@graftland/plugin-remote 0.0.0-stage → 0.2.0-beta.2

package/src/index.ts

@@ -0,0 +1,115 @@
+import { Plugin } from "@graftland/graft"
+import { ModuleResolver } from "@graftland/loader"
+import { Array, Cause, Effect, Path, Schema } from "effect"
+import type { Duration, Schedule } from "effect"
+import { SecureRandom } from "effect/crypto"
+import { ChildProcessSpawner } from "effect/process"
+import { launch } from "./internal/entry"
+import { follow } from "./internal/follow"
+import { CapabilityFailed } from "./internal/assembly"
+import { publicError } from "./internal/execution"
+import * as Configuration from "./internal/entryConfig"
+import * as Credential from "./internal/credentials"
+import { RemoteWithdrawn, RemoteError, MissingInstance } from "./Errors"
+import * as Contract from "./Contract"
+export { Contract }
+export { Instance } from "./Instance"
+export { RemoteTerminationUnconfirmed } from "./internal/runner/model"
+export { RemoteError, RemoteWithdrawn, MissingInstance } from "./Errors"
+export { UndeclaredFailure, ChildFailure } from "./Contract"
+export type {
+	Connect,
+	Source as CredentialSource,
+} from "./internal/credentials"
+
+export interface Options<
+	D extends ReadonlyArray<Plugin.Dependency> = readonly [],
+> {
+	readonly connect: Credential.Connect<D>
+	/** Contract module resolved independently in each execution environment. */
+	readonly contractModule: string
+	readonly config?: Schema.Json
+	readonly retry?: Schedule.Schedule<unknown, unknown> | undefined
+	readonly shutdownTimeout?: Duration.Input | undefined
+}
+const publicCause = <E extends Schema.Top>(
+	declared: E,
+	cause: Cause.Cause<unknown>,
+): Cause.Cause<
+	| E["Type"]
+	| Contract.UndeclaredFailure
+	| RemoteWithdrawn
+	| RemoteError
+	| MissingInstance
+> =>
+	Cause.fromReasons(
+		Array.flatMap(cause.reasons, (reason) => {
+			if (reason._tag !== "Fail") return [reason]
+			return Schema.is(CapabilityFailed)(reason.error)
+				? Array.map(
+						publicCause(declared, reason.error.cause).reasons,
+						(inner) => inner.annotate(Cause.reasonAnnotations(reason)),
+					)
+				: [
+						Cause.makeFailReason(publicError(declared, reason.error)).annotate(
+							Cause.reasonAnnotations(reason),
+						),
+					]
+		}),
+	)
+
+export const plugin = <
+	S extends Schema.Top & {
+		readonly Encoded: Schema.Json
+		readonly DecodingServices: never
+		readonly EncodingServices: never
+	},
+	E extends Schema.Top & {
+		readonly DecodingServices: never
+		readonly EncodingServices: never
+	},
+	const D extends ReadonlyArray<Plugin.Dependency> = readonly [],
+>(
+	contract: Contract.Contract<S, E>,
+	options: Options<D> & { readonly config?: S["Encoded"] },
+): Plugin.Plugin<
+	void,
+	void,
+	| E["Type"]
+	| Contract.UndeclaredFailure
+	| RemoteError
+	| RemoteWithdrawn
+	| MissingInstance
+> =>
+	Plugin.make({
+		name: contract.name,
+		inject: [
+			Plugin.optional(ModuleResolver.ModuleResolver),
+			Path.Path,
+			SecureRandom.SecureRandom,
+			ChildProcessSpawner.ChildProcessSpawner,
+		],
+		retry: options.retry,
+		apply: () =>
+			Effect.gen(function* () {
+				const input = yield* Schema.decodeUnknownEffect(Configuration.Host)({
+					contract: options.contractModule,
+					connect: options.connect,
+					config: options.config === undefined ? {} : options.config,
+				})
+				yield* Schema.decodeEffect(contract.config)(input.config)
+				const child = yield* launch(
+					contract,
+					input,
+					{
+						contractModule: options.contractModule,
+						shutdownTimeout: options.shutdownTimeout,
+					},
+					Credential.invocation(options.connect),
+				)
+				yield* follow(child, (cause) =>
+					Effect.failCause(publicCause(contract.error, cause)),
+				)
+			}).pipe(Effect.mapError((error) => publicError(contract.error, error))),
+	})
+export { host as default } from "./internal/entry"

