@graftland/plugin-remote 0.3.2 → 0.4.0

package/dist/index.js

@@ -1,86 +1,52 @@
-import { a as provide, l as make, u as optional } from "./Graft-B71CPA2Y.js";
-import { r as ModuleResolver } from "./importer-Cvf88eAY.js";
-import { a as publicError, d as follow, f as Host, n as host, r as launch, s as CapabilityFailed } from "./entry-psOpX3Bj.js";
-import { n as Credentials } from "./Auth-BElTC9_X.js";
-import { a as MissingInstance, c as RemoteError, l as RemoteWithdrawn, r as CredentialsError } from "./Errors-DYhsGZcZ.js";
-import { n as prepare } from "./token-CYBNNlhS.js";
-import { n as UndeclaredFailure, t as Contract_exports } from "./Contract-DsJtisvL.js";
-import { O as Instance, l as RemoteTerminationUnconfirmed } from "./Peer-DXeVrGBh.js";
-import { Array, Cause, Context, Effect, Path, Schema, Scope } from "effect";
+import { Contract_exports, UndeclaredFailure } from "./Contract.js";
+import { AuthenticationFailed, AuthenticatorUnavailable, CredentialsError, LocalTerminationTimeout, MissingInstance, ProcessExited, RemoteEntryError, RemoteError, RemoteWithdrawn, TransportError } from "./Errors.js";
+import { CapabilityFailed } from "./internal/assembly.js";
+import { invocation } from "./internal/credentials.js";
+import { host, launch } from "./internal/entry.js";
+import { Host } from "./Config.js";
+import { publicError } from "./internal/execution.js";
+import { follow } from "./internal/follow.js";
+import { Instance } from "./Instance.js";
+import { RemoteTerminationUnconfirmed } from "./internal/runner/model.js";
+import { Array, Cause, Effect, Path, Schema } from "effect";
 import { SecureRandom } from "effect/crypto";
 import { ChildProcessSpawner } from "effect/process";
-// packages/remote/src/internal/credentials.ts
-const provider = (source, encode) => {
-	const input = Effect.isEffect(source) ? {
-		inject: [],
-		read: source
-	} : source;
-	return make({
-		name: "remote-effect-credentials",
-		inject: input.inject,
-		apply: Effect.fnUntraced(function* () {
-			const context = yield* Effect.context().pipe(Effect.map(Context.omit(Scope.Scope)));
-			const read = input.read.pipe(Effect.provideContext(context), Effect.mapError((error) => CredentialsError.make({ cause: Cause.fail(error) })));
-			yield* provide(Credentials, encode(read));
-		})
-	});
-};
-const invocation = (connect) => {
-	const auth = connect.auth;
-	if (auth === void 0) return void 0;
-	if ("mtls" in auth) {
-		const source = auth.mtls;
-		if (Effect.isEffect(source) || "read" in source) return {
-			plugin: provider(source, (read) => ({
-				kind: "Certificate",
-				read: read.pipe(Effect.map((value) => ({
-					_tag: "Certificate",
-					value
-				})))
-			})),
-			config: void 0
-		};
-	}
-	if ("bearer" in auth || "jwt" in auth) {
-		const source = "bearer" in auth ? auth.bearer.token : auth.jwt.token;
-		if (typeof source !== "string" && (Effect.isEffect(source) || "read" in source)) return {
-			plugin: provider(source, (read) => ({
-				kind: "Authorization",
-				read: read.pipe(Effect.flatMap(prepare), Effect.map((value) => ({
-					_tag: "Authorization",
-					value
-				})))
-			})),
-			config: void 0
-		};
-	}
-};
-// packages/remote/src/index.ts
+import { Plugin } from "@graftland/graft";
+import { ModuleResolver } from "@graftland/loader";
+// src/index.ts
 const publicCause = (declared, cause) => Cause.fromReasons(Array.flatMap(cause.reasons, (reason) => {
 	if (reason._tag !== "Fail") return [reason];
 	return Schema.is(CapabilityFailed)(reason.error) ? Array.map(publicCause(declared, reason.error.cause).reasons, (inner) => inner.annotate(Cause.reasonAnnotations(reason))) : [Cause.makeFailReason(publicError(declared, reason.error)).annotate(Cause.reasonAnnotations(reason))];
 }));
-const plugin = (contract, options) => make({
+/** Fixes deployment options; business config is plugin input, and updates restart the execution unit. */
+const plugin = (contract, options) => Plugin.make({
 	name: contract.name,
 	inject: [
-		optional(ModuleResolver),
+		Plugin.optional(ModuleResolver.ModuleResolver),
 		Path.Path,
 		SecureRandom.SecureRandom,
 		ChildProcessSpawner.ChildProcessSpawner
 	],
 	retry: options.retry,
-	apply: Effect.fnUntraced(function* () {
+	config: Schema.toEncoded(contract.config),
+	apply: (config) => Effect.gen(function* () {
+		const auth = invocation(options.connect);
 		const input = yield* Schema.decodeUnknownEffect(Host)({
 			contract: options.contractModule,
-			connect: options.connect,
-			config: options.config === void 0 ? {} : options.config
+			connect: auth === void 0 ? options.connect : {
+				...options.connect,
+				auth: { name: "effect-credentials" }
+			},
+			config
 		});
 		yield* Schema.decodeEffect(contract.config)(input.config);
 		const child = yield* launch(contract, input, {
 			contractModule: options.contractModule,
 			shutdownTimeout: options.shutdownTimeout
-		}, invocation(options.connect));
+		}, auth);
 		yield* follow(child, (cause) => Effect.failCause(publicCause(contract.error, cause)));
-	}, Effect.mapError((error) => publicError(contract.error, error)))
+	}).pipe(Effect.mapError((error) => publicError(contract.error, error)))
 });
-export { Contract_exports as Contract, Instance, MissingInstance, RemoteError, RemoteTerminationUnconfirmed, RemoteWithdrawn, UndeclaredFailure, host as default, plugin };
+export { AuthenticationFailed, AuthenticatorUnavailable, Contract_exports as Contract, CredentialsError, Instance, LocalTerminationTimeout, MissingInstance, ProcessExited, RemoteEntryError, RemoteError, RemoteTerminationUnconfirmed, RemoteWithdrawn, TransportError, UndeclaredFailure, host as default, plugin };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["Configuration.Host","Credential.invocation"],"sources":["../src/index.ts"],"sourcesContent":["import { Plugin } from \"@graftland/graft\"\nimport { ModuleResolver } from \"@graftland/loader\"\nimport { Array, Cause, Effect, Path, Schema } from \"effect\"\nimport type { Duration, Schedule } from \"effect\"\nimport { SecureRandom } from \"effect/crypto\"\nimport { ChildProcessSpawner } from \"effect/process\"\nimport { launch } from \"./internal/entry\"\nimport { follow } from \"./internal/follow\"\nimport { CapabilityFailed } from \"./internal/assembly\"\nimport { publicError } from \"./internal/execution\"\nimport * as Configuration from \"./internal/entryConfig\"\nimport * as Credential from \"./internal/credentials\"\nimport { RemoteWithdrawn, RemoteError, MissingInstance } from \"./Errors\"\nimport * as Contract from \"./Contract\"\nexport { Contract }\nexport { Instance } from \"./Instance\"\nexport { RemoteTerminationUnconfirmed } from \"./internal/runner/model\"\nexport { RemoteError, RemoteWithdrawn, MissingInstance } from \"./Errors\"\nexport { UndeclaredFailure } from \"./Contract\"\nexport type {\n\tConnect,\n\tAuthentication,\n\tToken as CredentialToken,\n\tSource as CredentialSource,\n} from \"./internal/credentials\"\n\nexport interface Options<\n\tD extends ReadonlyArray<Plugin.Dependency> = readonly [],\n> {\n\treadonly connect: Credential.Connect<D>\n\t/** Contract module resolved independently in each execution environment. */\n\treadonly contractModule: string\n\treadonly config?: Schema.Json\n\treadonly retry?: Schedule.Schedule<unknown, unknown> | undefined\n\treadonly shutdownTimeout?: Duration.Input | undefined\n}\nconst publicCause = <E extends Schema.Top>(\n\tdeclared: E,\n\tcause: Cause.Cause<unknown>,\n): Cause.Cause<\n\t| E[\"Type\"]\n\t| Contract.UndeclaredFailure\n\t| RemoteWithdrawn\n\t| RemoteError\n\t| MissingInstance\n> =>\n\tCause.fromReasons(\n\t\tArray.flatMap(cause.reasons, (reason) => {\n\t\t\tif (reason._tag !== \"Fail\") return [reason]\n\t\t\treturn Schema.is(CapabilityFailed)(reason.error)\n\t\t\t\t? Array.map(\n\t\t\t\t\t\tpublicCause(declared, reason.error.cause).reasons,\n\t\t\t\t\t\t(inner) => inner.annotate(Cause.reasonAnnotations(reason)),\n\t\t\t\t\t)\n\t\t\t\t: [\n\t\t\t\t\t\tCause.makeFailReason(publicError(declared, reason.error)).annotate(\n\t\t\t\t\t\t\tCause.reasonAnnotations(reason),\n\t\t\t\t\t\t),\n\t\t\t\t\t]\n\t\t}),\n\t)\n\nexport const plugin = <\n\tS extends Schema.Top & {\n\t\treadonly Encoded: Schema.Json\n\t\treadonly DecodingServices: never\n\t\treadonly EncodingServices: never\n\t},\n\tE extends Schema.Top & {\n\t\treadonly DecodingServices: never\n\t\treadonly EncodingServices: never\n\t},\n\tconst D extends ReadonlyArray<Plugin.Dependency> = readonly [],\n>(\n\tcontract: Contract.Contract<S, E>,\n\toptions: Options<D> & { readonly config?: S[\"Encoded\"] },\n): Plugin.Plugin<\n\tvoid,\n\tvoid,\n\t| E[\"Type\"]\n\t| Contract.UndeclaredFailure\n\t| RemoteError\n\t| RemoteWithdrawn\n\t| MissingInstance\n> =>\n\tPlugin.make({\n\t\tname: contract.name,\n\t\tinject: [\n\t\t\tPlugin.optional(ModuleResolver.ModuleResolver),\n\t\t\tPath.Path,\n\t\t\tSecureRandom.SecureRandom,\n\t\t\tChildProcessSpawner.ChildProcessSpawner,\n\t\t],\n\t\tretry: options.retry,\n\t\tapply: Effect.fnUntraced(\n\t\t\tfunction* () {\n\t\t\t\tconst input = yield* Schema.decodeUnknownEffect(Configuration.Host)({\n\t\t\t\t\tcontract: options.contractModule,\n\t\t\t\t\tconnect: options.connect,\n\t\t\t\t\tconfig: options.config === undefined ? {} : options.config,\n\t\t\t\t})\n\t\t\t\tyield* Schema.decodeEffect(contract.config)(input.config)\n\t\t\t\tconst child = yield* launch(\n\t\t\t\t\tcontract,\n\t\t\t\t\tinput,\n\t\t\t\t\t{\n\t\t\t\t\t\tcontractModule: options.contractModule,\n\t\t\t\t\t\tshutdownTimeout: options.shutdownTimeout,\n\t\t\t\t\t},\n\t\t\t\t\tCredential.invocation(options.connect),\n\t\t\t\t)\n\t\t\t\tyield* follow(child, (cause) =>\n\t\t\t\t\tEffect.failCause(publicCause(contract.error, cause)),\n\t\t\t\t)\n\t\t\t},\n\t\t\tEffect.mapError((error) => publicError(contract.error, error)),\n\t\t),\n\t})\nexport { host as default } from \"./internal/entry\"\n"],"mappings":";;;;;;;;;;;;;;;;AAoCA,MAAM,eACL,UACA,UAQA,MAAM,YACL,MAAM,QAAQ,MAAM,UAAU,WAAW;CACxC,IAAI,OAAO,SAAS,QAAQ,OAAO,CAAC,MAAM;CAC1C,OAAO,OAAO,GAAG,gBAAgB,CAAC,CAAC,OAAO,KAAK,IAC5C,MAAM,IACN,YAAY,UAAU,OAAO,MAAM,KAAK,CAAC,CAAC,UACzC,UAAU,MAAM,SAAS,MAAM,kBAAkB,MAAM,CAAC,CAC1D,IACC,CACA,MAAM,eAAe,YAAY,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,SACzD,MAAM,kBAAkB,MAAM,CAC/B,CACD;AACH,CAAC,CACF;AAED,MAAa,UAYZ,UACA,YAUA,OAAO,KAAK;CACX,MAAM,SAAS;CACf,QAAQ;EACP,OAAO,SAAS,eAAe,cAAc;EAC7C,KAAK;EACL,aAAa;EACb,oBAAoB;CACrB;CACA,OAAO,QAAQ;CACf,OAAO,OAAO,WACb,aAAa;EACZ,MAAM,QAAQ,OAAO,OAAO,oBAAoBA,IAAkB,CAAC,CAAC;GACnE,UAAU,QAAQ;GAClB,SAAS,QAAQ;GACjB,QAAQ,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,QAAQ;EACrD,CAAC;EACD,OAAO,OAAO,aAAa,SAAS,MAAM,CAAC,CAAC,MAAM,MAAM;EACxD,MAAM,QAAQ,OAAO,OACpB,UACA,OACA;GACC,gBAAgB,QAAQ;GACxB,iBAAiB,QAAQ;EAC1B,GACAC,WAAsB,QAAQ,OAAO,CACtC;EACA,OAAO,OAAO,QAAQ,UACrB,OAAO,UAAU,YAAY,SAAS,OAAO,KAAK,CAAC,CACpD;CACD,GACA,OAAO,UAAU,UAAU,YAAY,SAAS,OAAO,KAAK,CAAC,CAC9D;AACD,CAAC"}
+{"version":3,"file":"index.js","names":["Credential.invocation","Configuration.Host"],"sources":["../src/index.ts"],"sourcesContent":["import {\n\tArray,\n\tCause,\n\tEffect,\n\tPath,\n\tSchema,\n\ttype Duration,\n\ttype Schedule,\n} from \"effect\"\nimport { SecureRandom } from \"effect/crypto\"\nimport { ChildProcessSpawner } from \"effect/process\"\n\nimport { Plugin } from \"@graftland/graft\"\nimport { ModuleResolver } from \"@graftland/loader\"\n\nimport * as Contract from \"./Contract\"\nimport { MissingInstance, RemoteError, RemoteWithdrawn } from \"./Errors\"\nimport { CapabilityFailed } from \"./internal/assembly\"\nimport * as Credential from \"./internal/credentials\"\nimport { launch } from \"./internal/entry\"\nimport * as Configuration from \"./internal/entryConfig\"\nimport { publicError } from \"./internal/execution\"\nimport { follow } from \"./internal/follow\"\n\nexport { Contract }\nexport { Instance } from \"./Instance\"\nexport { RemoteTerminationUnconfirmed } from \"./internal/runner/model\"\nexport * from \"./Errors\"\nexport { UndeclaredFailure } from \"./Contract\"\nexport type {\n\tConnect,\n\tAuthentication,\n\tToken as CredentialToken,\n\tSource as CredentialSource,\n} from \"./internal/credentials\"\n\nexport interface Options<\n\tD extends ReadonlyArray<Plugin.Dependency> = readonly [],\n> {\n\treadonly connect: Credential.Connect<D>\n\t/** Contract module resolved independently in each execution environment. */\n\treadonly contractModule: string\n\treadonly retry?: Schedule.Schedule<unknown, unknown> | undefined\n\treadonly shutdownTimeout?: Duration.Input | undefined\n}\nconst publicCause = <E extends Schema.Top>(\n\tdeclared: E,\n\tcause: Cause.Cause<unknown>,\n): Cause.Cause<\n\t| E[\"Type\"]\n\t| Contract.UndeclaredFailure\n\t| RemoteWithdrawn\n\t| RemoteError\n\t| MissingInstance\n> =>\n\tCause.fromReasons(\n\t\tArray.flatMap(cause.reasons, (reason) => {\n\t\t\tif (reason._tag !== \"Fail\") return [reason]\n\t\t\treturn Schema.is(CapabilityFailed)(reason.error)\n\t\t\t\t? Array.map(\n\t\t\t\t\t\tpublicCause(declared, reason.error.cause).reasons,\n\t\t\t\t\t\t(inner) => inner.annotate(Cause.reasonAnnotations(reason)),\n\t\t\t\t\t)\n\t\t\t\t: [\n\t\t\t\t\t\tCause.makeFailReason(publicError(declared, reason.error)).annotate(\n\t\t\t\t\t\t\tCause.reasonAnnotations(reason),\n\t\t\t\t\t\t),\n\t\t\t\t\t]\n\t\t}),\n\t)\n\n/** Fixes deployment options; business config is plugin input, and updates restart the execution unit. */\nexport const plugin = <\n\tS extends Schema.Top & {\n\t\treadonly Encoded: Schema.Json\n\t\treadonly DecodingServices: never\n\t\treadonly EncodingServices: never\n\t},\n\tE extends Schema.Top & {\n\t\treadonly DecodingServices: never\n\t\treadonly EncodingServices: never\n\t},\n\tconst D extends ReadonlyArray<Plugin.Dependency> = readonly [],\n>(\n\tcontract: Contract.Contract<S, E>,\n\toptions: Options<D>,\n): Plugin.Plugin<\n\tS[\"Encoded\"],\n\tS[\"Encoded\"],\n\t| E[\"Type\"]\n\t| Contract.UndeclaredFailure\n\t| RemoteError\n\t| RemoteWithdrawn\n\t| MissingInstance\n> =>\n\tPlugin.make({\n\t\tname: contract.name,\n\t\tinject: [\n\t\t\tPlugin.optional(ModuleResolver.ModuleResolver),\n\t\t\tPath.Path,\n\t\t\tSecureRandom.SecureRandom,\n\t\t\tChildProcessSpawner.ChildProcessSpawner,\n\t\t],\n\t\tretry: options.retry,\n\t\tconfig: Schema.toEncoded(contract.config),\n\t\tapply: (config) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst auth = Credential.invocation(options.connect)\n\t\t\t\tconst input = yield* Schema.decodeUnknownEffect(Configuration.Host)({\n\t\t\t\t\tcontract: options.contractModule,\n\t\t\t\t\tconnect:\n\t\t\t\t\t\tauth === undefined\n\t\t\t\t\t\t\t? options.connect\n\t\t\t\t\t\t\t: { ...options.connect, auth: { name: \"effect-credentials\" } },\n\t\t\t\t\tconfig,\n\t\t\t\t})\n\t\t\t\tyield* Schema.decodeEffect(contract.config)(input.config)\n\t\t\t\tconst child = yield* launch(\n\t\t\t\t\tcontract,\n\t\t\t\t\tinput,\n\t\t\t\t\t{\n\t\t\t\t\t\tcontractModule: options.contractModule,\n\t\t\t\t\t\tshutdownTimeout: options.shutdownTimeout,\n\t\t\t\t\t},\n\t\t\t\t\tauth,\n\t\t\t\t)\n\t\t\t\tyield* follow(child, (cause) =>\n\t\t\t\t\tEffect.failCause(publicCause(contract.error, cause)),\n\t\t\t\t)\n\t\t\t}).pipe(Effect.mapError((error) => publicError(contract.error, error))),\n\t})\nexport { host as default } from \"./internal/entry\"\n"],"mappings":";;;;;;;;;;;;;;;;AA6CA,MAAM,eACL,UACA,UAQA,MAAM,YACL,MAAM,QAAQ,MAAM,UAAU,WAAW;CACxC,IAAI,OAAO,SAAS,QAAQ,OAAO,CAAC,MAAM;CAC1C,OAAO,OAAO,GAAG,gBAAgB,CAAC,CAAC,OAAO,KAAK,IAC5C,MAAM,IACN,YAAY,UAAU,OAAO,MAAM,KAAK,CAAC,CAAC,UACzC,UAAU,MAAM,SAAS,MAAM,kBAAkB,MAAM,CAAC,CAC1D,IACC,CACA,MAAM,eAAe,YAAY,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,SACzD,MAAM,kBAAkB,MAAM,CAC/B,CACD;AACH,CAAC,CACF;;AAGD,MAAa,UAYZ,UACA,YAUA,OAAO,KAAK;CACX,MAAM,SAAS;CACf,QAAQ;EACP,OAAO,SAAS,eAAe,cAAc;EAC7C,KAAK;EACL,aAAa;EACb,oBAAoB;CACrB;CACA,OAAO,QAAQ;CACf,QAAQ,OAAO,UAAU,SAAS,MAAM;CACxC,QAAQ,WACP,OAAO,IAAI,aAAa;EACvB,MAAM,OAAOA,WAAsB,QAAQ,OAAO;EAClD,MAAM,QAAQ,OAAO,OAAO,oBAAoBC,IAAkB,CAAC,CAAC;GACnE,UAAU,QAAQ;GAClB,SACC,SAAS,KAAA,IACN,QAAQ,UACR;IAAE,GAAG,QAAQ;IAAS,MAAM,EAAE,MAAM,qBAAqB;GAAE;GAC/D;EACD,CAAC;EACD,OAAO,OAAO,aAAa,SAAS,MAAM,CAAC,CAAC,MAAM,MAAM;EACxD,MAAM,QAAQ,OAAO,OACpB,UACA,OACA;GACC,gBAAgB,QAAQ;GACxB,iBAAiB,QAAQ;EAC1B,GACA,IACD;EACA,OAAO,OAAO,QAAQ,UACrB,OAAO,UAAU,YAAY,SAAS,OAAO,KAAK,CAAC,CACpD;CACD,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,UAAU,YAAY,SAAS,OAAO,KAAK,CAAC,CAAC;AACxE,CAAC"}

