@graftland/plugin-remote 0.3.1 → 0.3.2

package/dist/{supervisorPlugin-CivhM7x5.js → supervisorPlugin-t6Z6PrhD.js}

@@ -1,17 +1,16 @@
-import { a as provide, l as make$2, o as fork, u as optional } from "./Graft-CVyueNOf.js";
-import { a as PositiveDuration, i as Supervisor$1, t as resolve } from "./Packages-JNL34JpS.js";
+import { a as provide, l as make$2, o as fork, u as optional } from "./Graft-B71CPA2Y.js";
+import { a as PositiveDuration, i as Supervisor$1, t as resolve } from "./Packages-AgoCGotL.js";
 import { t as ConfigDirectory } from "./ConfigDirectory-BCC6q2R4.js";
-import { C as negotiate, E as make$3, S as keyOf, T as stoppingRecord, _ as StateStorageError, a as ExecutionError, d as SessionAccessDenied, f as SessionConflict, g as StateDirectoryLocked, h as StaleSession, i as Execution, m as SessionStopped, n as Session$1, o as Key, p as SessionRecord, r as channel, s as LeaseExpired, t as Peer, u as RunnerClosing, v as Store, w as stoppedRecord, x as childOf, y as TerminationUnconfirmed } from "./Peer-BT7eAGmh.js";
-import { t as observe } from "./ProcessObservation-DEGrEMfP.js";
-import { t as make$4 } from "./FailureGroup-BcH0XOBi.js";
+import { C as negotiate, E as make$3, S as keyOf, T as stoppingRecord, _ as StateStorageError, a as ExecutionError, d as SessionAccessDenied, f as SessionConflict, g as StateDirectoryLocked, h as StaleSession, i as Execution, m as SessionStopped, n as Session$1, o as Key, p as SessionRecord, r as channel, s as LeaseExpired, t as Peer, u as RunnerClosing, v as Store, w as stoppedRecord, x as childOf, y as TerminationUnconfirmed } from "./Peer-DXeVrGBh.js";
+import { t as observe } from "./ProcessObservation-gLgGirYv.js";
+import { r as cleanupCause, t as make$4 } from "./FailureGroup-BgT73AaR.js";
 import { t as CommandJson } from "./WatchdogProtocol-BZmVxrBP.js";
-import { l as TransportError } from "./Errors-BMKmu5Y7.js";
-import { t as Bootstrap } from "./Bootstrap-Dr6sX7el.js";
+import { u as TransportError } from "./Errors-DYhsGZcZ.js";
+import { t as Bootstrap } from "./Bootstrap-H9gDsgsC.js";
 import { t as command } from "./command-9zrHdbwT.js";
-import { n as close } from "./release-BY4Mlluy.js";
-import { n as cleanupCause } from "./cleanup-CXLa1Wd9.js";
-import { n as make$5, o as defaults } from "./port-DSVUY8Bq.js";
-import { i as resources, t as ServeLifecycle } from "./ServeLifecycle-CJM0gG5B.js";
+import { n as close } from "./release-DfZPuIcK.js";
+import { n as make$5, o as defaults } from "./port--3x2zJ4D.js";
+import { i as resources, t as ServeLifecycle } from "./ServeLifecycle-Bd1FPJ6e.js";
 import { Array, Cause, Clock, Context, Data, Deferred, Duration, Effect, Equal, Exit, FiberHandle, FiberSet, FileSystem, HashMap, HashSet, Layer, Option, Path, Queue, RcMap, Ref, Result, Schedule, Schema, Scope, Semaphore, Sink, Stream, String, SynchronizedRef } from "effect";
 import process from "node:process";
 import { Digest, SecureRandom } from "effect/crypto";
@@ -19,7 +18,7 @@ import { RpcServer } from "effect/rpc";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 // packages/remote/src/internal/runner/Lock.ts
 /** SQLite owns the local directory lock for the enclosing scope, including failed startup. */
-const acquire = (directory) => Effect.gen(function* () {
+const acquire = Effect.fnUntraced(function* (directory) {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	yield* fs.makeDirectory(directory, { recursive: true }).pipe(Effect.uninterruptible);
@@ -59,7 +58,7 @@ const memory = Effect.gen(function* () {
 * Older terminal request ids expire; Open fences their retries with expectedGeneration.
 * Requires exclusive directory ownership; it is not a multi-writer database.
 */
-const directory = (root) => Effect.gen(function* () {
+const directory = Effect.fnUntraced(function* (root) {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const digest = yield* Digest.Digest;
@@ -89,7 +88,7 @@ const directory = (root) => Effect.gen(function* () {
 	yield* storage(compact);
 	return Store.of({
 		list: storage(mutex.withPermit(read.pipe(Effect.map((rows) => Array.map(rows, (row) => row.record))))),
-		save: (record) => storage(mutex.withPermit(Effect.scoped(Effect.gen(function* () {
+		save: Effect.fnUntraced(function* (record) {
