@graftland/plugin-remote 0.3.3 → 0.4.1

package/src/internal/services.ts

@@ -1,7 +1,14 @@
 import { Array, Context, Effect, Record } from "effect"
+import {
+	RpcClient,
+	RpcServer,
+	type Rpc,
+	type RpcClientError,
+	type RpcGroup,
+} from "effect/rpc"
+
 import { Graft } from "@graftland/graft"
-import { RpcClient, RpcServer } from "effect/rpc"
-import type { Rpc, RpcClientError, RpcGroup } from "effect/rpc"
+
 import type { Service } from "../Contract"
 
 export const service = <

package/src/internal/socketChannel.ts

@@ -1,7 +1,8 @@
 import { Cause, Effect, Exit, Sink, Stream } from "effect"
 import { Socket } from "effect/socket"
+
 import { TransportError } from "../Errors"
-import { FrameError, isCompleteFrame, decoder, encode } from "./runner/Framing"
+import { decoder, encode, FrameError, isCompleteFrame } from "./runner/Framing"
 
 /** WebSocket boundaries are a wire compatibility detail, not Channel chunk boundaries. */
 export const fromSocket = Effect.fnUntraced(function* (socket: Socket.Socket) {

package/src/internal/stdioChannel.ts

@@ -1,7 +1,9 @@
-import { NodeSink } from "@effect/platform-node"
-import { Cause, Effect, Stdio, Stream } from "effect"
 // @effect-diagnostics-next-line nodeBuiltinImport:off -- Node's extra inherited descriptor carries protocol output separately from console output.
 import { createWriteStream } from "node:fs"
+
+import { Cause, Effect, Stdio, Stream } from "effect"
+import { NodeSink } from "@effect/platform-node"
+
 import { TransportError } from "../Errors"
 import type * as Port from "./port"
 

package/src/internal/supervisorPlugin.ts

@@ -1,4 +1,3 @@
-import { Graft, Plugin } from "@graftland/graft"
 import {
 	Context,
 	Effect,
@@ -11,15 +10,18 @@ import {
 } from "effect"
 import { Digest, SecureRandom } from "effect/crypto"
 import { ChildProcessSpawner } from "effect/process"
-import { Supervisor } from "./Supervisor"
-import { PositiveDuration } from "./config"
+
+import { Graft, Plugin } from "@graftland/graft"
 import { ConfigDirectory } from "@graftland/loader"
+
+import { PositiveDuration } from "./config"
+import { accept } from "./runner/accept"
+import * as Execution from "./runner/Execution"
 import * as Lock from "./runner/Lock"
 import * as Stores from "./runner/Store"
-import * as Execution from "./runner/Execution"
 import * as Engine from "./runner/Supervisor"
-import { accept } from "./runner/accept"
-import * as Lifecycle from "./ServeLifecycle"
+import * as Lifecycle from "./RunnerLifecycle"
+import { Supervisor } from "./Supervisor"
 
 export const Config = Schema.Struct({
 	root: Schema.String,
@@ -31,7 +33,7 @@ export default Plugin.make({
 	name: "remote-supervisor",
 	config: Config,
 	inject: [
-		Plugin.optional(Lifecycle.ServeLifecycle),
+		Plugin.optional(Lifecycle.RunnerLifecycle),
 		FileSystem.FileSystem,
 		Path.Path,
 		ChildProcessSpawner.ChildProcessSpawner,
@@ -39,7 +41,7 @@ export default Plugin.make({
 		Digest.Digest,
 	],
 	apply: Effect.fnUntraced(function* (options) {
-		const lifecycle = yield* Effect.serviceOption(Lifecycle.ServeLifecycle)
+		const lifecycle = yield* Effect.serviceOption(Lifecycle.RunnerLifecycle)
 		const resources = yield* Lifecycle.resources(lifecycle)
 		const path = yield* Path.Path
 		const directory = yield* ConfigDirectory.pipe(

package/src/internal/transportOptions.ts

@@ -1,4 +1,5 @@
 import type { Duration } from "effect"
+
 export interface WebsocketOptions {
 	readonly url: string
 	readonly tls?: {