package/src/internal/Certificates.ts

@@ -0,0 +1,330 @@
+import {
+	Array,
+	DateTime,
+	Effect,
+	FileSystem,
+	Path,
+	Redacted,
+	Result,
+	Schema,
+	String,
+} from "effect"
+import { SecureRandom, WebCrypto } from "effect/crypto"
+import { Base64 } from "effect/encoding"
+import { NetAddress } from "effect/net"
+import * as asn1js from "asn1js"
+import * as pki from "pkijs"
+
+export class CertificateError extends Schema.TaggedError<
+	CertificateError,
+	{ readonly brand: unique symbol }
+>()("CertificateError", {
+	detail: Schema.String,
+	cause: Schema.optional(Schema.Defect()),
+}) {
+	override get message() {
+		return this.detail
+	}
+}
+
+/** A requested output already exists and replacing it was not asked for. */
+export class CertificateExists extends Schema.TaggedError<
+	CertificateExists,
+	{ readonly brand: unique symbol }
+>()("CertificateExists", { file: Schema.String }) {
+	override get message() {
+		return `${this.file} already exists; use --force to replace the requested certificates`
+	}
+}
+
+/** Only PEM leaves this boundary; PKI.js objects stay local to each operation. */
+export interface Pem {
+	readonly certificate: string
+	readonly privateKey: Redacted.Redacted<string>
+}
+export interface IssueOptions {
+	readonly name: string
+	readonly days: number
+	readonly usage: "ca" | "server" | "client"
+	readonly hosts?: ReadonlyArray<string>
+	readonly identities?: ReadonlyArray<string>
+	readonly issuer?: Pem
+}
+const pem = (label: string, bytes: ArrayBuffer) =>
+	`-----BEGIN ${label}-----\n${String.replace(/.{64}(?=.)/g, "$&\n")(Base64.encode(new Uint8Array(bytes)))}\n-----END ${label}-----\n`
+// WebCrypto and PKI.js take ArrayBuffer-backed bytes, so the decoded view is copied into one.
+const der = (value: string) =>
+	Effect.fromResult(
+		Base64.decode(String.replace(/-----[^-]+-----|\s/g, "")(value)),
+	).pipe(Effect.map((bytes) => new Uint8Array(bytes)))
+const subject = (name: string) =>
+	new pki.RelativeDistinguishedNames({
+		typesAndValues: [
+			new pki.AttributeTypeAndValue({
+				type: "2.5.4.3",
+				value: new asn1js.Utf8String({ value: name }),
+			}),
+		],
+	})
+const hostName = (host: string) =>
+	Result.match(NetAddress.ipFromString(host), {
+		onFailure: () => new pki.GeneralName({ type: 2, value: host }),
+		onSuccess: (ip) =>
+			new pki.GeneralName({
+				type: 7,
+				value: new asn1js.OctetString({
+					valueHex: new Uint8Array(
+						ip._tag === "Ipv4Address"
+							? NetAddress.ipv4ToOctets(ip)
+							: NetAddress.ipv6ToOctets(ip),
+					),
+				}),
+			}),
+	})
+
+export const issue = Effect.fn("Certificates.issue")(function* (
+	options: IssueOptions,
+) {
+	const random = yield* SecureRandom.SecureRandom
+	const serial = yield* random.randomBytes(19)
+	const now = yield* DateTime.now
+	const webcrypto = yield* WebCrypto.WebCrypto
+	const engine = new pki.CryptoEngine({
+		name: "Node WebCrypto",
+		crypto: webcrypto,
+	})
+	const failure = (cause: unknown) =>
+		CertificateError.make({
+			detail: `Could not issue the certificate for ${options.name}`,
+			cause,
+		})
+	const keys = yield* Effect.tryPromise({
+		try: () =>
+			webcrypto.subtle.generateKey(
+				{ name: "ECDSA", namedCurve: "P-256" },
+				true,
+				["sign", "verify"],
+			),
+		catch: failure,
+	})
+	// Reused CA keys have the same P-256 / PKCS#8 format as the ones this command creates.
+	const authority =
+		options.issuer === undefined
+			? undefined
+			: {
+					certificate: yield* Effect.mapError(
+						der(options.issuer.certificate),
+						failure,
+					),
+					privateKey: yield* Effect.mapError(
+						der(Redacted.value(options.issuer.privateKey)),
+						failure,
+					),
+				}
+	const signingKey =
+		authority === undefined
+			? keys.privateKey
+			: yield* Effect.tryPromise({
+					try: () =>
+						webcrypto.subtle.importKey(
+							"pkcs8",
+							authority.privateKey,
+							{ name: "ECDSA", namedCurve: "P-256" },
+							false,
+							["sign"],
+						),
+					catch: failure,
+				})
+	const certificate = yield* Effect.try({
+		try: () => {
+			const issuer =
+				authority === undefined
+					? undefined
+					: pki.Certificate.fromBER(authority.certificate)
+			const names = [
+				...Array.map(options.hosts ?? [], hostName),
+				...Array.map(
+					options.identities ?? [],
+					(identity) =>
+						new pki.GeneralName({ type: 6, value: `graft://${identity}` }),
+				),
+			]
+			return new pki.Certificate({
+				version: 2,
+				// A leading nonzero byte keeps the serial positive without losing random bits.
+				serialNumber: new asn1js.Integer({
+					valueHex: new Uint8Array([1, ...serial]),
+				}),
+				subject: subject(options.name),
+				issuer: issuer?.subject ?? subject(options.name),
+				notBefore: new pki.Time({ value: DateTime.toDateUtc(now) }),
+				notAfter: new pki.Time({
+					value: DateTime.toDateUtc(DateTime.add(now, { days: options.days })),
