effect 4.1.0 → 4.1.2

package/src/cluster/Entity.ts

@@ -148,7 +148,20 @@ export interface Entity<
       readonly concurrency?: number | "unbounded" | undefined
       readonly mailboxCapacity?: number | "unbounded" | undefined
       readonly mailboxMetrics?: boolean | undefined
+      /**
+       * When `true`, a handler defect fails only its request instead of
+       * restarting the entity and replaying its in-flight requests.
+       */
       readonly disableFatalDefects?: boolean | undefined
+      /**
+       * Schedule for restarting an entity after a defect and for retrying failed
+       * handler construction.
+       *
+       * Backoff is tracked per entity and resets once a request completes.
+       * When the policy ends, the default (500 ms growing by 1.5x, capped at 10
+       * seconds) continues, so restarts never stop; use `disableFatalDefects` to
+       * avoid them.
+       */
       readonly defectRetryPolicy?: Schedule.Schedule<any, unknown> | undefined
       readonly spanAttributes?: Record<string, string> | undefined
     }
@@ -193,7 +206,20 @@ export interface Entity<
       readonly maxIdleTime?: Duration.Input | undefined
       readonly mailboxCapacity?: number | "unbounded" | undefined
       readonly mailboxMetrics?: boolean | undefined
+      /**
+       * When `true`, a handler defect fails only its request instead of
+       * restarting the entity and replaying its in-flight requests.
+       */
       readonly disableFatalDefects?: boolean | undefined
+      /**
+       * Schedule for restarting an entity after a defect and for retrying failed
+       * handler construction.
+       *
+       * Backoff is tracked per entity and resets once a request completes.
+       * When the policy ends, the default (500 ms growing by 1.5x, capped at 10
+       * seconds) continues, so restarts never stop; use `disableFatalDefects` to
+       * avoid them.
+       */
       readonly defectRetryPolicy?: Schedule.Schedule<any, unknown> | undefined
       readonly spanAttributes?: Record<string, string> | undefined
     }
@@ -290,7 +316,20 @@ const Proto = {
       readonly concurrency?: number | "unbounded" | undefined
       readonly mailboxCapacity?: number | "unbounded" | undefined
       readonly mailboxMetrics?: boolean | undefined
+      /**
+       * When `true`, a handler defect fails only its request instead of
+       * restarting the entity and replaying its in-flight requests.
+       */
       readonly disableFatalDefects?: boolean | undefined
+      /**
+       * Schedule for restarting an entity after a defect and for retrying failed
+       * handler construction.
+       *
+       * Backoff is tracked per entity and resets once a request completes.
+       * When the policy ends, the default (500 ms growing by 1.5x, capped at 10
+       * seconds) continues, so restarts never stop; use `disableFatalDefects` to
+       * avoid them.
+       */
       readonly defectRetryPolicy?: Schedule.Schedule<any, unknown> | undefined
       readonly spanAttributes?: Record<string, string> | undefined
     }
@@ -339,7 +378,20 @@ const Proto = {
       readonly maxIdleTime?: Duration.Input | undefined
       readonly mailboxCapacity?: number | "unbounded" | undefined
       readonly mailboxMetrics?: boolean | undefined
+      /**
+       * When `true`, a handler defect fails only its request instead of
+       * restarting the entity and replaying its in-flight requests.
+       */
       readonly disableFatalDefects?: boolean | undefined
+      /**
+       * Schedule for restarting an entity after a defect and for retrying failed
+       * handler construction.
+       *
+       * Backoff is tracked per entity and resets once a request completes.
+       * When the policy ends, the default (500 ms growing by 1.5x, capped at 10
+       * seconds) continues, so restarts never stop; use `disableFatalDefects` to
+       * avoid them.
+       */
       readonly defectRetryPolicy?: Schedule.Schedule<any, unknown> | undefined
       readonly spanAttributes?: Record<string, string> | undefined
     }