package/dist/internal/Certificates.js.map

@@ -1 +1 @@
-{"version":3,"file":"Certificates.js","names":[],"sources":["../../src/internal/Certificates.ts"],"sourcesContent":["import {\n\tArray,\n\tDateTime,\n\tEffect,\n\tFileSystem,\n\tPath,\n\tRedacted,\n\tResult,\n\tSchema,\n\tString,\n} from \"effect\"\nimport { SecureRandom, WebCrypto } from \"effect/crypto\"\nimport { Base64 } from \"effect/encoding\"\nimport { NetAddress } from \"effect/net\"\nimport * as asn1js from \"asn1js\"\nimport * as pki from \"pkijs\"\n\nexport class CertificateError extends Schema.TaggedError<\n\tCertificateError,\n\t{ readonly brand: unique symbol }\n>()(\"CertificateError\", {\n\tdetail: Schema.String,\n\tcause: Schema.optional(Schema.Defect()),\n}) {\n\toverride get message() {\n\t\treturn this.detail\n\t}\n}\n\n/** A requested output already exists and replacing it was not asked for. */\nexport class CertificateExists extends Schema.TaggedError<\n\tCertificateExists,\n\t{ readonly brand: unique symbol }\n>()(\"CertificateExists\", { file: Schema.String }) {\n\toverride get message() {\n\t\treturn `${this.file} already exists; use --force to replace the requested certificates`\n\t}\n}\n\n/** Only PEM leaves this boundary; PKI.js objects stay local to each operation. */\nexport interface Pem {\n\treadonly certificate: string\n\treadonly privateKey: Redacted.Redacted<string>\n}\nexport interface IssueOptions {\n\treadonly name: string\n\treadonly days: number\n\treadonly usage: \"ca\" | \"server\" | \"client\"\n\treadonly hosts?: ReadonlyArray<string>\n\treadonly identities?: ReadonlyArray<string>\n\treadonly issuer?: Pem\n}\nconst pem = (label: string, bytes: ArrayBuffer) =>\n\t`-----BEGIN ${label}-----\\n${String.replace(/.{64}(?=.)/g, \"$&\\n\")(Base64.encode(new Uint8Array(bytes)))}\\n-----END ${label}-----\\n`\n// WebCrypto and PKI.js take ArrayBuffer-backed bytes, so the decoded view is copied into one.\nconst der = (value: string) =>\n\tEffect.fromResult(\n\t\tBase64.decode(String.replace(/-----[^-]+-----|\\s/g, \"\")(value)),\n\t).pipe(Effect.map((bytes) => new Uint8Array(bytes)))\nconst subject = (name: string) =>\n\tnew pki.RelativeDistinguishedNames({\n\t\ttypesAndValues: [\n\t\t\tnew pki.AttributeTypeAndValue({\n\t\t\t\ttype: \"2.5.4.3\",\n\t\t\t\tvalue: new asn1js.Utf8String({ value: name }),\n\t\t\t}),\n\t\t],\n\t})\nconst hostName = (host: string) =>\n\tResult.match(NetAddress.ipFromString(host), {\n\t\tonFailure: () => new pki.GeneralName({ type: 2, value: host }),\n\t\tonSuccess: (ip) =>\n\t\t\tnew pki.GeneralName({\n\t\t\t\ttype: 7,\n\t\t\t\tvalue: new asn1js.OctetString({\n\t\t\t\t\tvalueHex: new Uint8Array(\n\t\t\t\t\t\tip._tag === \"Ipv4Address\"\n\t\t\t\t\t\t\t? NetAddress.ipv4ToOctets(ip)\n\t\t\t\t\t\t\t: NetAddress.ipv6ToOctets(ip),\n\t\t\t\t\t),\n\t\t\t\t}),\n\t\t\t}),\n\t})\n\nexport const issue = Effect.fn(\"Certificates.issue\")(function* (\n\toptions: IssueOptions,\n) {\n\tconst random = yield* SecureRandom.SecureRandom\n\tconst serial = yield* random.randomBytes(19)\n\tconst now = yield* DateTime.now\n\tconst webcrypto = yield* WebCrypto.WebCrypto\n\tconst engine = new pki.CryptoEngine({\n\t\tname: \"Node WebCrypto\",\n\t\tcrypto: webcrypto,\n\t})\n\tconst failure = (cause: unknown) =>\n\t\tCertificateError.make({\n\t\t\tdetail: `Could not issue the certificate for ${options.name}`,\n\t\t\tcause,\n\t\t})\n\tconst keys = yield* Effect.tryPromise({\n\t\ttry: () =>\n\t\t\twebcrypto.subtle.generateKey(\n\t\t\t\t{ name: \"ECDSA\", namedCurve: \"P-256\" },\n\t\t\t\ttrue,\n\t\t\t\t[\"sign\", \"verify\"],\n\t\t\t),\n\t\tcatch: failure,\n\t})\n\t// Reused CA keys have the same P-256 / PKCS#8 format as the ones this command creates.\n\tconst authority =\n\t\toptions.issuer === undefined\n\t\t\t? undefined\n\t\t\t: {\n\t\t\t\t\tcertificate: yield* Effect.mapError(\n\t\t\t\t\t\tder(options.issuer.certificate),\n\t\t\t\t\t\tfailure,\n\t\t\t\t\t),\n\t\t\t\t\tprivateKey: yield* Effect.mapError(\n\t\t\t\t\t\tder(Redacted.value(options.issuer.privateKey)),\n\t\t\t\t\t\tfailure,\n\t\t\t\t\t),\n\t\t\t\t}\n\tconst signingKey =\n\t\tauthority === undefined\n\t\t\t? keys.privateKey\n\t\t\t: yield* Effect.tryPromise({\n\t\t\t\t\ttry: () =>\n\t\t\t\t\t\twebcrypto.subtle.importKey(\n\t\t\t\t\t\t\t\"pkcs8\",\n\t\t\t\t\t\t\tauthority.privateKey,\n\t\t\t\t\t\t\t{ name: \"ECDSA\", namedCurve: \"P-256\" },\n\t\t\t\t\t\t\tfalse,\n\t\t\t\t\t\t\t[\"sign\"],\n\t\t\t\t\t\t),\n\t\t\t\t\tcatch: failure,\n\t\t\t\t})\n\tconst certificate = yield* Effect.try({\n\t\ttry: () => {\n\t\t\tconst issuer =\n\t\t\t\tauthority === undefined\n\t\t\t\t\t? undefined\n\t\t\t\t\t: pki.Certificate.fromBER(authority.certificate)\n\t\t\tconst names = [\n\t\t\t\t...Array.map(options.hosts ?? [], hostName),\n\t\t\t\t...Array.map(\n\t\t\t\t\toptions.identities ?? [],\n\t\t\t\t\t(identity) =>\n\t\t\t\t\t\tnew pki.GeneralName({ type: 6, value: `graft://${identity}` }),\n\t\t\t\t),\n\t\t\t]\n\t\t\treturn new pki.Certificate({\n\t\t\t\tversion: 2,\n\t\t\t\t// A leading nonzero byte keeps the serial positive without losing random bits.\n\t\t\t\tserialNumber: new asn1js.Integer({\n\t\t\t\t\tvalueHex: new Uint8Array([1, ...serial]),\n\t\t\t\t}),\n\t\t\t\tsubject: subject(options.name),\n\t\t\t\tissuer: issuer?.subject ?? subject(options.name),\n\t\t\t\tnotBefore: new pki.Time({ value: DateTime.toDateUtc(now) }),\n\t\t\t\tnotAfter: new pki.Time({\n\t\t\t\t\tvalue: DateTime.toDateUtc(DateTime.add(now, { days: options.days })),\n\t\t\t\t}),\n\t\t\t\textensions: [\n\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\textnID: \"2.5.29.19\",\n\t\t\t\t\t\tcritical: true,\n\t\t\t\t\t\textnValue: new pki.BasicConstraints({ cA: options.usage === \"ca\" })\n\t\t\t\t\t\t\t.toSchema()\n\t\t\t\t\t\t\t.toBER(),\n\t\t\t\t\t}),\n\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\textnID: \"2.5.29.15\",\n\t\t\t\t\t\tcritical: true,\n\t\t\t\t\t\textnValue: new asn1js.BitString({\n\t\t\t\t\t\t\tvalueHex: new Uint8Array([options.usage === \"ca\" ? 0x06 : 0x80]),\n\t\t\t\t\t\t}).toBER(),\n\t\t\t\t\t}),\n\t\t\t\t\t...(options.usage === \"ca\"\n\t\t\t\t\t\t? []\n\t\t\t\t\t\t: [\n\t\t\t\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\t\t\t\textnID: \"2.5.29.37\",\n\t\t\t\t\t\t\t\t\textnValue: new pki.ExtKeyUsage({\n\t\t\t\t\t\t\t\t\t\tkeyPurposes: [\n\t\t\t\t\t\t\t\t\t\t\toptions.usage === \"server\"\n\t\t\t\t\t\t\t\t\t\t\t\t? \"1.3.6.1.5.5.7.3.1\"\n\t\t\t\t\t\t\t\t\t\t\t\t: \"1.3.6.1.5.5.7.3.2\",\n\t\t\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t\t\t\t.toSchema()\n\t\t\t\t\t\t\t\t\t\t.toBER(),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t]),\n\t\t\t\t\t...(names.length === 0\n\t\t\t\t\t\t? []\n\t\t\t\t\t\t: [\n\t\t\t\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\t\t\t\textnID: \"2.5.29.17\",\n\t\t\t\t\t\t\t\t\textnValue: new pki.AltName({ altNames: names })\n\t\t\t\t\t\t\t\t\t\t.toSchema()\n\t\t\t\t\t\t\t\t\t\t.toBER(),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t]),\n\t\t\t\t],\n\t\t\t})\n\t\t},\n\t\tcatch: failure,\n\t})\n\tyield* Effect.tryPromise({\n\t\ttry: () =>\n\t\t\tcertificate.subjectPublicKeyInfo.importKey(keys.publicKey, engine),\n\t\tcatch: failure,\n\t})\n\tyield* Effect.tryPromise({\n\t\ttry: () => certificate.sign(signingKey, \"SHA-256\", engine),\n\t\tcatch: failure,\n\t})\n\tconst privateKey = yield* Effect.tryPromise({\n\t\ttry: () => webcrypto.subtle.exportKey(\"pkcs8\", keys.privateKey),\n\t\tcatch: failure,\n\t})\n\treturn yield* Effect.try({\n\t\ttry: () => ({\n\t\t\tcertificate: pem(\"CERTIFICATE\", certificate.toSchema().toBER()),\n\t\t\tprivateKey: Redacted.make(pem(\"PRIVATE KEY\", privateKey)),\n\t\t}),\n\t\tcatch: failure,\n\t})\n})\n\nexport const read = Effect.fn(\"Certificates.read\")(function* (base: string) {\n\tconst fs = yield* FileSystem.FileSystem\n\tconst certificate = yield* fs.readFileString(base + \".crt\")\n\tconst privateKey = yield* fs.readFileString(base + \".key\")\n\treturn { certificate, privateKey: Redacted.make(privateKey) }\n})\nexport const write = Effect.fn(\"Certificates.write\")(function* (\n\tbase: string,\n\tpair: Pem,\n\tforce: boolean = false,\n) {\n\tconst fs = yield* FileSystem.FileSystem\n\tyield* fs.writeFileString(base + \".key\", Redacted.value(pair.privateKey), {\n\t\tflag: force ? \"w\" : \"wx\",\n\t\tmode: 0o600,\n\t})\n\t// Opening an existing file does not change its permissions when renewing it.\n\tyield* fs.chmod(base + \".key\", 0o600)\n\tyield* fs.writeFileString(base + \".crt\", pair.certificate, {\n\t\tflag: force ? \"w\" : \"wx\",\n\t})\n\t// One region for the pair: an interruption between the files would leave a key without its certificate.\n}, Effect.uninterruptible)\n\nexport interface Options {\n\treadonly out: string\n\treadonly server: ReadonlyArray<string>\n\treadonly identity: ReadonlyArray<string>\n\treadonly days: number\n\treadonly force: boolean\n}\n/** URI-encode names so each identity has a distinct filename, including names with slashes. */\nexport const clientName = (identity: string) =>\n\t`client-${encodeURIComponent(identity)}`\nexport const generate = Effect.fn(\"Certificates.generate\")(function* (\n\toptions: Options,\n) {\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst outputs = [\n\t\t...(options.server.length === 0 ? [] : [\"server\"]),\n\t\t...Array.map(Array.dedupe(options.identity), clientName),\n\t]\n\tif (!options.force) {\n\t\tconst files = Array.flatMap(outputs, (name) =>\n\t\t\tArray.map([\".crt\", \".key\"], (extension) =>\n\t\t\t\tpath.join(options.out, name + extension),\n\t\t\t),\n\t\t)\n\t\tconst taken = yield* Effect.filter(files, fs.exists)\n\t\tif (Array.isReadonlyArrayNonEmpty(taken))\n\t\t\treturn yield* CertificateExists.make({ file: taken[0] })\n\t}\n\tyield* fs\n\t\t.makeDirectory(options.out, { recursive: true })\n\t\t.pipe(Effect.uninterruptible)\n\tconst ca = path.join(options.out, \"ca\")\n\tconst existing =\n\t\t(yield* fs.exists(ca + \".crt\")) || (yield* fs.exists(ca + \".key\"))\n\t// An incomplete CA pair fails on read. Even --force never replaces the signing authority.\n\tconst issuer = existing\n\t\t? yield* read(ca)\n\t\t: yield* issue({ name: \"Graft CA\", usage: \"ca\", days: options.days }).pipe(\n\t\t\t\tEffect.tap((pair) => write(ca, pair)),\n\t\t\t)\n\tif (options.server.length > 0) {\n\t\tconst pair = yield* issue({\n\t\t\tname: \"Graft runner\",\n\t\t\tusage: \"server\",\n\t\t\thosts: options.server,\n\t\t\tdays: options.days,\n\t\t\tissuer,\n\t\t})\n\t\tyield* write(path.join(options.out, \"server\"), pair, options.force)\n\t}\n\tyield* Effect.forEach(\n\t\tArray.dedupe(options.identity),\n\t\t(identity) =>\n\t\t\tissue({\n\t\t\t\tname: identity,\n\t\t\t\tusage: \"client\",\n\t\t\t\tidentities: [identity],\n\t\t\t\tdays: options.days,\n\t\t\t\tissuer,\n\t\t\t}).pipe(\n\t\t\t\tEffect.flatMap((pair) =>\n\t\t\t\t\twrite(\n\t\t\t\t\t\tpath.join(options.out, clientName(identity)),\n\t\t\t\t\t\tpair,\n\t\t\t\t\t\toptions.force,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t),\n\t\t{ discard: true },\n\t)\n})\n"],"mappings":";;;;;;;AAiBA,IAAa,mBAAb,cAAsC,OAAO,YAG3C,CAAC,CAAC,oBAAoB;CACvB,QAAQ,OAAO;CACf,OAAO,OAAO,SAAS,OAAO,OAAO,CAAC;AACvC,CAAC,CAAC,CAAC;CACF,IAAa,UAAU;EACtB,OAAO,KAAK;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,OAAO,YAG5C,CAAC,CAAC,qBAAqB,EAAE,MAAM,OAAO,OAAO,CAAC,CAAC,CAAC;CACjD,IAAa,UAAU;EACtB,OAAO,GAAG,KAAK,KAAK;CACrB;AACD;AAeA,MAAM,OAAO,OAAe,UAC3B,cAAc,MAAM,SAAS,OAAO,QAAQ,eAAe,MAAM,CAAC,CAAC,OAAO,OAAO,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,aAAa,MAAM;AAE7H,MAAM,OAAO,UACZ,OAAO,WACN,OAAO,OAAO,OAAO,QAAQ,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAC/D,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,IAAI,WAAW,KAAK,CAAC,CAAC;AACpD,MAAM,WAAW,SAChB,IAAI,IAAI,2BAA2B,EAClC,gBAAgB,CACf,IAAI,IAAI,sBAAsB;CAC7B,MAAM;CACN,OAAO,IAAI,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;AAC7C,CAAC,CACF,EACD,CAAC;AACF,MAAM,YAAY,SACjB,OAAO,MAAM,WAAW,aAAa,IAAI,GAAG;CAC3C,iBAAiB,IAAI,IAAI,YAAY;EAAE,MAAM;EAAG,OAAO;CAAK,CAAC;CAC7D,YAAY,OACX,IAAI,IAAI,YAAY;EACnB,MAAM;EACN,OAAO,IAAI,OAAO,YAAY,EAC7B,UAAU,IAAI,WACb,GAAG,SAAS,gBACT,WAAW,aAAa,EAAE,IAC1B,WAAW,aAAa,EAAE,CAC9B,EACD,CAAC;CACF,CAAC;AACH,CAAC;AAEF,MAAa,QAAQ,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACpD,SACC;CAED,MAAM,SAAS,QAAO,OADA,aAAa,aAAA,CACN,YAAY,EAAE;CAC3C,MAAM,MAAM,OAAO,SAAS;CAC5B,MAAM,YAAY,OAAO,UAAU;CACnC,MAAM,SAAS,IAAI,IAAI,aAAa;EACnC,MAAM;EACN,QAAQ;CACT,CAAC;CACD,MAAM,WAAW,UAChB,iBAAiB,KAAK;EACrB,QAAQ,uCAAuC,QAAQ;EACvD;CACD,CAAC;CACF,MAAM,OAAO,OAAO,OAAO,WAAW;EACrC,WACC,UAAU,OAAO,YAChB;GAAE,MAAM;GAAS,YAAY;EAAQ,GACrC,MACA,CAAC,QAAQ,QAAQ,CAClB;EACD,OAAO;CACR,CAAC;CAED,MAAM,YACL,QAAQ,WAAW,KAAA,IAChB,KAAA,IACA;EACA,aAAa,OAAO,OAAO,SAC1B,IAAI,QAAQ,OAAO,WAAW,GAC9B,OACD;EACA,YAAY,OAAO,OAAO,SACzB,IAAI,SAAS,MAAM,QAAQ,OAAO,UAAU,CAAC,GAC7C,OACD;CACD;CACH,MAAM,aACL,cAAc,KAAA,IACX,KAAK,aACL,OAAO,OAAO,WAAW;EACzB,WACC,UAAU,OAAO,UAChB,SACA,UAAU,YACV;GAAE,MAAM;GAAS,YAAY;EAAQ,GACrC,OACA,CAAC,MAAM,CACR;EACD,OAAO;CACR,CAAC;CACJ,MAAM,cAAc,OAAO,OAAO,IAAI;EACrC,WAAW;GACV,MAAM,SACL,cAAc,KAAA,IACX,KAAA,IACA,IAAI,YAAY,QAAQ,UAAU,WAAW;GACjD,MAAM,QAAQ,CACb,GAAG,MAAM,IAAI,QAAQ,SAAS,CAAC,GAAG,QAAQ,GAC1C,GAAG,MAAM,IACR,QAAQ,cAAc,CAAC,IACtB,aACA,IAAI,IAAI,YAAY;IAAE,MAAM;IAAG,OAAO,WAAW;GAAW,CAAC,CAC/D,CACD;GACA,OAAO,IAAI,IAAI,YAAY;IAC1B,SAAS;IAET,cAAc,IAAI,OAAO,QAAQ,EAChC,UAAU,IAAI,WAAW,CAAC,GAAG,GAAG,MAAM,CAAC,EACxC,CAAC;IACD,SAAS,QAAQ,QAAQ,IAAI;IAC7B,QAAQ,QAAQ,WAAW,QAAQ,QAAQ,IAAI;IAC/C,WAAW,IAAI,IAAI,KAAK,EAAE,OAAO,SAAS,UAAU,GAAG,EAAE,CAAC;IAC1D,UAAU,IAAI,IAAI,KAAK,EACtB,OAAO,SAAS,UAAU,SAAS,IAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,CAAC,EACpE,CAAC;IACD,YAAY;KACX,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,UAAU;MACV,WAAW,IAAI,IAAI,iBAAiB,EAAE,IAAI,QAAQ,UAAU,KAAK,CAAC,CAAC,CACjE,SAAS,CAAC,CACV,MAAM;KACT,CAAC;KACD,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,UAAU;MACV,WAAW,IAAI,OAAO,UAAU,EAC/B,UAAU,IAAI,WAAW,CAAC,QAAQ,UAAU,OAAO,IAAO,GAAI,CAAC,EAChE,CAAC,CAAC,CAAC,MAAM;KACV,CAAC;KACD,GAAI,QAAQ,UAAU,OACnB,CAAC,IACD,CACA,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,WAAW,IAAI,IAAI,YAAY,EAC9B,aAAa,CACZ,QAAQ,UAAU,WACf,sBACA,mBACJ,EACD,CAAC,CAAC,CACA,SAAS,CAAC,CACV,MAAM;KACT,CAAC,CACF;KACF,GAAI,MAAM,WAAW,IAClB,CAAC,IACD,CACA,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,WAAW,IAAI,IAAI,QAAQ,EAAE,UAAU,MAAM,CAAC,CAAC,CAC7C,SAAS,CAAC,CACV,MAAM;KACT,CAAC,CACF;IACH;GACD,CAAC;EACF;EACA,OAAO;CACR,CAAC;CACD,OAAO,OAAO,WAAW;EACxB,WACC,YAAY,qBAAqB,UAAU,KAAK,WAAW,MAAM;EAClE,OAAO;CACR,CAAC;CACD,OAAO,OAAO,WAAW;EACxB,WAAW,YAAY,KAAK,YAAY,WAAW,MAAM;EACzD,OAAO;CACR,CAAC;CACD,MAAM,aAAa,OAAO,OAAO,WAAW;EAC3C,WAAW,UAAU,OAAO,UAAU,SAAS,KAAK,UAAU;EAC9D,OAAO;CACR,CAAC;CACD,OAAO,OAAO,OAAO,IAAI;EACxB,YAAY;GACX,aAAa,IAAI,eAAe,YAAY,SAAS,CAAC,CAAC,MAAM,CAAC;GAC9D,YAAY,SAAS,KAAK,IAAI,eAAe,UAAU,CAAC;EACzD;EACA,OAAO;CACR,CAAC;AACF,CAAC;AAED,MAAa,OAAO,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,MAAc;CAC3E,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,cAAc,OAAO,GAAG,eAAe,OAAO,MAAM;CAC1D,MAAM,aAAa,OAAO,GAAG,eAAe,OAAO,MAAM;CACzD,OAAO;EAAE;EAAa,YAAY,SAAS,KAAK,UAAU;CAAE;AAC7D,CAAC;AACD,MAAa,QAAQ,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACpD,MACA,MACA,QAAiB,OAChB;CACD,MAAM,KAAK,OAAO,WAAW;CAC7B,OAAO,GAAG,gBAAgB,OAAO,QAAQ,SAAS,MAAM,KAAK,UAAU,GAAG;EACzE,MAAM,QAAQ,MAAM;EACpB,MAAM;CACP,CAAC;CAED,OAAO,GAAG,MAAM,OAAO,QAAQ,GAAK;CACpC,OAAO,GAAG,gBAAgB,OAAO,QAAQ,KAAK,aAAa,EAC1D,MAAM,QAAQ,MAAM,KACrB,CAAC;AAEF,GAAG,OAAO,eAAe;;AAUzB,MAAa,cAAc,aAC1B,UAAU,mBAAmB,QAAQ;AACtC,MAAa,WAAW,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAC1D,SACC;CACD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,UAAU,CACf,GAAI,QAAQ,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,GAChD,GAAG,MAAM,IAAI,MAAM,OAAO,QAAQ,QAAQ,GAAG,UAAU,CACxD;CACA,IAAI,CAAC,QAAQ,OAAO;EACnB,MAAM,QAAQ,MAAM,QAAQ,UAAU,SACrC,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,cAC5B,KAAK,KAAK,QAAQ,KAAK,OAAO,SAAS,CACxC,CACD;EACA,MAAM,QAAQ,OAAO,OAAO,OAAO,OAAO,GAAG,MAAM;EACnD,IAAI,MAAM,wBAAwB,KAAK,GACtC,OAAO,OAAO,kBAAkB,KAAK,EAAE,MAAM,MAAM,GAAG,CAAC;CACzD;CACA,OAAO,GACL,cAAc,QAAQ,KAAK,EAAE,WAAW,KAAK,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe;CAC7B,MAAM,KAAK,KAAK,KAAK,QAAQ,KAAK,IAAI;CAItC,MAAM,UAFJ,OAAO,GAAG,OAAO,KAAK,MAAM,OAAO,OAAO,GAAG,OAAO,KAAK,MAAM,KAG9D,OAAO,KAAK,EAAE,IACd,OAAO,MAAM;EAAE,MAAM;EAAY,OAAO;EAAM,MAAM,QAAQ;CAAK,CAAC,CAAC,CAAC,KACpE,OAAO,KAAK,SAAS,MAAM,IAAI,IAAI,CAAC,CACrC;CACF,IAAI,QAAQ,OAAO,SAAS,GAAG;EAC9B,MAAM,OAAO,OAAO,MAAM;GACzB,MAAM;GACN,OAAO;GACP,OAAO,QAAQ;GACf,MAAM,QAAQ;GACd;EACD,CAAC;EACD,OAAO,MAAM,KAAK,KAAK,QAAQ,KAAK,QAAQ,GAAG,MAAM,QAAQ,KAAK;CACnE;CACA,OAAO,OAAO,QACb,MAAM,OAAO,QAAQ,QAAQ,IAC5B,aACA,MAAM;EACL,MAAM;EACN,OAAO;EACP,YAAY,CAAC,QAAQ;EACrB,MAAM,QAAQ;EACd;CACD,CAAC,CAAC,CAAC,KACF,OAAO,SAAS,SACf,MACC,KAAK,KAAK,QAAQ,KAAK,WAAW,QAAQ,CAAC,GAC3C,MACA,QAAQ,KACT,CACD,CACD,GACD,EAAE,SAAS,KAAK,CACjB;AACD,CAAC"}
