@graftland/plugin-remote 0.0.0-stage → 0.3.0

package/dist/port-Blbh8tms.js

@@ -0,0 +1,285 @@
+import { t as EndOfStream } from "./Framing-zaYdOJnT.js";
+import { t as make$1 } from "./FailureGroup-BcH0XOBi.js";
+import { c as TransportError } from "./Errors-oPsTLY7l.js";
+import { Array, Cause, Context, Data, Deferred, Effect, Fiber, HashMap, Option, Queue, Record, Result, Schema, Stream, TxQueue, TxRef } from "effect";
+import { RpcClient, RpcClientError, RpcSerialization, RpcServer } from "effect/rpc";
+// packages/remote/src/internal/Limits.ts
+const PositiveInt = Schema.Int.check(Schema.isGreaterThan(0));
+const PositiveFinite = Schema.Finite.check(Schema.isGreaterThan(0));
+const Limits = Schema.Struct({
+	control: PositiveInt,
+	data: PositiveInt,
+	log: PositiveInt
+});
+const defaults = {
+	control: 8,
+	data: 16,
+	log: 2
+};
+// packages/remote/src/internal/port.ts
+const Priority = Context.Reference("@graftland/plugin-remote/internal/port/Priority", { defaultValue: () => "data" });
+var RequestKey = class extends Data.Class {};
+const Frame = Schema.Struct({
+	session: Schema.String,
+	endpoint: Schema.String,
+	direction: Schema.Literals(["request", "response"]),
+	priority: Schema.Literals([
+		"control",
+		"data",
+		"log"
+	]),
+	message: Schema.Unknown
+});
+const Id = Schema.Union([Schema.String, Schema.Finite]);
+const isRequest = Schema.is(Schema.Union([
+	Schema.TaggedStruct("Request", {
+		id: Id,
+		tag: Schema.String
+	}),
+	Schema.TaggedStruct("Ack", { requestId: Id }),
+	Schema.TaggedStruct("Interrupt", { requestId: Id }),
+	Schema.TaggedStruct("Eof", {})
+]));
+const isResponse = Schema.is(Schema.Union([
+	Schema.TaggedStruct("Exit", { requestId: Id }),
+	Schema.TaggedStruct("Chunk", { requestId: Id }),
+	Schema.TaggedStruct("Defect", { defect: Schema.Unknown })
+]));
+const Request = Schema.declare((input) => isRequest(input));
+const Response = Schema.declare((input) => isResponse(input));
+const error = (message) => TransportError.make({ cause: Cause.die(new Error(message)) });
+const rpcError = (cause) => RpcClientError.RpcClientError.make({ reason: RpcClientError.RpcClientDefect.make({
+	message: "Remote connection failed",
+	cause
+}) });
+const priority = (group, tag) => {
+	const rpc = group.requests.get(tag);
+	return rpc === void 0 ? "data" : Context.get(rpc.annotations, Priority);
+};
+const mailbox = (priority) => Queue.dropping(2).pipe(Effect.map((queue) => ({
+	queue,
+	priority,
+	sent: false
+})));
+const deliver = Effect.fnUntraced(function* (requestState, message) {
+	if (!(yield* Queue.offer(requestState.queue, message))) return yield* error("RPC request mailbox overflow");
+});
+const initialize = (bytes, options) => Effect.gen(function* () {
+	return {
+		bytes,
+		options,
+		limits: {
+			...defaults,
+			...options.limits
+		},
+		workers: yield* make$1(),
+		incoming: yield* TxRef.make(HashMap.empty()),
+		outgoing: yield* TxRef.make(HashMap.empty()),
+		queues: {
+			control: yield* TxQueue.unbounded(),
+			data: yield* TxQueue.unbounded(),
+			log: yield* TxQueue.unbounded()
+		},
+		servers: yield* Effect.forEach(Record.toEntries(options.serve), Effect.fnUntraced(function* ([name, group]) {
+			return [name, {
+				group,
+				ready: yield* Deferred.make(),
+				disconnects: yield* Queue.dropping(1)
+			}];
+		})).pipe(Effect.map(HashMap.fromIterable)),
+		clients: yield* Effect.forEach(Record.toEntries(options.call), Effect.fnUntraced(function* ([name, group]) {
+			return [name, {
+				group,
+				ready: yield* Deferred.make()
+			}];
+		})).pipe(Effect.map(HashMap.fromIterable))
+	};
+});
+const admit = Effect.fnUntraced(function* (state, table, key, requestState, direction) {
+	yield* Effect.tx(Effect.gen(function* () {
+		yield* state.workers.check;
+		const current = yield* TxRef.get(table);
+		if (Array.filter(Array.fromIterable(HashMap.values(current)), (entry) => entry.priority === requestState.priority).length >= state.limits[requestState.priority]) {
+			if (direction === "outgoing") return yield* Effect.txRetry;
+			return yield* error(`RPC admission limit exceeded for ${requestState.priority}`);
+		}
+		yield* TxRef.set(table, HashMap.set(current, key, requestState));
+	}));
+});
+const remove = Effect.fnUntraced(function* (table, key, requestState) {
+	yield* TxRef.update(table, HashMap.remove(key));
+	yield* Queue.end(requestState.queue);
+});
+const enqueue = (state, frame, request = Option.none()) => Effect.tx(state.workers.check.pipe(Effect.andThen(TxQueue.offer(state.queues[frame.priority], {
+	frame,
+	request
+}).pipe(Effect.flatMap((accepted) => accepted ? Effect.void : error("Remote output has ended")))), Effect.asVoid));
+const frame = (state, endpoint, direction, p, message) => ({
+	session: state.options.session,
+	endpoint,
+	direction,
+	priority: p,
+	message
+});
+const send = Effect.fnUntraced(function* (state, effect) {
+	const fiber = yield* state.workers.run(state.workers.check.pipe(Effect.andThen(effect)));
+	const result = yield* Fiber.await(fiber).pipe(Effect.onInterrupt(() => Fiber.interrupt(fiber)));
+	yield* state.workers.check;
+	yield* result;
+});
+const cancel = Effect.fnUntraced(function* (state, key) {
+	const canceled = yield* Effect.tx(Effect.gen(function* () {
+		const table = yield* TxRef.get(state.outgoing);
+		const requestState = HashMap.get(table, key);
+		if (Option.isNone(requestState)) return Option.none();
+		if (requestState.value.sent) {
+			yield* enqueue(state, frame(state, key.endpoint, "request", "control", {
+				_tag: "Interrupt",
+				requestId: key.id
+			}));
+			return Option.none();
+		}
+		yield* TxRef.set(state.outgoing, HashMap.remove(table, key));
+		return requestState;
+	}));
+	if (Option.isSome(canceled)) yield* Queue.end(canceled.value.queue);
+});
+const clientProtocol = (state, endpoint) => {
+	const client = Option.getOrThrow(HashMap.get(state.clients, endpoint));
+	return RpcClient.Protocol.of({
+		codecFor: RpcSerialization.json.codecFor,
+		supportsAck: true,
+		supportsTransferables: false,
+		run: (_id, receive) => Deferred.succeed(client.ready, receive).pipe(Effect.andThen(state.workers.await), Effect.catchCause((cause) => receive({
+			_tag: "ClientProtocolError",
+			error: rpcError(cause)
+		})), Effect.andThen(Effect.never)),
+		send: (_id, message) => send(state, Effect.gen(function* () {
+			if (message._tag === "Request") {
+				if (message.discard === true || message.isNotification === true) return yield* error("Discard and notification requests are not supported");
+				const key = new RequestKey({
+					endpoint,
+					id: message.id
+				});
+				const requestState = yield* mailbox(priority(client.group, message.tag));
+				yield* admit(state, state.outgoing, key, requestState, "outgoing");
+				yield* state.workers.run(Stream.fromQueue(requestState.queue).pipe(Stream.runForEach(Effect.fnUntraced(function* (response) {