package/src/cluster/MessageStorage.ts

@@ -30,6 +30,7 @@ import * as DeliverAt from "./DeliverAt.ts"
 import type { EntityAddress } from "./EntityAddress.ts"
 import * as Envelope from "./Envelope.ts"
 import * as ClusterAbandon from "./internal/clusterAbandon.ts"
+import { TransactionNotifications } from "./internal/transactionNotifications.ts"
 import * as Message from "./Message.ts"
 import * as Reply from "./Reply.ts"
 import * as ShardId from "./ShardId.ts"
@@ -223,8 +224,8 @@ export class MessageStorage extends Context.Service<MessageStorage, {
   /**
    * Wraps requests in storage transactions.
    *
-   * `WithExit` replies saved in a transaction notify callers after the outermost
-   * commit; stream chunks notify immediately. Replies saved in a failed
+   * `WithExit` replies and discarded sends saved in a transaction notify after
+   * the outermost commit; stream chunks notify immediately. Replies saved in a failed
    * transaction must be discarded. The wrapper may fail only with the wrapped
    * effect's own failure or a defect.
    */
@@ -532,10 +533,6 @@ export type EncodedRepliesOptions<A> = {
   readonly cursor: Option.Option<A>
 }
 
-const TransactionNotifications = Context.Reference<
-  Array<Effect.Effect<void, PersistenceError | MalformedMessage>> | undefined
->("effect/cluster/MessageStorage/TransactionNotifications", { defaultValue: () => undefined })
-
 /**
  * Wraps a concrete message storage implementation with reply-handler management.
  *

package/src/cluster/Reply.ts

@@ -220,7 +220,7 @@ export class Chunk<R extends Rpc.Any> extends Data.TaggedClass("Chunk")<{
    * @stability unstable
    * @since 4.0.0
    */
-  static readonly Any = Schema.declare((u): u is Chunk<never> => isReply(u) && u._tag === "Chunk")
+  static readonly Any = Schema.declare((u): u is Chunk<Rpc.Any> => isReply(u) && u._tag === "Chunk")
 
   /**
    * Transformation between encoded chunk records and `Chunk` instances.

package/src/cluster/Runners.ts

@@ -32,6 +32,7 @@ import type { MalformedMessage, PersistenceError } from "./ClusterError.ts"
 import { AlreadyProcessingMessage, EntityNotAssignedToRunner, MailboxFull, RunnerUnavailable } from "./ClusterError.ts"
 import { Persisted } from "./ClusterSchema.ts"
 import * as Envelope from "./Envelope.ts"
+import { TransactionNotifications } from "./internal/transactionNotifications.ts"
 import * as Message from "./Message.ts"
 import * as MessageStorage from "./MessageStorage.ts"
 import * as Reply from "./Reply.ts"
@@ -180,6 +181,19 @@ export const make: (
 
   const requestIdRewrites = new Map<Snowflake.Snowflake, Snowflake.Snowflake>()
 
+  // A message saved in a transaction is invisible to readers until the commit,
+  // so its wake-up waits for the commit. A failure then can no longer be
+  // returned and is dropped; the next storage poll delivers the message.
+  const notifyAfterCommit = <E>(message: Message.Outgoing<any>, notify: Effect.Effect<void, E>) => {
+    const rpc = message.rpc as any as Rpc.AnyWithProps
+    if (!Context.get(rpc.annotations, Persisted)) return notify
+    return TransactionNotifications.use((notifications) =>
+      notifications === undefined ? notify : Effect.sync(() => {
+        notifications.push(Effect.ignore(notify))
+      })
+    )
+  }
+
   function notifyWith<E>(
     message: Message.Outgoing<any>,
     afterPersist: (message: Message.Outgoing<any>, isDuplicate: boolean) => Effect.Effect<void, E>
@@ -471,7 +485,7 @@ export const make: (
       const { discard, message } = options_
       return notifyWith(message, (message, duplicate) => {
         if (discard || message._tag === "OutgoingEnvelope") {
-          return options.notify(options_)
+          return notifyAfterCommit(message, options.notify(options_))
         } else if (!duplicate && Option.isSome(options_.address)) {
           return Effect.catch(
             options.send({
@@ -499,7 +513,7 @@ export const make: (
       }
       return notifyWith(message, (message) => {
         if (options.discard || message._tag === "OutgoingEnvelope") {
-          return notifyEntity(message)
+          return notifyAfterCommit(message, notifyEntity(message))
         }
         return Effect.andThen(
           notifyEntity(message),