 			const encoded = yield* Schema.encodeEffect(json)(record);
 			const address = yield* Schema.encodeEffect(Schema.fromJsonString(Schema.Struct({
 				key: Key,
@@ -111,13 +110,13 @@ const directory = (root) => Effect.gen(function* () {
 				yield* (yield* fs.open(root, { flag: "r" })).sync.pipe(Effect.uninterruptible);
 			}));
 			yield* compact;
-		}))))
+		}, Effect.scoped, mutex.withPermit, storage)
 	});
 });
 Layer.effect(Store, memory);
 const layerDirectory = (root) => Layer.effect(Store, directory(root));
 // packages/remote/src/internal/runner/Processes.ts
-const inspect = (pid) => Effect.scoped(Effect.gen(function* () {
+const inspect = Effect.fnUntraced(function* (pid) {
 	const child = yield* (yield* ChildProcessSpawner.ChildProcessSpawner).spawn(ChildProcess.make("ps", [
 		"-p",
 		`${pid}`,
@@ -126,10 +125,8 @@ const inspect = (pid) => Effect.scoped(Effect.gen(function* () {
 		"-o",
 		"stat="
 	], {
-		env: {
-			...process.env,
-			LC_ALL: "C"
-		},
+		env: { LC_ALL: "C" },
+		extendEnv: true,
 		stdin: "ignore"
 	}));
 	const [code, output, stderr] = yield* Effect.all([
@@ -142,11 +139,11 @@ const inspect = (pid) => Effect.scoped(Effect.gen(function* () {
 	if (code !== 0 || born === void 0 || status === void 0) return yield* ExecutionError.make({ detail: "Cannot inspect process identity: " + stderr });
 	if (String.startsWith("Z")(status)) return Option.none();
 	return Option.some({ born });
-})).pipe(Effect.mapError((error) => error._tag === "ExecutionError" ? error : ExecutionError.make({
+}, Effect.scoped, Effect.mapError((error) => error._tag === "ExecutionError" ? error : ExecutionError.make({
 	detail: "Inspecting process identity failed",
 	cause: Cause.fail(error)
 })));
-const identity = (pid) => Effect.gen(function* () {
+const identity = Effect.fnUntraced(function* (pid) {
 	const current = yield* inspect(pid);
 	if (Option.isNone(current)) return yield* ExecutionError.make({ detail: "The child exited before its identity could be recorded" });
 	return {
@@ -154,12 +151,12 @@ const identity = (pid) => Effect.gen(function* () {
 		start: current.value
 	};
 });
-const matches = (child) => Effect.gen(function* () {
+const matches = Effect.fnUntraced(function* (child) {
 	const current = yield* inspect(child.pid);
 	if (Option.isNone(current) || current.value.born !== child.start.born) return false;
 	return true;
 });
-const recover$1 = (child) => Effect.gen(function* () {
+const recover$1 = Effect.fnUntraced(function* (child) {
 	if (!(yield* matches(child))) return {
 		kind: "Exited",
 		exit: {
@@ -194,7 +191,7 @@ const recover$1 = (child) => Effect.gen(function* () {
 });
 // packages/remote/src/internal/runner/Execution.ts
 var Channels = class extends Context.Service()("@graftland/plugin-remote/internal/runner/Execution/Channels") {};
-const make$1 = (root) => Effect.gen(function* () {
+const make$1 = Effect.fnUntraced(function* (root) {
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -204,7 +201,7 @@ const make$1 = (root) => Effect.gen(function* () {
 	return {
 		driver: Execution.of({
 			recover: (child) => recover$1(child).pipe(Effect.provideContext(platform)),
-			spawn: (handle, request, limits) => Effect.gen(function* () {
+			spawn: Effect.fnUntraced(function* (handle, request, limits) {
 				const resolved = yield* resolve(root, request.specifier, request.digest);
 				const argv = yield* command();
 				const child = yield* spawner.spawn(ChildProcess.make(argv[0], [
@@ -270,7 +267,7 @@ const make$1 = (root) => Effect.gen(function* () {
 						millis
 					})
 				};
-			}).pipe(Effect.provideContext(platform), Effect.catchTags({
+			}, Effect.provideContext(platform), Effect.catchTags({
 				PlatformError: (error) => Effect.fail(ExecutionError.make({
 					detail: "Starting the child failed",
 					cause: Cause.fail(error)
@@ -369,34 +366,32 @@ const emptyTermination = {
 };
 const exitCause = (exit) => Exit.isFailure(exit) ? exit.cause : Cause.empty;
 /** A signal is a request; only the exited effect confirms that the execution has stopped. */
-const terminate = (execution, grace, confirmation) => {
-	if (execution._tag === "Absent") return Effect.succeed(emptyTermination);
-	if (execution._tag === "Exited") return Effect.succeed({