package/src/internal/watchdogMain.ts

@@ -1,9 +1,11 @@
 /** Executable worker: fd 4 and the lease timer remain independent of the plugin thread. */
-import { NodeRuntime, NodeStream } from "@effect/platform-node"
-import { Clock, Effect, FiberHandle, Ref, Schema, Stream } from "effect"
 import { Socket } from "node:net"
-import { parentPort } from "node:worker_threads"
 import process from "node:process"
+import { parentPort } from "node:worker_threads"
+
+import { Clock, Effect, FiberHandle, Ref, Schema, Stream } from "effect"
+import { NodeRuntime, NodeStream } from "@effect/platform-node"
+
 import { CommandJson, Notice } from "./runner/WatchdogProtocol"
 
 // The runner machine is trusted. A suspended machine cannot enforce a deadline until it resumes.

package/src/internal/websocket.ts

@@ -1,14 +1,17 @@
 import { Array, Effect, Layer, Redacted, Schema } from "effect"
 import { Socket } from "effect/socket"
+
 import WS from "ws"
+
 import type { ClientCertificate } from "../Auth"
 import type { Properties } from "../Transport"
+import { headerSize, maxPayload } from "./runner/Framing"
+import type { WebsocketOptions } from "./transportOptions"
+
 interface PreparedCredentials {
 	readonly certificate?: ClientCertificate
 	readonly authorization?: Redacted.Redacted<string>
 }
-import type { WebsocketOptions } from "./transportOptions"
-import { headerSize, maxPayload } from "./runner/Framing"
 
 export const protocol = "graft-remote.v1"
 export const path = "/graft"

package/src/internal/websocketServer.ts

@@ -1,4 +1,5 @@
-import { NodeHttpServer, NodeHttpServerRequest } from "@effect/platform-node"
+import { TLSSocket } from "node:tls"
+
 import {
 	Array,
 	Cause,
@@ -11,15 +12,16 @@ import {
 } from "effect"
 import { HttpServerRequest, HttpServerResponse } from "effect/http"
 import type { Socket } from "effect/socket"
-import { TLSSocket } from "node:tls"
+import { NodeHttpServer, NodeHttpServerRequest } from "@effect/platform-node"
+
 import {
+	TransportError,
 	type AuthenticationFailed,
 	type AuthenticatorUnavailable,
-	TransportError,
 } from "../Errors"
 import type { Accept, Handshake, Serving } from "../Transport"
 import * as Channel from "./socketChannel"
-import { path, protocol, payloadLimit } from "./websocket"
+import { path, payloadLimit, protocol } from "./websocket"
 
 const rejection = (error: AuthenticationFailed | AuthenticatorUnavailable) =>
 	error._tag === "AuthenticatorUnavailable"

package/src/internal/workerChannel.ts

@@ -1,4 +1,5 @@
 import { Cause, Effect, FiberSet, Queue, Sink, Stream } from "effect"
+
 import { TransportError } from "../Errors"
 import type { Channel } from "./port"
 

package/src/internal/workerMain.ts

@@ -1,12 +1,15 @@
 /** Executable entry for a direct worker; platform services belong to this thread. */
-import { Graft } from "@graftland/graft"
-import { NodeRuntime } from "@effect/platform-node"
-import { Effect, Layer, Schema } from "effect"
 import { parentPort, workerData } from "node:worker_threads"
+
+import { Cause, Effect, Layer, Logger, Schema } from "effect"
+import { NodeRuntime } from "@effect/platform-node"
+
+import { Graft } from "@graftland/graft"
+
 import { load, run } from "./childRuntime"
+import { platform } from "./platform"
 import { Bootstrap } from "./workerBootstrap"
 import * as Channel from "./workerChannel"
-import { platform } from "./platform"
 
 const main = Effect.scoped(
 	Effect.gen(function* () {
@@ -19,5 +22,18 @@ const main = Effect.scoped(
 	}),
 )
 NodeRuntime.runMain(
-	main.pipe(Effect.provide(Graft.layer.pipe(Layer.provide(platform)))),
+	Effect.scoped(
+		Effect.gen(function* () {
+			const context = yield* Layer.build(
+				Graft.layer.pipe(Layer.provide(platform)),
+			)
+			return yield* main.pipe(Effect.provideContext(context))
+		}),
+	).pipe(
+		Effect.tapCause((cause) =>
+			Cause.hasInterruptsOnly(cause) ? Effect.void : Effect.logError(cause),
+		),
+		Effect.provideService(Logger.LogToStderr, true),
+	),
+	{ disableErrorReporting: true },
 )