+					const receive = yield* Deferred.await(client.ready);
+					if (response._tag === "Exit") yield* remove(state.outgoing, key, requestState);
+					yield* receive(response);
+				}))));
+				yield* enqueue(state, frame(state, endpoint, "request", requestState.priority, message), Option.some(key));
+			} else if (message._tag === "Interrupt") yield* cancel(state, new RequestKey({
+				endpoint,
+				id: message.requestId
+			}));
+			else if (message._tag === "Ack") yield* enqueue(state, frame(state, endpoint, "request", "control", message));
+		})).pipe(Effect.mapError((failure) => rpcError(Cause.fail(failure))))
+	});
+};
+const serverProtocol = (state, endpoint) => {
+	const server = Option.getOrThrow(HashMap.get(state.servers, endpoint));
+	return RpcServer.Protocol.of({
+		codecFor: RpcSerialization.json.codecFor,
+		supportsAck: true,
+		supportsTransferables: false,
+		supportsSpanPropagation: false,
+		supportsNotifications: false,
+		clientIds: Effect.succeed(/* @__PURE__ */ new Set([0])),
+		initialMessage: Effect.succeedNone,
+		disconnects: server.disconnects,
+		end: () => Effect.void,
+		run: (receive) => Deferred.succeed(server.ready, receive).pipe(Effect.andThen(Effect.never)),
+		send: (_id, message) => send(state, Effect.gen(function* () {
+			if (message._tag === "Chunk" || message._tag === "Exit") {
+				const key = new RequestKey({
+					endpoint,
+					id: message.requestId
+				});
+				const requestState = yield* TxRef.get(state.incoming).pipe(Effect.map(HashMap.get(key)));
+				if (Option.isNone(requestState)) return;
+				yield* enqueue(state, frame(state, endpoint, "response", message._tag === "Exit" ? "control" : requestState.value.priority, message));
+				if (message._tag === "Exit") yield* remove(state.incoming, key, requestState.value);
+			} else yield* enqueue(state, frame(state, endpoint, "response", "control", message));
+		})).pipe(Effect.catchTag("TransportError", () => Effect.void))
+	});
+};
+const next = (state) => Effect.tx(Effect.gen(function* () {
+	yield* state.workers.check;
+	for (const p of [
+		"control",
+		"data",
+		"log"
+	]) {
+		const pending = yield* TxQueue.poll(state.queues[p]);
+		if (Option.isNone(pending)) continue;
+		const { frame, request } = pending.value;
+		if (Option.isSome(request)) {
+			const table = yield* TxRef.get(state.outgoing);
+			const requestState = HashMap.get(table, request.value);
+			if (Option.isNone(requestState)) return Option.none();
+			yield* TxRef.set(state.outgoing, HashMap.set(table, request.value, {
+				...requestState.value,
+				sent: true
+			}));
+		}
+		return Option.some(frame);
+	}
+	if ((yield* TxQueue.isDone(state.queues.control)) && (yield* TxQueue.isDone(state.queues.data)) && (yield* TxQueue.isDone(state.queues.log))) return yield* Cause.done();
+	return yield* Effect.txRetry;
+}));
+const writer = (state) => Stream.fromEffectRepeat(next(state)).pipe(Stream.filterMap(Result.fromOption(() => void 0)), Stream.mapEffect((frame) => Schema.encodeEffect(Schema.fromJsonString(Frame))(frame).pipe(Effect.mapError((cause) => TransportError.make({ cause: Cause.fail(cause) })))), Stream.map((json) => new TextEncoder().encode(json + "\n")), Stream.run(state.bytes.output));
+const read = Effect.fnUntraced(function* (state, raw) {
+	const current = yield* Schema.decodeUnknownEffect(Frame)(raw).pipe(Effect.mapError((cause) => TransportError.make({ cause: Cause.fail(cause) })));
+	if (current.session !== state.options.session) return;
+	if (current.direction === "request") {
+		const server = HashMap.get(state.servers, current.endpoint);
+		if (Option.isNone(server)) return yield* error(`Unknown RPC server endpoint: ${current.endpoint}`);
+		const message = yield* Schema.decodeUnknownEffect(Request)(current.message).pipe(Effect.mapError((cause) => TransportError.make({ cause: Cause.fail(cause) })));
+		if (message._tag === "Eof") return yield* TransportError.make({ cause: Cause.fail(EndOfStream.make({})) });
+		const key = new RequestKey({
+			endpoint: current.endpoint,
+			id: message._tag === "Request" ? message.id : message.requestId
+		});
+		if (message._tag === "Request") {
+			const p = priority(server.value.group, message.tag);
+			const requestState = yield* mailbox(p);
+			yield* admit(state, state.incoming, key, requestState, "incoming");
+			yield* state.workers.run(Stream.fromQueue(requestState.queue).pipe(Stream.runForEach(Effect.fnUntraced(function* (request) {
+				yield* (yield* Deferred.await(server.value.ready))(0, request);
+			}))));
+			yield* deliver(requestState, message);
+		} else {
+			const requestState = yield* TxRef.get(state.incoming).pipe(Effect.map(HashMap.get(key)));
+			if (Option.isSome(requestState)) yield* deliver(requestState.value, message);
+		}
+	} else {
+		const message = yield* Schema.decodeUnknownEffect(Response)(current.message).pipe(Effect.mapError((cause) => TransportError.make({ cause: Cause.fail(cause) })));
+		if (message._tag === "Defect") return yield* TransportError.make({ cause: Cause.die(message.defect) });
+		const key = new RequestKey({
+			endpoint: current.endpoint,
+			id: message.requestId
+		});
+		const requestState = yield* TxRef.get(state.outgoing).pipe(Effect.map(HashMap.get(key)));
+		if (Option.isSome(requestState)) yield* deliver(requestState.value, message);
+	}
+});
+const reader = (state) => state.bytes.input.pipe(Stream.decodeText(), Stream.splitLines, Stream.filter((line) => line.length > 0), Stream.mapEffect((line) => Schema.decodeEffect(Schema.fromJsonString(Schema.Unknown))(line).pipe(Effect.mapError((cause) => TransportError.make({ cause: Cause.fail(cause) })))), Stream.runForEach((raw) => read(state, raw)), Effect.andThen(Effect.fail(TransportError.make({ cause: Cause.fail(EndOfStream.make({})) }))));
+/** One RPC client/server per declared endpoint; servers may start after the port. */
+const make = Effect.fnUntraced(function* (bytes, options) {
+	const state = yield* initialize(bytes, options);
+	yield* state.workers.await.pipe(Effect.catchCause(() => Effect.uninterruptible(Effect.gen(function* () {
+		for (const server of HashMap.values(state.servers)) yield* Queue.offer(server.disconnects, 0);
+		yield* Effect.tx(TxRef.set(state.incoming, HashMap.empty()).pipe(Effect.andThen(TxRef.set(state.outgoing, HashMap.empty()))));
+	}))), Effect.forkScoped);
+	const writing = yield* state.workers.run(writer(state));
+	yield* state.workers.run(reader(state));
+	return {
+		clientProtocol: (endpoint) => clientProtocol(state, endpoint),
+		serverProtocol: (endpoint) => serverProtocol(state, endpoint),
+		await: state.workers.await,
+		fail: state.workers.fail,
+		end: Effect.tx(Effect.forEach(Record.values(state.queues), TxQueue.end, { discard: true })).pipe(Effect.andThen(Fiber.join(writing)))
+	};
+});
+export { PositiveInt as a, PositiveFinite as i, make as n, defaults as o, Limits as r, Priority as t };