+{"version":3,"file":"Certificates.js","names":[],"sources":["../../src/internal/Certificates.ts"],"sourcesContent":["import {\n\tArray,\n\tDateTime,\n\tEffect,\n\tFileSystem,\n\tPath,\n\tRedacted,\n\tResult,\n\tSchema,\n\tString,\n} from \"effect\"\nimport { SecureRandom, WebCrypto } from \"effect/crypto\"\nimport { Base64 } from \"effect/encoding\"\nimport { NetAddress } from \"effect/net\"\n\nimport * as asn1js from \"asn1js\"\nimport * as pki from \"pkijs\"\n\nexport class CertificateError extends Schema.TaggedError<\n\tCertificateError,\n\t{ readonly brand: unique symbol }\n>()(\"CertificateError\", {\n\tdetail: Schema.String,\n\tcause: Schema.optional(Schema.Defect()),\n}) {\n\toverride get message() {\n\t\treturn this.detail\n\t}\n}\n\n/** A requested output already exists and replacing it was not asked for. */\nexport class CertificateExists extends Schema.TaggedError<\n\tCertificateExists,\n\t{ readonly brand: unique symbol }\n>()(\"CertificateExists\", { file: Schema.String }) {\n\toverride get message() {\n\t\treturn `${this.file} already exists; use --force to replace the requested certificates`\n\t}\n}\n\n/** Only PEM leaves this boundary; PKI.js objects stay local to each operation. */\nexport interface Pem {\n\treadonly certificate: string\n\treadonly privateKey: Redacted.Redacted<string>\n}\nexport interface IssueOptions {\n\treadonly name: string\n\treadonly days: number\n\treadonly usage: \"ca\" | \"server\" | \"client\"\n\treadonly hosts?: ReadonlyArray<string>\n\treadonly identities?: ReadonlyArray<string>\n\treadonly issuer?: Pem\n}\nconst pem = (label: string, bytes: ArrayBuffer) =>\n\t`-----BEGIN ${label}-----\\n${String.replace(/.{64}(?=.)/g, \"$&\\n\")(Base64.encode(new Uint8Array(bytes)))}\\n-----END ${label}-----\\n`\n// WebCrypto and PKI.js take ArrayBuffer-backed bytes, so the decoded view is copied into one.\nconst der = (value: string) =>\n\tEffect.fromResult(\n\t\tBase64.decode(String.replace(/-----[^-]+-----|\\s/g, \"\")(value)),\n\t).pipe(Effect.map((bytes) => new Uint8Array(bytes)))\nconst subject = (name: string) =>\n\tnew pki.RelativeDistinguishedNames({\n\t\ttypesAndValues: [\n\t\t\tnew pki.AttributeTypeAndValue({\n\t\t\t\ttype: \"2.5.4.3\",\n\t\t\t\tvalue: new asn1js.Utf8String({ value: name }),\n\t\t\t}),\n\t\t],\n\t})\nconst hostName = (host: string) =>\n\tResult.match(NetAddress.ipFromString(host), {\n\t\tonFailure: () => new pki.GeneralName({ type: 2, value: host }),\n\t\tonSuccess: (ip) =>\n\t\t\tnew pki.GeneralName({\n\t\t\t\ttype: 7,\n\t\t\t\tvalue: new asn1js.OctetString({\n\t\t\t\t\tvalueHex: new Uint8Array(\n\t\t\t\t\t\tip._tag === \"Ipv4Address\"\n\t\t\t\t\t\t\t? NetAddress.ipv4ToOctets(ip)\n\t\t\t\t\t\t\t: NetAddress.ipv6ToOctets(ip),\n\t\t\t\t\t),\n\t\t\t\t}),\n\t\t\t}),\n\t})\n\nexport const issue = Effect.fn(\"Certificates.issue\")(function* (\n\toptions: IssueOptions,\n) {\n\tconst random = yield* SecureRandom.SecureRandom\n\tconst serial = yield* random.randomBytes(19)\n\tconst now = yield* DateTime.now\n\tconst webcrypto = yield* WebCrypto.WebCrypto\n\tconst engine = new pki.CryptoEngine({\n\t\tname: \"Node WebCrypto\",\n\t\tcrypto: webcrypto,\n\t})\n\tconst failure = (cause: unknown) =>\n\t\tCertificateError.make({\n\t\t\tdetail: `Could not issue the certificate for ${options.name}`,\n\t\t\tcause,\n\t\t})\n\tconst keys = yield* Effect.tryPromise({\n\t\ttry: () =>\n\t\t\twebcrypto.subtle.generateKey(\n\t\t\t\t{ name: \"ECDSA\", namedCurve: \"P-256\" },\n\t\t\t\ttrue,\n\t\t\t\t[\"sign\", \"verify\"],\n\t\t\t),\n\t\tcatch: failure,\n\t})\n\t// Reused CA keys have the same P-256 / PKCS#8 format as the ones this command creates.\n\tconst authority =\n\t\toptions.issuer === undefined\n\t\t\t? undefined\n\t\t\t: {\n\t\t\t\t\tcertificate: yield* Effect.mapError(\n\t\t\t\t\t\tder(options.issuer.certificate),\n\t\t\t\t\t\tfailure,\n\t\t\t\t\t),\n\t\t\t\t\tprivateKey: yield* Effect.mapError(\n\t\t\t\t\t\tder(Redacted.value(options.issuer.privateKey)),\n\t\t\t\t\t\tfailure,\n\t\t\t\t\t),\n\t\t\t\t}\n\tconst signingKey =\n\t\tauthority === undefined\n\t\t\t? keys.privateKey\n\t\t\t: yield* Effect.tryPromise({\n\t\t\t\t\ttry: () =>\n\t\t\t\t\t\twebcrypto.subtle.importKey(\n\t\t\t\t\t\t\t\"pkcs8\",\n\t\t\t\t\t\t\tauthority.privateKey,\n\t\t\t\t\t\t\t{ name: \"ECDSA\", namedCurve: \"P-256\" },\n\t\t\t\t\t\t\tfalse,\n\t\t\t\t\t\t\t[\"sign\"],\n\t\t\t\t\t\t),\n\t\t\t\t\tcatch: failure,\n\t\t\t\t})\n\tconst certificate = yield* Effect.try({\n\t\ttry: () => {\n\t\t\tconst issuer =\n\t\t\t\tauthority === undefined\n\t\t\t\t\t? undefined\n\t\t\t\t\t: pki.Certificate.fromBER(authority.certificate)\n\t\t\tconst names = [\n\t\t\t\t...Array.map(options.hosts ?? [], hostName),\n\t\t\t\t...Array.map(\n\t\t\t\t\toptions.identities ?? [],\n\t\t\t\t\t(identity) =>\n\t\t\t\t\t\tnew pki.GeneralName({ type: 6, value: `graft://${identity}` }),\n\t\t\t\t),\n\t\t\t]\n\t\t\treturn new pki.Certificate({\n\t\t\t\tversion: 2,\n\t\t\t\t// A leading nonzero byte keeps the serial positive without losing random bits.\n\t\t\t\tserialNumber: new asn1js.Integer({\n\t\t\t\t\tvalueHex: new Uint8Array([1, ...serial]),\n\t\t\t\t}),\n\t\t\t\tsubject: subject(options.name),\n\t\t\t\tissuer: issuer?.subject ?? subject(options.name),\n\t\t\t\tnotBefore: new pki.Time({ value: DateTime.toDateUtc(now) }),\n\t\t\t\tnotAfter: new pki.Time({\n\t\t\t\t\tvalue: DateTime.toDateUtc(DateTime.add(now, { days: options.days })),\n\t\t\t\t}),\n\t\t\t\textensions: [\n\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\textnID: \"2.5.29.19\",\n\t\t\t\t\t\tcritical: true,\n\t\t\t\t\t\textnValue: new pki.BasicConstraints({ cA: options.usage === \"ca\" })\n\t\t\t\t\t\t\t.toSchema()\n\t\t\t\t\t\t\t.toBER(),\n\t\t\t\t\t}),\n\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\textnID: \"2.5.29.15\",\n\t\t\t\t\t\tcritical: true,\n\t\t\t\t\t\textnValue: new asn1js.BitString({\n\t\t\t\t\t\t\tvalueHex: new Uint8Array([options.usage === \"ca\" ? 0x06 : 0x80]),\n\t\t\t\t\t\t}).toBER(),\n\t\t\t\t\t}),\n\t\t\t\t\t...(options.usage === \"ca\"\n\t\t\t\t\t\t? []\n\t\t\t\t\t\t: [\n\t\t\t\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\t\t\t\textnID: \"2.5.29.37\",\n\t\t\t\t\t\t\t\t\textnValue: new pki.ExtKeyUsage({\n\t\t\t\t\t\t\t\t\t\tkeyPurposes: [\n\t\t\t\t\t\t\t\t\t\t\toptions.usage === \"server\"\n\t\t\t\t\t\t\t\t\t\t\t\t? \"1.3.6.1.5.5.7.3.1\"\n\t\t\t\t\t\t\t\t\t\t\t\t: \"1.3.6.1.5.5.7.3.2\",\n\t\t\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t\t\t\t.toSchema()\n\t\t\t\t\t\t\t\t\t\t.toBER(),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t]),\n\t\t\t\t\t...(names.length === 0\n\t\t\t\t\t\t? []\n\t\t\t\t\t\t: [\n\t\t\t\t\t\t\t\tnew pki.Extension({\n\t\t\t\t\t\t\t\t\textnID: \"2.5.29.17\",\n\t\t\t\t\t\t\t\t\textnValue: new pki.AltName({ altNames: names })\n\t\t\t\t\t\t\t\t\t\t.toSchema()\n\t\t\t\t\t\t\t\t\t\t.toBER(),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t]),\n\t\t\t\t],\n\t\t\t})\n\t\t},\n\t\tcatch: failure,\n\t})\n\tyield* Effect.tryPromise({\n\t\ttry: () =>\n\t\t\tcertificate.subjectPublicKeyInfo.importKey(keys.publicKey, engine),\n\t\tcatch: failure,\n\t})\n\tyield* Effect.tryPromise({\n\t\ttry: () => certificate.sign(signingKey, \"SHA-256\", engine),\n\t\tcatch: failure,\n\t})\n\tconst privateKey = yield* Effect.tryPromise({\n\t\ttry: () => webcrypto.subtle.exportKey(\"pkcs8\", keys.privateKey),\n\t\tcatch: failure,\n\t})\n\treturn yield* Effect.try({\n\t\ttry: () => ({\n\t\t\tcertificate: pem(\"CERTIFICATE\", certificate.toSchema().toBER()),\n\t\t\tprivateKey: Redacted.make(pem(\"PRIVATE KEY\", privateKey)),\n\t\t}),\n\t\tcatch: failure,\n\t})\n})\n\nexport const read = Effect.fn(\"Certificates.read\")(function* (base: string) {\n\tconst fs = yield* FileSystem.FileSystem\n\tconst certificate = yield* fs.readFileString(base + \".crt\")\n\tconst privateKey = yield* fs.readFileString(base + \".key\")\n\treturn { certificate, privateKey: Redacted.make(privateKey) }\n})\nexport const write = Effect.fn(\"Certificates.write\")(function* (\n\tbase: string,\n\tpair: Pem,\n\tforce: boolean = false,\n) {\n\tconst fs = yield* FileSystem.FileSystem\n\tyield* fs.writeFileString(base + \".key\", Redacted.value(pair.privateKey), {\n\t\tflag: force ? \"w\" : \"wx\",\n\t\tmode: 0o600,\n\t})\n\t// Opening an existing file does not change its permissions when renewing it.\n\tyield* fs.chmod(base + \".key\", 0o600)\n\tyield* fs.writeFileString(base + \".crt\", pair.certificate, {\n\t\tflag: force ? \"w\" : \"wx\",\n\t})\n\t// One region for the pair: an interruption between the files would leave a key without its certificate.\n}, Effect.uninterruptible)\n\nexport interface Options {\n\treadonly out: string\n\treadonly server: ReadonlyArray<string>\n\treadonly identity: ReadonlyArray<string>\n\treadonly days: number\n\treadonly force: boolean\n}\n/** URI-encode names so each identity has a distinct filename, including names with slashes. */\nexport const clientName = (identity: string) =>\n\t`client-${encodeURIComponent(identity)}`\nexport const generate = Effect.fn(\"Certificates.generate\")(function* (\n\toptions: Options,\n) {\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst outputs = [\n\t\t...(options.server.length === 0 ? [] : [\"server\"]),\n\t\t...Array.map(Array.dedupe(options.identity), clientName),\n\t]\n\tif (!options.force) {\n\t\tconst files = Array.flatMap(outputs, (name) =>\n\t\t\tArray.map([\".crt\", \".key\"], (extension) =>\n\t\t\t\tpath.join(options.out, name + extension),\n\t\t\t),\n\t\t)\n\t\tconst taken = yield* Effect.filter(files, fs.exists)\n\t\tif (Array.isReadonlyArrayNonEmpty(taken))\n\t\t\treturn yield* CertificateExists.make({ file: taken[0] })\n\t}\n\tyield* fs\n\t\t.makeDirectory(options.out, { recursive: true })\n\t\t.pipe(Effect.uninterruptible)\n\tconst ca = path.join(options.out, \"ca\")\n\tconst existing =\n\t\t(yield* fs.exists(ca + \".crt\")) || (yield* fs.exists(ca + \".key\"))\n\t// An incomplete CA pair fails on read. Even --force never replaces the signing authority.\n\tconst issuer = existing\n\t\t? yield* read(ca)\n\t\t: yield* issue({ name: \"Graft CA\", usage: \"ca\", days: options.days }).pipe(\n\t\t\t\tEffect.tap((pair) => write(ca, pair)),\n\t\t\t)\n\tif (options.server.length > 0) {\n\t\tconst pair = yield* issue({\n\t\t\tname: \"Graft runner\",\n\t\t\tusage: \"server\",\n\t\t\thosts: options.server,\n\t\t\tdays: options.days,\n\t\t\tissuer,\n\t\t})\n\t\tyield* write(path.join(options.out, \"server\"), pair, options.force)\n\t}\n\tyield* Effect.forEach(\n\t\tArray.dedupe(options.identity),\n\t\t(identity) =>\n\t\t\tissue({\n\t\t\t\tname: identity,\n\t\t\t\tusage: \"client\",\n\t\t\t\tidentities: [identity],\n\t\t\t\tdays: options.days,\n\t\t\t\tissuer,\n\t\t\t}).pipe(\n\t\t\t\tEffect.flatMap((pair) =>\n\t\t\t\t\twrite(\n\t\t\t\t\t\tpath.join(options.out, clientName(identity)),\n\t\t\t\t\t\tpair,\n\t\t\t\t\t\toptions.force,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t),\n\t\t{ discard: true },\n\t)\n})\n"],"mappings":";;;;;;;AAkBA,IAAa,mBAAb,cAAsC,OAAO,YAG3C,CAAC,CAAC,oBAAoB;CACvB,QAAQ,OAAO;CACf,OAAO,OAAO,SAAS,OAAO,OAAO,CAAC;AACvC,CAAC,CAAC,CAAC;CACF,IAAa,UAAU;EACtB,OAAO,KAAK;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,OAAO,YAG5C,CAAC,CAAC,qBAAqB,EAAE,MAAM,OAAO,OAAO,CAAC,CAAC,CAAC;CACjD,IAAa,UAAU;EACtB,OAAO,GAAG,KAAK,KAAK;CACrB;AACD;AAeA,MAAM,OAAO,OAAe,UAC3B,cAAc,MAAM,SAAS,OAAO,QAAQ,eAAe,MAAM,CAAC,CAAC,OAAO,OAAO,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,aAAa,MAAM;AAE7H,MAAM,OAAO,UACZ,OAAO,WACN,OAAO,OAAO,OAAO,QAAQ,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAC/D,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,IAAI,WAAW,KAAK,CAAC,CAAC;AACpD,MAAM,WAAW,SAChB,IAAI,IAAI,2BAA2B,EAClC,gBAAgB,CACf,IAAI,IAAI,sBAAsB;CAC7B,MAAM;CACN,OAAO,IAAI,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;AAC7C,CAAC,CACF,EACD,CAAC;AACF,MAAM,YAAY,SACjB,OAAO,MAAM,WAAW,aAAa,IAAI,GAAG;CAC3C,iBAAiB,IAAI,IAAI,YAAY;EAAE,MAAM;EAAG,OAAO;CAAK,CAAC;CAC7D,YAAY,OACX,IAAI,IAAI,YAAY;EACnB,MAAM;EACN,OAAO,IAAI,OAAO,YAAY,EAC7B,UAAU,IAAI,WACb,GAAG,SAAS,gBACT,WAAW,aAAa,EAAE,IAC1B,WAAW,aAAa,EAAE,CAC9B,EACD,CAAC;CACF,CAAC;AACH,CAAC;AAEF,MAAa,QAAQ,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACpD,SACC;CAED,MAAM,SAAS,QAAO,OADA,aAAa,aAAA,CACN,YAAY,EAAE;CAC3C,MAAM,MAAM,OAAO,SAAS;CAC5B,MAAM,YAAY,OAAO,UAAU;CACnC,MAAM,SAAS,IAAI,IAAI,aAAa;EACnC,MAAM;EACN,QAAQ;CACT,CAAC;CACD,MAAM,WAAW,UAChB,iBAAiB,KAAK;EACrB,QAAQ,uCAAuC,QAAQ;EACvD;CACD,CAAC;CACF,MAAM,OAAO,OAAO,OAAO,WAAW;EACrC,WACC,UAAU,OAAO,YAChB;GAAE,MAAM;GAAS,YAAY;EAAQ,GACrC,MACA,CAAC,QAAQ,QAAQ,CAClB;EACD,OAAO;CACR,CAAC;CAED,MAAM,YACL,QAAQ,WAAW,KAAA,IAChB,KAAA,IACA;EACA,aAAa,OAAO,OAAO,SAC1B,IAAI,QAAQ,OAAO,WAAW,GAC9B,OACD;EACA,YAAY,OAAO,OAAO,SACzB,IAAI,SAAS,MAAM,QAAQ,OAAO,UAAU,CAAC,GAC7C,OACD;CACD;CACH,MAAM,aACL,cAAc,KAAA,IACX,KAAK,aACL,OAAO,OAAO,WAAW;EACzB,WACC,UAAU,OAAO,UAChB,SACA,UAAU,YACV;GAAE,MAAM;GAAS,YAAY;EAAQ,GACrC,OACA,CAAC,MAAM,CACR;EACD,OAAO;CACR,CAAC;CACJ,MAAM,cAAc,OAAO,OAAO,IAAI;EACrC,WAAW;GACV,MAAM,SACL,cAAc,KAAA,IACX,KAAA,IACA,IAAI,YAAY,QAAQ,UAAU,WAAW;GACjD,MAAM,QAAQ,CACb,GAAG,MAAM,IAAI,QAAQ,SAAS,CAAC,GAAG,QAAQ,GAC1C,GAAG,MAAM,IACR,QAAQ,cAAc,CAAC,IACtB,aACA,IAAI,IAAI,YAAY;IAAE,MAAM;IAAG,OAAO,WAAW;GAAW,CAAC,CAC/D,CACD;GACA,OAAO,IAAI,IAAI,YAAY;IAC1B,SAAS;IAET,cAAc,IAAI,OAAO,QAAQ,EAChC,UAAU,IAAI,WAAW,CAAC,GAAG,GAAG,MAAM,CAAC,EACxC,CAAC;IACD,SAAS,QAAQ,QAAQ,IAAI;IAC7B,QAAQ,QAAQ,WAAW,QAAQ,QAAQ,IAAI;IAC/C,WAAW,IAAI,IAAI,KAAK,EAAE,OAAO,SAAS,UAAU,GAAG,EAAE,CAAC;IAC1D,UAAU,IAAI,IAAI,KAAK,EACtB,OAAO,SAAS,UAAU,SAAS,IAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,CAAC,EACpE,CAAC;IACD,YAAY;KACX,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,UAAU;MACV,WAAW,IAAI,IAAI,iBAAiB,EAAE,IAAI,QAAQ,UAAU,KAAK,CAAC,CAAC,CACjE,SAAS,CAAC,CACV,MAAM;KACT,CAAC;KACD,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,UAAU;MACV,WAAW,IAAI,OAAO,UAAU,EAC/B,UAAU,IAAI,WAAW,CAAC,QAAQ,UAAU,OAAO,IAAO,GAAI,CAAC,EAChE,CAAC,CAAC,CAAC,MAAM;KACV,CAAC;KACD,GAAI,QAAQ,UAAU,OACnB,CAAC,IACD,CACA,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,WAAW,IAAI,IAAI,YAAY,EAC9B,aAAa,CACZ,QAAQ,UAAU,WACf,sBACA,mBACJ,EACD,CAAC,CAAC,CACA,SAAS,CAAC,CACV,MAAM;KACT,CAAC,CACF;KACF,GAAI,MAAM,WAAW,IAClB,CAAC,IACD,CACA,IAAI,IAAI,UAAU;MACjB,QAAQ;MACR,WAAW,IAAI,IAAI,QAAQ,EAAE,UAAU,MAAM,CAAC,CAAC,CAC7C,SAAS,CAAC,CACV,MAAM;KACT,CAAC,CACF;IACH;GACD,CAAC;EACF;EACA,OAAO;CACR,CAAC;CACD,OAAO,OAAO,WAAW;EACxB,WACC,YAAY,qBAAqB,UAAU,KAAK,WAAW,MAAM;EAClE,OAAO;CACR,CAAC;CACD,OAAO,OAAO,WAAW;EACxB,WAAW,YAAY,KAAK,YAAY,WAAW,MAAM;EACzD,OAAO;CACR,CAAC;CACD,MAAM,aAAa,OAAO,OAAO,WAAW;EAC3C,WAAW,UAAU,OAAO,UAAU,SAAS,KAAK,UAAU;EAC9D,OAAO;CACR,CAAC;CACD,OAAO,OAAO,OAAO,IAAI;EACxB,YAAY;GACX,aAAa,IAAI,eAAe,YAAY,SAAS,CAAC,CAAC,MAAM,CAAC;GAC9D,YAAY,SAAS,KAAK,IAAI,eAAe,UAAU,CAAC;EACzD;EACA,OAAO;CACR,CAAC;AACF,CAAC;AAED,MAAa,OAAO,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,MAAc;CAC3E,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,cAAc,OAAO,GAAG,eAAe,OAAO,MAAM;CAC1D,MAAM,aAAa,OAAO,GAAG,eAAe,OAAO,MAAM;CACzD,OAAO;EAAE;EAAa,YAAY,SAAS,KAAK,UAAU;CAAE;AAC7D,CAAC;AACD,MAAa,QAAQ,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACpD,MACA,MACA,QAAiB,OAChB;CACD,MAAM,KAAK,OAAO,WAAW;CAC7B,OAAO,GAAG,gBAAgB,OAAO,QAAQ,SAAS,MAAM,KAAK,UAAU,GAAG;EACzE,MAAM,QAAQ,MAAM;EACpB,MAAM;CACP,CAAC;CAED,OAAO,GAAG,MAAM,OAAO,QAAQ,GAAK;CACpC,OAAO,GAAG,gBAAgB,OAAO,QAAQ,KAAK,aAAa,EAC1D,MAAM,QAAQ,MAAM,KACrB,CAAC;AAEF,GAAG,OAAO,eAAe;;AAUzB,MAAa,cAAc,aAC1B,UAAU,mBAAmB,QAAQ;AACtC,MAAa,WAAW,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAC1D,SACC;CACD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,UAAU,CACf,GAAI,QAAQ,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,GAChD,GAAG,MAAM,IAAI,MAAM,OAAO,QAAQ,QAAQ,GAAG,UAAU,CACxD;CACA,IAAI,CAAC,QAAQ,OAAO;EACnB,MAAM,QAAQ,MAAM,QAAQ,UAAU,SACrC,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,cAC5B,KAAK,KAAK,QAAQ,KAAK,OAAO,SAAS,CACxC,CACD;EACA,MAAM,QAAQ,OAAO,OAAO,OAAO,OAAO,GAAG,MAAM;EACnD,IAAI,MAAM,wBAAwB,KAAK,GACtC,OAAO,OAAO,kBAAkB,KAAK,EAAE,MAAM,MAAM,GAAG,CAAC;CACzD;CACA,OAAO,GACL,cAAc,QAAQ,KAAK,EAAE,WAAW,KAAK,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe;CAC7B,MAAM,KAAK,KAAK,KAAK,QAAQ,KAAK,IAAI;CAItC,MAAM,UAFJ,OAAO,GAAG,OAAO,KAAK,MAAM,OAAO,OAAO,GAAG,OAAO,KAAK,MAAM,KAG9D,OAAO,KAAK,EAAE,IACd,OAAO,MAAM;EAAE,MAAM;EAAY,OAAO;EAAM,MAAM,QAAQ;CAAK,CAAC,CAAC,CAAC,KACpE,OAAO,KAAK,SAAS,MAAM,IAAI,IAAI,CAAC,CACrC;CACF,IAAI,QAAQ,OAAO,SAAS,GAAG;EAC9B,MAAM,OAAO,OAAO,MAAM;GACzB,MAAM;GACN,OAAO;GACP,OAAO,QAAQ;GACf,MAAM,QAAQ;GACd;EACD,CAAC;EACD,OAAO,MAAM,KAAK,KAAK,QAAQ,KAAK,QAAQ,GAAG,MAAM,QAAQ,KAAK;CACnE;CACA,OAAO,OAAO,QACb,MAAM,OAAO,QAAQ,QAAQ,IAC5B,aACA,MAAM;EACL,MAAM;EACN,OAAO;EACP,YAAY,CAAC,QAAQ;EACrB,MAAM,QAAQ;EACd;CACD,CAAC,CAAC,CAAC,KACF,OAAO,SAAS,SACf,MACC,KAAK,KAAK,QAAQ,KAAK,WAAW,QAAQ,CAAC,GAC3C,MACA,QAAQ,KACT,CACD,CACD,GACD,EAAE,SAAS,KAAK,CACjB;AACD,CAAC"}

