@graftland/plugin-remote 0.0.0-stage → 0.3.0

package/dist/importer-D7zSgqxq.js

@@ -0,0 +1,347 @@
+import { s as fromModule } from "./Graft-BsYq3F-J.js";
+import { t as ConfigDirectory } from "./ConfigDirectory-BCC6q2R4.js";
+import { registerHooks } from "node:module";
+import { Array, Cause, Config, Context, Data, Effect, Exit, HashMap, MutableList, Option, Path, Predicate, Record, Ref, Result, Schema, Scope, String } from "effect";
+import { SecureRandom } from "effect/crypto";
+// packages/remote/src/internal/forkTree.ts
+const findSubtree = (trees, id) => Array.findFirst(trees, (tree) => tree.id === id ? Option.some(tree) : findSubtree(tree.children, id));
+const isSubtreeActive = (tree) => tree.state._tag === "Active" && Array.every(tree.children, isSubtreeActive);
+// packages/loader/src/internal/snapshot.ts
+/** Class instances are opaque; only arrays and plain records belong to the data graph. */
+const isContainer = (value) => Predicate.isObjectOrArray(value) && (Array.isArray(value) || Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+const owned = /* @__PURE__ */ new WeakSet();
+/** Internal evidence that every plain container in this graph has been captured. */
+const isSnapshot = (value) => owned.has(value);
+/**
+* Copy and freeze a data graph without changing the caller's objects. Sharing,
+* cycles, sparse arrays and null prototypes survive the copy. Own properties
+* are captured as values; class instances (including Env) retain their identity.
+*/
+const snapshot = (value) => {
+	const copies = /* @__PURE__ */ new WeakMap();
+	const pending = MutableList.make();
+	const copyOf = (source) => {
+		if (!isContainer(source) || owned.has(source)) return source;
+		const existing = copies.get(source);
+		if (existing !== void 0) return existing;
+		const copy = Array.isArray(source) ? [] : Object.create(Object.getPrototypeOf(source));
+		copies.set(source, copy);
+		MutableList.append(pending, {
+			source,
+			copy
+		});
+		return copy;
+	};
+	const result = copyOf(value);
+	while (pending.length > 0) {
+		const item = MutableList.take(pending);
+		if (item === MutableList.Empty) break;
+		const { source, copy } = item;
+		for (const key of Reflect.ownKeys(source)) Object.defineProperty(copy, key, {
+			value: copyOf(Reflect.get(source, key)),
+			enumerable: Object.prototype.propertyIsEnumerable.call(source, key),
+			configurable: !(Array.isArray(source) && key === "length"),
+			writable: true
+		});
+		Object.freeze(copy);
+		owned.add(copy);
+	}
+	return result;
+};
+// packages/loader/src/Entry.ts
+/**
+* Entries describe which plugins to load and how, as plain data that a
+* config file can hold.
+*/
+/** A value read from an environment variable when the entry is loaded (`!env NAME` in YAML). */
+var Env = class extends Data.TaggedClass("Env") {};
+/**
+* The id of the entry a plugin was loaded from. Ids persist in the config
+* file, so a plugin can use this as a name that survives restarts.
+*/
+const CurrentId = Context.Reference("@graftland/loader/Entry/CurrentId", { defaultValue: () => Option.none() });
+/** The descriptions also document the config file's JSON Schema. */
+const Fields = Schema.Struct({
+	id: Schema.String.annotate({ description: "Identifies the entry." }),
+	name: Schema.String.annotate({ description: "The plugin's module: a relative path, a package name, or a short name. Ignored for groups." }),
+	config: Schema.optionalKey(Schema.Unknown).annotateKey({ description: "The plugin's input. For a group, its list of entries." }),
+	disabled: Schema.optionalKey(Schema.Boolean.annotate({ description: "true unloads the entry but keeps it in the file." })),
+	group: Schema.optionalKey(Schema.Boolean.annotate({ description: "true makes the entry a group of other entries." })),
+	inject: Schema.optionalKey(Schema.Array(Schema.String).annotate({ description: "Service keys to wait for before loading the plugin, in addition to its own inject." })),
+	isolate: Schema.optionalKey(Schema.Record(Schema.String, Schema.Union([Schema.Literal(true), Schema.String])).annotate({ description: "Service or event keys to isolate: true for a private realm, or a label for a shared one." })),
+	intercept: Schema.optionalKey(Schema.Record(Schema.String, Schema.Unknown).annotate({ description: "Patches for registered references, applying to this entry and its descendants. Each value is resolved, decoded with the registered Schema, then merged." }))
+});
+/** Known fields are validated; additional entry metadata is preserved as unknown data. */
+const Entry = Schema.StructWithRest(Fields, [Schema.Record(Schema.String, Schema.Unknown)]);
+var CyclicConfig = class extends Schema.TaggedError()("CyclicConfig", { path: Schema.Array(Schema.String) }) {
+	get message() {
+		return `Configuration contains a cycle at ${Array.join(this.path, ".") || "<root>"}`;
+	}
+};
+/** Identity-based graph traversal; sharing is allowed, but a back edge is not. */
+const checkAcyclic = (value) => {
+	const active = /* @__PURE__ */ new WeakSet();
+	const finished = /* @__PURE__ */ new WeakSet();
+	const work = MutableList.make();
+	MutableList.prepend(work, {
+		value,
+		path: [],
+		leave: false
+	});
+	while (work.length > 0) {
+		const frame = MutableList.take(work);
+		if (frame === MutableList.Empty) break;
