@maiaos/node 0.1.0-canary.44938d4.manual.1

package/dist/runtime/local-server.js

@@ -0,0 +1,639 @@
+import { randomUUID, timingSafeEqual } from "node:crypto";
+import { chmod, lstat, unlink, writeFile } from "node:fs/promises";
+import { createConnection } from "node:net";
+import { join } from "node:path";
+import { LOCAL_NODE_FRAME_HEADER_BYTES, LOCAL_NODE_INCOMPLETE_FRAME_TIMEOUT_MS, LOCAL_NODE_MAX_FRAME_CHUNKS, localNodeAuthenticatedRequestSchema, localNodeResponseEnvelopeSchema, MAIA_PROTOCOL_VERSION, MAX_LOCAL_NODE_FRAME_BYTES, } from "@maiaos/protocol";
+import { Context, Deferred, Effect, FiberSet, Layer, Option, Semaphore, } from "effect";
+import { asNodeRuntimeError, makeNodeRuntimeError, } from "./errors.js";
+import { decodeSingleFrame, encodeFrame } from "./framing.js";
+import { acceptsLocalServerRequest, localServerChannelDefinitions, } from "./local-server-channels.js";
+import { acquireLocalServerListener } from "./local-server-listener.js";
+import { recordRejectedRequest, recordResponseTransportLoss, } from "./observability.js";
+const FORCED_CLEANUP_TIMEOUT = "2 seconds";
+const ENDPOINT_PROBE_TIMEOUT = "250 millis";
+const READINESS_PROBE_TIMEOUT = "1 second";
+const RESPONSE_WRITE_ADMISSION_TIMEOUT_MILLISECONDS = 1000;
+// Graceful drain must contain the admitted read and response-write budgets,
+// plus bounded scheduler slack, before Maia escalates to forced cleanup.
+const GRACEFUL_DRAIN_TIMEOUT_MILLISECONDS = LOCAL_NODE_INCOMPLETE_FRAME_TIMEOUT_MS +
+    RESPONSE_WRITE_ADMISSION_TIMEOUT_MILLISECONDS +
+    500;
+const ORDINARY_REQUEST_LIMIT = 6;
+const incompleteFrameTimeout = process.env.MAIA_NODE_TEST_MODE === "1" &&
+    process.env.MAIA_NODE_TEST_EXTENDED_FRAME_DEADLINE === "1"
+    ? LOCAL_NODE_INCOMPLETE_FRAME_TIMEOUT_MS + 2000
+    : LOCAL_NODE_INCOMPLETE_FRAME_TIMEOUT_MS;
+const isNodeErrorCode = (error, code) => error instanceof Error && "code" in error && error.code === code;
+const responseMetadata = (correlationId) => ({
+    ...(correlationId === undefined ? {} : { correlationId }),
+    kind: "response",
+    messageId: `response_${randomUUID().replaceAll("-", "")}`,
+    protocolVersion: MAIA_PROTOCOL_VERSION,
+});
+const errorResponse = (error, correlationId) => localNodeResponseEnvelopeSchema.parse({
+    ...responseMetadata(correlationId),
+    payload: {
+        error: {
+            code: error.code,
+            message: error.message,
+            retryable: error.retryable,
+        },
+        ok: false,
+    },
+});
+const credentialsMatch = (expected, provided) => {
+    const expectedBytes = Buffer.from(expected, "utf8");
+    const providedBytes = Buffer.from(provided, "utf8");
+    return (expectedBytes.byteLength === providedBytes.byteLength &&
+        timingSafeEqual(expectedBytes, providedBytes));
+};
+const statusResponse = Effect.fn("LocalServer.statusResponse")(function* (input, correlationId) {
+    const status = yield* input.status();
+    return localNodeResponseEnvelopeSchema.parse({
+        ...responseMetadata(correlationId),
+        payload: { ok: true, result: status },
+    });
+});
+const successResponse = (result, correlationId) => localNodeResponseEnvelopeSchema.parse({
+    ...responseMetadata(correlationId),
+    payload: { ok: true, result },
+});
+const shutdownResponse = (correlationId) => localNodeResponseEnvelopeSchema.parse({
+    ...responseMetadata(correlationId),
+    payload: {
+        ok: true,
+        result: { accepted: true, method: "node.shutdown" },
+    },
+});
+const invalidRequest = () => ({
+    rejected: "frame_invalid",
+    response: errorResponse(makeNodeRuntimeError("frame_invalid", "The local IPC request does not match the protocol schema.")),
+    stop: false,
+});
+const misdirectedRequest = (correlationId) => ({
+    rejected: "frame_invalid",
+    response: errorResponse(makeNodeRuntimeError("frame_invalid", "The local IPC request is not admitted on this channel."), correlationId),
+    stop: false,
+});
+const authenticationFailure = (correlationId) => ({
