@graftland/plugin-remote 0.0.0-stage → 0.3.0

package/dist/token-v5ne2I0-.js

@@ -0,0 +1,17 @@
+import { t as AuthenticationFailed } from "./Errors-oPsTLY7l.js";
+import { Effect, Option, Redacted } from "effect";
+// packages/remote/src/internal/auth/token.ts
+const invalid = () => AuthenticationFailed.make({
+	reason: "invalid",
+	challenge: "Bearer error=\"invalid_token\""
+});
+const read = (authorization) => {
+	if (Option.isNone(authorization)) return Effect.fail(AuthenticationFailed.make({
+		reason: "missing",
+		challenge: "Bearer"
+	}));
+	const token = /^Bearer +([^ ]+)$/i.exec(Redacted.value(authorization.value))?.[1];
+	return token === void 0 ? Effect.fail(invalid()) : Effect.succeed(Redacted.make(token));
+};
+const prepare = (token) => Effect.succeed(Redacted.make("Bearer " + Redacted.value(token)));
+export { prepare as n, read as r, invalid as t };

package/dist/tokenCredentials-WUJm2AKm.js

@@ -0,0 +1,31 @@
+import { a as provide, l as make } from "./Graft-BsYq3F-J.js";
+import { t as ConfigDirectory } from "./ConfigDirectory-BCC6q2R4.js";
+import { n as Credentials } from "./Auth-BElTC9_X.js";
+import { n as CredentialsError } from "./Errors-oPsTLY7l.js";
+import { n as prepare } from "./token-v5ne2I0-.js";
+import { Cause, Effect, FileSystem, Option, Path, Redacted, Schema } from "effect";
+// packages/remote/src/internal/auth/tokenCredentials.ts
+const Config$1 = Schema.Struct({ token: Schema.Union([Schema.RedactedFromValue(Schema.String), Schema.Struct({ file: Schema.String })]) });
+const plugin = (name) => make({
+	name,
+	config: Config$1,
+	inject: [FileSystem.FileSystem, Path.Path],
+	apply: Effect.fnUntraced(function* (config) {
+		const fs = yield* FileSystem.FileSystem;
+		const path = yield* Path.Path;
+		const directory = yield* ConfigDirectory;
+		const token = config.token;
+		const read = Redacted.isRedacted(token) ? Effect.succeed(token) : fs.readFileString(path.resolve(Option.getOrElse(directory, () => "."), token.file)).pipe(Effect.map(Redacted.make));
+		yield* provide(Credentials, {
+			kind: "Authorization",
+			read: read.pipe(Effect.flatMap(prepare), Effect.mapBoth({
+				onSuccess: (value) => ({
+					_tag: "Authorization",
+					value
+				}),
+				onFailure: (error) => CredentialsError.make({ cause: Cause.fail(error) })
+			}))
+		});
+	})
+});
+export { plugin as n, Config$1 as t };

