@bjorntech/key-ferry 0.0.0-stage → 0.1.4

package/dist/remote.js

@@ -0,0 +1,227 @@
+import { readFileSync } from "node:fs";
+import { isIP } from "node:net";
+import { Effect, Scope } from "effect";
+/** Must stay in sync with the standalone relay implementation. */
+export const RELAY_AUTH_HEADER = "x-varlock-relay-token";
+const HOP_BY_HOP = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "host",
+    "content-length",
+]);
+const MCP_PROTOCOL_HEADERS = new Set([
+    "accept",
+    "content-type",
+    "mcp-session-id",
+    "mcp-protocol-version",
+    "last-event-id",
+    "origin",
+]);
+const CREDENTIAL_HEADERS = new Set(["authorization", "cookie", "proxy-authorization"]);
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const diagnostic = (server, code, message) => ({ server, code, message });
+export function isRemoteProtection(value) {
+    return "remote" in value;
+}
+export function sourceEnvironmentKeys(mapping) {
+    if (!isRemoteProtection(mapping))
+        return Object.values(mapping);
+    return Object.values(mapping.remote.headers).map((value) => typeof value === "string" ? value : value.env);
+}
+export function validateRemoteUrl(value, allowPrivateNetwork = false) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new TypeError("remote MCP URL is invalid");
+    }
+    if (url.protocol !== "https:" || url.username || url.password || url.hash) {
+        throw new TypeError("remote MCP URL must be HTTPS without credentials or fragments");
+    }
+    if (!allowPrivateNetwork && unsafeNetworkHost(url.hostname)) {
+        throw new TypeError("remote MCP URL targets a local or private network; set allowPrivateNetwork to opt in");
+    }
+    return url;
+}
+function unsafeNetworkHost(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+    if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0")
+        return true;
+    const version = isIP(host);
+    if (version === 6)
+        return (host === "::1" || host.startsWith("fc") || host.startsWith("fd") || host.startsWith("fe80:"));
+    if (version !== 4)
+        return false;
+    const octets = host.split(".").map(Number);
+    const [a, b] = octets;
+    return (a === 10 ||
+        a === 127 ||
+        (a === 169 && b === 254) ||
+        (a === 192 && b === 168) ||
+        (a === 172 && b >= 16 && b <= 31));
+}
+function mappingHeaderNames(mapping) {
+    return new Set(Object.keys(mapping.remote.headers).map((name) => name.toLowerCase()));
+}
+/** Remove mapped and dangerous configured headers from the native loopback config. */
+export function safeForwardHeaders(headers, mapping) {
+    const mapped = mappingHeaderNames(mapping);
+    const result = Object.create(null);
+    for (const [name, value] of Object.entries(headers ?? {})) {
+        const lower = name.toLowerCase();
+        if (!HEADER_NAME.test(name) ||
+            name === "__proto__" ||
+            name === "prototype" ||
+            name === "constructor" ||
+            HOP_BY_HOP.has(lower) ||
+            MCP_PROTOCOL_HEADERS.has(lower))
+            return undefined;
+        if (mapped.has(lower))
+            continue;
+        if (CREDENTIAL_HEADERS.has(lower) || /[\r\n\0]/.test(value))
+            return undefined;
+        result[name] = value;
+    }
+    return result;
+}
+function placeholderHeaders(mapping, environment) {
+    const result = Object.create(null);
+    for (const [header, raw] of Object.entries(mapping.remote.headers)) {
+        const value = typeof raw === "string" ? { env: raw } : raw;
+        const placeholder = environment[value.env];
+        if (placeholder === undefined)
+            throw new Error("missing placeholder");
+        result[header] = `${value.prefix ?? ""}${placeholder}${value.suffix ?? ""}`;
+    }
+    return result;
+}
+function readProxyAndCa(environment) {
+    const proxyUrl = environment.HTTPS_PROXY ??
+        environment.https_proxy ??
+        environment.HTTP_PROXY ??