+const terminate = Effect.fnUntraced(function* (execution, grace, confirmation) {
+	if (execution._tag === "Absent") return emptyTermination;
+	if (execution._tag === "Exited") return {
 		...emptyTermination,
 		exit: execution.exit
-	});
+	};
 	const child = execution.unit;
-	return Effect.gen(function* () {
-		const graceful = yield* child.interrupt.pipe(Effect.andThen(child.exited), Effect.timeoutOption(grace), Effect.exit);
-		if (Exit.isSuccess(graceful) && Option.isSome(graceful.value)) return {
-			...emptyTermination,
-			exit: graceful.value.value
-		};
-		const killed = yield* Effect.exit(child.kill);
-		const forced = yield* child.exited.pipe(Effect.timeoutOption(confirmation), Effect.exit);
-		const cause = Cause.combine(Cause.combine(exitCause(graceful), exitCause(killed)), exitCause(forced));
-		if (Exit.isFailure(forced) || Option.isNone(forced.value)) return yield* TerminationUnconfirmed.make({
-			detail: "The child exit could not be confirmed",
-			cause
-		});
-		return {
-			kind: "Killed",
-			exit: forced.value.value,
-			cause
-		};
+	const graceful = yield* child.interrupt.pipe(Effect.andThen(child.exited), Effect.timeoutOption(grace), Effect.exit);
+	if (Exit.isSuccess(graceful) && Option.isSome(graceful.value)) return {
+		...emptyTermination,
+		exit: graceful.value.value
+	};
+	const killed = yield* Effect.exit(child.kill);
+	const forced = yield* child.exited.pipe(Effect.timeoutOption(confirmation), Effect.exit);
+	const cause = Cause.combine(Cause.combine(exitCause(graceful), exitCause(killed)), exitCause(forced));
+	if (Exit.isFailure(forced) || Option.isNone(forced.value)) return yield* TerminationUnconfirmed.make({
+		detail: "The child exit could not be confirmed",
+		cause
 	});
-};
-const initialize = (options = {}) => Effect.gen(function* () {
+	return {
+		kind: "Killed",
+		exit: forced.value.value,
+		cause
+	};
+});
+const initialize = Effect.fnUntraced(function* (options = {}) {
 	const store = yield* Store;
 	const execution = yield* Execution;
 	const random = yield* SecureRandom.SecureRandom;
@@ -432,19 +427,19 @@ const operations = (runtime) => {
 		return Option.isSome(found) && Equal.equals(keyOf(found.value.handle.key), keyOf(handle.key)) && found.value.handle.generation === handle.generation ? Effect.succeed(found.value) : Effect.fail(StaleSession.make({ detail: "Unknown session or generation" }));
 	}));
 	const latest = (key) => Ref.get(records).pipe(Effect.map((all) => Array.reduce(Array.fromIterable(HashMap.values(all)), 0, (value, record) => Equal.equals(keyOf(record.handle.key), keyOf(key)) ? Math.max(value, record.handle.generation) : value)));
-	const entryFor = (handle) => Effect.gen(function* () {
+	const entryFor = Effect.fnUntraced(function* (handle) {
 		yield* status(handle);
 		const all = yield* Ref.get(entries);
 		const found = HashMap.get(all, handle.token);
 		if (Option.isNone(found)) return yield* SessionStopped.make({ detail: "The session was retired during recovery" });
 		return found.value;
 	});
-	const commit = (entry, transition) => SynchronizedRef.updateEffect(entry.state, (state) => Effect.gen(function* () {
+	const commit = (entry, transition) => SynchronizedRef.updateEffect(entry.state, Effect.fnUntraced(function* (state) {
 		const next = yield* Effect.fromResult(transition(state));
 		yield* persist(snapshot(next));
 		return next;
 	}));
-	const finishStop = (entry, state, saved) => Effect.gen(function* () {
+	const finishStop = Effect.fnUntraced(function* (entry, state, saved) {
 		yield* FiberHandle.clear(entry.loading);
 		const result = yield* terminate(state.execution, grace, confirmation);
 		const closed = yield* Effect.exit(close(entry.unitScope, Exit.void));
@@ -461,7 +456,7 @@ const operations = (runtime) => {
 		return termination;
 	});
 	/** Called with the session ref locked; the worker starts after its transition is published. */
-	const stopLocked = (entry, state, reason, exit) => Effect.gen(function* () {
+	const stopLocked = Effect.fnUntraced(function* (entry, state, reason, exit) {
 		if (state._tag === "Stopping" || state._tag === "Stopped") return [state.reply, state];
 		const reply = yield* Deferred.make();
 		const next = beginStop(state, reason, reply, exit);