+		const { value, path, leave } = frame;
+		if (!isContainer(value)) continue;
+		if (leave) {
+			active.delete(value);
+			finished.add(value);
+			continue;
+		}
+		if (active.has(value)) return Result.fail(CyclicConfig.make({ path }));
+		if (finished.has(value)) continue;
+		active.add(value);
+		MutableList.prepend(work, {
+			value,
+			path,
+			leave: true
+		});
+		for (const [key, child] of Record.toEntries(value)) MutableList.prepend(work, {
+			value: child,
+			path: [...path, key],
+			leave: false
+		});
+	}
+	return Result.succeed(void 0);
+};
+/** Rejects cycles and resolves Env while preserving sharing within each execution. */
+const resolveEnv = (value) => Effect.suspend(() => {
+	const resolved = /* @__PURE__ */ new WeakMap();
+	const resolve = (value) => Effect.suspend(() => {
+		if (value instanceof Env) return Config.String(value.name);
+		if (!isContainer(value)) return Effect.succeed(value);
+		if (resolved.has(value)) return Effect.succeed(resolved.get(value));
+		const result = Array.isArray(value) ? Effect.forEach(value, resolve) : Effect.map(Effect.forEach(Record.toEntries(value), ([key, inner]) => Effect.map(resolve(inner), (value) => [key, value])), Record.fromEntries);
+		return Effect.map(result, (result) => {
+			resolved.set(value, result);
+			return result;
+		});
+	});
+	return Effect.andThen(Effect.fromResult(checkAcyclic(value)), resolve(value));
+});
+// packages/loader/src/internal/recovery.ts
+/** Recovery is safe only when no companion failure, defect or interruption would be discarded. */
+const isOnlyFailure = (cause, matches) => cause.reasons.length === 1 && Array.some(cause.reasons, (reason) => Cause.isFailReason(reason) && matches(reason.error));
+// packages/loader/src/ModuleResolver.ts
+/**
+* Turns the `name` of an entry into a plugin.
+*/
+var ModuleNotFound = class extends Schema.TaggedError()("ModuleNotFound", {
+	plugin: Schema.String,
+	tried: Schema.Array(Schema.String)
+}) {
+	get message() {
+		return `No plugin found for "${this.plugin}" (tried ${Array.join(this.tried, ", ")})`;
+	}
+};
+/** A module could not be imported, or plugin resolution found no plugin export. */
+var ModuleInvalid = class extends Schema.TaggedError()("ModuleInvalid", {
+	specifier: Schema.String,
+	cause: Schema.Unknown
+}) {
+	get message() {
+		return `Module "${this.specifier}" could not be loaded`;
+	}
+};
+var ModuleResolver = class extends Context.Service()("@graftland/loader/ModuleResolver") {};
+const isPath = (name) => String.startsWith(".")(name) || String.startsWith("/")(name);
+/** The specifiers tried for a name, in order: as written, then the naming conventions for short names. */
+const candidates = (name) => isPath(name) || String.includes(":")(name) || String.startsWith("@")(name) ? [name] : [
+	name,
+	`@graftland/plugin-${name}`,
+	`graft-plugin-${name}`
+];
+/** An error followed by its causes, outermost first. */
+const causes = (error, depth = 0) => depth < 8 && Predicate.hasProperty(error, "cause") && error.cause !== void 0 ? [error, ...causes(error.cause, depth + 1)] : [error];
+/** Node's message for a missing package or file, followed by its importer. */
+const decodeNotFound = Schema.decodeUnknownOption(Schema.TemplateLiteralParser([
+	"Cannot find ",
+	Schema.Literals(["package", "module"]),
+	" '",
+	Schema.String.check(Schema.isPattern(/^[^']+$/)),
+	"'",
+	Schema.String
+]));
+/** What a module resolution error says is missing, if it is one. */
+const missingName = (error) => Predicate.hasProperty(error, "code") && error.code === "ERR_MODULE_NOT_FOUND" && Predicate.hasProperty(error, "message") && Predicate.isString(error.message) ? Option.map(decodeNotFound(error.message), ([, , , name]) => name) : Option.none();
+/**
+* Whether an import failed because the candidate itself does not exist, as
+* opposed to something it imports. Only then is the next candidate tried.
+*/
+const isMissing = (error, candidate) => Array.some(causes(error), (error) => Option.exists(missingName(error), (name) => Array.contains(candidate, name)));
+/** The package a bare specifier belongs to: `@scope/name` or `name`. */
+const packageOf = (specifier) => Array.join(Array.take(String.split("/")(specifier), String.startsWith("@")(specifier) ? 2 : 1), "/");
+var PlanKey = class extends Data.Class {};
+/** Failed attempts release their resources before recovery; successful leases stay with the entry. */
+const inCandidateScope = (effect) => Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+	const parent = yield* Effect.scope;
+	const scope = yield* Scope.fork(parent);
+	const result = yield* Effect.exit(restore(effect).pipe(Scope.provide(scope)));
+	if (Exit.isSuccess(result)) return result.value;
+	const closed = yield* Effect.exit(Scope.close(scope, result));
+	return yield* Effect.failCause(Exit.isFailure(closed) ? Cause.combine(result.cause, closed.cause) : result.cause);
+}));
+/**
+* Resolves names with dynamic `import`. Relative specifiers are resolved
+* against `ConfigDirectory` when supplied, otherwise `base`; file URLs retain their query and fragment for importing, while
+* their decoded paths identify missing candidates. Bare specifiers go through
+* `importer`, which should run in the application so its dependencies are visible.
