@smthrs/artifacts 1.0.0-rc.7 → 1.0.0-rc.9

package/src/ArtifactBackupLease.ts

@@ -124,9 +124,10 @@ export const withLease = <A, E, R, E2>(
         acquire.pipe(Effect.andThen(
           Effect.scoped(Effect.gen(function*() {
             yield* Effect.forkScoped(
-              Effect.forever(
-                Effect.sleep(heartbeatEvery).pipe(
-                  Effect.andThen(gate(
+              Effect.gen(function*() {
+                while (true) {
+                  yield* Effect.sleep(heartbeatEvery)
+                  const reclaimed = yield* gate(
                     fs,
                     directory,
                     fs.readFileString(marker).pipe(
@@ -139,27 +140,36 @@ export const withLease = <A, E, R, E2>(
                         // lease stale and reaped it: deletion is no longer
                         // fenced while the backup still copies. The sibling
                         // `internal/ArtifactLocks.ts` heartbeat reports the same
-                        // loss the same way.
+                        // loss the same way. A reaped marker is never handed
+                        // back, so the loss is reported once and the heartbeat
+                        // ends instead of repeating it every tick.
                         if (Option.getOrUndefined(found) !== owner) {
-                          return Effect.logWarning(
-                            "Artifact backup lease was reclaimed while its backup was still running"
+                          return Effect.as(
+                            Effect.logWarning(
+                              "Artifact backup lease was reclaimed while its backup was still running"
+                            ),
+                            true
                           )
                         }
                         return Effect.flatMap(Clock.currentTimeMillis, (now) => {
                           const timestamp = new Date(now)
-                          return fs.utimes(marker, timestamp, timestamp)
+                          return Effect.as(fs.utimes(marker, timestamp, timestamp), false)
                         })
                       }),
                       Effect.mapError(failure)
                     ),
                     failure
-                  )),
-                  // A failed heartbeat is retried on the next tick, but a
-                  // minute of them lets the marker go stale, so each one is
-                  // reported rather than dropped.
-                  Effect.catch((cause) => Effect.logWarning("Artifact backup lease heartbeat failed", cause))
-                )
-              )
+                  ).pipe(
+                    // A failed heartbeat is retried on the next tick, but a
+                    // minute of them lets the marker go stale, so each one is
+                    // reported rather than dropped.
+                    Effect.catch((cause) =>
+                      Effect.as(Effect.logWarning("Artifact backup lease heartbeat failed", cause), false)
+                    )
+                  )
+                  if (reclaimed) return
+                }
+              })
             )
             return yield* effect
           }))

package/src/ArtifactSweep.ts

@@ -241,6 +241,17 @@ export const makeFileSystem = (
   const remove: Service["remove"] = Effect.fn("ArtifactSweep.remove")((digest, removeOptions) =>
     Effect.gen(function*() {
       const validated = yield* ArtifactStore.validateDigest(digest)
+      const bound = removeOptions?.ifUnmodifiedSinceMs
+      // NaN fails every comparison, so the fence below would read it as "not
+      // modified since" and delete a blob a concurrent put just freshened.
+      if (bound !== undefined && (typeof bound !== "number" || Number.isNaN(bound))) {
+        return yield* Effect.fail(
+          new ArtifactStore.ArtifactStoreError({
+            code: "invalid_configuration",
+            message: "invalid sweep option: ifUnmodifiedSinceMs"
+          })
+        )
+      }
       yield* Effect.annotateCurrentSpan({ digest: validated })
       const checkRoot = yield* ArtifactPath.guard(fs, directory).pipe(Effect.mapError(hostFailure))
       const checkParent = yield* ArtifactPath.guard(fs, `${directory}/${validated.slice(0, 2)}`).pipe(
@@ -265,7 +276,6 @@ export const makeFileSystem = (
           yield* checkRoot.pipe(Effect.mapError(hostFailure))
           yield* checkParent.pipe(Effect.mapError(hostFailure))
           const checkBlob = yield* ArtifactPath.guard(fs, path, "File").pipe(Effect.mapError(hostFailure))
-          const bound = removeOptions?.ifUnmodifiedSinceMs
           if (bound !== undefined) {
             const info = yield* fs.stat(path).pipe(Effect.option)
             // Already gone is a completed deletion, and an unmeasurable mtime is

package/src/FileLease.ts

@@ -37,7 +37,7 @@
 
 import * as Clock from "effect/Clock"
 import * as Deferred from "effect/Deferred"
-import type * as Duration from "effect/Duration"
+import * as Duration from "effect/Duration"
 import * as Effect from "effect/Effect"
 import type * as FileSystem from "effect/FileSystem"
 import * as Option from "effect/Option"
@@ -57,7 +57,11 @@ export interface Options {
   readonly annotations?: Readonly<Record<string, unknown>> | undefined
   /** How often the holder refreshes the lock's mtime. Defaults to 10 seconds. */
   readonly heartbeatEvery?: Duration.Input | undefined
-  /** Age past which a lock or claim is stale. Defaults to 60 000 ms. */
+  /**
+   * Age past which a lock or claim is stale. Defaults to 60 000 ms. Must be a
+   * finite positive number longer than `heartbeatEvery`; anything else fails
+   * the lease through `failure` before the lock is touched.
+   */
   readonly staleAfterMs?: number | undefined
   /** How long acquisition may wait. Defaults to 2 minutes. */
   readonly acquireWithin?: Duration.Input | undefined
@@ -132,6 +136,19 @@ export const hold = <A, E, R, E2>(
     const heartbeatEvery = options.heartbeatEvery ?? "10 seconds"
     const staleAfterMs = options.staleAfterMs ?? defaultStaleAfterMs
     const retryEvery = options.retryEvery ?? "25 millis"
+    // A holder heartbeats its lock to stay fresh, so a stale bound at or below
+    // the heartbeat, or one that is not a positive finite number, would let a
+    // contender read a live holder's lock as abandoned and move it, or would
+    // never reclaim a dead holder's lock at all.
+    const heartbeatMs = Option.map(Duration.fromInput(heartbeatEvery), Duration.toMillis)
+    if (
+      typeof staleAfterMs !== "number" || !Number.isFinite(staleAfterMs) || staleAfterMs <= 0 ||
+      Option.isNone(heartbeatMs) || !(heartbeatMs.value > 0 && heartbeatMs.value < staleAfterMs)
+    ) {
+      return yield* Effect.fail(
+        failure(new RangeError(`${label} needs 0 < heartbeatEvery < staleAfterMs, with a finite staleAfterMs`))
+      )
+    }
     const owner = yield* token
     /**
      * Whether this call created the lock file, and therefore owes a release.

package/src/RemoteArtifacts.ts

@@ -376,7 +376,12 @@ export const make = (
     if (endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && loopback)) {
       return yield* Effect.fail(configurationFailure("remote artifact endpoint must use HTTPS"))
     }
-    if (endpoint.username !== "" || endpoint.password !== "" || endpoint.search !== "" || endpoint.hash !== "") {
+    // An empty query or fragment ("https://h/p?") parses as "" yet survives
+    // serialization, so the delimiter itself is refused in the href.
+    if (
+      endpoint.username !== "" || endpoint.password !== "" || endpoint.search !== "" || endpoint.hash !== "" ||
+      endpoint.href.includes("?") || endpoint.href.includes("#")
+    ) {
       return yield* Effect.fail(
         configurationFailure("remote artifact endpoint must not contain credentials, a query, or a fragment")
       )