@graftland/plugin-remote 0.0.0-stage → 0.3.0

package/dist/internal/Certificates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Certificates.js","names":[],"sources":["../../src/internal/Certificates.ts"],"sourcesContent":["import {\n\tArray,\n\tDateTime,\n\tEffect,\n\tFileSystem,\n\tPath,\n\tRedacted,\n\tResult,\n\tSchema,\n\tString,\n} from \"effect\"\nimport { SecureRandom, WebCrypto } from \"effect/crypto\"\nimport { Base64 } from \"effect/encoding\"\nimport { NetAddress } from \"effect/net\"\nimport * as asn1js from \"asn1js\"\nimport * as pki from \"pkijs\"\n\nexport class CertificateError extends Schema.TaggedError<\n\tCertificateError,\n\t{ readonly brand: unique symbol }\n>()(\"CertificateError\", {\n\tdetail: Schema.String,\n\tcause: Schema.optional(Schema.Defect()),\n}) {\n\toverride get message() {\n\t\treturn this.detail\n\t}\n}\n\n/** A requested output already exists and replacing it was not asked for. */\nexport class CertificateExists extends Schema.TaggedError<\n\tCertificateExists,\n\t{ readonly brand: unique symbol }\n>()(\"CertificateExists\", { file: Schema.String }) {\n\toverride get message() {\n\t\treturn `${this.file} already exists; use --force to replace the requested certificates`\n\t}\n}\n\n/** Only PEM leaves this boundary; PKI.js objects stay local to each operation. */\nexport interface Pem {\n\treadonly certificate: string\n\treadonly privateKey: Redacted.Redacted<string>\n}\nexport interface IssueOptions {\n\treadonly name: string\n\treadonly days: number\n\treadonly usage: \"ca\" | \"server\" | \"client\"\n\treadonly hosts?: ReadonlyArray<string>\n\treadonly identities?: ReadonlyArray<string>\n\treadonly issuer?: Pem\n}\nconst pem = (label: string, bytes: ArrayBuffer) =>\n\t`-----BEGIN ${label}-----\\n${String.replace(/.{64}(?=.)/g, \"$&\\n\")(Base64.encode(new Uint8Array(bytes)))}\\n-----END ${label}-----\\n`\n// WebCrypto and PKI.js take ArrayBuffer-backed bytes, so the decoded view is copied into one.\nconst der = (value: string) =>\n\tEffect.fromResult(\n\t\tBase64.decode(String.replace(/-----[^-]+-----|\\s/g, \"\")(value)),\n\t).pipe(Effect.map((bytes) => new Uint8Array(bytes)))\nconst subject = (name: string) =>\n\tnew pki.RelativeDistinguishedNames({\n\t\ttypesAndValues: [\n\t\t\tnew pki.AttributeTypeAndValue({\n\t\t\t\ttype: \"2.5.4.3\",\n\t\t\t\tvalue: new asn1js.Utf8String({ value: name }),\n\t\t\t}),\n\t\t],\n\t})\nconst hostName = (host: string) =>\n\tResult.match(NetAddress.ipFromString(host), {\n\t\tonFailure: () => new pki.GeneralName({ type: 2, value: host }),\n\t\tonSuccess: (ip) =>\n\t\t\tnew pki.GeneralName({\n\t\t\t\ttype: 7,\n\t\t\t\tvalue: new asn1js.OctetString({\n\t\t\t\t\tvalueHex: new Uint8Array(\n\t\t\t\t\t\tip._tag === \"Ipv4Address\"\n\t\t\t\t\t\t\t? NetAddress.ipv4ToOctets(ip)\n\t\t\t\t\t\t\t: NetAddress.ipv6ToOctets(ip),\n\t\t\t\t\t),\n\t\t\t\t}),\n\t\t\t}),\n\t})\n\nexport const issue = Effect.fn(\"Certificates.issue\")(function* (\n\toptions: IssueOptions,\n) {\n\tconst random = yield* SecureRandom.SecureRandom\n\tconst serial = yield* random.randomBytes(19)\n\tconst now = yield* DateTime.now\n\tconst webcrypto = yield* WebCrypto.WebCrypto\n\tconst engine = new pki.CryptoEngine({\n\t\tname: \"Node WebCrypto\",\n\t\tcrypto: webcrypto,\n\t})\n\tconst failure = (cause: unknown) =>\n\t\tCertificateError.make({\n\t\t\tdetail: `Could not issue the certificate for ${options.name}`,\n\t\t\tcause,\n\t\t})\n\tconst keys = yield* Effect.tryPromise({\n\t\ttry: () =>\n\t\t\twebcrypto.subtle.generateKey(\n\t\t\t\t{ name: \"ECDSA\", namedCurve: \"P-256\" },\n\t\t\t\ttrue,\n\t\t\t\t[\"sign\", \"verify\"],\n\t\t\t),\n\t\tcatch: failure,\n\t})\n\t// Reused CA keys have the same P-256 / PKCS#8 format as the ones this command creates.\n\tconst authority =\n\t\toptions.issuer === undefined\n\t\t\t? undefined\n\t\t\t: {\n\t\t\t\t\tcertificate: yield* Effect.mapError(\n\t\t\t\t\t\tder(options.issuer.certificate),\n\t\t\t\t\t\tfailure,\n\t\t\t\t\t),\n\t\t\t\t\tprivateKey: yield* Effect.mapError(\n\t\t\t\t\t\tder(Redacted.value(options.issuer.privateKey)),\n\t\t\t\t\t\tfailure,\n\t\t\t\t\t),\n\t\t\t\t}\n\tconst signingKey =\n\t\tauthority === undefined\n\t\t\t? keys.privateKey\n\t\t\t: yield* Effect.tryPromise({\n\t\t\t\t\ttry: () =>\n\t\t\t\t\t\twebcrypto.subtle.importKey(\n\t\t\t\t\t\t\t\"pkcs8\",\n\t\t\t\t\t\t\tauthority.privateKey,\n\t\t\t\t\t\t\t{ name: \"ECDSA\", namedCurve: \"P-256\" },\n\t\t\t\t\t\t\tfalse,\n\t\t\t\t\t\t\t[\"sign\"],\n\t\t\t\t\t\t),\n\t\t\t\t\tcatch: failure,\n\t\t\t\t})\n\tconst certificate = yield* Effect.try({\n\t\ttry: () => {\n\t\t\tconst issuer =\n\t\t\t\tauthority === undefined\n\t\t\t\t\t? undefined\n\t\t\t\t\t: pki.Certificate.fromBER(authority.certificate)\n\t\t\tconst names = [\n\t\t\t\t...Array.map(options.hosts ?? [], hostName),\n\t\t\t\t...Array.map(\n\t\t\t\t\toptions.identities ?? [],\n\t\t\t\t\t(identity) =>\n\t\t\t\t\t\tnew pki.GeneralName({ type: 6, value: `graft://${identity}` }),\n\t\t\t\t),\n\t\t\t]\n\t\t\treturn new pki.Certificate({\n\t\t\t\tversion: 2,\n\t\t\t\t// A leading nonzero byte keeps the serial positive without losing random bits.\n\t\t\t\tserialNumber: new asn1js.Integer({\n\t\t\t\t\tvalueHex: new Uint8Array([1, ...serial]),\n\t\t\t\t}),\n\t\t\t\tsubject: subject(options.name),\n\t\t\t\tissuer: issuer?.subject ?? subject(options.name),\n\t\t\t\tnotBefore: new pki.Time({ value: DateTime.toDateUtc(now) }),\n\t\t\t\tnotAfter: new pki.Time({\n\t\t\t\t\tvalue: DateTime.toDateUtc(DateTime.add(now, { days: options.days })),\n\t\t\t\t}),\n\t\t\t\textensions: [\n\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\textnID: \"2.5.29.19\",\n\t\t\t\t\t\tcritical: true,\n\t\t\t\t\t\textnValue: new pki.BasicConstraints({ cA: options.usage === \"ca\" })\n\t\t\t\t\t\t\t.toSchema()\n\t\t\t\t\t\t\t.toBER(),\n\t\t\t\t\t}),\n\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\textnID: \"2.5.29.15\",\n\t\t\t\t\t\tcritical: true,\n\t\t\t\t\t\textnValue: new asn1js.BitString({\n\t\t\t\t\t\t\tvalueHex: new Uint8Array([options.usage === \"ca\" ? 0x06 : 0x80]),\n\t\t\t\t\t\t}).toBER(),\n\t\t\t\t\t}),\n\t\t\t\t\t...(options.usage === \"ca\"\n\t\t\t\t\t\t? []\n\t\t\t\t\t\t: [\n\t\t\t\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\t\t\t\textnID: \"2.5.29.37\",\n\t\t\t\t\t\t\t\t\textnValue: new pki.ExtKeyUsage({\n\t\t\t\t\t\t\t\t\t\tkeyPurposes: [\n\t\t\t\t\t\t\t\t\t\t\toptions.usage === \"server\"\n\t\t\t\t\t\t\t\t\t\t\t\t? \"1.3.6.1.5.5.7.3.1\"\n\t\t\t\t\t\t\t\t\t\t\t\t: \"1.3.6.1.5.5.7.3.2\",\n\t\t\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t\t\t\t.toSchema()\n\t\t\t\t\t\t\t\t\t\t.toBER(),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t]),\n\t\t\t\t\t...(names.length === 0\n\t\t\t\t\t\t? []\n\t\t\t\t\t\t: [\n\t\t\t\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\t\t\t\textnID: \"2.5.29.17\",\n\t\t\t\t\t\t\t\t\textnValue: new pki.AltName({ altNames: names })\n\t\t\t\t\t\t\t\t\t\t.toSchema()\n\t\t\t\t\t\t\t\t\t\t.toBER(),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t]),\n\t\t\t\t],\n\t\t\t})\n\t\t},\n\t\tcatch: failure,\n\t})\n\tyield* Effect.tryPromise({\n\t\ttry: () =>\n\t\t\tcertificate.subjectPublicKeyInfo.importKey(keys.publicKey, engine),\n\t\tcatch: failure,\n\t})\n\tyield* Effect.tryPromise({\n\t\ttry: () => certificate.sign(signingKey, \"SHA-256\", engine),\n\t\tcatch: failure,\n\t})\n\tconst privateKey = yield* Effect.tryPromise({\n\t\ttry: () => webcrypto.subtle.exportKey(\"pkcs8\", keys.privateKey),\n\t\tcatch: failure,\n\t})\n\treturn yield* Effect.try({\n\t\ttry: () => ({\n\t\t\tcertificate: pem(\"CERTIFICATE\", certificate.toSchema().toBER()),\n\t\t\tprivateKey: Redacted.make(pem(\"PRIVATE KEY\", privateKey)),\n\t\t}),\n\t\tcatch: failure,\n\t})\n})\n\nexport const read = Effect.fn(\"Certificates.read\")(function* (base: string) {\n\tconst fs = yield* FileSystem.FileSystem\n\tconst certificate = yield* fs.readFileString(base + \".crt\")\n\tconst privateKey = yield* fs.readFileString(base + \".key\")\n\treturn { certificate, privateKey: Redacted.make(privateKey) }\n})\nexport const write = Effect.fn(\"Certificates.write\")(function* (\n\tbase: string,\n\tpair: Pem,\n\tforce: boolean = false,\n) {\n\tconst fs = yield* FileSystem.FileSystem\n\tyield* fs\n\t\t.writeFileString(base + \".key\", Redacted.value(pair.privateKey), {\n\t\t\tflag: force ? \"w\" : \"wx\",\n\t\t\tmode: 0o600,\n\t\t})\n\t\t.pipe(Effect.uninterruptible)\n\t// Opening an existing file does not change its permissions when renewing it.