+* Effect importers may acquire
+* resources in a candidate scope owned by the entry lifecycle. A failed candidate
+* closes before fallback; a successful candidate remains leased until entry disposal.
+* Importers may attach observation-only leases to the separate observationScope.
+* The caller keeps that scope through failure and closes it on retry or disposal.
+*/
+const make$1 = (options) => Effect.gen(function* () {
+	const path = yield* Path.Path;
+	/** Keep the import target and Node's possible missing names in one normalization step. */
+	const normalize = Effect.fnUntraced(function* (specifier) {
+		const invalid = (cause) => ModuleInvalid.make({
+			specifier,
+			cause
+		});
+		if (isPath(specifier)) {
+			const directory = yield* ConfigDirectory;
+			const file = path.resolve(Option.getOrElse(directory, () => options.base), specifier);
+			const url = yield* path.toFileUrl(file).pipe(Effect.mapError(invalid));
+			return {
+				target: url.href,
+				names: [
+					specifier,
+					file,
+					url.href
+				]
+			};
+		}
+		if (String.startsWith("file:")(String.toLowerCase(specifier))) {
+			const url = yield* Effect.try({
+				try: () => new URL(specifier),
+				catch: invalid
+			});
+			return {
+				target: specifier,
+				names: [
+					specifier,
+					yield* path.fromFileUrl(url).pipe(Effect.mapError(invalid)),
+					url.href
+				]
+			};
+		}
+		return {
+			target: specifier,
+			names: String.includes(":")(specifier) ? [specifier] : [specifier, packageOf(specifier)]
+		};
+	});
+	const plans = yield* Ref.make({
+		revision: -1,
+		entries: HashMap.empty()
+	});
+	const plan = Effect.fnUntraced(function* (name) {
+		const key = new PlanKey({
+			name,
+			target: (yield* normalize(name)).target
+		});
+		const environment = options.resolution;
+		const revision = environment === void 0 ? 0 : yield* environment.revision;
+		const cached = yield* Ref.get(plans);
+		if (cached.revision === revision) {
+			const found = HashMap.get(cached.entries, key);
+			if (Option.isSome(found)) return found.value;
+		} else yield* Ref.set(plans, {
+			revision,
+			entries: HashMap.empty()
+		});
+		const normalized = yield* Effect.forEach(candidates(name), (specifier) => Effect.map(normalize(specifier), (candidate) => ({
+			...candidate,
+			specifier
+		})));
+		const selected = yield* Effect.forEach(normalized, (candidate) => Effect.map(environment === void 0 ? Effect.succeed(Result.succeed(true)) : environment.exists(candidate.target).pipe(Effect.mapError((cause) => ModuleInvalid.make({
+			specifier: candidate.specifier,
+			cause
+		})), Effect.result), (exists) => ({
+			...candidate,
+			exists
+		})));
+		yield* Ref.update(plans, (current) => current.revision !== revision || Array.some(selected, (candidate) => Result.isFailure(candidate.exists)) ? current : {
+			...current,
+			entries: HashMap.set(current.entries, key, selected)
+		});
+		return selected;
+	});
+	const load = Effect.fnUntraced(function* (specifier, candidate, observationScope) {
+		const context = yield* Effect.context();
+		return yield* Effect.tryPromise({
+			try: (signal) => {
+				const imported = options.importer(candidate.target, { observationScope });
+				return Effect.isEffect(imported) ? Promise.resolve(imported) : imported.then(Effect.succeed, (cause) => {
+					if (signal.aborted) Effect.runSyncWith(context)(Effect.logError("Module import failed after cancellation", Cause.die(cause)).pipe(Effect.annotateLogs({ specifier })));
+					throw cause;
+				});
+			},
+			catch: (cause) => ModuleInvalid.make({
+				specifier,
+				cause
+			})
+		}).pipe(Effect.flatMap((imported) => imported.pipe(Effect.mapError((cause) => ModuleInvalid.make({
+			specifier,
+			cause
+		})))));
+	});
+	/** Only a missing candidate permits short-name fallback. */
+	const attempt = Effect.fnUntraced(function* (candidate, observationScope) {
+		const { specifier } = candidate;
+		return yield* load(specifier, candidate, observationScope).pipe(Effect.flatMap((module) => Effect.fromOption(fromModule(module), () => ModuleInvalid.make({
+			specifier,
+			cause: "it exports no plugin"
+		}))), inCandidateScope, Effect.asSome, Effect.catchCauseIf((cause) => isOnlyFailure(cause, (error) => isMissing(error.cause, candidate.names)), () => Effect.succeedNone));