+        environment.http_proxy;
+    const caPath = environment.NODE_EXTRA_CA_CERTS;
+    if (!proxyUrl || !caPath || !caPath.startsWith("/"))
+        throw new Error("missing Varlock proxy wiring");
+    const caPem = readFileSync(caPath, "utf8");
+    if (caPem.length === 0 ||
+        caPem.length > 2 * 1024 * 1024 ||
+        !caPem.includes("-----BEGIN CERTIFICATE-----")) {
+        throw new Error("invalid Varlock CA certificate");
+    }
+    return { proxyUrl, caPem };
+}
+/** Coordinates relay replacement without exposing relay tokens or secrets. */
+export function makeRemoteRelayCoordinator(factory, allowPrivateNetwork = false) {
+    const active = new Map();
+    let currentDiagnostics = [];
+    const stop = (handle) => handle.stop.pipe(Effect.catch(() => Effect.void));
+    const reconcile = (servers, mappings, environment, generation) => Effect.gen(function* () {
+        const nextDiagnostics = [];
+        for (const [name, mapping] of Object.entries(mappings)) {
+            if (!isRemoteProtection(mapping))
+                continue;
+            const server = servers.get(name);
+            const old = active.get(name);
+            if (!server || server.disabled === true) {
+                if (old) {
+                    yield* stop(old.handle);
+                    active.delete(name);
+                }
+                if (!server)
+                    nextDiagnostics.push(diagnostic(name, "remote_unavailable", "selected remote MCP server is not configured"));
+                continue;
+            }
+            if (!factory) {
+                if (old) {
+                    yield* stop(old.handle);
+                    active.delete(name);
+                }
+                nextDiagnostics.push(diagnostic(name, "remote_unavailable", "remote protection is unavailable in this plugin runtime"));
+                continue;
+            }
+            if (server.oauth !== false) {
+                if (old) {
+                    yield* stop(old.handle);
+                    active.delete(name);
+                }
+                nextDiagnostics.push(diagnostic(name, "remote_oauth_required", "set oauth:false for API-key relay mode, or remove this Varlock mapping to keep native OAuth"));
+                continue;
+            }
+            let upstream;
+            let wiring;
+            let placeholders;
+            let forwarded;
+            try {
+                upstream = validateRemoteUrl(server.url, allowPrivateNetwork);
+                wiring = readProxyAndCa(environment);
+                placeholders = placeholderHeaders(mapping, environment);
+                forwarded = safeForwardHeaders(server.headers, mapping);
+                if (forwarded === undefined)
+                    throw new Error("invalid remote header");
+            }
+            catch (error) {
+                if (old) {
+                    yield* stop(old.handle);
+                    active.delete(name);
+                }
+                const message = error instanceof Error && error.message === "missing placeholder"
+                    ? "a mapped placeholder is unavailable"
+                    : error instanceof Error && error.message === "invalid remote header"
+                        ? "remote headers contain an unsafe or malformed field"
+                        : error instanceof Error && error.message.includes("remote MCP URL")
+                            ? error.message
+                            : "Varlock proxy wiring is unavailable";
+                nextDiagnostics.push(diagnostic(name, message === "a mapped placeholder is unavailable"
+                    ? "remote_missing_placeholder"
+                    : message.startsWith("remote MCP URL")
+                        ? "remote_invalid_url"
+                        : message === "remote headers contain an unsafe or malformed field"
+                            ? "remote_invalid_header"
+                            : "remote_relay_failed", message));
+                continue;
+            }
+            if (old && old.generation === generation)
+                continue;
+            if (old) {
+                yield* stop(old.handle);
+                active.delete(name);
+            }
+            const started = yield* factory({
+                upstreamUrl: upstream.toString(),
+                proxyUrl: wiring.proxyUrl,
+                managerCaPem: wiring.caPem,
