@graftland/plugin-remote 0.0.0-stage → 0.3.0

package/dist/entry-SYsx9VNb.js

@@ -0,0 +1,708 @@
+import { c as isPlugin, i as plugin, l as make, o as fork, t as forks, u as optional } from "./Graft-BsYq3F-J.js";
+import { t as ConfigDirectory } from "./ConfigDirectory-BCC6q2R4.js";
+import { i as make$2, m as isSubtreeActive, n as ModuleInvalid, o as CurrentId, p as findSubtree, r as ModuleResolver, t as make$1 } from "./importer-D7zSgqxq.js";
+import { c as endpoint, n as UndeclaredFailure, o as endpoints, r as fromModule } from "./Contract-CcpSIJm4.js";
+import { a as ProcessExited, c as TransportError, i as MissingInstance, o as RemoteError, r as LocalTerminationTimeout, s as RemoteWithdrawn, t as AuthenticationFailed } from "./Errors-oPsTLY7l.js";
+import { n as WorkerTransport, t as LocalTransport } from "./directTransport-DrexuPSm.js";
+import { a as PositiveDuration, i as Supervisor, n as resolveEntry, r as verify } from "./Packages-B1TPk8pa.js";
+import { E as make$3, b as awaitTermination, n as Session, r as channel, t as Peer, x as childOf } from "./Peer-IJgFK6mD.js";
+import { n as Credentials, t as Authenticator } from "./Auth-BElTC9_X.js";
+import { n as Listener, t as Connector } from "./Transport-DULzpsgR.js";
+import { n as connectionEnded, t as closedNormally } from "./connectionEnded-DUgcobEd.js";
+import { t as ServeLifecycle } from "./ServeLifecycle-CJM0gG5B.js";
+import { t as make$4 } from "./FailureGroup-BcH0XOBi.js";
+import { n as cleanupCause, t as children } from "./cleanup-BPWr-5U9.js";
+import { n as make$5, o as defaults } from "./port-Blbh8tms.js";
+import { n as close } from "./release-BY4Mlluy.js";
+import { n as stdinExitTimeout } from "./ProcessObservation-DEGrEMfP.js";
+import { Array, Cause, Context, Deferred, Duration, Effect, Exit, Fiber, Option, Path, Ref, References, Schema, Scope, Stream, String } from "effect";
+import { SecureRandom } from "effect/crypto";
+import { RpcClient } from "effect/rpc";
+import { ChildProcessSpawner } from "effect/process";
+// packages/remote/src/internal/entryConfig.ts
+const Reference = Schema.Struct({
+	name: Schema.String,
+	config: Schema.optionalKey(Schema.Unknown)
+});
+const absent = Schema.optionalKey(Schema.Never);
+const authFields = {
+	name: absent,
+	config: absent,
+	mtls: absent,
+	bearer: absent,
+	jwt: absent,
+	none: absent
+};
+const Authentication = Schema.Union([
+	Schema.Struct({
+		...authFields,
+		name: Schema.String,
+		config: Schema.optionalKey(Schema.Unknown)
+	}),
+	Schema.Struct({
+		...authFields,
+		mtls: Schema.Unknown
+	}),
+	Schema.Struct({
+		...authFields,
+		bearer: Schema.Unknown
+	}),
+	Schema.Struct({
+		...authFields,
+		jwt: Schema.Unknown
+	}),
+	Schema.Struct({
+		...authFields,
+		none: Schema.Unknown
+	})
+]);
+const transportFields = {
+	url: absent,
+	unix: absent,
+	command: absent,
+	stdio: absent,
+	local: absent,
+	worker: absent,
+	transport: absent
+};
+const auth = Schema.optionalKey(Authentication);
+const common = {
+	instance: Schema.optionalKey(Schema.String),
+	lease: Schema.optionalKey(PositiveDuration),
+	margin: Schema.optionalKey(PositiveDuration),
+	expect: Schema.optionalKey(Schema.Struct({
+		version: Schema.optionalKey(Schema.String),
+		digest: Schema.optionalKey(Schema.String)
+	}))
+};
+const network = {
+	...transportFields,
+	...common,
+	auth,
+	url: Schema.String,
+	ca: Schema.optionalKey(Schema.String),
+	servername: Schema.optionalKey(Schema.String)
+};
+const Connect = Schema.Union([
+	Schema.Struct(network),
+	Schema.Struct({
+		...transportFields,
+		...common,
+		auth,
+		unix: Schema.String
+	}),
+	Schema.Struct({
+		...transportFields,
+		...common,
+		command: Schema.NonEmptyArray(Schema.String),
+		auth: Schema.optionalKey(Schema.Never.annotate({ message: "Direct and stdio transports do not accept auth" })),
+		cwd: Schema.optionalKey(Schema.String),
+		env: Schema.optionalKey(Schema.Record(Schema.String, Schema.String))
+	}),
+	Schema.Struct({
+		...transportFields,
+		auth: Schema.optionalKey(Schema.Never.annotate({ message: "Direct and stdio transports do not accept auth" })),
+		local: Schema.Struct({ command: Schema.optionalKey(Schema.NonEmptyArray(Schema.String)) })
+	}),
+	Schema.Struct({
+		...transportFields,
+		auth: Schema.optionalKey(Schema.Never.annotate({ message: "Direct and stdio transports do not accept auth" })),
+		worker: Schema.Struct({ execArgv: Schema.optionalKey(Schema.Array(Schema.String)) })
+	}),
+	Schema.Struct({
+		...transportFields,
+		...common,
+		auth,
+		transport: Reference
+	})
+]);
+const Listen = Schema.Union([
+	Schema.Struct({
+		...transportFields,
+		auth,
+		url: Schema.String,
+		cert: Schema.optionalKey(Schema.String),