+    rejected: "authentication_failed",
+    response: errorResponse(makeNodeRuntimeError("authentication_failed", "Local authentication failed."), correlationId),
+    stop: false,
+});
+const saturatedRequest = (correlationId) => ({
+    rejected: "saturated",
+    response: errorResponse(makeNodeRuntimeError("saturated", "The local Maia node is saturated.", true), correlationId),
+    stop: false,
+});
+const executeControlRequest = (input, request, correlationId) => input.executeControlRequest(request, correlationId).pipe(Effect.map((result) => ({
+    ...(request.method === "integration.apply.codex" ||
+        request.method === "integration.remove.codex" ||
+        request.method === "project.register" ||
+        request.method === "session.create" ||
+        request.method === "session.start" ||
+        request.method === "terminal.create" ||
+        request.method === "turn.send" ||
+        request.method === "workspace.repository.attach"
+        ? { mutation: true }
+        : {}),
+    response: successResponse(result, correlationId),
+    stop: false,
+})));
+const admitOrdinaryRequest = (context) => context.admission.ordinary
+    .withPermitsIfAvailable(1)(executeControlRequest(context.input, context.request, context.correlationId))
+    .pipe(Effect.map((admitted) => Option.isSome(admitted)
+    ? admitted.value
+    : saturatedRequest(context.correlationId)));
+const authenticatedRequest = (context) => {
+    const { admission, channel, input, request } = context;
+    const correlationId = request.request.messageId;
+    if (!credentialsMatch(input.localCredential, request.authentication.token)) {
+        return Effect.succeed(authenticationFailure(correlationId));
+    }
+    if (!acceptsLocalServerRequest(channel, request.request.payload)) {
+        return Effect.succeed(misdirectedRequest(correlationId));
+    }
+    if (request.request.payload.method === "node.status") {
+        return statusResponse(input, correlationId).pipe(Effect.map((response) => ({ response, stop: false })));
+    }
+    if (request.request.payload.method === "node.shutdown") {
+        return Effect.succeed({
+            response: shutdownResponse(correlationId),
+            stop: true,
+        });
+    }
+    return admitOrdinaryRequest({
+        admission,
+        correlationId,
+        input,
+        request: request.request.payload,
+    });
+};
+const handleRequest = (context) => {
+    const parsed = localNodeAuthenticatedRequestSchema.safeParse(context.value);
+    return parsed.success
+        ? authenticatedRequest({ ...context, request: parsed.data }).pipe(Effect.catch((error) => Effect.succeed({
+            rejected: error.code,
+            response: errorResponse(error, parsed.data.request.messageId),
+            stop: false,
+        })))
+        : Effect.succeed(invalidRequest());
+};
+class SocketFrameReader {
+    socket;
+    resume;
+    #complete = false;
+    #eventCount = 0;
+    #header = Buffer.alloc(LOCAL_NODE_FRAME_HEADER_BYTES);
+    #headerBytes = 0;
+    #payload;
+    #payloadBytes = 0;
+    #totalBytes = 0;
+    constructor(socket, resume) {
+        this.socket = socket;
+        this.resume = resume;
+    }
+    register() {
+        this.socket.on("close", this.onClose);
+        this.socket.on("data", this.onData);
+        this.socket.on("error", this.onError);
+        return Effect.sync(() => {
+            this.cleanup();
+        });
+    }
+    onClose = () => {
+        this.finish(Effect.fail(makeNodeRuntimeError("frame_invalid", "The local IPC connection closed before a complete frame arrived.", true)));
+    };
+    onError = (error) => {
+        this.finish(Effect.fail(asNodeRuntimeError(error, "transport_failed", "The local IPC connection failed.")));
+    };
+    onData = (chunk) => {
+        this.#eventCount += 1;
+        this.#totalBytes += chunk.byteLength;
+        if (this.#eventCount > LOCAL_NODE_MAX_FRAME_CHUNKS ||
+            this.#totalBytes >
+                MAX_LOCAL_NODE_FRAME_BYTES + LOCAL_NODE_FRAME_HEADER_BYTES) {