\n\tyield* fs.chmod(base + \".key\", 0o600).pipe(Effect.uninterruptible)\n\tyield* fs\n\t\t.writeFileString(base + \".crt\", pair.certificate, {\n\t\t\tflag: force ? \"w\" : \"wx\",\n\t\t})\n\t\t.pipe(Effect.uninterruptible)\n})\n\nexport interface Options {\n\treadonly out: string\n\treadonly server: ReadonlyArray<string>\n\treadonly identity: ReadonlyArray<string>\n\treadonly days: number\n\treadonly force: boolean\n}\n/** URI-encode names so each identity has a distinct filename, including names with slashes. */\nexport const clientName = (identity: string) =>\n\t`client-${encodeURIComponent(identity)}`\nexport const generate = Effect.fn(\"Certificates.generate\")(function* (\n\toptions: Options,\n) {\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst outputs = [\n\t\t...(options.server.length === 0 ? [] : [\"server\"]),\n\t\t...Array.map(Array.dedupe(options.identity), clientName),\n\t]\n\tif (!options.force) {\n\t\tconst files = Array.flatMap(outputs, (name) =>\n\t\t\tArray.map([\".crt\", \".key\"], (extension) =>\n\t\t\t\tpath.join(options.out, name + extension),\n\t\t\t),\n\t\t)\n\t\tconst taken = yield* Effect.filter(files, fs.exists)\n\t\tif (Array.isReadonlyArrayNonEmpty(taken))\n\t\t\treturn yield* CertificateExists.make({ file: taken[0] })\n\t}\n\tyield* fs\n\t\t.makeDirectory(options.out, { recursive: true })\n\t\t.pipe(Effect.uninterruptible)\n\tconst ca = path.join(options.out, \"ca\")\n\tconst existing =\n\t\t(yield* fs.exists(ca + \".crt\")) || (yield* fs.exists(ca + \".key\"))\n\t// An incomplete CA pair fails on read. Even --force never replaces the signing authority.\n\tconst issuer = existing\n\t\t? yield* read(ca)\n\t\t: yield* issue({ name: \"Graft CA\", usage: \"ca\", days: options.days }).pipe(\n\t\t\t\tEffect.tap((pair) => write(ca, pair)),\n\t\t\t)\n\tif (options.server.length > 0) {\n\t\tconst pair = yield* issue({\n\t\t\tname: \"Graft runner\",\n\t\t\tusage: \"server\",\n\t\t\thosts: options.server,\n\t\t\tdays: options.days,\n\t\t\tissuer,\n\t\t})\n\t\tyield* write(path.join(options.out, \"server\"), pair, options.force)\n\t}\n\tyield* Effect.forEach(\n\t\tArray.dedupe(options.identity),\n\t\t(identity) =>\n\t\t\tissue({\n\t\t\t\tname: identity,\n\t\t\t\tusage: \"client\",\n\t\t\t\tidentities: [identity],\n\t\t\t\tdays: options.days,\n\t\t\t\tissuer,\n\t\t\t}).pipe(\n\t\t\t\tEffect.flatMap((pair) =>\n\t\t\t\t\twrite(\n\t\t\t\t\t\tpath.join(options.out, clientName(identity)),\n\t\t\t\t\t\tpair,\n\t\t\t\t\t\toptions.force,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t),\n\t\t{ discard: true },\n\t)\n})\n"],"mappings":";;;;;;;AAiBA,IAAa,mBAAb,cAAsC,OAAO,YAG3C,CAAC,CAAC,oBAAoB;CACvB,QAAQ,OAAO;CACf,OAAO,OAAO,SAAS,OAAO,OAAO,CAAC;AACvC,CAAC,CAAC,CAAC;CACF,IAAa,UAAU;EACtB,OAAO,KAAK;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,OAAO,YAG5C,CAAC,CAAC,qBAAqB,EAAE,MAAM,OAAO,OAAO,CAAC,CAAC,CAAC;CACjD,IAAa,UAAU;EACtB,OAAO,GAAG,KAAK,KAAK;CACrB;AACD;AAeA,MAAM,OAAO,OAAe,UAC3B,cAAc,MAAM,SAAS,OAAO,QAAQ,eAAe,MAAM,CAAC,CAAC,OAAO,OAAO,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,aAAa,MAAM;AAE7H,MAAM,OAAO,UACZ,OAAO,WACN,OAAO,OAAO,OAAO,QAAQ,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAC/D,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,IAAI,WAAW,KAAK,CAAC,CAAC;AACpD,MAAM,WAAW,SAChB,IAAI,IAAI,2BAA2B,EAClC,gBAAgB,CACf,IAAI,IAAI,sBAAsB;CAC7B,MAAM;CACN,OAAO,IAAI,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;AAC7C,CAAC,CACF,EACD,CAAC;AACF,MAAM,YAAY,SACjB,OAAO,MAAM,WAAW,aAAa,IAAI,GAAG;CAC3C,iBAAiB,IAAI,IAAI,YAAY;EAAE,MAAM;EAAG,OAAO;CAAK,CAAC;CAC7D,YAAY,OACX,IAAI,IAAI,YAAY;EACnB,MAAM;EACN,OAAO,IAAI,OAAO,YAAY,EAC7B,UAAU,IAAI,WACb,GAAG,SAAS,gBACT,WAAW,aAAa,EAAE,IAC1B,WAAW,aAAa,EAAE,CAC9B,EACD,CAAC;CACF,CAAC;AACH,CAAC;AAEF,MAAa,QAAQ,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACpD,SACC;CAED,MAAM,SAAS,QAAO,OADA,aAAa,aAAA,CACN,YAAY,EAAE;CAC3C,MAAM,MAAM,OAAO,SAAS;CAC5B,MAAM,YAAY,OAAO,UAAU;CACnC,MAAM,SAAS,IAAI,IAAI,aAAa;EACnC,MAAM;EACN,QAAQ;CACT,CAAC;CACD,MAAM,WAAW,UAChB,iBAAiB,KAAK;EACrB,QAAQ,uCAAuC,QAAQ;EACvD;CACD,CAAC;CACF,MAAM,OAAO,OAAO,OAAO,WAAW;EACrC,WACC,UAAU,OAAO,YAChB;GAAE,MAAM;GAAS,YAAY;EAAQ,GACrC,MACA,CAAC,QAAQ,QAAQ,CAClB;EACD,OAAO;CACR,CAAC;CAED,MAAM,YACL,QAAQ,WAAW,KAAA,IAChB,KAAA,IACA;EACA,aAAa,OAAO,OAAO,SAC1B,IAAI,QAAQ,OAAO,WAAW,GAC9B,OACD;EACA,YAAY,OAAO,OAAO,SACzB,IAAI,SAAS,MAAM,QAAQ,OAAO,UAAU,CAAC,GAC7C,OACD;CACD;CACH,MAAM,aACL,cAAc,KAAA,IACX,KAAK,aACL,OAAO,OAAO,WAAW;EACzB,WACC,UAAU,OAAO,UAChB,SACA,UAAU,YACV;GAAE,MAAM;GAAS,YAAY;EAAQ,GACrC,OACA,CAAC,MAAM,CACR;EACD,OAAO;CACR,CAAC;CACJ,MAAM,cAAc,OAAO,OAAO,IAAI;EACrC,WAAW;GACV,MAAM,SACL,cAAc,KAAA,IACX,KAAA,IACA,IAAI,YAAY,QAAQ,UAAU,WAAW;GACjD,MAAM,QAAQ,CACb,GAAG,MAAM,IAAI,QAAQ,SAAS,CAAC,GAAG,QAAQ,GAC1C,GAAG,MAAM,IACR,QAAQ,cAAc,CAAC,IACtB,aACA,IAAI,IAAI,YAAY;IAAE,MAAM;IAAG,OAAO,WAAW;GAAW,CAAC,CAC/D,CACD;GACA,OAAO,IAAI,IAAI,YAAY;IAC1B,SAAS;IAET,cAAc,IAAI,OAAO,QAAQ,EAChC,UAAU,IAAI,WAAW,CAAC,GAAG,GAAG,MAAM,CAAC,EACxC,CAAC;IACD,SAAS,QAAQ,QAAQ,IAAI;IAC7B,QAAQ,QAAQ,WAAW,QAAQ,QAAQ,IAAI;IAC/C,WAAW,IAAI,IAAI,KAAK,EAAE,OAAO,SAAS,UAAU,GAAG,EAAE,CAAC;IAC1D,UAAU,IAAI,IAAI,KAAK,EACtB,OAAO,SAAS,UAAU,SAAS,IAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,CAAC,EACpE,CAAC;IACD,YAAY;KACX,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,UAAU;MACV,WAAW,IAAI,IAAI,iBAAiB,EAAE,IAAI,QAAQ,UAAU,KAAK,CAAC,CAAC,CACjE,SAAS,CAAC,CACV,MAAM;KACT,CAAC;KACD,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,UAAU;MACV,WAAW,IAAI,OAAO,UAAU,EAC/B,UAAU,IAAI,WAAW,CAAC,QAAQ,UAAU,OAAO,IAAO,GAAI,CAAC,EAChE,CAAC,CAAC,CAAC,MAAM;KACV,CAAC;KACD,GAAI,QAAQ,UAAU,OACnB,CAAC,IACD,CACA,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,WAAW,IAAI,IAAI,YAAY,EAC9B,aAAa,CACZ,QAAQ,UAAU,WACf,sBACA,mBACJ,EACD,CAAC,CAAC,CACA,SAAS,CAAC,CACV,MAAM;KACT,CAAC,CACF;KACF,GAAI,MAAM,WAAW,IAClB,CAAC,IACD,CACA,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,WAAW,IAAI,IAAI,QAAQ,EAAE,UAAU,MAAM,CAAC,CAAC,CAC7C,SAAS,CAAC,CACV,MAAM;KACT,CAAC,CACF;IACH;GACD,CAAC;EACF;EACA,OAAO;CACR,CAAC;CACD,OAAO,OAAO,WAAW;EACxB,WACC,YAAY,qBAAqB,UAAU,KAAK,WAAW,MAAM;EAClE,OAAO;CACR,CAAC;CACD,OAAO,OAAO,WAAW;EACxB,WAAW,YAAY,KAAK,YAAY,WAAW,MAAM;EACzD,OAAO;CACR,CAAC;CACD,MAAM,aAAa,OAAO,OAAO,WAAW;EAC3C,WAAW,UAAU,OAAO,UAAU,SAAS,KAAK,UAAU;EAC9D,OAAO;CACR,CAAC;CACD,OAAO,OAAO,OAAO,IAAI;EACxB,YAAY;GACX,aAAa,IAAI,eAAe,YAAY,SAAS,CAAC,CAAC,MAAM,CAAC;GAC9D,YAAY,SAAS,KAAK,IAAI,eAAe,UAAU,CAAC;EACzD;EACA,OAAO;CACR,CAAC;AACF,CAAC;AAED,MAAa,OAAO,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,MAAc;CAC3E,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,cAAc,OAAO,GAAG,eAAe,OAAO,MAAM;CAC1D,MAAM,aAAa,OAAO,GAAG,eAAe,OAAO,MAAM;CACzD,OAAO;EAAE;EAAa,YAAY,SAAS,KAAK,UAAU;CAAE;AAC7D,CAAC;AACD,MAAa,QAAQ,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACpD,MACA,MACA,QAAiB,OAChB;CACD,MAAM,KAAK,OAAO,WAAW;CAC7B,OAAO,GACL,gBAAgB,OAAO,QAAQ,SAAS,MAAM,KAAK,UAAU,GAAG;EAChE,MAAM,QAAQ,MAAM;EACpB,MAAM;CACP,CAAC,CAAC,CACD,KAAK,OAAO,eAAe;CAE7B,OAAO,GAAG,MAAM,OAAO,QAAQ,GAAK,CAAC,CAAC,KAAK,OAAO,eAAe;CACjE,OAAO,GACL,gBAAgB,OAAO,QAAQ,KAAK,aAAa,EACjD,MAAM,QAAQ,MAAM,KACrB,CAAC,CAAC,CACD,KAAK,OAAO,eAAe;AAC9B,CAAC;;AAUD,MAAa,cAAc,aAC1B,UAAU,mBAAmB,QAAQ;AACtC,MAAa,WAAW,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAC1D,SACC;CACD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,UAAU,CACf,GAAI,QAAQ,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,GAChD,GAAG,MAAM,IAAI,MAAM,OAAO,QAAQ,QAAQ,GAAG,UAAU,CACxD;CACA,IAAI,CAAC,QAAQ,OAAO;EACnB,MAAM,QAAQ,MAAM,QAAQ,UAAU,SACrC,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,cAC5B,KAAK,KAAK,QAAQ,KAAK,OAAO,SAAS,CACxC,CACD;EACA,MAAM,QAAQ,OAAO,OAAO,OAAO,OAAO,GAAG,MAAM;EACnD,IAAI,MAAM,wBAAwB,KAAK,GACtC,OAAO,OAAO,kBAAkB,KAAK,EAAE,MAAM,MAAM,GAAG,CAAC;CACzD;CACA,OAAO,GACL,cAAc,QAAQ,KAAK,EAAE,WAAW,KAAK,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe;CAC7B,MAAM,KAAK,KAAK,KAAK,QAAQ,KAAK,IAAI;CAItC,MAAM,UAFJ,OAAO,GAAG,OAAO,KAAK,MAAM,OAAO,OAAO,GAAG,OAAO,KAAK,MAAM,KAG9D,OAAO,KAAK,EAAE,IACd,OAAO,MAAM;EAAE,MAAM;EAAY,OAAO;EAAM,MAAM,QAAQ;CAAK,CAAC,CAAC,CAAC,KACpE,OAAO,KAAK,SAAS,MAAM,IAAI,IAAI,CAAC,CACrC;CACF,IAAI,QAAQ,OAAO,SAAS,GAAG;EAC9B,MAAM,OAAO,OAAO,MAAM;GACzB,MAAM;GACN,OAAO;GACP,OAAO,QAAQ;GACf,MAAM,QAAQ;GACd;EACD,CAAC;EACD,OAAO,MAAM,KAAK,KAAK,QAAQ,KAAK,QAAQ,GAAG,MAAM,QAAQ,KAAK;CACnE;CACA,OAAO,OAAO,QACb,MAAM,OAAO,QAAQ,QAAQ,IAC5B,aACA,MAAM;EACL,MAAM;EACN,OAAO;EACP,YAAY,CAAC,QAAQ;EACrB,MAAM,QAAQ;EACd;CACD,CAAC,CAAC,CAAC,KACF,OAAO,SAAS,SACf,MACC,KAAK,KAAK,QAAQ,KAAK,WAAW,QAAQ,CAAC,GAC3C,MACA,QAAQ,KACT,CACD,CACD,GACD,EAAE,SAAS,KAAK,CACjB;AACD,CAAC"}