+		key: Schema.optionalKey(Schema.String)
+	}),
+	Schema.Struct({
+		...transportFields,
+		auth,
+		unix: Schema.String
+	}),
+	Schema.Struct({
+		...transportFields,
+		stdio: Schema.Literal(true),
+		auth: Schema.optionalKey(Schema.Never.annotate({ message: "Direct and stdio transports do not accept auth" })),
+		identity: Schema.optionalKey(Schema.String)
+	}),
+	Schema.Struct({
+		...transportFields,
+		auth,
+		transport: Reference
+	})
+]);
+const capability = (side, name, config) => ({
+	name: `@graftland/plugin-remote/${side}/${name}`,
+	config
+});
+const authentication = (side, input) => {
+	if (input === void 0) return capability(side, "auth/none", {});
+	if (input.name !== void 0) return input;
+	if (input.mtls !== void 0) return capability(side, "auth/mtls", input.mtls);
+	if (input.bearer !== void 0) return capability(side, "auth/bearer", input.bearer);
+	if (input.jwt !== void 0) return capability(side, "auth/jwt", input.jwt);
+	return capability(side, "auth/none", input.none);
+};
+const hostTransport = (input) => {
+	if (input.transport !== void 0) return input.transport;
+	if (input.url !== void 0) return capability("host", "websocket", {
+		url: input.url,
+		...input.ca === void 0 ? {} : { ca: input.ca },
+		...input.servername === void 0 ? {} : { servername: input.servername }
+	});
+	if (input.unix !== void 0) return capability("host", "unix", { path: input.unix });
+	return capability("host", "command", {
+		argv: input.command,
+		..."cwd" in input && input.cwd !== void 0 ? { cwd: input.cwd } : {},
+		..."env" in input && input.env !== void 0 ? { env: input.env } : {}
+	});
+};
+const runnerTransport = (input) => {
+	if (input.transport !== void 0) return input.transport;
+	if (input.url !== void 0) return capability("runner", "websocket", {
+		url: input.url,
+		...input.cert === void 0 ? {} : { cert: input.cert },
+		...input.key === void 0 ? {} : { key: input.key }
+	});
+	if (input.unix !== void 0) return capability("runner", "unix", { path: input.unix });
+	return capability("runner", "stdio", {});
+};
+const Host = Schema.Struct({
+	contract: Schema.String,
+	connect: Connect,
+	config: Schema.Json.pipe(Schema.withDecodingDefaultKey(Effect.succeed({})))
+});
+const Runner = Schema.Struct({
+	root: Schema.String,
+	state: Schema.String,
+	lease: Schema.optionalKey(PositiveDuration),
+	grace: Schema.optionalKey(PositiveDuration),
+	listen: Schema.Array(Listen)
+});
+const runnerAuthentication = (input) => input.stdio !== void 0 ? capability("runner", "auth/none", { identity: input.identity ?? "anonymous" }) : authentication("runner", input.auth);
+// packages/remote/src/internal/follow.ts
+/** Follow startup and later failures without changing the caller's error boundary. */
+const follow = Effect.fnUntraced(function* (fork$1, fail) {
+	yield* fork$1.await.pipe(Effect.catchCause(fail));
+	yield* fork(fork$1.state.pipe(Stream.runForEach((state) => state._tag === "Failed" ? fail(state.cause) : Effect.void)));
+});
+// packages/remote/src/internal/assembly.ts
+var ListenerConfigError = class extends Schema.TaggedError()("ListenerConfigError", { detail: Schema.String }) {
+	get message() {
+		return this.detail;
+	}
+};
+var CapabilityContractError = class extends Schema.TaggedError()("CapabilityContractError", {
+	plugin: Schema.String,
+	key: Schema.String
+}) {
+	get message() {
+		return `Capability ${this.plugin} became active without providing ${this.key}`;
+	}
+};
+var CapabilityCombinationError = class extends Schema.TaggedError()("CapabilityCombinationError", { detail: Schema.String }) {
+	get message() {
+		return this.detail;
+	}
+};
+var CapabilityFailed = class extends Schema.TaggedError()("CapabilityFailed", { cause: Schema.Cause(Schema.Unknown, Schema.Unknown) }) {};
+const definition = Schema.declare(isPlugin);
+/** Entries resolve capability modules before assembling their private providers. */
+const Invocation = Schema.Struct({
+	plugin: definition,
+	config: Schema.Unknown
+});
+const Input = Schema.Struct({
+	transport: Invocation,
+	auth: Invocation,
+	consumer: definition,
+	input: Schema.optionalKey(Schema.Unknown)
+});
+const failure = (tree) => tree.state._tag === "Failed" ? Effect.fail(CapabilityFailed.make({ cause: tree.state.cause })) : Effect.forEach(tree.children, failure, { discard: true });
+const probe = (name, key) => make({
+	name: "remote-capability-contract",
+	inject: [optional(key)],
+	apply: Effect.fnUntraced(function* () {
+		const value = yield* Effect.serviceOption(key);
+		if (Option.isNone(value)) return yield* CapabilityContractError.make({
+			plugin: name,
+			key: key.key
+		});
+	})
+});
+/** Resolve the key in a fresh consumer after the provider subtree settles.
