@graftland/plugin-remote 0.3.1 → 0.3.2

package/dist/internal/serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve.js","names":["make","Importer.make"],"sources":["../../src/internal/serve.ts"],"sourcesContent":["import { findSubtree, isSubtreeActive } from \"./forkTree\"\nimport { Graft, Plugin, type Fork } from \"@graftland/graft\"\nimport {\n\tConfigDirectory,\n\tInclude,\n\tLoader,\n\tModuleResolver,\n} from \"@graftland/loader\"\nimport {\n\tArray,\n\tCause,\n\tDeferred,\n\tEffect,\n\tExit,\n\tLogger,\n\tOption,\n\tPath,\n\tStream,\n} from \"effect\"\nimport * as Importer from \"./importer\"\n\nimport { ServeLifecycle, StartupError, make } from \"./ServeLifecycle\"\nimport { cleanupCause } from \"./cleanup\"\nexport { StartupError } from \"./ServeLifecycle\"\n\nconst check = (\n\ttrees: ReadonlyArray<Fork.ForkTree>,\n): Effect.Effect<void, StartupError> =>\n\tEffect.forEach(\n\t\ttrees,\n\t\t(tree) => {\n\t\t\tif (tree.state._tag === \"Failed\")\n\t\t\t\treturn Effect.fail(\n\t\t\t\t\tStartupError.make({\n\t\t\t\t\t\tdetail: `Runner entry ${tree.name} failed`,\n\t\t\t\t\t\tcause: tree.state.cause,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\treturn check(tree.children)\n\t\t},\n\t\t{ discard: true },\n\t)\nconst ready = Plugin.make({\n\tname: \"remote-ready\",\n\tinject: [Loader.Loader],\n\tapply: Effect.fnUntraced(function* () {\n\t\tconst loader = yield* Loader.Loader\n\t\t// A failed authenticator can leave its listener child Pending while the outer plugin is Applying.\n\t\tyield* loader.ready.pipe(\n\t\t\tEffect.raceFirst(\n\t\t\t\tGraft.forks.pipe(\n\t\t\t\t\tStream.map((trees) => findSubtree(trees, loader.root.id)),\n\t\t\t\t\tStream.filter(Option.isSome),\n\t\t\t\t\tStream.runForEach((tree) => check([tree.value])),\n\t\t\t\t),\n\t\t\t),\n\t\t)\n\t\t// Pending can still be reacting to a provider published during startup.\n\t\t// Observe the loader's subtree, excluding this startup observer itself.\n\t\tyield* Graft.forks.pipe(\n\t\t\tStream.map((trees) => findSubtree(trees, loader.root.id)),\n\t\t\tStream.filter(Option.isSome),\n\t\t\tStream.map((tree) => tree.value),\n\t\t\tStream.tap((tree) => check([tree])),\n\t\t\tStream.filter(isSubtreeActive),\n\t\t\tStream.runHead,\n\t\t)\n\t}),\n})\n\n/** Loader logs child cleanup errors; the supervisor's release signal also reaches the command exit. */\nconst close = (entries: Fork.Fork, lifecycle: typeof ServeLifecycle.Service) =>\n\tEffect.gen(function* () {\n\t\tconst disposed = yield* Effect.exit(entries.dispose)\n\t\tconst released = yield* Effect.exit(Deferred.await(lifecycle.released))\n\t\tconst cause = Array.reduce(\n\t\t\t[disposed, released],\n\t\t\tCause.empty,\n\t\t\t(cause: Cause.Cause<unknown>, exit: Exit.Exit<void, unknown>) =>\n\t\t\t\tExit.isFailure(exit) ? Cause.combine(cause, exit.cause) : cause,\n\t\t)\n\t\tif (cause.reasons.length > 0)\n\t\t\treturn yield* Effect.failCause(cleanupCause(cause))\n\t})\n\nconst load = Effect.fnUntraced(function* (config: string, directory: string) {\n\tconst lifecycle = yield* make\n\tyield* Graft.provide(ServeLifecycle, lifecycle)\n\tconst importer = yield* Importer.make(directory)\n\tconst resolver = yield* ModuleResolver.make({ base: directory, importer })\n\tyield* Graft.provide(ModuleResolver.ModuleResolver, resolver)\n\tconst entries = yield* Graft.plugin(Include.Include, {\n\t\tpath: config,\n\t\twatch: false,\n\t})\n\tyield* entries.await\n\tconst startup = yield* Graft.plugin(ready)\n\tyield* startup.await\n\treturn yield* Deferred.await(lifecycle.ended).pipe(\n\t\tEffect.ensuring(close(entries, lifecycle)),\n\t)\n})\nexport const run = Effect.fnUntraced(function* (config: string) {\n\tconst path = yield* Path.Path\n\tconst file = path.resolve(config)\n\tconst directory = path.dirname(file)\n\treturn yield* load(file, directory).pipe(\n\t\tEffect.mapError((error) =>\n\t\t\tStartupError.make({\n\t\t\t\tdetail: \"Starting the runner failed\",\n\t\t\t\tcause: Cause.fail(error),\n\t\t\t}),\n\t\t),\n\t\tEffect.provideService(ConfigDirectory, Option.some(directory)),\n\t\tEffect.provideService(Logger.LogToStderr, true),\n\t)\n})\n"],"mappings":";;;;;;;;AAyBA,MAAM,SACL,UAEA,OAAO,QACN,QACC,SAAS;CACT,IAAI,KAAK,MAAM,SAAS,UACvB,OAAO,OAAO,KACb,aAAa,KAAK;EACjB,QAAQ,gBAAgB,KAAK,KAAK;EAClC,OAAO,KAAK,MAAM;CACnB,CAAC,CACF;CACD,OAAO,MAAM,KAAK,QAAQ;AAC3B,GACA,EAAE,SAAS,KAAK,CACjB;AACD,MAAM,QAAQ,OAAO,KAAK;CACzB,MAAM;CACN,QAAQ,CAAC,OAAO,MAAM;CACtB,OAAO,OAAO,WAAW,aAAa;EACrC,MAAM,SAAS,OAAO,OAAO;EAE7B,OAAO,OAAO,MAAM,KACnB,OAAO,UACN,MAAM,MAAM,KACX,OAAO,KAAK,UAAU,YAAY,OAAO,OAAO,KAAK,EAAE,CAAC,GACxD,OAAO,OAAO,OAAO,MAAM,GAC3B,OAAO,YAAY,SAAS,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAChD,CACD,CACD;EAGA,OAAO,MAAM,MAAM,KAClB,OAAO,KAAK,UAAU,YAAY,OAAO,OAAO,KAAK,EAAE,CAAC,GACxD,OAAO,OAAO,OAAO,MAAM,GAC3B,OAAO,KAAK,SAAS,KAAK,KAAK,GAC/B,OAAO,KAAK,SAAS,MAAM,CAAC,IAAI,CAAC,CAAC,GAClC,OAAO,OAAO,eAAe,GAC7B,OAAO,OACR;CACD,CAAC;AACF,CAAC;;AAGD,MAAM,SAAS,SAAoB,cAClC,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,OAAO,OAAO,KAAK,QAAQ,OAAO;CACnD,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,MAAM,UAAU,QAAQ,CAAC;CACtE,MAAM,QAAQ,MAAM,OACnB,CAAC,UAAU,QAAQ,GACnB,MAAM,QACL,OAA6B,SAC7B,KAAK,UAAU,IAAI,IAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,IAAI,KAC5D;CACA,IAAI,MAAM,QAAQ,SAAS,GAC1B,OAAO,OAAO,OAAO,UAAU,aAAa,KAAK,CAAC;AACpD,CAAC;AAEF,MAAM,OAAO,OAAO,WAAW,WAAW,QAAgB,WAAmB;CAC5E,MAAM,YAAY,OAAOA;CACzB,OAAO,MAAM,QAAQ,gBAAgB,SAAS;CAC9C,MAAM,WAAW,OAAOC,KAAc,SAAS;CAC/C,MAAM,WAAW,OAAO,eAAe,KAAK;EAAE,MAAM;EAAW;CAAS,CAAC;CACzE,OAAO,MAAM,QAAQ,eAAe,gBAAgB,QAAQ;CAC5D,MAAM,UAAU,OAAO,MAAM,OAAO,QAAQ,SAAS;EACpD,MAAM;EACN,OAAO;CACR,CAAC;CACD,OAAO,QAAQ;CAEf,QAAO,OADgB,MAAM,OAAO,KAAK,EAAA,CAC1B;CACf,OAAO,OAAO,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC,KAC7C,OAAO,SAAS,MAAM,SAAS,SAAS,CAAC,CAC1C;AACD,CAAC;AACD,MAAa,MAAM,OAAO,WAAW,WAAW,QAAgB;CAC/D,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,OAAO,KAAK,QAAQ,MAAM;CAChC,MAAM,YAAY,KAAK,QAAQ,IAAI;CACnC,OAAO,OAAO,KAAK,MAAM,SAAS,CAAC,CAAC,KACnC,OAAO,UAAU,UAChB,aAAa,KAAK;EACjB,QAAQ;EACR,OAAO,MAAM,KAAK,KAAK;CACxB,CAAC,CACF,GACA,OAAO,eAAe,iBAAiB,OAAO,KAAK,SAAS,CAAC,GAC7D,OAAO,eAAe,OAAO,aAAa,IAAI,CAC/C;AACD,CAAC"}
+{"version":3,"file":"serve.js","names":["make","Importer.make"],"sources":["../../src/internal/serve.ts"],"sourcesContent":["import { findSubtree, isSubtreeActive } from \"./forkTree\"\nimport { Graft, Plugin, type Fork } from \"@graftland/graft\"\nimport {\n\tConfigDirectory,\n\tInclude,\n\tLoader,\n\tModuleResolver,\n} from \"@graftland/loader\"\nimport {\n\tArray,\n\tCause,\n\tDeferred,\n\tEffect,\n\tExit,\n\tLogger,\n\tOption,\n\tPath,\n\tStream,\n} from \"effect\"\nimport * as Importer from \"./importer\"\n\nimport { ServeLifecycle, StartupError, make } from \"./ServeLifecycle\"\nimport { cleanupCause } from \"./cleanup\"\nexport { StartupError } from \"./ServeLifecycle\"\n\nconst check = (\n\ttrees: ReadonlyArray<Fork.ForkTree>,\n): Effect.Effect<void, StartupError> =>\n\tEffect.forEach(\n\t\ttrees,\n\t\t(tree) => {\n\t\t\tif (tree.state._tag === \"Failed\")\n\t\t\t\treturn Effect.fail(\n\t\t\t\t\tStartupError.make({\n\t\t\t\t\t\tdetail: `Runner entry ${tree.name} failed`,\n\t\t\t\t\t\tcause: tree.state.cause,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\treturn check(tree.children)\n\t\t},\n\t\t{ discard: true },\n\t)\nconst ready = Plugin.make({\n\tname: \"remote-ready\",\n\tinject: [Loader.Loader],\n\tapply: Effect.fnUntraced(function* () {\n\t\tconst loader = yield* Loader.Loader\n\t\t// A failed authenticator can leave its listener child Pending while the outer plugin is Applying.\n\t\tyield* loader.ready.pipe(\n\t\t\tEffect.raceFirst(\n\t\t\t\tGraft.forks.pipe(\n\t\t\t\t\tStream.map((trees) => findSubtree(trees, loader.root.id)),\n\t\t\t\t\tStream.filter(Option.isSome),\n\t\t\t\t\tStream.runForEach((tree) => check([tree.value])),\n\t\t\t\t),\n\t\t\t),\n\t\t)\n\t\t// Pending can still be reacting to a provider published during startup.\n\t\t// Observe the loader's subtree, excluding this startup observer itself.\n\t\tyield* Graft.forks.pipe(\n\t\t\tStream.map((trees) => findSubtree(trees, loader.root.id)),\n\t\t\tStream.filter(Option.isSome),\n\t\t\tStream.map((tree) => tree.value),\n\t\t\tStream.tap((tree) => check([tree])),\n\t\t\tStream.filter(isSubtreeActive),\n\t\t\tStream.runHead,\n\t\t)\n\t}),\n})\n\n/** Loader logs child cleanup errors; the supervisor's release signal also reaches the command exit. */\nconst close = Effect.fnUntraced(function* (\n\tentries: Fork.Fork,\n\tlifecycle: typeof ServeLifecycle.Service,\n) {\n\tconst disposed = yield* Effect.exit(entries.dispose)\n\tconst released = yield* Effect.exit(Deferred.await(lifecycle.released))\n\tconst cause = Array.reduce(\n\t\t[disposed, released],\n\t\tCause.empty,\n\t\t(cause: Cause.Cause<unknown>, exit: Exit.Exit<void, unknown>) =>\n\t\t\tExit.isFailure(exit) ? Cause.combine(cause, exit.cause) : cause,\n\t)\n\tif (cause.reasons.length > 0)\n\t\treturn yield* Effect.failCause(cleanupCause(cause))\n})\n\nconst load = Effect.fnUntraced(function* (config: string, directory: string) {\n\tconst lifecycle = yield* make\n\tyield* Graft.provide(ServeLifecycle, lifecycle)\n\tconst importer = yield* Importer.make(directory)\n\tconst resolver = yield* ModuleResolver.make({ base: directory, importer })\n\tyield* Graft.provide(ModuleResolver.ModuleResolver, resolver)\n\tconst entries = yield* Graft.plugin(Include.Include, {\n\t\tpath: config,\n\t\twatch: false,\n\t})\n\tyield* entries.await\n\tconst startup = yield* Graft.plugin(ready)\n\tyield* startup.await\n\treturn yield* Deferred.await(lifecycle.ended).pipe(\n\t\tEffect.ensuring(close(entries, lifecycle)),\n\t)\n})\nexport const run = Effect.fnUntraced(function* (config: string) {\n\tconst path = yield* Path.Path\n\tconst file = path.resolve(config)\n\tconst directory = path.dirname(file)\n\treturn yield* load(file, directory).pipe(\n\t\tEffect.mapError((error) =>\n\t\t\tStartupError.make({\n\t\t\t\tdetail: \"Starting the runner failed\",\n\t\t\t\tcause: Cause.fail(error),\n\t\t\t}),\n\t\t),\n\t\tEffect.provideService(ConfigDirectory, Option.some(directory)),\n\t\tEffect.provideService(Logger.LogToStderr, true),\n\t)\n})\n"],"mappings":";;;;;;;;AAyBA,MAAM,SACL,UAEA,OAAO,QACN,QACC,SAAS;CACT,IAAI,KAAK,MAAM,SAAS,UACvB,OAAO,OAAO,KACb,aAAa,KAAK;EACjB,QAAQ,gBAAgB,KAAK,KAAK;EAClC,OAAO,KAAK,MAAM;CACnB,CAAC,CACF;CACD,OAAO,MAAM,KAAK,QAAQ;AAC3B,GACA,EAAE,SAAS,KAAK,CACjB;AACD,MAAM,QAAQ,OAAO,KAAK;CACzB,MAAM;CACN,QAAQ,CAAC,OAAO,MAAM;CACtB,OAAO,OAAO,WAAW,aAAa;EACrC,MAAM,SAAS,OAAO,OAAO;EAE7B,OAAO,OAAO,MAAM,KACnB,OAAO,UACN,MAAM,MAAM,KACX,OAAO,KAAK,UAAU,YAAY,OAAO,OAAO,KAAK,EAAE,CAAC,GACxD,OAAO,OAAO,OAAO,MAAM,GAC3B,OAAO,YAAY,SAAS,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAChD,CACD,CACD;EAGA,OAAO,MAAM,MAAM,KAClB,OAAO,KAAK,UAAU,YAAY,OAAO,OAAO,KAAK,EAAE,CAAC,GACxD,OAAO,OAAO,OAAO,MAAM,GAC3B,OAAO,KAAK,SAAS,KAAK,KAAK,GAC/B,OAAO,KAAK,SAAS,MAAM,CAAC,IAAI,CAAC,CAAC,GAClC,OAAO,OAAO,eAAe,GAC7B,OAAO,OACR;CACD,CAAC;AACF,CAAC;;AAGD,MAAM,QAAQ,OAAO,WAAW,WAC/B,SACA,WACC;CACD,MAAM,WAAW,OAAO,OAAO,KAAK,QAAQ,OAAO;CACnD,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,MAAM,UAAU,QAAQ,CAAC;CACtE,MAAM,QAAQ,MAAM,OACnB,CAAC,UAAU,QAAQ,GACnB,MAAM,QACL,OAA6B,SAC7B,KAAK,UAAU,IAAI,IAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,IAAI,KAC5D;CACA,IAAI,MAAM,QAAQ,SAAS,GAC1B,OAAO,OAAO,OAAO,UAAU,aAAa,KAAK,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,OAAO,WAAW,WAAW,QAAgB,WAAmB;CAC5E,MAAM,YAAY,OAAOA;CACzB,OAAO,MAAM,QAAQ,gBAAgB,SAAS;CAC9C,MAAM,WAAW,OAAOC,KAAc,SAAS;CAC/C,MAAM,WAAW,OAAO,eAAe,KAAK;EAAE,MAAM;EAAW;CAAS,CAAC;CACzE,OAAO,MAAM,QAAQ,eAAe,gBAAgB,QAAQ;CAC5D,MAAM,UAAU,OAAO,MAAM,OAAO,QAAQ,SAAS;EACpD,MAAM;EACN,OAAO;CACR,CAAC;CACD,OAAO,QAAQ;CAEf,QAAO,OADgB,MAAM,OAAO,KAAK,EAAA,CAC1B;CACf,OAAO,OAAO,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC,KAC7C,OAAO,SAAS,MAAM,SAAS,SAAS,CAAC,CAC1C;AACD,CAAC;AACD,MAAa,MAAM,OAAO,WAAW,WAAW,QAAgB;CAC/D,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,OAAO,KAAK,QAAQ,MAAM;CAChC,MAAM,YAAY,KAAK,QAAQ,IAAI;CACnC,OAAO,OAAO,KAAK,MAAM,SAAS,CAAC,CAAC,KACnC,OAAO,UAAU,UAChB,aAAa,KAAK;EACjB,QAAQ;EACR,OAAO,MAAM,KAAK,KAAK;CACxB,CAAC,CACF,GACA,OAAO,eAAe,iBAAiB,OAAO,KAAK,SAAS,CAAC,GAC7D,OAAO,eAAe,OAAO,aAAa,IAAI,CAC/C;AACD,CAAC"}