+				}),
+				extensions: [
+					new pki.Extension({
+						extnID: "2.5.29.19",
+						critical: true,
+						extnValue: new pki.BasicConstraints({ cA: options.usage === "ca" })
+							.toSchema()
+							.toBER(),
+					}),
+					new pki.Extension({
+						extnID: "2.5.29.15",
+						critical: true,
+						extnValue: new asn1js.BitString({
+							valueHex: new Uint8Array([options.usage === "ca" ? 0x06 : 0x80]),
+						}).toBER(),
+					}),
+					...(options.usage === "ca"
+						? []
+						: [
+								new pki.Extension({
+									extnID: "2.5.29.37",
+									extnValue: new pki.ExtKeyUsage({
+										keyPurposes: [
+											options.usage === "server"
+												? "1.3.6.1.5.5.7.3.1"
+												: "1.3.6.1.5.5.7.3.2",
+										],
+									})
+										.toSchema()
+										.toBER(),
+								}),
+							]),
+					...(names.length === 0
+						? []
+						: [
+								new pki.Extension({
+									extnID: "2.5.29.17",
+									extnValue: new pki.AltName({ altNames: names })
+										.toSchema()
+										.toBER(),
+								}),
+							]),
+				],
+			})
+		},
+		catch: failure,
+	})
+	yield* Effect.tryPromise({
+		try: () =>
+			certificate.subjectPublicKeyInfo.importKey(keys.publicKey, engine),
+		catch: failure,
+	})
+	yield* Effect.tryPromise({
+		try: () => certificate.sign(signingKey, "SHA-256", engine),
+		catch: failure,
+	})
+	const privateKey = yield* Effect.tryPromise({
+		try: () => webcrypto.subtle.exportKey("pkcs8", keys.privateKey),
+		catch: failure,
+	})
+	return yield* Effect.try({
+		try: () => ({
+			certificate: pem("CERTIFICATE", certificate.toSchema().toBER()),
+			privateKey: Redacted.make(pem("PRIVATE KEY", privateKey)),
+		}),
+		catch: failure,
+	})
+})
+
+export const read = Effect.fn("Certificates.read")(function* (base: string) {
+	const fs = yield* FileSystem.FileSystem
+	const certificate = yield* fs.readFileString(base + ".crt")
+	const privateKey = yield* fs.readFileString(base + ".key")
+	return { certificate, privateKey: Redacted.make(privateKey) }
+})
+export const write = Effect.fn("Certificates.write")(function* (
+	base: string,
+	pair: Pem,
+	force: boolean = false,
+) {
+	const fs = yield* FileSystem.FileSystem
+	yield* fs
+		.writeFileString(base + ".key", Redacted.value(pair.privateKey), {
+			flag: force ? "w" : "wx",
+			mode: 0o600,
+		})
+		.pipe(Effect.uninterruptible)
+	// Opening an existing file does not change its permissions when renewing it.
+	yield* fs.chmod(base + ".key", 0o600).pipe(Effect.uninterruptible)
+	yield* fs
+		.writeFileString(base + ".crt", pair.certificate, {
+			flag: force ? "w" : "wx",
+		})
+		.pipe(Effect.uninterruptible)
+})
+
+export interface Options {
+	readonly out: string
+	readonly server: ReadonlyArray<string>
+	readonly identity: ReadonlyArray<string>
+	readonly days: number
+	readonly force: boolean
+}
+/** URI-encode names so each identity has a distinct filename, including names with slashes. */
+export const clientName = (identity: string) =>
+	`client-${encodeURIComponent(identity)}`
+export const generate = Effect.fn("Certificates.generate")(function* (
+	options: Options,
+) {
+	const fs = yield* FileSystem.FileSystem
+	const path = yield* Path.Path
+	const outputs = [
+		...(options.server.length === 0 ? [] : ["server"]),
+		...Array.map(Array.dedupe(options.identity), clientName),
+	]
+	if (!options.force) {
+		const files = Array.flatMap(outputs, (name) =>
+			Array.map([".crt", ".key"], (extension) =>
+				path.join(options.out, name + extension),
+			),
+		)
+		const taken = yield* Effect.filter(files, fs.exists)
+		if (Array.isReadonlyArrayNonEmpty(taken))
+			return yield* CertificateExists.make({ file: taken[0] })
+	}
+	yield* fs
+		.makeDirectory(options.out, { recursive: true })
+		.pipe(Effect.uninterruptible)
+	const ca = path.join(options.out, "ca")
+	const existing =
+		(yield* fs.exists(ca + ".crt")) || (yield* fs.exists(ca + ".key"))
+	// An incomplete CA pair fails on read. Even --force never replaces the signing authority.
+	const issuer = existing
+		? yield* read(ca)
+		: yield* issue({ name: "Graft CA", usage: "ca", days: options.days }).pipe(
+				Effect.tap((pair) => write(ca, pair)),
+			)
+	if (options.server.length > 0) {
+		const pair = yield* issue({
+			name: "Graft runner",
+			usage: "server",
+			hosts: options.server,
+			days: options.days,
+			issuer,
+		})
+		yield* write(path.join(options.out, "server"), pair, options.force)
+	}
+	yield* Effect.forEach(
+		Array.dedupe(options.identity),
+		(identity) =>
+			issue({
+				name: identity,
+				usage: "client",
+				identities: [identity],
+				days: options.days,
+				issuer,
+			}).pipe(
+				Effect.flatMap((pair) =>
+					write(
+						path.join(options.out, clientName(identity)),
+						pair,
+						options.force,
+					),
+				),
+			),
+		{ discard: true },
+	)
+})