+* An optional consumer started earlier could still hold a pre-publication snapshot.
+*/
+const watch = (provider, key) => fork(forks.pipe(Stream.map((trees) => findSubtree(trees, provider.id)), Stream.filter(Option.isSome), Stream.map((tree) => tree.value), Stream.tap(failure), Stream.map((tree) => ({
+	name: tree.name,
+	active: isSubtreeActive(tree)
+})), Stream.changesWith((left, right) => left.active === right.active), Stream.filter((tree) => tree.active), Stream.runForEach((tree) => Effect.scoped(plugin(probe(tree.name, key)).pipe(Effect.flatMap((fork) => fork.await))))));
+const assembly = (keys) => make({
+	name: "remote-assembly",
+	config: Input,
+	apply: Effect.fnUntraced(function* (input) {
+		yield* Effect.forEach([{
+			invocation: input.transport,
+			key: keys[0]
+		}, {
+			invocation: input.auth,
+			key: keys[1]
+		}], Effect.fnUntraced(function* ({ invocation, key }) {
+			const provider = yield* plugin(invocation.plugin, invocation.config);
+			yield* watch(provider, key);
+		}));
+		const consumer = yield* plugin(input.consumer, input.input);
+		yield* consumer.state.pipe(Stream.filter((state) => state._tag !== "Loading" && (state._tag !== "Pending" || !Array.some(keys, (key) => Array.contains(state.missing, key.key)))), Stream.runHead);
+		yield* follow(consumer, (cause) => Effect.fail(CapabilityFailed.make({ cause })));
+	})
+});
+const hostAssembly = assembly([Connector, Credentials]);
+const runnerAssembly = assembly([Listener, Authenticator]);
+const host$1 = (input) => plugin(hostAssembly, input, { isolate: [Connector, Credentials] });
+const runner = (input, consumer = listenerConsumer) => plugin(runnerAssembly, {
+	...input,
+	consumer
+}, { isolate: [Listener, Authenticator] });
+const compatible = (properties, kind) => {
+	if (kind === "Certificate" && (properties.protocol !== "wss" || !properties.encrypted || !Array.contains(properties.carries, "certificate"))) return Effect.fail(CapabilityCombinationError.make({ detail: "Mutual TLS requires encrypted wss with certificate evidence" }));
+	if (kind === "Authorization" && !Array.contains(properties.carries, "header")) return Effect.fail(CapabilityCombinationError.make({ detail: "This transport cannot carry Authorization headers" }));
+	return Effect.void;
+};
+const kind = (auth) => auth._tag === "Mtls" ? "Certificate" : auth._tag === "Header" ? "Authorization" : "None";
+const warn = (properties, credentials, side) => Effect.all([properties.network && !properties.encrypted ? Effect.logWarning(credentials === "Authorization" ? `${properties.protocol}:// ${side === "host" ? "connection" : "listener"} is unencrypted; credentials are transmitted in plaintext` : `${properties.protocol}:// ${side === "host" ? "connection" : "listener"} is unencrypted`) : Effect.void, side === "runner" && properties.network && credentials === "None" ? Effect.logWarning("WebSocket listener has no authentication") : Effect.void], { discard: true });
+const directAuth = (properties, explicit) => explicit && (properties.protocol === "stdio" || properties.protocol === "command") ? Effect.fail(CapabilityCombinationError.make({ detail: `${properties.protocol} transports do not accept auth` })) : Effect.void;
+const connectWith = (explicitAuth = false) => Effect.gen(function* () {
+	const connector = yield* Connector;
+	const credentials = yield* Credentials;
+	yield* directAuth(connector.properties, explicitAuth);
+	yield* compatible(connector.properties, credentials.kind);
+	yield* warn(connector.properties, credentials.kind, "host");
+	const prepared = yield* credentials.read;
+	return yield* connector.connect(prepared);
+});
+const accept = (auth, properties, session) => (handshake) => {
+	return (auth._tag === "Header" ? auth.authenticate(handshake.authorization) : auth._tag === "Mtls" ? Option.match(handshake.certificate, {
+		onNone: () => Effect.fail(AuthenticationFailed.make({ reason: "missing" })),
+		onSome: auth.authenticate
+	}) : (properties.network ? Effect.logWarning("WebSocket connection has no authentication") : Effect.void).pipe(Effect.as(auth.identity))).pipe(Effect.map(session));
+};
+const makeListenerConsumer = (prepare = () => Effect.void, ready = Effect.void) => make({