+	});
+	return {
+		importModule: Effect.fnUntraced(function* (specifier, options) {
+			const caller = yield* Effect.scope;
+			const candidate = yield* normalize(specifier);
+			return yield* load(specifier, candidate, options?.observationScope ?? caller).pipe(inCandidateScope);
+		}),
+		resolve: Effect.fnUntraced(function* (name, importOptions) {
+			const caller = yield* Effect.scope;
+			const observationScope = importOptions?.observationScope ?? caller;
+			const tried = candidates(name);
+			if (options.resolution !== void 0) yield* inCandidateScope(options.resolution.observe(tried, { observationScope }).pipe(Effect.mapError((cause) => ModuleInvalid.make({
+				specifier: name,
+				cause
+			}))));
+			const selected = yield* plan(name);
+			for (const candidate of selected) {
+				if (!(yield* Effect.fromResult(candidate.exists))) continue;
+				const plugin = yield* attempt(candidate, observationScope);
+				if (Option.isSome(plugin)) return plugin.value;
+			}
+			return yield* ModuleNotFound.make({
+				plugin: name,
+				tried
+			});
+		})
+	};
+});
+// packages/remote/src/internal/importer.ts
+/** Bare names resolve from the application; imported dependencies keep their own parent URLs. */
+const make = Effect.fnUntraced(function* (directory) {
+	const path = yield* Path.Path;
+	const base = yield* path.toFileUrl(path.join(directory, "graft.yml"));
+	const prefix = `graft-remote-${yield* (yield* SecureRandom.SecureRandom).uuidV4()}:`;
+	yield* Effect.acquireRelease(Effect.sync(() => registerHooks({ resolve: (specifier, context, next) => String.startsWith(prefix)(specifier) ? next(String.slice(prefix.length)(specifier), {
+		...context,
+		parentURL: base.href
+	}) : next(specifier, context) })), (hooks) => Effect.sync(() => hooks.deregister()));
+	return (specifier) => import(prefix + specifier);
+});
+export { isOnlyFailure as a, Env as c, isSnapshot as d, snapshot as f, make$1 as i, resolveEnv as l, isSubtreeActive as m, ModuleInvalid as n, CurrentId as o, findSubtree as p, ModuleResolver as r, Entry as s, make as t, isContainer as u };

package/dist/index.d.ts

@@ -0,0 +1,29 @@
+import { Connect, Source } from "./internal/credentials.js";
+import { ChildFailure } from "./internal/childErrors.js";
+import { MissingInstance, RemoteError, RemoteWithdrawn } from "./Errors.js";
+import { Contract, Contract_d_exports, UndeclaredFailure } from "./Contract.js";
+import { Instance } from "./Instance.js";
+import { RemoteTerminationUnconfirmed } from "./internal/runner/model.js";
+import { host } from "./internal/entry.js";
+import { Plugin } from "@graftland/graft";
+import { Duration, Schedule, Schema } from "effect";
+export interface Options<D extends ReadonlyArray<Plugin.Dependency> = readonly []> {
+  readonly connect: Connect<D>;
+  /** Contract module resolved independently in each execution environment. */
+  readonly contractModule: string;
+  readonly config?: Schema.Json;
+  readonly retry?: Schedule.Schedule<unknown, unknown> | undefined;
+  readonly shutdownTimeout?: Duration.Input | undefined;
+}
+export declare const plugin: <S extends Schema.Top & {
+  readonly Encoded: Schema.Json;
+  readonly DecodingServices: never;
+  readonly EncodingServices: never;
+}, E extends Schema.Top & {
+  readonly DecodingServices: never;
+  readonly EncodingServices: never;
+}, const D extends ReadonlyArray<Plugin.Dependency> = readonly []>(contract: Contract<S, E>, options: Options<D> & {
+  readonly config?: S["Encoded"];
+}) => Plugin.Plugin<void, void, E["Type"] | UndeclaredFailure | RemoteError | RemoteWithdrawn | MissingInstance>;
+export { ChildFailure, type Connect, Contract_d_exports as Contract, type Source as CredentialSource, Instance, MissingInstance, RemoteError, RemoteTerminationUnconfirmed, RemoteWithdrawn, UndeclaredFailure, host as default };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":["Credential.Connect","Contract.Contract","Contract.UndeclaredFailure"],"sources":["../src/index.ts"],"mappings":";;;;;;;;;iBAwBiB,QAChB,UAAU,cAAc,OAAO;WAEtB,SAASA,QAAmB;;WAE5B;WACA,SAAS,OAAO;WAChB,QAAQ,SAAS;WACjB,kBAAkB,SAAS;;qBA4BxB,SACZ,UAAU,OAAO;WACP,SAAS,OAAO;WAChB;WACA;GAEV,UAAU,OAAO;WACP;WACA;SAEJ,UAAU,cAAc,OAAO,2BAAyB,UAEpDC,SAAkB,GAAG,IAAE,SACxB,QAAQ;WAAgB,SAAS;MACxC,OAAO,mBAGP,YACAC,oBACA,cACA,kBACA"}