package/dist/internal/FailureGroup.js

@@ -1,6 +1,6 @@
-import { ReleaseInterrupted, close } from "./release.js";
 import { cleanupCause } from "./cleanup.js";
 import { Array, Cause, Data, Deferred, Effect, Exit, Fiber, FiberSet, Ref, Schema, Scope, TxRef } from "effect";
+import * as Release from "@graftland/graft/Release";
 // src/internal/FailureGroup.ts
 const State = Data.taggedEnum();
 /** One owner for first failure, transaction wakeups, and interruption of sibling work. */
@@ -18,12 +18,12 @@ const make = Effect.fnUntraced(function* () {
 		const waiting = yield* Effect.exit(restore(Fiber.await(worker)));
 		if (Exit.isFailure(waiting)) yield* Fiber.interrupt(worker);
 		const body = yield* Fiber.await(worker);
-		const closed = yield* Effect.exit(close(scope, body));
+		const closed = yield* Effect.exit(Release.close(scope, body));
 		const expected = Exit.isFailure(waiting) && Exit.isFailure(body) && Array.every(body.cause.reasons, (reason) => reason._tag === "Interrupt" && reason.fiberId === ownerId);
 		const bodyCause = Exit.isFailure(body) && !expected ? body.cause : Cause.empty;
 		const releaseCause = Exit.isFailure(closed) && !Cause.hasInterruptsOnly(closed.cause) ? closed.cause : Cause.empty;
 		const failure = Cause.combine(bodyCause, releaseCause);
-		const closing = Cause.combine(Cause.hasInterrupts(bodyCause) || Array.some(bodyCause.reasons, (reason) => reason._tag === "Die" && Schema.is(ReleaseInterrupted)(reason.defect)) ? bodyCause : Cause.empty, releaseCause);
+		const closing = Cause.combine(Cause.hasInterrupts(bodyCause) || Array.some(bodyCause.reasons, (reason) => reason._tag === "Die" && Schema.is(Release.ReleaseInterrupted)(reason.defect)) ? bodyCause : Cause.empty, releaseCause);
 		yield* Ref.update(cleanup, (cause) => Cause.combine(cause, closing));
 		if (failure.reasons.length > 0) {
 			yield* Ref.update(failures, (cause) => Cause.combine(cause, failure));
@@ -37,8 +37,8 @@ const make = Effect.fnUntraced(function* () {
 	yield* FiberSet.join(fibers).pipe(Effect.catchCause((cause) => publish(cause).pipe(Effect.andThen(FiberSet.clear(fibers)), Effect.uninterruptible)), Effect.forkScoped);
 	const failure = Effect.tx(check.pipe(Effect.andThen(Effect.txRetry)));
 	const failCause = (cause) => FiberSet.run(fibers, observe(Effect.failCause(cause))).pipe(Effect.asVoid);
-	const close$1 = TxRef.update(state, (s) => s._tag === "Open" ? State.Closed() : s).pipe(Effect.andThen(FiberSet.clear(fibers)), Effect.andThen(Ref.get(cleanup)), Effect.flatMap((cause) => cause.reasons.length > 0 ? Effect.failCause(cause) : Effect.void), Effect.uninterruptible);
-	yield* Effect.addFinalizer(() => close$1.pipe(Effect.catchCause((cause) => Effect.failCause(cleanupCause(cause)))));
+	const close = TxRef.update(state, (s) => s._tag === "Open" ? State.Closed() : s).pipe(Effect.andThen(FiberSet.clear(fibers)), Effect.andThen(Ref.get(cleanup)), Effect.flatMap((cause) => cause.reasons.length > 0 ? Effect.failCause(cause) : Effect.void), Effect.uninterruptible);
+	yield* Effect.addFinalizer(() => close.pipe(Effect.catchCause((cause) => Effect.failCause(cleanupCause(cause)))));
 	return {
 		await: failure,
 		check,
@@ -48,7 +48,7 @@ const make = Effect.fnUntraced(function* () {
 		fail: (error) => failCause(Cause.fail(error)),
 		failCause,
 		race: (effect) => check.pipe(Effect.andThen(Effect.raceFirst(effect, failure))),
-		close: close$1
+		close
 	};
 });
 export { make };