package/dist/internal/FailureGroup.js

@@ -0,0 +1,55 @@
+import { ReleaseInterrupted, close } from "./release.js";
+import { Array, Cause, Data, Deferred, Effect, Exit, Fiber, FiberSet, Ref, Schema, Scope, TxRef } from "effect";
+// src/internal/FailureGroup.ts
+const State = Data.taggedEnum();
+/** One owner for first failure, transaction wakeups, and interruption of sibling work. */
+const make = () => Effect.gen(function* () {
+	const fibers = yield* FiberSet.make();
+	const state = yield* TxRef.make(State.Open());
+	const failures = yield* Ref.make(Cause.empty);
+	const cleanup = yield* Ref.make(Cause.empty);
+	const check = TxRef.get(state).pipe(Effect.flatMap((s) => s._tag === "Failed" ? Effect.failCause(s.cause) : s._tag === "Closed" ? Effect.interrupt : Effect.void));
+	const publish = (cause) => TxRef.update(state, (s) => s._tag === "Open" ? State.Failed({ cause }) : s);
+	const observe = (effect) => Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+		const scope = yield* Scope.make();
+		const ownerId = yield* Effect.withFiber((self) => Effect.succeed(self.id));
+		const worker = yield* Effect.forkIn(restore(Scope.provide(scope)(effect)), scope);
+		const waiting = yield* Effect.exit(restore(Fiber.await(worker)));
+		if (Exit.isFailure(waiting)) yield* Fiber.interrupt(worker);
+		const body = yield* Fiber.await(worker);
+		const closed = yield* Effect.exit(close(scope, body));
+		const expected = Exit.isFailure(waiting) && Exit.isFailure(body) && Array.every(body.cause.reasons, (reason) => reason._tag === "Interrupt" && reason.fiberId === ownerId);
+		const bodyCause = Exit.isFailure(body) && !expected ? body.cause : Cause.empty;
+		const releaseCause = Exit.isFailure(closed) && !Cause.hasInterruptsOnly(closed.cause) ? closed.cause : Cause.empty;
+		const failure = Cause.combine(bodyCause, releaseCause);
+		const closing = Cause.combine(Cause.hasInterrupts(bodyCause) || Array.some(bodyCause.reasons, (reason) => reason._tag === "Die" && Schema.is(ReleaseInterrupted)(reason.defect)) ? bodyCause : Cause.empty, releaseCause);
+		yield* Ref.update(cleanup, (cause) => Cause.combine(cause, closing));
+		if (failure.reasons.length > 0) {
+			yield* Ref.update(failures, (cause) => Cause.combine(cause, failure));
+			yield* publish(failure);
+			yield* Deferred.failCause(fibers.deferred, failure);
+		}
+		if (Exit.isFailure(closed)) return yield* Effect.failCause(Exit.isFailure(body) ? Cause.combine(body.cause, closed.cause) : closed.cause);
+		if (Exit.isFailure(waiting) && Exit.isSuccess(body)) return yield* Effect.failCause(waiting.cause);
+		return yield* body;
+	}));
+	yield* FiberSet.join(fibers).pipe(Effect.catchCause((cause) => publish(cause).pipe(Effect.andThen(FiberSet.clear(fibers)), Effect.uninterruptible)), Effect.forkScoped);
+	const failure = Effect.tx(check.pipe(Effect.andThen(Effect.txRetry)));
+	const failCause = (cause) => FiberSet.run(fibers, observe(Effect.failCause(cause))).pipe(Effect.asVoid);
+	const close$1 = TxRef.update(state, (s) => s._tag === "Open" ? State.Closed() : s).pipe(Effect.andThen(FiberSet.clear(fibers)), Effect.andThen(Ref.get(cleanup)), Effect.flatMap((cause) => cause.reasons.length > 0 ? Effect.failCause(cause) : Effect.void), Effect.uninterruptible);
+	yield* Effect.addFinalizer(() => close$1.pipe(Effect.orDie));
+	return {
+		await: failure,
+		check,
+		cause: Ref.get(failures),
+		runtime: () => FiberSet.runtime(fibers)().pipe(Effect.map((run) => (effect) => run(check.pipe(Effect.andThen(observe(effect)))))),
+		run: (effect) => FiberSet.run(fibers, check.pipe(Effect.andThen(observe(effect)))),
+		fail: (error) => failCause(Cause.fail(error)),
+		failCause,
+		race: (effect) => check.pipe(Effect.andThen(Effect.raceFirst(effect, failure))),
+		close: close$1
+	};
+});
+export { make };
+
+//# sourceMappingURL=FailureGroup.js.map

package/dist/internal/FailureGroup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FailureGroup.js","names":["Release.close","Release.ReleaseInterrupted","close"],"sources":["../../src/internal/FailureGroup.ts"],"sourcesContent":["import {\n\tArray,\n\tCause,\n\tFiber,\n\tData,\n\tDeferred,\n\tEffect,\n\tExit,\n\tFiberSet,\n\tRef,\n\tScope,\n\tSchema,\n\tTxRef,\n} from \"effect\"\nimport * as Release from \"./release\"\n\ntype State<E> = Data.TaggedEnum<{\n\tOpen: {}\n\tFailed: { readonly cause: Cause.Cause<E> }\n\tClosed: {}\n}>\ninterface StateDefinition extends Data.TaggedEnum.WithGenerics<1> {\n\treadonly taggedEnum: State<this[\"A\"]>\n}\nconst State = Data.taggedEnum<StateDefinition>()\nexport interface FailureGroup<E> {\n\treadonly await: Effect.Effect<never, E>\n\treadonly check: Effect.Effect<void, E>\n\treadonly cause: Effect.Effect<Cause.Cause<E>>\n\treadonly run: <A, R>(\n\t\teffect: Effect.Effect<A, E, R>,\n\t) => Effect.Effect<Fiber.Fiber<A, E>, never, R>\n\treadonly fail: (error: E) => Effect.Effect<void>\n\treadonly failCause: (cause: Cause.Cause<E>) => Effect.Effect<void>\n\treadonly race: <A, E2, R>(\n\t\teffect: Effect.Effect<A, E2, R>,\n\t) => Effect.Effect<A, E | E2, R>\n\treadonly runtime: <R>() => Effect.Effect<\n\t\t(effect: Effect.Effect<unknown, E, R>) => Fiber.Fiber<unknown, E>,\n\t\tnever,\n\t\tR\n\t>\n\treadonly close: Effect.Effect<void, E>\n}\n\n/** One owner for first failure, transaction wakeups, and interruption of sibling work. */\nexport const make = <E>(): Effect.Effect<FailureGroup<E>, never, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst fibers = yield* FiberSet.make<unknown, E>()\n\t\tconst state = yield* TxRef.make<State<E>>(State.Open())\n\t\tconst failures = yield* Ref.make<Cause.Cause<E>>(Cause.empty)\n\t\tconst cleanup = yield* Ref.make<Cause.Cause<E>>(Cause.empty)\n\t\tconst check = TxRef.get(state).pipe(\n\t\t\tEffect.flatMap((s) =>\n\t\t\t\ts._tag === \"Failed\"\n\t\t\t\t\t? Effect.failCause(s.cause)\n\t\t\t\t\t: s._tag === \"Closed\"\n\t\t\t\t\t\t? Effect.interrupt\n\t\t\t\t\t\t: Effect.void,\n\t\t\t),\n\t\t)\n\t\tconst publish = (cause: Cause.Cause<E>) =>\n\t\t\tTxRef.update(state, (s): State<E> =>\n\t\t\t\ts._tag === \"Open\" ? State.Failed({ cause }) : s,\n\t\t\t)\n\n\t\tconst observe = <A, R>(effect: Effect.Effect<A, E, R>) =>\n\t\t\tEffect.uninterruptibleMask((restore) =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst scope = yield* Scope.make()\n\t\t\t\t\t// The owned child makes cancellation explicit, even when a stream closes an internal scope.\n\t\t\t\t\tconst ownerId = yield* Effect.withFiber((self) =>\n\t\t\t\t\t\tEffect.succeed(self.id),\n\t\t\t\t\t)\n\t\t\t\t\tconst worker = yield* Effect.forkIn(\n\t\t\t\t\t\trestore(Scope.provide(scope)(effect)),\n\t\t\t\t\t\tscope,\n\t\t\t\t\t)\n\t\t\t\t\tconst waiting = yield* Effect.exit(restore(Fiber.await(worker)))\n\t\t\t\t\tif (Exit.isFailure(waiting)) yield* Fiber.interrupt(worker)\n\t\t\t\t\tconst body = yield* Fiber.await(worker)\n\t\t\t\t\tconst closed = yield* Effect.exit(Release.close(scope, body))\n\t\t\t\t\t// Forwarding this exact cancellation from a finalizer is indistinguishable from acknowledging it.\n\t\t\t\t\tconst expected =\n\t\t\t\t\t\tExit.isFailure(waiting) &&\n\t\t\t\t\t\tExit.isFailure(body) &&\n\t\t\t\t\t\tArray.every(\n\t\t\t\t\t\t\tbody.cause.reasons,\n\t\t\t\t\t\t\t(reason) =>\n\t\t\t\t\t\t\t\treason._tag === \"Interrupt\" && reason.fiberId === ownerId,\n\t\t\t\t\t\t)\n\t\t\t\t\tconst bodyCause =\n\t\t\t\t\t\tExit.isFailure(body) && !expected ? body.cause : Cause.empty\n\t\t\t\t\t// Release.close marks independent interruptions; an unmarked one is pending cancellation.\n\t\t\t\t\tconst releaseCause =\n\t\t\t\t\t\tExit.isFailure(closed) && !Cause.hasInterruptsOnly(closed.cause)\n\t\t\t\t\t\t\t? closed.cause\n\t\t\t\t\t\t\t: Cause.empty\n\t\t\t\t\tconst failure = Cause.combine(bodyCause, releaseCause)\n\t\t\t\t\t// Body cleanup may carry either an interruption or a release defect from an inner group.\n\t\t\t\t\tconst closing = Cause.combine(\n\t\t\t\t\t\tCause.hasInterrupts(bodyCause) ||\n\t\t\t\t\t\t\tArray.some(\n\t\t\t\t\t\t\t\tbodyCause.reasons,\n\t\t\t\t\t\t\t\t(reason) =>\n\t\t\t\t\t\t\t\t\treason._tag === \"Die\" &&\n\t\t\t\t\t\t\t\t\tSchema.is(Release.ReleaseInterrupted)(reason.defect),\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t? bodyCause\n\t\t\t\t\t\t\t: Cause.empty,\n\t\t\t\t\t\treleaseCause,\n\t\t\t\t\t)\n\t\t\t\t\tyield* Ref.update(cleanup, (cause) => Cause.combine(cause, closing))\n\t\t\t\t\tif (failure.reasons.length > 0) {\n\t\t\t\t\t\tyield* Ref.update(failures, (cause) =>\n\t\t\t\t\t\t\tCause.combine(cause, failure),\n\t\t\t\t\t\t)\n\t\t\t\t\t\tyield* publish(failure)\n\t\t\t\t\t\tyield* Deferred.failCause(fibers.deferred, failure)\n\t\t\t\t\t}\n\t\t\t\t\tif (Exit.isFailure(closed))\n\t\t\t\t\t\treturn yield* Effect.failCause(\n\t\t\t\t\t\t\tExit.isFailure(body)\n\t\t\t\t\t\t\t\t? Cause.combine(body.cause, closed.cause)\n\t\t\t\t\t\t\t\t: closed.cause,\n\t\t\t\t\t\t)\n\t\t\t\t\tif (Exit.isFailure(waiting) && Exit.isSuccess(body))\n\t\t\t\t\t\treturn yield* Effect.failCause(waiting.cause)\n\t\t\t\t\treturn yield* body\n\t\t\t\t}),\n\t\t\t)\n\t\tyield* FiberSet.join(fibers).pipe(\n\t\t\tEffect.catchCause((cause) =>\n\t\t\t\tpublish(cause).pipe(\n\t\t\t\t\tEffect.andThen(FiberSet.clear(fibers)),\n\t\t\t\t\tEffect.uninterruptible,\n\t\t\t\t),\n\t\t\t),\n\t\t\tEffect.forkScoped,\n\t\t)\n\t\tconst failure = Effect.tx(check.pipe(Effect.andThen(Effect.txRetry)))\n\t\tconst failCause = (cause: Cause.Cause<E>) =>\n\t\t\t// This is an explicit failure report, not cancellation of an owned worker.\n\t\t\tFiberSet.run(fibers, observe(Effect.failCause(cause))).pipe(Effect.asVoid)\n\t\tconst close = TxRef.update(state, (s) =>\n\t\t\ts._tag === \"Open\" ? State.Closed() : s,\n\t\t).pipe(\n\t\t\tEffect.andThen(FiberSet.clear(fibers)),\n\t\t\tEffect.andThen(Ref.get(cleanup)),\n\t\t\tEffect.flatMap((cause) =>\n\t\t\t\tcause.reasons.length > 0 ? Effect.failCause(cause) : Effect.void,\n\t\t\t),\n\t\t\tEffect.uninterruptible,\n\t\t)\n\t\t// Operational failure is delivered by await; release must also deliver sibling cleanup failures.\n\t\tyield* Effect.addFinalizer(() => close.pipe(Effect.orDie))\n\t\treturn {\n\t\t\tawait: failure,\n\t\t\tcheck,\n\t\t\tcause: Ref.get(failures),\n\t\t\truntime: <R>() =>\n\t\t\t\tFiberSet.runtime(fibers)<R>().pipe(\n\t\t\t\t\tEffect.map(\n\t\t\t\t\t\t(run) => (effect: Effect.Effect<unknown, E, R>) =>\n\t\t\t\t\t\t\trun(check.pipe(Effect.andThen(observe(effect)))),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\trun: (effect) =>\n\t\t\t\tFiberSet.run(fibers, check.pipe(Effect.andThen(observe(effect)))),\n\t\t\tfail: (error) => failCause(Cause.fail(error)),\n\t\t\tfailCause,\n\t\t\trace: (effect) =>\n\t\t\t\tcheck.pipe(Effect.andThen(Effect.raceFirst(effect, failure))),\n\t\t\tclose,\n\t\t}\n\t})\n"],"mappings":";;;AAwBA,MAAM,QAAQ,KAAK,WAA4B;;AAsB/C,MAAa,aACZ,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,SAAS,KAAiB;CAChD,MAAM,QAAQ,OAAO,MAAM,KAAe,MAAM,KAAK,CAAC;CACtD,MAAM,WAAW,OAAO,IAAI,KAAqB,MAAM,KAAK;CAC5D,MAAM,UAAU,OAAO,IAAI,KAAqB,MAAM,KAAK;CAC3D,MAAM,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,KAC9B,OAAO,SAAS,MACf,EAAE,SAAS,WACR,OAAO,UAAU,EAAE,KAAK,IACxB,EAAE,SAAS,WACV,OAAO,YACP,OAAO,IACZ,CACD;CACA,MAAM,WAAW,UAChB,MAAM,OAAO,QAAQ,MACpB,EAAE,SAAS,SAAS,MAAM,OAAO,EAAE,MAAM,CAAC,IAAI,CAC/C;CAED,MAAM,WAAiB,WACtB,OAAO,qBAAqB,YAC3B,OAAO,IAAI,aAAa;EACvB,MAAM,QAAQ,OAAO,MAAM,KAAK;EAEhC,MAAM,UAAU,OAAO,OAAO,WAAW,SACxC,OAAO,QAAQ,KAAK,EAAE,CACvB;EACA,MAAM,SAAS,OAAO,OAAO,OAC5B,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,GACpC,KACD;EACA,MAAM,UAAU,OAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,MAAM,CAAC,CAAC;EAC/D,IAAI,KAAK,UAAU,OAAO,GAAG,OAAO,MAAM,UAAU,MAAM;EAC1D,MAAM,OAAO,OAAO,MAAM,MAAM,MAAM;EACtC,MAAM,SAAS,OAAO,OAAO,KAAKA,MAAc,OAAO,IAAI,CAAC;EAE5D,MAAM,WACL,KAAK,UAAU,OAAO,KACtB,KAAK,UAAU,IAAI,KACnB,MAAM,MACL,KAAK,MAAM,UACV,WACA,OAAO,SAAS,eAAe,OAAO,YAAY,OACpD;EACD,MAAM,YACL,KAAK,UAAU,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,MAAM;EAExD,MAAM,eACL,KAAK,UAAU,MAAM,KAAK,CAAC,MAAM,kBAAkB,OAAO,KAAK,IAC5D,OAAO,QACP,MAAM;EACV,MAAM,UAAU,MAAM,QAAQ,WAAW,YAAY;EAErD,MAAM,UAAU,MAAM,QACrB,MAAM,cAAc,SAAS,KAC5B,MAAM,KACL,UAAU,UACT,WACA,OAAO,SAAS,SAChB,OAAO,GAAGC,kBAA0B,CAAC,CAAC,OAAO,MAAM,CACrD,IACE,YACA,MAAM,OACT,YACD;EACA,OAAO,IAAI,OAAO,UAAU,UAAU,MAAM,QAAQ,OAAO,OAAO,CAAC;EACnE,IAAI,QAAQ,QAAQ,SAAS,GAAG;GAC/B,OAAO,IAAI,OAAO,WAAW,UAC5B,MAAM,QAAQ,OAAO,OAAO,CAC7B;GACA,OAAO,QAAQ,OAAO;GACtB,OAAO,SAAS,UAAU,OAAO,UAAU,OAAO;EACnD;EACA,IAAI,KAAK,UAAU,MAAM,GACxB,OAAO,OAAO,OAAO,UACpB,KAAK,UAAU,IAAI,IAChB,MAAM,QAAQ,KAAK,OAAO,OAAO,KAAK,IACtC,OAAO,KACX;EACD,IAAI,KAAK,UAAU,OAAO,KAAK,KAAK,UAAU,IAAI,GACjD,OAAO,OAAO,OAAO,UAAU,QAAQ,KAAK;EAC7C,OAAO,OAAO;CACf,CAAC,CACF;CACD,OAAO,SAAS,KAAK,MAAM,CAAC,CAAC,KAC5B,OAAO,YAAY,UAClB,QAAQ,KAAK,CAAC,CAAC,KACd,OAAO,QAAQ,SAAS,MAAM,MAAM,CAAC,GACrC,OAAO,eACR,CACD,GACA,OAAO,UACR;CACA,MAAM,UAAU,OAAO,GAAG,MAAM,KAAK,OAAO,QAAQ,OAAO,OAAO,CAAC,CAAC;CACpE,MAAM,aAAa,UAElB,SAAS,IAAI,QAAQ,QAAQ,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;CAC1E,MAAMC,UAAQ,MAAM,OAAO,QAAQ,MAClC,EAAE,SAAS,SAAS,MAAM,OAAO,IAAI,CACtC,CAAC,CAAC,KACD,OAAO,QAAQ,SAAS,MAAM,MAAM,CAAC,GACrC,OAAO,QAAQ,IAAI,IAAI,OAAO,CAAC,GAC/B,OAAO,SAAS,UACf,MAAM,QAAQ,SAAS,IAAI,OAAO,UAAU,KAAK,IAAI,OAAO,IAC7D,GACA,OAAO,eACR;CAEA,OAAO,OAAO,mBAAmBA,QAAM,KAAK,OAAO,KAAK,CAAC;CACzD,OAAO;EACN,OAAO;EACP;EACA,OAAO,IAAI,IAAI,QAAQ;EACvB,eACC,SAAS,QAAQ,MAAM,CAAC,CAAI,CAAC,CAAC,KAC7B,OAAO,KACL,SAAS,WACT,IAAI,MAAM,KAAK,OAAO,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAAC,CACjD,CACD;EACD,MAAM,WACL,SAAS,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAAC;EACjE,OAAO,UAAU,UAAU,MAAM,KAAK,KAAK,CAAC;EAC5C;EACA,OAAO,WACN,MAAM,KAAK,OAAO,QAAQ,OAAO,UAAU,QAAQ,OAAO,CAAC,CAAC;EAC7D,OAAA;CACD;AACD,CAAC"}