package/dist/index.js

@@ -0,0 +1,86 @@
+import { a as provide, l as make, u as optional } from "./Graft-BsYq3F-J.js";
+import { r as ModuleResolver } from "./importer-D7zSgqxq.js";
+import { a as publicError, d as follow, f as Host, n as host, r as launch, s as CapabilityFailed } from "./entry-SYsx9VNb.js";
+import { n as Credentials } from "./Auth-BElTC9_X.js";
+import { i as MissingInstance, n as CredentialsError, o as RemoteError, s as RemoteWithdrawn } from "./Errors-oPsTLY7l.js";
+import { n as prepare } from "./token-v5ne2I0-.js";
+import { d as ChildFailure, n as UndeclaredFailure, t as Contract_exports } from "./Contract-CcpSIJm4.js";
+import { O as Instance, l as RemoteTerminationUnconfirmed } from "./Peer-IJgFK6mD.js";
+import { Array, Cause, Context, Effect, Path, Schema, Scope } from "effect";
+import { SecureRandom } from "effect/crypto";
+import { ChildProcessSpawner } from "effect/process";
+// packages/remote/src/internal/credentials.ts
+const provider = (source, encode) => {
+	const input = Effect.isEffect(source) ? {
+		inject: [],
+		read: source
+	} : source;
+	return make({
+		name: "remote-effect-credentials",
+		inject: input.inject,
+		apply: Effect.fnUntraced(function* () {
+			const context = yield* Effect.context().pipe(Effect.map(Context.omit(Scope.Scope)));
+			const read = input.read.pipe(Effect.provideContext(context), Effect.mapError((error) => CredentialsError.make({ cause: Cause.fail(error) })));
+			yield* provide(Credentials, encode(read));
+		})
+	});
+};
+const invocation = (connect) => {
+	const auth = connect.auth;
+	if (auth === void 0) return void 0;
+	if ("mtls" in auth) {
+		const source = auth.mtls;
+		if (Effect.isEffect(source) || "read" in source) return {
+			plugin: provider(source, (read) => ({
+				kind: "Certificate",
+				read: read.pipe(Effect.map((value) => ({
+					_tag: "Certificate",
+					value
+				})))
+			})),
+			config: void 0
+		};
+	}
+	if ("bearer" in auth || "jwt" in auth) {
+		const source = "bearer" in auth ? auth.bearer.token : auth.jwt.token;
+		if (typeof source !== "string" && (Effect.isEffect(source) || "read" in source)) return {
+			plugin: provider(source, (read) => ({
+				kind: "Authorization",
+				read: read.pipe(Effect.flatMap(prepare), Effect.map((value) => ({
+					_tag: "Authorization",
+					value
+				})))
+			})),
+			config: void 0
+		};
+	}
+};
+// packages/remote/src/index.ts
+const publicCause = (declared, cause) => Cause.fromReasons(Array.flatMap(cause.reasons, (reason) => {
+	if (reason._tag !== "Fail") return [reason];
+	return Schema.is(CapabilityFailed)(reason.error) ? Array.map(publicCause(declared, reason.error.cause).reasons, (inner) => inner.annotate(Cause.reasonAnnotations(reason))) : [Cause.makeFailReason(publicError(declared, reason.error)).annotate(Cause.reasonAnnotations(reason))];
+}));
+const plugin = (contract, options) => make({
+	name: contract.name,
+	inject: [
+		optional(ModuleResolver),
+		Path.Path,
+		SecureRandom.SecureRandom,
+		ChildProcessSpawner.ChildProcessSpawner
+	],
+	retry: options.retry,
+	apply: () => Effect.gen(function* () {
+		const input = yield* Schema.decodeUnknownEffect(Host)({
+			contract: options.contractModule,
+			connect: options.connect,
+			config: options.config === void 0 ? {} : options.config
+		});
+		yield* Schema.decodeEffect(contract.config)(input.config);
+		const child = yield* launch(contract, input, {
+			contractModule: options.contractModule,
+			shutdownTimeout: options.shutdownTimeout
+		}, invocation(options.connect));
+		yield* follow(child, (cause) => Effect.failCause(publicCause(contract.error, cause)));
+	}).pipe(Effect.mapError((error) => publicError(contract.error, error)))
+});
+export { ChildFailure, Contract_exports as Contract, Instance, MissingInstance, RemoteError, RemoteTerminationUnconfirmed, RemoteWithdrawn, UndeclaredFailure, host as default, plugin };

