@graftland/plugin-remote 0.2.0-beta.2 → 0.3.1

package/dist/runner/auth/jwt.js

@@ -1,8 +1,8 @@
-import { a as provide, l as make } from "../../Graft-BsYq3F-J.js";
+import { a as provide, l as make } from "../../Graft-CVyueNOf.js";
 import { t as Authenticator } from "../../Auth-BElTC9_X.js";
 import { t as ConfigDirectory } from "../../ConfigDirectory-BCC6q2R4.js";
-import { t as AuthenticationFailed } from "../../Errors-oPsTLY7l.js";
-import { r as read } from "../../token-v5ne2I0-.js";
+import { t as AuthenticationFailed } from "../../Errors-BMKmu5Y7.js";
+import { r as read } from "../../token-Cc_1CTbE.js";
 import { Cause, Duration, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
 import { Signature } from "effect/crypto";
 import { HttpClient } from "effect/http";

package/dist/runner/auth/mtls.js

@@ -1,7 +1,7 @@
-import { a as provide, l as make$1 } from "../../Graft-BsYq3F-J.js";
+import { a as provide, l as make$1 } from "../../Graft-CVyueNOf.js";
 import { t as Authenticator } from "../../Auth-BElTC9_X.js";
 import { t as ConfigDirectory } from "../../ConfigDirectory-BCC6q2R4.js";
-import { t as AuthenticationFailed } from "../../Errors-oPsTLY7l.js";
+import { t as AuthenticationFailed } from "../../Errors-BMKmu5Y7.js";
 import { Array, Cause, Effect, FileSystem, Option, Path, Schema, String } from "effect";
 // packages/remote/src/internal/auth/mtls.ts
 const uriValue = (field) => {

package/dist/runner/auth/none.js

@@ -1,4 +1,4 @@
-import { a as provide, l as make } from "../../Graft-BsYq3F-J.js";
+import { a as provide, l as make } from "../../Graft-CVyueNOf.js";
 import { t as Authenticator } from "../../Auth-BElTC9_X.js";
 import { Effect, Schema } from "effect";
 // packages/remote/src/runner/auth/none.ts

package/dist/runner/index.js

@@ -1,8 +1,8 @@
-import { i as plugin, l as make, o as fork } from "../Graft-BsYq3F-J.js";
-import { r as ModuleResolver } from "../importer-D7zSgqxq.js";
-import { c as directAuth, d as follow, h as runnerTransport, i as resolve, l as makeListenerConsumer, m as runnerAuthentication, o as CapabilityCombinationError, p as Runner, s as CapabilityFailed, t as boundary, u as runner } from "../entry-SYsx9VNb.js";
-import { i as Supervisor } from "../Packages-B1TPk8pa.js";
-import { n as supervisorPlugin_default, t as Config$1 } from "../supervisorPlugin-Inb1S5IV.js";
+import { i as plugin, l as make, o as fork } from "../Graft-CVyueNOf.js";
+import { r as ModuleResolver } from "../importer-Bk6U_sn4.js";
+import { c as directAuth, d as follow, h as runnerTransport, i as resolve, l as makeListenerConsumer, m as runnerAuthentication, o as CapabilityCombinationError, p as Runner, s as CapabilityFailed, t as boundary, u as runner } from "../entry-B89sepMU.js";
+import { i as Supervisor } from "../Packages-JNL34JpS.js";
+import { n as supervisorPlugin_default, t as Config$1 } from "../supervisorPlugin-CivhM7x5.js";
 import { Array, Deferred, Effect, HashSet, Option, Path, Schema, Stream } from "effect";
 import { SecureRandom } from "effect/crypto";
 // packages/remote/src/internal/listenerStartup.ts

package/dist/runner/stdio.js

@@ -1,6 +1,6 @@
-import { a as provide, l as make } from "../Graft-BsYq3F-J.js";
+import { a as provide, l as make } from "../Graft-CVyueNOf.js";
 import { n as Listener } from "../Transport-DULzpsgR.js";
-import { c as TransportError } from "../Errors-oPsTLY7l.js";
+import { l as TransportError } from "../Errors-BMKmu5Y7.js";
 import { r as scoped } from "../release-BY4Mlluy.js";
 import { Cause, Deferred, Effect, Exit, Option, Schema, Sink, Stdio, Stream } from "effect";
 // packages/remote/src/runner/stdio.ts