+                placeholderHeaders: placeholders,
+                oauth: false,
+            }).pipe(Effect.map((handle) => ({ ok: true, handle })), Effect.catch(() => Effect.succeed({ ok: false })));
+            if (started.ok)
+                active.set(name, { handle: started.handle, generation });
+            else
+                nextDiagnostics.push(diagnostic(name, "remote_relay_failed", "remote relay could not start"));
+        }
+        currentDiagnostics = nextDiagnostics;
+    });
+    return {
+        get handles() {
+            return new Map([...active].map(([name, record]) => [name, record.handle]));
+        },
+        get diagnostics() {
+            return currentDiagnostics;
+        },
+        reconcile,
+        get health() {
+            return Effect.suspend(() => Effect.forEach([...active.values()], (record) => record.handle.health.pipe(Effect.map((value) => value.listening), Effect.catch(() => Effect.succeed(false))), { concurrency: "unbounded" }).pipe(Effect.map((values) => values.every(Boolean))));
+        },
+        stopAll: Effect.suspend(() => Effect.forEach([...active.values()], (record) => stop(record.handle), {
+            concurrency: "unbounded",
+        }).pipe(Effect.tap(() => Effect.sync(() => active.clear())))),
+    };
+}
+//# sourceMappingURL=remote.js.map

package/dist/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAGvC,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAuDzD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,MAAM;IACN,gBAAgB;CACjB,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,QAAQ;IACR,cAAc;IACd,gBAAgB;IAChB,sBAAsB;IACtB,eAAe;IACf,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACvF,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAEpD,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,IAA8B,EAC9B,OAAe,EACG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAEnD,MAAM,UAAU,kBAAkB,CAChC,KAAuB;IAEvB,OAAO,QAAQ,IAAI,KAAK,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAyB;IAC7D,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAC9C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,mBAAmB,GAAG,KAAK;IAC1E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,mBAAmB,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CACjB,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1E,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,CAAC;QACf,OAAO,CACL,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAC7F,CAAC;IACJ,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IACtB,OAAO,CACL,CAAC,KAAK,EAAE;QACR,CAAC,KAAK,GAAG;QACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAgE;IAEhE,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAChC,OAAqD,EACrD,OAAgE;IAEhE,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IACrF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IACE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACvB,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,aAAa;YACtB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YACrB,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC;YAE/B,OAAO,SAAS,CAAC;QACnB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAChC,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAgE,EAChE,WAA6C;IAE7C,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IACrF,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,GAAG,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,WAA6C;IAInE,MAAM,QAAQ,GACZ,WAAW,CAAC,WAAW;QACvB,WAAW,CAAC,WAAW;QACvB,WAAW,CAAC,UAAU;QACtB,WAAW,CAAC,UAAU,CAAC;IACzB,MAAM,MAAM,GAAG,WAAW,CAAC,mBAAmB,CAAC;IAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;QAC9B,CAAC,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAeD,8EAA8E;AAC9E,MAAM,UAAU,0BAA0B,CACxC,OAAuC,EACvC,mBAAmB,GAAG,KAAK;IAE3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6D,CAAC;IACpF,IAAI,kBAAkB,GAAgC,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9F,MAAM,SAAS,GAAG,CAChB,OAAkD,EAClD,QAAoD,EACpD,WAA6C,EAC7C,UAAkB,EAClB,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,eAAe,GAAuB,EAAE,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACxC,IAAI,GAAG,EAAE,CAAC;oBACR,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;gBACD,IAAI,CAAC,MAAM;oBACT,eAAe,CAAC,IAAI,CAClB,UAAU,CACR,IAAI,EACJ,oBAAoB,EACpB,8CAA8C,CAC/C,CACF,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,GAAG,EAAE,CAAC;oBACR,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,UAAU,CACR,IAAI,EACJ,oBAAoB,EACpB,yDAAyD,CAC1D,