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["Configuration.Host","Credential.invocation"],"sources":["../src/index.ts"],"sourcesContent":["import { Plugin } from \"@graftland/graft\"\nimport { ModuleResolver } from \"@graftland/loader\"\nimport { Array, Cause, Effect, Path, Schema } from \"effect\"\nimport type { Duration, Schedule } from \"effect\"\nimport { SecureRandom } from \"effect/crypto\"\nimport { ChildProcessSpawner } from \"effect/process\"\nimport { launch } from \"./internal/entry\"\nimport { follow } from \"./internal/follow\"\nimport { CapabilityFailed } from \"./internal/assembly\"\nimport { publicError } from \"./internal/execution\"\nimport * as Configuration from \"./internal/entryConfig\"\nimport * as Credential from \"./internal/credentials\"\nimport { RemoteWithdrawn, RemoteError, MissingInstance } from \"./Errors\"\nimport * as Contract from \"./Contract\"\nexport { Contract }\nexport { Instance } from \"./Instance\"\nexport { RemoteTerminationUnconfirmed } from \"./internal/runner/model\"\nexport { RemoteError, RemoteWithdrawn, MissingInstance } from \"./Errors\"\nexport { UndeclaredFailure, ChildFailure } from \"./Contract\"\nexport type {\n\tConnect,\n\tSource as CredentialSource,\n} from \"./internal/credentials\"\n\nexport interface Options<\n\tD extends ReadonlyArray<Plugin.Dependency> = readonly [],\n> {\n\treadonly connect: Credential.Connect<D>\n\t/** Contract module resolved independently in each execution environment. */\n\treadonly contractModule: string\n\treadonly config?: Schema.Json\n\treadonly retry?: Schedule.Schedule<unknown, unknown> | undefined\n\treadonly shutdownTimeout?: Duration.Input | undefined\n}\nconst publicCause = <E extends Schema.Top>(\n\tdeclared: E,\n\tcause: Cause.Cause<unknown>,\n): Cause.Cause<\n\t| E[\"Type\"]\n\t| Contract.UndeclaredFailure\n\t| RemoteWithdrawn\n\t| RemoteError\n\t| MissingInstance\n> =>\n\tCause.fromReasons(\n\t\tArray.flatMap(cause.reasons, (reason) => {\n\t\t\tif (reason._tag !== \"Fail\") return [reason]\n\t\t\treturn Schema.is(CapabilityFailed)(reason.error)\n\t\t\t\t? Array.map(\n\t\t\t\t\t\tpublicCause(declared, reason.error.cause).reasons,\n\t\t\t\t\t\t(inner) => inner.annotate(Cause.reasonAnnotations(reason)),\n\t\t\t\t\t)\n\t\t\t\t: [\n\t\t\t\t\t\tCause.makeFailReason(publicError(declared, reason.error)).annotate(\n\t\t\t\t\t\t\tCause.reasonAnnotations(reason),\n\t\t\t\t\t\t),\n\t\t\t\t\t]\n\t\t}),\n\t)\n\nexport const plugin = <\n\tS extends Schema.Top & {\n\t\treadonly Encoded: Schema.Json\n\t\treadonly DecodingServices: never\n\t\treadonly EncodingServices: never\n\t},\n\tE extends Schema.Top & {\n\t\treadonly DecodingServices: never\n\t\treadonly EncodingServices: never\n\t},\n\tconst D extends ReadonlyArray<Plugin.Dependency> = readonly [],\n>(\n\tcontract: Contract.Contract<S, E>,\n\toptions: Options<D> & { readonly config?: S[\"Encoded\"] },\n): Plugin.Plugin<\n\tvoid,\n\tvoid,\n\t| E[\"Type\"]\n\t| Contract.UndeclaredFailure\n\t| RemoteError\n\t| RemoteWithdrawn\n\t| MissingInstance\n> =>\n\tPlugin.make({\n\t\tname: contract.name,\n\t\tinject: [\n\t\t\tPlugin.optional(ModuleResolver.ModuleResolver),\n\t\t\tPath.Path,\n\t\t\tSecureRandom.SecureRandom,\n\t\t\tChildProcessSpawner.ChildProcessSpawner,\n\t\t],\n\t\tretry: options.retry,\n\t\tapply: () =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst input = yield* Schema.decodeUnknownEffect(Configuration.Host)({\n\t\t\t\t\tcontract: options.contractModule,\n\t\t\t\t\tconnect: options.connect,\n\t\t\t\t\tconfig: options.config === undefined ? {} : options.config,\n\t\t\t\t})\n\t\t\t\tyield* Schema.decodeEffect(contract.config)(input.config)\n\t\t\t\tconst child = yield* launch(\n\t\t\t\t\tcontract,\n\t\t\t\t\tinput,\n\t\t\t\t\t{\n\t\t\t\t\t\tcontractModule: options.contractModule,\n\t\t\t\t\t\tshutdownTimeout: options.shutdownTimeout,\n\t\t\t\t\t},\n\t\t\t\t\tCredential.invocation(options.connect),\n\t\t\t\t)\n\t\t\t\tyield* follow(child, (cause) =>\n\t\t\t\t\tEffect.failCause(publicCause(contract.error, cause)),\n\t\t\t\t)\n\t\t\t}).pipe(Effect.mapError((error) => publicError(contract.error, error))),\n\t})\nexport { host as default } from \"./internal/entry\"\n"],"mappings":";;;;;;;;;;;;;;;;;AAkCA,MAAM,eACL,UACA,UAQA,MAAM,YACL,MAAM,QAAQ,MAAM,UAAU,WAAW;CACxC,IAAI,OAAO,SAAS,QAAQ,OAAO,CAAC,MAAM;CAC1C,OAAO,OAAO,GAAG,gBAAgB,CAAC,CAAC,OAAO,KAAK,IAC5C,MAAM,IACN,YAAY,UAAU,OAAO,MAAM,KAAK,CAAC,CAAC,UACzC,UAAU,MAAM,SAAS,MAAM,kBAAkB,MAAM,CAAC,CAC1D,IACC,CACA,MAAM,eAAe,YAAY,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,SACzD,MAAM,kBAAkB,MAAM,CAC/B,CACD;AACH,CAAC,CACF;AAED,MAAa,UAYZ,UACA,YAUA,OAAO,KAAK;CACX,MAAM,SAAS;CACf,QAAQ;EACP,OAAO,SAAS,eAAe,cAAc;EAC7C,KAAK;EACL,aAAa;EACb,oBAAoB;CACrB;CACA,OAAO,QAAQ;CACf,aACC,OAAO,IAAI,aAAa;EACvB,MAAM,QAAQ,OAAO,OAAO,oBAAoBA,IAAkB,CAAC,CAAC;GACnE,UAAU,QAAQ;GAClB,SAAS,QAAQ;GACjB,QAAQ,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,QAAQ;EACrD,CAAC;EACD,OAAO,OAAO,aAAa,SAAS,MAAM,CAAC,CAAC,MAAM,MAAM;EACxD,MAAM,QAAQ,OAAO,OACpB,UACA,OACA;GACC,gBAAgB,QAAQ;GACxB,iBAAiB,QAAQ;EAC1B,GACAC,WAAsB,QAAQ,OAAO,CACtC;EACA,OAAO,OAAO,QAAQ,UACrB,OAAO,UAAU,YAAY,SAAS,OAAO,KAAK,CAAC,CACpD;CACD,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAU,YAAY,SAAS,OAAO,KAAK,CAAC,CAAC;AACxE,CAAC"}

package/dist/internal/Certificates.js

@@ -0,0 +1,182 @@
+import { Array, DateTime, Effect, FileSystem, Path, Redacted, Result, Schema, String } from "effect";
+import { SecureRandom, WebCrypto } from "effect/crypto";
+import { Base64 } from "effect/encoding";
+import { NetAddress } from "effect/net";
+import * as asn1js from "asn1js";
+import * as pki from "pkijs";
+// src/internal/Certificates.ts
+var CertificateError = class extends Schema.TaggedError()("CertificateError", {
+	detail: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {
+	get message() {
+		return this.detail;
+	}
+};
+/** A requested output already exists and replacing it was not asked for. */
+var CertificateExists = class extends Schema.TaggedError()("CertificateExists", { file: Schema.String }) {
+	get message() {
+		return `${this.file} already exists; use --force to replace the requested certificates`;
+	}
+};
+const pem = (label, bytes) => `-----BEGIN ${label}-----\n${String.replace(/.{64}(?=.)/g, "$&\n")(Base64.encode(new Uint8Array(bytes)))}\n-----END ${label}-----\n`;
+const der = (value) => Effect.fromResult(Base64.decode(String.replace(/-----[^-]+-----|\s/g, "")(value))).pipe(Effect.map((bytes) => new Uint8Array(bytes)));
+const subject = (name) => new pki.RelativeDistinguishedNames({ typesAndValues: [new pki.AttributeTypeAndValue({
+	type: "2.5.4.3",
+	value: new asn1js.Utf8String({ value: name })
+})] });
+const hostName = (host) => Result.match(NetAddress.ipFromString(host), {
+	onFailure: () => new pki.GeneralName({
+		type: 2,
+		value: host
+	}),
+	onSuccess: (ip) => new pki.GeneralName({
+		type: 7,
+		value: new asn1js.OctetString({ valueHex: new Uint8Array(ip._tag === "Ipv4Address" ? NetAddress.ipv4ToOctets(ip) : NetAddress.ipv6ToOctets(ip)) })
+	})
+});
+const issue = Effect.fn("Certificates.issue")(function* (options) {
+	const serial = yield* (yield* SecureRandom.SecureRandom).randomBytes(19);
+	const now = yield* DateTime.now;
+	const webcrypto = yield* WebCrypto.WebCrypto;
+	const engine = new pki.CryptoEngine({
+		name: "Node WebCrypto",
+		crypto: webcrypto
+	});
+	const failure = (cause) => CertificateError.make({
+		detail: `Could not issue the certificate for ${options.name}`,
+		cause
+	});
+	const keys = yield* Effect.tryPromise({
+		try: () => webcrypto.subtle.generateKey({
+			name: "ECDSA",
+			namedCurve: "P-256"
+		}, true, ["sign", "verify"]),
+		catch: failure
+	});
+	const authority = options.issuer === void 0 ? void 0 : {
+		certificate: yield* Effect.mapError(der(options.issuer.certificate), failure),
+		privateKey: yield* Effect.mapError(der(Redacted.value(options.issuer.privateKey)), failure)
+	};
+	const signingKey = authority === void 0 ? keys.privateKey : yield* Effect.tryPromise({
+		try: () => webcrypto.subtle.importKey("pkcs8", authority.privateKey, {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		}, false, ["sign"]),
+		catch: failure
+	});
+	const certificate = yield* Effect.try({
+		try: () => {
+			const issuer = authority === void 0 ? void 0 : pki.Certificate.fromBER(authority.certificate);
+			const names = [...Array.map(options.hosts ?? [], hostName), ...Array.map(options.identities ?? [], (identity) => new pki.GeneralName({
+				type: 6,
+				value: `graft://${identity}`
+			}))];
+			return new pki.Certificate({
+				version: 2,
+				serialNumber: new asn1js.Integer({ valueHex: new Uint8Array([1, ...serial]) }),
+				subject: subject(options.name),
+				issuer: issuer?.subject ?? subject(options.name),