+            this.finish(Effect.fail(makeNodeRuntimeError(this.#totalBytes >
+                MAX_LOCAL_NODE_FRAME_BYTES + LOCAL_NODE_FRAME_HEADER_BYTES
+                ? "frame_too_large"
+                : "frame_invalid", "The local IPC request exceeds its resource limits.")));
+            return;
+        }
+        this.consume(chunk);
+    };
+    cleanup() {
+        this.socket.off("close", this.onClose);
+        this.socket.off("data", this.onData);
+        this.socket.off("error", this.onError);
+    }
+    completeFrame() {
+        try {
+            const frame = Buffer.concat([
+                this.#header,
+                this.#payload ?? Buffer.alloc(0),
+            ]);
+            const decoded = decodeSingleFrame(frame);
+            if (decoded.state === "complete")
+                this.finish(Effect.succeed(decoded.value));
+        }
+        catch (error) {
+            this.finish(Effect.fail(asNodeRuntimeError(error, "frame_invalid", "The local IPC request is invalid.")));
+        }
+    }
+    consumeHeader(chunk) {
+        if (this.#headerBytes < this.#header.byteLength) {
+            const bytes = Math.min(this.#header.byteLength - this.#headerBytes, chunk.byteLength);
+            chunk.copy(this.#header, this.#headerBytes, 0, bytes);
+            this.#headerBytes += bytes;
+            if (this.#headerBytes < this.#header.byteLength)
+                return;
+            const payloadLength = this.#header.readUInt32BE(0);
+            if (payloadLength > MAX_LOCAL_NODE_FRAME_BYTES) {
+                this.finish(Effect.fail(makeNodeRuntimeError("frame_too_large", "The local IPC request exceeds the frame limit.")));
+                return;
+            }
+            this.#payload = Buffer.alloc(payloadLength);
+            return bytes;
+        }
+        return 0;
+    }
+    consumePayload(chunk, offset) {
+        const payload = this.#payload;
+        if (payload === undefined)
+            return;
+        const payloadOffset = offset;
+        const bytes = Math.min(payload.byteLength - this.#payloadBytes, chunk.byteLength - payloadOffset);
+        chunk.copy(payload, this.#payloadBytes, payloadOffset, payloadOffset + bytes);
+        this.#payloadBytes += bytes;
+        const consumedOffset = payloadOffset + bytes;
+        if (this.#payloadBytes !== payload.byteLength)
+            return;
+        if (consumedOffset !== chunk.byteLength) {
+            this.finish(Effect.fail(makeNodeRuntimeError("frame_invalid", "A local IPC connection may contain only one request frame.")));
+            return;
+        }
+        this.completeFrame();
+    }
+    consume(chunk) {
+        const offset = this.consumeHeader(chunk);
+        if (offset !== undefined)
+            this.consumePayload(chunk, offset);
+    }
+    finish(effect) {
+        if (this.#complete)
+            return;
+        this.#complete = true;
+        this.cleanup();
+        this.resume(effect);
+    }
+}
+const readFrame = (socket) => Effect.callback((resume) => new SocketFrameReader(socket, resume).register()).pipe(Effect.timeout(incompleteFrameTimeout), Effect.mapError((error) => asNodeRuntimeError(error, "frame_invalid", "The local IPC request deadline expired.")));
+const responseWriteFailure = (error) => asNodeRuntimeError(error, "transport_failed", "The local IPC response failed.");
+class SocketResponseWriter {
+    socket;
+    response;
+    resume;
+    #settled = false;
+    #writeCompleted = false;
+    #settlement;
+    constructor(socket, response, resume) {
+        this.socket = socket;
+        this.response = response;
+        this.resume = resume;
+    }
+    register() {
+        this.socket.once("close", this.onClose);
+        this.socket.on("error", this.onError);
+        this.socket.end(encodeFrame(this.response), this.onWriteComplete);
+        return Effect.sync(this.cancel);
+    }
+    cancel = () => {
+        this.clearSettlement();
+        if (!this.socket.destroyed)
