@smthrs/artifacts 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/RemoteArtifacts.d.ts

@@ -0,0 +1,237 @@
+/**
+ * The shared artifact tier: an {@link ArtifactStore.Service} spoken over HTTP.
+ *
+ * The wire protocol mirrors Bazel's dumb-HTTP remote cache, class
+ * `HttpCacheClient` in `com.google.devtools.build.lib.remote.http`, which
+ * documents it as: "CAS (Content Addressable Storage) blobs are stored under
+ * the path `/cas/base16-key`", uploaded with `PUT`, downloaded with `GET`. We add
+ * `HEAD /cas/{digest}` for a single existence probe and
+ * `POST /cas/findMissing` for the batched one, because Bazel's HTTP client has
+ * no `findMissingDigests` at all — it answers "everything is missing" and
+ * re-uploads — and a batched probe is the whole reason
+ * `MissingDigestsFinder` exists in the gRPC client.
+ *
+ * Transport is Effect's own `HttpClient` tag. There is no lower transport in
+ * this repository, and there does not need to be one: the kernel already
+ * decorates that tag with `net:get`/`net:post` capability checks, so a remote
+ * artifact fetch is permission-checked like every other egress.
+ *
+ * ## Chunked uploads
+ *
+ * With `chunkBytes` set, a blob past that size travels as a sequence of
+ * `PUT /cas/{digest}` requests carrying `Content-Range: bytes {a}-{b}/{total}`,
+ * preceded by a `HEAD /cas/{digest}` existence probe and a
+ * `Content-Range: bytes *\/{total}` probe with an empty body. This is the
+ * resumable-upload shape HTTP already has: the range probe asks what prefix
+ * the tier holds and `308` means "keep going", with a `Range: bytes=0-{last}`
+ * header on the probe or on a chunk answer moving the offset.
+ *
+ * Only a `308` continues the sequence, and the completing chunk's `2xx` is
+ * confirmed with `HEAD` before `put` reports the digest as published. A `2xx`
+ * anywhere else, to the empty probe or to a chunk the tier is still owed bytes
+ * after, reads as a tier that ignored `Content-Range` and stored the body it
+ * was handed, which is what plain WebDAV `PUT` does. That tier, the one that
+ * answers `400`, `411`, or `416`, and the one whose `HEAD` will not confirm
+ * the stored length all get the same treatment: one whole-blob `PUT`, which
+ * overwrites the partial body the sequence left behind. So the blob always
+ * lands whole, and the cost of turning the dial on against a server that
+ * never learned about it is round trips, never a digest published over bytes
+ * the server does not hold.
+ *
+ * This repository's own hosted and self-hosted cache services are such
+ * servers: neither implements the resumable sequence, and both refuse a
+ * ranged `PUT` with `400`, RFC 9110 section 14.5's answer from a resource
+ * that does not support partial `PUT`. Against them `chunkBytes` costs the
+ * probe round trip and the blob travels whole, and both cap one request body
+ * at 16 MiB, so a blob past that cap is refused with `413` in either mode.
+ *
+ * The endpoint and its credentials arrive as **layer construction options**.
+ * They are capabilities, never step inputs: they are not hashed into a step
+ * key, journaled, or returned in a recorded result. Invalid endpoint errors are
+ * sanitized before they cross the boundary.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as ArtifactStore from "./ArtifactStore.ts";
+/**
+ * How eagerly a composition materializes shared blobs into its local store.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare const DownloadPolicy: Schema.Literals<readonly ["all", "toplevel", "minimal"]>;
+/**
+ * How eagerly a composition materializes remote blobs.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type DownloadPolicy = typeof DownloadPolicy.Type;
+/**
+ * Every download policy, in materialization order.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare const downloadPolicies: ReadonlyArray<DownloadPolicy>;
+/**
+ * A remote artifact tier, which is an ordinary store that also states how
+ * eagerly a composition reading through it should materialize blobs locally.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Service extends ArtifactStore.Service {
+    readonly downloadPolicy: DownloadPolicy;
+}
+/**
+ * Reads the download policy a store declares, or `undefined` for a store that
+ * declares none — every local store, and any foreign implementation.