package/dist/internal/Limits.d.ts

@@ -0,0 +1 @@
+import { Schema } from "effect";

package/dist/internal/Limits.js

@@ -0,0 +1,17 @@
+import { Schema } from "effect";
+// src/internal/Limits.ts
+const PositiveInt = Schema.Int.check(Schema.isGreaterThan(0));
+const PositiveFinite = Schema.Finite.check(Schema.isGreaterThan(0));
+const Limits = Schema.Struct({
+	control: PositiveInt,
+	data: PositiveInt,
+	log: PositiveInt
+});
+const defaults = {
+	control: 8,
+	data: 16,
+	log: 2
+};
+export { Limits, PositiveFinite, PositiveInt, defaults };
+
+//# sourceMappingURL=Limits.js.map

package/dist/internal/Limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Limits.js","names":[],"sources":["../../src/internal/Limits.ts"],"sourcesContent":["import { Schema } from \"effect\"\n\nexport const PositiveInt = Schema.Int.check(Schema.isGreaterThan(0))\nexport const PositiveFinite = Schema.Finite.check(Schema.isGreaterThan(0))\nexport const Limits = Schema.Struct({\n\tcontrol: PositiveInt,\n\tdata: PositiveInt,\n\tlog: PositiveInt,\n})\nexport type Limits = typeof Limits.Type\nexport type Priority = keyof Limits\nexport const defaults: Limits = { control: 8, data: 16, log: 2 }\n"],"mappings":";;AAEA,MAAa,cAAc,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AACnE,MAAa,iBAAiB,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC;AACzE,MAAa,SAAS,OAAO,OAAO;CACnC,SAAS;CACT,MAAM;CACN,KAAK;AACN,CAAC;AAGD,MAAa,WAAmB;CAAE,SAAS;CAAG,MAAM;CAAI,KAAK;AAAE"}

package/dist/internal/Peer.js

@@ -0,0 +1,6 @@
+import { Context } from "effect";
+// src/internal/Peer.ts
+var Peer = class extends Context.Service()("@graftland/plugin-remote/internal/Peer") {};
+export { Peer };
+
+//# sourceMappingURL=Peer.js.map

package/dist/internal/Peer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Peer.js","names":[],"sources":["../../src/internal/Peer.ts"],"sourcesContent":["import { Context } from \"effect\"\nexport class Peer extends Context.Service<Peer, string>()(\n\t\"@graftland/plugin-remote/internal/Peer\",\n) {}\n"],"mappings":";;AACA,IAAa,OAAb,cAA0B,QAAQ,QAAsB,CAAC,CACxD,wCACD,CAAC,CAAC,CAAC"}

package/dist/internal/ServeLifecycle.js

@@ -0,0 +1,26 @@
+import { close } from "./release.js";
+import { Context, Deferred, Effect, Exit, Option, Schema, Scope } from "effect";
+// src/internal/ServeLifecycle.ts
+var StartupError = class extends Schema.TaggedError()("RunnerStartupError", {
+	detail: Schema.String,
+	cause: Schema.optionalKey(Schema.Cause(Schema.Unknown, Schema.Defect()))
+}) {
+	get message() {
+		return this.detail;
+	}
+};
+var ServeLifecycle = class extends Context.Service()("@graftland/plugin-remote/internal/ServeLifecycle") {};
+const make = Effect.all({
+	ended: Deferred.make(),
+	released: Deferred.make()
+});
+/** Observe shutdown independently of the loader, which logs child cleanup failures. */
+const resources = Effect.fnUntraced(function* (lifecycle) {
+	return yield* Effect.acquireRelease(Scope.make(), (scope, exit) => close(scope, exit).pipe(Effect.onExit((released) => Option.isNone(lifecycle) ? Effect.void : Deferred.done(lifecycle.value.released, Exit.isSuccess(released) ? Exit.void : Exit.fail(StartupError.make({
+		detail: "Supervisor shutdown failed",
+		cause: released.cause
+	}))).pipe(Effect.asVoid))));
+});
+export { ServeLifecycle, StartupError, make, resources };
+
+//# sourceMappingURL=ServeLifecycle.js.map

package/dist/internal/ServeLifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServeLifecycle.js","names":["Release.close"],"sources":["../../src/internal/ServeLifecycle.ts"],"sourcesContent":["import { Context, Deferred, Effect, Exit, Option, Schema, Scope } from \"effect\"\nimport * as Release from \"./release\"\nimport type { TransportError } from \"../Errors\"\n\nexport class StartupError extends Schema.TaggedError<\n\tStartupError,\n\t{ readonly brand: unique symbol }\n>()(\"RunnerStartupError\", {\n\tdetail: Schema.String,\n\tcause: Schema.optionalKey(Schema.Cause(Schema.Unknown, Schema.Defect())),\n}) {\n\toverride get message() {\n\t\treturn this.detail\n\t}\n}\n\nexport class ServeLifecycle extends Context.Service<\n\tServeLifecycle,\n\t{\n\t\treadonly ended: Deferred.Deferred<void, TransportError>\n\t\treadonly released: Deferred.Deferred<void, StartupError>\n\t}\n>()(\"@graftland/plugin-remote/internal/ServeLifecycle\") {}\n\nexport const make = Effect.all({\n\tended: Deferred.make<void, TransportError>(),\n\treleased: Deferred.make<void, StartupError>(),\n})\n\n/** Observe shutdown independently of the loader, which logs child cleanup failures. */\nexport const resources = Effect.fnUntraced(function* (\n\tlifecycle: Option.Option<typeof ServeLifecycle.Service>,\n) {\n\treturn yield* Effect.acquireRelease(Scope.make(), (scope, exit) =>\n\t\tRelease.close(scope, exit).pipe(\n\t\t\tEffect.onExit((released) =>\n\t\t\t\tOption.isNone(lifecycle)\n\t\t\t\t\t? Effect.void\n\t\t\t\t\t: Deferred.done(\n\t\t\t\t\t\t\tlifecycle.value.released,\n\t\t\t\t\t\t\tExit.isSuccess(released)\n\t\t\t\t\t\t\t\t? Exit.void\n\t\t\t\t\t\t\t\t: Exit.fail(\n\t\t\t\t\t\t\t\t\t\tStartupError.make({\n\t\t\t\t\t\t\t\t\t\t\tdetail: \"Supervisor shutdown failed\",\n\t\t\t\t\t\t\t\t\t\t\tcause: released.cause,\n\t\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t).pipe(Effect.asVoid),\n\t\t\t),\n\t\t),\n\t)\n})\n"],"mappings":";;;AAIA,IAAa,eAAb,cAAkC,OAAO,YAGvC,CAAC,CAAC,sBAAsB;CACzB,QAAQ,OAAO;CACf,OAAO,OAAO,YAAY,OAAO,MAAM,OAAO,SAAS,OAAO,OAAO,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;CACF,IAAa,UAAU;EACtB,OAAO,KAAK;CACb;AACD;AAEA,IAAa,iBAAb,cAAoC,QAAQ,QAM1C,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC;AAEzD,MAAa,OAAO,OAAO,IAAI;CAC9B,OAAO,SAAS,KAA2B;CAC3C,UAAU,SAAS,KAAyB;AAC7C,CAAC;;AAGD,MAAa,YAAY,OAAO,WAAW,WAC1C,WACC;CACD,OAAO,OAAO,OAAO,eAAe,MAAM,KAAK,IAAI,OAAO,SACzDA,MAAc,OAAO,IAAI,CAAC,CAAC,KAC1B,OAAO,QAAQ,aACd,OAAO,OAAO,SAAS,IACpB,OAAO,OACP,SAAS,KACT,UAAU,MAAM,UAChB,KAAK,UAAU,QAAQ,IACpB,KAAK,OACL,KAAK,KACL,aAAa,KAAK;EACjB,QAAQ;EACR,OAAO,SAAS;CACjB,CAAC,CACF,CACH,CAAC,CAAC,KAAK,OAAO,MAAM,CACvB,CACD,CACD;AACD,CAAC"}