@@ -478,7 +473,7 @@ const operations = (runtime) => {
 			return stopLocked(entry, state, { _tag: "Expired" }, Option.none()).pipe(Effect.map(([, next]) => next));
 		});
 	})), { startImmediately: false });
-	const register = (entry, unit) => SynchronizedRef.updateEffect(entry.state, (state) => Effect.gen(function* () {
+	const register = (entry, unit) => SynchronizedRef.updateEffect(entry.state, Effect.fnUntraced(function* (state) {
 		const now = yield* Clock.monotonicTimeNanos;
 		const current = yield* Effect.fromResult(live(state, now));
 		const next = yield* Effect.fromResult(registerUnit(current, unit));
@@ -487,7 +482,7 @@ const operations = (runtime) => {
 		yield* FiberSet.run(workers, observe(unit.exited.pipe(Effect.flatMap((exit) => stop(entry, { _tag: "Exited" }, Option.some(exit))))));
 		return next;
 	})).pipe(Effect.uninterruptible);
-	const runLoad = (entry, state) => execution.spawn(state.record.handle, state.request, state.record.limits).pipe(Scope.provide(entry.unitScope), Effect.flatMap((unit) => register(entry, unit).pipe(Effect.andThen(unit.start), Effect.as(unit.code))), Effect.tap((code) => commit(entry, (current) => loaded(current, code))), Effect.onExit((result) => Effect.gen(function* () {
+	const runLoad = (entry, state) => execution.spawn(state.record.handle, state.request, state.record.limits).pipe(Scope.provide(entry.unitScope), Effect.flatMap((unit) => register(entry, unit).pipe(Effect.andThen(unit.start), Effect.as(unit.code))), Effect.tap((code) => commit(entry, (current) => loaded(current, code))), Effect.onExit(Effect.fnUntraced(function* (result) {
 		if (Exit.isSuccess(result)) {
 			yield* Deferred.done(state.reply, result);
 			return;
@@ -510,7 +505,7 @@ const operations = (runtime) => {
 		healthy
 	};
 };
-const recover = (runtime, actions) => Effect.gen(function* () {
+const recover = Effect.fnUntraced(function* (runtime, actions) {
 	const { store, execution, confirmation, records } = runtime;
 	const { persist } = actions;
 	const stored = yield* store.list;
@@ -531,10 +526,10 @@ const recover = (runtime, actions) => Effect.gen(function* () {
 		yield* persist(stoppedRecord(record.phase === "Stopping" ? record.previous : record, { _tag: "Recovery" }, termination));
 	}
 });
-const ownShutdown = (runtime, actions) => Effect.gen(function* () {
+const ownShutdown = Effect.fnUntraced(function* (runtime, actions) {
 	const { entries, health, closing } = runtime;
 	const { stop } = actions;
-	yield* Effect.addFinalizer(() => Effect.gen(function* () {
+	yield* Effect.addFinalizer(Effect.fnUntraced(function* () {
 		yield* Ref.set(closing, true);
 		const all = yield* Ref.get(entries);
 		const exits = yield* Effect.forEach(HashMap.values(all), (entry) => stop(entry, { _tag: "Shutdown" }).pipe(Effect.flatMap(Deferred.await), Effect.exit));
@@ -543,18 +538,19 @@ const ownShutdown = (runtime, actions) => Effect.gen(function* () {
 		if (cause.reasons.length > 0) return yield* Effect.failCause(cleanupCause(cause));
 	}));
 });
-const protocol = (runtime, actions) => Effect.gen(function* () {
+const protocol = Effect.fnUntraced(function* (runtime, actions) {
 	const { random, owner, locks, lease, limits, records, entries, health } = runtime;
 	const { persist, status, latest, entryFor, stop, scheduleLease, runLoad, healthy } = actions;
 	return Supervisor.of({
 		await: health.await,
 		status,
 		highWater: (key) => latest(key).pipe(Effect.map((value) => value === 0 ? null : value)),
-		open: (request) => Effect.scoped(Effect.gen(function* () {
+		open: Effect.fnUntraced(function* (request) {
 			yield* healthy;
 			const leaseMillis = Duration.toMillis(request.lease ?? lease);
 			const negotiated = negotiate(limits, request.limits ?? defaults);
-			return yield* (yield* RcMap.get(locks, keyOf(request.key))).withPermit(Effect.gen(function* () {
+			const lock = yield* RcMap.get(locks, keyOf(request.key));
+			return yield* Effect.gen(function* () {
 				yield* healthy;
 				const allRecords = yield* Ref.get(records);
 				const same = Array.filter(Array.fromIterable(HashMap.values(allRecords)), (row) => Equal.equals(keyOf(row.handle.key), keyOf(request.key)));
@@ -605,28 +601,28 @@ const protocol = (runtime, actions) => Effect.gen(function* () {