package/dist/internal/FailureGroup.js.map

@@ -1 +1 @@
-{"version":3,"file":"FailureGroup.js","names":["Release.close","Release.ReleaseInterrupted","close"],"sources":["../../src/internal/FailureGroup.ts"],"sourcesContent":["import {\n\tArray,\n\tCause,\n\tFiber,\n\tData,\n\tDeferred,\n\tEffect,\n\tExit,\n\tFiberSet,\n\tRef,\n\tScope,\n\tSchema,\n\tTxRef,\n} from \"effect\"\nimport * as Release from \"./release\"\nimport { cleanupCause } from \"./cleanup\"\n\ntype State<E> = Data.TaggedEnum<{\n\tOpen: {}\n\tFailed: { readonly cause: Cause.Cause<E> }\n\tClosed: {}\n}>\ninterface StateDefinition extends Data.TaggedEnum.WithGenerics<1> {\n\treadonly taggedEnum: State<this[\"A\"]>\n}\nconst State = Data.taggedEnum<StateDefinition>()\nexport interface FailureGroup<E> {\n\treadonly await: Effect.Effect<never, E>\n\treadonly check: Effect.Effect<void, E>\n\treadonly cause: Effect.Effect<Cause.Cause<E>>\n\treadonly run: <A, R>(\n\t\teffect: Effect.Effect<A, E, R>,\n\t) => Effect.Effect<Fiber.Fiber<A, E>, never, R>\n\treadonly fail: (error: E) => Effect.Effect<void>\n\treadonly failCause: (cause: Cause.Cause<E>) => Effect.Effect<void>\n\treadonly race: <A, E2, R>(\n\t\teffect: Effect.Effect<A, E2, R>,\n\t) => Effect.Effect<A, E | E2, R>\n\treadonly runtime: <R>() => Effect.Effect<\n\t\t(effect: Effect.Effect<unknown, E, R>) => Fiber.Fiber<unknown, E>,\n\t\tnever,\n\t\tR\n\t>\n\treadonly close: Effect.Effect<void, E>\n}\n\n/** One owner for first failure, transaction wakeups, and interruption of sibling work. */\nexport const make = Effect.fnUntraced(function* <E>(): Effect.fn.Return<\n\tFailureGroup<E>,\n\tnever,\n\tScope.Scope\n> {\n\tconst fibers = yield* FiberSet.make<unknown, E>()\n\tconst state = yield* TxRef.make<State<E>>(State.Open())\n\tconst failures = yield* Ref.make<Cause.Cause<E>>(Cause.empty)\n\tconst cleanup = yield* Ref.make<Cause.Cause<E>>(Cause.empty)\n\tconst check = TxRef.get(state).pipe(\n\t\tEffect.flatMap((s) =>\n\t\t\ts._tag === \"Failed\"\n\t\t\t\t? Effect.failCause(s.cause)\n\t\t\t\t: s._tag === \"Closed\"\n\t\t\t\t\t? Effect.interrupt\n\t\t\t\t\t: Effect.void,\n\t\t),\n\t)\n\tconst publish = (cause: Cause.Cause<E>) =>\n\t\tTxRef.update(state, (s): State<E> =>\n\t\t\ts._tag === \"Open\" ? State.Failed({ cause }) : s,\n\t\t)\n\n\tconst observe = <A, R>(effect: Effect.Effect<A, E, R>) =>\n\t\tEffect.uninterruptibleMask((restore) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst scope = yield* Scope.make()\n\t\t\t\t// The owned child makes cancellation explicit, even when a stream closes an internal scope.\n\t\t\t\tconst ownerId = yield* Effect.withFiber((self) =>\n\t\t\t\t\tEffect.succeed(self.id),\n\t\t\t\t)\n\t\t\t\tconst worker = yield* Effect.forkIn(\n\t\t\t\t\trestore(Scope.provide(scope)(effect)),\n\t\t\t\t\tscope,\n\t\t\t\t)\n\t\t\t\tconst waiting = yield* Effect.exit(restore(Fiber.await(worker)))\n\t\t\t\tif (Exit.isFailure(waiting)) yield* Fiber.interrupt(worker)\n\t\t\t\tconst body = yield* Fiber.await(worker)\n\t\t\t\tconst closed = yield* Effect.exit(Release.close(scope, body))\n\t\t\t\t// Forwarding this exact cancellation from a finalizer is indistinguishable from acknowledging it.\n\t\t\t\tconst expected =\n\t\t\t\t\tExit.isFailure(waiting) &&\n\t\t\t\t\tExit.isFailure(body) &&\n\t\t\t\t\tArray.every(\n\t\t\t\t\t\tbody.cause.reasons,\n\t\t\t\t\t\t(reason) =>\n\t\t\t\t\t\t\treason._tag === \"Interrupt\" && reason.fiberId === ownerId,\n\t\t\t\t\t)\n\t\t\t\tconst bodyCause =\n\t\t\t\t\tExit.isFailure(body) && !expected ? body.cause : Cause.empty\n\t\t\t\t// Release.close marks independent interruptions; an unmarked one is pending cancellation.\n\t\t\t\tconst releaseCause =\n\t\t\t\t\tExit.isFailure(closed) && !Cause.hasInterruptsOnly(closed.cause)\n\t\t\t\t\t\t? closed.cause\n\t\t\t\t\t\t: Cause.empty\n\t\t\t\tconst failure = Cause.combine(bodyCause, releaseCause)\n\t\t\t\t// Body cleanup may carry either an interruption or a release defect from an inner group.\n\t\t\t\tconst closing = Cause.combine(\n\t\t\t\t\tCause.hasInterrupts(bodyCause) ||\n\t\t\t\t\t\tArray.some(\n\t\t\t\t\t\t\tbodyCause.reasons,\n\t\t\t\t\t\t\t(reason) =>\n\t\t\t\t\t\t\t\treason._tag === \"Die\" &&\n\t\t\t\t\t\t\t\tSchema.is(Release.ReleaseInterrupted)(reason.defect),\n\t\t\t\t\t\t)\n\t\t\t\t\t\t? bodyCause\n\t\t\t\t\t\t: Cause.empty,\n\t\t\t\t\treleaseCause,\n\t\t\t\t)\n\t\t\t\tyield* Ref.update(cleanup, (cause) => Cause.combine(cause, closing))\n\t\t\t\tif (failure.reasons.length > 0) {\n\t\t\t\t\tyield* Ref.update(failures, (cause) => Cause.combine(cause, failure))\n\t\t\t\t\tyield* publish(failure)\n\t\t\t\t\tyield* Deferred.failCause(fibers.deferred, failure)\n\t\t\t\t}\n\t\t\t\tif (Exit.isFailure(closed))\n\t\t\t\t\treturn yield* Effect.failCause(\n\t\t\t\t\t\tExit.isFailure(body)\n\t\t\t\t\t\t\t? Cause.combine(body.cause, closed.cause)\n\t\t\t\t\t\t\t: closed.cause,\n\t\t\t\t\t)\n\t\t\t\tif (Exit.isFailure(waiting) && Exit.isSuccess(body))\n\t\t\t\t\treturn yield* Effect.failCause(waiting.cause)\n\t\t\t\treturn yield* body\n\t\t\t}),\n\t\t)\n\tyield* FiberSet.join(fibers).pipe(\n\t\tEffect.catchCause((cause) =>\n\t\t\tpublish(cause).pipe(\n\t\t\t\tEffect.andThen(FiberSet.clear(fibers)),\n\t\t\t\tEffect.uninterruptible,\n\t\t\t),\n\t\t),\n\t\tEffect.forkScoped,\n\t)\n\tconst failure = Effect.tx(check.pipe(Effect.andThen(Effect.txRetry)))\n\tconst failCause = (cause: Cause.Cause<E>) =>\n\t\t// This is an explicit failure report, not cancellation of an owned worker.\n\t\tFiberSet.run(fibers, observe(Effect.failCause(cause))).pipe(Effect.asVoid)\n\tconst close = TxRef.update(state, (s) =>\n\t\ts._tag === \"Open\" ? State.Closed() : s,\n\t).pipe(\n\t\tEffect.andThen(FiberSet.clear(fibers)),\n\t\tEffect.andThen(Ref.get(cleanup)),\n\t\tEffect.flatMap((cause) =>\n\t\t\tcause.reasons.length > 0 ? Effect.failCause(cause) : Effect.void,\n\t\t),\n\t\tEffect.uninterruptible,\n\t)\n\t// Operational failure is delivered by await; release must also deliver sibling cleanup failures.\n\t// Every sibling failure and interruption survives as a defect; orDie would keep only the first failure.\n\tyield* Effect.addFinalizer(() =>\n\t\tclose.pipe(\n\t\t\tEffect.catchCause((cause) => Effect.failCause(cleanupCause(cause))),\n\t\t),\n\t)\n\treturn {\n\t\tawait: failure,\n\t\tcheck,\n\t\tcause: Ref.get(failures),\n\t\truntime: <R>() =>\n\t\t\tFiberSet.runtime(fibers)<R>().pipe(\n\t\t\t\tEffect.map(\n\t\t\t\t\t(run) => (effect: Effect.Effect<unknown, E, R>) =>\n\t\t\t\t\t\trun(check.pipe(Effect.andThen(observe(effect)))),\n\t\t\t\t),\n\t\t\t),\n\t\trun: (effect) =>\n\t\t\tFiberSet.run(fibers, check.pipe(Effect.andThen(observe(effect)))),\n\t\tfail: (error) => failCause(Cause.fail(error)),\n\t\tfailCause,\n\t\trace: (effect) =>\n\t\t\tcheck.pipe(Effect.andThen(Effect.raceFirst(effect, failure))),\n\t\tclose,\n\t}\n})\n"],"mappings":";;;;AAyBA,MAAM,QAAQ,KAAK,WAA4B;;AAsB/C,MAAa,OAAO,OAAO,WAAW,aAIpC;CACD,MAAM,SAAS,OAAO,SAAS,KAAiB;CAChD,MAAM,QAAQ,OAAO,MAAM,KAAe,MAAM,KAAK,CAAC;CACtD,MAAM,WAAW,OAAO,IAAI,KAAqB,MAAM,KAAK;CAC5D,MAAM,UAAU,OAAO,IAAI,KAAqB,MAAM,KAAK;CAC3D,MAAM,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,KAC9B,OAAO,SAAS,MACf,EAAE,SAAS,WACR,OAAO,UAAU,EAAE,KAAK,IACxB,EAAE,SAAS,WACV,OAAO,YACP,OAAO,IACZ,CACD;CACA,MAAM,WAAW,UAChB,MAAM,OAAO,QAAQ,MACpB,EAAE,SAAS,SAAS,MAAM,OAAO,EAAE,MAAM,CAAC,IAAI,CAC/C;CAED,MAAM,WAAiB,WACtB,OAAO,qBAAqB,YAC3B,OAAO,IAAI,aAAa;EACvB,MAAM,QAAQ,OAAO,MAAM,KAAK;EAEhC,MAAM,UAAU,OAAO,OAAO,WAAW,SACxC,OAAO,QAAQ,KAAK,EAAE,CACvB;EACA,MAAM,SAAS,OAAO,OAAO,OAC5B,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,GACpC,KACD;EACA,MAAM,UAAU,OAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,MAAM,CAAC,CAAC;EAC/D,IAAI,KAAK,UAAU,OAAO,GAAG,OAAO,MAAM,UAAU,MAAM;EAC1D,MAAM,OAAO,OAAO,MAAM,MAAM,MAAM;EACtC,MAAM,SAAS,OAAO,OAAO,KAAKA,MAAc,OAAO,IAAI,CAAC;EAE5D,MAAM,WACL,KAAK,UAAU,OAAO,KACtB,KAAK,UAAU,IAAI,KACnB,MAAM,MACL,KAAK,MAAM,UACV,WACA,OAAO,SAAS,eAAe,OAAO,YAAY,OACpD;EACD,MAAM,YACL,KAAK,UAAU,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,MAAM;EAExD,MAAM,eACL,KAAK,UAAU,MAAM,KAAK,CAAC,MAAM,kBAAkB,OAAO,KAAK,IAC5D,OAAO,QACP,MAAM;EACV,MAAM,UAAU,MAAM,QAAQ,WAAW,YAAY;EAErD,MAAM,UAAU,MAAM,QACrB,MAAM,cAAc,SAAS,KAC5B,MAAM,KACL,UAAU,UACT,WACA,OAAO,SAAS,SAChB,OAAO,GAAGC,kBAA0B,CAAC,CAAC,OAAO,MAAM,CACrD,IACE,YACA,MAAM,OACT,YACD;EACA,OAAO,IAAI,OAAO,UAAU,UAAU,MAAM,QAAQ,OAAO,OAAO,CAAC;EACnE,IAAI,QAAQ,QAAQ,SAAS,GAAG;GAC/B,OAAO,IAAI,OAAO,WAAW,UAAU,MAAM,QAAQ,OAAO,OAAO,CAAC;GACpE,OAAO,QAAQ,OAAO;GACtB,OAAO,SAAS,UAAU,OAAO,UAAU,OAAO;EACnD;EACA,IAAI,KAAK,UAAU,MAAM,GACxB,OAAO,OAAO,OAAO,UACpB,KAAK,UAAU,IAAI,IAChB,MAAM,QAAQ,KAAK,OAAO,OAAO,KAAK,IACtC,OAAO,KACX;EACD,IAAI,KAAK,UAAU,OAAO,KAAK,KAAK,UAAU,IAAI,GACjD,OAAO,OAAO,OAAO,UAAU,QAAQ,KAAK;EAC7C,OAAO,OAAO;CACf,CAAC,CACF;CACD,OAAO,SAAS,KAAK,MAAM,CAAC,CAAC,KAC5B,OAAO,YAAY,UAClB,QAAQ,KAAK,CAAC,CAAC,KACd,OAAO,QAAQ,SAAS,MAAM,MAAM,CAAC,GACrC,OAAO,eACR,CACD,GACA,OAAO,UACR;CACA,MAAM,UAAU,OAAO,GAAG,MAAM,KAAK,OAAO,QAAQ,OAAO,OAAO,CAAC,CAAC;CACpE,MAAM,aAAa,UAElB,SAAS,IAAI,QAAQ,QAAQ,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;CAC1E,MAAMC,UAAQ,MAAM,OAAO,QAAQ,MAClC,EAAE,SAAS,SAAS,MAAM,OAAO,IAAI,CACtC,CAAC,CAAC,KACD,OAAO,QAAQ,SAAS,MAAM,MAAM,CAAC,GACrC,OAAO,QAAQ,IAAI,IAAI,OAAO,CAAC,GAC/B,OAAO,SAAS,UACf,MAAM,QAAQ,SAAS,IAAI,OAAO,UAAU,KAAK,IAAI,OAAO,IAC7D,GACA,OAAO,eACR;CAGA,OAAO,OAAO,mBACbA,QAAM,KACL,OAAO,YAAY,UAAU,OAAO,UAAU,aAAa,KAAK,CAAC,CAAC,CACnE,CACD;CACA,OAAO;EACN,OAAO;EACP;EACA,OAAO,IAAI,IAAI,QAAQ;EACvB,eACC,SAAS,QAAQ,MAAM,CAAC,CAAI,CAAC,CAAC,KAC7B,OAAO,KACL,SAAS,WACT,IAAI,MAAM,KAAK,OAAO,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAAC,CACjD,CACD;EACD,MAAM,WACL,SAAS,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAAC;EACjE,OAAO,UAAU,UAAU,MAAM,KAAK,KAAK,CAAC;EAC5C;EACA,OAAO,WACN,MAAM,KAAK,OAAO,QAAQ,OAAO,UAAU,QAAQ,OAAO,CAAC,CAAC;EAC7D,OAAA;CACD;AACD,CAAC"}
+{"version":3,"file":"FailureGroup.js","names":[],"sources":["../../src/internal/FailureGroup.ts"],"sourcesContent":["import {\n\tArray,\n\tCause,\n\tData,\n\tDeferred,\n\tEffect,\n\tExit,\n\tFiber,\n\tFiberSet,\n\tRef,\n\tSchema,\n\tScope,\n\tTxRef,\n} from \"effect\"\n\nimport * as Release from \"@graftland/graft/Release\"\n\nimport { cleanupCause } from \"./cleanup\"\n\ntype State<E> = Data.TaggedEnum<{\n\tOpen: {}\n\tFailed: { readonly cause: Cause.Cause<E> }\n\tClosed: {}\n}>\ninterface StateDefinition extends Data.TaggedEnum.WithGenerics<1> {\n\treadonly taggedEnum: State<this[\"A\"]>\n}\nconst State = Data.taggedEnum<StateDefinition>()\nexport interface FailureGroup<E> {\n\treadonly await: Effect.Effect<never, E>\n\treadonly check: Effect.Effect<void, E>\n\treadonly cause: Effect.Effect<Cause.Cause<E>>\n\treadonly run: <A, R>(\n\t\teffect: Effect.Effect<A, E, R>,\n\t) => Effect.Effect<Fiber.Fiber<A, E>, never, R>\n\treadonly fail: (error: E) => Effect.Effect<void>\n\treadonly failCause: (cause: Cause.Cause<E>) => Effect.Effect<void>\n\treadonly race: <A, E2, R>(\n\t\teffect: Effect.Effect<A, E2, R>,\n\t) => Effect.Effect<A, E | E2, R>\n\treadonly runtime: <R>() => Effect.Effect<\n\t\t(effect: Effect.Effect<unknown, E, R>) => Fiber.Fiber<unknown, E>,\n\t\tnever,\n\t\tR\n\t>\n\treadonly close: Effect.Effect<void, E>\n}\n\n/** One owner for first failure, transaction wakeups, and interruption of sibling work. */\nexport const make = Effect.fnUntraced(function* <E>(): Effect.fn.Return<\n\tFailureGroup<E>,\n\tnever,\n\tScope.Scope\n> {\n\tconst fibers = yield* FiberSet.make<unknown, E>()\n\tconst state = yield* TxRef.make<State<E>>(State.Open())\n\tconst failures = yield* Ref.make<Cause.Cause<E>>(Cause.empty)\n\tconst cleanup = yield* Ref.make<Cause.Cause<E>>(Cause.empty)\n\tconst check = TxRef.get(state).pipe(\n\t\tEffect.flatMap((s) =>\n\t\t\ts._tag === \"Failed\"\n\t\t\t\t? Effect.failCause(s.cause)\n\t\t\t\t: s._tag === \"Closed\"\n\t\t\t\t\t? Effect.interrupt\n\t\t\t\t\t: Effect.void,\n\t\t),\n\t)\n\tconst publish = (cause: Cause.Cause<E>) =>\n\t\tTxRef.update(state, (s): State<E> =>\n\t\t\ts._tag === \"Open\" ? State.Failed({ cause }) : s,\n\t\t)\n\n\tconst observe = <A, R>(effect: Effect.Effect<A, E, R>) =>\n\t\tEffect.uninterruptibleMask((restore) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst scope = yield* Scope.make()\n\t\t\t\t// The owned child makes cancellation explicit, even when a stream closes an internal scope.\n\t\t\t\tconst ownerId = yield* Effect.withFiber((self) =>\n\t\t\t\t\tEffect.succeed(self.id),\n\t\t\t\t)\n\t\t\t\tconst worker = yield* Effect.forkIn(\n\t\t\t\t\trestore(Scope.provide(scope)(effect)),\n\t\t\t\t\tscope,\n\t\t\t\t)\n\t\t\t\tconst waiting = yield* Effect.exit(restore(Fiber.await(worker)))\n\t\t\t\tif (Exit.isFailure(waiting)) yield* Fiber.interrupt(worker)\n\t\t\t\tconst body = yield* Fiber.await(worker)\n\t\t\t\tconst closed = yield* Effect.exit(Release.close(scope, body))\n\t\t\t\t// Forwarding this exact cancellation from a finalizer is indistinguishable from acknowledging it.\n\t\t\t\tconst expected =\n\t\t\t\t\tExit.isFailure(waiting) &&\n\t\t\t\t\tExit.isFailure(body) &&\n\t\t\t\t\tArray.every(\n\t\t\t\t\t\tbody.cause.reasons,\n\t\t\t\t\t\t(reason) =>\n\t\t\t\t\t\t\treason._tag === \"Interrupt\" && reason.fiberId === ownerId,\n\t\t\t\t\t)\n\t\t\t\tconst bodyCause =\n\t\t\t\t\tExit.isFailure(body) && !expected ? body.cause : Cause.empty\n\t\t\t\t// Release.close marks independent interruptions; an unmarked one is pending cancellation.\n\t\t\t\tconst releaseCause =\n\t\t\t\t\tExit.isFailure(closed) && !Cause.hasInterruptsOnly(closed.cause)\n\t\t\t\t\t\t? closed.cause\n\t\t\t\t\t\t: Cause.empty\n\t\t\t\tconst failure = Cause.combine(bodyCause, releaseCause)\n\t\t\t\t// Body cleanup may carry either an interruption or a release defect from an inner group.\n\t\t\t\tconst closing = Cause.combine(\n\t\t\t\t\tCause.hasInterrupts(bodyCause) ||\n\t\t\t\t\t\tArray.some(\n\t\t\t\t\t\t\tbodyCause.reasons,\n\t\t\t\t\t\t\t(reason) =>\n\t\t\t\t\t\t\t\treason._tag === \"Die\" &&\n\t\t\t\t\t\t\t\tSchema.is(Release.ReleaseInterrupted)(reason.defect),\n\t\t\t\t\t\t)\n\t\t\t\t\t\t? bodyCause\n\t\t\t\t\t\t: Cause.empty,\n\t\t\t\t\treleaseCause,\n\t\t\t\t)\n\t\t\t\tyield* Ref.update(cleanup, (cause) => Cause.combine(cause, closing))\n\t\t\t\tif (failure.reasons.length > 0) {\n\t\t\t\t\tyield* Ref.update(failures, (cause) => Cause.combine(cause, failure))\n\t\t\t\t\tyield* publish(failure)\n\t\t\t\t\tyield* Deferred.failCause(fibers.deferred, failure)\n\t\t\t\t}\n\t\t\t\tif (Exit.isFailure(closed))\n\t\t\t\t\treturn yield* Effect.failCause(\n\t\t\t\t\t\tExit.isFailure(body)\n\t\t\t\t\t\t\t? Cause.combine(body.cause, closed.cause)\n\t\t\t\t\t\t\t: closed.cause,\n\t\t\t\t\t)\n\t\t\t\tif (Exit.isFailure(waiting) && Exit.isSuccess(body))\n\t\t\t\t\treturn yield* Effect.failCause(waiting.cause)\n\t\t\t\treturn yield* body\n\t\t\t}),\n\t\t)\n\tyield* FiberSet.join(fibers).pipe(\n\t\tEffect.catchCause((cause) =>\n\t\t\tpublish(cause).pipe(\n\t\t\t\tEffect.andThen(FiberSet.clear(fibers)),\n\t\t\t\tEffect.uninterruptible,\n\t\t\t),\n\t\t),\n\t\tEffect.forkScoped,\n\t)\n\tconst failure = Effect.tx(check.pipe(Effect.andThen(Effect.txRetry)))\n\tconst failCause = (cause: Cause.Cause<E>) =>\n\t\t// This is an explicit failure report, not cancellation of an owned worker.\n\t\tFiberSet.run(fibers, observe(Effect.failCause(cause))).pipe(Effect.asVoid)\n\tconst close = TxRef.update(state, (s) =>\n\t\ts._tag === \"Open\" ? State.Closed() : s,\n\t).pipe(\n\t\tEffect.andThen(FiberSet.clear(fibers)),\n\t\tEffect.andThen(Ref.get(cleanup)),\n\t\tEffect.flatMap((cause) =>\n\t\t\tcause.reasons.length > 0 ? Effect.failCause(cause) : Effect.void,\n\t\t),\n\t\tEffect.uninterruptible,\n\t)\n\t// Operational failure is delivered by await; release must also deliver sibling cleanup failures.\n\t// Every sibling failure and interruption survives as a defect; orDie would keep only the first failure.\n\tyield* Effect.addFinalizer(() =>\n\t\tclose.pipe(\n\t\t\tEffect.catchCause((cause) => Effect.failCause(cleanupCause(cause))),\n\t\t),\n\t)\n\treturn {\n\t\tawait: failure,\n\t\tcheck,\n\t\tcause: Ref.get(failures),\n\t\truntime: <R>() =>\n\t\t\tFiberSet.runtime(fibers)<R>().pipe(\n\t\t\t\tEffect.map(\n\t\t\t\t\t(run) => (effect: Effect.Effect<unknown, E, R>) =>\n\t\t\t\t\t\trun(check.pipe(Effect.andThen(observe(effect)))),\n\t\t\t\t),\n\t\t\t),\n\t\trun: (effect) =>\n\t\t\tFiberSet.run(fibers, check.pipe(Effect.andThen(observe(effect)))),\n\t\tfail: (error) => failCause(Cause.fail(error)),\n\t\tfailCause,\n\t\trace: (effect) =>\n\t\t\tcheck.pipe(Effect.andThen(Effect.raceFirst(effect, failure))),\n\t\tclose,\n\t}\n})\n"],"mappings":";;;;AA2BA,MAAM,QAAQ,KAAK,WAA4B;;AAsB/C,MAAa,OAAO,OAAO,WAAW,aAIpC;CACD,MAAM,SAAS,OAAO,SAAS,KAAiB;CAChD,MAAM,QAAQ,OAAO,MAAM,KAAe,MAAM,KAAK,CAAC;CACtD,MAAM,WAAW,OAAO,IAAI,KAAqB,MAAM,KAAK;CAC5D,MAAM,UAAU,OAAO,IAAI,KAAqB,MAAM,KAAK;CAC3D,MAAM,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,KAC9B,OAAO,SAAS,MACf,EAAE,SAAS,WACR,OAAO,UAAU,EAAE,KAAK,IACxB,EAAE,SAAS,WACV,OAAO,YACP,OAAO,IACZ,CACD;CACA,MAAM,WAAW,UAChB,MAAM,OAAO,QAAQ,MACpB,EAAE,SAAS,SAAS,MAAM,OAAO,EAAE,MAAM,CAAC,IAAI,CAC/C;CAED,MAAM,WAAiB,WACtB,OAAO,qBAAqB,YAC3B,OAAO,IAAI,aAAa;EACvB,MAAM,QAAQ,OAAO,MAAM,KAAK;EAEhC,MAAM,UAAU,OAAO,OAAO,WAAW,SACxC,OAAO,QAAQ,KAAK,EAAE,CACvB;EACA,MAAM,SAAS,OAAO,OAAO,OAC5B,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,GACpC,KACD;EACA,MAAM,UAAU,OAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,MAAM,CAAC,CAAC;EAC/D,IAAI,KAAK,UAAU,OAAO,GAAG,OAAO,MAAM,UAAU,MAAM;EAC1D,MAAM,OAAO,OAAO,MAAM,MAAM,MAAM;EACtC,MAAM,SAAS,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO,IAAI,CAAC;EAE5D,MAAM,WACL,KAAK,UAAU,OAAO,KACtB,KAAK,UAAU,IAAI,KACnB,MAAM,MACL,KAAK,MAAM,UACV,WACA,OAAO,SAAS,eAAe,OAAO,YAAY,OACpD;EACD,MAAM,YACL,KAAK,UAAU,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,MAAM;EAExD,MAAM,eACL,KAAK,UAAU,MAAM,KAAK,CAAC,MAAM,kBAAkB,OAAO,KAAK,IAC5D,OAAO,QACP,MAAM;EACV,MAAM,UAAU,MAAM,QAAQ,WAAW,YAAY;EAErD,MAAM,UAAU,MAAM,QACrB,MAAM,cAAc,SAAS,KAC5B,MAAM,KACL,UAAU,UACT,WACA,OAAO,SAAS,SAChB,OAAO,GAAG,QAAQ,kBAAkB,CAAC,CAAC,OAAO,MAAM,CACrD,IACE,YACA,MAAM,OACT,YACD;EACA,OAAO,IAAI,OAAO,UAAU,UAAU,MAAM,QAAQ,OAAO,OAAO,CAAC;EACnE,IAAI,QAAQ,QAAQ,SAAS,GAAG;GAC/B,OAAO,IAAI,OAAO,WAAW,UAAU,MAAM,QAAQ,OAAO,OAAO,CAAC;GACpE,OAAO,QAAQ,OAAO;GACtB,OAAO,SAAS,UAAU,OAAO,UAAU,OAAO;EACnD;EACA,IAAI,KAAK,UAAU,MAAM,GACxB,OAAO,OAAO,OAAO,UACpB,KAAK,UAAU,IAAI,IAChB,MAAM,QAAQ,KAAK,OAAO,OAAO,KAAK,IACtC,OAAO,KACX;EACD,IAAI,KAAK,UAAU,OAAO,KAAK,KAAK,UAAU,IAAI,GACjD,OAAO,OAAO,OAAO,UAAU,QAAQ,KAAK;EAC7C,OAAO,OAAO;CACf,CAAC,CACF;CACD,OAAO,SAAS,KAAK,MAAM,CAAC,CAAC,KAC5B,OAAO,YAAY,UAClB,QAAQ,KAAK,CAAC,CAAC,KACd,OAAO,QAAQ,SAAS,MAAM,MAAM,CAAC,GACrC,OAAO,eACR,CACD,GACA,OAAO,UACR;CACA,MAAM,UAAU,OAAO,GAAG,MAAM,KAAK,OAAO,QAAQ,OAAO,OAAO,CAAC,CAAC;CACpE,MAAM,aAAa,UAElB,SAAS,IAAI,QAAQ,QAAQ,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;CAC1E,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAClC,EAAE,SAAS,SAAS,MAAM,OAAO,IAAI,CACtC,CAAC,CAAC,KACD,OAAO,QAAQ,SAAS,MAAM,MAAM,CAAC,GACrC,OAAO,QAAQ,IAAI,IAAI,OAAO,CAAC,GAC/B,OAAO,SAAS,UACf,MAAM,QAAQ,SAAS,IAAI,OAAO,UAAU,KAAK,IAAI,OAAO,IAC7D,GACA,OAAO,eACR;CAGA,OAAO,OAAO,mBACb,MAAM,KACL,OAAO,YAAY,UAAU,OAAO,UAAU,aAAa,KAAK,CAAC,CAAC,CACnE,CACD;CACA,OAAO;EACN,OAAO;EACP;EACA,OAAO,IAAI,IAAI,QAAQ;EACvB,eACC,SAAS,QAAQ,MAAM,CAAC,CAAI,CAAC,CAAC,KAC7B,OAAO,KACL,SAAS,WACT,IAAI,MAAM,KAAK,OAAO,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAAC,CACjD,CACD;EACD,MAAM,WACL,SAAS,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAAC;EACjE,OAAO,UAAU,UAAU,MAAM,KAAK,KAAK,CAAC;EAC5C;EACA,OAAO,WACN,MAAM,KAAK,OAAO,QAAQ,OAAO,UAAU,QAAQ,OAAO,CAAC,CAAC;EAC7D;CACD;AACD,CAAC"}

package/dist/internal/Peer.js.map

@@ -1 +1 @@
-{"version":3,"file":"Peer.js","names":[],"sources":["../../src/internal/Peer.ts"],"sourcesContent":["import { Context } from \"effect\"\nexport class Peer extends Context.Service<Peer, string>()(\n\t\"@graftland/plugin-remote/internal/Peer\",\n) {}\n"],"mappings":";;AACA,IAAa,OAAb,cAA0B,QAAQ,QAAsB,CAAC,CACxD,wCACD,CAAC,CAAC,CAAC"}
+{"version":3,"file":"Peer.js","names":[],"sources":["../../src/internal/Peer.ts"],"sourcesContent":["import { Context } from \"effect\"\n\nexport class Peer extends Context.Service<Peer, string>()(\n\t\"@graftland/plugin-remote/internal/Peer\",\n) {}\n"],"mappings":";;AAEA,IAAa,OAAb,cAA0B,QAAQ,QAAsB,CAAC,CACxD,wCACD,CAAC,CAAC,CAAC"}

package/dist/internal/{ServeLifecycle.js → RunnerLifecycle.js}

@@ -1,6 +1,6 @@
-import { close } from "./release.js";
 import { Context, Deferred, Effect, Exit, Option, Schema, Scope } from "effect";
-// src/internal/ServeLifecycle.ts
+import * as Release from "@graftland/graft/Release";
+// src/internal/RunnerLifecycle.ts
 var StartupError = class extends Schema.TaggedError()("RunnerStartupError", {
 	detail: Schema.String,
 	cause: Schema.optionalKey(Schema.Cause(Schema.Unknown, Schema.Defect()))
@@ -9,18 +9,18 @@ var StartupError = class extends Schema.TaggedError()("RunnerStartupError", {
 		return this.detail;
 	}
 };
-var ServeLifecycle = class extends Context.Service()("@graftland/plugin-remote/internal/ServeLifecycle") {};
+var RunnerLifecycle = class extends Context.Service()("@graftland/plugin-remote/internal/RunnerLifecycle") {};
 const make = Effect.all({
 	ended: Deferred.make(),
 	released: Deferred.make()
 });
 /** Observe shutdown independently of the loader, which logs child cleanup failures. */
 const resources = Effect.fnUntraced(function* (lifecycle) {
-	return yield* Effect.acquireRelease(Scope.make(), (scope, exit) => close(scope, exit).pipe(Effect.onExit((released) => Option.isNone(lifecycle) ? Effect.void : Deferred.done(lifecycle.value.released, Exit.isSuccess(released) ? Exit.void : Exit.fail(StartupError.make({
+	return yield* Effect.acquireRelease(Scope.make(), (scope, exit) => Release.close(scope, exit).pipe(Effect.onExit((released) => Option.isNone(lifecycle) ? Effect.void : Deferred.done(lifecycle.value.released, Exit.isSuccess(released) ? Exit.void : Exit.fail(StartupError.make({
 		detail: "Supervisor shutdown failed",
 		cause: released.cause
 	}))).pipe(Effect.asVoid))));
 });
-export { ServeLifecycle, StartupError, make, resources };
+export { RunnerLifecycle, StartupError, make, resources };
 
-//# sourceMappingURL=ServeLifecycle.js.map
+//# sourceMappingURL=RunnerLifecycle.js.map

package/dist/internal/RunnerLifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RunnerLifecycle.js","names":[],"sources":["../../src/internal/RunnerLifecycle.ts"],"sourcesContent":["import { Context, Deferred, Effect, Exit, Option, Schema, Scope } from \"effect\"\n\nimport * as Release from \"@graftland/graft/Release\"\n\nimport type { TransportError } from \"../Errors\"\n\nexport class StartupError extends Schema.TaggedError<\n\tStartupError,\n\t{ readonly brand: unique symbol }\n>()(\"RunnerStartupError\", {\n\tdetail: Schema.String,\n\tcause: Schema.optionalKey(Schema.Cause(Schema.Unknown, Schema.Defect())),\n}) {\n\toverride get message() {\n\t\treturn this.detail\n\t}\n}\n\nexport class RunnerLifecycle extends Context.Service<\n\tRunnerLifecycle,\n\t{\n\t\treadonly ended: Deferred.Deferred<void, TransportError>\n\t\treadonly released: Deferred.Deferred<void, StartupError>\n\t}\n>()(\"@graftland/plugin-remote/internal/RunnerLifecycle\") {}\n\nexport const make = Effect.all({\n\tended: Deferred.make<void, TransportError>(),\n\treleased: Deferred.make<void, StartupError>(),\n})\n\n/** Observe shutdown independently of the loader, which logs child cleanup failures. */\nexport const resources = Effect.fnUntraced(function* (\n\tlifecycle: Option.Option<typeof RunnerLifecycle.Service>,\n) {\n\treturn yield* Effect.acquireRelease(Scope.make(), (scope, exit) =>\n\t\tRelease.close(scope, exit).pipe(\n\t\t\tEffect.onExit((released) =>\n\t\t\t\tOption.isNone(lifecycle)\n\t\t\t\t\t? Effect.void\n\t\t\t\t\t: Deferred.done(\n\t\t\t\t\t\t\tlifecycle.value.released,\n\t\t\t\t\t\t\tExit.isSuccess(released)\n\t\t\t\t\t\t\t\t? Exit.void\n\t\t\t\t\t\t\t\t: Exit.fail(\n\t\t\t\t\t\t\t\t\t\tStartupError.make({\n\t\t\t\t\t\t\t\t\t\t\tdetail: \"Supervisor shutdown failed\",\n\t\t\t\t\t\t\t\t\t\t\tcause: released.cause,\n\t\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t).pipe(Effect.asVoid),\n\t\t\t),\n\t\t),\n\t)\n})\n"],"mappings":";;;AAMA,IAAa,eAAb,cAAkC,OAAO,YAGvC,CAAC,CAAC,sBAAsB;CACzB,QAAQ,OAAO;CACf,OAAO,OAAO,YAAY,OAAO,MAAM,OAAO,SAAS,OAAO,OAAO,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;CACF,IAAa,UAAU;EACtB,OAAO,KAAK;CACb;AACD;AAEA,IAAa,kBAAb,cAAqC,QAAQ,QAM3C,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC;AAE1D,MAAa,OAAO,OAAO,IAAI;CAC9B,OAAO,SAAS,KAA2B;CAC3C,UAAU,SAAS,KAAyB;AAC7C,CAAC;;AAGD,MAAa,YAAY,OAAO,WAAW,WAC1C,WACC;CACD,OAAO,OAAO,OAAO,eAAe,MAAM,KAAK,IAAI,OAAO,SACzD,QAAQ,MAAM,OAAO,IAAI,CAAC,CAAC,KAC1B,OAAO,QAAQ,aACd,OAAO,OAAO,SAAS,IACpB,OAAO,OACP,SAAS,KACT,UAAU,MAAM,UAChB,KAAK,UAAU,QAAQ,IACpB,KAAK,OACL,KAAK,KACL,aAAa,KAAK;EACjB,QAAQ;EACR,OAAO,SAAS;CACjB,CAAC,CACF,CACH,CAAC,CAAC,KAAK,OAAO,MAAM,CACvB,CACD,CACD;AACD,CAAC"}