+ *
+ * @category getters
+ * @since 1.0.0-rc.0
+ */
+export declare const downloadPolicyOf: (store: ArtifactStore.Service) => DownloadPolicy | undefined;
+/**
+ * How to reach the shared artifact tier.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export interface Options {
+    /**
+     * The cache root, e.g. `https://cache.example.com`. `/cas/{digest}` and
+     * `/cas/findMissing` are resolved beneath it. A trailing slash is ignored.
+     *
+     * Four shapes are refused at construction as `invalid_configuration`, before
+     * any request leaves and therefore before `headers` can reach a wire: a value
+     * that is not a string, one no `URL` parser accepts, a scheme other than
+     * `https:` (plain `http:` is accepted only for the literal loopback hosts
+     * `localhost`, `127.0.0.1`, and `[::1]`), and an endpoint carrying
+     * userinfo, a query, or a fragment. The
+     * last rule keeps a credential out of a place nothing here would redact: an
+     * endpoint is interpolated into every request path and into span attributes.
+     *
+     * The refusal message names only the violated rule and never echoes the
+     * endpoint, so a rejected `https://user:secret@host` cannot leak its
+     * credential into a log line or a durable error.
+     */
+    readonly endpoint: string;
+    /**
+     * Headers sent with every request — an `Authorization` bearer token, a
+     * tenant header, whatever the deployment's gateway wants. This is the
+     * credential seam, and it is deliberately construction-time: a credential
+     * that arrived as a step input would be hashed into a step key and persisted
+     * everywhere the journal goes.
+     *
+     * The protocol wins every collision. These headers are applied to a request
+     * first. Configured `content-type`, `content-length`, and `content-range`
+     * are removed, then computed only where the protocol needs them. Whole-blob
+     * uploads, including fallbacks, never carry `content-range`.
+     * All configured header names are redacted in HTTP spans, in addition to
+     * the host's existing redaction rules.
+     *
+     * A name that is not an HTTP token, or a value longer than 16 KiB or
+     * carrying a control character (CR and LF included), is refused at
+     * construction as `invalid_configuration`.
+     */
+    readonly headers?: Record<string, string> | undefined;
+    /**
+     * The deadline on a single download, from the request leaving to the last
+     * body byte arriving. A shared tier that stops answering must fail the read
+     * rather than park it forever. `CombinedArtifacts.get` propagates a remote
+     * `ArtifactStoreError`, including a download timeout. Only opportunistic
+     * uploads from `CombinedArtifacts.put` ignore remote failures;
+     * `ArtifactSync.hydrate` separately turns a failure into replay rejection.
+     * Defaults to 60 seconds, Bazel's `--remote_timeout`
+     * default for the same REST protocol (its `RemoteOptions`: "For the REST
+     * cache, this is both the connect and the read timeout").
+     */
+    readonly downloadTimeout?: Duration.Input | undefined;
+    /**
+     * Deadline for an upload, including every resume probe and chunk. Defaults
+     * to 60 seconds.
+     */
+    readonly uploadTimeout?: Duration.Input | undefined;
+    /**
+     * Deadline for an existence probe or one `findMissing` batch, including its
+     * response body. Defaults to 60 seconds.
+     */
+    readonly requestTimeout?: Duration.Input | undefined;
+    /**
+     * The largest download this client will buffer, in bytes. The body is read
+     * incrementally and abandoned the moment it exceeds the bound — and refused
+     * outright when `Content-Length` already declares the excess — so a
+     * mis-serving or hostile cache cannot make this process buffer and hash an
+     * arbitrarily large body before the digest check refuses it. Defaults to
+     * 256 MiB.
+     */
+    readonly maxDownloadBytes?: number | undefined;
+    /**
+     * Largest `findMissing` response body accepted. Defaults to the protocol's
+     * 256 KiB request/response bound and may only lower that bound.
+     */
+    readonly maxFindMissingResponseBytes?: number | undefined;
+    /**
+     * Above this many bytes an upload travels as a sequence of `Content-Range`
+     * `PUT`s instead of one whole-blob body, and a transfer that died partway
+     * resumes from the prefix the tier kept rather than starting over. See
+     * {@link module:RemoteArtifacts | the chunked upload protocol} below.
+     *
+     * Absent by default: every upload is one whole-blob `PUT`, which is what
+     * Bazel's dumb-HTTP client does and what every deployment already serving
+     * this protocol expects. Set it when a proxy caps request bodies, or when
+     * artifacts are large enough that losing a transfer is expensive.