 					yield* scheduleLease(entry, deadline);
 					return record;
 				}));
-			}));
-		})),
-		renew: (handle) => Effect.gen(function* () {
+			}).pipe(lock.withPermit);
+		}, Effect.scoped),
+		renew: Effect.fnUntraced(function* (handle) {
 			yield* healthy;
 			const entry = yield* entryFor(handle);
-			return yield* SynchronizedRef.modifyEffect(entry.state, (state) => Effect.gen(function* () {
+			return yield* Effect.uninterruptibleMask((restore) => SynchronizedRef.modifyEffect(entry.state, Effect.fnUntraced(function* (state) {
 				const now = yield* Clock.monotonicTimeNanos;
 				const current = yield* Effect.fromResult(live(state, now));
 				const running = executionOf(current);
-				if (running._tag === "Running") yield* running.unit.renew(current.record.leaseMillis);
+				if (running._tag === "Running") yield* restore(running.unit.renew(current.record.leaseMillis));
 				const deadline = now + nanos(current.record.leaseMillis);
 				yield* scheduleLease(entry, deadline);
 				return [current.record.leaseMillis, {
 					...current,
 					deadline
 				}];
-			}));
+			})));
 		}),
-		load: (handle, request) => Effect.gen(function* () {
+		load: Effect.fnUntraced(function* (handle, request) {
 			yield* healthy;
 			const entry = yield* entryFor(handle);
-			return yield* yield* SynchronizedRef.modifyEffect(entry.state, (state) => Effect.gen(function* () {
+			return yield* yield* SynchronizedRef.modifyEffect(entry.state, Effect.fnUntraced(function* (state) {
 				const now = yield* Clock.monotonicTimeNanos;
 				const current = yield* Effect.fromResult(live(state, now));
 				if (current._tag !== "Open") {
@@ -640,7 +636,7 @@ const protocol = (runtime, actions) => Effect.gen(function* () {
 				return [Deferred.await(done), next];
 			})).pipe(Effect.uninterruptible);
 		}),
-		dispose: (handle) => Effect.gen(function* () {
+		dispose: Effect.fnUntraced(function* (handle) {
 			const record = yield* status(handle);
 			if (record.phase === "Stopped") return record.termination;
 			const entry = yield* entryFor(handle);
@@ -648,7 +644,7 @@ const protocol = (runtime, actions) => Effect.gen(function* () {
 		})
 	});
 });
-const make = (options = {}) => Effect.gen(function* () {
+const make = Effect.fnUntraced(function* (options = {}) {
 	const runtime = yield* initialize(options);
 	const actions = operations(runtime);
 	yield* recover(runtime, actions);
@@ -657,7 +653,7 @@ const make = (options = {}) => Effect.gen(function* () {
 });
 const layer = (options = {}) => Layer.effect(Supervisor, make(options));
 // packages/remote/src/internal/runner/accept.ts
-const accept = (supervisor, execution, channel$1) => Effect.gen(function* () {
+const accept = Effect.fnUntraced(function* (supervisor, execution, channel$1) {
 	const identity = yield* Peer;
 	const scope = yield* Effect.scope;
 	const mux = yield* make$3(channel$1);
@@ -684,7 +680,7 @@ const accept = (supervisor, execution, channel$1) => Effect.gen(function* () {
 			...leaseMillis === void 0 ? {} : { lease: leaseMillis },
 			limits
 		}),
-		Load: ({ handle, ...request }) => Effect.gen(function* () {
+		Load: Effect.fnUntraced(function* ({ handle, ...request }) {
 			yield* authorize(handle);
 			const attachment = yield* Ref.get(attached);
 			if (Option.isSome(attachment) && attachment.value !== handle.token) return yield* SessionConflict.make({ detail: "A connection can attach only one execution" });
@@ -695,7 +691,7 @@ const accept = (supervisor, execution, channel$1) => Effect.gen(function* () {
 				yield* Effect.all([Effect.forever(Effect.flatMap(mux.take(1), (bytes) => child.send(1, bytes))), Effect.forever(Effect.flatMap(child.take(1), (bytes) => mux.send(1, bytes)))], { concurrency: "unbounded" }).pipe(Effect.catchCause((cause) => Cause.hasInterruptsOnly(cause) ? Effect.void : child.fail(TransportError.make({ cause }))), Effect.forkIn(scope));
 			}
 			return code;
-		}).pipe(loading.withPermit),
+		}, loading.withPermit),
 		Renew: (handle) => authorize(handle).pipe(Effect.andThen(supervisor.renew(handle))),
 		Dispose: (handle) => authorize(handle).pipe(Effect.andThen(supervisor.dispose(handle))),
 		Status: (handle) => authorize(handle).pipe(Effect.andThen(supervisor.status(handle)))