package/dist/internal/supervisorPlugin.js

@@ -1 +1 @@
-export { t as Config, n as default } from "../supervisorPlugin-CivhM7x5.js";
+export { t as Config, n as default } from "../supervisorPlugin-t6Z6PrhD.js";

package/dist/internal/watchdogMain.js

@@ -1,5 +1,5 @@
 import { n as Notice, t as CommandJson } from "../WatchdogProtocol-BZmVxrBP.js";
-import { Effect, FiberHandle, Ref, Schema, Stream } from "effect";
+import { Clock, Effect, FiberHandle, Ref, Schema, Stream } from "effect";
 import { NodeRuntime, NodeStream } from "@effect/platform-node";
 import process from "node:process";
 import { parentPort } from "node:worker_threads";
@@ -8,11 +8,11 @@ import { Socket } from "node:net";
 /** Executable worker: fd 4 and the lease timer remain independent of the plugin thread. */
 const die = Effect.sync(() => process.kill(process.pid, "SIGKILL")).pipe(Effect.andThen(Effect.never));
 const notify = (notice) => Schema.encodeEffect(Notice)(notice).pipe(Effect.flatMap((message) => Effect.sync(() => parentPort?.postMessage(message))));
-const now = Effect.sync(() => performance.now());
-const expire = (deadline) => Effect.gen(function* () {
+const now = Clock.monotonicTimeNanos.pipe(Effect.map((nanos) => Number(nanos) / 1e6));
+const expire = Effect.fnUntraced(function* (deadline) {
 	const remaining = deadline - (yield* now);
 	if (remaining <= 0) return yield* die;
-	yield* Effect.sleep(Math.min(remaining, 2147483647));
+	yield* Effect.sleep(remaining);
 	return yield* expire(deadline);
 });
 const main = Effect.scoped(Effect.gen(function* () {
@@ -30,7 +30,7 @@ const main = Effect.scoped(Effect.gen(function* () {
 		socket.destroy();
 	}));
 	yield* notify("ready");
-	yield* NodeStream.fromReadable({ evaluate: () => input }).pipe(Stream.decodeText(), Stream.splitLines, Stream.mapEffect((line) => Schema.decodeEffect(CommandJson)(line)), Stream.runForEach((command) => Effect.gen(function* () {
+	yield* NodeStream.fromReadable({ evaluate: () => input }).pipe(Stream.decodeText(), Stream.splitLines, Stream.mapEffect((line) => Schema.decodeEffect(CommandJson)(line)), Stream.runForEach(Effect.fnUntraced(function* (command) {
 		if (command.kind === "start") return yield* notify("start");
 		if (command.kind === "stop") {
 			yield* Ref.update(lease, (state) => ({