package/dist/runner/unix.js

@@ -1,8 +1,8 @@
-import { a as provide, l as make } from "../Graft-BsYq3F-J.js";
+import { a as provide, l as make } from "../Graft-CVyueNOf.js";
 import { t as ConfigDirectory } from "../ConfigDirectory-BCC6q2R4.js";
 import { n as Listener } from "../Transport-DULzpsgR.js";
-import { c as TransportError } from "../Errors-oPsTLY7l.js";
-import { t as bind } from "../websocketServer-MXcCJx0v.js";
+import { l as TransportError } from "../Errors-BMKmu5Y7.js";
+import { t as bind } from "../websocketServer-D2Hk7wsA.js";
 import { Cause, Console, Effect, Option, Path, Schema } from "effect";
 import { createServer } from "node:http";
 // packages/remote/src/runner/unix.ts

package/dist/runner/websocket.js

@@ -1,9 +1,9 @@
-import { a as provide, l as make } from "../Graft-BsYq3F-J.js";
+import { a as provide, l as make } from "../Graft-CVyueNOf.js";
 import { t as ConfigDirectory } from "../ConfigDirectory-BCC6q2R4.js";
-import { n as Url, o as properties } from "../socketChannel-KmtzF-9G.js";
+import { n as Url, o as properties } from "../socketChannel-C_ppdSzz.js";
 import { n as Listener } from "../Transport-DULzpsgR.js";
-import { c as TransportError } from "../Errors-oPsTLY7l.js";
-import { t as bind } from "../websocketServer-MXcCJx0v.js";
+import { l as TransportError } from "../Errors-BMKmu5Y7.js";
+import { t as bind } from "../websocketServer-D2Hk7wsA.js";
 import { Cause, Console, Effect, FileSystem, Option, Path, Schema, String } from "effect";
 import { createSecureServer } from "node:http2";
 import { createServer } from "node:http";

package/dist/{socketChannel-KmtzF-9G.js → socketChannel-C_ppdSzz.js}

@@ -1,5 +1,5 @@
 import { i as __toESM, r as __require, t as __commonJSMin } from "./rolldown-runtime-DYf_mQCB.js";
-import { c as TransportError } from "./Errors-oPsTLY7l.js";
+import { l as TransportError } from "./Errors-BMKmu5Y7.js";
 import { a as isCompleteFrame, i as encode, n as FrameError, o as maxPayload, r as decoder } from "./Framing-zaYdOJnT.js";
 import { Array as Array$1, Cause, Effect, Exit, Layer, Redacted, Schema, Sink, Stream } from "effect";
 import { Socket } from "effect/socket";

package/dist/{supervisorPlugin-Inb1S5IV.js → supervisorPlugin-CivhM7x5.js}

@@ -1,16 +1,16 @@
-import { a as provide, l as make$2, o as fork, u as optional } from "./Graft-BsYq3F-J.js";
-import { a as PositiveDuration, i as Supervisor$1, t as resolve } from "./Packages-B1TPk8pa.js";
+import { a as provide, l as make$2, o as fork, u as optional } from "./Graft-CVyueNOf.js";
+import { a as PositiveDuration, i as Supervisor$1, t as resolve } from "./Packages-JNL34JpS.js";
 import { t as ConfigDirectory } from "./ConfigDirectory-BCC6q2R4.js";
-import { C as negotiate, E as make$3, S as keyOf, T as stoppingRecord, _ as StateStorageError, a as ExecutionError, d as SessionAccessDenied, f as SessionConflict, g as StateDirectoryLocked, h as StaleSession, i as Execution, m as SessionStopped, n as Session$1, o as Key, p as SessionRecord, r as channel, s as LeaseExpired, t as Peer, u as RunnerClosing, v as Store, w as stoppedRecord, x as childOf, y as TerminationUnconfirmed } from "./Peer-IJgFK6mD.js";
+import { C as negotiate, E as make$3, S as keyOf, T as stoppingRecord, _ as StateStorageError, a as ExecutionError, d as SessionAccessDenied, f as SessionConflict, g as StateDirectoryLocked, h as StaleSession, i as Execution, m as SessionStopped, n as Session$1, o as Key, p as SessionRecord, r as channel, s as LeaseExpired, t as Peer, u as RunnerClosing, v as Store, w as stoppedRecord, x as childOf, y as TerminationUnconfirmed } from "./Peer-BT7eAGmh.js";
 import { t as observe } from "./ProcessObservation-DEGrEMfP.js";
 import { t as make$4 } from "./FailureGroup-BcH0XOBi.js";
 import { t as CommandJson } from "./WatchdogProtocol-BZmVxrBP.js";
-import { c as TransportError } from "./Errors-oPsTLY7l.js";
-import { t as Bootstrap } from "./Bootstrap-MCwivGN1.js";
+import { l as TransportError } from "./Errors-BMKmu5Y7.js";
+import { t as Bootstrap } from "./Bootstrap-Dr6sX7el.js";
 import { t as command } from "./command-9zrHdbwT.js";
 import { n as close } from "./release-BY4Mlluy.js";
-import { n as cleanupCause } from "./cleanup-BPWr-5U9.js";
-import { n as make$5, o as defaults } from "./port-Blbh8tms.js";
+import { n as cleanupCause } from "./cleanup-CXLa1Wd9.js";
+import { n as make$5, o as defaults } from "./port-DSVUY8Bq.js";
 import { i as resources, t as ServeLifecycle } from "./ServeLifecycle-CJM0gG5B.js";
 import { Array, Cause, Clock, Context, Data, Deferred, Duration, Effect, Equal, Exit, FiberHandle, FiberSet, FileSystem, HashMap, HashSet, Layer, Option, Path, Queue, RcMap, Ref, Result, Schedule, Schema, Scope, Semaphore, Sink, Stream, String, SynchronizedRef } from "effect";
 import process from "node:process";