package/dist/internal/Supervisor.js

@@ -0,0 +1,7 @@
+import { Context } from "effect";
+// src/internal/Supervisor.ts
+/** A listener hands an authenticated byte channel to the supervisor. */
+var Supervisor = class extends Context.Service()("@graftland/plugin-remote/internal/Supervisor") {};
+export { Supervisor };
+
+//# sourceMappingURL=Supervisor.js.map

package/dist/internal/Supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Supervisor.js","names":[],"sources":["../../src/internal/Supervisor.ts"],"sourcesContent":["/** A listener hands an authenticated byte channel to the supervisor. */\nimport { Context } from \"effect\"\nimport type { Effect, Scope } from \"effect\"\nimport type { Peer } from \"./Peer\"\nimport type { Channel } from \"../Transport\"\nimport type { TransportError } from \"../Errors\"\nexport class Supervisor extends Context.Service<\n\tSupervisor,\n\t{\n\t\treadonly accept: (\n\t\t\tchannel: Channel,\n\t\t) => Effect.Effect<void, TransportError, Peer | Scope.Scope>\n\t}\n>()(\"@graftland/plugin-remote/internal/Supervisor\") {}\n"],"mappings":";;;AAMA,IAAa,aAAb,cAAgC,QAAQ,QAOtC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC"}

package/dist/internal/assembly.d.ts

@@ -0,0 +1,5 @@
+import "./port.js";
+import "../Errors.js";
+import "../Auth.js";
+import "../Transport.js";
+import { Effect, Schema } from "effect";

package/dist/internal/assembly.js

@@ -0,0 +1,138 @@
+import { findSubtree, isSubtreeActive } from "./forkTree.js";
+import { Peer } from "./Peer.js";
+import { Authenticator, Credentials } from "../Auth.js";
+import { Connector, Listener } from "../Transport.js";
+import { AuthenticationFailed } from "../Errors.js";
+import { Supervisor } from "./Supervisor.js";
+import { follow } from "./follow.js";
+import { closedNormally, connectionEnded } from "./runner/connectionEnded.js";
+import { ServeLifecycle } from "./ServeLifecycle.js";
+import { Graft, Plugin } from "@graftland/graft";
+import { Array, Deferred, Effect, Fiber, Option, Schema, Stream } from "effect";
+// src/internal/assembly.ts
+var ListenerConfigError = class extends Schema.TaggedError()("ListenerConfigError", { detail: Schema.String }) {
+	get message() {
+		return this.detail;
+	}
+};
+var CapabilityContractError = class extends Schema.TaggedError()("CapabilityContractError", {
+	plugin: Schema.String,
+	key: Schema.String
+}) {
+	get message() {
+		return `Capability ${this.plugin} became active without providing ${this.key}`;
+	}
+};
+var CapabilityCombinationError = class extends Schema.TaggedError()("CapabilityCombinationError", { detail: Schema.String }) {
+	get message() {
+		return this.detail;
+	}
+};
+var CapabilityFailed = class extends Schema.TaggedError()("CapabilityFailed", { cause: Schema.Cause(Schema.Unknown, Schema.Unknown) }) {};
+const definition = Schema.declare(Plugin.isPlugin);
+/** Entries resolve capability modules before assembling their private providers. */
+const Invocation = Schema.Struct({
+	plugin: definition,
+	config: Schema.Unknown
+});
+const Input = Schema.Struct({
+	transport: Invocation,
+	auth: Invocation,
+	consumer: definition,
+	input: Schema.optionalKey(Schema.Unknown)
+});
+const failure = (tree) => tree.state._tag === "Failed" ? Effect.fail(CapabilityFailed.make({ cause: tree.state.cause })) : Effect.forEach(tree.children, failure, { discard: true });
+const probe = (name, key) => Plugin.make({
+	name: "remote-capability-contract",
+	inject: [Plugin.optional(key)],
+	apply: Effect.fnUntraced(function* () {
+		const value = yield* Effect.serviceOption(key);
+		if (Option.isNone(value)) return yield* CapabilityContractError.make({
+			plugin: name,
+			key: key.key
+		});
+	})
+});
+/** Resolve the key in a fresh consumer after the provider subtree settles.
+* An optional consumer started earlier could still hold a pre-publication snapshot.
+*/
+const watch = (provider, key) => Plugin.fork(Graft.forks.pipe(Stream.map((trees) => findSubtree(trees, provider.id)), Stream.filter(Option.isSome), Stream.map((tree) => tree.value), Stream.tap(failure), Stream.map((tree) => ({
+	name: tree.name,
+	active: isSubtreeActive(tree)
+})), Stream.changesWith((left, right) => left.active === right.active), Stream.filter((tree) => tree.active), Stream.runForEach((tree) => Effect.scoped(Graft.plugin(probe(tree.name, key)).pipe(Effect.flatMap((fork) => fork.await))))));
+const assembly = (keys) => Plugin.make({
+	name: "remote-assembly",
+	config: Input,
+	apply: Effect.fnUntraced(function* (input) {
+		yield* Effect.forEach([{
+			invocation: input.transport,
+			key: keys[0]
+		}, {
+			invocation: input.auth,
+			key: keys[1]
+		}], Effect.fnUntraced(function* ({ invocation, key }) {
+			const provider = yield* Graft.plugin(invocation.plugin, invocation.config);
+			yield* watch(provider, key);
+		}));
+		const consumer = yield* Graft.plugin(input.consumer, input.input);
+		yield* consumer.state.pipe(Stream.filter((state) => state._tag !== "Loading" && (state._tag !== "Pending" || !Array.some(keys, (key) => Array.contains(state.missing, key.key)))), Stream.runHead);
+		yield* follow(consumer, (cause) => Effect.fail(CapabilityFailed.make({ cause })));
+	})
+});
+const hostAssembly = assembly([Connector, Credentials]);
+const runnerAssembly = assembly([Listener, Authenticator]);
+const host = (input) => Graft.plugin(hostAssembly, input, { isolate: [Connector, Credentials] });
+const runner = (input, consumer = listenerConsumer) => Graft.plugin(runnerAssembly, {
+	...input,
+	consumer
+}, { isolate: [Listener, Authenticator] });
+const compatible = (properties, kind) => {
+	if (kind === "Certificate" && (properties.protocol !== "wss" || !properties.encrypted || !Array.contains(properties.carries, "certificate"))) return Effect.fail(CapabilityCombinationError.make({ detail: "Mutual TLS requires encrypted wss with certificate evidence" }));
+	if (kind === "Authorization" && !Array.contains(properties.carries, "header")) return Effect.fail(CapabilityCombinationError.make({ detail: "This transport cannot carry Authorization headers" }));
+	return Effect.void;
+};
+const kind = (auth) => auth._tag === "Mtls" ? "Certificate" : auth._tag === "Header" ? "Authorization" : "None";
+const warn = (properties, credentials, side) => Effect.all([properties.network && !properties.encrypted ? Effect.logWarning(credentials === "Authorization" ? `${properties.protocol}:// ${side === "host" ? "connection" : "listener"} is unencrypted; credentials are transmitted in plaintext` : `${properties.protocol}:// ${side === "host" ? "connection" : "listener"} is unencrypted`) : Effect.void, side === "runner" && properties.network && credentials === "None" ? Effect.logWarning("WebSocket listener has no authentication") : Effect.void], { discard: true });
+const directAuth = (properties, explicit) => explicit && (properties.protocol === "stdio" || properties.protocol === "command") ? Effect.fail(CapabilityCombinationError.make({ detail: `${properties.protocol} transports do not accept auth` })) : Effect.void;
+const connectWith = (explicitAuth = false) => Effect.gen(function* () {
+	const connector = yield* Connector;
+	const credentials = yield* Credentials;
+	yield* directAuth(connector.properties, explicitAuth);
+	yield* compatible(connector.properties, credentials.kind);
+	yield* warn(connector.properties, credentials.kind, "host");
+	const prepared = yield* credentials.read;
+	return yield* connector.connect(prepared);
+});
+const accept = (auth, properties, session) => (handshake) => {
+	return (auth._tag === "Header" ? auth.authenticate(handshake.authorization) : auth._tag === "Mtls" ? Option.match(handshake.certificate, {
+		onNone: () => Effect.fail(AuthenticationFailed.make({ reason: "missing" })),
+		onSome: auth.authenticate
+	}) : (properties.network ? Effect.logWarning("WebSocket connection has no authentication") : Effect.void).pipe(Effect.as(auth.identity))).pipe(Effect.map(session));
+};
+const makeListenerConsumer = (prepare = () => Effect.void, ready = Effect.void) => Plugin.make({
+	name: "remote-listener-consumer",
+	inject: [
+		Listener,
+		Authenticator,
+		Supervisor,
+		Plugin.optional(ServeLifecycle)
+	],
+	apply: Effect.fnUntraced(function* () {
+		const listener = yield* Listener;
+		const auth = yield* Authenticator;
+		const supervisor = yield* Supervisor;
+		const lifecycle = yield* Effect.serviceOption(ServeLifecycle);
+		yield* prepare(listener.properties, auth);
+		yield* compatible(listener.properties, kind(auth)).pipe(Effect.mapError((error) => ListenerConfigError.make({ detail: error.detail })));
+		yield* warn(listener.properties, kind(auth), "runner");
+		const serving = yield* listener.bind(auth._tag === "Mtls" ? Option.some(auth.tls) : Option.none());
+		const running = yield* Plugin.fork(serving.serve(accept(auth, listener.properties, (identity) => (channel) => supervisor.accept(channel).pipe(Effect.catchCause((cause) => listener.properties.protocol === "stdio" ? closedNormally(cause) ? Effect.void : Effect.failCause(cause) : connectionEnded(cause)), Effect.provideService(Peer, identity)))).pipe(Effect.onExit((exit) => listener.properties.protocol === "stdio" && Option.isSome(lifecycle) ? Deferred.done(lifecycle.value.ended, exit) : Effect.void)));
+		yield* serving.ready.pipe(Effect.raceFirst(Fiber.join(running)));
+		yield* ready;
+	})
+});
+const listenerConsumer = makeListenerConsumer();
+connectWith();
+export { CapabilityCombinationError, CapabilityContractError, CapabilityFailed, Invocation, ListenerConfigError, accept, compatible, connectWith, directAuth, host, listenerConsumer, makeListenerConsumer, runner };
+
+//# sourceMappingURL=assembly.js.map