package/dist/internal/watchdogMain.js.map

@@ -1 +1 @@
-{"version":3,"file":"watchdogMain.js","names":[],"sources":["../../src/internal/watchdogMain.ts"],"sourcesContent":["/** Executable worker: fd 4 and the lease timer remain independent of the plugin thread. */\nimport { NodeRuntime, NodeStream } from \"@effect/platform-node\"\nimport { Effect, FiberHandle, Ref, Schema, Stream } from \"effect\"\nimport { Socket } from \"node:net\"\nimport { parentPort } from \"node:worker_threads\"\nimport process from \"node:process\"\nimport { CommandJson, Notice } from \"./runner/WatchdogProtocol\"\n\n// The runner machine is trusted. A suspended machine cannot enforce a deadline until it resumes.\n// Killing this live process has no PID lookup; external supervisor kills retain a small PID reuse window.\nconst die = Effect.sync(() => process.kill(process.pid, \"SIGKILL\")).pipe(\n\tEffect.andThen(Effect.never),\n)\nconst notify = (notice: typeof Notice.Type) =>\n\tSchema.encodeEffect(Notice)(notice).pipe(\n\t\tEffect.flatMap((message) =>\n\t\t\tEffect.sync(() => parentPort?.postMessage(message)),\n\t\t),\n\t)\nconst now = Effect.sync(() => performance.now())\nconst expire = (deadline: number): Effect.Effect<never> =>\n\tEffect.gen(function* () {\n\t\tconst remaining = deadline - (yield* now)\n\t\tif (remaining <= 0) return yield* die\n\t\tyield* Effect.sleep(Math.min(remaining, 2147483647))\n\t\treturn yield* expire(deadline)\n\t})\nconst main = Effect.scoped(\n\tEffect.gen(function* () {\n\t\tconst lease = yield* Ref.make({\n\t\t\tdeadline: (yield* now) + 30000,\n\t\t\tstopped: false,\n\t\t})\n\t\tconst timer = yield* FiberHandle.make<never, never>()\n\t\tyield* FiberHandle.run(timer, expire((yield* Ref.get(lease)).deadline))\n\t\tconst input = yield* Effect.acquireRelease(\n\t\t\tEffect.sync(() => new Socket({ fd: 4, readable: true, writable: false })),\n\t\t\t(socket) =>\n\t\t\t\tEffect.sync(() => {\n\t\t\t\t\tsocket.destroy()\n\t\t\t\t}),\n\t\t)\n\t\tyield* notify(\"ready\")\n\t\tyield* NodeStream.fromReadable({ evaluate: () => input }).pipe(\n\t\t\tStream.decodeText(),\n\t\t\tStream.splitLines,\n\t\t\tStream.mapEffect((line) => Schema.decodeEffect(CommandJson)(line)),\n\t\t\tStream.runForEach((command) =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tif (command.kind === \"start\") return yield* notify(\"start\")\n\t\t\t\t\tif (command.kind === \"stop\") {\n\t\t\t\t\t\tyield* Ref.update(lease, (state) => ({ ...state, stopped: true }))\n\t\t\t\t\t\treturn yield* notify(\"stop\")\n\t\t\t\t\t}\n\t\t\t\t\tconst current = yield* Ref.get(lease)\n\t\t\t\t\tconst time = yield* now\n\t\t\t\t\tif (current.stopped || time >= current.deadline) return yield* die\n\t\t\t\t\tconst deadline = time + command.millis\n\t\t\t\t\tyield* Ref.set(lease, { deadline, stopped: false })\n\t\t\t\t\tyield* FiberHandle.run(timer, expire(deadline))\n\t\t\t\t}),\n\t\t\t),\n\t\t)\n\t\treturn yield* die\n\t}),\n).pipe(\n\tEffect.catchCause((cause) =>\n\t\tEffect.logError(\"Watchdog failed\", cause).pipe(Effect.andThen(die)),\n\t),\n)\n\nNodeRuntime.runMain(main)\n"],"mappings":";;;;;;;;AAUA,MAAM,MAAM,OAAO,WAAW,QAAQ,KAAK,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KACnE,OAAO,QAAQ,OAAO,KAAK,CAC5B;AACA,MAAM,UAAU,WACf,OAAO,aAAa,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KACnC,OAAO,SAAS,YACf,OAAO,WAAW,YAAY,YAAY,OAAO,CAAC,CACnD,CACD;AACD,MAAM,MAAM,OAAO,WAAW,YAAY,IAAI,CAAC;AAC/C,MAAM,UAAU,aACf,OAAO,IAAI,aAAa;CACvB,MAAM,YAAY,YAAY,OAAO;CACrC,IAAI,aAAa,GAAG,OAAO,OAAO;CAClC,OAAO,OAAO,MAAM,KAAK,IAAI,WAAW,UAAU,CAAC;CACnD,OAAO,OAAO,OAAO,QAAQ;AAC9B,CAAC;AACF,MAAM,OAAO,OAAO,OACnB,OAAO,IAAI,aAAa;CACvB,MAAM,QAAQ,OAAO,IAAI,KAAK;EAC7B,WAAW,OAAO,OAAO;EACzB,SAAS;CACV,CAAC;CACD,MAAM,QAAQ,OAAO,YAAY,KAAmB;CACpD,OAAO,YAAY,IAAI,OAAO,QAAQ,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,QAAQ,CAAC;CACtE,MAAM,QAAQ,OAAO,OAAO,eAC3B,OAAO,WAAW,IAAI,OAAO;EAAE,IAAI;EAAG,UAAU;EAAM,UAAU;CAAM,CAAC,CAAC,IACvE,WACA,OAAO,WAAW;EACjB,OAAO,QAAQ;CAChB,CAAC,CACH;CACA,OAAO,OAAO,OAAO;CACrB,OAAO,WAAW,aAAa,EAAE,gBAAgB,MAAM,CAAC,CAAC,CAAC,KACzD,OAAO,WAAW,GAClB,OAAO,YACP,OAAO,WAAW,SAAS,OAAO,aAAa,WAAW,CAAC,CAAC,IAAI,CAAC,GACjE,OAAO,YAAY,YAClB,OAAO,IAAI,aAAa;EACvB,IAAI,QAAQ,SAAS,SAAS,OAAO,OAAO,OAAO,OAAO;EAC1D,IAAI,QAAQ,SAAS,QAAQ;GAC5B,OAAO,IAAI,OAAO,QAAQ,WAAW;IAAE,GAAG;IAAO,SAAS;GAAK,EAAE;GACjE,OAAO,OAAO,OAAO,MAAM;EAC5B;EACA,MAAM,UAAU,OAAO,IAAI,IAAI,KAAK;EACpC,MAAM,OAAO,OAAO;EACpB,IAAI,QAAQ,WAAW,QAAQ,QAAQ,UAAU,OAAO,OAAO;EAC/D,MAAM,WAAW,OAAO,QAAQ;EAChC,OAAO,IAAI,IAAI,OAAO;GAAE;GAAU,SAAS;EAAM,CAAC;EAClD,OAAO,YAAY,IAAI,OAAO,OAAO,QAAQ,CAAC;CAC/C,CAAC,CACF,CACD;CACA,OAAO,OAAO;AACf,CAAC,CACF,CAAC,CAAC,KACD,OAAO,YAAY,UAClB,OAAO,SAAS,mBAAmB,KAAK,CAAC,CAAC,KAAK,OAAO,QAAQ,GAAG,CAAC,CACnE,CACD;AAEA,YAAY,QAAQ,IAAI"}
+{"version":3,"file":"watchdogMain.js","names":[],"sources":["../../src/internal/watchdogMain.ts"],"sourcesContent":["/** Executable worker: fd 4 and the lease timer remain independent of the plugin thread. */\nimport { NodeRuntime, NodeStream } from \"@effect/platform-node\"\nimport { Clock, Effect, FiberHandle, Ref, Schema, Stream } from \"effect\"\nimport { Socket } from \"node:net\"\nimport { parentPort } from \"node:worker_threads\"\nimport process from \"node:process\"\nimport { CommandJson, Notice } from \"./runner/WatchdogProtocol\"\n\n// The runner machine is trusted. A suspended machine cannot enforce a deadline until it resumes.\n// Killing this live process has no PID lookup; external supervisor kills retain a small PID reuse window.\nconst die = Effect.sync(() => process.kill(process.pid, \"SIGKILL\")).pipe(\n\tEffect.andThen(Effect.never),\n)\nconst notify = (notice: typeof Notice.Type) =>\n\tSchema.encodeEffect(Notice)(notice).pipe(\n\t\tEffect.flatMap((message) =>\n\t\t\tEffect.sync(() => parentPort?.postMessage(message)),\n\t\t),\n\t)\n// Milliseconds on the monotonic clock, which the lease sleep also uses.\nconst now = Clock.monotonicTimeNanos.pipe(\n\tEffect.map((nanos) => Number(nanos) / 1_000_000),\n)\nconst expire = Effect.fnUntraced(function* (\n\tdeadline: number,\n): Effect.fn.Return<never> {\n\tconst remaining = deadline - (yield* now)\n\tif (remaining <= 0) return yield* die\n\t// The clock splits sleeps longer than the platform timer limit.\n\tyield* Effect.sleep(remaining)\n\treturn yield* expire(deadline)\n})\nconst main = Effect.scoped(\n\tEffect.gen(function* () {\n\t\tconst lease = yield* Ref.make({\n\t\t\tdeadline: (yield* now) + 30000,\n\t\t\tstopped: false,\n\t\t})\n\t\tconst timer = yield* FiberHandle.make<never, never>()\n\t\tyield* FiberHandle.run(timer, expire((yield* Ref.get(lease)).deadline))\n\t\tconst input = yield* Effect.acquireRelease(\n\t\t\tEffect.sync(() => new Socket({ fd: 4, readable: true, writable: false })),\n\t\t\t(socket) =>\n\t\t\t\tEffect.sync(() => {\n\t\t\t\t\tsocket.destroy()\n\t\t\t\t}),\n\t\t)\n\t\tyield* notify(\"ready\")\n\t\tyield* NodeStream.fromReadable({ evaluate: () => input }).pipe(\n\t\t\tStream.decodeText(),\n\t\t\tStream.splitLines,\n\t\t\tStream.mapEffect((line) => Schema.decodeEffect(CommandJson)(line)),\n\t\t\tStream.runForEach(\n\t\t\t\tEffect.fnUntraced(function* (command: typeof CommandJson.Type) {\n\t\t\t\t\tif (command.kind === \"start\") return yield* notify(\"start\")\n\t\t\t\t\tif (command.kind === \"stop\") {\n\t\t\t\t\t\tyield* Ref.update(lease, (state) => ({ ...state, stopped: true }))\n\t\t\t\t\t\treturn yield* notify(\"stop\")\n\t\t\t\t\t}\n\t\t\t\t\tconst current = yield* Ref.get(lease)\n\t\t\t\t\tconst time = yield* now\n\t\t\t\t\tif (current.stopped || time >= current.deadline) return yield* die\n\t\t\t\t\tconst deadline = time + command.millis\n\t\t\t\t\tyield* Ref.set(lease, { deadline, stopped: false })\n\t\t\t\t\tyield* FiberHandle.run(timer, expire(deadline))\n\t\t\t\t}),\n\t\t\t),\n\t\t)\n\t\treturn yield* die\n\t}),\n).pipe(\n\tEffect.catchCause((cause) =>\n\t\tEffect.logError(\"Watchdog failed\", cause).pipe(Effect.andThen(die)),\n\t),\n)\n\nNodeRuntime.runMain(main)\n"],"mappings":";;;;;;;;AAUA,MAAM,MAAM,OAAO,WAAW,QAAQ,KAAK,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KACnE,OAAO,QAAQ,OAAO,KAAK,CAC5B;AACA,MAAM,UAAU,WACf,OAAO,aAAa,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KACnC,OAAO,SAAS,YACf,OAAO,WAAW,YAAY,YAAY,OAAO,CAAC,CACnD,CACD;AAED,MAAM,MAAM,MAAM,mBAAmB,KACpC,OAAO,KAAK,UAAU,OAAO,KAAK,IAAI,GAAS,CAChD;AACA,MAAM,SAAS,OAAO,WAAW,WAChC,UAC0B;CAC1B,MAAM,YAAY,YAAY,OAAO;CACrC,IAAI,aAAa,GAAG,OAAO,OAAO;CAElC,OAAO,OAAO,MAAM,SAAS;CAC7B,OAAO,OAAO,OAAO,QAAQ;AAC9B,CAAC;AACD,MAAM,OAAO,OAAO,OACnB,OAAO,IAAI,aAAa;CACvB,MAAM,QAAQ,OAAO,IAAI,KAAK;EAC7B,WAAW,OAAO,OAAO;EACzB,SAAS;CACV,CAAC;CACD,MAAM,QAAQ,OAAO,YAAY,KAAmB;CACpD,OAAO,YAAY,IAAI,OAAO,QAAQ,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,QAAQ,CAAC;CACtE,MAAM,QAAQ,OAAO,OAAO,eAC3B,OAAO,WAAW,IAAI,OAAO;EAAE,IAAI;EAAG,UAAU;EAAM,UAAU;CAAM,CAAC,CAAC,IACvE,WACA,OAAO,WAAW;EACjB,OAAO,QAAQ;CAChB,CAAC,CACH;CACA,OAAO,OAAO,OAAO;CACrB,OAAO,WAAW,aAAa,EAAE,gBAAgB,MAAM,CAAC,CAAC,CAAC,KACzD,OAAO,WAAW,GAClB,OAAO,YACP,OAAO,WAAW,SAAS,OAAO,aAAa,WAAW,CAAC,CAAC,IAAI,CAAC,GACjE,OAAO,WACN,OAAO,WAAW,WAAW,SAAkC;EAC9D,IAAI,QAAQ,SAAS,SAAS,OAAO,OAAO,OAAO,OAAO;EAC1D,IAAI,QAAQ,SAAS,QAAQ;GAC5B,OAAO,IAAI,OAAO,QAAQ,WAAW;IAAE,GAAG;IAAO,SAAS;GAAK,EAAE;GACjE,OAAO,OAAO,OAAO,MAAM;EAC5B;EACA,MAAM,UAAU,OAAO,IAAI,IAAI,KAAK;EACpC,MAAM,OAAO,OAAO;EACpB,IAAI,QAAQ,WAAW,QAAQ,QAAQ,UAAU,OAAO,OAAO;EAC/D,MAAM,WAAW,OAAO,QAAQ;EAChC,OAAO,IAAI,IAAI,OAAO;GAAE;GAAU,SAAS;EAAM,CAAC;EAClD,OAAO,YAAY,IAAI,OAAO,OAAO,QAAQ,CAAC;CAC/C,CAAC,CACF,CACD;CACA,OAAO,OAAO;AACf,CAAC,CACF,CAAC,CAAC,KACD,OAAO,YAAY,UAClB,OAAO,SAAS,mBAAmB,KAAK,CAAC,CAAC,KAAK,OAAO,QAAQ,GAAG,CAAC,CACnE,CACD;AAEA,YAAY,QAAQ,IAAI"}