+     *
+     * The repository's own hosted and self-hosted cache services answer the
+     * ranged probe with `400`, so against them this dial degrades to one
+     * whole-blob `PUT`, and their 16 MiB body cap refuses a larger blob with
+     * `413` in either mode.
+     */
+    readonly chunkBytes?: number | undefined;
+    /**
+     * How eagerly a composition reading through this tier materializes blobs
+     * into its local store. This is Bazel's `--remote_download_{all,toplevel,
+     * minimal}` dial (`RemoteOutputChecker`), and it lives here because the
+     * shared tier is the thing being conserved.
+     *
+     * - `all` (the default) prefetches every referenced blob when a replay is
+     *   admitted, so the replay reads local bytes.
+     * - `toplevel` prefetches nothing and materializes a blob into the local
+     *   store on the first read that actually needs it.
+     * - `minimal` prefetches nothing and materializes nothing: a read is served
+     *   straight from the shared tier and the local store never grows.
+     *
+     * `CombinedArtifacts.get` honors the last two; `@smthrs/engine-store`'s
+     * `ArtifactSync.hydrate` honors the first.
+     */
+    readonly downloadPolicy?: DownloadPolicy | undefined;
+}
+/**
+ * Builds a remote artifact store over Effect's `HttpClient`.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export declare const make: (options: Options) => Effect.Effect<Service, ArtifactStore.ArtifactStoreError, HttpClient.HttpClient>;
+/**
+ * Provides a remote artifact store as the `ArtifactStore` tag.
+ *
+ * Composing this *alone* makes every artifact read and write a network round
+ * trip. The intended production shape is
+ * {@link CombinedArtifacts.layer | CombinedArtifacts}, with this as its remote
+ * tier.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export declare const layer: (options: Options) => Layer.Layer<ArtifactStore.ArtifactStore, ArtifactStore.ArtifactStoreError, HttpClient.HttpClient>;
+//# sourceMappingURL=RemoteArtifacts.d.ts.map

package/dist/cjs/RemoteArtifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemoteArtifacts.d.ts","sourceRoot":"","sources":["../../src/RemoteArtifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAIvC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAA;AAG7D,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,0DAA2D,CAAA;AAEtF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC,cAAc,CAAiD,CAAA;AAE5G;;;;;;GAMG;AACH,MAAM,WAAW,OAAQ,SAAQ,aAAa,CAAC,OAAO;IACpD,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;CACxC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,aAAa,CAAC,OAAO,KAAG,cAAc,GAAG,SAGhF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IACrD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IACnD;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IACpD;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9C;;;OAGG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;CACrD;AA4FD;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,GACf,SAAS,OAAO,KACf,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,kBAAkB,EAAE,UAAU,CAAC,UAAU,CA4c7E,CAAA;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,KAAK,GAChB,SAAS,OAAO,KACf,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,aAAa,CAAC,kBAAkB,EAAE,UAAU,CAAC,UAAU,CACzC,CAAA"}

package/dist/cjs/RemoteArtifacts.js

@@ -0,0 +1,405 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var RemoteArtifacts_exports = {};
+__export(RemoteArtifacts_exports, {
+  DownloadPolicy: () => DownloadPolicy,
+  downloadPolicies: () => downloadPolicies,
+  downloadPolicyOf: () => downloadPolicyOf,
+  layer: () => layer,
+  make: () => make
+});
+module.exports = __toCommonJS(RemoteArtifacts_exports);
+var Duration = __toESM(require("effect/Duration"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var Layer = __toESM(require("effect/Layer"), 1);
+var Option = __toESM(require("effect/Option"), 1);
+var Schema = __toESM(require("effect/Schema"), 1);
+var Stream = __toESM(require("effect/Stream"), 1);
+var FetchHttpClient = __toESM(require("effect/unstable/http/FetchHttpClient"), 1);
+var Headers = __toESM(require("effect/unstable/http/Headers"), 1);
+var HttpClient = __toESM(require("effect/unstable/http/HttpClient"), 1);
+var HttpClientRequest = __toESM(require("effect/unstable/http/HttpClientRequest"), 1);
+var ArtifactStore = __toESM(require("./ArtifactStore.js"), 1);
+const DownloadPolicy = Schema.Literals(["all", "toplevel", "minimal"]);