package/dist/release-BY4Mlluy.js

@@ -0,0 +1,23 @@
+import { Array, Cause, Effect, Exit, Result, Schema, Scope } from "effect";
+// packages/remote/src/internal/release.ts
+/** Resource release was interrupted, rather than successfully cancelled. */
+var ReleaseInterrupted = class extends Schema.TaggedError()("ReleaseInterrupted", { cause: Schema.Cause(Schema.Never, Schema.Unknown) }) {
+	get message() {
+		return "Resource release was interrupted";
+	}
+};
+/** Keep a known release failure distinguishable from cancellation through enclosing scopes. */
+const close = (scope, exit) => Effect.uninterruptible(Scope.close(scope, exit).pipe(Effect.catchCauseIf(Cause.hasInterruptsOnly, (cause) => Effect.gen(function* () {
+	const pending = yield* Effect.exit(Effect.interruptible(Effect.void));
+	const [cancelled, interrupted] = Array.partition(cause.reasons, (reason) => Exit.isFailure(pending) && Array.some(pending.cause.reasons, (external) => reason._tag === "Interrupt" && external._tag === "Interrupt" && reason.fiberId === external.fiberId) ? Result.succeed(reason) : Result.fail(reason));
+	if (interrupted.length === 0) return yield* Effect.failCause(cause);
+	return yield* Effect.failCause(Cause.combine(Cause.fromReasons(cancelled), Cause.die(ReleaseInterrupted.make({ cause: Cause.fromReasons(interrupted) }))));
+}))));
+const scoped = (effect) => Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+	const scope = yield* Scope.make();
+	const body = yield* Effect.exit(restore(Scope.provide(scope)(effect)));
+	const closed = yield* Effect.exit(close(scope, body));
+	if (Exit.isFailure(closed)) return yield* Effect.failCause(Exit.isFailure(body) ? Cause.combine(body.cause, closed.cause) : closed.cause);
+	return yield* body;
+}));
+export { close as n, scoped as r, ReleaseInterrupted as t };

package/dist/rolldown-runtime-DYf_mQCB.js

@@ -0,0 +1,34 @@
+import { createRequire } from "node:module";
+// \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod, mod.exports), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
+export { __toESM as i, __exportAll as n, __require as r, __commonJSMin as t };

package/dist/runner/auth/bearer.d.ts

@@ -0,0 +1,7 @@
+import { Schema } from "effect";
+export declare const Config: Schema.Struct<{
+  readonly tokens: Schema.String;
+}>;
+declare const _default: any;
+export { _default as default };
+//# sourceMappingURL=bearer.d.ts.map

package/dist/runner/auth/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","names":[],"sources":["../../../src/runner/auth/bearer.ts"],"mappings":";qBAmBa,QAAM,OAAA"}