package/src/internal/FailureGroup.ts

@@ -0,0 +1,176 @@
+import {
+	Array,
+	Cause,
+	Fiber,
+	Data,
+	Deferred,
+	Effect,
+	Exit,
+	FiberSet,
+	Ref,
+	Scope,
+	Schema,
+	TxRef,
+} from "effect"
+import * as Release from "./release"
+
+type State<E> = Data.TaggedEnum<{
+	Open: {}
+	Failed: { readonly cause: Cause.Cause<E> }
+	Closed: {}
+}>
+interface StateDefinition extends Data.TaggedEnum.WithGenerics<1> {
+	readonly taggedEnum: State<this["A"]>
+}
+const State = Data.taggedEnum<StateDefinition>()
+export interface FailureGroup<E> {
+	readonly await: Effect.Effect<never, E>
+	readonly check: Effect.Effect<void, E>
+	readonly cause: Effect.Effect<Cause.Cause<E>>
+	readonly run: <A, R>(
+		effect: Effect.Effect<A, E, R>,
+	) => Effect.Effect<Fiber.Fiber<A, E>, never, R>
+	readonly fail: (error: E) => Effect.Effect<void>
+	readonly failCause: (cause: Cause.Cause<E>) => Effect.Effect<void>
+	readonly race: <A, E2, R>(
+		effect: Effect.Effect<A, E2, R>,
+	) => Effect.Effect<A, E | E2, R>
+	readonly runtime: <R>() => Effect.Effect<
+		(effect: Effect.Effect<unknown, E, R>) => Fiber.Fiber<unknown, E>,
+		never,
+		R
+	>
+	readonly close: Effect.Effect<void, E>
+}
+
+/** One owner for first failure, transaction wakeups, and interruption of sibling work. */
+export const make = <E>(): Effect.Effect<FailureGroup<E>, never, Scope.Scope> =>
+	Effect.gen(function* () {
+		const fibers = yield* FiberSet.make<unknown, E>()
+		const state = yield* TxRef.make<State<E>>(State.Open())
+		const failures = yield* Ref.make<Cause.Cause<E>>(Cause.empty)
+		const cleanup = yield* Ref.make<Cause.Cause<E>>(Cause.empty)
+		const check = TxRef.get(state).pipe(
+			Effect.flatMap((s) =>
+				s._tag === "Failed"
+					? Effect.failCause(s.cause)
+					: s._tag === "Closed"
+						? Effect.interrupt
+						: Effect.void,
+			),
+		)
+		const publish = (cause: Cause.Cause<E>) =>
+			TxRef.update(state, (s): State<E> =>
+				s._tag === "Open" ? State.Failed({ cause }) : s,
+			)
+
+		const observe = <A, R>(effect: Effect.Effect<A, E, R>) =>
+			Effect.uninterruptibleMask((restore) =>
+				Effect.gen(function* () {
+					const scope = yield* Scope.make()
+					// The owned child makes cancellation explicit, even when a stream closes an internal scope.
+					const ownerId = yield* Effect.withFiber((self) =>
+						Effect.succeed(self.id),
+					)
+					const worker = yield* Effect.forkIn(
+						restore(Scope.provide(scope)(effect)),
+						scope,
+					)
+					const waiting = yield* Effect.exit(restore(Fiber.await(worker)))
+					if (Exit.isFailure(waiting)) yield* Fiber.interrupt(worker)
+					const body = yield* Fiber.await(worker)
+					const closed = yield* Effect.exit(Release.close(scope, body))
+					// Forwarding this exact cancellation from a finalizer is indistinguishable from acknowledging it.
+					const expected =
+						Exit.isFailure(waiting) &&
+						Exit.isFailure(body) &&
+						Array.every(
+							body.cause.reasons,
+							(reason) =>
+								reason._tag === "Interrupt" && reason.fiberId === ownerId,