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC3B,IAAI,GAAG,EAAE,CAAC;oBACR,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,UAAU,CACR,IAAI,EACJ,uBAAuB,EACvB,6FAA6F,CAC9F,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,QAAa,CAAC;YAClB,IAAI,MAA2C,CAAC;YAChD,IAAI,YAA8C,CAAC;YACnD,IAAI,SAAuD,CAAC;YAC5D,IAAI,CAAC;gBACH,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBAC9D,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;gBACrC,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACxD,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxD,IAAI,SAAS,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,GAAG,EAAE,CAAC;oBACR,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;gBACD,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,qBAAqB;oBAC/D,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,uBAAuB;wBACnE,CAAC,CAAC,qDAAqD;wBACvD,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;4BAClE,CAAC,CAAC,KAAK,CAAC,OAAO;4BACf,CAAC,CAAC,qCAAqC,CAAC;gBAChD,eAAe,CAAC,IAAI,CAClB,UAAU,CACR,IAAI,EACJ,OAAO,KAAK,qCAAqC;oBAC/C,CAAC,CAAC,4BAA4B;oBAC9B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;wBACpC,CAAC,CAAC,oBAAoB;wBACtB,CAAC,CAAC,OAAO,KAAK,qDAAqD;4BACjE,CAAC,CAAC,uBAAuB;4BACzB,CAAC,CAAC,qBAAqB,EAC7B,OAAO,CACR,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU;gBAAE,SAAS;YACnD,IAAI,GAAG,EAAE,CAAC;gBACR,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;gBAC7B,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,KAAK;gBAC1B,kBAAkB,EAAE,YAAY;gBAChC,KAAK,EAAE,KAAK;aACb,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,MAAM,EAAE,CAAC,CAAC,EACvD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,CAAC,CAAC,CAC3D,CAAC;YACF,IAAI,OAAO,CAAC,EAAE;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;;gBAEvE,eAAe,CAAC,IAAI,CAClB,UAAU,CAAC,IAAI,EAAE,qBAAqB,EAAE,8BAA8B,CAAC,CACxE,CAAC;QACN,CAAC;QACD,kBAAkB,GAAG,eAAe,CAAC;IACvC,CAAC,CAAC,CAAC;IAEL,OAAO;QACL,IAAI,OAAO;YACT,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,WAAW;YACb,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QACD,SAAS;QACT,IAAI,MAAM;YACR,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CACzB,MAAM,CAAC,OAAO,CACZ,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EACpB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACvB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EACtC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC1C,EACH,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACpE,WAAW,EAAE,WAAW;SACzB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAC7D;KACF,CAAC;AACJ,CAAC"}

package/dist/rpc.d.ts

@@ -0,0 +1,112 @@
+import { Schema } from "effect";
+import { VarlockError, type SafeStatus } from "./contracts.js";
+export declare const SafeStatusSchema: Schema.Struct<{
+    readonly phase: Schema.String;
+    readonly projectDirectory: Schema.String;
+    readonly generation: Schema.Number;
+    readonly pid: Schema.optional<Schema.Number>;
+    readonly endpoint: Schema.optional<Schema.String>;
+    readonly lastRefreshAt: Schema.optional<Schema.String>;
+    readonly error: Schema.optional<Schema.Struct<{
+        readonly code: Schema.String;
+        readonly message: Schema.String;
+        readonly retryable: Schema.Boolean;
+    }>>;
+    readonly diagnostics: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly code: Schema.String;
+        readonly server: Schema.String;
+        readonly message: Schema.String;
+    }>>>;
+}>;
+export declare const KeyFerryRpc: {
+    readonly id: "key-ferry";
+    readonly methods: {
+        readonly status: {
+            readonly input: Schema.Struct<{}>;
+            readonly output: Schema.Struct<{
+                readonly phase: Schema.String;
+                readonly projectDirectory: Schema.String;
+                readonly generation: Schema.Number;
+                readonly pid: Schema.optional<Schema.Number>;
+                readonly endpoint: Schema.optional<Schema.String>;
+                readonly lastRefreshAt: Schema.optional<Schema.String>;
+                readonly error: Schema.optional<Schema.Struct<{
+                    readonly code: Schema.String;
+                    readonly message: Schema.String;
+                    readonly retryable: Schema.Boolean;
+                }>>;
+                readonly diagnostics: Schema.optional<Schema.$Array<Schema.Struct<{
+                    readonly code: Schema.String;
+                    readonly server: Schema.String;