+	name: "remote-listener-consumer",
+	inject: [
+		Listener,
+		Authenticator,
+		Supervisor,
+		optional(ServeLifecycle)
+	],
+	apply: Effect.fnUntraced(function* () {
+		const listener = yield* Listener;
+		const auth = yield* Authenticator;
+		const supervisor = yield* Supervisor;
+		const lifecycle = yield* Effect.serviceOption(ServeLifecycle);
+		yield* prepare(listener.properties, auth);
+		yield* compatible(listener.properties, kind(auth)).pipe(Effect.mapError((error) => ListenerConfigError.make({ detail: error.detail })));
+		yield* warn(listener.properties, kind(auth), "runner");
+		const serving = yield* listener.bind(auth._tag === "Mtls" ? Option.some(auth.tls) : Option.none());
+		const running = yield* fork(serving.serve(accept(auth, listener.properties, (identity) => (channel) => supervisor.accept(channel).pipe(Effect.catchCause((cause) => listener.properties.protocol === "stdio" ? closedNormally(cause) ? Effect.void : Effect.failCause(cause) : connectionEnded(cause)), Effect.provideService(Peer, identity)))).pipe(Effect.onExit((exit) => listener.properties.protocol === "stdio" && Option.isSome(lifecycle) ? Deferred.done(lifecycle.value.ended, exit) : Effect.void)));
+		yield* serving.ready.pipe(Effect.raceFirst(Fiber.join(running)));
+		yield* ready;
+	})
+});
+const listenerConsumer = makeListenerConsumer();
+connectWith();
+// packages/remote/src/internal/host/runner.ts
+const connect$1 = (target, contractModule, options, resources, processScope) => Effect.gen(function* () {
+	const instance = target.instance;
+	const margin = Duration.toMillis(target.margin ?? "5 seconds");
+	const channel$1 = yield* connectWith(target.explicitAuth).pipe(Scope.provide(processScope));
+	const mux = yield* make$3(channel$1).pipe(Scope.provide(resources));
+	const control = yield* make$5(channel(mux, 0), {
+		session: "session-v1",
+		serve: {},
+		call: { session: Session }
+	}).pipe(Scope.provide(resources));
+	const session = yield* RpcClient.make(Session).pipe(Effect.provideService(RpcClient.Protocol, control.clientProtocol("session")), Scope.provide(resources));
+	const expectedGeneration = yield* session.HighWater({ instance });
+	const record = yield* session.Open({
+		instance,
+		expectedGeneration,
+		requestId: options.session,
+		limits: defaults,
+		...target.lease === void 0 ? {} : { leaseMillis: Duration.toMillis(target.lease) }
+	});
+	const failures = yield* make$4().pipe(Scope.provide(resources));
+	const finishStarted = yield* Ref.make(false);
+	const terminate = yield* Effect.cached(Effect.gen(function* () {
+		yield* Ref.set(finishStarted, true);
+		yield* failures.close;
+		const result = yield* awaitTermination(record.handle, session.Dispose(record.handle), record.leaseMillis, margin);
+		const { code, signal, stderr, cause } = result.exit;
+		yield* Effect.logInfo("Remote execution terminated", {
+			code,
+			...signal === null ? {} : { signal },
+			...stderr === void 0 || stderr === "" ? {} : { stderr },
+			...cause === void 0 || cause.reasons.length === 0 ? {} : { cause }
+		}).pipe(Effect.annotateLogs({
+			"remote.instance": record.handle.key.instance,
+			"remote.generation": record.handle.generation,
+			"remote.termination": result.kind
+		}));
+		if (result.cause.reasons.length > 0) return yield* Effect.failCause(cleanupCause(result.cause));
+	}));
+	yield* Scope.addFinalizer(processScope, Effect.gen(function* () {
+		if (!(yield* Ref.get(finishStarted))) yield* terminate.pipe(Effect.catchCause((cause) => Effect.failCause(cleanupCause(cause))));
+	}));
+	const renewed = yield* Effect.forever(Effect.sleep(record.leaseMillis / 3).pipe(Effect.andThen(session.Renew(record.handle)))).pipe(Effect.forkIn(resources));
+	const code = yield* session.Load({
+		handle: record.handle,
+		specifier: contractModule,
+		digest: target.expect?.digest !== void 0
+	});
+	yield* verify(code, target.expect);
+	const loaded = yield* session.Status(record.handle);
+	const peer = yield* make$5(channel(mux, 1), {
+		...options,
+		session: record.handle.token,
+		limits: record.limits
+	}).pipe(Scope.provide(resources));