+				notBefore: new pki.Time({ value: DateTime.toDateUtc(now) }),
+				notAfter: new pki.Time({ value: DateTime.toDateUtc(DateTime.add(now, { days: options.days })) }),
+				extensions: [
+					new pki.Extension({
+						extnID: "2.5.29.19",
+						critical: true,
+						extnValue: new pki.BasicConstraints({ cA: options.usage === "ca" }).toSchema().toBER()
+					}),
+					new pki.Extension({
+						extnID: "2.5.29.15",
+						critical: true,
+						extnValue: new asn1js.BitString({ valueHex: new Uint8Array([options.usage === "ca" ? 6 : 128]) }).toBER()
+					}),
+					...options.usage === "ca" ? [] : [new pki.Extension({
+						extnID: "2.5.29.37",
+						extnValue: new pki.ExtKeyUsage({ keyPurposes: [options.usage === "server" ? "1.3.6.1.5.5.7.3.1" : "1.3.6.1.5.5.7.3.2"] }).toSchema().toBER()
+					})],
+					...names.length === 0 ? [] : [new pki.Extension({
+						extnID: "2.5.29.17",
+						extnValue: new pki.AltName({ altNames: names }).toSchema().toBER()
+					})]
+				]
+			});
+		},
+		catch: failure
+	});
+	yield* Effect.tryPromise({
+		try: () => certificate.subjectPublicKeyInfo.importKey(keys.publicKey, engine),
+		catch: failure
+	});
+	yield* Effect.tryPromise({
+		try: () => certificate.sign(signingKey, "SHA-256", engine),
+		catch: failure
+	});
+	const privateKey = yield* Effect.tryPromise({
+		try: () => webcrypto.subtle.exportKey("pkcs8", keys.privateKey),
+		catch: failure
+	});
+	return yield* Effect.try({
+		try: () => ({
+			certificate: pem("CERTIFICATE", certificate.toSchema().toBER()),
+			privateKey: Redacted.make(pem("PRIVATE KEY", privateKey))
+		}),
+		catch: failure
+	});
+});
+const read = Effect.fn("Certificates.read")(function* (base) {
+	const fs = yield* FileSystem.FileSystem;
+	const certificate = yield* fs.readFileString(base + ".crt");
+	const privateKey = yield* fs.readFileString(base + ".key");
+	return {
+		certificate,
+		privateKey: Redacted.make(privateKey)
+	};
+});
+const write = Effect.fn("Certificates.write")(function* (base, pair, force = false) {
+	const fs = yield* FileSystem.FileSystem;
+	yield* fs.writeFileString(base + ".key", Redacted.value(pair.privateKey), {
+		flag: force ? "w" : "wx",
+		mode: 384
+	}).pipe(Effect.uninterruptible);
+	yield* fs.chmod(base + ".key", 384).pipe(Effect.uninterruptible);
+	yield* fs.writeFileString(base + ".crt", pair.certificate, { flag: force ? "w" : "wx" }).pipe(Effect.uninterruptible);
+});
+/** URI-encode names so each identity has a distinct filename, including names with slashes. */
+const clientName = (identity) => `client-${encodeURIComponent(identity)}`;
+const generate = Effect.fn("Certificates.generate")(function* (options) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const outputs = [...options.server.length === 0 ? [] : ["server"], ...Array.map(Array.dedupe(options.identity), clientName)];
+	if (!options.force) {
+		const files = Array.flatMap(outputs, (name) => Array.map([".crt", ".key"], (extension) => path.join(options.out, name + extension)));
+		const taken = yield* Effect.filter(files, fs.exists);
+		if (Array.isReadonlyArrayNonEmpty(taken)) return yield* CertificateExists.make({ file: taken[0] });
+	}
+	yield* fs.makeDirectory(options.out, { recursive: true }).pipe(Effect.uninterruptible);
+	const ca = path.join(options.out, "ca");
+	const issuer = (yield* fs.exists(ca + ".crt")) || (yield* fs.exists(ca + ".key")) ? yield* read(ca) : yield* issue({
+		name: "Graft CA",
+		usage: "ca",
+		days: options.days
+	}).pipe(Effect.tap((pair) => write(ca, pair)));
+	if (options.server.length > 0) {
+		const pair = yield* issue({
+			name: "Graft runner",
+			usage: "server",
+			hosts: options.server,
+			days: options.days,
+			issuer
+		});
+		yield* write(path.join(options.out, "server"), pair, options.force);
+	}
+	yield* Effect.forEach(Array.dedupe(options.identity), (identity) => issue({
+		name: identity,
+		usage: "client",
+		identities: [identity],
+		days: options.days,
+		issuer
+	}).pipe(Effect.flatMap((pair) => write(path.join(options.out, clientName(identity)), pair, options.force))), { discard: true });
+});
+export { CertificateError, CertificateExists, clientName, generate, issue, read, write };
+
+//# sourceMappingURL=Certificates.js.map