package/dist/{token-Cc_1CTbE.js → token-CYBNNlhS.js}

@@ -1,4 +1,4 @@
-import { t as AuthenticationFailed } from "./Errors-BMKmu5Y7.js";
+import { t as AuthenticationFailed } from "./Errors-DYhsGZcZ.js";
 import { Effect, Option, Redacted } from "effect";
 // packages/remote/src/internal/auth/token.ts
 const invalid = () => AuthenticationFailed.make({

package/dist/{tokenCredentials-CI6mMRRd.js → tokenCredentials-CbCuk-Rt.js}

@@ -1,8 +1,8 @@
-import { a as provide, l as make } from "./Graft-CVyueNOf.js";
+import { a as provide, l as make } from "./Graft-B71CPA2Y.js";
 import { t as ConfigDirectory } from "./ConfigDirectory-BCC6q2R4.js";
 import { n as Credentials } from "./Auth-BElTC9_X.js";
-import { n as CredentialsError } from "./Errors-BMKmu5Y7.js";
-import { n as prepare } from "./token-Cc_1CTbE.js";
+import { r as CredentialsError } from "./Errors-DYhsGZcZ.js";
+import { n as prepare } from "./token-CYBNNlhS.js";
 import { Cause, Effect, FileSystem, Option, Path, Redacted, Schema } from "effect";
 // packages/remote/src/internal/auth/tokenCredentials.ts
 const Config$1 = Schema.Struct({ token: Schema.Union([Schema.RedactedFromValue(Schema.String), Schema.Struct({ file: Schema.String })]) });

package/dist/{websocketServer-D2Hk7wsA.js → websocketServer-NQhODlEt.js}

@@ -1,11 +1,13 @@
-import { l as TransportError } from "./Errors-BMKmu5Y7.js";
-import { a as payloadLimit, s as protocol, t as fromSocket } from "./socketChannel-C_ppdSzz.js";
+import { u as TransportError } from "./Errors-DYhsGZcZ.js";
+import { a as payloadLimit, s as protocol, t as fromSocket } from "./socketChannel-CJvL2DiB.js";
 import { Array, Cause, Deferred, Effect, Option, Redacted, Scope, String } from "effect";
 import { NodeHttpServer, NodeHttpServerRequest } from "@effect/platform-node";
 import { HttpServerRequest, HttpServerResponse } from "effect/http";
 import { TLSSocket } from "node:tls";
 // packages/remote/src/internal/websocketServer.ts
-const rejection = (error) => Effect.logWarning("Remote host authentication failed", { reason: error.reason }, ...error.cause === void 0 ? [] : [error.cause]).pipe(Effect.as(HttpServerResponse.empty({
+const rejection = (error) => error._tag === "AuthenticatorUnavailable" ? unavailable(error) : unauthorized(error);
+const unavailable = (error) => Effect.logError("Remote host authenticator is unavailable", error.cause).pipe(Effect.as(HttpServerResponse.empty({ status: 503 })));
+const unauthorized = (error) => Effect.logWarning("Remote host authentication failed", { reason: error.reason }, ...error.cause === void 0 ? [] : [error.cause]).pipe(Effect.as(HttpServerResponse.empty({
 	status: 401,
 	headers: error.challenge === void 0 ? {} : { "www-authenticate": error.challenge }
 })));