package/src/runner/auth/bearer.ts

@@ -1,9 +1,11 @@
-import { Option } from "effect"
-import { Graft, Plugin } from "@graftland/graft"
+// @effect-diagnostics-next-line nodeBuiltinImport:off -- Token digests use Node's constant-time comparison
+import { timingSafeEqual } from "node:crypto"
+
 import {
 	Array,
 	Effect,
 	FileSystem,
+	Option,
 	Path,
 	Record,
 	Redacted,
@@ -11,13 +13,15 @@ import {
 } from "effect"
 import { Digest } from "effect/crypto"
 import { Hex } from "effect/encoding"
-// @effect-diagnostics-next-line nodeBuiltinImport:off -- Token digests use Node's constant-time comparison
-import { timingSafeEqual } from "node:crypto"
-import { Authenticator } from "../../Auth"
+
+import { Graft, Plugin } from "@graftland/graft"
 import { ConfigDirectory } from "@graftland/loader"
+
+import { Authenticator } from "../../Auth"
+import { Bearer as Config } from "../../internal/auth/config"
 import * as Token from "../../internal/auth/token"
 
-export const Config = Schema.Struct({ tokens: Schema.String })
+export { Config }
 const Tokens = Schema.fromJsonString(
 	Schema.Record(
 		Schema.String.check(Schema.isPattern(/^[0-9a-fA-F]{64}$/)),

package/src/runner/auth/jwt.ts

@@ -1,50 +1,19 @@
-import { Option } from "effect"
-import { Graft, Plugin } from "@graftland/graft"
-import {
-	Cause,
-	Duration,
-	Effect,
-	FileSystem,
-	Layer,
-	Path,
-	Schema,
-} from "effect"
-import { Jwk, Jwks, Jwt } from "effect/jose"
+import { Cause, Effect, FileSystem, Layer, Option, Path, Schema } from "effect"
 import { Signature } from "effect/crypto"
 import { HttpClient } from "effect/http"
-import { Authenticator } from "../../Auth"
+import { Jwk, Jwks, Jwt } from "effect/jose"
+
+import { Graft, Plugin } from "@graftland/graft"
 import { ConfigDirectory } from "@graftland/loader"
+
+import { Authenticator } from "../../Auth"
 import { AuthenticationFailed, AuthenticatorUnavailable } from "../../Errors"
+import { Jwt as Config } from "../../internal/auth/config"
 import * as Token from "../../internal/auth/token"
 
-export const ClockTolerance = Schema.DurationFromString.check(
-	Schema.makeFilter(
-		(duration) =>
-			Duration.isFinite(duration) && Duration.toMillis(duration) >= 0,
-		{ expected: "a finite, non-negative duration" },
-	),
-)
-export const Config = Schema.Struct({
-	issuer: Schema.NonEmptyString,
-	audience: Schema.NonEmptyArray(Schema.NonEmptyString),
-	algorithms: Schema.NonEmptyArray(Jwk.AsymmetricAlgorithm),
-	identityClaim: Schema.NonEmptyString.pipe(
-		Schema.withDecodingDefaultKey(Effect.succeed("sub")),
-	),
-	clockTolerance: ClockTolerance.pipe(
-		Schema.withDecodingDefaultKey(Effect.succeed("5 seconds")),
-	),
-	keys: Schema.Union([
-		Schema.Struct({
-			jwksUrl: Schema.String,
-			publicKey: Schema.optionalKey(Schema.Never),
-		}),
-		Schema.Struct({
-			publicKey: Schema.String,
-			jwksUrl: Schema.optionalKey(Schema.Never),
-		}),
-	]),
-})
+export { ClockTolerance } from "../../internal/auth/config"
+
+export { Config }
 const keys = Effect.fnUntraced(function* (config: typeof Config.Type) {
 	if (config.keys.jwksUrl !== undefined)
 		return Jwks.layerRemote({ url: config.keys.jwksUrl })