package/dist/internal/websocketServer.js

@@ -6,7 +6,9 @@ import { NodeHttpServer, NodeHttpServerRequest } from "@effect/platform-node";
 import { HttpServerRequest, HttpServerResponse } from "effect/http";
 import { TLSSocket } from "node:tls";
 // src/internal/websocketServer.ts
-const rejection = (error) => Effect.logWarning("Remote host authentication failed", { reason: error.reason }, ...error.cause === void 0 ? [] : [error.cause]).pipe(Effect.as(HttpServerResponse.empty({
+const rejection = (error) => error._tag === "AuthenticatorUnavailable" ? unavailable(error) : unauthorized(error);
+const unavailable = (error) => Effect.logError("Remote host authenticator is unavailable", error.cause).pipe(Effect.as(HttpServerResponse.empty({ status: 503 })));
+const unauthorized = (error) => Effect.logWarning("Remote host authentication failed", { reason: error.reason }, ...error.cause === void 0 ? [] : [error.cause]).pipe(Effect.as(HttpServerResponse.empty({
 	status: 401,
 	headers: error.challenge === void 0 ? {} : { "www-authenticate": error.challenge }
 })));

package/dist/internal/websocketServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"websocketServer.js","names":["Channel.fromSocket"],"sources":["../../src/internal/websocketServer.ts"],"sourcesContent":["import { NodeHttpServer, NodeHttpServerRequest } from \"@effect/platform-node\"\nimport {\n\tArray,\n\tCause,\n\tDeferred,\n\tEffect,\n\tOption,\n\tRedacted,\n\tScope,\n\tString,\n} from \"effect\"\nimport { HttpServerRequest, HttpServerResponse } from \"effect/http\"\nimport type { Socket } from \"effect/socket\"\nimport { TLSSocket } from \"node:tls\"\nimport { AuthenticationFailed, TransportError } from \"../Errors\"\nimport type { Accept, Handshake, Serving } from \"../Transport\"\nimport * as Channel from \"./socketChannel\"\nimport { path, protocol, payloadLimit } from \"./websocket\"\n\nconst rejection = (error: AuthenticationFailed) =>\n\tEffect.logWarning(\n\t\t\"Remote host authentication failed\",\n\t\t{\n\t\t\treason: error.reason,\n\t\t},\n\t\t...(error.cause === undefined ? [] : [error.cause]),\n\t).pipe(\n\t\tEffect.as(\n\t\t\tHttpServerResponse.empty({\n\t\t\t\tstatus: 401,\n\t\t\t\theaders:\n\t\t\t\t\terror.challenge === undefined\n\t\t\t\t\t\t? {}\n\t\t\t\t\t\t: { \"www-authenticate\": error.challenge },\n\t\t\t}),\n\t\t),\n\t)\n\nconst handshake: Effect.Effect<\n\tHandshake,\n\tnever,\n\tHttpServerRequest.HttpServerRequest\n> = Effect.gen(function* () {\n\tconst request = yield* HttpServerRequest.HttpServerRequest\n\tconst { socket } = NodeHttpServerRequest.toIncomingMessage(request)\n\t// Only a TLS-verified peer is certificate evidence; forwarded headers are not.\n\tconst peer =\n\t\tsocket instanceof TLSSocket && socket.authorized\n\t\t\t? Option.some(socket.getPeerCertificate())\n\t\t\t: Option.none()\n\treturn {\n\t\tauthorization: Option.map(\n\t\t\tOption.fromUndefinedOr(request.headers[\"authorization\"]),\n\t\t\tRedacted.make,\n\t\t),\n\t\tcertificate: Option.map(peer, (certificate) => ({\n\t\t\tder: certificate.raw,\n\t\t\tsubjectAltName: Option.fromUndefinedOr(certificate.subjectaltname),\n\t\t})),\n\t}\n})\n\nconst open = Effect.fnUntraced(function* (\n\tcreateServer: Parameters<typeof NodeHttpServer.make>[0],\n\toptions: Pick<NodeHttpServer.Options, \"host\" | \"port\" | \"path\">,\n) {\n\t// The lazily created ws server belongs here, so serving scopes close before ws.close waits.\n\tconst resources = yield* Effect.acquireRelease(Scope.make(), Scope.close)\n\tconst ready = yield* Deferred.make<void>()\n\tconst server = yield* NodeHttpServer.make(createServer, {\n\t\t...options,\n\t\tdisablePreemptiveShutdown: true,\n\t\twebsocket: {\n\t\t\tperMessageDeflate: false,\n\t\t\tmaxPayload: payloadLimit,\n\t\t\thandleProtocols: (protocols) =>\n\t\t\t\tprotocols.has(protocol) ? protocol : false,\n\t\t},\n\t}).pipe(Scope.provide(resources))\n\treturn {\n\t\taddress: server.address,\n\t\tready: Deferred.await(ready),\n\t\trun: <A, E, R>(\n\t\t\taccept: Effect.Effect<\n\t\t\t\t(socket: Socket.Socket) => Effect.Effect<A, E, R>,\n\t\t\t\tAuthenticationFailed,\n\t\t\t\tHttpServerRequest.HttpServerRequest\n\t\t\t>,\n\t\t) =>\n\t\t\tserver\n\t\t\t\t.serve(\n\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\tconst request = yield* HttpServerRequest.HttpServerRequest\n\t\t\t\t\t\tif (request.url !== path)\n\t\t\t\t\t\t\treturn HttpServerResponse.empty({ status: 404 })\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\tString.toLowerCase(request.headers[\"upgrade\"] ?? \"\") !==\n\t\t\t\t\t\t\t\t\"websocket\" ||\n\t\t\t\t\t\t\t!Array.some(\n\t\t\t\t\t\t\t\tString.split(\n\t\t\t\t\t\t\t\t\trequest.headers[\"sec-websocket-protocol\"] ?? \"\",\n\t\t\t\t\t\t\t\t\t\",\",\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t(value) => String.trim(value) === protocol,\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t)\n\t\t\t\t\t\t\treturn HttpServerResponse.empty({ status: 400 })\n\t\t\t\t\t\tconst session = yield* Effect.result(accept)\n\t\t\t\t\t\tif (session._tag === \"Failure\")\n\t\t\t\t\t\t\treturn yield* rejection(session.failure)\n\t\t\t\t\t\t// Authentication finishes before upgrade; session work is owned by the request scope.\n\t\t\t\t\t\tyield* request.upgrade.pipe(\n\t\t\t\t\t\t\tEffect.flatMap(session.success),\n\t\t\t\t\t\t\tEffect.interruptible,\n\t\t\t\t\t\t\tEffect.scoped,\n\t\t\t\t\t\t)\n\t\t\t\t\t\treturn HttpServerResponse.empty()\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.andThen(Deferred.succeed(ready, undefined)),\n\t\t\t\t\tEffect.andThen(Effect.never),\n\t\t\t\t),\n\t}\n})\n\nexport const bind = Effect.fnUntraced(function* (\n\tcreateServer: Parameters<typeof NodeHttpServer.make>[0],\n\toptions: Pick<NodeHttpServer.Options, \"host\" | \"port\" | \"path\">,\n) {\n\tconst server = yield* open(createServer, options)\n\treturn {\n\t\taddress: server.address,\n\t\tready: server.ready,\n\t\tserve: (accept: Accept) =>\n\t\t\tserver\n\t\t\t\t.run(\n\t\t\t\t\thandshake.pipe(\n\t\t\t\t\t\tEffect.flatMap(accept),\n\t\t\t\t\t\tEffect.map(\n\t\t\t\t\t\t\t(session) => (socket: Socket.Socket) =>\n\t\t\t\t\t\t\t\tChannel.fromSocket(socket).pipe(Effect.flatMap(session)),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\t\tTransportError.make({ cause: Cause.fail(error) }),\n\t\t\t\t\t),\n\t\t\t\t),\n\t} satisfies Serving & { readonly address: typeof server.address }\n})\n"],"mappings":";;;;;;;;AAmBA,MAAM,aAAa,UAClB,OAAO,WACN,qCACA,EACC,QAAQ,MAAM,OACf,GACA,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAClD,CAAC,CAAC,KACD,OAAO,GACN,mBAAmB,MAAM;CACxB,QAAQ;CACR,SACC,MAAM,cAAc,KAAA,IACjB,CAAC,IACD,EAAE,oBAAoB,MAAM,UAAU;AAC3C,CAAC,CACF,CACD;AAED,MAAM,YAIF,OAAO,IAAI,aAAa;CAC3B,MAAM,UAAU,OAAO,kBAAkB;CACzC,MAAM,EAAE,WAAW,sBAAsB,kBAAkB,OAAO;CAElE,MAAM,OACL,kBAAkB,aAAa,OAAO,aACnC,OAAO,KAAK,OAAO,mBAAmB,CAAC,IACvC,OAAO,KAAK;CAChB,OAAO;EACN,eAAe,OAAO,IACrB,OAAO,gBAAgB,QAAQ,QAAQ,gBAAgB,GACvD,SAAS,IACV;EACA,aAAa,OAAO,IAAI,OAAO,iBAAiB;GAC/C,KAAK,YAAY;GACjB,gBAAgB,OAAO,gBAAgB,YAAY,cAAc;EAClE,EAAE;CACH;AACD,CAAC;AAED,MAAM,OAAO,OAAO,WAAW,WAC9B,cACA,SACC;CAED,MAAM,YAAY,OAAO,OAAO,eAAe,MAAM,KAAK,GAAG,MAAM,KAAK;CACxE,MAAM,QAAQ,OAAO,SAAS,KAAW;CACzC,MAAM,SAAS,OAAO,eAAe,KAAK,cAAc;EACvD,GAAG;EACH,2BAA2B;EAC3B,WAAW;GACV,mBAAmB;GACnB,YAAY;GACZ,kBAAkB,cACjB,UAAU,IAAA,iBAAY,IAAI,WAAW;EACvC;CACD,CAAC,CAAC,CAAC,KAAK,MAAM,QAAQ,SAAS,CAAC;CAChC,OAAO;EACN,SAAS,OAAO;EAChB,OAAO,SAAS,MAAM,KAAK;EAC3B,MACC,WAMA,OACE,MACA,OAAO,IAAI,aAAa;GACvB,MAAM,UAAU,OAAO,kBAAkB;GACzC,IAAI,QAAQ,QAAA,UACX,OAAO,mBAAmB,MAAM,EAAE,QAAQ,IAAI,CAAC;GAChD,IACC,OAAO,YAAY,QAAQ,QAAQ,cAAc,EAAE,MAClD,eACD,CAAC,MAAM,KACN,OAAO,MACN,QAAQ,QAAQ,6BAA6B,IAC7C,GACD,IACC,UAAU,OAAO,KAAK,KAAK,MAAA,iBAC7B,GAEA,OAAO,mBAAmB,MAAM,EAAE,QAAQ,IAAI,CAAC;GAChD,MAAM,UAAU,OAAO,OAAO,OAAO,MAAM;GAC3C,IAAI,QAAQ,SAAS,WACpB,OAAO,OAAO,UAAU,QAAQ,OAAO;GAExC,OAAO,QAAQ,QAAQ,KACtB,OAAO,QAAQ,QAAQ,OAAO,GAC9B,OAAO,eACP,OAAO,MACR;GACA,OAAO,mBAAmB,MAAM;EACjC,CAAC,CACF,CAAC,CACA,KACA,OAAO,QAAQ,SAAS,QAAQ,OAAO,KAAA,CAAS,CAAC,GACjD,OAAO,QAAQ,OAAO,KAAK,CAC5B;CACH;AACD,CAAC;AAED,MAAa,OAAO,OAAO,WAAW,WACrC,cACA,SACC;CACD,MAAM,SAAS,OAAO,KAAK,cAAc,OAAO;CAChD,OAAO;EACN,SAAS,OAAO;EAChB,OAAO,OAAO;EACd,QAAQ,WACP,OACE,IACA,UAAU,KACT,OAAO,QAAQ,MAAM,GACrB,OAAO,KACL,aAAa,WACbA,WAAmB,MAAM,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,CAAC,CACzD,CACD,CACD,CAAC,CACA,KACA,OAAO,UAAU,UAChB,eAAe,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,EAAE,CAAC,CACjD,CACD;CACH;AACD,CAAC"}