package/dist/runner/auth/bearer.js

@@ -0,0 +1,42 @@
+import { a as provide, l as make } from "../../Graft-BsYq3F-J.js";
+import { t as Authenticator } from "../../Auth-BElTC9_X.js";
+import { t as ConfigDirectory } from "../../ConfigDirectory-BCC6q2R4.js";
+import { r as read, t as invalid } from "../../token-v5ne2I0-.js";
+import { Array, Effect, FileSystem, Option, Path, Record, Redacted, Schema } from "effect";
+import { Digest } from "effect/crypto";
+import { Hex } from "effect/encoding";
+import { timingSafeEqual } from "node:crypto";
+// packages/remote/src/runner/auth/bearer.ts
+const Config = Schema.Struct({ tokens: Schema.String });
+const Tokens = Schema.fromJsonString(Schema.Record(Schema.String.check(Schema.isPattern(/^[0-9a-fA-F]{64}$/)), Schema.NonEmptyString));
+var bearer_default = make({
+	name: "remote-bearer-authenticator",
+	config: Config,
+	inject: [
+		FileSystem.FileSystem,
+		Path.Path,
+		Digest.Digest
+	],
+	apply: Effect.fnUntraced(function* (config) {
+		const fs = yield* FileSystem.FileSystem;
+		const path = yield* Path.Path;
+		const directory = yield* ConfigDirectory.pipe(Effect.map(Option.getOrElse(() => ".")));
+		const digest = yield* Digest.Digest;
+		const file = yield* fs.readFileString(path.resolve(directory, config.tokens));
+		const mapping = yield* Schema.decodeEffect(Tokens)(file);
+		const tokens = yield* Effect.forEach(Record.toEntries(mapping), ([hex, identity]) => Effect.fromResult(Hex.decode(hex)).pipe(Effect.map((hash) => ({
+			hash,
+			identity
+		}))));
+		yield* provide(Authenticator, {
+			_tag: "Header",
+			authenticate: Effect.fnUntraced(function* (authorization) {
+				const token = yield* read(authorization);
+				const hash = yield* digest.digest(Digest.sha256, new TextEncoder().encode(Redacted.value(token)));
+				const found = Array.findFirst(tokens, (entry) => timingSafeEqual(hash, entry.hash));
+				return yield* Effect.fromOption(found, invalid).pipe(Effect.map((entry) => entry.identity));
+			})
+		});
+	})
+});
+export { Config, bearer_default as default };

package/dist/runner/auth/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","names":["Token.read","Token.invalid"],"sources":["../../../src/runner/auth/bearer.ts"],"sourcesContent":["import { Option } from \"effect\"\nimport { Graft, Plugin } from \"@graftland/graft\"\nimport {\n\tArray,\n\tEffect,\n\tFileSystem,\n\tPath,\n\tRecord,\n\tRedacted,\n\tSchema,\n} from \"effect\"\nimport { Digest } from \"effect/crypto\"\nimport { Hex } from \"effect/encoding\"\n// @effect-diagnostics-next-line nodeBuiltinImport:off -- Token digests use Node's constant-time comparison\nimport { timingSafeEqual } from \"node:crypto\"\nimport { Authenticator } from \"../../Auth\"\nimport { ConfigDirectory } from \"@graftland/loader\"\nimport * as Token from \"../../internal/auth/token\"\n\nexport const Config = Schema.Struct({ tokens: Schema.String })\nconst Tokens = Schema.fromJsonString(\n\tSchema.Record(\n\t\tSchema.String.check(Schema.isPattern(/^[0-9a-fA-F]{64}$/)),\n\t\tSchema.NonEmptyString,\n\t),\n)\nexport default Plugin.make({\n\tname: \"remote-bearer-authenticator\",\n\tconfig: Config,\n\tinject: [FileSystem.FileSystem, Path.Path, Digest.Digest],\n\tapply: Effect.fnUntraced(function* (config) {\n\t\tconst fs = yield* FileSystem.FileSystem\n\t\tconst path = yield* Path.Path\n\t\tconst directory = yield* ConfigDirectory.pipe(\n\t\t\tEffect.map(Option.getOrElse(() => \".\")),\n\t\t)\n\t\tconst digest = yield* Digest.Digest\n\t\tconst file = yield* fs.readFileString(\n\t\t\tpath.resolve(directory, config.tokens),\n\t\t)\n\t\tconst mapping = yield* Schema.decodeEffect(Tokens)(file)\n\t\tconst tokens = yield* Effect.forEach(\n\t\t\tRecord.toEntries(mapping),\n\t\t\t([hex, identity]) =>\n\t\t\t\tEffect.fromResult(Hex.decode(hex)).pipe(\n\t\t\t\t\tEffect.map((hash) => ({ hash, identity })),\n\t\t\t\t),\n\t\t)\n\t\tyield* Graft.provide(Authenticator, {\n\t\t\t_tag: \"Header\",\n\t\t\tauthenticate: Effect.fnUntraced(function* (authorization) {\n\t\t\t\tconst token = yield* Token.read(authorization)\n\t\t\t\tconst hash = yield* digest.digest(\n\t\t\t\t\tDigest.sha256,\n\t\t\t\t\tnew TextEncoder().encode(Redacted.value(token)),\n\t\t\t\t)\n\t\t\t\tconst found = Array.findFirst(tokens, (entry) =>\n\t\t\t\t\ttimingSafeEqual(hash, entry.hash),\n\t\t\t\t)\n\t\t\t\treturn yield* Effect.fromOption(found, Token.invalid).pipe(\n\t\t\t\t\tEffect.map((entry) => entry.identity),\n\t\t\t\t)\n\t\t\t}),\n\t\t})\n\t}),\n})\n"],"mappings":";;;;;;;;;AAmBA,MAAa,SAAS,OAAO,OAAO,EAAE,QAAQ,OAAO,OAAO,CAAC;AAC7D,MAAM,SAAS,OAAO,eACrB,OAAO,OACN,OAAO,OAAO,MAAM,OAAO,UAAU,mBAAmB,CAAC,GACzD,OAAO,cACR,CACD;AACA,IAAA,iBAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQ;CACR,QAAQ;EAAC,WAAW;EAAY,KAAK;EAAM,OAAO;CAAM;CACxD,OAAO,OAAO,WAAW,WAAW,QAAQ;EAC3C,MAAM,KAAK,OAAO,WAAW;EAC7B,MAAM,OAAO,OAAO,KAAK;EACzB,MAAM,YAAY,OAAO,gBAAgB,KACxC,OAAO,IAAI,OAAO,gBAAgB,GAAG,CAAC,CACvC;EACA,MAAM,SAAS,OAAO,OAAO;EAC7B,MAAM,OAAO,OAAO,GAAG,eACtB,KAAK,QAAQ,WAAW,OAAO,MAAM,CACtC;EACA,MAAM,UAAU,OAAO,OAAO,aAAa,MAAM,CAAC,CAAC,IAAI;EACvD,MAAM,SAAS,OAAO,OAAO,QAC5B,OAAO,UAAU,OAAO,IACvB,CAAC,KAAK,cACN,OAAO,WAAW,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAClC,OAAO,KAAK,UAAU;GAAE;GAAM;EAAS,EAAE,CAC1C,CACF;EACA,OAAO,MAAM,QAAQ,eAAe;GACnC,MAAM;GACN,cAAc,OAAO,WAAW,WAAW,eAAe;IACzD,MAAM,QAAQ,OAAOA,KAAW,aAAa;IAC7C,MAAM,OAAO,OAAO,OAAO,OAC1B,OAAO,QACP,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,MAAM,KAAK,CAAC,CAC/C;IACA,MAAM,QAAQ,MAAM,UAAU,SAAS,UACtC,gBAAgB,MAAM,MAAM,IAAI,CACjC;IACA,OAAO,OAAO,OAAO,WAAW,OAAOC,OAAa,CAAC,CAAC,KACrD,OAAO,KAAK,UAAU,MAAM,QAAQ,CACrC;GACD,CAAC;EACF,CAAC;CACF,CAAC;AACF,CAAC"}