package/src/runner/auth/mtls.ts

@@ -1,10 +1,13 @@
+import { Effect, FileSystem, Option, Path } from "effect"
+
 import { Graft, Plugin } from "@graftland/graft"
-import { Effect, FileSystem, Option, Path, Schema } from "effect"
-import { Authenticator, type AuthenticatorApi } from "../../Auth"
 import { ConfigDirectory } from "@graftland/loader"
+
+import { Authenticator, type AuthenticatorApi } from "../../Auth"
+import { Mtls as Config } from "../../internal/auth/config"
 import { identityFromSubjectAltName } from "../../internal/auth/mtls"
 
-export const Config = Schema.Struct({ ca: Schema.String })
+export { Config }
 const read = Effect.fnUntraced(function* (ca: string) {
 	const fs = yield* FileSystem.FileSystem
 	const path = yield* Path.Path

package/src/runner/auth/none.ts

@@ -1,5 +1,7 @@
-import { Graft, Plugin } from "@graftland/graft"
 import { Effect, Schema } from "effect"
+
+import { Graft, Plugin } from "@graftland/graft"
+
 import { Authenticator } from "../../Auth"
 
 export default Plugin.make({

package/src/runner/index.ts

@@ -1,13 +1,27 @@
-import { Graft, Plugin } from "@graftland/graft"
+import {
+	Array,
+	Cause,
+	Deferred,
+	Effect,
+	Exit,
+	Option,
+	Path,
+	Schema,
+	Stream,
+} from "effect"
 import { SecureRandom } from "effect/crypto"
-import { Path } from "effect"
+
+import { Application, ProtocolOutput } from "@graftland/cli/Application"
+import { Graft, Plugin, type Fork } from "@graftland/graft"
 import { ModuleResolver } from "@graftland/loader"
-import { Deferred, Effect, Schema, Stream } from "effect"
-import * as Configuration from "../internal/entryConfig"
-import { boundary, resolve } from "../internal/entry"
+
 import * as Assembly from "../internal/assembly"
-import * as Startup from "../internal/listenerStartup"
+import { cleanupCause } from "../internal/cleanup"
+import { boundary, resolve } from "../internal/entry"
+import * as Configuration from "../internal/entryConfig"
 import { follow } from "../internal/follow"
+import * as Startup from "../internal/listenerStartup"
+import * as Lifecycle from "../internal/RunnerLifecycle"
 import { Supervisor } from "../internal/Supervisor"
 import supervisor, {
 	Config as SupervisorConfig,
@@ -45,7 +59,12 @@ const startListener = Effect.fnUntraced(function* (
 const owner = Plugin.make({
 	name: "remote-supervised-runtime",
 	config: Configuration.Runner,
-	inject: [ModuleResolver.ModuleResolver, Path.Path, SecureRandom.SecureRandom],
+	inject: [
+		ModuleResolver.ModuleResolver,
+		Path.Path,
+		SecureRandom.SecureRandom,
+		Plugin.optional(Application),
+	],
 	apply: Effect.fnUntraced(function* (config) {
 		const options = yield* Schema.encodeEffect(SupervisorConfig)(config)
 		const engine = yield* Graft.plugin(supervisor, options)
@@ -61,6 +80,21 @@ const owner = Plugin.make({
 			{ concurrency: "unbounded" },
 		)
 		yield* Startup.validate(descriptions)
+		const protocol = yield* ProtocolOutput
+		if (
+			Array.some(
+				descriptions,
+				(description) => description.properties.protocol === "stdio",
+			) !== protocol
+		)
+			return yield* Lifecycle.StartupError.make({
+				detail:
+					"A stdio runner requires graft start --stdio and exactly one stdio listener",
+			})
+		if (protocol) {
+			const application = yield* Effect.serviceOption(Application)
+			if (Option.isSome(application)) yield* application.value.claimProtocol
+		}
 		yield* Deferred.succeed(begin, undefined)
 		yield* Effect.forEach(
 			listeners,
@@ -85,13 +119,70 @@ const owner = Plugin.make({
 		)
 	}),
 })
+const shutdown = Effect.fnUntraced(function* (
+	fork: Fork.Fork,
+	lifecycle: typeof Lifecycle.RunnerLifecycle.Service,
+) {
+	const disposed = yield* Effect.exit(fork.dispose)
+	const result = yield* Deferred.poll(lifecycle.released)
+	const released = Option.isSome(result)
+		? yield* Effect.exit(result.value)
+		: Exit.void
+	const cause = Cause.combine(
+		Exit.isFailure(disposed) ? disposed.cause : Cause.empty,
+		Exit.isFailure(released) ? released.cause : Cause.empty,
+	)
+	if (cause.reasons.length > 0)
+		return yield* Effect.failCause(cleanupCause(cause))
+})
+
 export default Plugin.make({
 	name: "remote-server",
-	config: Configuration.Runner,
-	apply: Effect.fnUntraced(function* (config) {
+	config: Schema.Unknown,
+	inject: [Plugin.optional(Application)],
+	apply: Effect.fnUntraced(function* (input) {
+		const application = yield* Effect.serviceOption(Application)
+		const config = yield* Schema.decodeUnknownEffect(Configuration.Runner)(
+			input,
+		).pipe(
+			Effect.tapError((error) =>
+				Option.isSome(application)
+					? application.value.finish(Exit.fail(error))
+					: Effect.void,
+			),
+		)
+		const lifecycle = yield* Lifecycle.make
 		const encoded = yield* Schema.encodeEffect(Configuration.Runner)(config)
-		const fork = yield* Graft.plugin(owner, encoded, { isolate: [Supervisor] })
+		const assembly = Plugin.make({
+			name: "remote-runner-runtime",
+			apply: Effect.fnUntraced(function* () {
+				yield* Graft.provide(Lifecycle.RunnerLifecycle, lifecycle)
+				const fork = yield* Graft.plugin(owner, encoded)
+				const fail = yield* boundary("runner")
+				yield* follow(fork, fail)
+			}),
+		})
+		const fork = yield* Graft.plugin(assembly, undefined, {
+			isolate: [Supervisor, Lifecycle.RunnerLifecycle],
+		})
+		if (Option.isSome(application)) {
+			yield* application.value.onExit(shutdown(fork, lifecycle))
+			yield* Plugin.fork(
+				Deferred.await(lifecycle.ended).pipe(
+					Effect.matchCauseEffect({
+						onSuccess: () => application.value.finish(Exit.void),
+						onFailure: (cause) =>
+							application.value.finish(Exit.failCause(cause)),
+					}),
+				),
+			)
+		}
 		const fail = yield* boundary("runner")
-		yield* follow(fork, fail)
+		yield* follow(fork, (cause) =>
+			(Option.isSome(application) && !Cause.hasInterruptsOnly(cause)
+				? application.value.finish(Exit.failCause(cause))
+				: Effect.void
+			).pipe(Effect.andThen(fail(cause))),
+		)
 	}),
 })