package/dist/{workerChannel-cmLc13vm.js → workerChannel-C8hhBJzA.js}

@@ -1,4 +1,4 @@
-import { l as TransportError } from "./Errors-BMKmu5Y7.js";
+import { u as TransportError } from "./Errors-DYhsGZcZ.js";
 import { Cause, Effect, FiberSet, Queue, Schema, Sink, Stream } from "effect";
 // packages/remote/src/internal/workerBootstrap.ts
 const Bootstrap = Schema.Struct({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@graftland/plugin-remote",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "type": "module",
   "description": "Local and authenticated network execution for Graft plugins",
   "license": "Apache-2.0",
@@ -49,9 +49,9 @@
     "effect": "4.1.*"
   },
   "dependencies": {
-    "@graftland/graft": "0.3.1",
+    "@graftland/graft": "0.3.2",
     "@effect/platform-node": "4.1.2",
-    "@graftland/loader": "0.3.1",
+    "@graftland/loader": "0.3.2",
     "pkijs": "4.0.1",
     "asn1js": "4.0.0",
     "ws": "8.22.1"

package/src/Auth.ts

@@ -1,7 +1,11 @@
 /** Credentials and authenticated identities shared by transport plugins. */
 import { Context } from "effect"
 import type { Effect, Redacted, Option, Scope } from "effect"
-import type { AuthenticationFailed, CredentialsError } from "./Errors"
+import type {
+	AuthenticationFailed,
+	AuthenticatorUnavailable,
+	CredentialsError,
+} from "./Errors"
 
 export interface ClientCertificate {
 	readonly cert: string
@@ -42,7 +46,10 @@ export type AuthenticatorApi =
 			readonly issuer?: string
 			readonly authenticate: (
 				header: Option.Option<Redacted.Redacted<string>>,
-			) => Effect.Effect<string, AuthenticationFailed>
+			) => Effect.Effect<
+				string,
+				AuthenticationFailed | AuthenticatorUnavailable
+			>
 	  }
 	| {
 			readonly _tag: "Mtls"

package/src/Errors.ts

@@ -81,6 +81,14 @@ export class AuthenticationFailed extends Schema.TaggedError<
 	cause: Schema.optionalKey(Schema.Cause(Schema.Unknown, Schema.Unknown)),
 }) {}
 
+/** The authenticator could not reach what it needs to decide, such as its key set; the credential may still be valid. */
+export class AuthenticatorUnavailable extends Schema.TaggedError<
+	AuthenticatorUnavailable,
+	{ readonly brand: unique symbol }
+>()("AuthenticatorUnavailable", {
+	cause: Schema.Cause(Schema.Unknown, Schema.Unknown),
+}) {}
+
 /** A remote entry could not be resolved or configured at the indicated field. */
 export class RemoteEntryError extends Schema.TaggedError<
 	RemoteEntryError,

package/src/Transport.ts

@@ -1,7 +1,11 @@
 /** Execution and byte-channel capabilities; implementations live in host plugins. */
 import { Context } from "effect"
 import type { Effect, Option, Scope, Stream, Sink, Redacted } from "effect"
-import type { AuthenticationFailed, TransportError } from "./Errors"
+import type {
+	AuthenticationFailed,
+	AuthenticatorUnavailable,
+	TransportError,
+} from "./Errors"
 import type { Prepared, VerifiedCertificate, TlsPolicy } from "./Auth"
 /** Ordered reliable bytes. Chunk boundaries have no meaning; EOF is not exit confirmation. */
 export interface Channel {
@@ -24,7 +28,7 @@ export type Session = (
 ) => Effect.Effect<void, TransportError, Scope.Scope>
 export type Accept = (
 	handshake: Handshake,
-) => Effect.Effect<Session, AuthenticationFailed>
+) => Effect.Effect<Session, AuthenticationFailed | AuthenticatorUnavailable>
 export interface Serving {
 	/** Completes after serve has registered its accept loop, not merely after bind. */
 	readonly ready: Effect.Effect<void>