package/dist/websocketServer-MXcCJx0v.js

@@ -0,0 +1,58 @@
+import { c as TransportError } from "./Errors-oPsTLY7l.js";
+import { a as payloadLimit, s as protocol, t as fromSocket } from "./socketChannel-KmtzF-9G.js";
+import { Array, Cause, Deferred, Effect, Option, Redacted, Scope, String } from "effect";
+import { NodeHttpServer, NodeHttpServerRequest } from "@effect/platform-node";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+import { TLSSocket } from "node:tls";
+// packages/remote/src/internal/websocketServer.ts
+const rejection = (error) => Effect.logWarning("Remote host authentication failed", { reason: error.reason }, ...error.cause === void 0 ? [] : [error.cause]).pipe(Effect.as(HttpServerResponse.empty({
+	status: 401,
+	headers: error.challenge === void 0 ? {} : { "www-authenticate": error.challenge }
+})));
+const handshake = Effect.gen(function* () {
+	const request = yield* HttpServerRequest.HttpServerRequest;
+	const { socket } = NodeHttpServerRequest.toIncomingMessage(request);
+	const peer = socket instanceof TLSSocket && socket.authorized ? Option.some(socket.getPeerCertificate()) : Option.none();
+	return {
+		authorization: Option.map(Option.fromUndefinedOr(request.headers["authorization"]), Redacted.make),
+		certificate: Option.map(peer, (certificate) => ({
+			der: certificate.raw,
+			subjectAltName: Option.fromUndefinedOr(certificate.subjectaltname)
+		}))
+	};
+});
+const open = Effect.fnUntraced(function* (createServer, options) {
+	const resources = yield* Effect.acquireRelease(Scope.make(), Scope.close);
+	const ready = yield* Deferred.make();
+	const server = yield* NodeHttpServer.make(createServer, {
+		...options,
+		disablePreemptiveShutdown: true,
+		websocket: {
+			perMessageDeflate: false,
+			maxPayload: payloadLimit,
+			handleProtocols: (protocols) => protocols.has("graft-remote.v1") ? protocol : false
+		}
+	}).pipe(Scope.provide(resources));
+	return {
+		address: server.address,
+		ready: Deferred.await(ready),
+		run: (accept) => server.serve(Effect.gen(function* () {
+			const request = yield* HttpServerRequest.HttpServerRequest;
+			if (request.url !== "/graft") return HttpServerResponse.empty({ status: 404 });
+			if (String.toLowerCase(request.headers["upgrade"] ?? "") !== "websocket" || !Array.some(String.split(request.headers["sec-websocket-protocol"] ?? "", ","), (value) => String.trim(value) === "graft-remote.v1")) return HttpServerResponse.empty({ status: 400 });
+			const session = yield* Effect.result(accept);
+			if (session._tag === "Failure") return yield* rejection(session.failure);
+			yield* request.upgrade.pipe(Effect.flatMap(session.success), Effect.interruptible, Effect.scoped);
+			return HttpServerResponse.empty();
+		})).pipe(Effect.andThen(Deferred.succeed(ready, void 0)), Effect.andThen(Effect.never))
+	};
+});
+const bind = Effect.fnUntraced(function* (createServer, options) {
+	const server = yield* open(createServer, options);
+	return {
+		address: server.address,
+		ready: server.ready,
+		serve: (accept) => server.run(handshake.pipe(Effect.flatMap(accept), Effect.map((session) => (socket) => fromSocket(socket).pipe(Effect.flatMap(session))))).pipe(Effect.mapError((error) => TransportError.make({ cause: Cause.fail(error) })))
+	};
+});
+export { bind as t };

package/dist/workerChannel-P82YdNjh.js

@@ -0,0 +1,27 @@
+import { c as TransportError } from "./Errors-oPsTLY7l.js";
+import { Cause, Effect, FiberSet, Queue, Schema, Sink, Stream } from "effect";
+// packages/remote/src/internal/workerBootstrap.ts
+const Bootstrap = Schema.Struct({
+	contractModule: Schema.String,
+	session: Schema.String
+});
+// packages/remote/src/internal/workerChannel.ts
+const make = Effect.fnUntraced(function* (endpoint) {
+	const input = yield* Queue.unbounded();
+	const callbacks = yield* FiberSet.make();
+	const run = yield* FiberSet.runtime(callbacks)();
+	const receive = (value) => run(value === null ? Queue.end(input) : Queue.offer(input, new Uint8Array(value)));
+	yield* Effect.acquireRelease(Effect.sync(() => endpoint.on("message", receive)), () => Effect.sync(() => endpoint.off("message", receive)).pipe(Effect.andThen(Queue.shutdown(input))));
+	const send = (bytes) => Effect.try({
+		try: () => {
+			const buffer = bytes === null ? null : new Uint8Array(bytes).buffer;
+			endpoint.postMessage(buffer, buffer === null ? [] : [buffer]);
+		},
+		catch: (cause) => TransportError.make({ cause: Cause.die(cause) })
+	});
+	return {
+		input: Stream.fromQueue(input),
+		output: Sink.forEach((bytes) => send(bytes)).pipe(Sink.ensuring(send(null)))
+	};
+});
+export { Bootstrap as n, make as t };