+	const report = (cause) => Cause.hasInterruptsOnly(cause) ? Effect.void : failures.failCause(Cause.map(cause, (error) => TransportError.make({ cause: Cause.fail(error) })));
+	yield* failures.await.pipe(Effect.catchCause((cause) => Cause.hasInterruptsOnly(cause) ? Effect.void : peer.fail(TransportError.make({ cause }))), Effect.forkIn(resources));
+	yield* failures.run(Fiber.join(renewed).pipe(Effect.catchCause((cause) => Effect.gen(function* () {
+		if (Cause.hasInterruptsOnly(cause)) return;
+		const status = yield* Effect.exit(session.Status(record.handle).pipe(Effect.timeout("5 seconds")));
+		if (Exit.isSuccess(status) && status.value.phase === "Stopped") {
+			const exit = status.value.termination.exit;
+			yield* report(Cause.combine(cause, Cause.fail(ProcessExited.make({
+				pid: Option.map(childOf(loaded), (child) => child.pid),
+				exitCode: exit.code,
+				stderr: exit.stderr ?? "",
+				statusCause: exit.cause ?? Cause.empty
+			}))));
+		} else yield* report(Exit.isFailure(status) ? Cause.combine(cause, status.cause) : cause);
+	}))));
+	return {
+		resources,
+		pid: Option.map(childOf(loaded), (child) => child.pid),
+		diagnostics: failures.cause,
+		terminate: () => Effect.gen(function* () {
+			yield* Fiber.interrupt(renewed);
+			yield* terminate;
+		}),
+		transport: {
+			...peer,
+			failure: peer.await,
+			report
+		}
+	};
+});
+// packages/remote/src/internal/runner/Local.ts
+/** Direct execution observers stay alive until exit, including forced cleanup. */
+const connect = Effect.fnUntraced(function* (execution, options) {
+	const failures = yield* make$4();
+	const exited = yield* execution.exited.pipe(Effect.forkScoped);
+	const peer = yield* make$5(execution.channel, options);
+	yield* failures.run(Effect.raceFirst(peer.await, Fiber.join(exited).pipe(Effect.flatMap(Effect.fail))));
+	const report = (cause) => Cause.hasInterruptsOnly(cause) ? Effect.void : failures.fail(TransportError.make({ cause })).pipe(Effect.andThen(peer.fail(TransportError.make({ cause }))));
+	yield* failures.run(execution.failure);
+	return {
+		...peer,
+		pid: execution.pid,
+		...execution.threadId === void 0 ? {} : { threadId: execution.threadId },
+		exited,
+		resources: yield* Effect.scope,
+		transport: {
+			...peer,
+			failure: failures.await,
+			report
+		},
+		diagnostics: Fiber.await(exited).pipe(Effect.andThen(failures.cause)),
+		terminate: (graceful) => Effect.gen(function* () {
+			yield* failures.close;
+			if (!graceful) return;
+			const status = yield* peer.end.pipe(Effect.catchCauseIf(Cause.hasInterruptsOnly, () => Effect.void), Effect.andThen(Fiber.join(exited)), Effect.interruptible, Effect.timeoutOrElse({
+				duration: stdinExitTimeout,
+				orElse: () => LocalTerminationTimeout.make({
+					...Option.match(execution.pid, {
+						onNone: () => ({}),
+						onSome: (pid) => ({ pid })
+					}),
+					...execution.threadId === void 0 ? {} : { threadId: execution.threadId }
+				})
+			}));
+			if (status.exitCode !== 0 || status.statusCause.reasons.length > 0) return yield* status;
+		})
+	};
+});
+// packages/remote/src/internal/runner/Connection.ts
+var Connection = class extends Context.Service()("@graftland/plugin-remote/internal/runner/Connection") {};
+const connected = Connection.of;
+const Local = Effect.fnUntraced(function* (target, contractModule, options, resources, processScope) {
+	const execution = yield* (yield* target._tag === "Local" ? LocalTransport : WorkerTransport).start({
+		...target,
+		contractModule,
+		session: options.session
+	}).pipe(Scope.provide(processScope));
+	return yield* connect(execution, options).pipe(Scope.provide(resources));
+});
+const reason = (exit) => Exit.isFailure(exit) ? exit.cause : Cause.empty;
+const finish = (causes) => {
+	const cause = Array.reduce(causes, Cause.empty, Cause.combine);
+	return cause.reasons.length === 0 ? Effect.void : Effect.failCause(cleanupCause(cause));
+};
+/** Close partially acquired resources too; the normal release observes exit before stopping readers. */
+const scopes = Effect.acquireRelease(Effect.all({
+	resources: Scope.make(),
+	process: Scope.make()
+}), (scopes, exit) => Effect.gen(function* () {
+	const process = yield* Effect.exit(close(scopes.process, exit));