package/src/bin.ts

@@ -68,24 +68,23 @@ const child = Command.make(
 			Argument.withSchema(Schema.fromJsonString(Bootstrap)),
 		),
 	},
-	({ contract, session, bootstrap }) =>
-		Effect.gen(function* () {
-			const watchdog = yield* Watchdog.start
-			// The executable owns stdin; it must not retain the process after a supervisor stop.
-			yield* Effect.addFinalizer(() =>
-				Effect.sync(() => {
-					process.stdin.destroy()
-				}),
-			)
-			const begin = yield* Effect.raceFirst(
-				watchdog.begin.pipe(Effect.as(true)),
-				watchdog.stop.pipe(Effect.as(false)),
-			)
-			if (!begin) return
-			const definition = yield* load(pathToFileURL(contract).href)
-			const channel = yield* bytes
-			return yield* run(definition, channel, session, bootstrap, watchdog.stop)
-		}),
+	Effect.fnUntraced(function* ({ contract, session, bootstrap }) {
+		const watchdog = yield* Watchdog.start
+		// The executable owns stdin; it must not retain the process after a supervisor stop.
+		yield* Effect.addFinalizer(() =>
+			Effect.sync(() => {
+				process.stdin.destroy()
+			}),
+		)
+		const begin = yield* Effect.raceFirst(
+			watchdog.begin.pipe(Effect.as(true)),
+			watchdog.stop.pipe(Effect.as(false)),
+		)
+		if (!begin) return
+		const definition = yield* load(pathToFileURL(contract).href)
+		const channel = yield* bytes
+		return yield* run(definition, channel, session, bootstrap, watchdog.stop)
+	}),
 )
 const cli = Command.make(
 	"graft-remote",
@@ -93,18 +92,17 @@ const cli = Command.make(
 		contract: Argument.String("contract").pipe(Argument.optional),
 		session: Argument.String("session").pipe(Argument.withDefault("local")),
 	},
-	({ contract, session }) =>
-		Effect.gen(function* () {
-			if (Option.isNone(contract))
-				return yield* CliError.UserError.make({
-					cause: "Missing contract module",
-					userMessage:
-						"A contract module or the child/serve/certificates subcommand is required",
-				})
-			const definition = yield* load(contract.value)
-			const channel = yield* bytes
-			return yield* run(definition, channel, session)
-		}),
+	Effect.fnUntraced(function* ({ contract, session }) {
+		if (Option.isNone(contract))
+			return yield* CliError.UserError.make({
+				cause: "Missing contract module",
+				userMessage:
+					"A contract module or the child/serve/certificates subcommand is required",
+			})
+		const definition = yield* load(contract.value)
+		const channel = yield* bytes
+		return yield* run(definition, channel, session)
+	}),
 ).pipe(Command.withSubcommands([child, serve, certificates]))
 
 NodeRuntime.runMain(

package/src/index.ts

@@ -92,8 +92,8 @@ export const plugin = <
 			ChildProcessSpawner.ChildProcessSpawner,
 		],
 		retry: options.retry,
-		apply: () =>
-			Effect.gen(function* () {
+		apply: Effect.fnUntraced(
+			function* () {
 				const input = yield* Schema.decodeUnknownEffect(Configuration.Host)({
 					contract: options.contractModule,
 					connect: options.connect,
@@ -112,6 +112,8 @@ export const plugin = <
 				yield* follow(child, (cause) =>
 					Effect.failCause(publicCause(contract.error, cause)),
 				)
-			}).pipe(Effect.mapError((error) => publicError(contract.error, error))),
+			},
+			Effect.mapError((error) => publicError(contract.error, error)),
+		),
 	})
 export { host as default } from "./internal/entry"

package/src/internal/Certificates.ts

@@ -241,20 +241,17 @@ export const write = Effect.fn("Certificates.write")(function* (
 	force: boolean = false,
 ) {
 	const fs = yield* FileSystem.FileSystem
-	yield* fs
-		.writeFileString(base + ".key", Redacted.value(pair.privateKey), {
-			flag: force ? "w" : "wx",
-			mode: 0o600,
-		})
-		.pipe(Effect.uninterruptible)
+	yield* fs.writeFileString(base + ".key", Redacted.value(pair.privateKey), {
+		flag: force ? "w" : "wx",
+		mode: 0o600,
+	})
 	// Opening an existing file does not change its permissions when renewing it.
-	yield* fs.chmod(base + ".key", 0o600).pipe(Effect.uninterruptible)
-	yield* fs
-		.writeFileString(base + ".crt", pair.certificate, {
-			flag: force ? "w" : "wx",
-		})
-		.pipe(Effect.uninterruptible)
-})
+	yield* fs.chmod(base + ".key", 0o600)
+	yield* fs.writeFileString(base + ".crt", pair.certificate, {
+		flag: force ? "w" : "wx",
+	})
+	// One region for the pair: an interruption between the files would leave a key without its certificate.
+}, Effect.uninterruptible)
 
 export interface Options {
 	readonly out: string