package/src/cluster/Sharding.ts

@@ -143,7 +143,20 @@ export class Sharding extends Context.Service<Sharding, {
       readonly concurrency?: number | "unbounded" | undefined
       readonly mailboxCapacity?: number | "unbounded" | undefined
       readonly mailboxMetrics?: boolean | undefined
+      /**
+       * When `true`, a handler defect fails only its request instead of
+       * restarting the entity and replaying its in-flight requests.
+       */
       readonly disableFatalDefects?: boolean | undefined
+      /**
+       * Schedule for restarting an entity after a defect and for retrying failed
+       * handler construction.
+       *
+       * Backoff is tracked per entity and resets once a request completes.
+       * When the policy ends, the default (500 ms growing by 1.5x, capped at 10
+       * seconds) continues, so restarts never stop; use `disableFatalDefects` to
+       * avoid them.
+       */
       readonly defectRetryPolicy?: Schedule.Schedule<any, unknown> | undefined
       readonly spanAttributes?: Record<string, string> | undefined
     }
@@ -1697,7 +1710,10 @@ const make = Effect.gen(function*() {
               }
               clientRequests.set(id, entry)
               respond = makeClientRespond(entry, client.write)
-              return sendOutgoing(message, false)
+              // A failed send leaves no reply or interrupt to release the entry.
+              // Only drop the local bookkeeping, as the request may have been
+              // persisted.
+              return Effect.tapError(sendOutgoing(message, false), () => Effect.sync(() => clientRequests.delete(id)))
             }
             case "Ack": {
               const requestId = Snowflake.Snowflake(options.message.requestId)

package/src/cluster/internal/clusterAbandon.ts

@@ -1,14 +1,14 @@
 import type * as Cause from "../../Cause.ts"
 import * as Effect from "../../Effect.ts"
-import * as Fiber from "../../Fiber.ts"
 import { Abandon } from "../ClusterSchema.ts"
 
-export const interrupt: Effect.Effect<never> = Effect.interruptible(
-  Effect.callback<never>(() => {
-    const fiber = Fiber.getCurrent()!
-    fiber.interruptUnsafe(fiber.id, Abandon.annotation)
-  })
-)
+// Annotate before opening the interruptible region. An interrupt already
+// pending on an uninterruptible fiber fires as soon as the region opens, and
+// the annotation is merged into that pending cause instead of being lost.
+export const interrupt: Effect.Effect<never> = Effect.withFiber((fiber) => {
+  fiber.interruptUnsafe(fiber.id, Abandon.annotation)
+  return Effect.interruptible(Effect.never)
+})
 
 export const isCause = (cause: Cause.Cause<unknown>): boolean =>
   cause.reasons.some((reason) => reason._tag === "Interrupt" && reason.annotations.has(Abandon.key))

package/src/cluster/internal/entityManager.ts

@@ -116,6 +116,10 @@ export type EntityState = {
     /** Set when the request should not outlive its caller. */
     callerScope?: Scope.Scope | undefined
     transaction?: RequestTransaction | undefined
+    /** Set when an interrupt arrives while no handlers are ready. */
+    interrupted?: boolean | undefined
+    /** The handler generation the remembered interrupt was last sent to. */
+    interruptSentTo?: EntityState["write"] | undefined
   }>
   lastActiveCheck: number
   write: RpcServer.RpcServer<any>["write"]
@@ -172,7 +176,7 @@ export const make = Effect.fnUntraced(function*<
   const defectRetryPolicy = options.defectRetryPolicy
     ? Schedule.concat(options.defectRetryPolicy, defaultRetryPolicy)
     : defaultRetryPolicy
-  const retryDriver = yield* Schedule.toStepWithSleep(defectRetryPolicy)
+  const newRestartStep = Schedule.toStepWithSleep(defectRetryPolicy)
   const entityRpcs = new Map(entity.protocol.requests)
 
   // The series reads the mailbox size on snapshot, so delivery does no extra work.
@@ -294,13 +298,38 @@ export const make = Effect.fnUntraced(function*<
     const retired = Latch.makeUnsafe()
     const isActive = () => !retired.isOpen()
 