package/dist/runner/auth/jwt.d.ts

@@ -0,0 +1,19 @@
+import { Schema } from "effect";
+export declare const ClockTolerance: Schema.DurationFromString;
+export declare const Config: Schema.Struct<{
+  readonly issuer: Schema.NonEmptyString;
+  readonly audience: Schema.NonEmptyArray<Schema.NonEmptyString>;
+  readonly algorithms: Schema.NonEmptyArray<Schema.Literals<readonly ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512", "EdDSA"]>>;
+  readonly identityClaim: Schema.withDecodingDefaultKey<Schema.NonEmptyString, never>;
+  readonly clockTolerance: Schema.withDecodingDefaultKey<Schema.DurationFromString, never>;
+  readonly keys: Schema.Union<readonly [Schema.Struct<{
+    readonly jwksUrl: Schema.String;
+    readonly publicKey: Schema.optionalKey<Schema.Never>;
+  }>, Schema.Struct<{
+    readonly publicKey: Schema.String;
+    readonly jwksUrl: Schema.optionalKey<Schema.Never>;
+  }>]>;
+}>;
+declare const _default: any;
+export { _default as default };
+//# sourceMappingURL=jwt.d.ts.map

package/dist/runner/auth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","names":[],"sources":["../../../src/runner/auth/jwt.ts"],"mappings":";qBAmBa,gBAAc,OAAA;qBAOd,QAAM,OAAA"}

package/dist/runner/auth/jwt.js

@@ -0,0 +1,65 @@
+import { a as provide, l as make } from "../../Graft-BsYq3F-J.js";
+import { t as Authenticator } from "../../Auth-BElTC9_X.js";
+import { t as ConfigDirectory } from "../../ConfigDirectory-BCC6q2R4.js";
+import { t as AuthenticationFailed } from "../../Errors-oPsTLY7l.js";
+import { r as read } from "../../token-v5ne2I0-.js";
+import { Cause, Duration, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
+import { Signature } from "effect/crypto";
+import { HttpClient } from "effect/http";
+import { Jwk, Jwks, Jwt } from "effect/jose";
+// packages/remote/src/runner/auth/jwt.ts
+const ClockTolerance = Schema.DurationFromString.check(Schema.makeFilter((duration) => Duration.isFinite(duration) && Duration.toMillis(duration) >= 0, { expected: "a finite, non-negative duration" }));
+const Config = Schema.Struct({
+	issuer: Schema.NonEmptyString,
+	audience: Schema.NonEmptyArray(Schema.NonEmptyString),
+	algorithms: Schema.NonEmptyArray(Jwk.AsymmetricAlgorithm),
+	identityClaim: Schema.NonEmptyString.pipe(Schema.withDecodingDefaultKey(Effect.succeed("sub"))),
+	clockTolerance: ClockTolerance.pipe(Schema.withDecodingDefaultKey(Effect.succeed("5 seconds"))),
+	keys: Schema.Union([Schema.Struct({
+		jwksUrl: Schema.String,
+		publicKey: Schema.optionalKey(Schema.Never)
+	}), Schema.Struct({
+		publicKey: Schema.String,
+		jwksUrl: Schema.optionalKey(Schema.Never)
+	})])
+});
+const keys = Effect.fnUntraced(function* (config) {
+	if (config.keys.jwksUrl !== void 0) return Jwks.layerRemote({ url: config.keys.jwksUrl });
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const directory = yield* ConfigDirectory.pipe(Effect.map(Option.getOrElse(() => ".")));
+	const pem = yield* fs.readFileString(path.resolve(directory, config.keys.publicKey));
+	const keys = yield* Effect.forEach(config.algorithms, (algorithm) => Jwk.importSpki(pem, algorithm).pipe(Effect.flatMap(Jwk.exportPublic)));
+	return Jwks.layerLocal({ keys });
+});
+var jwt_default = make({
+	name: "remote-jwt-authenticator",
+	config: Config,
+	inject: [
+		FileSystem.FileSystem,
+		Path.Path,
+		Signature.Signature,
+		HttpClient.HttpClient
+	],
+	apply: Effect.fnUntraced(function* (config) {
+		const keySet = yield* keys(config);
+		const services = yield* Layer.build(keySet);
+		const signature = yield* Signature.Signature;
+		yield* provide(Authenticator, {
+			_tag: "Header",
+			issuer: config.issuer,
+			authenticate: (authorization) => read(authorization).pipe(Effect.flatMap((token) => Jwt.verifyWithKeySet(Schema.Record(Schema.String, Schema.Unknown), token, {
+				issuer: config.issuer,
+				audience: config.audience,
+				algorithms: config.algorithms,
+				clockTolerance: config.clockTolerance,
+				requiredClaims: ["exp"]
+			}).pipe(Effect.flatMap((verified) => Schema.decodeUnknownEffect(Schema.NonEmptyString)(verified.claims[config.identityClaim])), Effect.mapError((error) => AuthenticationFailed.make({
+				reason: "invalid",
+				challenge: "Bearer error=\"invalid_token\"",
+				cause: Cause.fail(error)
+			})), Effect.provideService(Signature.Signature, signature), Effect.provideContext(services))))
+		});
+	})
+});
+export { ClockTolerance, Config, jwt_default as default };