package/package.json

@@ -1,6 +1,72 @@
 {
   "name": "@graftland/plugin-remote",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.3.0",
+  "type": "module",
+  "description": "Local and authenticated network execution for Graft plugins",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/graftland/graft.git",
+    "directory": "packages/remote"
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.zh-CN.md",
+    "README.zh-TW.md"
+  ],
+  "sideEffects": false,
+  "exports": {
+    ".": "./dist/index.js",
+    "./Auth": "./dist/Auth.js",
+    "./Contract": "./dist/Contract.js",
+    "./Errors": "./dist/Errors.js",
+    "./host/auth/bearer": "./dist/host/auth/bearer.js",
+    "./host/auth/jwt": "./dist/host/auth/jwt.js",
+    "./host/auth/mtls": "./dist/host/auth/mtls.js",
+    "./host/auth/none": "./dist/host/auth/none.js",
+    "./host/command": "./dist/host/command.js",
+    "./host/local": "./dist/host/local.js",
+    "./host/unix": "./dist/host/unix.js",
+    "./host/websocket": "./dist/host/websocket.js",
+    "./host/worker": "./dist/host/worker.js",
+    "./runner": "./dist/runner/index.js",
+    "./runner/auth/bearer": "./dist/runner/auth/bearer.js",
+    "./runner/auth/jwt": "./dist/runner/auth/jwt.js",
+    "./runner/auth/mtls": "./dist/runner/auth/mtls.js",
+    "./runner/auth/none": "./dist/runner/auth/none.js",
+    "./runner/stdio": "./dist/runner/stdio.js",
+    "./runner/unix": "./dist/runner/unix.js",
+    "./runner/websocket": "./dist/runner/websocket.js",
+    "./Testing": "./dist/Testing.js",
+    "./Transport": "./dist/Transport.js",
+    "./package.json": "./package.json",
+    "./internal/bin": "./dist/bin.js",
+    "./internal/watchdog": "./dist/internal/watchdogMain.js",
+    "./internal/worker": "./dist/internal/workerMain.js"
+  },
+  "peerDependencies": {
+    "effect": "4.1.*"
+  },
+  "dependencies": {
+    "@graftland/graft": "0.3.0",
+    "@effect/platform-node": "4.1.2",
+    "@graftland/loader": "0.3.0",
+    "pkijs": "4.0.1",
+    "asn1js": "4.0.0",
+    "ws": "8.22.1"
+  },
+  "devDependencies": {
+    "@effect/vitest": "4.1.2",
+    "effect": "4.1.2",
+    "vitest": "5.1.0",
+    "@types/ws": "8.18.2"
+  },
+  "bin": {
+    "graft-remote": "./dist/bin.js"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "test": "vitest run"
+  }
 }