package/dist/{token-v5ne2I0-.js → token-Cc_1CTbE.js}

@@ -1,4 +1,4 @@
-import { t as AuthenticationFailed } from "./Errors-oPsTLY7l.js";
+import { t as AuthenticationFailed } from "./Errors-BMKmu5Y7.js";
 import { Effect, Option, Redacted } from "effect";
 // packages/remote/src/internal/auth/token.ts
 const invalid = () => AuthenticationFailed.make({

package/dist/{tokenCredentials-WUJm2AKm.js → tokenCredentials-CI6mMRRd.js}

@@ -1,8 +1,8 @@
-import { a as provide, l as make } from "./Graft-BsYq3F-J.js";
+import { a as provide, l as make } from "./Graft-CVyueNOf.js";
 import { t as ConfigDirectory } from "./ConfigDirectory-BCC6q2R4.js";
 import { n as Credentials } from "./Auth-BElTC9_X.js";
-import { n as CredentialsError } from "./Errors-oPsTLY7l.js";
-import { n as prepare } from "./token-v5ne2I0-.js";
+import { n as CredentialsError } from "./Errors-BMKmu5Y7.js";
+import { n as prepare } from "./token-Cc_1CTbE.js";
 import { Cause, Effect, FileSystem, Option, Path, Redacted, Schema } from "effect";
 // packages/remote/src/internal/auth/tokenCredentials.ts
 const Config$1 = Schema.Struct({ token: Schema.Union([Schema.RedactedFromValue(Schema.String), Schema.Struct({ file: Schema.String })]) });

package/dist/{websocketServer-MXcCJx0v.js → websocketServer-D2Hk7wsA.js}

@@ -1,5 +1,5 @@
-import { c as TransportError } from "./Errors-oPsTLY7l.js";
-import { a as payloadLimit, s as protocol, t as fromSocket } from "./socketChannel-KmtzF-9G.js";
+import { l as TransportError } from "./Errors-BMKmu5Y7.js";
+import { a as payloadLimit, s as protocol, t as fromSocket } from "./socketChannel-C_ppdSzz.js";
 import { Array, Cause, Deferred, Effect, Option, Redacted, Scope, String } from "effect";
 import { NodeHttpServer, NodeHttpServerRequest } from "@effect/platform-node";
 import { HttpServerRequest, HttpServerResponse } from "effect/http";

package/dist/{workerChannel-P82YdNjh.js → workerChannel-cmLc13vm.js}

@@ -1,4 +1,4 @@
-import { c as TransportError } from "./Errors-oPsTLY7l.js";
+import { l as TransportError } from "./Errors-BMKmu5Y7.js";
 import { Cause, Effect, FiberSet, Queue, Schema, Sink, Stream } from "effect";
 // packages/remote/src/internal/workerBootstrap.ts
 const Bootstrap = Schema.Struct({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@graftland/plugin-remote",
-  "version": "0.2.0-beta.2",
+  "version": "0.3.1",
   "type": "module",
   "description": "Local and authenticated network execution for Graft plugins",
   "license": "Apache-2.0",
@@ -49,9 +49,9 @@
     "effect": "4.1.*"
   },
   "dependencies": {
-    "@graftland/graft": "0.2.0-beta.2",
+    "@graftland/graft": "0.3.1",
     "@effect/platform-node": "4.1.2",
-    "@graftland/loader": "0.2.0-beta.2",
+    "@graftland/loader": "0.3.1",
     "pkijs": "4.0.1",
     "asn1js": "4.0.0",
     "ws": "8.22.1"