+            this.socket.destroy();
+    };
+    onClose = () => {
+        this.clearSettlement();
+        this.cleanup();
+        this.settle(this.#writeCompleted
+            ? Effect.succeed(true)
+            : Effect.fail(peerDisconnectedError()));
+    };
+    onError = (error) => {
+        this.settle(Effect.fail(responseWriteFailure(error)));
+    };
+    onWriteComplete = () => {
+        this.#writeCompleted = true;
+        this.#settlement = setImmediate(() => {
+            this.settle(Effect.succeed(true));
+        });
+    };
+    cleanup() {
+        this.socket.off("close", this.onClose);
+        this.socket.off("error", this.onError);
+    }
+    clearSettlement() {
+        if (this.#settlement === undefined)
+            return;
+        clearImmediate(this.#settlement);
+        this.#settlement = undefined;
+    }
+    settle(effect) {
+        if (this.#settled)
+            return;
+        this.#settled = true;
+        this.clearSettlement();
+        this.resume(effect);
+    }
+}
+const writeRequestFrameCallback = (socket, response) => Effect.callback((resume) => {
+    let settled = false;
+    const finish = (effect) => {
+        if (settled)
+            return;
+        settled = true;
+        socket.off("close", onClose);
+        socket.off("error", onError);
+        resume(effect);
+    };
+    const onClose = () => {
+        finish(Effect.fail(peerDisconnectedError()));
+    };
+    const onError = (error) => {
+        finish(Effect.fail(responseWriteFailure(error)));
+    };
+    socket.once("close", onClose);
+    socket.on("error", onError);
+    socket.end(encodeFrame(response), () => {
+        finish(Effect.succeed(true));
+    });
+    return Effect.sync(() => {
+        if (settled)
+            return;
+        settled = true;
+        socket.off("close", onClose);
+        socket.off("error", onError);
+        if (!socket.destroyed)
+            socket.destroy();
+    });
+});
+const writeResponseFrameCallback = (socket, response) => Effect.callback((resume) => new SocketResponseWriter(socket, response, resume).register());
+export const writeFrame = (socket, response) => writeRequestFrameCallback(socket, response).pipe(Effect.timeoutOrElse({
+    duration: RESPONSE_WRITE_ADMISSION_TIMEOUT_MILLISECONDS,
+    orElse: () => Effect.fail(makeNodeRuntimeError("deadline_exceeded", "The local IPC response write deadline expired.", true)),
+}));
+export const writeResponseFrame = (socket, response) => writeResponseFrameCallback(socket, response).pipe(Effect.timeoutOrElse({
+    duration: RESPONSE_WRITE_ADMISSION_TIMEOUT_MILLISECONDS,
+    orElse: () => Effect.fail(makeNodeRuntimeError("deadline_exceeded", "The local IPC response write deadline expired.", true)),
+}));
+const recordRequestRejection = (code) => recordRejectedRequest(code).pipe(Effect.andThen(Effect.logWarning("maia.node.ipc_request_rejected", new Map([["code", code]]))));
+export const writeHandledResponse = (socket, response) => writeResponseFrame(socket, response).pipe(Effect.catch((error) => recordResponseTransportLoss(error.code)));
+const writeRequestFailure = Effect.fn("LocalServer.writeRequestFailure")(function* (socket, error) {
+    yield* recordRequestRejection(error.code);
+    if (socket.destroyed)
+        return;
+    yield* writeHandledResponse(socket, errorResponse(error));
+});
+const shouldDropTestMutationResponse = (outcome) => process.env.MAIA_NODE_TEST_MODE === "1" &&
+    process.env.MAIA_NODE_TEST_DROP_MUTATION_RESPONSE === "1" &&
+    outcome.mutation === true;
+const dropFirstTestMutationResponse = Effect.fn("LocalServer.dropFirstTestMutationResponse")(function* (socket, input, outcome) {
+    if (!shouldDropTestMutationResponse(outcome))
+        return false;
+    const dropped = yield* Effect.tryPromise({
+        catch: (error) => asNodeRuntimeError(error, "transport_failed", "Could not apply the mutation-response failure injection."),
+        try: async () => {
+            try {