package/dist/internal/assembly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assembly.js","names":[],"sources":["../../src/internal/assembly.ts"],"sourcesContent":["import { findSubtree, isSubtreeActive } from \"./forkTree\"\nimport { Peer } from \"./Peer\"\nimport { Graft, Plugin, type Fork } from \"@graftland/graft\"\nimport {\n\tArray,\n\tContext,\n\tDeferred,\n\tEffect,\n\tFiber,\n\tOption,\n\tSchema,\n\tStream,\n} from \"effect\"\nimport {\n\tAuthenticator,\n\tCredentials,\n\ttype AuthenticatorApi,\n\ttype CredentialsApi,\n} from \"../Auth\"\nimport {\n\tConnector,\n\tListener,\n\ttype Accept,\n\ttype Properties,\n\ttype Session,\n} from \"../Transport\"\nimport { AuthenticationFailed } from \"../Errors\"\nimport { Supervisor } from \"./Supervisor\"\nimport { follow } from \"./follow\"\nimport { connectionEnded, closedNormally } from \"./runner/connectionEnded\"\nimport { ServeLifecycle } from \"./ServeLifecycle\"\n\nexport class ListenerConfigError extends Schema.TaggedError<\n\tListenerConfigError,\n\t{ readonly brand: unique symbol }\n>()(\"ListenerConfigError\", { detail: Schema.String }) {\n\toverride get message() {\n\t\treturn this.detail\n\t}\n}\n\nexport class CapabilityContractError extends Schema.TaggedError<\n\tCapabilityContractError,\n\t{ readonly brand: unique symbol }\n>()(\"CapabilityContractError\", { plugin: Schema.String, key: Schema.String }) {\n\toverride get message() {\n\t\treturn `Capability ${this.plugin} became active without providing ${this.key}`\n\t}\n}\nexport class CapabilityCombinationError extends Schema.TaggedError<\n\tCapabilityCombinationError,\n\t{ readonly brand: unique symbol }\n>()(\"CapabilityCombinationError\", { detail: Schema.String }) {\n\toverride get message() {\n\t\treturn this.detail\n\t}\n}\n\nexport class CapabilityFailed extends Schema.TaggedError<\n\tCapabilityFailed,\n\t{ readonly brand: unique symbol }\n>()(\"CapabilityFailed\", {\n\tcause: Schema.Cause(Schema.Unknown, Schema.Unknown),\n}) {}\n\nconst definition = Schema.declare(Plugin.isPlugin)\n/** Entries resolve capability modules before assembling their private providers. */\nexport const Invocation = Schema.Struct({\n\tplugin: definition,\n\tconfig: Schema.Unknown,\n})\nconst Input = Schema.Struct({\n\ttransport: Invocation,\n\tauth: Invocation,\n\tconsumer: definition,\n\tinput: Schema.optionalKey(Schema.Unknown),\n})\nexport type Input = typeof Input.Type\n\nconst failure = (tree: Fork.ForkTree): Effect.Effect<void, CapabilityFailed> =>\n\ttree.state._tag === \"Failed\"\n\t\t? Effect.fail(CapabilityFailed.make({ cause: tree.state.cause }))\n\t\t: Effect.forEach(tree.children, failure, { discard: true })\n\nconst probe = (name: string, key: Context.Key<unknown, unknown>) =>\n\tPlugin.make({\n\t\tname: \"remote-capability-contract\",\n\t\tinject: [Plugin.optional(key)],\n\t\tapply: Effect.fnUntraced(function* () {\n\t\t\tconst value = yield* Effect.serviceOption(key)\n\t\t\tif (Option.isNone(value))\n\t\t\t\treturn yield* CapabilityContractError.make({\n\t\t\t\t\tplugin: name,\n\t\t\t\t\tkey: key.key,\n\t\t\t\t})\n\t\t}),\n\t})\n\n/** Resolve the key in a fresh consumer after the provider subtree settles.\n * An optional consumer started earlier could still hold a pre-publication snapshot.\n */\nconst watch = (provider: Fork.Fork, key: Context.Key<unknown, unknown>) =>\n\tPlugin.fork(\n\t\tGraft.forks.pipe(\n\t\t\tStream.map((trees) => findSubtree(trees, provider.id)),\n\t\t\tStream.filter(Option.isSome),\n\t\t\tStream.map((tree) => tree.value),\n\t\t\tStream.tap(failure),\n\t\t\tStream.map((tree) => ({\n\t\t\t\tname: tree.name,\n\t\t\t\tactive: isSubtreeActive(tree),\n\t\t\t})),\n\t\t\tStream.changesWith((left, right) => left.active === right.active),\n\t\t\tStream.filter((tree) => tree.active),\n\t\t\tStream.runForEach((tree) =>\n\t\t\t\tEffect.scoped(\n\t\t\t\t\tGraft.plugin(probe(tree.name, key)).pipe(\n\t\t\t\t\t\tEffect.flatMap((fork) => fork.await),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t),\n\t\t),\n\t)\n\nconst assembly = (\n\tkeys: readonly [Context.Key<unknown, unknown>, Context.Key<unknown, unknown>],\n) =>\n\tPlugin.make({\n\t\tname: \"remote-assembly\",\n\t\tconfig: Input,\n\t\tapply: Effect.fnUntraced(function* (input) {\n\t\t\tyield* Effect.forEach(\n\t\t\t\t[\n\t\t\t\t\t{ invocation: input.transport, key: keys[0] },\n\t\t\t\t\t{ invocation: input.auth, key: keys[1] },\n\t\t\t\t],\n\t\t\t\tEffect.fnUntraced(function* ({ invocation, key }) {\n\t\t\t\t\tconst provider = yield* Graft.plugin(\n\t\t\t\t\t\tinvocation.plugin,\n\t\t\t\t\t\tinvocation.config,\n\t\t\t\t\t)\n\t\t\t\t\tyield* watch(provider, key)\n\t\t\t\t}),\n\t\t\t)\n\t\t\tconst consumer = yield* Graft.plugin(input.consumer, input.input)\n\t\t\t// Capability publication can leave a transient Pending snapshot; business dependencies may remain Pending.\n\t\t\tyield* consumer.state.pipe(\n\t\t\t\tStream.filter(\n\t\t\t\t\t(state) =>\n\t\t\t\t\t\tstate._tag !== \"Loading\" &&\n\t\t\t\t\t\t(state._tag !== \"Pending\" ||\n\t\t\t\t\t\t\t!Array.some(keys, (key) =>\n\t\t\t\t\t\t\t\tArray.contains(state.missing, key.key),\n\t\t\t\t\t\t\t)),\n\t\t\t\t),\n\t\t\t\tStream.runHead,\n\t\t\t)\n\t\t\tyield* follow(consumer, (cause) =>\n\t\t\t\tEffect.fail(CapabilityFailed.make({ cause })),\n\t\t\t)\n\t\t}),\n\t})\nconst hostAssembly = assembly([Connector, Credentials])\nconst runnerAssembly = assembly([Listener, Authenticator])\n\nexport const host = (input: Input) =>\n\tGraft.plugin(hostAssembly, input, { isolate: [Connector, Credentials] })\nexport const runner = (\n\tinput: Omit<Input, \"consumer\">,\n\tconsumer = listenerConsumer,\n) =>\n\tGraft.plugin(\n\t\trunnerAssembly,\n\t\t{ ...input, consumer },\n\t\t{ isolate: [Listener, Authenticator] },\n\t)\n\nexport const compatible = (\n\tproperties: Properties,\n\tkind: CredentialsApi[\"kind\"],\n): Effect.Effect<void, CapabilityCombinationError> => {\n\tif (\n\t\tkind === \"Certificate\" &&\n\t\t(properties.protocol !== \"wss\" ||\n\t\t\t!properties.encrypted ||\n\t\t\t!Array.contains(properties.carries, \"certificate\"))\n\t)\n\t\treturn Effect.fail(\n\t\t\tCapabilityCombinationError.make({\n\t\t\t\tdetail: \"Mutual TLS requires encrypted wss with certificate evidence\",\n\t\t\t}),\n\t\t)\n\tif (kind === \"Authorization\" && !Array.contains(properties.carries, \"header\"))\n\t\treturn Effect.fail(\n\t\t\tCapabilityCombinationError.make({\n\t\t\t\tdetail: \"This transport cannot carry Authorization headers\",\n\t\t\t}),\n\t\t)\n\treturn Effect.void\n}\nconst kind = (auth: AuthenticatorApi): CredentialsApi[\"kind\"] =>\n\tauth._tag === \"Mtls\"\n\t\t? \"Certificate\"\n\t\t: auth._tag === \"Header\"\n\t\t\t? \"Authorization\"\n\t\t\t: \"None\"\nconst warn = (\n\tproperties: Properties,\n\tcredentials: CredentialsApi[\"kind\"],\n\tside: \"host\" | \"runner\",\n) =>\n\tEffect.all(\n\t\t[\n\t\t\tproperties.network && !properties.encrypted\n\t\t\t\t? Effect.logWarning(\n\t\t\t\t\t\tcredentials === \"Authorization\"\n\t\t\t\t\t\t\t? `${properties.protocol}:// ${side === \"host\" ? \"connection\" : \"listener\"} is unencrypted; credentials are transmitted in plaintext`\n\t\t\t\t\t\t\t: `${properties.protocol}:// ${side === \"host\" ? \"connection\" : \"listener\"} is unencrypted`,\n\t\t\t\t\t)\n\t\t\t\t: Effect.void,\n\t\t\tside === \"runner\" && properties.network && credentials === \"None\"\n\t\t\t\t? Effect.logWarning(\"WebSocket listener has no authentication\")\n\t\t\t\t: Effect.void,\n\t\t],\n\t\t{ discard: true },\n\t)\n\nexport const directAuth = (properties: Properties, explicit: boolean) =>\n\texplicit &&\n\t(properties.protocol === \"stdio\" || properties.protocol === \"command\")\n\t\t? Effect.fail(\n\t\t\t\tCapabilityCombinationError.make({\n\t\t\t\t\tdetail: `${properties.protocol} transports do not accept auth`,\n\t\t\t\t}),\n\t\t\t)\n\t\t: Effect.void\n\nexport const connectWith = (explicitAuth = false) =>\n\tEffect.gen(function* () {\n\t\tconst connector = yield* Connector\n\t\tconst credentials = yield* Credentials\n\t\tyield* directAuth(connector.properties, explicitAuth)\n\t\tyield* compatible(connector.properties, credentials.kind)\n\t\tyield* warn(connector.properties, credentials.kind, \"host\")\n\t\tconst prepared = yield* credentials.read\n\t\treturn yield* connector.connect(prepared)\n\t})\n\nexport const accept =\n\t(\n\t\tauth: AuthenticatorApi,\n\t\tproperties: Properties,\n\t\tsession: (identity: string) => Session,\n\t): Accept =>\n\t(handshake) => {\n\t\tconst identity =\n\t\t\tauth._tag === \"Header\"\n\t\t\t\t? auth.authenticate(handshake.authorization)\n\t\t\t\t: auth._tag === \"Mtls\"\n\t\t\t\t\t? Option.match(handshake.certificate, {\n\t\t\t\t\t\t\tonNone: () =>\n\t\t\t\t\t\t\t\tEffect.fail(AuthenticationFailed.make({ reason: \"missing\" })),\n\t\t\t\t\t\t\tonSome: auth.authenticate,\n\t\t\t\t\t\t})\n\t\t\t\t\t: (properties.network\n\t\t\t\t\t\t\t? Effect.logWarning(\"WebSocket connection has no authentication\")\n\t\t\t\t\t\t\t: Effect.void\n\t\t\t\t\t\t).pipe(Effect.as(auth.identity))\n\t\treturn identity.pipe(Effect.map(session))\n\t}\n\nexport const makeListenerConsumer = (\n\tprepare: (\n\t\tproperties: Properties,\n\t\tauth: AuthenticatorApi,\n\t) => Effect.Effect<void, CapabilityCombinationError> = () => Effect.void,\n\tready: Effect.Effect<void> = Effect.void,\n) =>\n\tPlugin.make({\n\t\tname: \"remote-listener-consumer\",\n\t\tinject: [\n\t\t\tListener,\n\t\t\tAuthenticator,\n\t\t\tSupervisor,\n\t\t\tPlugin.optional(ServeLifecycle),\n\t\t],\n\t\tapply: Effect.fnUntraced(function* () {\n\t\t\tconst listener = yield* Listener\n\t\t\tconst auth = yield* Authenticator\n\t\t\tconst supervisor = yield* Supervisor\n\t\t\tconst lifecycle = yield* Effect.serviceOption(ServeLifecycle)\n\t\t\tyield* prepare(listener.properties, auth)\n\t\t\tyield* compatible(listener.properties, kind(auth)).pipe(\n\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\tListenerConfigError.make({ detail: error.detail }),\n\t\t\t\t),\n\t\t\t)\n\t\t\tyield* warn(listener.properties, kind(auth), \"runner\")\n\t\t\tconst serving = yield* listener.bind(\n\t\t\t\tauth._tag === \"Mtls\" ? Option.some(auth.tls) : Option.none(),\n\t\t\t)\n\t\t\tconst running = yield* Plugin.fork(\n\t\t\t\tserving\n\t\t\t\t\t.serve(\n\t\t\t\t\t\taccept(\n\t\t\t\t\t\t\tauth,\n\t\t\t\t\t\t\tlistener.properties,\n\t\t\t\t\t\t\t(identity) => (channel) =>\n\t\t\t\t\t\t\t\tsupervisor.accept(channel).pipe(\n\t\t\t\t\t\t\t\t\tEffect.catchCause((cause) =>\n\t\t\t\t\t\t\t\t\t\tlistener.properties.protocol === \"stdio\"\n\t\t\t\t\t\t\t\t\t\t\t? closedNormally(cause)\n\t\t\t\t\t\t\t\t\t\t\t\t? Effect.void\n\t\t\t\t\t\t\t\t\t\t\t\t: Effect.failCause(cause)\n\t\t\t\t\t\t\t\t\t\t\t: connectionEnded(cause),\n\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t\tEffect.provideService(Peer, identity),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t\t.pipe(\n\t\t\t\t\t\tEffect.onExit((exit) =>\n\t\t\t\t\t\t\tlistener.properties.protocol === \"stdio\" &&\n\t\t\t\t\t\t\tOption.isSome(lifecycle)\n\t\t\t\t\t\t\t\t? Deferred.done(lifecycle.value.ended, exit)\n\t\t\t\t\t\t\t\t: Effect.void,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t)\n\t\t\tyield* serving.ready.pipe(Effect.raceFirst(Fiber.join(running)))\n\t\t\tyield* ready\n\t\t}),\n\t})\n\nexport const listenerConsumer = makeListenerConsumer()\n\nexport const connect = connectWith()\n"],"mappings":";;;;;;;;;;;;AAgCA,IAAa,sBAAb,cAAyC,OAAO,YAG9C,CAAC,CAAC,uBAAuB,EAAE,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CACrD,IAAa,UAAU;EACtB,OAAO,KAAK;CACb;AACD;AAEA,IAAa,0BAAb,cAA6C,OAAO,YAGlD,CAAC,CAAC,2BAA2B;CAAE,QAAQ,OAAO;CAAQ,KAAK,OAAO;AAAO,CAAC,CAAC,CAAC;CAC7E,IAAa,UAAU;EACtB,OAAO,cAAc,KAAK,OAAO,mCAAmC,KAAK;CAC1E;AACD;AACA,IAAa,6BAAb,cAAgD,OAAO,YAGrD,CAAC,CAAC,8BAA8B,EAAE,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CAC5D,IAAa,UAAU;EACtB,OAAO,KAAK;CACb;AACD;AAEA,IAAa,mBAAb,cAAsC,OAAO,YAG3C,CAAC,CAAC,oBAAoB,EACvB,OAAO,OAAO,MAAM,OAAO,SAAS,OAAO,OAAO,EACnD,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,aAAa,OAAO,QAAQ,OAAO,QAAQ;;AAEjD,MAAa,aAAa,OAAO,OAAO;CACvC,QAAQ;CACR,QAAQ,OAAO;AAChB,CAAC;AACD,MAAM,QAAQ,OAAO,OAAO;CAC3B,WAAW;CACX,MAAM;CACN,UAAU;CACV,OAAO,OAAO,YAAY,OAAO,OAAO;AACzC,CAAC;AAGD,MAAM,WAAW,SAChB,KAAK,MAAM,SAAS,WACjB,OAAO,KAAK,iBAAiB,KAAK,EAAE,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,IAC9D,OAAO,QAAQ,KAAK,UAAU,SAAS,EAAE,SAAS,KAAK,CAAC;AAE5D,MAAM,SAAS,MAAc,QAC5B,OAAO,KAAK;CACX,MAAM;CACN,QAAQ,CAAC,OAAO,SAAS,GAAG,CAAC;CAC7B,OAAO,OAAO,WAAW,aAAa;EACrC,MAAM,QAAQ,OAAO,OAAO,cAAc,GAAG;EAC7C,IAAI,OAAO,OAAO,KAAK,GACtB,OAAO,OAAO,wBAAwB,KAAK;GAC1C,QAAQ;GACR,KAAK,IAAI;EACV,CAAC;CACH,CAAC;AACF,CAAC;;;;AAKF,MAAM,SAAS,UAAqB,QACnC,OAAO,KACN,MAAM,MAAM,KACX,OAAO,KAAK,UAAU,YAAY,OAAO,SAAS,EAAE,CAAC,GACrD,OAAO,OAAO,OAAO,MAAM,GAC3B,OAAO,KAAK,SAAS,KAAK,KAAK,GAC/B,OAAO,IAAI,OAAO,GAClB,OAAO,KAAK,UAAU;CACrB,MAAM,KAAK;CACX,QAAQ,gBAAgB,IAAI;AAC7B,EAAE,GACF,OAAO,aAAa,MAAM,UAAU,KAAK,WAAW,MAAM,MAAM,GAChE,OAAO,QAAQ,SAAS,KAAK,MAAM,GACnC,OAAO,YAAY,SAClB,OAAO,OACN,MAAM,OAAO,MAAM,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,KACnC,OAAO,SAAS,SAAS,KAAK,KAAK,CACpC,CACD,CACD,CACD,CACD;AAED,MAAM,YACL,SAEA,OAAO,KAAK;CACX,MAAM;CACN,QAAQ;CACR,OAAO,OAAO,WAAW,WAAW,OAAO;EAC1C,OAAO,OAAO,QACb,CACC;GAAE,YAAY,MAAM;GAAW,KAAK,KAAK;EAAG,GAC5C;GAAE,YAAY,MAAM;GAAM,KAAK,KAAK;EAAG,CACxC,GACA,OAAO,WAAW,WAAW,EAAE,YAAY,OAAO;GACjD,MAAM,WAAW,OAAO,MAAM,OAC7B,WAAW,QACX,WAAW,MACZ;GACA,OAAO,MAAM,UAAU,GAAG;EAC3B,CAAC,CACF;EACA,MAAM,WAAW,OAAO,MAAM,OAAO,MAAM,UAAU,MAAM,KAAK;EAEhE,OAAO,SAAS,MAAM,KACrB,OAAO,QACL,UACA,MAAM,SAAS,cACd,MAAM,SAAS,aACf,CAAC,MAAM,KAAK,OAAO,QAClB,MAAM,SAAS,MAAM,SAAS,IAAI,GAAG,CACtC,EACH,GACA,OAAO,OACR;EACA,OAAO,OAAO,WAAW,UACxB,OAAO,KAAK,iBAAiB,KAAK,EAAE,MAAM,CAAC,CAAC,CAC7C;CACD,CAAC;AACF,CAAC;AACF,MAAM,eAAe,SAAS,CAAC,WAAW,WAAW,CAAC;AACtD,MAAM,iBAAiB,SAAS,CAAC,UAAU,aAAa,CAAC;AAEzD,MAAa,QAAQ,UACpB,MAAM,OAAO,cAAc,OAAO,EAAE,SAAS,CAAC,WAAW,WAAW,EAAE,CAAC;AACxE,MAAa,UACZ,OACA,WAAW,qBAEX,MAAM,OACL,gBACA;CAAE,GAAG;CAAO;AAAS,GACrB,EAAE,SAAS,CAAC,UAAU,aAAa,EAAE,CACtC;AAED,MAAa,cACZ,YACA,SACqD;CACrD,IACC,SAAS,kBACR,WAAW,aAAa,SACxB,CAAC,WAAW,aACZ,CAAC,MAAM,SAAS,WAAW,SAAS,aAAa,IAElD,OAAO,OAAO,KACb,2BAA2B,KAAK,EAC/B,QAAQ,8DACT,CAAC,CACF;CACD,IAAI,SAAS,mBAAmB,CAAC,MAAM,SAAS,WAAW,SAAS,QAAQ,GAC3E,OAAO,OAAO,KACb,2BAA2B,KAAK,EAC/B,QAAQ,oDACT,CAAC,CACF;CACD,OAAO,OAAO;AACf;AACA,MAAM,QAAQ,SACb,KAAK,SAAS,SACX,gBACA,KAAK,SAAS,WACb,kBACA;AACL,MAAM,QACL,YACA,aACA,SAEA,OAAO,IACN,CACC,WAAW,WAAW,CAAC,WAAW,YAC/B,OAAO,WACP,gBAAgB,kBACb,GAAG,WAAW,SAAS,MAAM,SAAS,SAAS,eAAe,WAAW,6DACzE,GAAG,WAAW,SAAS,MAAM,SAAS,SAAS,eAAe,WAAW,gBAC7E,IACC,OAAO,MACV,SAAS,YAAY,WAAW,WAAW,gBAAgB,SACxD,OAAO,WAAW,0CAA0C,IAC5D,OAAO,IACX,GACA,EAAE,SAAS,KAAK,CACjB;AAED,MAAa,cAAc,YAAwB,aAClD,aACC,WAAW,aAAa,WAAW,WAAW,aAAa,aACzD,OAAO,KACP,2BAA2B,KAAK,EAC/B,QAAQ,GAAG,WAAW,SAAS,gCAChC,CAAC,CACF,IACC,OAAO;AAEX,MAAa,eAAe,eAAe,UAC1C,OAAO,IAAI,aAAa;CACvB,MAAM,YAAY,OAAO;CACzB,MAAM,cAAc,OAAO;CAC3B,OAAO,WAAW,UAAU,YAAY,YAAY;CACpD,OAAO,WAAW,UAAU,YAAY,YAAY,IAAI;CACxD,OAAO,KAAK,UAAU,YAAY,YAAY,MAAM,MAAM;CAC1D,MAAM,WAAW,OAAO,YAAY;CACpC,OAAO,OAAO,UAAU,QAAQ,QAAQ;AACzC,CAAC;AAEF,MAAa,UAEX,MACA,YACA,aAEA,cAAc;CAcd,QAZC,KAAK,SAAS,WACX,KAAK,aAAa,UAAU,aAAa,IACzC,KAAK,SAAS,SACb,OAAO,MAAM,UAAU,aAAa;EACpC,cACC,OAAO,KAAK,qBAAqB,KAAK,EAAE,QAAQ,UAAU,CAAC,CAAC;EAC7D,QAAQ,KAAK;CACd,CAAC,KACC,WAAW,UACV,OAAO,WAAW,4CAA4C,IAC9D,OAAO,KAAA,CACR,KAAK,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAA,CACnB,KAAK,OAAO,IAAI,OAAO,CAAC;AACzC;AAED,MAAa,wBACZ,gBAG6D,OAAO,MACpE,QAA6B,OAAO,SAEpC,OAAO,KAAK;CACX,MAAM;CACN,QAAQ;EACP;EACA;EACA;EACA,OAAO,SAAS,cAAc;CAC/B;CACA,OAAO,OAAO,WAAW,aAAa;EACrC,MAAM,WAAW,OAAO;EACxB,MAAM,OAAO,OAAO;EACpB,MAAM,aAAa,OAAO;EAC1B,MAAM,YAAY,OAAO,OAAO,cAAc,cAAc;EAC5D,OAAO,QAAQ,SAAS,YAAY,IAAI;EACxC,OAAO,WAAW,SAAS,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,KAClD,OAAO,UAAU,UAChB,oBAAoB,KAAK,EAAE,QAAQ,MAAM,OAAO,CAAC,CAClD,CACD;EACA,OAAO,KAAK,SAAS,YAAY,KAAK,IAAI,GAAG,QAAQ;EACrD,MAAM,UAAU,OAAO,SAAS,KAC/B,KAAK,SAAS,SAAS,OAAO,KAAK,KAAK,GAAG,IAAI,OAAO,KAAK,CAC5D;EACA,MAAM,UAAU,OAAO,OAAO,KAC7B,QACE,MACA,OACC,MACA,SAAS,aACR,cAAc,YACd,WAAW,OAAO,OAAO,CAAC,CAAC,KAC1B,OAAO,YAAY,UAClB,SAAS,WAAW,aAAa,UAC9B,eAAe,KAAK,IACnB,OAAO,OACP,OAAO,UAAU,KAAK,IACvB,gBAAgB,KAAK,CACzB,GACA,OAAO,eAAe,MAAM,QAAQ,CACrC,CACF,CACD,CAAC,CACA,KACA,OAAO,QAAQ,SACd,SAAS,WAAW,aAAa,WACjC,OAAO,OAAO,SAAS,IACpB,SAAS,KAAK,UAAU,MAAM,OAAO,IAAI,IACzC,OAAO,IACX,CACD,CACF;EACA,OAAO,QAAQ,MAAM,KAAK,OAAO,UAAU,MAAM,KAAK,OAAO,CAAC,CAAC;EAC/D,OAAO;CACR,CAAC;AACF,CAAC;AAEF,MAAa,mBAAmB,qBAAqB;AAE9B,YAAY"}