package/dist/internal/Supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"Supervisor.js","names":[],"sources":["../../src/internal/Supervisor.ts"],"sourcesContent":["/** A listener hands an authenticated byte channel to the supervisor. */\nimport { Context } from \"effect\"\nimport type { Effect, Scope } from \"effect\"\nimport type { Peer } from \"./Peer\"\nimport type { Channel } from \"../Transport\"\nimport type { TransportError } from \"../Errors\"\nexport class Supervisor extends Context.Service<\n\tSupervisor,\n\t{\n\t\treadonly accept: (\n\t\t\tchannel: Channel,\n\t\t) => Effect.Effect<void, TransportError, Peer | Scope.Scope>\n\t}\n>()(\"@graftland/plugin-remote/internal/Supervisor\") {}\n"],"mappings":";;;AAMA,IAAa,aAAb,cAAgC,QAAQ,QAOtC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC"}
+{"version":3,"file":"Supervisor.js","names":[],"sources":["../../src/internal/Supervisor.ts"],"sourcesContent":["/** A listener hands an authenticated byte channel to the supervisor. */\nimport { Context, type Effect, type Scope } from \"effect\"\n\nimport type { TransportError } from \"../Errors\"\nimport type { Channel } from \"../Transport\"\nimport type { Peer } from \"./Peer\"\n\nexport class Supervisor extends Context.Service<\n\tSupervisor,\n\t{\n\t\treadonly accept: (\n\t\t\tchannel: Channel,\n\t\t) => Effect.Effect<void, TransportError, Peer | Scope.Scope>\n\t}\n>()(\"@graftland/plugin-remote/internal/Supervisor\") {}\n"],"mappings":";;;AAOA,IAAa,aAAb,cAAgC,QAAQ,QAOtC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC"}

package/dist/internal/assembly.d.ts

@@ -1,5 +1,6 @@
+import "../index.js";
 import "./port.js";
-import "../Errors.js";
 import "../Auth.js";
 import "../Transport.js";
-import { Effect, Schema } from "effect";
+import { Effect, Schema } from "effect";
+import { Fork, Graft, Plugin } from "@graftland/graft";

package/dist/internal/assembly.js

@@ -1,14 +1,14 @@
-import { findSubtree, isSubtreeActive } from "./forkTree.js";
-import { Peer } from "./Peer.js";
 import { Authenticator, Credentials } from "../Auth.js";
-import { Connector, Listener } from "../Transport.js";
 import { AuthenticationFailed } from "../Errors.js";
-import { Supervisor } from "./Supervisor.js";
+import { Connector, Listener } from "../Transport.js";
 import { follow } from "./follow.js";
+import { findSubtree, isSubtreeActive } from "./forkTree.js";
+import { Peer } from "./Peer.js";
 import { closedNormally, connectionEnded } from "./runner/connectionEnded.js";
-import { ServeLifecycle } from "./ServeLifecycle.js";
-import { Graft, Plugin } from "@graftland/graft";
+import { RunnerLifecycle } from "./RunnerLifecycle.js";
+import { Supervisor } from "./Supervisor.js";
 import { Array, Deferred, Effect, Fiber, Option, Schema, Stream } from "effect";
+import { Graft, Plugin } from "@graftland/graft";
 // src/internal/assembly.ts
 var ListenerConfigError = class extends Schema.TaggedError()("ListenerConfigError", { detail: Schema.String }) {
 	get message() {
@@ -122,13 +122,13 @@ const makeListenerConsumer = (prepare = () => Effect.void, ready = Effect.void)
 		Listener,
 		Authenticator,
 		Supervisor,
-		Plugin.optional(ServeLifecycle)
+		Plugin.optional(RunnerLifecycle)
 	],
 	apply: Effect.fnUntraced(function* () {
 		const listener = yield* Listener;
 		const auth = yield* Authenticator;
 		const supervisor = yield* Supervisor;
-		const lifecycle = yield* Effect.serviceOption(ServeLifecycle);
+		const lifecycle = yield* Effect.serviceOption(RunnerLifecycle);
 		yield* prepare(listener.properties, auth);
 		yield* compatible(listener.properties, kind(auth)).pipe(Effect.mapError((error) => ListenerConfigError.make({ detail: error.detail })));
 		yield* warn(listener.properties, kind(auth), "runner");