+                await writeFile(join(input.paths.runtimeDirectory, "mutation-response-drop.barrier"), "dropped\n", { encoding: "utf8", flag: "wx", mode: 0o600 });
+                return true;
+            }
+            catch (error) {
+                if (isNodeErrorCode(error, "EEXIST"))
+                    return false;
+                throw error;
+            }
+        },
+    });
+    if (dropped)
+        socket.destroy();
+    return dropped;
+});
+const peerDisconnectedError = (error) => error === undefined
+    ? makeNodeRuntimeError("transport_failed", "The local IPC peer disconnected before the request completed.", true)
+    : asNodeRuntimeError(error, "transport_failed", "The local IPC peer disconnected before the request completed.");
+const awaitPeerCloseCallback = (socket) => Effect.callback((resume) => {
+    const finish = (error) => {
+        socket.off("close", onClose);
+        socket.off("error", onError);
+        resume(Effect.fail(peerDisconnectedError(error)));
+    };
+    const onClose = () => {
+        finish();
+    };
+    const onError = (error) => {
+        finish(error);
+    };
+    socket.once("close", onClose);
+    socket.once("error", onError);
+    return Effect.sync(() => {
+        socket.off("close", onClose);
+        socket.off("error", onError);
+    });
+});
+const awaitPeerClose = (socket) => socket.destroyed
+    ? Effect.fail(peerDisconnectedError())
+    : awaitPeerCloseCallback(socket);
+const serveConnection = Effect.fn("LocalServer.serveConnection")(function* (socket, context) {
+    const request = yield* readFrame(socket);
+    const outcome = yield* Effect.raceFirst(handleRequest({
+        admission: context.admission,
+        channel: context.channel,
+        input: context.input,
+        value: request,
+    }), awaitPeerClose(socket));
+    if (outcome.rejected !== undefined) {
+        yield* recordRequestRejection(outcome.rejected);
+    }
+    if (yield* dropFirstTestMutationResponse(socket, context.input, outcome)) {
+        context.activeSockets.delete(socket);
+        return;
+    }
+    yield* writeHandledResponse(socket, outcome.response);
+    if (outcome.stop)
+        yield* context.input.requestStop;
+    context.activeSockets.delete(socket);
+});
+const runConnection = (socket, context) => serveConnection(socket, context).pipe(Effect.catch((error) => writeRequestFailure(socket, error)), Effect.ensuring(Effect.sync(() => {
+    context.activeSockets.delete(socket);
+    socket.destroy();
+})));
+const writeTestBarrier = (input, options) => {
+    if (process.env.MAIA_NODE_TEST_MODE !== "1" || !options.enabled) {
+        return Effect.void;
+    }
+    const path = join(input.paths.runtimeDirectory, options.name);
+    return Effect.tryPromise({
+        catch: (error) => asNodeRuntimeError(error, "transport_failed", options.failureMessage),
+        try: async () => {
+            try {
+                await writeFile(path, "acknowledged\n", {
+                    encoding: "utf8",
+                    flag: "wx",
+                    mode: 0o600,
+                });
+            }
+            catch (error) {
+                if (isNodeErrorCode(error, "EEXIST"))
+                    return;
+                throw error;
+            }
+        },
+    }).pipe(Effect.orDie);
+};
+const writeTestConnectionCapacityBarrier = (input) => writeTestBarrier(input, {
+    enabled: process.env.MAIA_NODE_TEST_CONNECTION_CAPACITY_BARRIER === "1",
+    failureMessage: "Could not acknowledge the connection-capacity test event.",
+    name: "connection-capacity.barrier",
+});
+const writeTestConnectionDropBarrier = (input) => writeTestBarrier(input, {
+    enabled: process.env.MAIA_NODE_TEST_CONNECTION_DROP_BARRIER === "1",
+    failureMessage: "Could not acknowledge the connection-limit test event.",
+    name: "connection-drop.barrier",
+});
+const recordConnectionLimit = (input) => recordRejectedRequest("connection_limit").pipe(Effect.andThen(writeTestConnectionDropBarrier(input)));
+const runAcceptedConnection = (socket, handler) => {