+{"version":3,"file":"websocketServer.js","names":["Channel.fromSocket"],"sources":["../../src/internal/websocketServer.ts"],"sourcesContent":["import { NodeHttpServer, NodeHttpServerRequest } from \"@effect/platform-node\"\nimport {\n\tArray,\n\tCause,\n\tDeferred,\n\tEffect,\n\tOption,\n\tRedacted,\n\tScope,\n\tString,\n} from \"effect\"\nimport { HttpServerRequest, HttpServerResponse } from \"effect/http\"\nimport type { Socket } from \"effect/socket\"\nimport { TLSSocket } from \"node:tls\"\nimport {\n\ttype AuthenticationFailed,\n\ttype AuthenticatorUnavailable,\n\tTransportError,\n} from \"../Errors\"\nimport type { Accept, Handshake, Serving } from \"../Transport\"\nimport * as Channel from \"./socketChannel\"\nimport { path, protocol, payloadLimit } from \"./websocket\"\n\nconst rejection = (error: AuthenticationFailed | AuthenticatorUnavailable) =>\n\terror._tag === \"AuthenticatorUnavailable\"\n\t\t? unavailable(error)\n\t\t: unauthorized(error)\n\n// The credential was not judged, so the client is told to retry rather than to replace it.\nconst unavailable = (error: AuthenticatorUnavailable) =>\n\tEffect.logError(\"Remote host authenticator is unavailable\", error.cause).pipe(\n\t\tEffect.as(HttpServerResponse.empty({ status: 503 })),\n\t)\n\nconst unauthorized = (error: AuthenticationFailed) =>\n\tEffect.logWarning(\n\t\t\"Remote host authentication failed\",\n\t\t{\n\t\t\treason: error.reason,\n\t\t},\n\t\t...(error.cause === undefined ? [] : [error.cause]),\n\t).pipe(\n\t\tEffect.as(\n\t\t\tHttpServerResponse.empty({\n\t\t\t\tstatus: 401,\n\t\t\t\theaders:\n\t\t\t\t\terror.challenge === undefined\n\t\t\t\t\t\t? {}\n\t\t\t\t\t\t: { \"www-authenticate\": error.challenge },\n\t\t\t}),\n\t\t),\n\t)\n\nconst handshake: Effect.Effect<\n\tHandshake,\n\tnever,\n\tHttpServerRequest.HttpServerRequest\n> = Effect.gen(function* () {\n\tconst request = yield* HttpServerRequest.HttpServerRequest\n\tconst { socket } = NodeHttpServerRequest.toIncomingMessage(request)\n\t// Only a TLS-verified peer is certificate evidence; forwarded headers are not.\n\tconst peer =\n\t\tsocket instanceof TLSSocket && socket.authorized\n\t\t\t? Option.some(socket.getPeerCertificate())\n\t\t\t: Option.none()\n\treturn {\n\t\tauthorization: Option.map(\n\t\t\tOption.fromUndefinedOr(request.headers[\"authorization\"]),\n\t\t\tRedacted.make,\n\t\t),\n\t\tcertificate: Option.map(peer, (certificate) => ({\n\t\t\tder: certificate.raw,\n\t\t\tsubjectAltName: Option.fromUndefinedOr(certificate.subjectaltname),\n\t\t})),\n\t}\n})\n\nconst open = Effect.fnUntraced(function* (\n\tcreateServer: Parameters<typeof NodeHttpServer.make>[0],\n\toptions: Pick<NodeHttpServer.Options, \"host\" | \"port\" | \"path\">,\n) {\n\t// The lazily created ws server belongs here, so serving scopes close before ws.close waits.\n\tconst resources = yield* Effect.acquireRelease(Scope.make(), Scope.close)\n\tconst ready = yield* Deferred.make<void>()\n\tconst server = yield* NodeHttpServer.make(createServer, {\n\t\t...options,\n\t\tdisablePreemptiveShutdown: true,\n\t\twebsocket: {\n\t\t\tperMessageDeflate: false,\n\t\t\tmaxPayload: payloadLimit,\n\t\t\thandleProtocols: (protocols) =>\n\t\t\t\tprotocols.has(protocol) ? protocol : false,\n\t\t},\n\t}).pipe(Scope.provide(resources))\n\treturn {\n\t\taddress: server.address,\n\t\tready: Deferred.await(ready),\n\t\trun: <A, E, R>(\n\t\t\taccept: Effect.Effect<\n\t\t\t\t(socket: Socket.Socket) => Effect.Effect<A, E, R>,\n\t\t\t\tAuthenticationFailed | AuthenticatorUnavailable,\n\t\t\t\tHttpServerRequest.HttpServerRequest\n\t\t\t>,\n\t\t) =>\n\t\t\tserver\n\t\t\t\t.serve(\n\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\tconst request = yield* HttpServerRequest.HttpServerRequest\n\t\t\t\t\t\tif (request.url !== path)\n\t\t\t\t\t\t\treturn HttpServerResponse.empty({ status: 404 })\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\tString.toLowerCase(request.headers[\"upgrade\"] ?? \"\") !==\n\t\t\t\t\t\t\t\t\"websocket\" ||\n\t\t\t\t\t\t\t!Array.some(\n\t\t\t\t\t\t\t\tString.split(\n\t\t\t\t\t\t\t\t\trequest.headers[\"sec-websocket-protocol\"] ?? \"\",\n\t\t\t\t\t\t\t\t\t\",\",\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t(value) => String.trim(value) === protocol,\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t)\n\t\t\t\t\t\t\treturn HttpServerResponse.empty({ status: 400 })\n\t\t\t\t\t\tconst session = yield* Effect.result(accept)\n\t\t\t\t\t\tif (session._tag === \"Failure\")\n\t\t\t\t\t\t\treturn yield* rejection(session.failure)\n\t\t\t\t\t\t// Authentication finishes before upgrade; session work is owned by the request scope.\n\t\t\t\t\t\tyield* request.upgrade.pipe(\n\t\t\t\t\t\t\tEffect.flatMap(session.success),\n\t\t\t\t\t\t\tEffect.interruptible,\n\t\t\t\t\t\t\tEffect.scoped,\n\t\t\t\t\t\t)\n\t\t\t\t\t\treturn HttpServerResponse.empty()\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.andThen(Deferred.succeed(ready, undefined)),\n\t\t\t\t\tEffect.andThen(Effect.never),\n\t\t\t\t),\n\t}\n})\n\nexport const bind = Effect.fnUntraced(function* (\n\tcreateServer: Parameters<typeof NodeHttpServer.make>[0],\n\toptions: Pick<NodeHttpServer.Options, \"host\" | \"port\" | \"path\">,\n) {\n\tconst server = yield* open(createServer, options)\n\treturn {\n\t\taddress: server.address,\n\t\tready: server.ready,\n\t\tserve: (accept: Accept) =>\n\t\t\tserver\n\t\t\t\t.run(\n\t\t\t\t\thandshake.pipe(\n\t\t\t\t\t\tEffect.flatMap(accept),\n\t\t\t\t\t\tEffect.map(\n\t\t\t\t\t\t\t(session) => (socket: Socket.Socket) =>\n\t\t\t\t\t\t\t\tChannel.fromSocket(socket).pipe(Effect.flatMap(session)),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\t\tTransportError.make({ cause: Cause.fail(error) }),\n\t\t\t\t\t),\n\t\t\t\t),\n\t} satisfies Serving & { readonly address: typeof server.address }\n})\n"],"mappings":";;;;;;;;AAuBA,MAAM,aAAa,UAClB,MAAM,SAAS,6BACZ,YAAY,KAAK,IACjB,aAAa,KAAK;AAGtB,MAAM,eAAe,UACpB,OAAO,SAAS,4CAA4C,MAAM,KAAK,CAAC,CAAC,KACxE,OAAO,GAAG,mBAAmB,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,CACpD;AAED,MAAM,gBAAgB,UACrB,OAAO,WACN,qCACA,EACC,QAAQ,MAAM,OACf,GACA,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAClD,CAAC,CAAC,KACD,OAAO,GACN,mBAAmB,MAAM;CACxB,QAAQ;CACR,SACC,MAAM,cAAc,KAAA,IACjB,CAAC,IACD,EAAE,oBAAoB,MAAM,UAAU;AAC3C,CAAC,CACF,CACD;AAED,MAAM,YAIF,OAAO,IAAI,aAAa;CAC3B,MAAM,UAAU,OAAO,kBAAkB;CACzC,MAAM,EAAE,WAAW,sBAAsB,kBAAkB,OAAO;CAElE,MAAM,OACL,kBAAkB,aAAa,OAAO,aACnC,OAAO,KAAK,OAAO,mBAAmB,CAAC,IACvC,OAAO,KAAK;CAChB,OAAO;EACN,eAAe,OAAO,IACrB,OAAO,gBAAgB,QAAQ,QAAQ,gBAAgB,GACvD,SAAS,IACV;EACA,aAAa,OAAO,IAAI,OAAO,iBAAiB;GAC/C,KAAK,YAAY;GACjB,gBAAgB,OAAO,gBAAgB,YAAY,cAAc;EAClE,EAAE;CACH;AACD,CAAC;AAED,MAAM,OAAO,OAAO,WAAW,WAC9B,cACA,SACC;CAED,MAAM,YAAY,OAAO,OAAO,eAAe,MAAM,KAAK,GAAG,MAAM,KAAK;CACxE,MAAM,QAAQ,OAAO,SAAS,KAAW;CACzC,MAAM,SAAS,OAAO,eAAe,KAAK,cAAc;EACvD,GAAG;EACH,2BAA2B;EAC3B,WAAW;GACV,mBAAmB;GACnB,YAAY;GACZ,kBAAkB,cACjB,UAAU,IAAA,iBAAY,IAAI,WAAW;EACvC;CACD,CAAC,CAAC,CAAC,KAAK,MAAM,QAAQ,SAAS,CAAC;CAChC,OAAO;EACN,SAAS,OAAO;EAChB,OAAO,SAAS,MAAM,KAAK;EAC3B,MACC,WAMA,OACE,MACA,OAAO,IAAI,aAAa;GACvB,MAAM,UAAU,OAAO,kBAAkB;GACzC,IAAI,QAAQ,QAAA,UACX,OAAO,mBAAmB,MAAM,EAAE,QAAQ,IAAI,CAAC;GAChD,IACC,OAAO,YAAY,QAAQ,QAAQ,cAAc,EAAE,MAClD,eACD,CAAC,MAAM,KACN,OAAO,MACN,QAAQ,QAAQ,6BAA6B,IAC7C,GACD,IACC,UAAU,OAAO,KAAK,KAAK,MAAA,iBAC7B,GAEA,OAAO,mBAAmB,MAAM,EAAE,QAAQ,IAAI,CAAC;GAChD,MAAM,UAAU,OAAO,OAAO,OAAO,MAAM;GAC3C,IAAI,QAAQ,SAAS,WACpB,OAAO,OAAO,UAAU,QAAQ,OAAO;GAExC,OAAO,QAAQ,QAAQ,KACtB,OAAO,QAAQ,QAAQ,OAAO,GAC9B,OAAO,eACP,OAAO,MACR;GACA,OAAO,mBAAmB,MAAM;EACjC,CAAC,CACF,CAAC,CACA,KACA,OAAO,QAAQ,SAAS,QAAQ,OAAO,KAAA,CAAS,CAAC,GACjD,OAAO,QAAQ,OAAO,KAAK,CAC5B;CACH;AACD,CAAC;AAED,MAAa,OAAO,OAAO,WAAW,WACrC,cACA,SACC;CACD,MAAM,SAAS,OAAO,KAAK,cAAc,OAAO;CAChD,OAAO;EACN,SAAS,OAAO;EAChB,OAAO,OAAO;EACd,QAAQ,WACP,OACE,IACA,UAAU,KACT,OAAO,QAAQ,MAAM,GACrB,OAAO,KACL,aAAa,WACbA,WAAmB,MAAM,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,CAAC,CACzD,CACD,CACD,CAAC,CACA,KACA,OAAO,UAAU,UAChB,eAAe,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,EAAE,CAAC,CACjD,CACD;CACH;AACD,CAAC"}