+	const resources = yield* Effect.exit(close(scopes.resources, exit));
+	yield* finish([reason(process), reason(resources)]);
+}));
+/** Setup supplies a concrete control lifecycle; release never reads a later-installed effect. */
+const acquire = (target, contractModule, options, setup, dispose, timeout) => Effect.gen(function* () {
+	const owned = yield* scopes;
+	const connection = yield* Effect.acquireRelease(Effect.gen(function* () {
+		return target._tag === "Local" || target._tag === "Worker" ? yield* Local(target, contractModule, options, owned.resources, owned.process).pipe(Effect.map(connected)) : yield* connect$1(target, contractModule, options, owned.resources, owned.process);
+	}).pipe(Effect.interruptible), (connection, exit) => Effect.gen(function* () {
+		const process = yield* Effect.exit(close(owned.process, exit));
+		yield* connection.diagnostics;
+		const resources = yield* Effect.exit(close(owned.resources, exit));
+		const diagnostics = yield* connection.diagnostics;
+		yield* finish([
+			reason(process),
+			reason(resources),
+			diagnostics
+		]);
+	}));
+	return yield* Effect.acquireRelease(setup.pipe(Effect.provideService(Connection, connection)), (value) => Effect.gen(function* () {
+		const graceful = yield* dispose(value).pipe(Effect.interruptible, Effect.timeout(timeout), Effect.exit);
+		const terminated = yield* Effect.exit(connection.terminate(Exit.isSuccess(graceful)));
+		yield* finish([Exit.isSuccess(graceful) ? graceful.value : graceful.cause, reason(terminated)]);
+	}));
+});
+// packages/remote/src/internal/host.ts
+const race = (connection, effect) => Effect.raceFirst(effect, connection.transport.failure);
+const forwardEvents = (contract, client, connection) => Effect.gen(function* () {
+	const stopped = yield* Deferred.make();
+	const remoteFailure = yield* make$4();
+	return {
+		stopped,
+		remoteFailure,
+		events: yield* race(connection, client.Events().pipe(Stream.runForEach((event) => {
+			switch (event._tag) {
+				case "Stopped": return Deferred.succeed(stopped, void 0);
+				case "Withdrawing": return remoteFailure.fail(RemoteWithdrawn.make({}));
+				case "Failed": return contract.decodeCause(event.cause).pipe(Effect.flatMap((cause) => remoteFailure.failCause(cause)));
+			}
+		}))).pipe(Effect.tapCause(connection.transport.report), Effect.forkIn(connection.resources))
+	};
+});
+const forwardLogs = (contract, client, connection) => Effect.gen(function* () {
+	const logsEnded = yield* Deferred.make();
+	const reportedDrops = yield* Ref.make(0);
+	yield* race(connection, client.Logs().pipe(Stream.runForEach((event) => Effect.gen(function* () {
+		const previous = yield* Ref.getAndSet(reportedDrops, event.dropped);
+		if (event.dropped > previous) yield* Effect.logWarning("Remote logs were dropped").pipe(Effect.annotateLogs({
+			...Option.isSome(connection.pid) ? { "remote.pid": connection.pid.value } : {},
+			"remote.logs.dropped": event.dropped - previous,
+			"remote.logs.droppedTotal": event.dropped
+		}));
+		if (event._tag === "LogsEnded") {
+			yield* Deferred.succeed(logsEnded, void 0);
+			return;
+		}
+		const entry = event.entry;
+		const cause = yield* contract.decodeCause(entry.cause);
+		yield* Effect.logWithLevel(entry.level === "All" || entry.level === "None" ? "Info" : entry.level)(...Array.isArray(entry.message) ? entry.message : [entry.message], cause).pipe(Effect.annotateLogs({
+			...Option.isSome(connection.pid) ? { "remote.pid": connection.pid.value } : {},
+			...connection.threadId === void 0 ? {} : { "remote.threadId": connection.threadId },
+			"remote.annotations": entry.annotations
+		}));
+	})))).pipe(Effect.tapCause(connection.transport.report), Effect.forkIn(connection.resources));
+	return logsEnded;
+});
+const initialize = (contract) => Effect.gen(function* () {
+	const connection = yield* Connection;
+	const client = yield* RpcClient.make(contract.control).pipe(Effect.provideService(RpcClient.Protocol, connection.transport.clientProtocol(endpoint)), Scope.provide(connection.resources));
+	for (const service of contract.inject) yield* service.serve(connection.transport).pipe(Effect.tapCause(connection.transport.report), Effect.forkIn(connection.resources));
