,YAAY,KAAK,EAAE,SAAS,kCAAkC,CAAC,CAAC,GACtF,OAAO,SAAS,YACd,WAAW;CACT;CACA,OAAO;AACT,CAAC,CACH,CACF;;AAGF,MAAa,oBAAoB,eAA4B,WAAW,UAAU;;AAGlF,MAAa,qBACX,gBAEA,OAAO,IAAI;CACT,OAAO,iBAAiB,YAAY,KAAK;CACzC,OAAO,iBAAiB,YAAY,KAAK;CACzC,OAAO,iBAAiB,YAAY,KAAK;AAC3C,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,kBAAkB,KAAK,OAAO,CAAC,CAAC;AAElE,MAAa,oBAAoB,OAAO,WAAW,MAAM,CAAC,CACxD,kEACF"}

package/dist/durable/DurableAgentRuntime.d.mts

@@ -0,0 +1,3 @@
+import { a as Receipt } from "../Receipt-BAHyigAF.mjs";
+import { At as DurableRetryFailure, Bt as RecoveryFailure, Ct as DurableApprovalSuspension, Dt as DurableObserveOptions, Et as DurableObligationFailure, Ft as DurableSubmitOptions, Gt as isolateRecovery, Ht as RecoverySweepOptions, It as DurableVerifyFailure, Jt as threadCreatedBatchId, Kt as recoveryRepairBatchId, Lt as DurableWorkerFailure, Mt as DurableRuntimeConfigOptions, Nt as DurableSubmitAgent, Ot as DurableProgressFailure, Pt as DurableSubmitFailure, Rt as DurableWorkerRequirements, St as DurableApprovalResolver, Tt as DurableExplainFailure, Ut as RecoverySweepResult, Vt as RecoveryReport, Wt as childReservationIdFor, Yt as threadCreatedRecordId, _t as ApprovalSuspensionError, jt as DurableRuntimeConfig, kt as DurableResolveFailure, qt as recoveryRepairRecordId, vt as DurableAbortFailure, wt as DurableAwaitFailure, xt as DurableApprovalFailure, yt as DurableAgentRuntime, zt as RecoveryBlocked } from "../Records-D88mgvyS.mjs";
+export { ApprovalSuspensionError, DurableAbortFailure, DurableAgentRuntime, DurableApprovalFailure, DurableApprovalResolver, DurableApprovalSuspension, DurableAwaitFailure, DurableExplainFailure, DurableObligationFailure, DurableObserveOptions, DurableProgressFailure, DurableResolveFailure, DurableRetryFailure, DurableRuntimeConfig, DurableRuntimeConfigOptions, DurableSubmitAgent, DurableSubmitFailure, DurableSubmitOptions, DurableVerifyFailure, DurableWorkerFailure, DurableWorkerRequirements, Receipt, RecoveryBlocked, RecoveryFailure, RecoveryReport, RecoverySweepOptions, RecoverySweepResult, childReservationIdFor, isolateRecovery, recoveryRepairBatchId, recoveryRepairRecordId, threadCreatedBatchId, threadCreatedRecordId };

package/dist/durable/DurableAgentRuntime.mjs

@@ -0,0 +1,3 @@
+import { Receipt } from "../core/Receipt.mjs";
+import { a as DurableApprovalSuspension, c as RecoveryFailure, d as childReservationIdFor, f as isolateRecovery, g as threadCreatedRecordId, h as threadCreatedBatchId, i as DurableApprovalResolver, l as RecoveryReport, m as recoveryRepairRecordId, n as DurableAgentRuntime, o as DurableRuntimeConfig, p as recoveryRepairBatchId, s as RecoveryBlocked, t as ApprovalSuspensionError, u as RecoverySweepResult } from "../DurableAgentRuntime-B-9w7jDt.mjs";
+export { ApprovalSuspensionError, DurableAgentRuntime, DurableApprovalResolver, DurableApprovalSuspension, DurableRuntimeConfig, Receipt, RecoveryBlocked, RecoveryFailure, RecoveryReport, RecoverySweepResult, childReservationIdFor, isolateRecovery, recoveryRepairBatchId, recoveryRepairRecordId, threadCreatedBatchId, threadCreatedRecordId };

package/dist/durable/DurableFailpoint.d.mts

@@ -0,0 +1,2 @@
+import { a as DurableRuntimeFailpointLocation, i as DurableRuntimeFailpointHandler, n as DurableRuntimeFailpoint, r as DurableRuntimeFailpointError } from "../DurableFailpoint-Cnr3wx1L.mjs";
+export { DurableRuntimeFailpoint, DurableRuntimeFailpointError, DurableRuntimeFailpointHandler, DurableRuntimeFailpointLocation };