package/dist/internal/auth/mtls.js

@@ -0,0 +1,23 @@
+import { AuthenticationFailed } from "../../Errors.js";
+import { Array, Cause, Effect, Schema, String } from "effect";
+// src/internal/auth/mtls.ts
+const uriValue = (field) => {
+	const value = String.slice(4)(field);
+	return String.startsWith("\"")(value) ? Schema.decodeEffect(Schema.fromJsonString(Schema.String))(value).pipe(Effect.mapError((error) => AuthenticationFailed.make({
+		reason: "invalid",
+		cause: Cause.fail(error)
+	}))) : Effect.succeed(value);
+};
+/** Read exactly one graft URI from Node's plain or JSON-quoted SAN representation. */
+const identityFromSubjectAltName = (san) => Effect.gen(function* () {
+	const values = yield* Effect.forEach(Array.filter(String.split(san ?? "", ", "), String.startsWith("URI:")), uriValue);
+	const uris = Array.filter(values, String.startsWith("graft://"));
+	const [uri] = uris;
+	return yield* uris.length === 1 && uri !== void 0 ? Effect.succeed(uri) : Effect.fail(AuthenticationFailed.make({
+		reason: "invalid",
+		cause: Cause.fail("The peer certificate must contain exactly one graft SAN URI")
+	}));
+});
+export { identityFromSubjectAltName };
+
+//# sourceMappingURL=mtls.js.map