+	const events = yield* forwardEvents(contract, client, connection);
+	const logsEnded = yield* forwardLogs(contract, client, connection);
+	return {
+		connection,
+		client,
+		...events,
+		logsEnded
+	};
+});
+const load$1 = (active, input) => race(active.connection, Effect.raceFirst(active.client.Load({ input }).pipe(Effect.catchIf((cause) => Cause.isCause(cause), Effect.failCause)), active.remoteFailure.await));
+const dispose = (active) => Effect.gen(function* () {
+	const result = yield* race(active.connection, active.client.Dispose().pipe(Effect.catchIf(Cause.isCause, Effect.succeed)));
+	const cause = Cause.isCause(result) ? result : Cause.empty;
+	yield* race(active.connection, Deferred.await(active.stopped).pipe(Effect.andThen(Deferred.await(active.logsEnded)))).pipe(Effect.onError(() => Effect.failCause(cleanupCause(cause))));
+	return cause;
+});
+// packages/remote/src/internal/execution.ts
+const dependencies = (target) => target._tag === "Connector" ? [Connector, Credentials] : target._tag === "Local" ? [LocalTransport] : [WorkerTransport];
+/** One owned execution per activation, with explicitly mapped services. */
+const executionPlugin = (contract, options, configured, annotations = {}) => make({
+	name: contract.name,
+	inject: [
+		SecureRandom.SecureRandom,
+		...dependencies(configured),
+		...Array.map(contract.inject, (service) => service.key)
+	],
+	config: Schema.toEncoded(contract.config),
+	apply: (input) => Effect.gen(function* () {
+		const session = yield* (yield* SecureRandom.SecureRandom).uuidV4();
+		const active = yield* acquire(configured, options.contractModule, {
+			session,
+			serve: endpoints(contract.inject),
+			call: {
+				...endpoints(contract.provides),
+				[endpoint]: contract.control
+			}
+		}, initialize(contract), dispose, options.shutdownTimeout ?? "5 seconds");
+		yield* load$1(active, input);
+		for (const service of contract.provides) yield* service.publish(active.connection.transport).pipe(Scope.provide(active.connection.resources));
+		yield* fork(Effect.raceFirst(Fiber.join(active.events), active.remoteFailure.await).pipe(Effect.mapError((error) => publicError(contract.error, error))));
+		return () => Effect.succeed(false);
+	}).pipe(Effect.annotateLogs(annotations), Effect.mapError((error) => publicError(contract.error, error)))
+});
+const publicError = (declared, error) => Schema.is(declared)(error) ? error : Schema.is(UndeclaredFailure)(error) || Schema.is(RemoteWithdrawn)(error) || Schema.is(RemoteError)(error) || Schema.is(MissingInstance)(error) ? error : RemoteError.make({ cause: Cause.fail(error) });
+// packages/remote/src/internal/entry.ts
+var EntryError = class extends Schema.TaggedError()("RemoteEntryError", {
+	entry: Schema.Option(Schema.String),
+	directory: Schema.Option(Schema.String),
+	field: Schema.String,
+	cause: Schema.Cause(Schema.Unknown, Schema.Unknown)
+}) {
+	get message() {
+		return `Remote entry ${Option.getOrElse(this.entry, () => "<programmatic>")} failed at ${this.field}`;
+	}
+};
+const boundary = Effect.fnUntraced(function* (field) {
+	const entry = yield* CurrentId;
+	const directory = yield* ConfigDirectory;
+	return (cause) => Effect.fail(EntryError.make({
+		entry,
+		directory,
+		field,
+		cause
+	}));
+});
+const resolve = Effect.fnUntraced(function* (reference, field) {
+	const existing = yield* Effect.serviceOption(ModuleResolver);
+	const path = yield* Path.Path;
+	const source = yield* ConfigDirectory;
+	const directory = path.resolve(Option.getOrElse(source, () => "."));
+	const resolver = yield* Option.match(existing, {
+		onSome: Effect.succeed,
+		onNone: () => Effect.gen(function* () {
+			const importer = yield* make$1(directory);
+			return yield* make$2({
+				base: directory,
+				importer: (specifier) => String.startsWith("@graftland/plugin-remote/")(specifier) ? import(specifier) : importer(specifier)
+			});
+		})
+	});
+	const fail = yield* boundary(field);
+	return {
+		plugin: yield* resolver.resolve(reference.name).pipe(Effect.catchCause(fail)),
+		config: reference.config
+	};
+});
+const loadContract = Effect.fnUntraced(function* (specifier) {