package/src/Auth.ts

@@ -0,0 +1,62 @@
+/** Credentials and authenticated identities shared by transport plugins. */
+import { Context } from "effect"
+import type { Effect, Redacted, Option, Scope } from "effect"
+import type { AuthenticationFailed, CredentialsError } from "./Errors"
+
+export interface ClientCertificate {
+	readonly cert: string
+	readonly key: Redacted.Redacted<string>
+}
+export interface VerifiedCertificate {
+	readonly der: Uint8Array
+	readonly subjectAltName: Option.Option<string>
+}
+export interface TlsPolicy {
+	readonly ca: ReadonlyArray<string>
+	readonly minVersion: "TLSv1.3"
+	readonly requestCert: true
+	readonly rejectUnauthorized: true
+}
+export type Prepared =
+	| {
+			readonly _tag: "Authorization"
+			readonly value: Redacted.Redacted<string>
+	  }
+	| { readonly _tag: "Certificate"; readonly value: ClientCertificate }
+	| { readonly _tag: "None" }
+
+export type CredentialsApi = {
+	[K in Prepared["_tag"]]: {
+		readonly kind: K
+		readonly read: Effect.Effect<
+			Extract<Prepared, { readonly _tag: K }>,
+			CredentialsError,
+			Scope.Scope
+		>
+	}
+}[Prepared["_tag"]]
+
+export type AuthenticatorApi =
+	| {
+			readonly _tag: "Header"
+			readonly issuer?: string
+			readonly authenticate: (
+				header: Option.Option<Redacted.Redacted<string>>,
+			) => Effect.Effect<string, AuthenticationFailed>
+	  }
+	| {
+			readonly _tag: "Mtls"
+			readonly tls: TlsPolicy
+			readonly authenticate: (
+				peer: VerifiedCertificate,
+			) => Effect.Effect<string, AuthenticationFailed>
+	  }
+	| { readonly _tag: "None"; readonly identity: string }
+
+export class Credentials extends Context.Service<Credentials, CredentialsApi>()(
+	"@graftland/plugin-remote/Auth/Credentials",
+) {}
+export class Authenticator extends Context.Service<
+	Authenticator,
+	AuthenticatorApi
+>()("@graftland/plugin-remote/Auth/Authenticator") {}

package/src/Contract.ts

@@ -0,0 +1,100 @@
+import { ChildFailure } from "./internal/childErrors"
+export { ChildFailure }
+import { Array, Cause, Predicate, Schema } from "effect"
+
+import type { Service } from "./internal/services"
+import * as Control from "./internal/control"
+export { service } from "./internal/services"
+
+const TypeId = "~@graftland/plugin-remote/Contract"
+
+/** An undeclared failure still crosses the boundary, with its diagnostic value. */
+export class UndeclaredFailure extends Schema.TaggedError<
+	UndeclaredFailure,
+	{ readonly brand: unique symbol }
+>()("UndeclaredFailure", { original: Schema.Defect({ includeStack: true }) }) {}
+
+/** Pure metadata shared by the host and the executable runner bootstrap. */
+export const make = <
+	S extends Schema.Top & {
+		readonly Encoded: Schema.Json
+		readonly DecodingServices: never
+		readonly EncodingServices: never
+	},
+	E extends Schema.Top & {
+		readonly DecodingServices: never
+		readonly EncodingServices: never
+	},
+>(options: {
+	readonly name: string
+	readonly config: S
+	readonly error: E
+	readonly module: string
+	readonly inject?: ReadonlyArray<Service>
+	readonly provides?: ReadonlyArray<Service>
+}) => {
+	// Keys are runtime strings; tuple types cannot distinguish independently created keys.
+	const keys = Array.map(
+		[...(options.inject ?? []), ...(options.provides ?? [])],
+		(service) => service.key.key,
+	)
+	if (
+		Array.dedupe(keys).length !== keys.length ||
+		keys.includes(Control.endpoint)
+	)
+		throw new Error(
+			"Service keys must be unique within a remote contract and must not use the control endpoint",
+		)
+	const failure = Schema.Union([options.error, UndeclaredFailure, ChildFailure])
+	const codec = Schema.toCodecJson(
+		Schema.Cause(failure, Schema.Defect({ includeStack: true })),
+	)
+	const declared = Schema.is(failure)
+	const normalizeCause = (cause: Cause.Cause<unknown>) =>
+		Cause.map(cause, (error) =>
+			declared(error) ? error : UndeclaredFailure.make({ original: error }),
+		)
+	return {
+		...options,
+		control: Control.make(codec),
+		normalizeCause,
+		inject: options.inject ?? [],
+		provides: options.provides ?? [],
+		[TypeId]: TypeId,
+		encodeCause: (cause: Cause.Cause<unknown>) =>
+			normalizeCause(cause).pipe(Schema.encodeEffect(codec)),
+		decodeCause: Schema.decodeUnknownEffect(codec),
+	}
+}
+
+/** The shared config, error codecs, and service declarations for one remote plugin. */
+export type Contract<
+	S extends Schema.Top & {
+		readonly Encoded: Schema.Json
+		readonly DecodingServices: never
+		readonly EncodingServices: never
+	},
+	E extends Schema.Top & {
+		readonly DecodingServices: never
+		readonly EncodingServices: never
+	},
+> = ReturnType<typeof make<S, E>>
+
+/** Dynamic imports retain the control server and cause normalization; hosts retain the declared error type. */
+export type RunnerContract = Contract<
+	Schema.Codec<unknown, Schema.Json>,
+	Schema.Codec<unknown>
+>
+
+export const isContract = (value: unknown): value is RunnerContract =>
+	Predicate.hasProperty(value, TypeId) && value[TypeId] === TypeId
+
+/** A contract module exports either default or a named contract. */
+export const fromModule = (module: unknown) =>
+	Array.findFirst(
+		[
+			Predicate.hasProperty(module, "default") ? module.default : undefined,
+			Predicate.hasProperty(module, "contract") ? module.contract : undefined,
+		],
+		isContract,
+	)