package/dist/internal/auth/mtls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mtls.js","names":[],"sources":["../../../src/internal/auth/mtls.ts"],"sourcesContent":["import { Array, Cause, Effect, Schema, String } from \"effect\"\nimport { AuthenticationFailed } from \"../../Errors\"\n\n// Node JSON-quotes SAN values containing separators, escaping commas inside the value.\nconst uriValue = (field: string) => {\n\tconst value = String.slice(4)(field)\n\treturn String.startsWith('\"')(value)\n\t\t? Schema.decodeEffect(Schema.fromJsonString(Schema.String))(value).pipe(\n\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\tAuthenticationFailed.make({\n\t\t\t\t\t\treason: \"invalid\",\n\t\t\t\t\t\tcause: Cause.fail(error),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t)\n\t\t: Effect.succeed(value)\n}\n\n/** Read exactly one graft URI from Node's plain or JSON-quoted SAN representation. */\nexport const identityFromSubjectAltName = (\n\tsan: string | undefined,\n): Effect.Effect<string, AuthenticationFailed> =>\n\tEffect.gen(function* () {\n\t\tconst values = yield* Effect.forEach(\n\t\t\tArray.filter(String.split(san ?? \"\", \", \"), String.startsWith(\"URI:\")),\n\t\t\turiValue,\n\t\t)\n\t\tconst uris = Array.filter(values, String.startsWith(\"graft://\"))\n\t\tconst [uri] = uris\n\t\treturn yield* uris.length === 1 && uri !== undefined\n\t\t\t? Effect.succeed(uri)\n\t\t\t: Effect.fail(\n\t\t\t\t\tAuthenticationFailed.make({\n\t\t\t\t\t\treason: \"invalid\",\n\t\t\t\t\t\tcause: Cause.fail(\n\t\t\t\t\t\t\t\"The peer certificate must contain exactly one graft SAN URI\",\n\t\t\t\t\t\t),\n\t\t\t\t\t}),\n\t\t\t\t)\n\t})\n"],"mappings":";;;AAIA,MAAM,YAAY,UAAkB;CACnC,MAAM,QAAQ,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK;CACnC,OAAO,OAAO,WAAW,IAAG,CAAC,CAAC,KAAK,IAChC,OAAO,aAAa,OAAO,eAAe,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KACjE,OAAO,UAAU,UAChB,qBAAqB,KAAK;EACzB,QAAQ;EACR,OAAO,MAAM,KAAK,KAAK;CACxB,CAAC,CACF,CACD,IACC,OAAO,QAAQ,KAAK;AACxB;;AAGA,MAAa,8BACZ,QAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,OAAO,QAC5B,MAAM,OAAO,OAAO,MAAM,OAAO,IAAI,IAAI,GAAG,OAAO,WAAW,MAAM,CAAC,GACrE,QACD;CACA,MAAM,OAAO,MAAM,OAAO,QAAQ,OAAO,WAAW,UAAU,CAAC;CAC/D,MAAM,CAAC,OAAO;CACd,OAAO,OAAO,KAAK,WAAW,KAAK,QAAQ,KAAA,IACxC,OAAO,QAAQ,GAAG,IAClB,OAAO,KACP,qBAAqB,KAAK;EACzB,QAAQ;EACR,OAAO,MAAM,KACZ,6DACD;CACD,CAAC,CACF;AACH,CAAC"}

package/dist/internal/auth/token.js

@@ -0,0 +1,19 @@
+import { AuthenticationFailed } from "../../Errors.js";
+import { Effect, Option, Redacted } from "effect";
+// src/internal/auth/token.ts
+const invalid = () => AuthenticationFailed.make({
+	reason: "invalid",
+	challenge: "Bearer error=\"invalid_token\""
+});
+const read = (authorization) => {
+	if (Option.isNone(authorization)) return Effect.fail(AuthenticationFailed.make({
+		reason: "missing",
+		challenge: "Bearer"
+	}));
+	const token = /^Bearer +([^ ]+)$/i.exec(Redacted.value(authorization.value))?.[1];
+	return token === void 0 ? Effect.fail(invalid()) : Effect.succeed(Redacted.make(token));
+};
+const prepare = (token) => Effect.succeed(Redacted.make("Bearer " + Redacted.value(token)));
+export { invalid, prepare, read };
+
+//# sourceMappingURL=token.js.map

package/dist/internal/auth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","names":[],"sources":["../../../src/internal/auth/token.ts"],"sourcesContent":["import { Effect, Option, Redacted } from \"effect\"\nimport { AuthenticationFailed } from \"../../Errors\"\n\nexport const invalid = () =>\n\tAuthenticationFailed.make({\n\t\treason: \"invalid\",\n\t\tchallenge: 'Bearer error=\"invalid_token\"',\n\t})\nexport const read = (\n\tauthorization: Option.Option<Redacted.Redacted<string>>,\n): Effect.Effect<Redacted.Redacted<string>, AuthenticationFailed> => {\n\tif (Option.isNone(authorization))\n\t\treturn Effect.fail(\n\t\t\tAuthenticationFailed.make({\n\t\t\t\treason: \"missing\",\n\t\t\t\tchallenge: \"Bearer\",\n\t\t\t}),\n\t\t)\n\tconst match = /^Bearer +([^ ]+)$/i.exec(Redacted.value(authorization.value))\n\tconst token = match?.[1]\n\treturn token === undefined\n\t\t? Effect.fail(invalid())\n\t\t: Effect.succeed(Redacted.make(token))\n}\nexport const prepare = (token: Redacted.Redacted<string>) =>\n\tEffect.succeed(Redacted.make(\"Bearer \" + Redacted.value(token)))\n"],"mappings":";;;AAGA,MAAa,gBACZ,qBAAqB,KAAK;CACzB,QAAQ;CACR,WAAW;AACZ,CAAC;AACF,MAAa,QACZ,kBACoE;CACpE,IAAI,OAAO,OAAO,aAAa,GAC9B,OAAO,OAAO,KACb,qBAAqB,KAAK;EACzB,QAAQ;EACR,WAAW;CACZ,CAAC,CACF;CAED,MAAM,QADQ,qBAAqB,KAAK,SAAS,MAAM,cAAc,KAAK,CACxD,CAAC,GAAG;CACtB,OAAO,UAAU,KAAA,IACd,OAAO,KAAK,QAAQ,CAAC,IACrB,OAAO,QAAQ,SAAS,KAAK,KAAK,CAAC;AACvC;AACA,MAAa,WAAW,UACvB,OAAO,QAAQ,SAAS,KAAK,YAAY,SAAS,MAAM,KAAK,CAAC,CAAC"}

package/dist/internal/auth/tokenCredentials.d.ts

@@ -0,0 +1,8 @@
+import { Graft, Plugin } from "@graftland/graft";
+import { Schema } from "effect";
+export declare const Config: Schema.Struct<{
+  readonly token: Schema.Union<readonly [Schema.RedactedFromValue<Schema.String>, Schema.Struct<{
+    readonly file: Schema.String;
+  }>]>;
+}>;
+//# sourceMappingURL=tokenCredentials.d.ts.map

package/dist/internal/auth/tokenCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenCredentials.d.ts","names":[],"sources":["../../../src/internal/auth/tokenCredentials.ts"],"mappings":";;qBAea,QAAM,OAAA"}

package/dist/internal/auth/tokenCredentials.js

@@ -0,0 +1,33 @@
+import { Credentials } from "../../Auth.js";
+import { CredentialsError } from "../../Errors.js";
+import { prepare } from "./token.js";
+import { Graft, Plugin } from "@graftland/graft";
+import { ConfigDirectory } from "@graftland/loader";
+import { Cause, Effect, FileSystem, Option, Path, Redacted, Schema } from "effect";
+// src/internal/auth/tokenCredentials.ts
+const Config = Schema.Struct({ token: Schema.Union([Schema.RedactedFromValue(Schema.String), Schema.Struct({ file: Schema.String })]) });
+const plugin = (name) => Plugin.make({
+	name,
+	config: Config,
+	inject: [FileSystem.FileSystem, Path.Path],
+	apply: Effect.fnUntraced(function* (config) {
+		const fs = yield* FileSystem.FileSystem;
+		const path = yield* Path.Path;
+		const directory = yield* ConfigDirectory;
+		const token = config.token;
+		const read = Redacted.isRedacted(token) ? Effect.succeed(token) : fs.readFileString(path.resolve(Option.getOrElse(directory, () => "."), token.file)).pipe(Effect.map(Redacted.make));
+		yield* Graft.provide(Credentials, {
+			kind: "Authorization",
+			read: read.pipe(Effect.flatMap(prepare), Effect.mapBoth({
+				onSuccess: (value) => ({
+					_tag: "Authorization",
+					value
+				}),
+				onFailure: (error) => CredentialsError.make({ cause: Cause.fail(error) })
+			}))
+		});
+	})
+});
+export { Config, plugin };
+
+//# sourceMappingURL=tokenCredentials.js.map

package/dist/internal/auth/tokenCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenCredentials.js","names":[],"sources":["../../../src/internal/auth/tokenCredentials.ts"],"sourcesContent":["import { Graft, Plugin } from \"@graftland/graft\"\nimport { ConfigDirectory } from \"@graftland/loader\"\nimport {\n\tCause,\n\tEffect,\n\tFileSystem,\n\tOption,\n\tPath,\n\tRedacted,\n\tSchema,\n} from \"effect\"\nimport { Credentials, type Prepared } from \"../../Auth\"\nimport { CredentialsError } from \"../../Errors\"\nimport { prepare } from \"./token\"\n\nexport const Config = Schema.Struct({\n\ttoken: Schema.Union([\n\t\tSchema.RedactedFromValue(Schema.String),\n\t\tSchema.Struct({ file: Schema.String }),\n\t]),\n})\nexport const plugin = (\n\tname: string,\n): Plugin.Plugin<\n\ttypeof Config.Type,\n\ttypeof Config.Encoded,\n\tGraft.ServiceConflict\n> =>\n\tPlugin.make({\n\t\tname,\n\t\tconfig: Config,\n\t\tinject: [FileSystem.FileSystem, Path.Path],\n\t\tapply: Effect.fnUntraced(function* (config) {\n\t\t\tconst fs = yield* FileSystem.FileSystem\n\t\t\tconst path = yield* Path.Path\n\t\t\tconst directory = yield* ConfigDirectory\n\t\t\tconst token = config.token\n\t\t\tconst read = Redacted.isRedacted(token)\n\t\t\t\t? Effect.succeed(token)\n\t\t\t\t: fs\n\t\t\t\t\t\t.readFileString(\n\t\t\t\t\t\t\tpath.resolve(\n\t\t\t\t\t\t\t\tOption.getOrElse(directory, () => \".\"),\n\t\t\t\t\t\t\t\ttoken.file,\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t)\n\t\t\t\t\t\t.pipe(Effect.map(Redacted.make))\n\t\t\tyield* Graft.provide(Credentials, {\n\t\t\t\tkind: \"Authorization\",\n\t\t\t\tread: read.pipe(\n\t\t\t\t\tEffect.flatMap(prepare),\n\t\t\t\t\tEffect.mapBoth({\n\t\t\t\t\t\tonSuccess: (\n\t\t\t\t\t\t\tvalue,\n\t\t\t\t\t\t): Extract<Prepared, { readonly _tag: \"Authorization\" }> => ({\n\t\t\t\t\t\t\t_tag: \"Authorization\",\n\t\t\t\t\t\t\tvalue,\n\t\t\t\t\t\t}),\n\t\t\t\t\t\tonFailure: (error) =>\n\t\t\t\t\t\t\tCredentialsError.make({ cause: Cause.fail(error) }),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t})\n\t\t}),\n\t})\n"],"mappings":";;;;;;;AAeA,MAAa,SAAS,OAAO,OAAO,EACnC,OAAO,OAAO,MAAM,CACnB,OAAO,kBAAkB,OAAO,MAAM,GACtC,OAAO,OAAO,EAAE,MAAM,OAAO,OAAO,CAAC,CACtC,CAAC,EACF,CAAC;AACD,MAAa,UACZ,SAMA,OAAO,KAAK;CACX;CACA,QAAQ;CACR,QAAQ,CAAC,WAAW,YAAY,KAAK,IAAI;CACzC,OAAO,OAAO,WAAW,WAAW,QAAQ;EAC3C,MAAM,KAAK,OAAO,WAAW;EAC7B,MAAM,OAAO,OAAO,KAAK;EACzB,MAAM,YAAY,OAAO;EACzB,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,SAAS,WAAW,KAAK,IACnC,OAAO,QAAQ,KAAK,IACpB,GACC,eACA,KAAK,QACJ,OAAO,UAAU,iBAAiB,GAAG,GACrC,MAAM,IACP,CACD,CAAC,CACA,KAAK,OAAO,IAAI,SAAS,IAAI,CAAC;EAClC,OAAO,MAAM,QAAQ,aAAa;GACjC,MAAM;GACN,MAAM,KAAK,KACV,OAAO,QAAQ,OAAO,GACtB,OAAO,QAAQ;IACd,YACC,WAC4D;KAC5D,MAAM;KACN;IACD;IACA,YAAY,UACX,iBAAiB,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,EAAE,CAAC;GACpD,CAAC,CACF;EACD,CAAC;CACF,CAAC;AACF,CAAC"}