+						)
+					const bodyCause =
+						Exit.isFailure(body) && !expected ? body.cause : Cause.empty
+					// Release.close marks independent interruptions; an unmarked one is pending cancellation.
+					const releaseCause =
+						Exit.isFailure(closed) && !Cause.hasInterruptsOnly(closed.cause)
+							? closed.cause
+							: Cause.empty
+					const failure = Cause.combine(bodyCause, releaseCause)
+					// Body cleanup may carry either an interruption or a release defect from an inner group.
+					const closing = Cause.combine(
+						Cause.hasInterrupts(bodyCause) ||
+							Array.some(
+								bodyCause.reasons,
+								(reason) =>
+									reason._tag === "Die" &&
+									Schema.is(Release.ReleaseInterrupted)(reason.defect),
+							)
+							? bodyCause
+							: Cause.empty,
+						releaseCause,
+					)
+					yield* Ref.update(cleanup, (cause) => Cause.combine(cause, closing))
+					if (failure.reasons.length > 0) {
+						yield* Ref.update(failures, (cause) =>
+							Cause.combine(cause, failure),
+						)
+						yield* publish(failure)
+						yield* Deferred.failCause(fibers.deferred, failure)
+					}
+					if (Exit.isFailure(closed))
+						return yield* Effect.failCause(
+							Exit.isFailure(body)
+								? Cause.combine(body.cause, closed.cause)
+								: closed.cause,
+						)
+					if (Exit.isFailure(waiting) && Exit.isSuccess(body))
+						return yield* Effect.failCause(waiting.cause)
+					return yield* body
+				}),
+			)
+		yield* FiberSet.join(fibers).pipe(
+			Effect.catchCause((cause) =>
+				publish(cause).pipe(
+					Effect.andThen(FiberSet.clear(fibers)),
+					Effect.uninterruptible,
+				),
+			),
+			Effect.forkScoped,
+		)
+		const failure = Effect.tx(check.pipe(Effect.andThen(Effect.txRetry)))
+		const failCause = (cause: Cause.Cause<E>) =>
+			// This is an explicit failure report, not cancellation of an owned worker.
+			FiberSet.run(fibers, observe(Effect.failCause(cause))).pipe(Effect.asVoid)
+		const close = TxRef.update(state, (s) =>
+			s._tag === "Open" ? State.Closed() : s,
+		).pipe(
+			Effect.andThen(FiberSet.clear(fibers)),
+			Effect.andThen(Ref.get(cleanup)),
+			Effect.flatMap((cause) =>
+				cause.reasons.length > 0 ? Effect.failCause(cause) : Effect.void,
+			),
+			Effect.uninterruptible,
+		)
+		// Operational failure is delivered by await; release must also deliver sibling cleanup failures.
+		yield* Effect.addFinalizer(() => close.pipe(Effect.orDie))
+		return {
+			await: failure,
+			check,
+			cause: Ref.get(failures),
+			runtime: <R>() =>
+				FiberSet.runtime(fibers)<R>().pipe(
+					Effect.map(
+						(run) => (effect: Effect.Effect<unknown, E, R>) =>
+							run(check.pipe(Effect.andThen(observe(effect)))),
+					),
+				),
+			run: (effect) =>
+				FiberSet.run(fibers, check.pipe(Effect.andThen(observe(effect)))),
+			fail: (error) => failCause(Cause.fail(error)),
+			failCause,
+			race: (effect) =>
+				check.pipe(Effect.andThen(Effect.raceFirst(effect, failure))),
+			close,
+		}
+	})