package/src/Errors.ts

@@ -0,0 +1,82 @@
+import { Option, Schema } from "effect"
+
+export class ProcessExited extends Schema.TaggedError<
+	ProcessExited,
+	{ readonly brand: unique symbol }
+>()("ProcessExited", {
+	pid: Schema.Option(Schema.Int),
+	threadId: Schema.optionalKey(Schema.Int),
+	exitCode: Schema.NullOr(Schema.Int),
+	stderr: Schema.String,
+	statusCause: Schema.Cause(Schema.Unknown, Schema.Unknown),
+}) {
+	override get message() {
+		return this.threadId !== undefined
+			? `Remote worker ${this.threadId} exited unexpectedly (${this.exitCode})`
+			: `Remote process${Option.isSome(this.pid) ? ` ${this.pid.value}` : ""} exited unexpectedly (${this.exitCode ?? "signal"})`
+	}
+}
+export class TransportError extends Schema.TaggedError<
+	TransportError,
+	{ readonly brand: unique symbol }
+>()("TransportError", {
+	cause: Schema.Cause(Schema.Unknown, Schema.Unknown),
+}) {}
+
+/** The remote export lease was withdrawn; host consumers must drain before Dispose. */
+export class RemoteWithdrawn extends Schema.TaggedError<
+	RemoteWithdrawn,
+	{ readonly brand: unique symbol }
+>()("RemoteWithdrawn", {}) {
+	override get message() {
+		return "Remote services were withdrawn"
+	}
+}
+
+/** Infrastructure failure at the plugin boundary; the complete underlying cause remains inspectable. */
+export class RemoteError extends Schema.TaggedError<
+	RemoteError,
+	{ readonly brand: unique symbol }
+>()("RemoteError", { cause: Schema.Cause(Schema.Unknown, Schema.Unknown) }) {}
+
+/** A network execution needs a stable logical identity across host restarts. */
+export class MissingInstance extends Schema.TaggedError<
+	MissingInstance,
+	{ readonly brand: unique symbol }
+>()("MissingInstance", {}) {
+	override get message() {
+		return "A runner connection requires an instance or a loader entry id; set connect.instance when loading without Loader."
+	}
+}
+
+/** Dispose completed, but Node still owns live handles; process-scope cleanup must terminate it. */
+export class LocalTerminationTimeout extends Schema.TaggedError<
+	LocalTerminationTimeout,
+	{ readonly brand: unique symbol }
+>()("LocalTerminationTimeout", {
+	pid: Schema.optionalKey(Schema.Int),
+	threadId: Schema.optionalKey(Schema.Int),
+}) {
+	override get message() {
+		return this.threadId !== undefined
+			? `Remote worker ${this.threadId} did not exit within one second after Dispose; terminating it`
+			: `Remote process ${this.pid} did not exit within one second after Dispose; terminating it`
+	}
+}
+
+/** A credential source failed; the original failure remains available. */
+export class CredentialsError extends Schema.TaggedError<
+	CredentialsError,
+	{ readonly brand: unique symbol }
+>()("CredentialsError", {
+	cause: Schema.Cause(Schema.Unknown, Schema.Unknown),
+}) {}
+
+export class AuthenticationFailed extends Schema.TaggedError<
+	AuthenticationFailed,
+	{ readonly brand: unique symbol }
+>()("AuthenticationFailed", {
+	reason: Schema.Literals(["missing", "invalid"]),
+	challenge: Schema.optionalKey(Schema.String),
+	cause: Schema.optionalKey(Schema.Cause(Schema.Unknown, Schema.Unknown)),
+}) {}