package/src/runner/stdio.ts

@@ -1,4 +1,3 @@
-import { Graft, Plugin } from "@graftland/graft"
 import {
 	Cause,
 	Deferred,
@@ -10,9 +9,12 @@ import {
 	Stdio,
 	Stream,
 } from "effect"
-import { Listener, type Accept } from "../Transport"
+
+import { Graft, Plugin } from "@graftland/graft"
+import * as Release from "@graftland/graft/Release"
+
 import { TransportError } from "../Errors"
-import * as Release from "../internal/release"
+import { Listener, type Accept } from "../Transport"
 
 export const Config = Schema.Struct({ auth: Schema.optionalKey(Schema.Never) })
 export default Plugin.make({
@@ -30,7 +32,7 @@ export default Plugin.make({
 			},
 			bind: Effect.fnUntraced(function* () {
 				const ready = yield* Deferred.make<void>()
-				const eof = yield* Deferred.make<void>()
+				const eof = yield* Deferred.make<void, TransportError>()
 				const channel = {
 					input: stdio.stdin.pipe(
 						Stream.onExit((exit) =>
@@ -42,13 +44,16 @@ export default Plugin.make({
 							TransportError.make({ cause: Cause.fail(error) }),
 						),
 					),
-					output: stdio
-						.stdout({ endOnDone: false })
-						.pipe(
-							Sink.mapError((error) =>
-								TransportError.make({ cause: Cause.fail(error) }),
-							),
+					output: stdio.stdout({ endOnDone: false }).pipe(
+						Sink.mapError((error) =>
+							TransportError.make({ cause: Cause.fail(error) }),
 						),
+						Sink.onExit((exit) =>
+							Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause)
+								? Deferred.failCause(eof, exit.cause)
+								: Effect.void,
+						),
+					),
 				}
 				return {
 					ready: Deferred.await(ready),