+const downloadPolicies = Object.freeze(["all", "toplevel", "minimal"]);
+const downloadPolicyOf = (store) => {
+  const declared = store.downloadPolicy;
+  return Schema.is(DownloadPolicy)(declared) ? declared : void 0;
+};
+const defaultDownloadTimeout = Duration.seconds(60);
+const defaultUploadTimeout = Duration.seconds(60);
+const defaultRequestTimeout = Duration.seconds(60);
+const defaultMaxDownloadBytes = 256 * 1024 * 1024;
+const maxFindMissingBatchDigests = 1e3;
+const maxFindMissingBodyBytes = 256 * 1024;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const transportReason = (cause) => {
+  const reason = cause?.reason;
+  const tag = typeof reason?._tag === "string" ? reason._tag : void 0;
+  let code;
+  let current = reason ?? cause;
+  for (let depth = 0; depth < 8 && typeof current === "object" && current !== null; depth++) {
+    const candidate = current.code;
+    if (typeof candidate === "string" && /^[A-Z][A-Z0-9_]{1,63}$/.test(candidate)) {
+      code = candidate;
+      break;
+    }
+    current = current.cause;
+  }
+  const parts = [tag, code].filter((part) => part !== void 0);
+  return parts.length === 0 ? void 0 : parts.join(" ");
+};
+const transportFailure = (operation, cause) => {
+  const reason = transportReason(cause);
+  return new ArtifactStore.ArtifactStoreError({
+    code: "transport_failed",
+    message: `the remote artifact tier refused ${operation}${reason === void 0 ? "" : ` (${reason})`}`
+  });
+};
+const unexpectedStatus = (operation, status) => new ArtifactStore.ArtifactStoreError({
+  code: "transport_failed",
+  message: `the remote artifact tier answered ${operation} with HTTP ${status}`
+});
+const invalidOption = (name) => new ArtifactStore.ArtifactStoreError({
+  code: "invalid_configuration",
+  message: `invalid remote artifact option: ${name}`
+});
+const FindMissingResponse = Schema.Struct({ missing: Schema.Array(Schema.String) });
+const headerName = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const hasControlText = (value) => {
+  for (let index = 0; index < value.length; index++) {
+    const unit = value.charCodeAt(index);
+    if (unit <= 31 || unit === 127) return true;
+  }
+  return false;
+};
+const configurationFailure = (message) => new ArtifactStore.ArtifactStoreError({ code: "invalid_configuration", message });
+const isOk = (response) => response.status >= 200 && response.status < 300;
+const make = (options) => Effect.gen(function* () {
+  const configured = yield* Effect.try({
+    try: () => {
+      const headers2 = options.headers === void 0 ? void 0 : Object.freeze(Object.fromEntries(
+        Object.entries(options.headers).map(([name, value]) => {
+          if (typeof value !== "string" || value.length > 16 * 1024 || hasControlText(value)) {
+            throw new TypeError("header value");
+          }
+          if (!headerName.test(name)) throw new TypeError("header name");
+          return [name, value];
+        })
+      ));
+      return {
+        endpoint: options.endpoint,
+        headers: headers2,
+        downloadTimeout: options.downloadTimeout,
+        uploadTimeout: options.uploadTimeout,
+        requestTimeout: options.requestTimeout,
+        maxDownloadBytes: options.maxDownloadBytes,
+        maxFindMissingResponseBytes: options.maxFindMissingResponseBytes,
+        chunkBytes: options.chunkBytes,
+        downloadPolicy: options.downloadPolicy
+      };
+    },
+    catch: () => invalidOption("options")
+  });
+  if (typeof configured.endpoint !== "string") return yield* Effect.fail(invalidOption("endpoint"));
+  const endpoint = yield* Effect.try({
+    try: () => new URL(configured.endpoint),
+    catch: () => configurationFailure("invalid remote artifact endpoint")
+  });
+  const loopback = endpoint.hostname === "localhost" || endpoint.hostname === "127.0.0.1" || endpoint.hostname === "[::1]";
+  if (endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && loopback)) {
+    return yield* Effect.fail(configurationFailure("remote artifact endpoint must use HTTPS"));
+  }
+  if (endpoint.username !== "" || endpoint.password !== "" || endpoint.search !== "" || endpoint.hash !== "") {
+    return yield* Effect.fail(
+      configurationFailure("remote artifact endpoint must not contain credentials, a query, or a fragment")
+    );
+  }
+  endpoint.pathname = endpoint.pathname.replace(/\/+$/, "");
+  const base = endpoint.toString().replace(/\/+$/, "");
+  const headers = configured.headers;
+  const client = yield* HttpClient.HttpClient;