package/src/Instance.ts

@@ -0,0 +1,12 @@
+import { Context, Schema } from "effect"
+export const Identity = Schema.Struct({
+	id: Schema.String,
+	generation: Schema.Int,
+})
+/** Outside a remote activation the identity is local/0. Local activations use a fresh UUID/1; runners allocate persistent generations. */
+export const Instance = Context.Reference<typeof Identity.Type>(
+	"@graftland/plugin-remote/Instance/Instance",
+	{
+		defaultValue: () => ({ id: "local", generation: 0 }),
+	},
+)

package/src/Testing.ts

@@ -0,0 +1,135 @@
+import type { Plugin } from "@graftland/graft"
+import {
+	Array,
+	Equivalence,
+	Deferred,
+	Effect,
+	Fiber,
+	Stream,
+	String,
+	Schema,
+} from "effect"
+import type { Channel } from "./Transport"
+import * as Framing from "./internal/runner/Framing"
+
+export class ConformanceError extends Schema.TaggedError<
+	ConformanceError,
+	{ readonly brand: unique symbol }
+>()("ConformanceError", { message: Schema.String }) {}
+const check = (condition: boolean, message: string) =>
+	condition ? Effect.void : Effect.fail(ConformanceError.make({ message }))
+export interface Capabilities {
+	readonly connector: Plugin.Plugin
+	readonly listener: Plugin.Plugin
+	readonly credentials: Plugin.Plugin
+	readonly authenticator: Plugin.Plugin
+}
+/** The fixture supplies addresses/credentials and an echo session; no full runner is required. */
+export const transport = <E, R>(
+	plugins: Capabilities,
+	fixture: (plugins: Capabilities) => Effect.Effect<Channel, E, R>,
+) => {
+	const connect = fixture(plugins)
+	return {
+		chunks: Effect.gen(function* () {
+			const channel = yield* connect
+			const first = yield* Framing.encode({
+				channel: 0,
+				payload: new Uint8Array([1, 2, 3]),
+			})
+			const second = yield* Framing.encode({
+				channel: 1,
+				payload: new Uint8Array([4, 5]),
+			})
+			const combined = new Uint8Array(first.length + second.length)
+			combined.set(first)
+			combined.set(second, first.length)
+			// Split the header, then put the remainder and the next frame in one chunk.
+			const done = yield* Deferred.make<void>()
+			const sending = yield* Stream.make(
+				combined.subarray(0, 2),
+				combined.subarray(2),
+			).pipe(
+				Stream.concat(
+					Stream.fromEffect(Deferred.await(done)).pipe(Stream.drain),
+				),
+				Stream.run(channel.output),
+				Effect.forkScoped,
+			)
+			const frames = Framing.decoder()
+			const reply = yield* channel.input.pipe(
+				Stream.mapEffect((chunk) => Effect.fromResult(frames.decode(chunk))),
+				Stream.flattenIterable,
+				Stream.zipWithIndex,
+				Stream.tap(([, index]) =>
+					index === 1 ? Deferred.succeed(done, undefined) : Effect.void,
+				),
+				Stream.map(([frame]) => frame),
+				Stream.runCollect,
+			)
+			yield* frames.finish
+			yield* Deferred.succeed(done, undefined)
+			yield* Fiber.join(sending)
+			yield* check(
+				Array.makeEquivalence(
+					Equivalence.Struct({
+						channel: Equivalence.Number,
+						payload: Array.makeEquivalence(Equivalence.Number),
+					}),
+				)(
+					Array.map(reply, (frame) => ({
+						channel: frame.channel,
+						payload: Array.fromIterable(frame.payload),
+					})),
+					[
+						{ channel: 0, payload: [1, 2, 3] },
+						{ channel: 1, payload: [4, 5] },
+					],
+				),
+				"The channel changed byte order across split or coalesced chunks",
+			)
+		}),
+		eof: Effect.gen(function* () {
+			const channel = yield* connect
+			yield* Stream.empty.pipe(Stream.run(channel.output))
+			const remaining = yield* Stream.runCollect(channel.input)
+			yield* check(
+				remaining.length === 0,
+				"The channel produced bytes after EOF",
+			)
+		}),
+	}
+}
+
+/** HTTP implementations reject before accepting a session, preserving the challenge. */
+export const rejection = <E, R>(
+	response: Effect.Effect<string, E, R>,
+	challenge?: string,
+) =>
+	response.pipe(
+		Effect.tap((response) =>
+			Effect.all(
+				[
+					check(String.includes("HTTP/1.1 401")(response), "Expected HTTP 401"),
+					check(
+						!String.includes("101 Switching Protocols")(response),
+						"Rejected credentials opened a WebSocket",
+					),
+					check(
+						!String.includes("sec-websocket-accept:")(
+							String.toLowerCase(response),
+						),
+						"Rejected credentials received a WebSocket accept header",
+					),
+					check(
+						challenge === undefined ||
+							String.includes(
+								"www-authenticate: " + String.toLowerCase(challenge),
+							)(String.toLowerCase(response)),
+						"The authentication challenge was lost",
+					),
+				],
+				{ discard: true },
+			),
+		),
+	)