+    // Per-activation restart backoff, reset when a request completes.
+    let restartStep: Effect.Success<typeof newRestartStep> | undefined
+    const restartDelay = Effect.gen(function*() {
+      restartStep ??= yield* newRestartStep
+      yield* restartStep(void 0)
+    })
+
+    // An interrupted request is not run again. The server answers the
+    // interrupt as it would for a request without a running handler. Each
+    // generation receives it at most once, and the flag stays so a later
+    // generation still applies it if this one fails first.
+    const writeInterrupt = (
+      request: {
+        readonly message: Message.IncomingRequestLocal<any>
+        interruptSentTo?: EntityState["write"] | undefined
+      },
+      write: EntityState["write"]
+    ): Effect.Effect<void> => {
+      if (request.interruptSentTo === write) return Effect.void
+      request.interruptSentTo = write
+      return write(0, interruptEnvelope(request))
+    }
+
     // Replay previously dispatched requests before admitting new work.
     const replay = Effect.fnUntraced(function*(write: EntityState["write"]) {
       if (!isActive()) return
       for (const request of activeRequests.values()) {
         if (!request.delivered) continue
         request.sentExit = false
-        yield* write(0, requestEnvelope(request), requestWriteOptions(request))
+        yield* request.interrupted
+          ? writeInterrupt(request, write)
+          : write(0, requestEnvelope(request), requestWriteOptions(request))
       }
     })
 
@@ -369,8 +398,11 @@ export const make = Effect.fnUntraced(function*<
                     )
                   }
                 }
+                // A failed save can abort the request transaction, so a retry
+                // could store a success outside it. Save once and let the
+                // failed transaction replay the request.
                 const write = retryRespond(
-                  4,
+                  persisted && request.transaction && Exit.isSuccess(response.exit) ? 0 : 4,
                   Effect.suspend(() =>
                     request.message.respond(
                       new Reply.WithExit({
@@ -402,13 +434,31 @@ export const make = Effect.fnUntraced(function*<
                   )
                 })
                 const complete = Effect.sync(() => {
+                  restartStep = undefined
                   if (storageEnabled) {
                     processedRequestIds.add(request.message.envelope.requestId)
                   }
                   removeActiveRequest(Snowflake.Snowflake(response.requestId))
                 })
+                // Let callers read the saved reply instead of waiting on a
+                // handler that will never be resumed.
+                const completeFromStorage = Effect.andThen(
+                  complete,
+                  options.storage.unregisterReplyHandler(request.message.envelope.requestId)
+                )
                 const respond = Effect.andThen(save, complete).pipe(
                   Effect.catchTag("EntityNotAssignedToRunner", () => abandonFenced),
+                  // A save can commit and still fail, e.g. when the COMMIT
+                  // acknowledgement is lost. Volatile requests skip the lookup:
+                  // their replies are never stored, and a storage read could
+                  // stall a custom responder's failure.
+                  Effect.catchTag("PersistenceError", (error) =>
+                    persisted
+                      ? Effect.flatMap(
+                        hasStoredExit(request.message.envelope.requestId),
+                        (committed) => committed ? completeFromStorage : Effect.fail(error)
+                      )
+                      : Effect.fail(error)),
                   Effect.orDie
                 )
                 const transaction = request.transaction
@@ -427,16 +477,10 @@ export const make = Effect.fnUntraced(function*<
                     // A rejected save failed the transaction, rolling back the
                     // handler's writes; the request is left for the owner.
                     if (fenced) return abandonFenced
+                    // The commit can succeed despite the error.
                     return Effect.flatMap(
                       hasStoredExit(request.message.envelope.requestId),
-                      (committed) => {
-                        if (!committed) return restartFrom(outcome.cause)
-                        // Commit succeeded despite the error; let callers read the saved reply.
-                        return Effect.andThen(
-                          complete,
-                          options.storage.unregisterReplyHandler(request.message.envelope.requestId)
-                        )
-                      }
+                      (committed) => committed ? completeFromStorage : restartFrom(outcome.cause)
                     )
                   }
                   return Effect.orDie(save)
@@ -513,10 +557,22 @@ export const make = Effect.fnUntraced(function*<
       address
     )
 