package/dist/runner/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","names":["Token.read"],"sources":["../../../src/runner/auth/jwt.ts"],"sourcesContent":["import { Option } from \"effect\"\nimport { Graft, Plugin } from \"@graftland/graft\"\nimport {\n\tCause,\n\tDuration,\n\tEffect,\n\tFileSystem,\n\tLayer,\n\tPath,\n\tSchema,\n} from \"effect\"\nimport { Jwk, Jwks, Jwt } from \"effect/jose\"\nimport { Signature } from \"effect/crypto\"\nimport { HttpClient } from \"effect/http\"\nimport { Authenticator } from \"../../Auth\"\nimport { ConfigDirectory } from \"@graftland/loader\"\nimport { AuthenticationFailed } from \"../../Errors\"\nimport * as Token from \"../../internal/auth/token\"\n\nexport const ClockTolerance = Schema.DurationFromString.check(\n\tSchema.makeFilter(\n\t\t(duration) =>\n\t\t\tDuration.isFinite(duration) && Duration.toMillis(duration) >= 0,\n\t\t{ expected: \"a finite, non-negative duration\" },\n\t),\n)\nexport const Config = Schema.Struct({\n\tissuer: Schema.NonEmptyString,\n\taudience: Schema.NonEmptyArray(Schema.NonEmptyString),\n\talgorithms: Schema.NonEmptyArray(Jwk.AsymmetricAlgorithm),\n\tidentityClaim: Schema.NonEmptyString.pipe(\n\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"sub\")),\n\t),\n\tclockTolerance: ClockTolerance.pipe(\n\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"5 seconds\")),\n\t),\n\tkeys: Schema.Union([\n\t\tSchema.Struct({\n\t\t\tjwksUrl: Schema.String,\n\t\t\tpublicKey: Schema.optionalKey(Schema.Never),\n\t\t}),\n\t\tSchema.Struct({\n\t\t\tpublicKey: Schema.String,\n\t\t\tjwksUrl: Schema.optionalKey(Schema.Never),\n\t\t}),\n\t]),\n})\nconst keys = Effect.fnUntraced(function* (config: typeof Config.Type) {\n\tif (config.keys.jwksUrl !== undefined)\n\t\treturn Jwks.layerRemote({ url: config.keys.jwksUrl })\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst directory = yield* ConfigDirectory.pipe(\n\t\tEffect.map(Option.getOrElse(() => \".\")),\n\t)\n\tconst pem = yield* fs.readFileString(\n\t\tpath.resolve(directory, config.keys.publicKey),\n\t)\n\t// A single PEM must support the allowed algorithms; use JWKS for multiple key types.\n\tconst keys = yield* Effect.forEach(config.algorithms, (algorithm) =>\n\t\tJwk.importSpki(pem, algorithm).pipe(Effect.flatMap(Jwk.exportPublic)),\n\t)\n\treturn Jwks.layerLocal({ keys })\n})\nexport default Plugin.make({\n\tname: \"remote-jwt-authenticator\",\n\tconfig: Config,\n\tinject: [\n\t\tFileSystem.FileSystem,\n\t\tPath.Path,\n\t\tSignature.Signature,\n\t\tHttpClient.HttpClient,\n\t],\n\tapply: Effect.fnUntraced(function* (config) {\n\t\tconst keySet = yield* keys(config)\n\t\tconst services = yield* Layer.build(keySet)\n\t\tconst signature = yield* Signature.Signature\n\t\tyield* Graft.provide(Authenticator, {\n\t\t\t_tag: \"Header\",\n\t\t\tissuer: config.issuer,\n\t\t\tauthenticate: (authorization) =>\n\t\t\t\tToken.read(authorization).pipe(\n\t\t\t\t\tEffect.flatMap((token) =>\n\t\t\t\t\t\tJwt.verifyWithKeySet(\n\t\t\t\t\t\t\tSchema.Record(Schema.String, Schema.Unknown),\n\t\t\t\t\t\t\ttoken,\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tissuer: config.issuer,\n\t\t\t\t\t\t\t\taudience: config.audience,\n\t\t\t\t\t\t\t\talgorithms: config.algorithms,\n\t\t\t\t\t\t\t\tclockTolerance: config.clockTolerance,\n\t\t\t\t\t\t\t\trequiredClaims: [\"exp\"],\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t).pipe(\n\t\t\t\t\t\t\tEffect.flatMap((verified) =>\n\t\t\t\t\t\t\t\tSchema.decodeUnknownEffect(Schema.NonEmptyString)(\n\t\t\t\t\t\t\t\t\tverified.claims[config.identityClaim],\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\t\t\t\tAuthenticationFailed.make({\n\t\t\t\t\t\t\t\t\treason: \"invalid\",\n\t\t\t\t\t\t\t\t\tchallenge: 'Bearer error=\"invalid_token\"',\n\t\t\t\t\t\t\t\t\tcause: Cause.fail(error),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tEffect.provideService(Signature.Signature, signature),\n\t\t\t\t\t\t\tEffect.provideContext(services),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t})\n\t}),\n})\n"],"mappings":";;;;;;;;;;AAmBA,MAAa,iBAAiB,OAAO,mBAAmB,MACvD,OAAO,YACL,aACA,SAAS,SAAS,QAAQ,KAAK,SAAS,SAAS,QAAQ,KAAK,GAC/D,EAAE,UAAU,kCAAkC,CAC/C,CACD;AACA,MAAa,SAAS,OAAO,OAAO;CACnC,QAAQ,OAAO;CACf,UAAU,OAAO,cAAc,OAAO,cAAc;CACpD,YAAY,OAAO,cAAc,IAAI,mBAAmB;CACxD,eAAe,OAAO,eAAe,KACpC,OAAO,uBAAuB,OAAO,QAAQ,KAAK,CAAC,CACpD;CACA,gBAAgB,eAAe,KAC9B,OAAO,uBAAuB,OAAO,QAAQ,WAAW,CAAC,CAC1D;CACA,MAAM,OAAO,MAAM,CAClB,OAAO,OAAO;EACb,SAAS,OAAO;EAChB,WAAW,OAAO,YAAY,OAAO,KAAK;CAC3C,CAAC,GACD,OAAO,OAAO;EACb,WAAW,OAAO;EAClB,SAAS,OAAO,YAAY,OAAO,KAAK;CACzC,CAAC,CACF,CAAC;AACF,CAAC;AACD,MAAM,OAAO,OAAO,WAAW,WAAW,QAA4B;CACrE,IAAI,OAAO,KAAK,YAAY,KAAA,GAC3B,OAAO,KAAK,YAAY,EAAE,KAAK,OAAO,KAAK,QAAQ,CAAC;CACrD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,YAAY,OAAO,gBAAgB,KACxC,OAAO,IAAI,OAAO,gBAAgB,GAAG,CAAC,CACvC;CACA,MAAM,MAAM,OAAO,GAAG,eACrB,KAAK,QAAQ,WAAW,OAAO,KAAK,SAAS,CAC9C;CAEA,MAAM,OAAO,OAAO,OAAO,QAAQ,OAAO,aAAa,cACtD,IAAI,WAAW,KAAK,SAAS,CAAC,CAAC,KAAK,OAAO,QAAQ,IAAI,YAAY,CAAC,CACrE;CACA,OAAO,KAAK,WAAW,EAAE,KAAK,CAAC;AAChC,CAAC;AACD,IAAA,cAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQ;CACR,QAAQ;EACP,WAAW;EACX,KAAK;EACL,UAAU;EACV,WAAW;CACZ;CACA,OAAO,OAAO,WAAW,WAAW,QAAQ;EAC3C,MAAM,SAAS,OAAO,KAAK,MAAM;EACjC,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM;EAC1C,MAAM,YAAY,OAAO,UAAU;EACnC,OAAO,MAAM,QAAQ,eAAe;GACnC,MAAM;GACN,QAAQ,OAAO;GACf,eAAe,kBACdA,KAAW,aAAa,CAAC,CAAC,KACzB,OAAO,SAAS,UACf,IAAI,iBACH,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,GAC3C,OACA;IACC,QAAQ,OAAO;IACf,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,gBAAgB,OAAO;IACvB,gBAAgB,CAAC,KAAK;GACvB,CACD,CAAC,CAAC,KACD,OAAO,SAAS,aACf,OAAO,oBAAoB,OAAO,cAAc,CAAC,CAChD,SAAS,OAAO,OAAO,cACxB,CACD,GACA,OAAO,UAAU,UAChB,qBAAqB,KAAK;IACzB,QAAQ;IACR,WAAW;IACX,OAAO,MAAM,KAAK,KAAK;GACxB,CAAC,CACF,GACA,OAAO,eAAe,UAAU,WAAW,SAAS,GACpD,OAAO,eAAe,QAAQ,CAC/B,CACD,CACD;EACF,CAAC;CACF,CAAC;AACF,CAAC"}