package/src/Contract.ts

@@ -1,38 +1,79 @@
-import { ChildFailure } from "./internal/childErrors"
-export { ChildFailure }
-import { Array, Cause, Predicate, Schema } from "effect"
-
-import type { Service } from "./internal/services"
+import { Array, Predicate, Schema } from "effect"
+import type { Context, Effect, Scope } from "effect"
+import type { Graft } from "@graftland/graft"
+import type { Rpc, RpcClient, RpcGroup, RpcServer } from "effect/rpc"
 import * as Control from "./internal/control"
 export { service } from "./internal/services"
 
 const TypeId = "~@graftland/plugin-remote/Contract"
 
-/** An undeclared failure still crosses the boundary, with its diagnostic value. */
-export class UndeclaredFailure extends Schema.TaggedError<
-	UndeclaredFailure,
-	{ readonly brand: unique symbol }
->()("UndeclaredFailure", { original: Schema.Defect({ includeStack: true }) }) {}
+/** RPC types stay inside the descriptor; Graft supplies its dynamic activation context. */
+export interface Service<R = never, ClientR = never> {
+	readonly key: Context.Key<unknown, unknown>
+	readonly group: Pick<RpcGroup.RpcGroup<Rpc.Any>, "requests">
+	readonly serve: (port: {
+		readonly serverProtocol: (endpoint: string) => RpcServer.Protocol["Service"]
+	}) => Effect.Effect<never, never, R>
+	readonly publish: (port: {
+		readonly clientProtocol: (endpoint: string) => RpcClient.Protocol["Service"]
+	}) => Effect.Effect<
+		void,
+		Graft.ServiceConflict,
+		Graft.Graft | Scope.Scope | ClientR
+	>
+}
 
-/** Pure metadata shared by the host and the executable runner bootstrap. */
-export const make = <
-	S extends Schema.Top & {
-		readonly Encoded: Schema.Json
-		readonly DecodingServices: never
-		readonly EncodingServices: never
-	},
-	E extends Schema.Top & {
-		readonly DecodingServices: never
-		readonly EncodingServices: never
-	},
->(options: {
+/** A self-contained configuration schema that encodes as JSON. */
+export type ConfigSchema = Schema.Top & {
+	readonly Encoded: Schema.Json
+	readonly DecodingServices: never
+	readonly EncodingServices: never
+}
+/** A self-contained schema for declared failures. */
+export type ErrorSchema = Schema.Top & {
+	readonly DecodingServices: never
+	readonly EncodingServices: never
+}
+
+/** The shared configuration and service declarations for one remote plugin. */
+export interface Contract<
+	S extends ConfigSchema,
+	E extends ErrorSchema = typeof Schema.Never,
+> {
 	readonly name: string
 	readonly config: S
 	readonly error: E
 	readonly module: string
+	readonly inject: ReadonlyArray<Service>
+	readonly provides: ReadonlyArray<Service>
+	readonly [TypeId]: typeof TypeId
+}
+/** Configuration accepted by make; omitted errors default to Never. */
+export interface Options<S extends ConfigSchema, E extends ErrorSchema> {
+	readonly name: string
+	readonly config: S
+	readonly error?: E
+	readonly module: string
 	readonly inject?: ReadonlyArray<Service>
 	readonly provides?: ReadonlyArray<Service>
-}) => {
+}
+
+/** An undeclared failure still crosses the boundary, with its diagnostic value. */
+export class UndeclaredFailure extends Schema.TaggedError<
+	UndeclaredFailure,
+	{ readonly brand: unique symbol }
+>()("UndeclaredFailure", { original: Schema.Defect({ includeStack: true }) }) {}
+
+/** Pure metadata shared by the host and the executable runner bootstrap. */
+export function make<S extends ConfigSchema, E extends ErrorSchema>(
+	options: Options<S, E> & { readonly error: E },
+): Contract<S, E>
+export function make<S extends ConfigSchema>(
+	options: Options<S, typeof Schema.Never>,
+): Contract<S>
+export function make<S extends ConfigSchema, E extends ErrorSchema>(
+	options: Options<S, E>,
+): Contract<S, E | typeof Schema.Never> {
 	// Keys are runtime strings; tuple types cannot distinguish independently created keys.
 	const keys = Array.map(
 		[...(options.inject ?? []), ...(options.provides ?? [])],
@@ -45,42 +86,17 @@ export const make = <
 		throw new Error(
 			"Service keys must be unique within a remote contract and must not use the control endpoint",
 		)
-	const failure = Schema.Union([options.error, UndeclaredFailure, ChildFailure])
-	const codec = Schema.toCodecJson(
-		Schema.Cause(failure, Schema.Defect({ includeStack: true })),
-	)
-	const declared = Schema.is(failure)
-	const normalizeCause = (cause: Cause.Cause<unknown>) =>
-		Cause.map(cause, (error) =>
-			declared(error) ? error : UndeclaredFailure.make({ original: error }),
-		)
+
 	return {
 		...options,
-		control: Control.make(codec),
-		normalizeCause,
+		error: options.error ?? Schema.Never,
 		inject: options.inject ?? [],
 		provides: options.provides ?? [],
 		[TypeId]: TypeId,
-		encodeCause: (cause: Cause.Cause<unknown>) =>
-			normalizeCause(cause).pipe(Schema.encodeEffect(codec)),
-		decodeCause: Schema.decodeUnknownEffect(codec),
 	}
 }
 