package/src/internal/Limits.ts

@@ -0,0 +1,12 @@
+import { Schema } from "effect"
+
+export const PositiveInt = Schema.Int.check(Schema.isGreaterThan(0))
+export const PositiveFinite = Schema.Finite.check(Schema.isGreaterThan(0))
+export const Limits = Schema.Struct({
+	control: PositiveInt,
+	data: PositiveInt,
+	log: PositiveInt,
+})
+export type Limits = typeof Limits.Type
+export type Priority = keyof Limits
+export const defaults: Limits = { control: 8, data: 16, log: 2 }

package/src/internal/Peer.ts

@@ -0,0 +1,4 @@
+import { Context } from "effect"
+export class Peer extends Context.Service<Peer, string>()(
+	"@graftland/plugin-remote/internal/Peer",
+) {}

package/src/internal/ServeLifecycle.ts

@@ -0,0 +1,53 @@
+import { Context, Deferred, Effect, Exit, Option, Schema, Scope } from "effect"
+import * as Release from "./release"
+import type { TransportError } from "../Errors"
+
+export class StartupError extends Schema.TaggedError<
+	StartupError,
+	{ readonly brand: unique symbol }
+>()("RunnerStartupError", {
+	detail: Schema.String,
+	cause: Schema.optionalKey(Schema.Cause(Schema.Unknown, Schema.Defect())),
+}) {
+	override get message() {
+		return this.detail
+	}
+}
+
+export class ServeLifecycle extends Context.Service<
+	ServeLifecycle,
+	{
+		readonly ended: Deferred.Deferred<void, TransportError>
+		readonly released: Deferred.Deferred<void, StartupError>
+	}
+>()("@graftland/plugin-remote/internal/ServeLifecycle") {}
+
+export const make = Effect.all({
+	ended: Deferred.make<void, TransportError>(),
+	released: Deferred.make<void, StartupError>(),
+})
+
+/** Observe shutdown independently of the loader, which logs child cleanup failures. */
+export const resources = Effect.fnUntraced(function* (
+	lifecycle: Option.Option<typeof ServeLifecycle.Service>,
+) {
+	return yield* Effect.acquireRelease(Scope.make(), (scope, exit) =>
+		Release.close(scope, exit).pipe(
+			Effect.onExit((released) =>
+				Option.isNone(lifecycle)
+					? Effect.void
+					: Deferred.done(
+							lifecycle.value.released,
+							Exit.isSuccess(released)
+								? Exit.void
+								: Exit.fail(
+										StartupError.make({
+											detail: "Supervisor shutdown failed",
+											cause: released.cause,
+										}),
+									),
+						).pipe(Effect.asVoid),
+			),
+		),
+	)
+})

package/src/internal/Supervisor.ts

@@ -0,0 +1,14 @@
+/** A listener hands an authenticated byte channel to the supervisor. */
+import { Context } from "effect"
+import type { Effect, Scope } from "effect"
+import type { Peer } from "./Peer"
+import type { Channel } from "../Transport"
+import type { TransportError } from "../Errors"
+export class Supervisor extends Context.Service<
+	Supervisor,
+	{
+		readonly accept: (
+			channel: Channel,
+		) => Effect.Effect<void, TransportError, Peer | Scope.Scope>
+	}
+>()("@graftland/plugin-remote/internal/Supervisor") {}