package/dist/runner/auth/mtls.d.ts

@@ -0,0 +1,11 @@
+import { AuthenticatorApi } from "../../Auth.js";
+import { Schema } from "effect";
+export declare const Config: Schema.Struct<{
+  readonly ca: Schema.String;
+}>;
+export declare const make: (ca: string) => Extract<AuthenticatorApi, {
+  readonly _tag: "Mtls";
+}>;
+declare const _default: any;
+export { _default as default };
+//# sourceMappingURL=mtls.d.ts.map

package/dist/runner/auth/mtls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mtls.d.ts","names":[],"sources":["../../../src/runner/auth/mtls.ts"],"mappings":";;qBAMa,QAAM,OAAA;;;qBASN,OAAI,eAEd,QAAQ;WAA6B"}

package/dist/runner/auth/mtls.js

@@ -0,0 +1,48 @@
+import { a as provide, l as make$1 } from "../../Graft-BsYq3F-J.js";
+import { t as Authenticator } from "../../Auth-BElTC9_X.js";
+import { t as ConfigDirectory } from "../../ConfigDirectory-BCC6q2R4.js";
+import { t as AuthenticationFailed } from "../../Errors-oPsTLY7l.js";
+import { Array, Cause, Effect, FileSystem, Option, Path, Schema, String } from "effect";
+// packages/remote/src/internal/auth/mtls.ts
+const uriValue = (field) => {
+	const value = String.slice(4)(field);
+	return String.startsWith("\"")(value) ? Schema.decodeEffect(Schema.fromJsonString(Schema.String))(value).pipe(Effect.mapError((error) => AuthenticationFailed.make({
+		reason: "invalid",
+		cause: Cause.fail(error)
+	}))) : Effect.succeed(value);
+};
+/** Read exactly one graft URI from Node's plain or JSON-quoted SAN representation. */
+const identityFromSubjectAltName = (san) => Effect.gen(function* () {
+	const values = yield* Effect.forEach(Array.filter(String.split(san ?? "", ", "), String.startsWith("URI:")), uriValue);
+	const uris = Array.filter(values, String.startsWith("graft://"));
+	const [uri] = uris;
+	return yield* uris.length === 1 && uri !== void 0 ? Effect.succeed(uri) : Effect.fail(AuthenticationFailed.make({
+		reason: "invalid",
+		cause: Cause.fail("The peer certificate must contain exactly one graft SAN URI")
+	}));
+});
+// packages/remote/src/runner/auth/mtls.ts
+const Config = Schema.Struct({ ca: Schema.String });
+const read = Effect.fnUntraced(function* (ca) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const directory = yield* ConfigDirectory.pipe(Effect.map(Option.getOrElse(() => ".")));
+	return yield* fs.readFileString(path.resolve(directory, ca));
+});
+const make = (ca) => ({
+	_tag: "Mtls",
+	tls: {
+		ca: [ca],
+		minVersion: "TLSv1.3",
+		requestCert: true,
+		rejectUnauthorized: true
+	},
+	authenticate: (peer) => identityFromSubjectAltName(Option.getOrUndefined(peer.subjectAltName))
+});
+var mtls_default = make$1({
+	name: "remote-certificate-authenticator",
+	config: Config,
+	inject: [FileSystem.FileSystem, Path.Path],
+	apply: ({ ca }) => read(ca).pipe(Effect.flatMap((ca) => provide(Authenticator, make(ca))))
+});
+export { Config, mtls_default as default, make };