package/dist/internal/workerMain.js

@@ -1,6 +1,6 @@
-import { r as layer } from "../Graft-CVyueNOf.js";
-import { n as run, r as platform, t as load } from "../childRuntime-An0HsIzl.js";
-import { n as Bootstrap, t as make } from "../workerChannel-cmLc13vm.js";
+import { r as layer } from "../Graft-B71CPA2Y.js";
+import { n as run, r as platform, t as load } from "../childRuntime-Bm3iSg_N.js";
+import { n as Bootstrap, t as make } from "../workerChannel-C8hhBJzA.js";
 import { Effect, Layer, Schema } from "effect";
 import { NodeRuntime } from "@effect/platform-node";
 import { parentPort, workerData } from "node:worker_threads";

package/dist/{port-DSVUY8Bq.js → port--3x2zJ4D.js}

@@ -1,6 +1,6 @@
-import { t as EndOfStream } from "./Framing-zaYdOJnT.js";
-import { t as make$1 } from "./FailureGroup-BcH0XOBi.js";
-import { l as TransportError } from "./Errors-BMKmu5Y7.js";
+import { t as EndOfStream } from "./Framing-G9eSaeLb.js";
+import { t as make$1 } from "./FailureGroup-BgT73AaR.js";
+import { u as TransportError } from "./Errors-DYhsGZcZ.js";
 import { Array, Cause, Context, Data, Deferred, Effect, Fiber, HashMap, Option, Queue, Record, Result, Schema, Stream, TxQueue, TxRef } from "effect";
 import { RpcClient, RpcClientError, RpcSerialization, RpcServer } from "effect/rpc";
 // packages/remote/src/internal/Limits.ts
@@ -64,7 +64,7 @@ const mailbox = (priority) => Queue.dropping(2).pipe(Effect.map((queue) => ({
 const deliver = Effect.fnUntraced(function* (requestState, message) {
 	if (!(yield* Queue.offer(requestState.queue, message))) return yield* error("RPC request mailbox overflow");
 });
-const initialize = (bytes, options) => Effect.gen(function* () {
+const initialize = Effect.fnUntraced(function* (bytes, options) {
 	return {
 		bytes,
 		options,
@@ -204,7 +204,7 @@ const serverProtocol = (state, endpoint) => {
 		})).pipe(Effect.catchTag("TransportError", () => Effect.void))
 	});
 };
-const next = (state) => Effect.tx(Effect.gen(function* () {
+const next = Effect.fnUntraced(function* (state) {
 	yield* state.workers.check;
 	for (const p of [
 		"control",
@@ -227,7 +227,7 @@ const next = (state) => Effect.tx(Effect.gen(function* () {
 	}
 	if ((yield* TxQueue.isDone(state.queues.control)) && (yield* TxQueue.isDone(state.queues.data)) && (yield* TxQueue.isDone(state.queues.log))) return yield* Cause.done();
 	return yield* Effect.txRetry;
-}));
+}, Effect.tx);
 const writer = (state) => Stream.fromEffectRepeat(next(state)).pipe(Stream.filterMap(Result.fromOption(() => void 0)), Stream.mapEffect((frame) => Schema.encodeEffect(Schema.fromJsonString(Frame))(frame).pipe(Effect.mapError((cause) => TransportError.make({ cause: Cause.fail(cause) })))), Stream.map((json) => new TextEncoder().encode(json + "\n")), Stream.run(state.bytes.output));
 const read = Effect.fnUntraced(function* (state, raw) {
 	const current = yield* Schema.decodeUnknownEffect(Frame)(raw).pipe(Effect.mapError((cause) => TransportError.make({ cause: Cause.fail(cause) })));
@@ -268,10 +268,10 @@ const reader = (state) => state.bytes.input.pipe(Stream.decodeText(), Stream.spl
 /** One RPC client/server per declared endpoint; servers may start after the port. */
 const make = Effect.fnUntraced(function* (bytes, options) {
 	const state = yield* initialize(bytes, options);
-	yield* state.workers.await.pipe(Effect.catchCause(() => Effect.uninterruptible(Effect.gen(function* () {
+	yield* state.workers.await.pipe(Effect.catchCause(Effect.fnUntraced(function* () {
 		for (const server of HashMap.values(state.servers)) yield* Queue.offer(server.disconnects, 0);
 		yield* Effect.tx(TxRef.set(state.incoming, HashMap.empty()).pipe(Effect.andThen(TxRef.set(state.outgoing, HashMap.empty()))));
-	}))), Effect.forkScoped);
+	}, Effect.uninterruptible)), Effect.forkScoped);
 	const writing = yield* state.workers.run(writer(state));
 	yield* state.workers.run(reader(state));
 	return {

package/dist/{release-BY4Mlluy.js → release-DfZPuIcK.js}

@@ -7,7 +7,7 @@ var ReleaseInterrupted = class extends Schema.TaggedError()("ReleaseInterrupted"
 	}
 };
 /** Keep a known release failure distinguishable from cancellation through enclosing scopes. */
-const close = (scope, exit) => Effect.uninterruptible(Scope.close(scope, exit).pipe(Effect.catchCauseIf(Cause.hasInterruptsOnly, (cause) => Effect.gen(function* () {
+const close = (scope, exit) => Effect.uninterruptible(Scope.close(scope, exit).pipe(Effect.catchCauseIf(Cause.hasInterruptsOnly, Effect.fnUntraced(function* (cause) {
 	const pending = yield* Effect.exit(Effect.interruptible(Effect.void));
 	const [cancelled, interrupted] = Array.partition(cause.reasons, (reason) => Exit.isFailure(pending) && Array.some(pending.cause.reasons, (external) => reason._tag === "Interrupt" && external._tag === "Interrupt" && reason.fiberId === external.fiberId) ? Result.succeed(reason) : Result.fail(reason));
 	if (interrupted.length === 0) return yield* Effect.failCause(cause);

package/dist/runner/auth/bearer.js

@@ -1,7 +1,7 @@
-import { a as provide, l as make } from "../../Graft-CVyueNOf.js";
+import { a as provide, l as make } from "../../Graft-B71CPA2Y.js";
 import { t as Authenticator } from "../../Auth-BElTC9_X.js";
 import { t as ConfigDirectory } from "../../ConfigDirectory-BCC6q2R4.js";
-import { r as read, t as invalid } from "../../token-Cc_1CTbE.js";
+import { r as read, t as invalid } from "../../token-CYBNNlhS.js";
 import { Array, Effect, FileSystem, Option, Path, Record, Redacted, Schema } from "effect";
 import { Digest } from "effect/crypto";
 import { Hex } from "effect/encoding";

package/dist/runner/auth/jwt.js

@@ -1,8 +1,8 @@
-import { a as provide, l as make } from "../../Graft-CVyueNOf.js";
+import { a as provide, l as make } from "../../Graft-B71CPA2Y.js";
 import { t as Authenticator } from "../../Auth-BElTC9_X.js";
 import { t as ConfigDirectory } from "../../ConfigDirectory-BCC6q2R4.js";
-import { t as AuthenticationFailed } from "../../Errors-BMKmu5Y7.js";
-import { r as read } from "../../token-Cc_1CTbE.js";
+import { n as AuthenticatorUnavailable, t as AuthenticationFailed } from "../../Errors-DYhsGZcZ.js";
+import { r as read } from "../../token-CYBNNlhS.js";
 import { Cause, Duration, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
 import { Signature } from "effect/crypto";
 import { HttpClient } from "effect/http";
@@ -54,7 +54,7 @@ var jwt_default = make({
 				algorithms: config.algorithms,
 				clockTolerance: config.clockTolerance,
 				requiredClaims: ["exp"]
-			}).pipe(Effect.flatMap((verified) => Schema.decodeUnknownEffect(Schema.NonEmptyString)(verified.claims[config.identityClaim])), Effect.mapError((error) => AuthenticationFailed.make({
+			}).pipe(Effect.flatMap((verified) => Schema.decodeUnknownEffect(Schema.NonEmptyString)(verified.claims[config.identityClaim])), Effect.mapError((error) => error._tag === "JoseError" && error.reason._tag === "KeySetUnavailable" ? AuthenticatorUnavailable.make({ cause: Cause.fail(error) }) : AuthenticationFailed.make({
 				reason: "invalid",
 				challenge: "Bearer error=\"invalid_token\"",
 				cause: Cause.fail(error)