+    // Forward interrupts remembered after their request was replayed, which
+    // the replacement handlers have not seen yet.
+    const forwardInterrupts = Effect.suspend(() => {
+      const write = writeRef.getUnsafe()
+      if (write === undefined) return Effect.void
+      const interrupts: Array<Effect.Effect<void>> = []
+      for (const request of activeRequests.values()) {
+        if (request.interrupted) interrupts.push(writeInterrupt(request, write))
+      }
+      return Effect.all(interrupts, { discard: true })
+    })
+
     function restart(cause: Cause.Cause<unknown>, rebuild: Effect.Effect<void>): Effect.Effect<void> {
       return Effect.logError("Defect in entity, restarting", cause).pipe(
-        Effect.andThen(Effect.ignore(retryDriver(void 0))),
-        Effect.flatMap(() => isActive() ? rebuild : endLatch.open),
+        Effect.andThen(Effect.ignore(restartDelay)),
+        Effect.flatMap(() => isActive() ? Effect.andThen(rebuild, forwardInterrupts) : endLatch.open),
         Effect.annotateLogs({
           module: "EntityManager",
           address,
@@ -538,6 +594,16 @@ export const make = Effect.fnUntraced(function*<
           if (message._tag !== "Request") {
             // Interrupts, acks and EOF reach the handlers even during shutdown.
             const write = writeRef.getUnsafe()
+            if (write === undefined && message._tag === "Interrupt") {
+              // Waiting could stall the sender indefinitely if every rebuild
+              // fails, so remember the interrupt for the next generation.
+              // Uninterruptible requests ignore it.
+              const request = activeRequests.get(Snowflake.Snowflake(message.requestId))
+              if (request && !isUninterruptibleForServer(request.message.annotations)) {
+                request.interrupted = true
+              }
+              return Effect.void
+            }
             return write
               ? write(clientId, message, writeOptions)
               : Effect.flatMap(writeRef.await, (write) => write(clientId, message, writeOptions))
@@ -553,7 +619,7 @@ export const make = Effect.fnUntraced(function*<
           const request = activeRequests.get(Snowflake.Snowflake(message.id))
           if (!request) return Effect.void
           request.delivered = true
-          return write(clientId, message, writeOptions)
+          return request.interrupted ? writeInterrupt(request, write) : write(clientId, message, writeOptions)
         })
       },
       activeRequests,
@@ -977,7 +1043,7 @@ const makeMessageDecode = <Rpcs extends Rpc.Any>(entityRpcs: Map<string, Rpcs>)
         )
       )
     }
-    return decodeRequest(message, rpc) as Effect.Effect<
+    return decodeRequest(message, rpc) as any as Effect.Effect<
       {
         readonly _tag: "IncomingRequest"
         readonly envelope: Envelope.Request.Any
@@ -1002,6 +1068,14 @@ const requestEnvelope = (entry: {
   } as any) as any
 })
 
+const interruptEnvelope = (entry: {
+  readonly message: Message.IncomingRequestLocal<any>
+}): Parameters<EntityState["write"]>[1] => ({
+  _tag: "Interrupt",
+  requestId: entry.message.envelope.requestId as any,
+  interruptors: []
+})
+
 const retryRespond = <A, E, R>(times: number, effect: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>
   times === 0 ?
     effect :

package/src/cluster/internal/transactionNotifications.ts

@@ -0,0 +1,7 @@
+import * as Context from "../../Context.ts"
+import type * as Effect from "../../Effect.ts"
+import type { MalformedMessage, PersistenceError } from "../ClusterError.ts"
+
+export const TransactionNotifications = Context.Reference<
+  Array<Effect.Effect<void, PersistenceError | MalformedMessage>> | undefined
+>("effect/cluster/MessageStorage/TransactionNotifications", { defaultValue: () => undefined })

package/src/crypto/Aead.ts

@@ -37,7 +37,7 @@ import * as Chacha from "./internal/chacha.ts"
 import * as KeyModel from "./internal/key.ts"
 import * as internal from "./internal/webCrypto.ts"
 import * as SecureRandom from "./SecureRandom.ts"
-import { WebCrypto } from "./WebCrypto.ts"
+import * as WebCrypto from "./WebCrypto.ts"
 
 const TypeId = "~effect/crypto/Aead/Key" as const
 
@@ -374,7 +374,7 @@ export const layerWebCryptoWith = (options: {
     Aead,
     Effect.gen(function*() {
       const random = yield* SecureRandom.SecureRandom
-      const crypto = yield* WebCrypto
+      const crypto = yield* WebCrypto.WebCrypto
       const cryptoKeyFor = KeyModel.makeCache((subtle, bytes) =>
         subtle.importKey("raw", bytes as BufferSource, "AES-GCM", false, ["encrypt", "decrypt"])
       )
@@ -488,7 +488,7 @@ export const key = <A extends Algorithm>(
  */
 export const fromCryptoKey = <A extends AesGcm>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<Key<A>, CryptoError.CryptoError> =>
   algorithm.implementation !== undefined
     ? internal.invalidKey("Aead", "fromCryptoKey", `${algorithm.name} keys cannot be CryptoKeys`)