package/src/runner/unix.ts

@@ -1,11 +1,14 @@
-import { Graft, Plugin } from "@graftland/graft"
-import { ConfigDirectory } from "@graftland/loader"
-import { Cause, Console, Effect, Option, Path, Schema } from "effect"
 // @effect-diagnostics-next-line nodeBuiltinImport:off -- NodeHttpServer takes a factory for an HTTP/1.1 server on the Unix socket
 import { createServer } from "node:http"
-import { Listener } from "../Transport"
+
+import { Cause, Console, Effect, Option, Path, Schema } from "effect"
+
+import { Graft, Plugin } from "@graftland/graft"
+import { ConfigDirectory } from "@graftland/loader"
+
 import { TransportError } from "../Errors"
 import * as Server from "../internal/websocketServer"
+import { Listener } from "../Transport"
 
 export const Config = Schema.Struct({ path: Schema.String })
 const Listening = Schema.fromJsonString(

package/src/runner/websocket.ts

@@ -1,4 +1,7 @@
-import { Graft, Plugin } from "@graftland/graft"
+// @effect-diagnostics-next-line nodeBuiltinImport:off -- NodeHttpServer takes a factory for an HTTP/1.1 upgrade server
+import { createServer } from "node:http"
+import { createSecureServer } from "node:http2"
+
 import {
 	Cause,
 	Console,
@@ -9,16 +12,15 @@ import {
 	Schema,
 	String,
 } from "effect"
+
+import { Graft, Plugin } from "@graftland/graft"
 import { ConfigDirectory } from "@graftland/loader"
-import { createSecureServer } from "node:http2"
-import { Url, path as upgradePath } from "../internal/websocket"
-import { Listener } from "../Transport"
+
 import type { TlsPolicy } from "../Auth"
 import { TransportError } from "../Errors"
+import { properties, path as upgradePath, Url } from "../internal/websocket"
 import * as Server from "../internal/websocketServer"
-import { properties } from "../internal/websocket"
-// @effect-diagnostics-next-line nodeBuiltinImport:off -- NodeHttpServer takes a factory for an HTTP/1.1 upgrade server
-import { createServer } from "node:http"
+import { Listener } from "../Transport"
 
 const url = (protocol: "ws:" | "wss:") =>
 	Url.check(

package/dist/Auth-BElTC9_X.js

@@ -1,6 +0,0 @@
-import { Context } from "effect";
-// packages/remote/src/Auth.ts
-/** Credentials and authenticated identities shared by transport plugins. */
-var Credentials = class extends Context.Service()("@graftland/plugin-remote/Auth/Credentials") {};
-var Authenticator = class extends Context.Service()("@graftland/plugin-remote/Auth/Authenticator") {};
-export { Credentials as n, Authenticator as t };

package/dist/Bootstrap-H9gDsgsC.js

@@ -1,9 +0,0 @@
-import { D as Identity } from "./Peer-DXeVrGBh.js";
-import { r as Limits } from "./port--3x2zJ4D.js";
-import { Schema } from "effect";
-// packages/remote/src/internal/runner/Bootstrap.ts
-const Bootstrap = Schema.Struct({
-	identity: Identity,
-	limits: Limits
-});
-export { Bootstrap as t };

package/dist/ConfigDirectory-BCC6q2R4.js

@@ -1,5 +0,0 @@
-import { Context, Option } from "effect";
-// packages/loader/src/ConfigDirectory.ts
-/** Directory of the supplied configuration path, before following symbolic links. */
-const ConfigDirectory = Context.Reference("@graftland/loader/ConfigDirectory", { defaultValue: Option.none });
-export { ConfigDirectory as t };