+                    readonly message: Schema.String;
+                }>>>;
+            }>;
+            readonly errors: {
+                readonly unavailable: Schema.Struct<{
+                    readonly code: Schema.String;
+                }>;
+            };
+        };
+        readonly refresh: {
+            readonly input: Schema.Struct<{}>;
+            readonly output: Schema.Struct<{
+                readonly phase: Schema.String;
+                readonly projectDirectory: Schema.String;
+                readonly generation: Schema.Number;
+                readonly pid: Schema.optional<Schema.Number>;
+                readonly endpoint: Schema.optional<Schema.String>;
+                readonly lastRefreshAt: Schema.optional<Schema.String>;
+                readonly error: Schema.optional<Schema.Struct<{
+                    readonly code: Schema.String;
+                    readonly message: Schema.String;
+                    readonly retryable: Schema.Boolean;
+                }>>;
+                readonly diagnostics: Schema.optional<Schema.$Array<Schema.Struct<{
+                    readonly code: Schema.String;
+                    readonly server: Schema.String;
+                    readonly message: Schema.String;
+                }>>>;
+            }>;
+            readonly errors: {
+                readonly unavailable: Schema.Struct<{
+                    readonly code: Schema.String;
+                }>;
+            };
+        };
+        readonly doctor: {
+            readonly input: Schema.Struct<{}>;
+            readonly output: Schema.Struct<{
+                readonly phase: Schema.String;
+                readonly projectDirectory: Schema.String;
+                readonly generation: Schema.Number;
+                readonly pid: Schema.optional<Schema.Number>;
+                readonly endpoint: Schema.optional<Schema.String>;
+                readonly lastRefreshAt: Schema.optional<Schema.String>;
+                readonly error: Schema.optional<Schema.Struct<{
+                    readonly code: Schema.String;
+                    readonly message: Schema.String;
+                    readonly retryable: Schema.Boolean;
+                }>>;
+                readonly diagnostics: Schema.optional<Schema.$Array<Schema.Struct<{
+                    readonly code: Schema.String;
+                    readonly server: Schema.String;
+                    readonly message: Schema.String;
+                }>>>;
+            }>;
+            readonly errors: {
+                readonly unavailable: Schema.Struct<{
+                    readonly code: Schema.String;
+                }>;
+            };
+        };
+    };
+    readonly events: {};
+};
+declare const publicMessage: (error: VarlockError) => "Varlock configuration is invalid" | "Varlock could not start" | "Varlock refresh failed" | "Varlock operation timed out" | "Varlock is not ready" | "Varlock manager is stopped" | "Varlock returned an invalid response" | "Varlock is unavailable";
+/** Rebuild a safe status without trusting an adapter error message. */
+export declare function sanitizeStatus(status: SafeStatus): SafeStatus;
+export declare function rpcError(error: VarlockError): {
+    code: "invalid_config" | "unavailable" | "start_failed" | "refresh_failed" | "not_ready" | "disposed" | "protocol_error" | "timeout";
+};
+export { publicMessage };
+//# sourceMappingURL=rpc.d.ts.map

package/dist/rpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../src/rpc.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAQ/D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;EAiB3B,CAAC;AAcH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BtB,CAAC;AAEH,QAAA,MAAM,aAAa,GAAI,OAAO,YAAY,0PAmBzC,CAAC;AAEF,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAkC7D;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,YAAY;;EAE3C;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/rpc.js

@@ -0,0 +1,117 @@
+import { Rpc } from "@opencode/plugin/effect";
+import { Schema } from "effect";
+import { VarlockError } from "./contracts.js";
+const statusError = Schema.Struct({
+    code: Schema.String,
+    message: Schema.String,
+    retryable: Schema.Boolean,
+});
+export const SafeStatusSchema = Schema.Struct({
+    phase: Schema.String,
+    projectDirectory: Schema.String,
+    generation: Schema.Number,
+    pid: Schema.optional(Schema.Number),
+    endpoint: Schema.optional(Schema.String),