-/** The shared config, error codecs, and service declarations for one remote plugin. */
-export type Contract<
-	S extends Schema.Top & {
-		readonly Encoded: Schema.Json
-		readonly DecodingServices: never
-		readonly EncodingServices: never
-	},
-	E extends Schema.Top & {
-		readonly DecodingServices: never
-		readonly EncodingServices: never
-	},
-> = ReturnType<typeof make<S, E>>
-
-/** Dynamic imports retain the control server and cause normalization; hosts retain the declared error type. */
+/** A contract whose schemas are discovered through a dynamic import. */
 export type RunnerContract = Contract<
 	Schema.Codec<unknown, Schema.Json>,
 	Schema.Codec<unknown>

package/src/Errors.ts

@@ -80,3 +80,18 @@ export class AuthenticationFailed extends Schema.TaggedError<
 	challenge: Schema.optionalKey(Schema.String),
 	cause: Schema.optionalKey(Schema.Cause(Schema.Unknown, Schema.Unknown)),
 }) {}
+
+/** A remote entry could not be resolved or configured at the indicated field. */
+export class RemoteEntryError extends Schema.TaggedError<
+	RemoteEntryError,
+	{ readonly brand: unique symbol }
+>()("RemoteEntryError", {
+	entry: Schema.Option(Schema.String),
+	directory: Schema.Option(Schema.String),
+	field: Schema.String,
+	cause: Schema.Cause(Schema.Unknown, Schema.Unknown),
+}) {
+	override get message() {
+		return `Remote entry ${Option.getOrElse(this.entry, () => "<programmatic>")} failed at ${this.field}`
+	}
+}

package/src/Testing.ts

@@ -1,6 +1,7 @@
 import type { Plugin } from "@graftland/graft"
 import {
 	Array,
+	Cause,
 	Equivalence,
 	Deferred,
 	Effect,
@@ -9,13 +10,17 @@ import {
 	String,
 	Schema,
 } from "effect"
+import type { TransportError } from "./Errors"
 import type { Channel } from "./Transport"
 import * as Framing from "./internal/runner/Framing"
 
 export class ConformanceError extends Schema.TaggedError<
 	ConformanceError,
 	{ readonly brand: unique symbol }
->()("ConformanceError", { message: Schema.String }) {}
+>()("ConformanceError", {
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Cause(Schema.Unknown, Schema.Unknown)),
+}) {}
 const check = (condition: boolean, message: string) =>
 	condition ? Effect.void : Effect.fail(ConformanceError.make({ message }))
 export interface Capabilities {
@@ -88,7 +93,16 @@ export const transport = <E, R>(
 				),
 				"The channel changed byte order across split or coalesced chunks",
 			)
-		}),
+		}).pipe(
+			Effect.mapError((error): E | ConformanceError | TransportError =>
+				Schema.is(Framing.FrameError)(error)
+					? ConformanceError.make({
+							message: error.message,
+							cause: Cause.fail(error),
+						})
+					: error,
+			),
+		),
 		eof: Effect.gen(function* () {
 			const channel = yield* connect
 			yield* Stream.empty.pipe(Stream.run(channel.output))

package/src/host/auth/bearer.ts

@@ -1,10 +1,5 @@
-import type { Graft, Plugin } from "@graftland/graft"
 import { Config, plugin } from "../../internal/auth/tokenCredentials"
 export { Config }
 