package/dist/runner/auth/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","names":["Token.read"],"sources":["../../../src/runner/auth/jwt.ts"],"sourcesContent":["import { Option } from \"effect\"\nimport { Graft, Plugin } from \"@graftland/graft\"\nimport {\n\tCause,\n\tDuration,\n\tEffect,\n\tFileSystem,\n\tLayer,\n\tPath,\n\tSchema,\n} from \"effect\"\nimport { Jwk, Jwks, Jwt } from \"effect/jose\"\nimport { Signature } from \"effect/crypto\"\nimport { HttpClient } from \"effect/http\"\nimport { Authenticator } from \"../../Auth\"\nimport { ConfigDirectory } from \"@graftland/loader\"\nimport { AuthenticationFailed } from \"../../Errors\"\nimport * as Token from \"../../internal/auth/token\"\n\nexport const ClockTolerance = Schema.DurationFromString.check(\n\tSchema.makeFilter(\n\t\t(duration) =>\n\t\t\tDuration.isFinite(duration) && Duration.toMillis(duration) >= 0,\n\t\t{ expected: \"a finite, non-negative duration\" },\n\t),\n)\nexport const Config = Schema.Struct({\n\tissuer: Schema.NonEmptyString,\n\taudience: Schema.NonEmptyArray(Schema.NonEmptyString),\n\talgorithms: Schema.NonEmptyArray(Jwk.AsymmetricAlgorithm),\n\tidentityClaim: Schema.NonEmptyString.pipe(\n\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"sub\")),\n\t),\n\tclockTolerance: ClockTolerance.pipe(\n\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"5 seconds\")),\n\t),\n\tkeys: Schema.Union([\n\t\tSchema.Struct({\n\t\t\tjwksUrl: Schema.String,\n\t\t\tpublicKey: Schema.optionalKey(Schema.Never),\n\t\t}),\n\t\tSchema.Struct({\n\t\t\tpublicKey: Schema.String,\n\t\t\tjwksUrl: Schema.optionalKey(Schema.Never),\n\t\t}),\n\t]),\n})\nconst keys = Effect.fnUntraced(function* (config: typeof Config.Type) {\n\tif (config.keys.jwksUrl !== undefined)\n\t\treturn Jwks.layerRemote({ url: config.keys.jwksUrl })\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst directory = yield* ConfigDirectory.pipe(\n\t\tEffect.map(Option.getOrElse(() => \".\")),\n\t)\n\tconst pem = yield* fs.readFileString(\n\t\tpath.resolve(directory, config.keys.publicKey),\n\t)\n\t// A single PEM must support the allowed algorithms; use JWKS for multiple key types.\n\tconst keys = yield* Effect.forEach(config.algorithms, (algorithm) =>\n\t\tJwk.importSpki(pem, algorithm).pipe(Effect.flatMap(Jwk.exportPublic)),\n\t)\n\treturn Jwks.layerLocal({ keys })\n})\nexport default Plugin.make({\n\tname: \"remote-jwt-authenticator\",\n\tconfig: Config,\n\tinject: [\n\t\tFileSystem.FileSystem,\n\t\tPath.Path,\n\t\tSignature.Signature,\n\t\tHttpClient.HttpClient,\n\t],\n\tapply: Effect.fnUntraced(function* (config) {\n\t\tconst keySet = yield* keys(config)\n\t\tconst services = yield* Layer.build(keySet)\n\t\tconst signature = yield* Signature.Signature\n\t\tyield* Graft.provide(Authenticator, {\n\t\t\t_tag: \"Header\",\n\t\t\tissuer: config.issuer,\n\t\t\tauthenticate: (authorization) =>\n\t\t\t\tToken.read(authorization).pipe(\n\t\t\t\t\tEffect.flatMap((token) =>\n\t\t\t\t\t\tJwt.verifyWithKeySet(\n\t\t\t\t\t\t\tSchema.Record(Schema.String, Schema.Unknown),\n\t\t\t\t\t\t\ttoken,\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tissuer: config.issuer,\n\t\t\t\t\t\t\t\taudience: config.audience,\n\t\t\t\t\t\t\t\talgorithms: config.algorithms,\n\t\t\t\t\t\t\t\tclockTolerance: config.clockTolerance,\n\t\t\t\t\t\t\t\trequiredClaims: [\"exp\"],\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t).pipe(\n\t\t\t\t\t\t\tEffect.flatMap((verified) =>\n\t\t\t\t\t\t\t\tSchema.decodeUnknownEffect(Schema.NonEmptyString)(\n\t\t\t\t\t\t\t\t\tverified.claims[config.identityClaim],\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\t\t\t\tAuthenticationFailed.make({\n\t\t\t\t\t\t\t\t\treason: \"invalid\",\n\t\t\t\t\t\t\t\t\tchallenge: 'Bearer error=\"invalid_token\"',\n\t\t\t\t\t\t\t\t\tcause: Cause.fail(error),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tEffect.provideService(Signature.Signature, signature),\n\t\t\t\t\t\t\tEffect.provideContext(services),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t})\n\t}),\n})\n"],"mappings":";;;;;;;;;;AAmBA,MAAa,iBAAiB,OAAO,mBAAmB,MACvD,OAAO,YACL,aACA,SAAS,SAAS,QAAQ,KAAK,SAAS,SAAS,QAAQ,KAAK,GAC/D,EAAE,UAAU,kCAAkC,CAC/C,CACD;AACA,MAAa,SAAS,OAAO,OAAO;CACnC,QAAQ,OAAO;CACf,UAAU,OAAO,cAAc,OAAO,cAAc;CACpD,YAAY,OAAO,cAAc,IAAI,mBAAmB;CACxD,eAAe,OAAO,eAAe,KACpC,OAAO,uBAAuB,OAAO,QAAQ,KAAK,CAAC,CACpD;CACA,gBAAgB,eAAe,KAC9B,OAAO,uBAAuB,OAAO,QAAQ,WAAW,CAAC,CAC1D;CACA,MAAM,OAAO,MAAM,CAClB,OAAO,OAAO;EACb,SAAS,OAAO;EAChB,WAAW,OAAO,YAAY,OAAO,KAAK;CAC3C,CAAC,GACD,OAAO,OAAO;EACb,WAAW,OAAO;EAClB,SAAS,OAAO,YAAY,OAAO,KAAK;CACzC,CAAC,CACF,CAAC;AACF,CAAC;AACD,MAAM,OAAO,OAAO,WAAW,WAAW,QAA4B;CACrE,IAAI,OAAO,KAAK,YAAY,KAAA,GAC3B,OAAO,KAAK,YAAY,EAAE,KAAK,OAAO,KAAK,QAAQ,CAAC;CACrD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,YAAY,OAAO,gBAAgB,KACxC,OAAO,IAAI,OAAO,gBAAgB,GAAG,CAAC,CACvC;CACA,MAAM,MAAM,OAAO,GAAG,eACrB,KAAK,QAAQ,WAAW,OAAO,KAAK,SAAS,CAC9C;CAEA,MAAM,OAAO,OAAO,OAAO,QAAQ,OAAO,aAAa,cACtD,IAAI,WAAW,KAAK,SAAS,CAAC,CAAC,KAAK,OAAO,QAAQ,IAAI,YAAY,CAAC,CACrE;CACA,OAAO,KAAK,WAAW,EAAE,KAAK,CAAC;AAChC,CAAC;AACD,IAAA,cAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQ;CACR,QAAQ;EACP,WAAW;EACX,KAAK;EACL,UAAU;EACV,WAAW;CACZ;CACA,OAAO,OAAO,WAAW,WAAW,QAAQ;EAC3C,MAAM,SAAS,OAAO,KAAK,MAAM;EACjC,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM;EAC1C,MAAM,YAAY,OAAO,UAAU;EACnC,OAAO,MAAM,QAAQ,eAAe;GACnC,MAAM;GACN,QAAQ,OAAO;GACf,eAAe,kBACdA,KAAW,aAAa,CAAC,CAAC,KACzB,OAAO,SAAS,UACf,IAAI,iBACH,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,GAC3C,OACA;IACC,QAAQ,OAAO;IACf,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,gBAAgB,OAAO;IACvB,gBAAgB,CAAC,KAAK;GACvB,CACD,CAAC,CAAC,KACD,OAAO,SAAS,aACf,OAAO,oBAAoB,OAAO,cAAc,CAAC,CAChD,SAAS,OAAO,OAAO,cACxB,CACD,GACA,OAAO,UAAU,UAChB,qBAAqB,KAAK;IACzB,QAAQ;IACR,WAAW;IACX,OAAO,MAAM,KAAK,KAAK;GACxB,CAAC,CACF,GACA,OAAO,eAAe,UAAU,WAAW,SAAS,GACpD,OAAO,eAAe,QAAQ,CAC/B,CACD,CACD;EACF,CAAC;CACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"jwt.js","names":["Token.read"],"sources":["../../../src/runner/auth/jwt.ts"],"sourcesContent":["import { Option } from \"effect\"\nimport { Graft, Plugin } from \"@graftland/graft\"\nimport {\n\tCause,\n\tDuration,\n\tEffect,\n\tFileSystem,\n\tLayer,\n\tPath,\n\tSchema,\n} from \"effect\"\nimport { Jwk, Jwks, Jwt } from \"effect/jose\"\nimport { Signature } from \"effect/crypto\"\nimport { HttpClient } from \"effect/http\"\nimport { Authenticator } from \"../../Auth\"\nimport { ConfigDirectory } from \"@graftland/loader\"\nimport { AuthenticationFailed, AuthenticatorUnavailable } from \"../../Errors\"\nimport * as Token from \"../../internal/auth/token\"\n\nexport const ClockTolerance = Schema.DurationFromString.check(\n\tSchema.makeFilter(\n\t\t(duration) =>\n\t\t\tDuration.isFinite(duration) && Duration.toMillis(duration) >= 0,\n\t\t{ expected: \"a finite, non-negative duration\" },\n\t),\n)\nexport const Config = Schema.Struct({\n\tissuer: Schema.NonEmptyString,\n\taudience: Schema.NonEmptyArray(Schema.NonEmptyString),\n\talgorithms: Schema.NonEmptyArray(Jwk.AsymmetricAlgorithm),\n\tidentityClaim: Schema.NonEmptyString.pipe(\n\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"sub\")),\n\t),\n\tclockTolerance: ClockTolerance.pipe(\n\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"5 seconds\")),\n\t),\n\tkeys: Schema.Union([\n\t\tSchema.Struct({\n\t\t\tjwksUrl: Schema.String,\n\t\t\tpublicKey: Schema.optionalKey(Schema.Never),\n\t\t}),\n\t\tSchema.Struct({\n\t\t\tpublicKey: Schema.String,\n\t\t\tjwksUrl: Schema.optionalKey(Schema.Never),\n\t\t}),\n\t]),\n})\nconst keys = Effect.fnUntraced(function* (config: typeof Config.Type) {\n\tif (config.keys.jwksUrl !== undefined)\n\t\treturn Jwks.layerRemote({ url: config.keys.jwksUrl })\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst directory = yield* ConfigDirectory.pipe(\n\t\tEffect.map(Option.getOrElse(() => \".\")),\n\t)\n\tconst pem = yield* fs.readFileString(\n\t\tpath.resolve(directory, config.keys.publicKey),\n\t)\n\t// A single PEM must support the allowed algorithms; use JWKS for multiple key types.\n\tconst keys = yield* Effect.forEach(config.algorithms, (algorithm) =>\n\t\tJwk.importSpki(pem, algorithm).pipe(Effect.flatMap(Jwk.exportPublic)),\n\t)\n\treturn Jwks.layerLocal({ keys })\n})\nexport default Plugin.make({\n\tname: \"remote-jwt-authenticator\",\n\tconfig: Config,\n\tinject: [\n\t\tFileSystem.FileSystem,\n\t\tPath.Path,\n\t\tSignature.Signature,\n\t\tHttpClient.HttpClient,\n\t],\n\tapply: Effect.fnUntraced(function* (config) {\n\t\tconst keySet = yield* keys(config)\n\t\tconst services = yield* Layer.build(keySet)\n\t\tconst signature = yield* Signature.Signature\n\t\tyield* Graft.provide(Authenticator, {\n\t\t\t_tag: \"Header\",\n\t\t\tissuer: config.issuer,\n\t\t\tauthenticate: (authorization) =>\n\t\t\t\tToken.read(authorization).pipe(\n\t\t\t\t\tEffect.flatMap((token) =>\n\t\t\t\t\t\tJwt.verifyWithKeySet(\n\t\t\t\t\t\t\tSchema.Record(Schema.String, Schema.Unknown),\n\t\t\t\t\t\t\ttoken,\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tissuer: config.issuer,\n\t\t\t\t\t\t\t\taudience: config.audience,\n\t\t\t\t\t\t\t\talgorithms: config.algorithms,\n\t\t\t\t\t\t\t\tclockTolerance: config.clockTolerance,\n\t\t\t\t\t\t\t\trequiredClaims: [\"exp\"],\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t).pipe(\n\t\t\t\t\t\t\tEffect.flatMap((verified) =>\n\t\t\t\t\t\t\t\tSchema.decodeUnknownEffect(Schema.NonEmptyString)(\n\t\t\t\t\t\t\t\t\tverified.claims[config.identityClaim],\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t// An unreachable key set says nothing about the token; the client must not discard it.\n\t\t\t\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\t\t\t\terror._tag === \"JoseError\" &&\n\t\t\t\t\t\t\t\terror.reason._tag === \"KeySetUnavailable\"\n\t\t\t\t\t\t\t\t\t? AuthenticatorUnavailable.make({ cause: Cause.fail(error) })\n\t\t\t\t\t\t\t\t\t: AuthenticationFailed.make({\n\t\t\t\t\t\t\t\t\t\t\treason: \"invalid\",\n\t\t\t\t\t\t\t\t\t\t\tchallenge: 'Bearer error=\"invalid_token\"',\n\t\t\t\t\t\t\t\t\t\t\tcause: Cause.fail(error),\n\t\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tEffect.provideService(Signature.Signature, signature),\n\t\t\t\t\t\t\tEffect.provideContext(services),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t})\n\t}),\n})\n"],"mappings":";;;;;;;;;;AAmBA,MAAa,iBAAiB,OAAO,mBAAmB,MACvD,OAAO,YACL,aACA,SAAS,SAAS,QAAQ,KAAK,SAAS,SAAS,QAAQ,KAAK,GAC/D,EAAE,UAAU,kCAAkC,CAC/C,CACD;AACA,MAAa,SAAS,OAAO,OAAO;CACnC,QAAQ,OAAO;CACf,UAAU,OAAO,cAAc,OAAO,cAAc;CACpD,YAAY,OAAO,cAAc,IAAI,mBAAmB;CACxD,eAAe,OAAO,eAAe,KACpC,OAAO,uBAAuB,OAAO,QAAQ,KAAK,CAAC,CACpD;CACA,gBAAgB,eAAe,KAC9B,OAAO,uBAAuB,OAAO,QAAQ,WAAW,CAAC,CAC1D;CACA,MAAM,OAAO,MAAM,CAClB,OAAO,OAAO;EACb,SAAS,OAAO;EAChB,WAAW,OAAO,YAAY,OAAO,KAAK;CAC3C,CAAC,GACD,OAAO,OAAO;EACb,WAAW,OAAO;EAClB,SAAS,OAAO,YAAY,OAAO,KAAK;CACzC,CAAC,CACF,CAAC;AACF,CAAC;AACD,MAAM,OAAO,OAAO,WAAW,WAAW,QAA4B;CACrE,IAAI,OAAO,KAAK,YAAY,KAAA,GAC3B,OAAO,KAAK,YAAY,EAAE,KAAK,OAAO,KAAK,QAAQ,CAAC;CACrD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,YAAY,OAAO,gBAAgB,KACxC,OAAO,IAAI,OAAO,gBAAgB,GAAG,CAAC,CACvC;CACA,MAAM,MAAM,OAAO,GAAG,eACrB,KAAK,QAAQ,WAAW,OAAO,KAAK,SAAS,CAC9C;CAEA,MAAM,OAAO,OAAO,OAAO,QAAQ,OAAO,aAAa,cACtD,IAAI,WAAW,KAAK,SAAS,CAAC,CAAC,KAAK,OAAO,QAAQ,IAAI,YAAY,CAAC,CACrE;CACA,OAAO,KAAK,WAAW,EAAE,KAAK,CAAC;AAChC,CAAC;AACD,IAAA,cAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQ;CACR,QAAQ;EACP,WAAW;EACX,KAAK;EACL,UAAU;EACV,WAAW;CACZ;CACA,OAAO,OAAO,WAAW,WAAW,QAAQ;EAC3C,MAAM,SAAS,OAAO,KAAK,MAAM;EACjC,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM;EAC1C,MAAM,YAAY,OAAO,UAAU;EACnC,OAAO,MAAM,QAAQ,eAAe;GACnC,MAAM;GACN,QAAQ,OAAO;GACf,eAAe,kBACdA,KAAW,aAAa,CAAC,CAAC,KACzB,OAAO,SAAS,UACf,IAAI,iBACH,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,GAC3C,OACA;IACC,QAAQ,OAAO;IACf,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,gBAAgB,OAAO;IACvB,gBAAgB,CAAC,KAAK;GACvB,CACD,CAAC,CAAC,KACD,OAAO,SAAS,aACf,OAAO,oBAAoB,OAAO,cAAc,CAAC,CAChD,SAAS,OAAO,OAAO,cACxB,CACD,GAEA,OAAO,UAAU,UAChB,MAAM,SAAS,eACf,MAAM,OAAO,SAAS,sBACnB,yBAAyB,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,EAAE,CAAC,IAC1D,qBAAqB,KAAK;IAC1B,QAAQ;IACR,WAAW;IACX,OAAO,MAAM,KAAK,KAAK;GACxB,CAAC,CACJ,GACA,OAAO,eAAe,UAAU,WAAW,SAAS,GACpD,OAAO,eAAe,QAAQ,CAC/B,CACD,CACD;EACF,CAAC;CACF,CAAC;AACF,CAAC"}