package/src/crypto/Cipher.ts

@@ -35,7 +35,7 @@ import * as CryptoError from "./CryptoError.ts"
 import * as KeyModel from "./internal/key.ts"
 import * as internal from "./internal/webCrypto.ts"
 import * as SecureRandom from "./SecureRandom.ts"
-import { WebCrypto } from "./WebCrypto.ts"
+import * as WebCrypto from "./WebCrypto.ts"
 
 const TypeId = "~effect/crypto/Cipher/Key" as const
 
@@ -217,7 +217,7 @@ export const layerWebCrypto: Layer.Layer<Cipher, never, SecureRandom.SecureRando
   Cipher,
   Effect.gen(function*() {
     const random = yield* SecureRandom.SecureRandom
-    const crypto = yield* WebCrypto
+    const crypto = yield* WebCrypto.WebCrypto
     const cryptoKeyFor = KeyModel.makeCache((subtle, bytes, algorithm: Algorithm) =>
       subtle.importKey("raw", bytes as BufferSource, algorithm.mode, false, ["encrypt", "decrypt"])
     )
@@ -299,7 +299,7 @@ export const key = <A extends Algorithm>(
  */
 export const fromCryptoKey = <A extends Algorithm>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<Key<A>, CryptoError.CryptoError> =>
   KeyModel.fromCryptoKey("Cipher", "fromCryptoKey", KeyProto, algorithm, cryptoKey, {
     type: "secret",

package/src/crypto/KeyAgreement.ts

@@ -43,7 +43,7 @@ import * as Asymmetric from "./internal/asymmetric.ts"
 import * as KeyModel from "./internal/key.ts"
 import * as internal from "./internal/webCrypto.ts"
 import * as SecureRandom from "./SecureRandom.ts"
-import { WebCrypto } from "./WebCrypto.ts"
+import * as WebCrypto from "./WebCrypto.ts"
 
 const PrivateKeyTypeId = "~effect/crypto/KeyAgreement/PrivateKey" as const
 const PublicKeyTypeId = "~effect/crypto/KeyAgreement/PublicKey" as const
@@ -307,7 +307,7 @@ export const layerWebCrypto: Layer.Layer<KeyAgreement, never, SecureRandom.Secur
   KeyAgreement,
   Effect.gen(function*() {
     const random = yield* SecureRandom.SecureRandom
-    const crypto = yield* WebCrypto
+    const crypto = yield* WebCrypto.WebCrypto
     const caches = Asymmetric.makeCaches(family)
     return KeyAgreement.of({
       generateKeyPair: <A extends Algorithm>(algorithm: A) =>
@@ -447,7 +447,7 @@ export const publicKey = <A extends Algorithm>(
  */
 export const privateKeyFromCryptoKey = <A extends Algorithm>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<PrivateKey<A>, CryptoError.CryptoError> =>
   Asymmetric.fromCryptoKey(family, "privateKeyFromCryptoKey", algorithm, "private", cryptoKey)
 
@@ -467,7 +467,7 @@ export const privateKeyFromCryptoKey = <A extends Algorithm>(
  */
 export const publicKeyFromCryptoKey = <A extends Algorithm>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<PublicKey<A>, CryptoError.CryptoError> =>
   Asymmetric.fromCryptoKey(family, "publicKeyFromCryptoKey", algorithm, "public", cryptoKey)
 

package/src/crypto/KeyFormat.ts

@@ -76,6 +76,35 @@ export type Role = "public" | "private" | "secret"
  */
 export type Direction = "decode" | "encode"
 
+/**
+ * A JSON Web Key (RFC 7517) with the native Web Crypto field types and
+ * mutability, usable without DOM declarations.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface JsonWebKey {
+  alg?: string
+  crv?: string
+  d?: string
+  dp?: string
+  dq?: string
+  e?: string
+  ext?: boolean
+  k?: string
+  key_ops?: Array<string>
+  kty?: string
+  n?: string
+  oth?: Array<{ d?: string; r?: string; t?: string }>
+  p?: string
+  q?: string
+  qi?: string
+  use?: string
+  x?: string
+  y?: string
+}
+
 /**
  * A key format, such as {@link spki} or `pem(pkcs8)`.
  *
@@ -83,7 +112,7 @@ export type Direction = "decode" | "encode"
  *
  * `~tags` exists only in the types. It records the roles the format holds,
  * whether it can be read and written, and the type of its data: `Uint8Array`
- * for DER, `string` for PEM, and `JsonWebKey` for JWK.
+ * for DER, `string` for PEM, and {@link JsonWebKey} for JWK.
  *
  * @stability unstable
  * @category models