package/src/Transport.ts

@@ -0,0 +1,52 @@
+/** Execution and byte-channel capabilities; implementations live in host plugins. */
+import { Context } from "effect"
+import type { Effect, Option, Scope, Stream, Sink, Redacted } from "effect"
+import type { AuthenticationFailed, TransportError } from "./Errors"
+import type { Prepared, VerifiedCertificate, TlsPolicy } from "./Auth"
+/** Ordered reliable bytes. Chunk boundaries have no meaning; EOF is not exit confirmation. */
+export interface Channel {
+	readonly input: Stream.Stream<Uint8Array, TransportError>
+	readonly output: Sink.Sink<unknown, Uint8Array, unknown, TransportError>
+}
+
+export interface Properties {
+	readonly protocol: string
+	readonly encrypted: boolean
+	readonly network: boolean
+	readonly carries: ReadonlyArray<"header" | "certificate">
+}
+export interface Handshake {
+	readonly authorization: Option.Option<Redacted.Redacted<string>>
+	readonly certificate: Option.Option<VerifiedCertificate>
+}
+export type Session = (
+	channel: Channel,
+) => Effect.Effect<void, TransportError, Scope.Scope>
+export type Accept = (
+	handshake: Handshake,
+) => Effect.Effect<Session, AuthenticationFailed>
+export interface Serving {
+	/** Completes after serve has registered its accept loop, not merely after bind. */
+	readonly ready: Effect.Effect<void>
+	readonly serve: (
+		accept: Accept,
+	) => Effect.Effect<void, TransportError, Scope.Scope>
+}
+export interface ConnectorApi {
+	readonly properties: Properties
+	readonly connect: (
+		credentials: Prepared,
+	) => Effect.Effect<Channel, TransportError, Scope.Scope>
+}
+export interface ListenerApi {
+	readonly properties: Properties
+	readonly bind: (
+		tls: Option.Option<TlsPolicy>,
+	) => Effect.Effect<Serving, TransportError, Scope.Scope>
+}
+export class Connector extends Context.Service<Connector, ConnectorApi>()(
+	"@graftland/plugin-remote/Transport/Connector",
+) {}
+export class Listener extends Context.Service<Listener, ListenerApi>()(
+	"@graftland/plugin-remote/Transport/Listener",
+) {}