+    if (handler.activeSockets.size === handler.maxConnections) {
+        void handler.run(writeTestConnectionCapacityBarrier(handler.input));
+    }
+    socket.setNoDelay(true);
+    void handler.run(runConnection(socket, handler).pipe(Effect.withSpan("maia.node.ipc.request", { root: true })));
+};
+const beginClose = (server, closed) => {
+    if (!server.listening) {
+        Deferred.doneUnsafe(closed, Effect.succeed(true));
+        return;
+    }
+    server.close((error) => {
+        Deferred.doneUnsafe(closed, error === undefined
+            ? Effect.succeed(true)
+            : Effect.logError("maia.node.ipc_close_failed", new Map([["code", "transport_failed"]])).pipe(Effect.as(true)));
+    });
+};
+const closeServer = Effect.fn("LocalServer.close")(function* (runtime, requestForce) {
+    const closed = yield* Deferred.make();
+    yield* Effect.sync(() => {
+        beginClose(runtime.server, closed);
+    });
+    const graceful = yield* Deferred.await(closed).pipe(Effect.timeoutOption(GRACEFUL_DRAIN_TIMEOUT_MILLISECONDS));
+    if (Option.isSome(graceful))
+        return;
+    yield* requestForce;
+    yield* Effect.sync(() => {
+        runtime.activeSockets.forEach((socket) => socket.destroy());
+    });
+    const forced = yield* Deferred.await(closed).pipe(Effect.timeoutOption(FORCED_CLEANUP_TIMEOUT));
+    if (Option.isNone(forced)) {
+        yield* Effect.logError("maia.node.ipc_forced_close_deadline", new Map([["code", "resource_cleanup_failed"]]));
+    }
+});
+const probeEndpoint = (address) => Effect.callback((resume) => {
+    const socket = createConnection(address);
+    const finish = (active) => {
+        socket.destroy();
+        resume(Effect.succeed(active));
+    };
+    socket.once("connect", () => {
+        finish(true);
+    });
+    socket.once("error", () => {
+        finish(false);
+    });
+    return Effect.sync(() => socket.destroy());
+}).pipe(Effect.timeoutOption(ENDPOINT_PROBE_TIMEOUT), Effect.map(Option.getOrElse(() => false)));
+const inspectUnixEndpoint = (address) => Effect.tryPromise({
+    catch: (error) => asNodeRuntimeError(error, "path_invalid", "Could not inspect the local IPC endpoint."),
+    try: async () => {
+        try {
+            return await lstat(address);
+        }
+        catch (error) {
+            if (isNodeErrorCode(error, "ENOENT"))
+                return;
+            throw error;
+        }
+    },
+});
+const validateUnixEndpoint = (metadata) => {
+    if (!metadata.isSocket() || metadata.isSymbolicLink()) {
+        return Effect.fail(makeNodeRuntimeError("path_invalid", "The Maia local endpoint path is unsafe."));
+    }
+    if (typeof process.getuid === "function" &&
+        metadata.uid !== process.getuid()) {
+        return Effect.fail(makeNodeRuntimeError("path_invalid", "The Maia local endpoint belongs to another user."));
+    }
+    return Effect.void;
+};
+const removeStaleUnixEndpoint = Effect.fn("LocalServer.removeStaleUnixEndpoint")(function* (address) {
+    const metadata = yield* inspectUnixEndpoint(address);
+    if (metadata === undefined)
+        return;
+    yield* validateUnixEndpoint(metadata);
+    if (yield* probeEndpoint(address)) {
+        return yield* Effect.fail(makeNodeRuntimeError("already_running", "Another process already owns the Maia local endpoint.", true));
+    }
+    yield* Effect.tryPromise({
+        catch: (error) => asNodeRuntimeError(error, "transport_failed", "Could not remove a stale local endpoint."),
+        try: () => unlink(address),
+    });
+});
+const connectEndpoint = (address) => Effect.callback((resume) => {
+    const socket = createConnection(address);
+    const onError = (error) => {
+        socket.off("connect", onConnect);
+        resume(Effect.fail(asNodeRuntimeError(error, "transport_failed", "Could not connect to the Maia local IPC endpoint.")));
+    };
+    const onConnect = () => {
+        socket.off("error", onError);
+        resume(Effect.succeed(socket));
+    };
+    socket.once("connect", onConnect);