-const capability: Plugin.Plugin<
-	typeof Config.Type,
-	typeof Config.Encoded,
-	Graft.ServiceConflict
-> = plugin("remote-bearer-credentials")
+const capability = plugin("remote-bearer-credentials")
 export default capability

package/src/host/auth/jwt.ts

@@ -1,10 +1,5 @@
-import type { Graft, Plugin } from "@graftland/graft"
 import { Config, plugin } from "../../internal/auth/tokenCredentials"
 export { Config }
 
-const capability: Plugin.Plugin<
-	typeof Config.Type,
-	typeof Config.Encoded,
-	Graft.ServiceConflict
-> = plugin("remote-jwt-credentials")
+const capability = plugin("remote-jwt-credentials")
 export default capability

package/src/host/command.ts

@@ -1,3 +1,5 @@
+/** Options for the command connector. */
+export type { CommandOptions as Options } from "../internal/transportOptions"
 import type { CommandOptions } from "../internal/transportOptions"
 import { Plugin, Graft } from "@graftland/graft"
 import {

package/src/host/local.ts

@@ -1,4 +1,4 @@
-import { Plugin, type Graft } from "@graftland/graft"
+import { Plugin } from "@graftland/graft"
 import { Array, Effect, Scope } from "effect"
 import { ChildProcess, ChildProcessSpawner } from "effect/process"
 import { LocalTransport } from "../internal/directTransport"
@@ -29,13 +29,9 @@ const make = Effect.map(ChildProcessSpawner.ChildProcessSpawner, (spawner) =>
 		}),
 	}),
 )
-const plugin: Plugin.Plugin<void, void, Graft.ServiceConflict> = Plugin.service(
-	LocalTransport,
-	make,
-	{
-		name: "remote-local-transport",
-		inject: [ChildProcessSpawner.ChildProcessSpawner],
-	},
-)
+const plugin = Plugin.service(LocalTransport, make, {
+	name: "remote-local-transport",
+	inject: [ChildProcessSpawner.ChildProcessSpawner],
+})
 
 export default plugin

package/src/host/unix.ts

@@ -1,3 +1,5 @@
+/** Options for the unix connector. */
+export type { UnixOptions as Options } from "../internal/transportOptions"
 import type { UnixOptions } from "../internal/transportOptions"
 import { Plugin, Graft } from "@graftland/graft"
 import { ConfigDirectory } from "@graftland/loader"

package/src/host/websocket.ts

@@ -1,3 +1,5 @@
+/** Options for the websocket connector. */
+export type { WebsocketOptions as Options } from "../internal/transportOptions"
 import type { WebsocketOptions } from "../internal/transportOptions"
 import { Plugin, Graft } from "@graftland/graft"
 import { Cause, Effect, FileSystem, Option, Path, Schema } from "effect"

package/src/host/worker.ts

@@ -1,4 +1,4 @@
-import { Plugin, type Graft } from "@graftland/graft"
+import { Plugin } from "@graftland/graft"
 import { Cause, Deferred, Effect, FiberSet, Option, Schema } from "effect"
 import { Worker } from "node:worker_threads"
 import { WorkerTransport } from "../internal/directTransport"
@@ -82,9 +82,7 @@ const start: typeof WorkerTransport.Service.start = Effect.fnUntraced(
 		}
 	},
 )
-const plugin: Plugin.Plugin<void, void, Graft.ServiceConflict> = Plugin.service(
-	WorkerTransport,
-	Effect.succeed({ start }),
-	{ name: "remote-thread-transport" },
-)
+const plugin = Plugin.service(WorkerTransport, Effect.succeed({ start }), {
+	name: "remote-thread-transport",
+})
 export default plugin