package/dist/runner/auth/mtls.js

@@ -1,7 +1,7 @@
-import { a as provide, l as make$1 } from "../../Graft-CVyueNOf.js";
+import { a as provide, l as make$1 } from "../../Graft-B71CPA2Y.js";
 import { t as Authenticator } from "../../Auth-BElTC9_X.js";
 import { t as ConfigDirectory } from "../../ConfigDirectory-BCC6q2R4.js";
-import { t as AuthenticationFailed } from "../../Errors-BMKmu5Y7.js";
+import { t as AuthenticationFailed } from "../../Errors-DYhsGZcZ.js";
 import { Array, Cause, Effect, FileSystem, Option, Path, Schema, String } from "effect";
 // packages/remote/src/internal/auth/mtls.ts
 const uriValue = (field) => {
@@ -12,7 +12,7 @@ const uriValue = (field) => {
 	}))) : Effect.succeed(value);
 };
 /** Read exactly one graft URI from Node's plain or JSON-quoted SAN representation. */
-const identityFromSubjectAltName = (san) => Effect.gen(function* () {
+const identityFromSubjectAltName = Effect.fnUntraced(function* (san) {
 	const values = yield* Effect.forEach(Array.filter(String.split(san ?? "", ", "), String.startsWith("URI:")), uriValue);
 	const uris = Array.filter(values, String.startsWith("graft://"));
 	const [uri] = uris;

package/dist/runner/auth/none.js

@@ -1,4 +1,4 @@
-import { a as provide, l as make } from "../../Graft-CVyueNOf.js";
+import { a as provide, l as make } from "../../Graft-B71CPA2Y.js";
 import { t as Authenticator } from "../../Auth-BElTC9_X.js";
 import { Effect, Schema } from "effect";
 // packages/remote/src/runner/auth/none.ts

package/dist/runner/index.js

@@ -1,8 +1,8 @@
-import { i as plugin, l as make, o as fork } from "../Graft-CVyueNOf.js";
-import { r as ModuleResolver } from "../importer-Bk6U_sn4.js";
-import { c as directAuth, d as follow, h as runnerTransport, i as resolve, l as makeListenerConsumer, m as runnerAuthentication, o as CapabilityCombinationError, p as Runner, s as CapabilityFailed, t as boundary, u as runner } from "../entry-B89sepMU.js";
-import { i as Supervisor } from "../Packages-JNL34JpS.js";
-import { n as supervisorPlugin_default, t as Config$1 } from "../supervisorPlugin-CivhM7x5.js";
+import { i as plugin, l as make, o as fork } from "../Graft-B71CPA2Y.js";
+import { r as ModuleResolver } from "../importer-Cvf88eAY.js";
+import { c as directAuth, d as follow, h as runnerTransport, i as resolve, l as makeListenerConsumer, m as runnerAuthentication, o as CapabilityCombinationError, p as Runner, s as CapabilityFailed, t as boundary, u as runner } from "../entry-psOpX3Bj.js";
+import { i as Supervisor } from "../Packages-AgoCGotL.js";
+import { n as supervisorPlugin_default, t as Config$1 } from "../supervisorPlugin-t6Z6PrhD.js";
 import { Array, Deferred, Effect, HashSet, Option, Path, Schema, Stream } from "effect";
 import { SecureRandom } from "effect/crypto";
 // packages/remote/src/internal/listenerStartup.ts

package/dist/runner/stdio.js

@@ -1,7 +1,7 @@
-import { a as provide, l as make } from "../Graft-CVyueNOf.js";
+import { a as provide, l as make } from "../Graft-B71CPA2Y.js";
 import { n as Listener } from "../Transport-DULzpsgR.js";
-import { l as TransportError } from "../Errors-BMKmu5Y7.js";
-import { r as scoped } from "../release-BY4Mlluy.js";
+import { u as TransportError } from "../Errors-DYhsGZcZ.js";
+import { r as scoped } from "../release-DfZPuIcK.js";
 import { Cause, Deferred, Effect, Exit, Option, Schema, Sink, Stdio, Stream } from "effect";
 // packages/remote/src/runner/stdio.ts
 const Config = Schema.Struct({ auth: Schema.optionalKey(Schema.Never) });

package/dist/runner/unix.js

@@ -1,8 +1,8 @@
-import { a as provide, l as make } from "../Graft-CVyueNOf.js";
+import { a as provide, l as make } from "../Graft-B71CPA2Y.js";
 import { t as ConfigDirectory } from "../ConfigDirectory-BCC6q2R4.js";
 import { n as Listener } from "../Transport-DULzpsgR.js";
-import { l as TransportError } from "../Errors-BMKmu5Y7.js";
-import { t as bind } from "../websocketServer-D2Hk7wsA.js";
+import { u as TransportError } from "../Errors-DYhsGZcZ.js";
+import { t as bind } from "../websocketServer-NQhODlEt.js";
 import { Cause, Console, Effect, Option, Path, Schema } from "effect";
 import { createServer } from "node:http";
 // packages/remote/src/runner/unix.ts

package/dist/runner/websocket.js

@@ -1,9 +1,9 @@
-import { a as provide, l as make } from "../Graft-CVyueNOf.js";
+import { a as provide, l as make } from "../Graft-B71CPA2Y.js";
 import { t as ConfigDirectory } from "../ConfigDirectory-BCC6q2R4.js";
-import { n as Url, o as properties } from "../socketChannel-C_ppdSzz.js";
+import { n as Url, o as properties } from "../socketChannel-CJvL2DiB.js";
 import { n as Listener } from "../Transport-DULzpsgR.js";
-import { l as TransportError } from "../Errors-BMKmu5Y7.js";
-import { t as bind } from "../websocketServer-D2Hk7wsA.js";
+import { u as TransportError } from "../Errors-DYhsGZcZ.js";
+import { t as bind } from "../websocketServer-NQhODlEt.js";
 import { Cause, Console, Effect, FileSystem, Option, Path, Schema, String } from "effect";
 import { createSecureServer } from "node:http2";
 import { createServer } from "node:http";

package/dist/{socketChannel-C_ppdSzz.js → socketChannel-CJvL2DiB.js}

@@ -1,6 +1,6 @@
 import { i as __toESM, r as __require, t as __commonJSMin } from "./rolldown-runtime-DYf_mQCB.js";
-import { l as TransportError } from "./Errors-BMKmu5Y7.js";
-import { a as isCompleteFrame, i as encode, n as FrameError, o as maxPayload, r as decoder } from "./Framing-zaYdOJnT.js";
+import { u as TransportError } from "./Errors-DYhsGZcZ.js";
+import { a as isCompleteFrame, i as encode, n as FrameError, o as maxPayload, r as decoder } from "./Framing-G9eSaeLb.js";
 import { Array as Array$1, Cause, Effect, Exit, Layer, Redacted, Schema, Sink, Stream } from "effect";
 import { Socket } from "effect/socket";
 // node_modules/.pnpm/ws@8.22.1/node_modules/ws/lib/constants.js