+	const resolver = yield* ModuleResolver;
+	const fail = yield* boundary("contract");
+	return yield* resolver.importModule(specifier).pipe(Effect.flatMap((module) => Effect.fromOption(fromModule(module), () => ModuleInvalid.make({
+		specifier,
+		cause: "Expected a default or named remote contract"
+	}))), Effect.catchCause(fail));
+});
+/** Direct execution installs only its execution capability in a private realm. */
+const direct = (provider, consumer, input, key) => plugin(make({
+	name: "remote-direct",
+	apply: Effect.fnUntraced(function* () {
+		const capability = yield* plugin(provider);
+		yield* follow(capability, (cause) => Effect.fail(CapabilityFailed.make({ cause })));
+		const execution = yield* plugin(consumer, input);
+		yield* follow(execution, (cause) => Effect.fail(CapabilityFailed.make({ cause })));
+	})
+}), void 0, { isolate: [key] });
+const directTarget = Effect.fnUntraced(function* (contract, input, selected, annotations, options) {
+	const path = yield* Path.Path;
+	const source = yield* ConfigDirectory;
+	const directory = path.resolve(Option.getOrElse(source, () => "."));
+	const module = String.startsWith("file:")(input.contract) ? input.contract : yield* resolveEntry(directory, input.contract);
+	const capability = yield* resolve({ name: selected._tag === "Local" ? "@graftland/plugin-remote/host/local" : "@graftland/plugin-remote/host/worker" }, "connect");
+	return yield* direct(capability.plugin, executionPlugin(contract, {
+		...options,
+		contractModule: module
+	}, selected, annotations), input.config, selected._tag === "Local" ? LocalTransport : WorkerTransport);
+});
+const runnerTarget = Effect.fnUntraced(function* (contract, input, target, annotations, options, authOverride) {
+	const instance = target.instance === void 0 ? yield* CurrentId : Option.some(target.instance);
+	if (Option.isNone(instance)) return yield* MissingInstance.make({});
+	const transport = yield* resolve(hostTransport(target), "connect.transport");
+	const auth = authOverride ?? (yield* resolve(authentication("host", target.auth), "connect.auth"));
+	const consumer = executionPlugin(contract, options, {
+		_tag: "Connector",
+		explicitAuth: target.auth !== void 0,
+		instance: instance.value,
+		...target.lease === void 0 ? {} : { lease: target.lease },
+		...target.margin === void 0 ? {} : { margin: target.margin },
+		...target.expect === void 0 ? {} : { expect: target.expect }
+	}, annotations);
+	return yield* host$1({
+		transport,
+		auth,
+		consumer,
+		input: input.config
+	});
+});
+const launch = Effect.fnUntraced(function* (contract, input, options, authOverride) {
+	const annotations = yield* References.CurrentLogAnnotations;
+	const connect = input.connect;
+	const scope = yield* children;
+	return yield* Effect.gen(function* () {
+		if (connect.local !== void 0) return yield* directTarget(contract, input, {
+			_tag: "Local",
+			...connect.local
+		}, annotations, options);
+		if (connect.worker !== void 0) return yield* directTarget(contract, input, {
+			_tag: "Worker",
+			...connect.worker
+		}, annotations, options);
+		return yield* runnerTarget(contract, input, connect, annotations, options, authOverride);
+	}).pipe(Scope.provide(scope));
+});
+const load = Effect.fnUntraced(function* (input) {
+	const contract = yield* loadContract(input.contract);
+	const failConfig = yield* boundary("config");
+	yield* Schema.decodeEffect(contract.config)(input.config).pipe(Effect.catchCause(failConfig));
+	const failConnect = yield* boundary("connect");
+	const fork = yield* launch(contract, input, { contractModule: input.contract }).pipe(Effect.catchCause(failConnect));
+	yield* follow(fork, failConnect);
+});
+const host = make({
+	name: "remote",
+	config: Host,
+	inject: [
+		SecureRandom.SecureRandom,
+		ModuleResolver,
+		Path.Path,
+		ChildProcessSpawner.ChildProcessSpawner
+	],
+	apply: load
+});
+export { publicError as a, directAuth as c, follow as d, Host as f, runnerTransport as h, resolve as i, makeListenerConsumer as l, runnerAuthentication as m, host as n, CapabilityCombinationError as o, Runner as p, launch as r, CapabilityFailed as s, boundary as t, runner as u };