package/dist/internal/assembly.js.map

@@ -1 +1 @@
-{"version":3,"file":"assembly.js","names":[],"sources":["../../src/internal/assembly.ts"],"sourcesContent":["import { findSubtree, isSubtreeActive } from \"./forkTree\"\nimport { Peer } from \"./Peer\"\nimport { Graft, Plugin, type Fork } from \"@graftland/graft\"\nimport {\n\tArray,\n\tContext,\n\tDeferred,\n\tEffect,\n\tFiber,\n\tOption,\n\tSchema,\n\tStream,\n} from \"effect\"\nimport {\n\tAuthenticator,\n\tCredentials,\n\ttype AuthenticatorApi,\n\ttype CredentialsApi,\n} from \"../Auth\"\nimport {\n\tConnector,\n\tListener,\n\ttype Accept,\n\ttype Properties,\n\ttype Session,\n} from \"../Transport\"\nimport { AuthenticationFailed } from \"../Errors\"\nimport { Supervisor } from \"./Supervisor\"\nimport { follow } from \"./follow\"\nimport { connectionEnded, closedNormally } from \"./runner/connectionEnded\"\nimport { ServeLifecycle } from \"./ServeLifecycle\"\n\nexport class ListenerConfigError extends Schema.TaggedError<\n\tListenerConfigError,\n\t{ readonly brand: unique symbol }\n>()(\"ListenerConfigError\", { detail: Schema.String }) {\n\toverride get message() {\n\t\treturn this.detail\n\t}\n}\n\nexport class CapabilityContractError extends Schema.TaggedError<\n\tCapabilityContractError,\n\t{ readonly brand: unique symbol }\n>()(\"CapabilityContractError\", { plugin: Schema.String, key: Schema.String }) {\n\toverride get message() {\n\t\treturn `Capability ${this.plugin} became active without providing ${this.key}`\n\t}\n}\nexport class CapabilityCombinationError extends Schema.TaggedError<\n\tCapabilityCombinationError,\n\t{ readonly brand: unique symbol }\n>()(\"CapabilityCombinationError\", { detail: Schema.String }) {\n\toverride get message() {\n\t\treturn this.detail\n\t}\n}\n\nexport class CapabilityFailed extends Schema.TaggedError<\n\tCapabilityFailed,\n\t{ readonly brand: unique symbol }\n>()(\"CapabilityFailed\", {\n\tcause: Schema.Cause(Schema.Unknown, Schema.Unknown),\n}) {}\n\n/** Every failure class assembly raises; host error classification reads this list. */\nexport const errors = [\n\tListenerConfigError,\n\tCapabilityContractError,\n\tCapabilityCombinationError,\n\tCapabilityFailed,\n] as const\n\nconst definition = Schema.declare(Plugin.isPlugin)\n/** Entries resolve capability modules before assembling their private providers. */\nexport const Invocation = Schema.Struct({\n\tplugin: definition,\n\tconfig: Schema.Unknown,\n})\nconst Input = Schema.Struct({\n\ttransport: Invocation,\n\tauth: Invocation,\n\tconsumer: definition,\n\tinput: Schema.optionalKey(Schema.Unknown),\n})\nexport type Input = typeof Input.Type\n\nconst failure = (tree: Fork.ForkTree): Effect.Effect<void, CapabilityFailed> =>\n\ttree.state._tag === \"Failed\"\n\t\t? Effect.fail(CapabilityFailed.make({ cause: tree.state.cause }))\n\t\t: Effect.forEach(tree.children, failure, { discard: true })\n\nconst probe = (name: string, key: Context.Key<unknown, unknown>) =>\n\tPlugin.make({\n\t\tname: \"remote-capability-contract\",\n\t\tinject: [Plugin.optional(key)],\n\t\tapply: Effect.fnUntraced(function* () {\n\t\t\tconst value = yield* Effect.serviceOption(key)\n\t\t\tif (Option.isNone(value))\n\t\t\t\treturn yield* CapabilityContractError.make({\n\t\t\t\t\tplugin: name,\n\t\t\t\t\tkey: key.key,\n\t\t\t\t})\n\t\t}),\n\t})\n\n/** Resolve the key in a fresh consumer after the provider subtree settles.\n * An optional consumer started earlier could still hold a pre-publication snapshot.\n */\nconst watch = (provider: Fork.Fork, key: Context.Key<unknown, unknown>) =>\n\tPlugin.fork(\n\t\tGraft.forks.pipe(\n\t\t\tStream.map((trees) => findSubtree(trees, provider.id)),\n\t\t\tStream.filter(Option.isSome),\n\t\t\tStream.map((tree) => tree.value),\n\t\t\tStream.tap(failure),\n\t\t\tStream.map((tree) => ({\n\t\t\t\tname: tree.name,\n\t\t\t\tactive: isSubtreeActive(tree),\n\t\t\t})),\n\t\t\tStream.changesWith((left, right) => left.active === right.active),\n\t\t\tStream.filter((tree) => tree.active),\n\t\t\tStream.runForEach((tree) =>\n\t\t\t\tEffect.scoped(\n\t\t\t\t\tGraft.plugin(probe(tree.name, key)).pipe(\n\t\t\t\t\t\tEffect.flatMap((fork) => fork.await),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t),\n\t\t),\n\t)\n\nconst assembly = (\n\tkeys: readonly [Context.Key<unknown, unknown>, Context.Key<unknown, unknown>],\n) =>\n\tPlugin.make({\n\t\tname: \"remote-assembly\",\n\t\tconfig: Input,\n\t\tapply: Effect.fnUntraced(function* (input) {\n\t\t\tyield* Effect.forEach(\n\t\t\t\t[\n\t\t\t\t\t{ invocation: input.transport, key: keys[0] },\n\t\t\t\t\t{ invocation: input.auth, key: keys[1] },\n\t\t\t\t],\n\t\t\t\tEffect.fnUntraced(function* ({ invocation, key }) {\n\t\t\t\t\tconst provider = yield* Graft.plugin(\n\t\t\t\t\t\tinvocation.plugin,\n\t\t\t\t\t\tinvocation.config,\n\t\t\t\t\t)\n\t\t\t\t\tyield* watch(provider, key)\n\t\t\t\t}),\n\t\t\t)\n\t\t\tconst consumer = yield* Graft.plugin(input.consumer, input.input)\n\t\t\t// Capability publication can leave a transient Pending snapshot; business dependencies may remain Pending.\n\t\t\tyield* consumer.state.pipe(\n\t\t\t\tStream.filter(\n\t\t\t\t\t(state) =>\n\t\t\t\t\t\tstate._tag !== \"Loading\" &&\n\t\t\t\t\t\t(state._tag !== \"Pending\" ||\n\t\t\t\t\t\t\t!Array.some(keys, (key) =>\n\t\t\t\t\t\t\t\tArray.contains(state.missing, key.key),\n\t\t\t\t\t\t\t)),\n\t\t\t\t),\n\t\t\t\tStream.runHead,\n\t\t\t)\n\t\t\tyield* follow(consumer, (cause) =>\n\t\t\t\tEffect.fail(CapabilityFailed.make({ cause })),\n\t\t\t)\n\t\t}),\n\t})\nconst hostAssembly = assembly([Connector, Credentials])\nconst runnerAssembly = assembly([Listener, Authenticator])\n\nexport const host = (input: Input) =>\n\tGraft.plugin(hostAssembly, input, { isolate: [Connector, Credentials] })\nexport const runner = (\n\tinput: Omit<Input, \"consumer\">,\n\tconsumer = listenerConsumer,\n) =>\n\tGraft.plugin(\n\t\trunnerAssembly,\n\t\t{ ...input, consumer },\n\t\t{ isolate: [Listener, Authenticator] },\n\t)\n\nexport const compatible = (\n\tproperties: Properties,\n\tkind: CredentialsApi[\"kind\"],\n): Effect.Effect<void, CapabilityCombinationError> => {\n\tif (\n\t\tkind === \"Certificate\" &&\n\t\t(properties.protocol !== \"wss\" ||\n\t\t\t!properties.encrypted ||\n\t\t\t!Array.contains(properties.carries, \"certificate\"))\n\t)\n\t\treturn Effect.fail(\n\t\t\tCapabilityCombinationError.make({\n\t\t\t\tdetail: \"Mutual TLS requires encrypted wss with certificate evidence\",\n\t\t\t}),\n\t\t)\n\tif (kind === \"Authorization\" && !Array.contains(properties.carries, \"header\"))\n\t\treturn Effect.fail(\n\t\t\tCapabilityCombinationError.make({\n\t\t\t\tdetail: \"This transport cannot carry Authorization headers\",\n\t\t\t}),\n\t\t)\n\treturn Effect.void\n}\nconst kind = (auth: AuthenticatorApi): CredentialsApi[\"kind\"] =>\n\tauth._tag === \"Mtls\"\n\t\t? \"Certificate\"\n\t\t: auth._tag === \"Header\"\n\t\t\t? \"Authorization\"\n\t\t\t: \"None\"\nconst warn = (\n\tproperties: Properties,\n\tcredentials: CredentialsApi[\"kind\"],\n\tside: \"host\" | \"runner\",\n) =>\n\tEffect.all(\n\t\t[\n\t\t\tproperties.network && !properties.encrypted\n\t\t\t\t? Effect.logWarning(\n\t\t\t\t\t\tcredentials === \"Authorization\"\n\t\t\t\t\t\t\t? `${properties.protocol}:// ${side === \"host\" ? \"connection\" : \"listener\"} is unencrypted; credentials are transmitted in plaintext`\n\t\t\t\t\t\t\t: `${properties.protocol}:// ${side === \"host\" ? \"connection\" : \"listener\"} is unencrypted`,\n\t\t\t\t\t)\n\t\t\t\t: Effect.void,\n\t\t\tside === \"runner\" && properties.network && credentials === \"None\"\n\t\t\t\t? Effect.logWarning(\"WebSocket listener has no authentication\")\n\t\t\t\t: Effect.void,\n\t\t],\n\t\t{ discard: true },\n\t)\n\nexport const directAuth = (properties: Properties, explicit: boolean) =>\n\texplicit &&\n\t(properties.protocol === \"stdio\" || properties.protocol === \"command\")\n\t\t? Effect.fail(\n\t\t\t\tCapabilityCombinationError.make({\n\t\t\t\t\tdetail: `${properties.protocol} transports do not accept auth`,\n\t\t\t\t}),\n\t\t\t)\n\t\t: Effect.void\n\nexport const connectWith = Effect.fnUntraced(function* (\n\texplicitAuth: boolean = false,\n) {\n\tconst connector = yield* Connector\n\tconst credentials = yield* Credentials\n\tyield* directAuth(connector.properties, explicitAuth)\n\tyield* compatible(connector.properties, credentials.kind)\n\tyield* warn(connector.properties, credentials.kind, \"host\")\n\tconst prepared = yield* credentials.read\n\treturn yield* connector.connect(prepared)\n})\n\nexport const accept =\n\t(\n\t\tauth: AuthenticatorApi,\n\t\tproperties: Properties,\n\t\tsession: (identity: string) => Session,\n\t): Accept =>\n\t(handshake) => {\n\t\tconst identity =\n\t\t\tauth._tag === \"Header\"\n\t\t\t\t? auth.authenticate(handshake.authorization)\n\t\t\t\t: auth._tag === \"Mtls\"\n\t\t\t\t\t? Option.match(handshake.certificate, {\n\t\t\t\t\t\t\tonNone: () =>\n\t\t\t\t\t\t\t\tEffect.fail(AuthenticationFailed.make({ reason: \"missing\" })),\n\t\t\t\t\t\t\tonSome: auth.authenticate,\n\t\t\t\t\t\t})\n\t\t\t\t\t: (properties.network\n\t\t\t\t\t\t\t? Effect.logWarning(\"WebSocket connection has no authentication\")\n\t\t\t\t\t\t\t: Effect.void\n\t\t\t\t\t\t).pipe(Effect.as(auth.identity))\n\t\treturn identity.pipe(Effect.map(session))\n\t}\n\nexport const makeListenerConsumer = (\n\tprepare: (\n\t\tproperties: Properties,\n\t\tauth: AuthenticatorApi,\n\t) => Effect.Effect<void, CapabilityCombinationError> = () => Effect.void,\n\tready: Effect.Effect<void> = Effect.void,\n) =>\n\tPlugin.make({\n\t\tname: \"remote-listener-consumer\",\n\t\tinject: [\n\t\t\tListener,\n\t\t\tAuthenticator,\n\t\t\tSupervisor,\n\t\t\tPlugin.optional(ServeLifecycle),\n\t\t],\n\t\tapply: Effect.fnUntraced(function* () {\n\t\t\tconst listener = yield* Listener\n\t\t\tconst auth = yield* Authenticator\n\t\t\tconst supervisor = yield* Supervisor\n\t\t\tconst lifecycle = yield* Effect.serviceOption(ServeLifecycle)\n\t\t\tyield* prepare(listener.properties, auth)\n\t\t\tyield* compatible(listener.properties, kind(auth)).pipe(\n\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\tListenerConfigError.make({ detail: error.detail }),\n\t\t\t\t),\n\t\t\t)\n\t\t\tyield* warn(listener.properties, kind(auth), \"runner\")\n\t\t\tconst serving = yield* listener.bind(\n\t\t\t\tauth._tag === \"Mtls\" ? Option.some(auth.tls) : Option.none(),\n\t\t\t)\n\t\t\tconst running = yield* Plugin.fork(\n\t\t\t\tserving\n\t\t\t\t\t.serve(\n\t\t\t\t\t\taccept(\n\t\t\t\t\t\t\tauth,\n\t\t\t\t\t\t\tlistener.properties,\n\t\t\t\t\t\t\t(identity) => (channel) =>\n\t\t\t\t\t\t\t\tsupervisor.accept(channel).pipe(\n\t\t\t\t\t\t\t\t\tEffect.catchCause((cause) =>\n\t\t\t\t\t\t\t\t\t\tlistener.properties.protocol === \"stdio\"\n\t\t\t\t\t\t\t\t\t\t\t? closedNormally(cause)\n\t\t\t\t\t\t\t\t\t\t\t\t? Effect.void\n\t\t\t\t\t\t\t\t\t\t\t\t: Effect.failCause(cause)\n\t\t\t\t\t\t\t\t\t\t\t: connectionEnded(cause),\n\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t\tEffect.provideService(Peer, identity),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t\t.pipe(\n\t\t\t\t\t\tEffect.onExit((exit) =>\n\t\t\t\t\t\t\tlistener.properties.protocol === \"stdio\" &&\n\t\t\t\t\t\t\tOption.isSome(lifecycle)\n\t\t\t\t\t\t\t\t? Deferred.done(lifecycle.value.ended, exit)\n\t\t\t\t\t\t\t\t: Effect.void,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t)\n\t\t\tyield* serving.ready.pipe(Effect.raceFirst(Fiber.join(running)))\n\t\t\tyield* ready\n\t\t}),\n\t})\n\nexport const listenerConsumer = makeListenerConsumer()\n\nexport const connect = connectWith()\n"],"mappings":";;;;;;;;;;;;AAgCA,IAAa,sBAAb,cAAyC,OAAO,YAG9C,CAAC,CAAC,uBAAuB,EAAE,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CACrD,IAAa,UAAU;EACtB,OAAO,KAAK;CACb;AACD;AAEA,IAAa,0BAAb,cAA6C,OAAO,YAGlD,CAAC,CAAC,2BAA2B;CAAE,QAAQ,OAAO;CAAQ,KAAK,OAAO;AAAO,CAAC,CAAC,CAAC;CAC7E,IAAa,UAAU;EACtB,OAAO,cAAc,KAAK,OAAO,mCAAmC,KAAK;CAC1E;AACD;AACA,IAAa,6BAAb,cAAgD,OAAO,YAGrD,CAAC,CAAC,8BAA8B,EAAE,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CAC5D,IAAa,UAAU;EACtB,OAAO,KAAK;CACb;AACD;AAEA,IAAa,mBAAb,cAAsC,OAAO,YAG3C,CAAC,CAAC,oBAAoB,EACvB,OAAO,OAAO,MAAM,OAAO,SAAS,OAAO,OAAO,EACnD,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,SAAS;CACrB;CACA;CACA;CACA;AACD;AAEA,MAAM,aAAa,OAAO,QAAQ,OAAO,QAAQ;;AAEjD,MAAa,aAAa,OAAO,OAAO;CACvC,QAAQ;CACR,QAAQ,OAAO;AAChB,CAAC;AACD,MAAM,QAAQ,OAAO,OAAO;CAC3B,WAAW;CACX,MAAM;CACN,UAAU;CACV,OAAO,OAAO,YAAY,OAAO,OAAO;AACzC,CAAC;AAGD,MAAM,WAAW,SAChB,KAAK,MAAM,SAAS,WACjB,OAAO,KAAK,iBAAiB,KAAK,EAAE,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,IAC9D,OAAO,QAAQ,KAAK,UAAU,SAAS,EAAE,SAAS,KAAK,CAAC;AAE5D,MAAM,SAAS,MAAc,QAC5B,OAAO,KAAK;CACX,MAAM;CACN,QAAQ,CAAC,OAAO,SAAS,GAAG,CAAC;CAC7B,OAAO,OAAO,WAAW,aAAa;EACrC,MAAM,QAAQ,OAAO,OAAO,cAAc,GAAG;EAC7C,IAAI,OAAO,OAAO,KAAK,GACtB,OAAO,OAAO,wBAAwB,KAAK;GAC1C,QAAQ;GACR,KAAK,IAAI;EACV,CAAC;CACH,CAAC;AACF,CAAC;;;;AAKF,MAAM,SAAS,UAAqB,QACnC,OAAO,KACN,MAAM,MAAM,KACX,OAAO,KAAK,UAAU,YAAY,OAAO,SAAS,EAAE,CAAC,GACrD,OAAO,OAAO,OAAO,MAAM,GAC3B,OAAO,KAAK,SAAS,KAAK,KAAK,GAC/B,OAAO,IAAI,OAAO,GAClB,OAAO,KAAK,UAAU;CACrB,MAAM,KAAK;CACX,QAAQ,gBAAgB,IAAI;AAC7B,EAAE,GACF,OAAO,aAAa,MAAM,UAAU,KAAK,WAAW,MAAM,MAAM,GAChE,OAAO,QAAQ,SAAS,KAAK,MAAM,GACnC,OAAO,YAAY,SAClB,OAAO,OACN,MAAM,OAAO,MAAM,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,KACnC,OAAO,SAAS,SAAS,KAAK,KAAK,CACpC,CACD,CACD,CACD,CACD;AAED,MAAM,YACL,SAEA,OAAO,KAAK;CACX,MAAM;CACN,QAAQ;CACR,OAAO,OAAO,WAAW,WAAW,OAAO;EAC1C,OAAO,OAAO,QACb,CACC;GAAE,YAAY,MAAM;GAAW,KAAK,KAAK;EAAG,GAC5C;GAAE,YAAY,MAAM;GAAM,KAAK,KAAK;EAAG,CACxC,GACA,OAAO,WAAW,WAAW,EAAE,YAAY,OAAO;GACjD,MAAM,WAAW,OAAO,MAAM,OAC7B,WAAW,QACX,WAAW,MACZ;GACA,OAAO,MAAM,UAAU,GAAG;EAC3B,CAAC,CACF;EACA,MAAM,WAAW,OAAO,MAAM,OAAO,MAAM,UAAU,MAAM,KAAK;EAEhE,OAAO,SAAS,MAAM,KACrB,OAAO,QACL,UACA,MAAM,SAAS,cACd,MAAM,SAAS,aACf,CAAC,MAAM,KAAK,OAAO,QAClB,MAAM,SAAS,MAAM,SAAS,IAAI,GAAG,CACtC,EACH,GACA,OAAO,OACR;EACA,OAAO,OAAO,WAAW,UACxB,OAAO,KAAK,iBAAiB,KAAK,EAAE,MAAM,CAAC,CAAC,CAC7C;CACD,CAAC;AACF,CAAC;AACF,MAAM,eAAe,SAAS,CAAC,WAAW,WAAW,CAAC;AACtD,MAAM,iBAAiB,SAAS,CAAC,UAAU,aAAa,CAAC;AAEzD,MAAa,QAAQ,UACpB,MAAM,OAAO,cAAc,OAAO,EAAE,SAAS,CAAC,WAAW,WAAW,EAAE,CAAC;AACxE,MAAa,UACZ,OACA,WAAW,qBAEX,MAAM,OACL,gBACA;CAAE,GAAG;CAAO;AAAS,GACrB,EAAE,SAAS,CAAC,UAAU,aAAa,EAAE,CACtC;AAED,MAAa,cACZ,YACA,SACqD;CACrD,IACC,SAAS,kBACR,WAAW,aAAa,SACxB,CAAC,WAAW,aACZ,CAAC,MAAM,SAAS,WAAW,SAAS,aAAa,IAElD,OAAO,OAAO,KACb,2BAA2B,KAAK,EAC/B,QAAQ,8DACT,CAAC,CACF;CACD,IAAI,SAAS,mBAAmB,CAAC,MAAM,SAAS,WAAW,SAAS,QAAQ,GAC3E,OAAO,OAAO,KACb,2BAA2B,KAAK,EAC/B,QAAQ,oDACT,CAAC,CACF;CACD,OAAO,OAAO;AACf;AACA,MAAM,QAAQ,SACb,KAAK,SAAS,SACX,gBACA,KAAK,SAAS,WACb,kBACA;AACL,MAAM,QACL,YACA,aACA,SAEA,OAAO,IACN,CACC,WAAW,WAAW,CAAC,WAAW,YAC/B,OAAO,WACP,gBAAgB,kBACb,GAAG,WAAW,SAAS,MAAM,SAAS,SAAS,eAAe,WAAW,6DACzE,GAAG,WAAW,SAAS,MAAM,SAAS,SAAS,eAAe,WAAW,gBAC7E,IACC,OAAO,MACV,SAAS,YAAY,WAAW,WAAW,gBAAgB,SACxD,OAAO,WAAW,0CAA0C,IAC5D,OAAO,IACX,GACA,EAAE,SAAS,KAAK,CACjB;AAED,MAAa,cAAc,YAAwB,aAClD,aACC,WAAW,aAAa,WAAW,WAAW,aAAa,aACzD,OAAO,KACP,2BAA2B,KAAK,EAC/B,QAAQ,GAAG,WAAW,SAAS,gCAChC,CAAC,CACF,IACC,OAAO;AAEX,MAAa,cAAc,OAAO,WAAW,WAC5C,eAAwB,OACvB;CACD,MAAM,YAAY,OAAO;CACzB,MAAM,cAAc,OAAO;CAC3B,OAAO,WAAW,UAAU,YAAY,YAAY;CACpD,OAAO,WAAW,UAAU,YAAY,YAAY,IAAI;CACxD,OAAO,KAAK,UAAU,YAAY,YAAY,MAAM,MAAM;CAC1D,MAAM,WAAW,OAAO,YAAY;CACpC,OAAO,OAAO,UAAU,QAAQ,QAAQ;AACzC,CAAC;AAED,MAAa,UAEX,MACA,YACA,aAEA,cAAc;CAcd,QAZC,KAAK,SAAS,WACX,KAAK,aAAa,UAAU,aAAa,IACzC,KAAK,SAAS,SACb,OAAO,MAAM,UAAU,aAAa;EACpC,cACC,OAAO,KAAK,qBAAqB,KAAK,EAAE,QAAQ,UAAU,CAAC,CAAC;EAC7D,QAAQ,KAAK;CACd,CAAC,KACC,WAAW,UACV,OAAO,WAAW,4CAA4C,IAC9D,OAAO,KAAA,CACR,KAAK,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAA,CACnB,KAAK,OAAO,IAAI,OAAO,CAAC;AACzC;AAED,MAAa,wBACZ,gBAG6D,OAAO,MACpE,QAA6B,OAAO,SAEpC,OAAO,KAAK;CACX,MAAM;CACN,QAAQ;EACP;EACA;EACA;EACA,OAAO,SAAS,cAAc;CAC/B;CACA,OAAO,OAAO,WAAW,aAAa;EACrC,MAAM,WAAW,OAAO;EACxB,MAAM,OAAO,OAAO;EACpB,MAAM,aAAa,OAAO;EAC1B,MAAM,YAAY,OAAO,OAAO,cAAc,cAAc;EAC5D,OAAO,QAAQ,SAAS,YAAY,IAAI;EACxC,OAAO,WAAW,SAAS,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,KAClD,OAAO,UAAU,UAChB,oBAAoB,KAAK,EAAE,QAAQ,MAAM,OAAO,CAAC,CAClD,CACD;EACA,OAAO,KAAK,SAAS,YAAY,KAAK,IAAI,GAAG,QAAQ;EACrD,MAAM,UAAU,OAAO,SAAS,KAC/B,KAAK,SAAS,SAAS,OAAO,KAAK,KAAK,GAAG,IAAI,OAAO,KAAK,CAC5D;EACA,MAAM,UAAU,OAAO,OAAO,KAC7B,QACE,MACA,OACC,MACA,SAAS,aACR,cAAc,YACd,WAAW,OAAO,OAAO,CAAC,CAAC,KAC1B,OAAO,YAAY,UAClB,SAAS,WAAW,aAAa,UAC9B,eAAe,KAAK,IACnB,OAAO,OACP,OAAO,UAAU,KAAK,IACvB,gBAAgB,KAAK,CACzB,GACA,OAAO,eAAe,MAAM,QAAQ,CACrC,CACF,CACD,CAAC,CACA,KACA,OAAO,QAAQ,SACd,SAAS,WAAW,aAAa,WACjC,OAAO,OAAO,SAAS,IACpB,SAAS,KAAK,UAAU,MAAM,OAAO,IAAI,IACzC,OAAO,IACX,CACD,CACF;EACA,OAAO,QAAQ,MAAM,KAAK,OAAO,UAAU,MAAM,KAAK,OAAO,CAAC,CAAC;EAC/D,OAAO;CACR,CAAC;AACF,CAAC;AAEF,MAAa,mBAAmB,qBAAqB;AAE9B,YAAY"}
+{"version":3,"file":"assembly.js","names":[],"sources":["../../src/internal/assembly.ts"],"sourcesContent":["import {\n\tArray,\n\tContext,\n\tDeferred,\n\tEffect,\n\tFiber,\n\tOption,\n\tSchema,\n\tStream,\n} from \"effect\"\n\nimport { Graft, Plugin, type Fork } from \"@graftland/graft\"\n\nimport {\n\tAuthenticator,\n\tCredentials,\n\ttype AuthenticatorApi,\n\ttype CredentialsApi,\n} from \"../Auth\"\nimport { AuthenticationFailed } from \"../Errors\"\nimport {\n\tConnector,\n\tListener,\n\ttype Accept,\n\ttype Properties,\n\ttype Session,\n} from \"../Transport\"\nimport { follow } from \"./follow\"\nimport { findSubtree, isSubtreeActive } from \"./forkTree\"\nimport { Peer } from \"./Peer\"\nimport { closedNormally, connectionEnded } from \"./runner/connectionEnded\"\nimport { RunnerLifecycle } from \"./RunnerLifecycle\"\nimport { Supervisor } from \"./Supervisor\"\n\nexport class ListenerConfigError extends Schema.TaggedError<\n\tListenerConfigError,\n\t{ readonly brand: unique symbol }\n>()(\"ListenerConfigError\", { detail: Schema.String }) {\n\toverride get message() {\n\t\treturn this.detail\n\t}\n}\n\nexport class CapabilityContractError extends Schema.TaggedError<\n\tCapabilityContractError,\n\t{ readonly brand: unique symbol }\n>()(\"CapabilityContractError\", { plugin: Schema.String, key: Schema.String }) {\n\toverride get message() {\n\t\treturn `Capability ${this.plugin} became active without providing ${this.key}`\n\t}\n}\nexport class CapabilityCombinationError extends Schema.TaggedError<\n\tCapabilityCombinationError,\n\t{ readonly brand: unique symbol }\n>()(\"CapabilityCombinationError\", { detail: Schema.String }) {\n\toverride get message() {\n\t\treturn this.detail\n\t}\n}\n\nexport class CapabilityFailed extends Schema.TaggedError<\n\tCapabilityFailed,\n\t{ readonly brand: unique symbol }\n>()(\"CapabilityFailed\", {\n\tcause: Schema.Cause(Schema.Unknown, Schema.Unknown),\n}) {}\n\n/** Every failure class assembly raises; host error classification reads this list. */\nexport const errors = [\n\tListenerConfigError,\n\tCapabilityContractError,\n\tCapabilityCombinationError,\n\tCapabilityFailed,\n] as const\n\nconst definition = Schema.declare(Plugin.isPlugin)\n/** Entries resolve capability modules before assembling their private providers. */\nexport const Invocation = Schema.Struct({\n\tplugin: definition,\n\tconfig: Schema.Unknown,\n})\nconst Input = Schema.Struct({\n\ttransport: Invocation,\n\tauth: Invocation,\n\tconsumer: definition,\n\tinput: Schema.optionalKey(Schema.Unknown),\n})\nexport type Input = typeof Input.Type\n\nconst failure = (tree: Fork.ForkTree): Effect.Effect<void, CapabilityFailed> =>\n\ttree.state._tag === \"Failed\"\n\t\t? Effect.fail(CapabilityFailed.make({ cause: tree.state.cause }))\n\t\t: Effect.forEach(tree.children, failure, { discard: true })\n\nconst probe = (name: string, key: Context.Key<unknown, unknown>) =>\n\tPlugin.make({\n\t\tname: \"remote-capability-contract\",\n\t\tinject: [Plugin.optional(key)],\n\t\tapply: Effect.fnUntraced(function* () {\n\t\t\tconst value = yield* Effect.serviceOption(key)\n\t\t\tif (Option.isNone(value))\n\t\t\t\treturn yield* CapabilityContractError.make({\n\t\t\t\t\tplugin: name,\n\t\t\t\t\tkey: key.key,\n\t\t\t\t})\n\t\t}),\n\t})\n\n/** Resolve the key in a fresh consumer after the provider subtree settles.\n * An optional consumer started earlier could still hold a pre-publication snapshot.\n */\nconst watch = (provider: Fork.Fork, key: Context.Key<unknown, unknown>) =>\n\tPlugin.fork(\n\t\tGraft.forks.pipe(\n\t\t\tStream.map((trees) => findSubtree(trees, provider.id)),\n\t\t\tStream.filter(Option.isSome),\n\t\t\tStream.map((tree) => tree.value),\n\t\t\tStream.tap(failure),\n\t\t\tStream.map((tree) => ({\n\t\t\t\tname: tree.name,\n\t\t\t\tactive: isSubtreeActive(tree),\n\t\t\t})),\n\t\t\tStream.changesWith((left, right) => left.active === right.active),\n\t\t\tStream.filter((tree) => tree.active),\n\t\t\tStream.runForEach((tree) =>\n\t\t\t\tEffect.scoped(\n\t\t\t\t\tGraft.plugin(probe(tree.name, key)).pipe(\n\t\t\t\t\t\tEffect.flatMap((fork) => fork.await),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t),\n\t\t),\n\t)\n\nconst assembly = (\n\tkeys: readonly [Context.Key<unknown, unknown>, Context.Key<unknown, unknown>],\n) =>\n\tPlugin.make({\n\t\tname: \"remote-assembly\",\n\t\tconfig: Input,\n\t\tapply: Effect.fnUntraced(function* (input) {\n\t\t\tyield* Effect.forEach(\n\t\t\t\t[\n\t\t\t\t\t{ invocation: input.transport, key: keys[0] },\n\t\t\t\t\t{ invocation: input.auth, key: keys[1] },\n\t\t\t\t],\n\t\t\t\tEffect.fnUntraced(function* ({ invocation, key }) {\n\t\t\t\t\tconst provider = yield* Graft.plugin(\n\t\t\t\t\t\tinvocation.plugin,\n\t\t\t\t\t\tinvocation.config,\n\t\t\t\t\t)\n\t\t\t\t\tyield* watch(provider, key)\n\t\t\t\t}),\n\t\t\t)\n\t\t\tconst consumer = yield* Graft.plugin(input.consumer, input.input)\n\t\t\t// Capability publication can leave a transient Pending snapshot; business dependencies may remain Pending.\n\t\t\tyield* consumer.state.pipe(\n\t\t\t\tStream.filter(\n\t\t\t\t\t(state) =>\n\t\t\t\t\t\tstate._tag !== \"Loading\" &&\n\t\t\t\t\t\t(state._tag !== \"Pending\" ||\n\t\t\t\t\t\t\t!Array.some(keys, (key) =>\n\t\t\t\t\t\t\t\tArray.contains(state.missing, key.key),\n\t\t\t\t\t\t\t)),\n\t\t\t\t),\n\t\t\t\tStream.runHead,\n\t\t\t)\n\t\t\tyield* follow(consumer, (cause) =>\n\t\t\t\tEffect.fail(CapabilityFailed.make({ cause })),\n\t\t\t)\n\t\t}),\n\t})\nconst hostAssembly = assembly([Connector, Credentials])\nconst runnerAssembly = assembly([Listener, Authenticator])\n\nexport const host = (input: Input) =>\n\tGraft.plugin(hostAssembly, input, { isolate: [Connector, Credentials] })\nexport const runner = (\n\tinput: Omit<Input, \"consumer\">,\n\tconsumer = listenerConsumer,\n) =>\n\tGraft.plugin(\n\t\trunnerAssembly,\n\t\t{ ...input, consumer },\n\t\t{ isolate: [Listener, Authenticator] },\n\t)\n\nexport const compatible = (\n\tproperties: Properties,\n\tkind: CredentialsApi[\"kind\"],\n): Effect.Effect<void, CapabilityCombinationError> => {\n\tif (\n\t\tkind === \"Certificate\" &&\n\t\t(properties.protocol !== \"wss\" ||\n\t\t\t!properties.encrypted ||\n\t\t\t!Array.contains(properties.carries, \"certificate\"))\n\t)\n\t\treturn Effect.fail(\n\t\t\tCapabilityCombinationError.make({\n\t\t\t\tdetail: \"Mutual TLS requires encrypted wss with certificate evidence\",\n\t\t\t}),\n\t\t)\n\tif (kind === \"Authorization\" && !Array.contains(properties.carries, \"header\"))\n\t\treturn Effect.fail(\n\t\t\tCapabilityCombinationError.make({\n\t\t\t\tdetail: \"This transport cannot carry Authorization headers\",\n\t\t\t}),\n\t\t)\n\treturn Effect.void\n}\nconst kind = (auth: AuthenticatorApi): CredentialsApi[\"kind\"] =>\n\tauth._tag === \"Mtls\"\n\t\t? \"Certificate\"\n\t\t: auth._tag === \"Header\"\n\t\t\t? \"Authorization\"\n\t\t\t: \"None\"\nconst warn = (\n\tproperties: Properties,\n\tcredentials: CredentialsApi[\"kind\"],\n\tside: \"host\" | \"runner\",\n) =>\n\tEffect.all(\n\t\t[\n\t\t\tproperties.network && !properties.encrypted\n\t\t\t\t? Effect.logWarning(\n\t\t\t\t\t\tcredentials === \"Authorization\"\n\t\t\t\t\t\t\t? `${properties.protocol}:// ${side === \"host\" ? \"connection\" : \"listener\"} is unencrypted; credentials are transmitted in plaintext`\n\t\t\t\t\t\t\t: `${properties.protocol}:// ${side === \"host\" ? \"connection\" : \"listener\"} is unencrypted`,\n\t\t\t\t\t)\n\t\t\t\t: Effect.void,\n\t\t\tside === \"runner\" && properties.network && credentials === \"None\"\n\t\t\t\t? Effect.logWarning(\"WebSocket listener has no authentication\")\n\t\t\t\t: Effect.void,\n\t\t],\n\t\t{ discard: true },\n\t)\n\nexport const directAuth = (properties: Properties, explicit: boolean) =>\n\texplicit &&\n\t(properties.protocol === \"stdio\" || properties.protocol === \"command\")\n\t\t? Effect.fail(\n\t\t\t\tCapabilityCombinationError.make({\n\t\t\t\t\tdetail: `${properties.protocol} transports do not accept auth`,\n\t\t\t\t}),\n\t\t\t)\n\t\t: Effect.void\n\nexport const connectWith = Effect.fnUntraced(function* (\n\texplicitAuth: boolean = false,\n) {\n\tconst connector = yield* Connector\n\tconst credentials = yield* Credentials\n\tyield* directAuth(connector.properties, explicitAuth)\n\tyield* compatible(connector.properties, credentials.kind)\n\tyield* warn(connector.properties, credentials.kind, \"host\")\n\tconst prepared = yield* credentials.read\n\treturn yield* connector.connect(prepared)\n})\n\nexport const accept =\n\t(\n\t\tauth: AuthenticatorApi,\n\t\tproperties: Properties,\n\t\tsession: (identity: string) => Session,\n\t): Accept =>\n\t(handshake) => {\n\t\tconst identity =\n\t\t\tauth._tag === \"Header\"\n\t\t\t\t? auth.authenticate(handshake.authorization)\n\t\t\t\t: auth._tag === \"Mtls\"\n\t\t\t\t\t? Option.match(handshake.certificate, {\n\t\t\t\t\t\t\tonNone: () =>\n\t\t\t\t\t\t\t\tEffect.fail(AuthenticationFailed.make({ reason: \"missing\" })),\n\t\t\t\t\t\t\tonSome: auth.authenticate,\n\t\t\t\t\t\t})\n\t\t\t\t\t: (properties.network\n\t\t\t\t\t\t\t? Effect.logWarning(\"WebSocket connection has no authentication\")\n\t\t\t\t\t\t\t: Effect.void\n\t\t\t\t\t\t).pipe(Effect.as(auth.identity))\n\t\treturn identity.pipe(Effect.map(session))\n\t}\n\nexport const makeListenerConsumer = (\n\tprepare: (\n\t\tproperties: Properties,\n\t\tauth: AuthenticatorApi,\n\t) => Effect.Effect<void, CapabilityCombinationError> = () => Effect.void,\n\tready: Effect.Effect<void> = Effect.void,\n) =>\n\tPlugin.make({\n\t\tname: \"remote-listener-consumer\",\n\t\tinject: [\n\t\t\tListener,\n\t\t\tAuthenticator,\n\t\t\tSupervisor,\n\t\t\tPlugin.optional(RunnerLifecycle),\n\t\t],\n\t\tapply: Effect.fnUntraced(function* () {\n\t\t\tconst listener = yield* Listener\n\t\t\tconst auth = yield* Authenticator\n\t\t\tconst supervisor = yield* Supervisor\n\t\t\tconst lifecycle = yield* Effect.serviceOption(RunnerLifecycle)\n\t\t\tyield* prepare(listener.properties, auth)\n\t\t\tyield* compatible(listener.properties, kind(auth)).pipe(\n\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\tListenerConfigError.make({ detail: error.detail }),\n\t\t\t\t),\n\t\t\t)\n\t\t\tyield* warn(listener.properties, kind(auth), \"runner\")\n\t\t\tconst serving = yield* listener.bind(\n\t\t\t\tauth._tag === \"Mtls\" ? Option.some(auth.tls) : Option.none(),\n\t\t\t)\n\t\t\tconst running = yield* Plugin.fork(\n\t\t\t\tserving\n\t\t\t\t\t.serve(\n\t\t\t\t\t\taccept(\n\t\t\t\t\t\t\tauth,\n\t\t\t\t\t\t\tlistener.properties,\n\t\t\t\t\t\t\t(identity) => (channel) =>\n\t\t\t\t\t\t\t\tsupervisor.accept(channel).pipe(\n\t\t\t\t\t\t\t\t\tEffect.catchCause((cause) =>\n\t\t\t\t\t\t\t\t\t\tlistener.properties.protocol === \"stdio\"\n\t\t\t\t\t\t\t\t\t\t\t? closedNormally(cause)\n\t\t\t\t\t\t\t\t\t\t\t\t? Effect.void\n\t\t\t\t\t\t\t\t\t\t\t\t: Effect.failCause(cause)\n\t\t\t\t\t\t\t\t\t\t\t: connectionEnded(cause),\n\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t\tEffect.provideService(Peer, identity),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t\t.pipe(\n\t\t\t\t\t\tEffect.onExit((exit) =>\n\t\t\t\t\t\t\tlistener.properties.protocol === \"stdio\" &&\n\t\t\t\t\t\t\tOption.isSome(lifecycle)\n\t\t\t\t\t\t\t\t? Deferred.done(lifecycle.value.ended, exit)\n\t\t\t\t\t\t\t\t: Effect.void,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t)\n\t\t\tyield* serving.ready.pipe(Effect.raceFirst(Fiber.join(running)))\n\t\t\tyield* ready\n\t\t}),\n\t})\n\nexport const listenerConsumer = makeListenerConsumer()\n\nexport const connect = connectWith()\n"],"mappings":";;;;;;;;;;;;AAkCA,IAAa,sBAAb,cAAyC,OAAO,YAG9C,CAAC,CAAC,uBAAuB,EAAE,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CACrD,IAAa,UAAU;EACtB,OAAO,KAAK;CACb;AACD;AAEA,IAAa,0BAAb,cAA6C,OAAO,YAGlD,CAAC,CAAC,2BAA2B;CAAE,QAAQ,OAAO;CAAQ,KAAK,OAAO;AAAO,CAAC,CAAC,CAAC;CAC7E,IAAa,UAAU;EACtB,OAAO,cAAc,KAAK,OAAO,mCAAmC,KAAK;CAC1E;AACD;AACA,IAAa,6BAAb,cAAgD,OAAO,YAGrD,CAAC,CAAC,8BAA8B,EAAE,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC;CAC5D,IAAa,UAAU;EACtB,OAAO,KAAK;CACb;AACD;AAEA,IAAa,mBAAb,cAAsC,OAAO,YAG3C,CAAC,CAAC,oBAAoB,EACvB,OAAO,OAAO,MAAM,OAAO,SAAS,OAAO,OAAO,EACnD,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,SAAS;CACrB;CACA;CACA;CACA;AACD;AAEA,MAAM,aAAa,OAAO,QAAQ,OAAO,QAAQ;;AAEjD,MAAa,aAAa,OAAO,OAAO;CACvC,QAAQ;CACR,QAAQ,OAAO;AAChB,CAAC;AACD,MAAM,QAAQ,OAAO,OAAO;CAC3B,WAAW;CACX,MAAM;CACN,UAAU;CACV,OAAO,OAAO,YAAY,OAAO,OAAO;AACzC,CAAC;AAGD,MAAM,WAAW,SAChB,KAAK,MAAM,SAAS,WACjB,OAAO,KAAK,iBAAiB,KAAK,EAAE,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,IAC9D,OAAO,QAAQ,KAAK,UAAU,SAAS,EAAE,SAAS,KAAK,CAAC;AAE5D,MAAM,SAAS,MAAc,QAC5B,OAAO,KAAK;CACX,MAAM;CACN,QAAQ,CAAC,OAAO,SAAS,GAAG,CAAC;CAC7B,OAAO,OAAO,WAAW,aAAa;EACrC,MAAM,QAAQ,OAAO,OAAO,cAAc,GAAG;EAC7C,IAAI,OAAO,OAAO,KAAK,GACtB,OAAO,OAAO,wBAAwB,KAAK;GAC1C,QAAQ;GACR,KAAK,IAAI;EACV,CAAC;CACH,CAAC;AACF,CAAC;;;;AAKF,MAAM,SAAS,UAAqB,QACnC,OAAO,KACN,MAAM,MAAM,KACX,OAAO,KAAK,UAAU,YAAY,OAAO,SAAS,EAAE,CAAC,GACrD,OAAO,OAAO,OAAO,MAAM,GAC3B,OAAO,KAAK,SAAS,KAAK,KAAK,GAC/B,OAAO,IAAI,OAAO,GAClB,OAAO,KAAK,UAAU;CACrB,MAAM,KAAK;CACX,QAAQ,gBAAgB,IAAI;AAC7B,EAAE,GACF,OAAO,aAAa,MAAM,UAAU,KAAK,WAAW,MAAM,MAAM,GAChE,OAAO,QAAQ,SAAS,KAAK,MAAM,GACnC,OAAO,YAAY,SAClB,OAAO,OACN,MAAM,OAAO,MAAM,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,KACnC,OAAO,SAAS,SAAS,KAAK,KAAK,CACpC,CACD,CACD,CACD,CACD;AAED,MAAM,YACL,SAEA,OAAO,KAAK;CACX,MAAM;CACN,QAAQ;CACR,OAAO,OAAO,WAAW,WAAW,OAAO;EAC1C,OAAO,OAAO,QACb,CACC;GAAE,YAAY,MAAM;GAAW,KAAK,KAAK;EAAG,GAC5C;GAAE,YAAY,MAAM;GAAM,KAAK,KAAK;EAAG,CACxC,GACA,OAAO,WAAW,WAAW,EAAE,YAAY,OAAO;GACjD,MAAM,WAAW,OAAO,MAAM,OAC7B,WAAW,QACX,WAAW,MACZ;GACA,OAAO,MAAM,UAAU,GAAG;EAC3B,CAAC,CACF;EACA,MAAM,WAAW,OAAO,MAAM,OAAO,MAAM,UAAU,MAAM,KAAK;EAEhE,OAAO,SAAS,MAAM,KACrB,OAAO,QACL,UACA,MAAM,SAAS,cACd,MAAM,SAAS,aACf,CAAC,MAAM,KAAK,OAAO,QAClB,MAAM,SAAS,MAAM,SAAS,IAAI,GAAG,CACtC,EACH,GACA,OAAO,OACR;EACA,OAAO,OAAO,WAAW,UACxB,OAAO,KAAK,iBAAiB,KAAK,EAAE,MAAM,CAAC,CAAC,CAC7C;CACD,CAAC;AACF,CAAC;AACF,MAAM,eAAe,SAAS,CAAC,WAAW,WAAW,CAAC;AACtD,MAAM,iBAAiB,SAAS,CAAC,UAAU,aAAa,CAAC;AAEzD,MAAa,QAAQ,UACpB,MAAM,OAAO,cAAc,OAAO,EAAE,SAAS,CAAC,WAAW,WAAW,EAAE,CAAC;AACxE,MAAa,UACZ,OACA,WAAW,qBAEX,MAAM,OACL,gBACA;CAAE,GAAG;CAAO;AAAS,GACrB,EAAE,SAAS,CAAC,UAAU,aAAa,EAAE,CACtC;AAED,MAAa,cACZ,YACA,SACqD;CACrD,IACC,SAAS,kBACR,WAAW,aAAa,SACxB,CAAC,WAAW,aACZ,CAAC,MAAM,SAAS,WAAW,SAAS,aAAa,IAElD,OAAO,OAAO,KACb,2BAA2B,KAAK,EAC/B,QAAQ,8DACT,CAAC,CACF;CACD,IAAI,SAAS,mBAAmB,CAAC,MAAM,SAAS,WAAW,SAAS,QAAQ,GAC3E,OAAO,OAAO,KACb,2BAA2B,KAAK,EAC/B,QAAQ,oDACT,CAAC,CACF;CACD,OAAO,OAAO;AACf;AACA,MAAM,QAAQ,SACb,KAAK,SAAS,SACX,gBACA,KAAK,SAAS,WACb,kBACA;AACL,MAAM,QACL,YACA,aACA,SAEA,OAAO,IACN,CACC,WAAW,WAAW,CAAC,WAAW,YAC/B,OAAO,WACP,gBAAgB,kBACb,GAAG,WAAW,SAAS,MAAM,SAAS,SAAS,eAAe,WAAW,6DACzE,GAAG,WAAW,SAAS,MAAM,SAAS,SAAS,eAAe,WAAW,gBAC7E,IACC,OAAO,MACV,SAAS,YAAY,WAAW,WAAW,gBAAgB,SACxD,OAAO,WAAW,0CAA0C,IAC5D,OAAO,IACX,GACA,EAAE,SAAS,KAAK,CACjB;AAED,MAAa,cAAc,YAAwB,aAClD,aACC,WAAW,aAAa,WAAW,WAAW,aAAa,aACzD,OAAO,KACP,2BAA2B,KAAK,EAC/B,QAAQ,GAAG,WAAW,SAAS,gCAChC,CAAC,CACF,IACC,OAAO;AAEX,MAAa,cAAc,OAAO,WAAW,WAC5C,eAAwB,OACvB;CACD,MAAM,YAAY,OAAO;CACzB,MAAM,cAAc,OAAO;CAC3B,OAAO,WAAW,UAAU,YAAY,YAAY;CACpD,OAAO,WAAW,UAAU,YAAY,YAAY,IAAI;CACxD,OAAO,KAAK,UAAU,YAAY,YAAY,MAAM,MAAM;CAC1D,MAAM,WAAW,OAAO,YAAY;CACpC,OAAO,OAAO,UAAU,QAAQ,QAAQ;AACzC,CAAC;AAED,MAAa,UAEX,MACA,YACA,aAEA,cAAc;CAcd,QAZC,KAAK,SAAS,WACX,KAAK,aAAa,UAAU,aAAa,IACzC,KAAK,SAAS,SACb,OAAO,MAAM,UAAU,aAAa;EACpC,cACC,OAAO,KAAK,qBAAqB,KAAK,EAAE,QAAQ,UAAU,CAAC,CAAC;EAC7D,QAAQ,KAAK;CACd,CAAC,KACC,WAAW,UACV,OAAO,WAAW,4CAA4C,IAC9D,OAAO,KAAA,CACR,KAAK,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAA,CACnB,KAAK,OAAO,IAAI,OAAO,CAAC;AACzC;AAED,MAAa,wBACZ,gBAG6D,OAAO,MACpE,QAA6B,OAAO,SAEpC,OAAO,KAAK;CACX,MAAM;CACN,QAAQ;EACP;EACA;EACA;EACA,OAAO,SAAS,eAAe;CAChC;CACA,OAAO,OAAO,WAAW,aAAa;EACrC,MAAM,WAAW,OAAO;EACxB,MAAM,OAAO,OAAO;EACpB,MAAM,aAAa,OAAO;EAC1B,MAAM,YAAY,OAAO,OAAO,cAAc,eAAe;EAC7D,OAAO,QAAQ,SAAS,YAAY,IAAI;EACxC,OAAO,WAAW,SAAS,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,KAClD,OAAO,UAAU,UAChB,oBAAoB,KAAK,EAAE,QAAQ,MAAM,OAAO,CAAC,CAClD,CACD;EACA,OAAO,KAAK,SAAS,YAAY,KAAK,IAAI,GAAG,QAAQ;EACrD,MAAM,UAAU,OAAO,SAAS,KAC/B,KAAK,SAAS,SAAS,OAAO,KAAK,KAAK,GAAG,IAAI,OAAO,KAAK,CAC5D;EACA,MAAM,UAAU,OAAO,OAAO,KAC7B,QACE,MACA,OACC,MACA,SAAS,aACR,cAAc,YACd,WAAW,OAAO,OAAO,CAAC,CAAC,KAC1B,OAAO,YAAY,UAClB,SAAS,WAAW,aAAa,UAC9B,eAAe,KAAK,IACnB,OAAO,OACP,OAAO,UAAU,KAAK,IACvB,gBAAgB,KAAK,CACzB,GACA,OAAO,eAAe,MAAM,QAAQ,CACrC,CACF,CACD,CAAC,CACA,KACA,OAAO,QAAQ,SACd,SAAS,WAAW,aAAa,WACjC,OAAO,OAAO,SAAS,IACpB,SAAS,KAAK,UAAU,MAAM,OAAO,IAAI,IACzC,OAAO,IACX,CACD,CACF;EACA,OAAO,QAAQ,MAAM,KAAK,OAAO,UAAU,MAAM,KAAK,OAAO,CAAC,CAAC;EAC/D,OAAO;CACR,CAAC;AACF,CAAC;AAEF,MAAa,mBAAmB,qBAAqB;AAE9B,YAAY"}