+  const credentialNames = Object.keys(headers ?? {}).map((name) => name.toLowerCase());
+  const authorized = (request) => (headers === void 0 ? request : HttpClientRequest.setHeaders(request, headers)).pipe(
+    HttpClientRequest.removeHeader("content-type"),
+    HttpClientRequest.removeHeader("content-length"),
+    HttpClientRequest.removeHeader("content-range")
+  );
+  const casUrl = (digest) => `${base}/cas/${digest}`;
+  const scopedClient = HttpClient.withScope(client);
+  const send = (operation, request, use) => Effect.gen(function* () {
+    const redactedNames = yield* Headers.CurrentRedactedNames;
+    const requestInit = yield* Effect.serviceOption(FetchHttpClient.RequestInit);
+    return yield* scopedClient.execute(request).pipe(
+      Effect.provideService(FetchHttpClient.RequestInit, {
+        ...Option.getOrUndefined(requestInit),
+        redirect: "manual"
+      }),
+      Effect.mapError((cause) => transportFailure(operation, cause)),
+      Effect.flatMap(use),
+      Effect.provideService(Headers.CurrentRedactedNames, [...redactedNames, ...credentialNames]),
+      Effect.scoped
+    );
+  });
+  const parseDeadline = (name, input, fallback) => Effect.gen(function* () {
+    const parsed = Duration.fromInput(input ?? fallback);
+    if (Option.isNone(parsed) || !Number.isFinite(Duration.toMillis(parsed.value)) || Duration.toMillis(parsed.value) <= 0) {
+      return yield* Effect.fail(invalidOption(name));
+    }
+    return parsed.value;
+  });
+  const downloadDeadline = yield* parseDeadline(
+    "downloadTimeout",
+    configured.downloadTimeout,
+    defaultDownloadTimeout
+  );
+  const uploadDeadline = yield* parseDeadline("uploadTimeout", configured.uploadTimeout, defaultUploadTimeout);
+  const requestDeadline = yield* parseDeadline("requestTimeout", configured.requestTimeout, defaultRequestTimeout);
+  const maxDownloadBytes = configured.maxDownloadBytes ?? defaultMaxDownloadBytes;
+  if (!Number.isSafeInteger(maxDownloadBytes) || maxDownloadBytes <= 0) {
+    return yield* Effect.fail(invalidOption("maxDownloadBytes"));
+  }
+  const maxFindMissingResponseBytes = configured.maxFindMissingResponseBytes ?? maxFindMissingBodyBytes;
+  if (!Number.isSafeInteger(maxFindMissingResponseBytes) || maxFindMissingResponseBytes <= 0 || maxFindMissingResponseBytes > maxFindMissingBodyBytes) {
+    return yield* Effect.fail(invalidOption("maxFindMissingResponseBytes"));
+  }
+  const chunkBytes = configured.chunkBytes;
+  if (chunkBytes !== void 0 && (!Number.isSafeInteger(chunkBytes) || chunkBytes <= 0)) {
+    return yield* Effect.fail(invalidOption("chunkBytes"));
+  }
+  const downloadPolicy = configured.downloadPolicy ?? "all";
+  if (!Schema.is(DownloadPolicy)(downloadPolicy)) {
+    return yield* Effect.fail(invalidOption("downloadPolicy"));
+  }
+  const bodyTooLarge = (operation, received, bound) => new ArtifactStore.ArtifactStoreError({
+    code: "transport_failed",
+    message: `the remote artifact tier answered ${operation} with ${received} bytes, past the ${bound}-byte bound`
+  });
+  const timedOut = (operation) => new ArtifactStore.ArtifactStoreError({
+    code: "transport_failed",
+    message: `the remote artifact tier did not finish ${operation} within its configured deadline`
+  });
+  const within = (operation, deadline, effect) => effect.pipe(
+    Effect.timeout(deadline),
+    Effect.catchTag("TimeoutError", () => Effect.fail(timedOut(operation)))
+  );
+  const readBounded = (response, operation, bound) => Effect.gen(function* () {
+    const declared = response.headers["content-length"];
+    if (declared !== void 0) {
+      const declaredBytes = Number(declared);
+      if (!/^\d+$/.test(declared) || !Number.isSafeInteger(declaredBytes)) {
+        return yield* Effect.fail(transportFailure(`${operation} body`));
+      }
+      if (declaredBytes > bound) return yield* Effect.fail(bodyTooLarge(operation, declaredBytes, bound));
+    }
+    const chunks = [];
+    let received = 0;
+    yield* Stream.runForEach(response.stream, (chunk) => Effect.suspend(() => {
+      received += chunk.byteLength;
+      if (received > bound) return Effect.fail(bodyTooLarge(operation, received, bound));
+      chunks.push(new Uint8Array(chunk));
+      return Effect.void;
+    })).pipe(
+      Effect.catchTag("HttpClientError", (cause) => (
+        // An absent body is zero bytes, not a transport refusal: the
+        // digest check in `get` is the arbiter of whether empty content
+        // is the requested artifact.