+    lastRefreshAt: Schema.optional(Schema.String),
+    error: Schema.optional(statusError),
+    diagnostics: Schema.optional(Schema.Array(Schema.Struct({
+        code: Schema.String,
+        server: Schema.String,
+        message: Schema.String,
+    }))),
+});
+const Empty = Schema.Struct({});
+const isVarlockErrorCode = (value) => value === "invalid_config" ||
+    value === "unavailable" ||
+    value === "start_failed" ||
+    value === "refresh_failed" ||
+    value === "not_ready" ||
+    value === "disposed" ||
+    value === "protocol_error" ||
+    value === "timeout";
+export const KeyFerryRpc = Rpc.define({
+    id: "key-ferry",
+    methods: {
+        status: {
+            input: Empty,
+            output: SafeStatusSchema,
+            errors: {
+                unavailable: Schema.Struct({ code: Schema.String }),
+            },
+        },
+        refresh: {
+            input: Empty,
+            output: SafeStatusSchema,
+            errors: {
+                unavailable: Schema.Struct({ code: Schema.String }),
+            },
+        },
+        doctor: {
+            input: Empty,
+            output: SafeStatusSchema,
+            errors: {
+                unavailable: Schema.Struct({ code: Schema.String }),
+            },
+        },
+    },
+    events: {},
+});
+const publicMessage = (error) => {
+    switch (error.code) {
+        case "invalid_config":
+            return "Varlock configuration is invalid";
+        case "start_failed":
+            return "Varlock could not start";
+        case "refresh_failed":
+            return "Varlock refresh failed";
+        case "timeout":
+            return "Varlock operation timed out";
+        case "not_ready":
+            return "Varlock is not ready";
+        case "disposed":
+            return "Varlock manager is stopped";
+        case "protocol_error":
+            return "Varlock returned an invalid response";
+        default:
+            return "Varlock is unavailable";
+    }
+};
+/** Rebuild a safe status without trusting an adapter error message. */
+export function sanitizeStatus(status) {
+    const errorCode = isVarlockErrorCode(status.error?.code) ? status.error.code : "unavailable";
+    return {
+        phase: status.phase,
+        projectDirectory: status.projectDirectory,
+        generation: status.generation,
+        ...(status.pid === undefined ? {} : { pid: status.pid }),
+        ...(status.endpoint === undefined ? {} : { endpoint: status.endpoint }),
+        ...(status.lastRefreshAt === undefined ? {} : { lastRefreshAt: status.lastRefreshAt }),
+        ...(status.error === undefined
+            ? {}
+            : {
+                error: new VarlockError({
+                    code: errorCode,
+                    message: publicMessage(new VarlockError({
+                        code: errorCode,
+                        message: "",
+                        retryable: status.error.retryable === true,
+                    })),
+                    retryable: status.error.retryable,
+                }),
+            }),
+        ...(status.diagnostics === undefined
+            ? {}
+            : {
+                diagnostics: status.diagnostics.map((item) => ({
+                    code: item.code,
+                    server: item.server,
+                    message: item.message,
+                })),
+            }),
+    };
+}
+export function rpcError(error) {
+    return { code: error.code };
+}
+export { publicMessage };
+//# sourceMappingURL=rpc.js.map

package/dist/rpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc.js","sourceRoot":"","sources":["../src/rpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,YAAY,EAAmB,MAAM,gBAAgB,CAAC;AAE/D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,SAAS,EAAE,MAAM,CAAC,OAAO;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,gBAAgB,EAAE,MAAM,CAAC,MAAM;IAC/B,UAAU,EAAE,MAAM,CAAC,MAAM;IACzB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAC1B,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,MAAM;KACvB,CAAC,CACH,CACF;CACF,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEhC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAiC,EAAE,CAC3E,KAAK,KAAK,gBAAgB;IAC1B,KAAK,KAAK,aAAa;IACvB,KAAK,KAAK,cAAc;IACxB,KAAK,KAAK,gBAAgB;IAC1B,KAAK,KAAK,WAAW;IACrB,KAAK,KAAK,UAAU;IACpB,KAAK,KAAK,gBAAgB;IAC1B,KAAK,KAAK,SAAS,CAAC;AAEtB,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