package/dist/runner/auth/mtls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mtls.js","names":[],"sources":["../../../src/runner/auth/mtls.ts"],"sourcesContent":["import { Graft, Plugin } from \"@graftland/graft\"\nimport { Effect, FileSystem, Option, Path, Schema } from \"effect\"\nimport { Authenticator, type AuthenticatorApi } from \"../../Auth\"\nimport { ConfigDirectory } from \"@graftland/loader\"\nimport { identityFromSubjectAltName } from \"../../internal/auth/mtls\"\n\nexport const Config = Schema.Struct({ ca: Schema.String })\nconst read = Effect.fnUntraced(function* (ca: string) {\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst directory = yield* ConfigDirectory.pipe(\n\t\tEffect.map(Option.getOrElse(() => \".\")),\n\t)\n\treturn yield* fs.readFileString(path.resolve(directory, ca))\n})\nexport const make = (\n\tca: string,\n): Extract<AuthenticatorApi, { readonly _tag: \"Mtls\" }> => ({\n\t_tag: \"Mtls\",\n\ttls: {\n\t\tca: [ca],\n\t\tminVersion: \"TLSv1.3\",\n\t\trequestCert: true,\n\t\trejectUnauthorized: true,\n\t},\n\tauthenticate: (peer) =>\n\t\tidentityFromSubjectAltName(Option.getOrUndefined(peer.subjectAltName)),\n})\nexport default Plugin.make({\n\tname: \"remote-certificate-authenticator\",\n\tconfig: Config,\n\tinject: [FileSystem.FileSystem, Path.Path],\n\tapply: ({ ca }) =>\n\t\tread(ca).pipe(\n\t\t\tEffect.flatMap((ca) => Graft.provide(Authenticator, make(ca))),\n\t\t),\n})\n"],"mappings":";;;;;;AAMA,MAAa,SAAS,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC;AACzD,MAAM,OAAO,OAAO,WAAW,WAAW,IAAY;CACrD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,YAAY,OAAO,gBAAgB,KACxC,OAAO,IAAI,OAAO,gBAAgB,GAAG,CAAC,CACvC;CACA,OAAO,OAAO,GAAG,eAAe,KAAK,QAAQ,WAAW,EAAE,CAAC;AAC5D,CAAC;AACD,MAAa,QACZ,QAC2D;CAC3D,MAAM;CACN,KAAK;EACJ,IAAI,CAAC,EAAE;EACP,YAAY;EACZ,aAAa;EACb,oBAAoB;CACrB;CACA,eAAe,SACd,2BAA2B,OAAO,eAAe,KAAK,cAAc,CAAC;AACvE;AACA,IAAA,eAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQ;CACR,QAAQ,CAAC,WAAW,YAAY,KAAK,IAAI;CACzC,QAAQ,EAAE,SACT,KAAK,EAAE,CAAC,CAAC,KACR,OAAO,SAAS,OAAO,MAAM,QAAQ,eAAe,KAAK,EAAE,CAAC,CAAC,CAC9D;AACF,CAAC"}

package/dist/runner/auth/none.d.ts

@@ -0,0 +1,3 @@
+declare const _default: any;
+export { _default as default };
+//# sourceMappingURL=none.d.ts.map

package/dist/runner/auth/none.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"none.d.ts","names":[],"sources":["../../../src/runner/auth/none.ts"],"mappings":""}

package/dist/runner/auth/none.js

@@ -0,0 +1,13 @@
+import { a as provide, l as make } from "../../Graft-BsYq3F-J.js";
+import { t as Authenticator } from "../../Auth-BElTC9_X.js";
+import { Effect, Schema } from "effect";
+// packages/remote/src/runner/auth/none.ts
+var none_default = make({
+	name: "remote-none-authenticator",
+	config: Schema.Struct({ identity: Schema.String.pipe(Schema.withDecodingDefaultKey(Effect.succeed("anonymous"))) }),
+	apply: (config) => provide(Authenticator, {
+		_tag: "None",
+		...config
+	})
+});
+export { none_default as default };

package/dist/runner/auth/none.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"none.js","names":[],"sources":["../../../src/runner/auth/none.ts"],"sourcesContent":["import { Graft, Plugin } from \"@graftland/graft\"\nimport { Effect, Schema } from \"effect\"\nimport { Authenticator } from \"../../Auth\"\n\nexport default Plugin.make({\n\tname: \"remote-none-authenticator\",\n\tconfig: Schema.Struct({\n\t\tidentity: Schema.String.pipe(\n\t\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"anonymous\")),\n\t\t),\n\t}),\n\tapply: (config) => Graft.provide(Authenticator, { _tag: \"None\", ...config }),\n})\n"],"mappings":";;;;AAIA,IAAA,eAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQ,OAAO,OAAO,EACrB,UAAU,OAAO,OAAO,KACvB,OAAO,uBAAuB,OAAO,QAAQ,WAAW,CAAC,CAC1D,EACD,CAAC;CACD,QAAQ,WAAW,MAAM,QAAQ,eAAe;EAAE,MAAM;EAAQ,GAAG;CAAO,CAAC;AAC5E,CAAC"}

package/dist/runner/index.d.ts

@@ -0,0 +1,3 @@
+declare const _default: any;
+export { _default as default };
+//# sourceMappingURL=index.d.ts.map

package/dist/runner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/runner/index.ts"],"mappings":""}