package/dist/internal/auth/config.d.ts

@@ -0,0 +1,27 @@
+import { Schema } from "effect";
+export declare const ClockTolerance: Schema.DurationFromString;
+export declare const Jwt: Schema.Struct<{
+  readonly issuer: Schema.NonEmptyString;
+  readonly audience: Schema.NonEmptyArray<Schema.NonEmptyString>;
+  readonly algorithms: Schema.NonEmptyArray<Schema.Literals<readonly ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512", "EdDSA"]>>;
+  readonly identityClaim: Schema.withDecodingDefaultKey<Schema.NonEmptyString, never>;
+  readonly clockTolerance: Schema.withDecodingDefaultKey<Schema.DurationFromString, never>;
+  readonly keys: Schema.Union<readonly [Schema.Struct<{
+    readonly jwksUrl: Schema.String;
+    readonly publicKey: Schema.optionalKey<Schema.Never>;
+  }>, Schema.Struct<{
+    readonly publicKey: Schema.String;
+    readonly jwksUrl: Schema.optionalKey<Schema.Never>;
+  }>]>;
+}>;
+export declare const Certificate: Schema.Struct<{
+  readonly cert: Schema.String;
+  readonly key: Schema.String;
+}>;
+export declare const Mtls: Schema.Struct<{
+  readonly ca: Schema.String;
+}>;
+export declare const Bearer: Schema.Struct<{
+  readonly tokens: Schema.String;
+}>;
+//# sourceMappingURL=config.d.ts.map

package/dist/internal/auth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","names":[],"sources":["../../../src/internal/auth/config.ts"],"mappings":";qBAGa,gBAAc,OAAA;qBAOd,KAAG,OAAA;;;;;;;;;;;;;;qBAsBH,aAAW,OAAA;;;;qBAOX,MAAI,OAAA;;;qBACJ,QAAM,OAAA"}

package/dist/internal/auth/config.js

@@ -0,0 +1,29 @@
+import { Duration, Effect, Schema } from "effect";
+import { Jwk } from "effect/jose";
+// src/internal/auth/config.ts
+const ClockTolerance = Schema.DurationFromString.check(Schema.makeFilter((duration) => Duration.isFinite(duration) && Duration.toMillis(duration) >= 0, { expected: "a finite, non-negative duration" }));
+const Jwt$1 = Schema.Struct({
+	issuer: Schema.NonEmptyString,
+	audience: Schema.NonEmptyArray(Schema.NonEmptyString),
+	algorithms: Schema.NonEmptyArray(Jwk.AsymmetricAlgorithm),
+	identityClaim: Schema.NonEmptyString.pipe(Schema.withDecodingDefaultKey(Effect.succeed("sub"))),
+	clockTolerance: ClockTolerance.pipe(Schema.withDecodingDefaultKey(Effect.succeed("5 seconds"))),
+	keys: Schema.Union([Schema.Struct({
+		jwksUrl: Schema.String,
+		publicKey: Schema.optionalKey(Schema.Never)
+	}), Schema.Struct({
+		publicKey: Schema.String,
+		jwksUrl: Schema.optionalKey(Schema.Never)
+	})])
+});
+const Certificate = Schema.Struct({
+	cert: Schema.String,
+	key: Schema.String
+});
+const Token = Schema.Struct({ token: Schema.Union([Schema.String, Schema.Struct({ file: Schema.String })]) });
+const Mtls = Schema.Struct({ ca: Schema.String });
+const Bearer = Schema.Struct({ tokens: Schema.String });
+const None = Schema.Struct({ identity: Schema.optionalKey(Schema.String) });
+export { Bearer, Certificate, ClockTolerance, Jwt$1 as Jwt, Mtls, None, Token };
+
+//# sourceMappingURL=config.js.map

package/dist/internal/auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","names":["Jwt"],"sources":["../../../src/internal/auth/config.ts"],"sourcesContent":["import { Duration, Effect, Schema } from \"effect\"\nimport { Jwk } from \"effect/jose\"\n\nexport const ClockTolerance = Schema.DurationFromString.check(\n\tSchema.makeFilter(\n\t\t(duration) =>\n\t\t\tDuration.isFinite(duration) && Duration.toMillis(duration) >= 0,\n\t\t{ expected: \"a finite, non-negative duration\" },\n\t),\n)\nexport const Jwt = Schema.Struct({\n\tissuer: Schema.NonEmptyString,\n\taudience: Schema.NonEmptyArray(Schema.NonEmptyString),\n\talgorithms: Schema.NonEmptyArray(Jwk.AsymmetricAlgorithm),\n\tidentityClaim: Schema.NonEmptyString.pipe(\n\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"sub\")),\n\t),\n\tclockTolerance: ClockTolerance.pipe(\n\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"5 seconds\")),\n\t),\n\tkeys: Schema.Union([\n\t\tSchema.Struct({\n\t\t\tjwksUrl: Schema.String,\n\t\t\tpublicKey: Schema.optionalKey(Schema.Never),\n\t\t}),\n\t\tSchema.Struct({\n\t\t\tpublicKey: Schema.String,\n\t\t\tjwksUrl: Schema.optionalKey(Schema.Never),\n\t\t}),\n\t]),\n})\n\nexport const Certificate = Schema.Struct({\n\tcert: Schema.String,\n\tkey: Schema.String,\n})\nexport const Token = Schema.Struct({\n\ttoken: Schema.Union([Schema.String, Schema.Struct({ file: Schema.String })]),\n})\nexport const Mtls = Schema.Struct({ ca: Schema.String })\nexport const Bearer = Schema.Struct({ tokens: Schema.String })\nexport const None = Schema.Struct({\n\tidentity: Schema.optionalKey(Schema.String),\n})\n"],"mappings":";;;AAGA,MAAa,iBAAiB,OAAO,mBAAmB,MACvD,OAAO,YACL,aACA,SAAS,SAAS,QAAQ,KAAK,SAAS,SAAS,QAAQ,KAAK,GAC/D,EAAE,UAAU,kCAAkC,CAC/C,CACD;AACA,MAAaA,QAAM,OAAO,OAAO;CAChC,QAAQ,OAAO;CACf,UAAU,OAAO,cAAc,OAAO,cAAc;CACpD,YAAY,OAAO,cAAc,IAAI,mBAAmB;CACxD,eAAe,OAAO,eAAe,KACpC,OAAO,uBAAuB,OAAO,QAAQ,KAAK,CAAC,CACpD;CACA,gBAAgB,eAAe,KAC9B,OAAO,uBAAuB,OAAO,QAAQ,WAAW,CAAC,CAC1D;CACA,MAAM,OAAO,MAAM,CAClB,OAAO,OAAO;EACb,SAAS,OAAO;EAChB,WAAW,OAAO,YAAY,OAAO,KAAK;CAC3C,CAAC,GACD,OAAO,OAAO;EACb,WAAW,OAAO;EAClB,SAAS,OAAO,YAAY,OAAO,KAAK;CACzC,CAAC,CACF,CAAC;AACF,CAAC;AAED,MAAa,cAAc,OAAO,OAAO;CACxC,MAAM,OAAO;CACb,KAAK,OAAO;AACb,CAAC;AACD,MAAa,QAAQ,OAAO,OAAO,EAClC,OAAO,OAAO,MAAM,CAAC,OAAO,QAAQ,OAAO,OAAO,EAAE,MAAM,OAAO,OAAO,CAAC,CAAC,CAAC,EAC5E,CAAC;AACD,MAAa,OAAO,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC;AACvD,MAAa,SAAS,OAAO,OAAO,EAAE,QAAQ,OAAO,OAAO,CAAC;AAC7D,MAAa,OAAO,OAAO,OAAO,EACjC,UAAU,OAAO,YAAY,OAAO,MAAM,EAC3C,CAAC"}

package/dist/internal/auth/mtls.js.map

@@ -1 +1 @@
-{"version":3,"file":"mtls.js","names":[],"sources":["../../../src/internal/auth/mtls.ts"],"sourcesContent":["import { Array, Cause, Effect, Schema, String } from \"effect\"\nimport { AuthenticationFailed } from \"../../Errors\"\n\n// Node JSON-quotes SAN values containing separators, escaping commas inside the value.\nconst uriValue = (field: string) => {\n\tconst value = String.slice(4)(field)\n\treturn String.startsWith('\"')(value)\n\t\t? Schema.decodeEffect(Schema.fromJsonString(Schema.String))(value).pipe(\n\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\tAuthenticationFailed.make({\n\t\t\t\t\t\treason: \"invalid\",\n\t\t\t\t\t\tcause: Cause.fail(error),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t)\n\t\t: Effect.succeed(value)\n}\n\n/** Read exactly one graft URI from Node's plain or JSON-quoted SAN representation. */\nexport const identityFromSubjectAltName = Effect.fnUntraced(function* (\n\tsan: string | undefined,\n): Effect.fn.Return<string, AuthenticationFailed> {\n\tconst values = yield* Effect.forEach(\n\t\tArray.filter(String.split(san ?? \"\", \", \"), String.startsWith(\"URI:\")),\n\t\turiValue,\n\t)\n\tconst uris = Array.filter(values, String.startsWith(\"graft://\"))\n\tconst [uri] = uris\n\treturn yield* uris.length === 1 && uri !== undefined\n\t\t? Effect.succeed(uri)\n\t\t: Effect.fail(\n\t\t\t\tAuthenticationFailed.make({\n\t\t\t\t\treason: \"invalid\",\n\t\t\t\t\tcause: Cause.fail(\n\t\t\t\t\t\t\"The peer certificate must contain exactly one graft SAN URI\",\n\t\t\t\t\t),\n\t\t\t\t}),\n\t\t\t)\n})\n"],"mappings":";;;AAIA,MAAM,YAAY,UAAkB;CACnC,MAAM,QAAQ,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK;CACnC,OAAO,OAAO,WAAW,IAAG,CAAC,CAAC,KAAK,IAChC,OAAO,aAAa,OAAO,eAAe,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KACjE,OAAO,UAAU,UAChB,qBAAqB,KAAK;EACzB,QAAQ;EACR,OAAO,MAAM,KAAK,KAAK;CACxB,CAAC,CACF,CACD,IACC,OAAO,QAAQ,KAAK;AACxB;;AAGA,MAAa,6BAA6B,OAAO,WAAW,WAC3D,KACiD;CACjD,MAAM,SAAS,OAAO,OAAO,QAC5B,MAAM,OAAO,OAAO,MAAM,OAAO,IAAI,IAAI,GAAG,OAAO,WAAW,MAAM,CAAC,GACrE,QACD;CACA,MAAM,OAAO,MAAM,OAAO,QAAQ,OAAO,WAAW,UAAU,CAAC;CAC/D,MAAM,CAAC,OAAO;CACd,OAAO,OAAO,KAAK,WAAW,KAAK,QAAQ,KAAA,IACxC,OAAO,QAAQ,GAAG,IAClB,OAAO,KACP,qBAAqB,KAAK;EACzB,QAAQ;EACR,OAAO,MAAM,KACZ,6DACD;CACD,CAAC,CACF;AACH,CAAC"}
+{"version":3,"file":"mtls.js","names":[],"sources":["../../../src/internal/auth/mtls.ts"],"sourcesContent":["import { Array, Cause, Effect, Schema, String } from \"effect\"\n\nimport { AuthenticationFailed } from \"../../Errors\"\n\n// Node JSON-quotes SAN values containing separators, escaping commas inside the value.\nconst uriValue = (field: string) => {\n\tconst value = String.slice(4)(field)\n\treturn String.startsWith('\"')(value)\n\t\t? Schema.decodeEffect(Schema.fromJsonString(Schema.String))(value).pipe(\n\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\tAuthenticationFailed.make({\n\t\t\t\t\t\treason: \"invalid\",\n\t\t\t\t\t\tcause: Cause.fail(error),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t)\n\t\t: Effect.succeed(value)\n}\n\n/** Read exactly one graft URI from Node's plain or JSON-quoted SAN representation. */\nexport const identityFromSubjectAltName = Effect.fnUntraced(function* (\n\tsan: string | undefined,\n): Effect.fn.Return<string, AuthenticationFailed> {\n\tconst values = yield* Effect.forEach(\n\t\tArray.filter(String.split(san ?? \"\", \", \"), String.startsWith(\"URI:\")),\n\t\turiValue,\n\t)\n\tconst uris = Array.filter(values, String.startsWith(\"graft://\"))\n\tconst [uri] = uris\n\treturn yield* uris.length === 1 && uri !== undefined\n\t\t? Effect.succeed(uri)\n\t\t: Effect.fail(\n\t\t\t\tAuthenticationFailed.make({\n\t\t\t\t\treason: \"invalid\",\n\t\t\t\t\tcause: Cause.fail(\n\t\t\t\t\t\t\"The peer certificate must contain exactly one graft SAN URI\",\n\t\t\t\t\t),\n\t\t\t\t}),\n\t\t\t)\n})\n"],"mappings":";;;AAKA,MAAM,YAAY,UAAkB;CACnC,MAAM,QAAQ,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK;CACnC,OAAO,OAAO,WAAW,IAAG,CAAC,CAAC,KAAK,IAChC,OAAO,aAAa,OAAO,eAAe,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KACjE,OAAO,UAAU,UAChB,qBAAqB,KAAK;EACzB,QAAQ;EACR,OAAO,MAAM,KAAK,KAAK;CACxB,CAAC,CACF,CACD,IACC,OAAO,QAAQ,KAAK;AACxB;;AAGA,MAAa,6BAA6B,OAAO,WAAW,WAC3D,KACiD;CACjD,MAAM,SAAS,OAAO,OAAO,QAC5B,MAAM,OAAO,OAAO,MAAM,OAAO,IAAI,IAAI,GAAG,OAAO,WAAW,MAAM,CAAC,GACrE,QACD;CACA,MAAM,OAAO,MAAM,OAAO,QAAQ,OAAO,WAAW,UAAU,CAAC;CAC/D,MAAM,CAAC,OAAO;CACd,OAAO,OAAO,KAAK,WAAW,KAAK,QAAQ,KAAA,IACxC,OAAO,QAAQ,GAAG,IAClB,OAAO,KACP,qBAAqB,KAAK;EACzB,QAAQ;EACR,OAAO,MAAM,KACZ,6DACD;CACD,CAAC,CACF;AACH,CAAC"}