package/src/index.ts

@@ -16,9 +16,11 @@ export { Contract }
 export { Instance } from "./Instance"
 export { RemoteTerminationUnconfirmed } from "./internal/runner/model"
 export { RemoteError, RemoteWithdrawn, MissingInstance } from "./Errors"
-export { UndeclaredFailure, ChildFailure } from "./Contract"
+export { UndeclaredFailure } from "./Contract"
 export type {
 	Connect,
+	Authentication,
+	Token as CredentialToken,
 	Source as CredentialSource,
 } from "./internal/credentials"
 

package/src/internal/auth/tokenCredentials.ts

@@ -19,13 +19,7 @@ export const Config = Schema.Struct({
 		Schema.Struct({ file: Schema.String }),
 	]),
 })
-export const plugin = (
-	name: string,
-): Plugin.Plugin<
-	typeof Config.Type,
-	typeof Config.Encoded,
-	Graft.ServiceConflict
-> =>
+export const plugin = (name: string) =>
 	Plugin.make({
 		name,
 		config: Config,

package/src/internal/child.ts

@@ -20,7 +20,7 @@ import {
 	SynchronizedRef,
 } from "effect"
 import type { Schema } from "effect"
-import { type RunnerContract } from "../Contract"
+import { type RunnerContract } from "./contract"
 import { Instance, type Identity } from "../Instance"
 import type * as Port from "./port"
 import type { Event, Log, LogEvent } from "./control"

package/src/internal/childRuntime.ts

@@ -5,6 +5,7 @@ import { Effect, Logger, Option } from "effect"
 import { RpcServer } from "effect/rpc"
 import { fromModule, type RunnerContract } from "../Contract"
 import * as Port from "./port"
+import { prepare, type RunnerContract as PreparedContract } from "./contract"
 import * as Services from "./services"
 import * as Child from "./child"
 import * as Multiplex from "./runner/Multiplex"
@@ -25,7 +26,7 @@ export const load = (specifier: string) =>
 	})
 
 const connect = (
-	contract: RunnerContract,
+	contract: PreparedContract,
 	channel: Port.Channel,
 	session: string,
 	bootstrap: Bootstrap | undefined,
@@ -49,7 +50,7 @@ const connect = (
 
 /** One execution unit; the executable supplies the platform and Graft services. */
 export const run = (
-	contract: RunnerContract,
+	descriptor: RunnerContract,
 	channel: Port.Channel,
 	session = "local",
 	bootstrap?: Bootstrap,
@@ -57,6 +58,7 @@ export const run = (
 ): Effect.Effect<void, ExecutionError, Graft.Graft> =>
 	Effect.scoped(
 		Effect.gen(function* () {
+			const contract = prepare(descriptor)
 			const telemetry = yield* Child.telemetry(contract)
 			const loggers = yield* Logger.CurrentLoggers
 			yield* Effect.gen(function* () {

package/src/internal/contract.ts

@@ -0,0 +1,47 @@
+import { Cause, Schema } from "effect"
+import * as Contract from "../Contract"
+import { ChildFailure } from "./childErrors"
+import * as Control from "./control"
+
+/** Control RPCs and child failures belong to the execution protocol, not the public descriptor. */
+export const prepare = <
+	S extends Schema.Top & {
+		readonly Encoded: Schema.Json
+		readonly DecodingServices: never
+		readonly EncodingServices: never
+	},
+	E extends Schema.Top & {
+		readonly DecodingServices: never
+		readonly EncodingServices: never
+	},
+>(
+	contract: Contract.Contract<S, E>,
+) => {
+	const failure = Schema.Union([
+		contract.error,
+		Contract.UndeclaredFailure,
+		ChildFailure,
+	])
+	const codec = Schema.toCodecJson(
+		Schema.Cause(failure, Schema.Defect({ includeStack: true })),
+	)
+	const declared = Schema.is(failure)
+	const normalizeCause = (cause: Cause.Cause<unknown>) =>
+		Cause.map(cause, (error) =>
+			declared(error)
+				? error
+				: Contract.UndeclaredFailure.make({ original: error }),
+		)
+	return {
+		...contract,
+		control: Control.make(codec),
+		normalizeCause,
+		encodeCause: (cause: Cause.Cause<unknown>) =>
+			normalizeCause(cause).pipe(Schema.encodeEffect(codec)),
+		decodeCause: Schema.decodeUnknownEffect(codec),
+	}
+}
+
+export type RunnerContract = ReturnType<
+	typeof prepare<Schema.Codec<unknown, Schema.Json>, Schema.Codec<unknown>>
+>