+        cause.reason._tag === "EmptyBodyError" ? Effect.void : Effect.fail(transportFailure(`${operation} body`))
+      ))
+    );
+    const bytes = new Uint8Array(received);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return bytes;
+  });
+  const download = (digest) => send("a download", authorized(HttpClientRequest.get(casUrl(digest))), (response) => Effect.gen(function* () {
+    if (response.status === 404) {
+      return yield* Effect.fail(new ArtifactStore.ArtifactMissing({ code: "artifact_missing", digest }));
+    }
+    if (!isOk(response)) return yield* Effect.fail(unexpectedStatus("a download", response.status));
+    return yield* readBounded(response, "a download", maxDownloadBytes);
+  }));
+  const uploadWhole = (digest, bytes) => send(
+    "an upload",
+    authorized(HttpClientRequest.put(casUrl(digest))).pipe(
+      HttpClientRequest.bodyUint8Array(bytes, "application/octet-stream")
+    ),
+    (response) => isOk(response) ? Effect.void : Effect.fail(unexpectedStatus("an upload", response.status))
+  );
+  const resumeOffset = (response) => {
+    const header = response.headers["range"];
+    if (header === void 0) return void 0;
+    const match = /^bytes=0-(\d+)$/.exec(header.trim());
+    if (match === null) return void 0;
+    const last = Number(match[1]);
+    if (!Number.isSafeInteger(last)) return void 0;
+    return last + 1;
+  };
+  const rejectsRanges = (status) => status === 400 || status === 411 || status === 416;
+  const holdsWhole = (digest, total) => send("an existence probe", authorized(HttpClientRequest.head(casUrl(digest))), (response) => Effect.sync(() => {
+    if (!isOk(response)) return false;
+    const declared = response.headers["content-length"];
+    return declared !== void 0 && Number(declared) === total;
+  }));
+  const uploadChunked = (digest, bytes, chunk) => Effect.gen(function* () {
+    const total = bytes.byteLength;
+    const ranged = (range, body) => send(
+      "an upload",
+      authorized(HttpClientRequest.put(casUrl(digest))).pipe(
+        HttpClientRequest.bodyUint8Array(body, "application/octet-stream"),
+        HttpClientRequest.setHeader("content-range", range)
+      ),
+      // Only status and headers are used after the response is released.