package/dist/durable/DurableFailpoint.mjs

@@ -0,0 +1,102 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+//#region src/durable/DurableFailpoint.ts
+var DurableFailpoint_exports = /* @__PURE__ */ __exportAll({
+	DurableRuntimeFailpoint: () => DurableRuntimeFailpoint,
+	DurableRuntimeFailpointError: () => DurableRuntimeFailpointError,
+	DurableRuntimeFailpointLocation: () => DurableRuntimeFailpointLocation
+});
+/**
+* Coordinator-owned failpoint locations (plan §Failpoints). Locations normally sit immediately
+* AFTER one durable mutation of the six-step coordinator flow, so a fault injected there
+* simulates a crash between two durable steps; the matching BEFORE boundary of each mutation is
+* owned by the storage adapters (`ledger:*:before`, `append:before`, ...), giving every durable
+* mutation a failpoint on both sides (change discipline). Run-start append also exposes its
+* BEFORE boundary here to distinguish a fresh clock from a committed clock in crash tests.
+*
+* The `subagent:*` family covers every durable mutation of the S2 establishment/join protocol
+* including reservation, request append, child admission, child readiness,
+* start-link append, sibling per-call settles at the suspension seam, the `waitingForChild`
+* suspension, child abort propagation, the atomic join batch, and both reservation-release
+* transitions.
+*/
+const DurableRuntimeFailpointLocation = Schema.Literals([
+	"submit:after-admit",
+	"submit:after-materialize",
+	"claim:after-claim",
+	"input:after-canonical-append",
+	"run:before-start-append",
+	"run:after-start-append",
+	"run:before-duration-append",
+	"run:after-duration-append",
+	"turn:after-canonical-append",
+	"turn:after-response-append",
+	"turn:after-results-append",
+	"compaction:before-canonical-append",
+	"compaction:after-canonical-append",
+	"checkpoint:before-save",
+	"checkpoint:after-save",
+	"tools:after-prepared-append",
+	"tools:before-prepared-append",
+	"tools:before-unavailable-append",
+	"tools:after-unavailable-append",
+	"policy:before-reservation-append",
+	"policy:after-reservation-append",
+	"step:after-step-append",
+	"approval:after-request-append",
+	"approval:after-suspend",
+	"join:after-claim",
+	"join:after-canonical-append",
+	"resolve:after-intent",
+	"terminalize:after-reserve",
+	"terminalize:after-canonical-append",
+	"abort:after-intent",
+	"subagent:after-reserve",
+	"subagent:after-request-append",
+	"subagent:after-admit",
+	"subagent:after-child-ready",
+	"subagent:after-start-append",
+	"subagent:after-sibling-settle",
+	"subagent:after-suspend",
+	"subagent:after-child-abort-intent",
+	"subagent:before-join-append",
+	"subagent:after-join-append",
+	"subagent:after-release-pending",
+	"subagent:after-release",
+	"worker:before-stop-append",
+	"worker:after-stop-append",
+	"worker:before-stop-seal",
+	"worker:after-stop-seal",
+	"worker:before-source-append",
+	"worker:after-source-append",
+	"worker:before-origin-append",
+	"worker:after-origin-append",
+	"worker:before-completion-append",
+	"worker:after-completion-append",
+	"worker:before-subtree-append",
+	"worker:after-subtree-append",
+	"worker:before-report-append",
+	"worker:after-report-append",
+	"worker:before-report-delivery",
+	"worker:after-report-delivery",
+	"update:before-canonical-append",
+	"update:after-canonical-append",
+	"update:before-delivery-insert",
+	"update:after-delivery-insert"
+]);
+/** Injected coordinator fault. Reaching the caller means the preceding durable step committed. */
+var DurableRuntimeFailpointError = class extends Schema.TaggedError()("DurableRuntimeFailpointError", { location: DurableRuntimeFailpointLocation }) {};
+const noFailpoint = () => Effect.void;
+/**
+* Explicit fault-injection authority used at durable coordinator step boundaries. The process
+* crash harness (WP5) maps a hit to `process.exit`; in-process tests fail the step with the
+* typed `DurableRuntimeFailpointError` instead.
+*/
+var DurableRuntimeFailpoint = class extends Context.Service()("@effect-agent/thread/DurableRuntimeFailpoint") {
+	/** Production default: no fault injection. */
+	static layer = Layer.succeed(this)({ hit: noFailpoint });
+};
+//#endregion
+export { DurableRuntimeFailpoint, DurableRuntimeFailpointError, DurableRuntimeFailpointLocation, DurableFailpoint_exports as t };
+
+//# sourceMappingURL=DurableFailpoint.mjs.map