+    socket.once("error", onError);
+    return Effect.sync(() => socket.destroy());
+});
+const readinessRequest = (token) => ({
+    authentication: { scheme: "maia.local.bearer/v1", token },
+    request: {
+        kind: "request",
+        messageId: `readiness_${randomUUID().replaceAll("-", "")}`,
+        payload: { method: "node.status", parameters: {} },
+        protocolVersion: MAIA_PROTOCOL_VERSION,
+    },
+});
+const verifyResponse = (value, expectedInstanceId) => {
+    const response = localNodeResponseEnvelopeSchema.safeParse(value);
+    if (!response.success ||
+        !response.data.payload.ok ||
+        response.data.payload.result.method !== "node.status" ||
+        response.data.payload.result.instanceId !== expectedInstanceId) {
+        return Effect.fail(makeNodeRuntimeError("transport_failed", "The local IPC readiness probe returned an invalid response."));
+    }
+    return Effect.void;
+};
+const verifyEndpoint = (input, address) => Effect.acquireUseRelease(connectEndpoint(address), (socket) => Effect.gen(function* () {
+    yield* writeFrame(socket, readinessRequest(input.localCredential));
+    const response = yield* readFrame(socket);
+    const status = yield* input.status();
+    yield* verifyResponse(response, status.instanceId);
+}), (socket) => Effect.sync(() => socket.destroy())).pipe(Effect.timeout(READINESS_PROBE_TIMEOUT), Effect.mapError((error) => asNodeRuntimeError(error, "transport_failed", "The local IPC readiness probe failed.")));
+const protectUnixEndpoint = (input, address) => input.paths.transport === "unix"
+    ? Effect.tryPromise({
+        catch: (error) => asNodeRuntimeError(error, "transport_failed", "Could not protect the local IPC endpoint."),
+        try: () => chmod(address, 0o600),
+    })
+    : Effect.void;
+const acquireChannel = Effect.fn("LocalServer.acquireChannel")(function* (context) {
+    const activeSockets = new Set();
+    const handler = {
+        activeSockets,
+        address: context.channel.address,
+        admission: context.admission,
+        channel: context.channel.channel,
+        input: context.input,
+        maxConnections: context.channel.maxConnections,
+        run: context.run,
+    };
+    yield* Effect.acquireRelease(acquireLocalServerListener({
+        activeSockets,
+        address: handler.address,
+        maxConnections: handler.maxConnections,
+        onAccepted: (socket) => {
+            runAcceptedConnection(socket, handler);
+        },
+        onLimit: () => {
+            void handler.run(recordConnectionLimit(handler.input));
+        },
+    }), (server) => closeServer({ activeSockets, server }, context.input.requestForce));
+});
+const prepareChannelEndpoints = (input, channels) => input.paths.transport === "unix"
+    ? Effect.all(channels.map((channel) => removeStaleUnixEndpoint(channel.address)), {
+        concurrency: 2,
+        discard: true,
+    })
+    : Effect.void;
+const protectChannelEndpoints = (input, channels) => Effect.all(channels.map((channel) => protectUnixEndpoint(input, channel.address)), { concurrency: 2, discard: true });
+const listen = Effect.fn("LocalServer.listen")(function* (input) {
+    const channels = localServerChannelDefinitions(input.paths);
+    yield* prepareChannelEndpoints(input, channels);
+    const admission = {
+        ordinary: Semaphore.makeUnsafe(ORDINARY_REQUEST_LIMIT),
+    };
+    const run = yield* FiberSet.makeRuntime();
+    yield* Effect.all(channels.map((channel) => acquireChannel({ admission, channel, input, run })), { concurrency: 2, discard: true });
+    yield* protectChannelEndpoints(input, channels);
+    yield* verifyEndpoint(input, channels[1].address);
+    yield* Effect.logInfo("maia.node.ipc_ready", new Map([["transport", input.paths.transport]]));
+});
+export class LocalServer extends Context.Service()("@maiaos/node/runtime/LocalServer") {
+    static layer = Layer.succeed(LocalServer, LocalServer.of({ listen }));
+}
+//# sourceMappingURL=local-server.js.map