+      Effect.succeed
+    );
+    if (yield* holdsWhole(digest, total)) return true;
+    const probe = yield* ranged(`bytes */${total}`, new Uint8Array(0));
+    if (isOk(probe) || rejectsRanges(probe.status)) return false;
+    if (probe.status !== 308 && probe.status !== 404) {
+      return yield* Effect.fail(unexpectedStatus("an upload probe", probe.status));
+    }
+    let offset = probe.status === 308 ? resumeOffset(probe) ?? 0 : 0;
+    while (offset < total) {
+      const end = Math.min(offset + chunk, total);
+      const answer = yield* ranged(`bytes ${offset}-${end - 1}/${total}`, bytes.subarray(offset, end));
+      if (answer.status !== 308) {
+        if (end === total && isOk(answer)) break;
+        if (isOk(answer) || rejectsRanges(answer.status)) return false;
+        return yield* Effect.fail(unexpectedStatus("an upload", answer.status));
+      }
+      offset = Math.max(end, resumeOffset(answer) ?? 0);
+    }
+    return yield* holdsWhole(digest, total);
+  });
+  const put = Effect.fn("RemoteArtifacts.put")(
+    (bytes) => Effect.flatMap(ArtifactStore.snapshotBytes(bytes), (snapshot) => Effect.gen(function* () {
+      const digest = yield* ArtifactStore.measureBytes(snapshot);
+      yield* Effect.annotateCurrentSpan({ digest });
+      yield* within(
+        "an upload",
+        uploadDeadline,
+        Effect.gen(function* () {
+          if (chunkBytes === void 0 || snapshot.byteLength <= chunkBytes) {
+            yield* uploadWhole(digest, snapshot);
+            return;
+          }
+          const transferred = yield* uploadChunked(digest, snapshot, chunkBytes);
+          if (!transferred) yield* uploadWhole(digest, snapshot);
+        })
+      );
+      return digest;
+    }))
+  );
+  const get = Effect.fn("RemoteArtifacts.get")(
+    (digest) => Effect.gen(function* () {
+      const validated = yield* ArtifactStore.validateDigest(digest);
+      yield* Effect.annotateCurrentSpan({ digest: validated });
+      const bytes = yield* within("a download", downloadDeadline, download(validated));
+      const measured = yield* ArtifactStore.measureBytes(bytes);
+      if (measured !== validated) {
+        return yield* Effect.fail(
+          new ArtifactStore.ArtifactCorruption({
+            code: "artifact_corruption",
+            recordedDigest: validated,
+            measuredDigest: measured
+          })
+        );
+      }
+      return bytes;
+    })
+  );
+  const has = Effect.fn("RemoteArtifacts.has")(
+    (digest) => Effect.gen(function* () {
+      const validated = yield* ArtifactStore.validateDigest(digest);
+      yield* Effect.annotateCurrentSpan({ digest: validated });
+      const response = yield* within(
+        "an existence probe",
+        requestDeadline,
+        send("an existence probe", authorized(HttpClientRequest.head(casUrl(validated))), Effect.succeed)
+      );
+      if (response.status === 404) return false;
+      if (!isOk(response)) return yield* Effect.fail(unexpectedStatus("an existence probe", response.status));
+      return true;
+    })
+  );
+  const findMissing = Effect.fn("RemoteArtifacts.findMissing")(
+    (digests) => Effect.gen(function* () {
+      const requested = [...new Set(digests)];
+      if (requested.length === 0) return [];
+      const validated = [];
+      for (const digest of requested) validated.push(yield* ArtifactStore.validateDigest(digest));
+      yield* Effect.annotateCurrentSpan({ count: validated.length });
+      const missing = /* @__PURE__ */ new Set();
+      for (let offset = 0; offset < validated.length; offset += maxFindMissingBatchDigests) {
+        const batch = validated.slice(offset, offset + maxFindMissingBatchDigests);
+        const requestBody = encoder.encode(JSON.stringify({ digests: batch }));
+        if (requestBody.byteLength > maxFindMissingBodyBytes) {
+          return yield* Effect.fail(configurationFailure("remote artifact findMissing request exceeds 256 KiB"));
+        }
+        const decoded = yield* within(
+          "a batched existence probe",
+          requestDeadline,
+          send(
+            "a batched existence probe",
+            authorized(HttpClientRequest.post(`${base}/cas/findMissing`)).pipe(
+              HttpClientRequest.bodyUint8Array(requestBody, "application/json")
+            ),
+            (response) => Effect.gen(function* () {
+              if (!isOk(response)) {
+                return yield* Effect.fail(unexpectedStatus("a batched existence probe", response.status));
+              }
+              const bodyBytes = yield* readBounded(
+                response,
+                "a batched existence probe",
+                maxFindMissingResponseBytes
+              );
+              const body = yield* Effect.try({
+                try: () => JSON.parse(decoder.decode(bodyBytes)),
+                catch: () => transportFailure("a batched existence probe body")
+              });
+              return yield* Schema.decodeUnknownEffect(FindMissingResponse)(body).pipe(
+                Effect.mapError(() => transportFailure("a batched existence probe body"))
+              );
+            })
+          )
+        );
+        const asked = new Set(batch);
+        for (const digest of decoded.missing) if (asked.has(digest)) missing.add(digest);
+      }
+      return validated.filter((digest) => missing.has(digest));
+    })
+  );
+  return { put, get, has, findMissing, downloadPolicy };
+});
+const layer = (options) => Layer.effect(ArtifactStore.ArtifactStore)(make(options));
+//# sourceMappingURL=RemoteArtifacts.js.map