package/src/crypto/KeyWrap.ts

@@ -44,7 +44,7 @@ import * as internal from "./internal/webCrypto.ts"
 import type * as KeyFormat from "./KeyFormat.ts"
 import * as Mac from "./Mac.ts"
 import * as SecureRandom from "./SecureRandom.ts"
-import { WebCrypto } from "./WebCrypto.ts"
+import * as WebCrypto from "./WebCrypto.ts"
 
 const KeyTypeId = "~effect/crypto/KeyWrap/Key" as const
 const PrivateKeyTypeId = "~effect/crypto/KeyWrap/PrivateKey" as const
@@ -417,7 +417,7 @@ export const layerWebCrypto: Layer.Layer<KeyWrap, never, SecureRandom.SecureRand
   KeyWrap,
   Effect.gen(function*() {
     const random = yield* SecureRandom.SecureRandom
-    const crypto = yield* WebCrypto
+    const crypto = yield* WebCrypto.WebCrypto
     const kwCryptoKey = KeyModel.makeCache((subtle, bytes) =>
       subtle.importKey("raw", bytes as BufferSource, "AES-KW", false, ["wrapKey", "unwrapKey"])
     )
@@ -553,7 +553,7 @@ export const key = <A extends AesKw>(
  */
 export const fromCryptoKey = <A extends AesKw>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<Key<A>, CryptoError.CryptoError> =>
   KeyModel.fromCryptoKey("KeyWrap", "fromCryptoKey", KeyProto, algorithm, cryptoKey, {
     type: "secret",
@@ -570,7 +570,7 @@ const rsaFromCryptoKey = <K>(
   proto: object,
   algorithm: RsaOaep,
   role: Asymmetric.Role,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<K, CryptoError.CryptoError> =>
   KeyModel.fromCryptoKey("KeyWrap", method, proto, algorithm, cryptoKey, {
     type: role,
@@ -597,7 +597,7 @@ const rsaFromCryptoKey = <K>(
  */
 export const privateKeyFromCryptoKey = <A extends RsaOaep>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<PrivateKey<A>, CryptoError.CryptoError> =>
   rsaFromCryptoKey("privateKeyFromCryptoKey", PrivateKeyProto, algorithm, "private", cryptoKey)
 
@@ -617,7 +617,7 @@ export const privateKeyFromCryptoKey = <A extends RsaOaep>(
  */
 export const publicKeyFromCryptoKey = <A extends RsaOaep>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<PublicKey<A>, CryptoError.CryptoError> =>
   rsaFromCryptoKey("publicKeyFromCryptoKey", PublicKeyProto, algorithm, "public", cryptoKey)
 

package/src/crypto/Mac.ts

@@ -23,7 +23,7 @@ import * as Digest from "./Digest.ts"
 import * as KeyModel from "./internal/key.ts"
 import * as internal from "./internal/webCrypto.ts"
 import * as SecureRandom from "./SecureRandom.ts"
-import { WebCrypto } from "./WebCrypto.ts"
+import * as WebCrypto from "./WebCrypto.ts"
 
 const TypeId = "~effect/crypto/Mac/Key" as const
 
@@ -215,7 +215,7 @@ export const layerWebCryptoWith = (options: {
     Mac,
     Effect.gen(function*() {
       const random = yield* SecureRandom.SecureRandom
-      const crypto = yield* WebCrypto
+      const crypto = yield* WebCrypto.WebCrypto
       const cryptoKeyFor = KeyModel.makeCache((subtle, bytes, algorithm: Algorithm) =>
         subtle.importKey("raw", bytes as BufferSource, importParams(algorithm), false, ["sign", "verify"])
       )
@@ -321,7 +321,7 @@ export const key = <A extends Algorithm>(
  */
 export const fromCryptoKey = <A extends Algorithm>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<Key<A>, CryptoError.CryptoError> =>
   KeyModel.fromCryptoKey("Mac", "fromCryptoKey", KeyProto, algorithm, cryptoKey, {
     type: "secret",