,WAAW;IACf,OAAO,EAAE;QACP,MAAM,EAAE;YACN,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aACpD;SACF;QACD,OAAO,EAAE;YACP,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aACpD;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aACpD;SACF;KACF;IACD,MAAM,EAAE,EAAE;CACX,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,KAAmB,EAAE,EAAE;IAC5C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,gBAAgB;YACnB,OAAO,kCAAkC,CAAC;QAC5C,KAAK,cAAc;YACjB,OAAO,yBAAyB,CAAC;QACnC,KAAK,gBAAgB;YACnB,OAAO,wBAAwB,CAAC;QAClC,KAAK,SAAS;YACZ,OAAO,6BAA6B,CAAC;QACvC,KAAK,WAAW;YACd,OAAO,sBAAsB,CAAC;QAChC,KAAK,UAAU;YACb,OAAO,4BAA4B,CAAC;QACtC,KAAK,gBAAgB;YACnB,OAAO,sCAAsC,CAAC;QAChD;YACE,OAAO,wBAAwB,CAAC;IACpC,CAAC;AACH,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7F,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;YAC5B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,KAAK,EAAE,IAAI,YAAY,CAAC;oBACtB,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,aAAa,CACpB,IAAI,YAAY,CAAC;wBACf,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,EAAE;wBACX,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI;qBAC3C,CAAC,CACH;oBACD,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;iBAClC,CAAC;aACH,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;aACJ,CAAC;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAmB;IAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/services/process.d.ts

@@ -0,0 +1,56 @@
+import { Context, Effect, Layer } from "effect";
+export type ProcessPhase = "spawn" | "running" | "timeout" | "capture-limit" | "exit";
+declare const ProcessError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ProcessError";
+} & Readonly<A>;
+/** Deliberately contains no command, arguments, or captured output. */
+export declare class ProcessError extends ProcessError_base<{
+    readonly phase: ProcessPhase;
+    readonly code: "spawn-failed" | "timeout" | "capture-limit" | "non-zero" | "signal" | "io";
+    readonly message: string;
+    readonly exitCode?: number;
+    readonly signal?: string;
+}> {
+}
+export interface ProcessExit {
+    readonly code: number | null;
+    readonly signal: string | null;
+}
+export interface ProcessHealth {
+    readonly pid: number;
+    readonly running: boolean;
+    readonly exit?: ProcessExit;
+}
+export interface RunInput {
+    readonly executable: string;
+    readonly args: readonly string[];
+    readonly cwd: string;
+    /** Exact child environment. Omit to run with an isolated empty environment. */
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly maxBytes?: number;
+    readonly timeoutMs?: number;
+}
+export interface RunResult extends ProcessExit {
+    readonly stdout: string;
+    readonly stderr: string;
+}
+export interface SpawnInput extends Omit<RunInput, "maxBytes" | "timeoutMs"> {
+    readonly terminateGraceMs?: number;
+}
+export interface ManagedProcess {
+    readonly pid: number;
+    readonly completion: Effect.Effect<ProcessExit, ProcessError>;
+    readonly health: Effect.Effect<ProcessHealth, never>;
+    readonly stop: Effect.Effect<void, ProcessError>;
+}
+export interface ProcessService {
+    run(input: RunInput): Effect.Effect<RunResult, ProcessError>;
+    spawn(input: SpawnInput): Effect.Effect<ManagedProcess, ProcessError, ScopeRequirement>;
+}
+export type ScopeRequirement = import("effect/Scope").Scope;
+declare const Process_base: Context.ServiceClass<Process, "key-ferry/Process", ProcessService>;
+export declare class Process extends Process_base {
+}
+export declare const ProcessLive: Layer.Layer<Process, never, never>;
+export {};
+//# sourceMappingURL=process.d.ts.map

package/dist/services/process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/services/process.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAkB,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEhE,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,MAAM,CAAC;;;;AAEtF,uEAAuE;AACvE,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,GAAG,eAAe,GAAG,UAAU,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,SAAU,SAAQ,WAAW;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,IAAI,CAAC,QAAQ,EAAE,UAAU,GAAG,WAAW,CAAC;IAC1E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7D,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;CACzF;AAID,MAAM,MAAM,gBAAgB,GAAG,OAAO,cAAc,EAAE,KAAK,CAAC;;AAE5D,qBAAa,OAAQ,SAAQ,YAA+D;CAAG;AAiO/F,eAAO,MAAM,WAAW,oCAA+D,CAAC"}