@graftland/plugin-remote 0.3.3 → 0.4.1

package/dist/runner/auth/jwt.js

@@ -1,28 +1,14 @@
-import { a as provide, l as make } from "../../Graft-B71CPA2Y.js";
-import { t as Authenticator } from "../../Auth-BElTC9_X.js";
-import { t as ConfigDirectory } from "../../ConfigDirectory-BCC6q2R4.js";
-import { n as AuthenticatorUnavailable, t as AuthenticationFailed } from "../../Errors-DYhsGZcZ.js";
-import { r as read } from "../../token-CYBNNlhS.js";
-import { Cause, Duration, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
+import { Authenticator } from "../../Auth.js";
+import { AuthenticationFailed, AuthenticatorUnavailable } from "../../Errors.js";
+import { ClockTolerance, Jwt } from "../../internal/auth/config.js";
+import { read } from "../../internal/auth/token.js";
+import { Cause, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
 import { Signature } from "effect/crypto";
+import { Graft, Plugin } from "@graftland/graft";
+import { ConfigDirectory } from "@graftland/loader";
+import { Jwk, Jwks, Jwt as Jwt$1 } from "effect/jose";
 import { HttpClient } from "effect/http";
-import { Jwk, Jwks, Jwt } from "effect/jose";
-// packages/remote/src/runner/auth/jwt.ts
-const ClockTolerance = Schema.DurationFromString.check(Schema.makeFilter((duration) => Duration.isFinite(duration) && Duration.toMillis(duration) >= 0, { expected: "a finite, non-negative duration" }));
-const Config = Schema.Struct({
-	issuer: Schema.NonEmptyString,
-	audience: Schema.NonEmptyArray(Schema.NonEmptyString),
-	algorithms: Schema.NonEmptyArray(Jwk.AsymmetricAlgorithm),
-	identityClaim: Schema.NonEmptyString.pipe(Schema.withDecodingDefaultKey(Effect.succeed("sub"))),
-	clockTolerance: ClockTolerance.pipe(Schema.withDecodingDefaultKey(Effect.succeed("5 seconds"))),
-	keys: Schema.Union([Schema.Struct({
-		jwksUrl: Schema.String,
-		publicKey: Schema.optionalKey(Schema.Never)
-	}), Schema.Struct({
-		publicKey: Schema.String,
-		jwksUrl: Schema.optionalKey(Schema.Never)
-	})])
-});
+// src/runner/auth/jwt.ts
 const keys = Effect.fnUntraced(function* (config) {
 	if (config.keys.jwksUrl !== void 0) return Jwks.layerRemote({ url: config.keys.jwksUrl });
 	const fs = yield* FileSystem.FileSystem;
@@ -32,9 +18,9 @@ const keys = Effect.fnUntraced(function* (config) {
 	const keys = yield* Effect.forEach(config.algorithms, (algorithm) => Jwk.importSpki(pem, algorithm).pipe(Effect.flatMap(Jwk.exportPublic)));
 	return Jwks.layerLocal({ keys });
 });
-var jwt_default = make({
+var jwt_default = Plugin.make({
 	name: "remote-jwt-authenticator",
-	config: Config,
+	config: Jwt,
 	inject: [
 		FileSystem.FileSystem,
 		Path.Path,
@@ -45,10 +31,10 @@ var jwt_default = make({
 		const keySet = yield* keys(config);
 		const services = yield* Layer.build(keySet);
 		const signature = yield* Signature.Signature;
-		yield* provide(Authenticator, {
+		yield* Graft.provide(Authenticator, {
 			_tag: "Header",
 			issuer: config.issuer,
-			authenticate: (authorization) => read(authorization).pipe(Effect.flatMap((token) => Jwt.verifyWithKeySet(Schema.Record(Schema.String, Schema.Unknown), token, {
+			authenticate: (authorization) => read(authorization).pipe(Effect.flatMap((token) => Jwt$1.verifyWithKeySet(Schema.Record(Schema.String, Schema.Unknown), token, {
 				issuer: config.issuer,
 				audience: config.audience,
 				algorithms: config.algorithms,
@@ -62,4 +48,6 @@ var jwt_default = make({
 		});
 	})
 });
-export { ClockTolerance, Config, jwt_default as default };
+export { ClockTolerance, Jwt as Config, jwt_default as default };
+
+//# sourceMappingURL=jwt.js.map

package/dist/runner/auth/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","names":["Token.read"],"sources":["../../../src/runner/auth/jwt.ts"],"sourcesContent":["import { Option } from \"effect\"\nimport { Graft, Plugin } from \"@graftland/graft\"\nimport {\n\tCause,\n\tDuration,\n\tEffect,\n\tFileSystem,\n\tLayer,\n\tPath,\n\tSchema,\n} from \"effect\"\nimport { Jwk, Jwks, Jwt } from \"effect/jose\"\nimport { Signature } from \"effect/crypto\"\nimport { HttpClient } from \"effect/http\"\nimport { Authenticator } from \"../../Auth\"\nimport { ConfigDirectory } from \"@graftland/loader\"\nimport { AuthenticationFailed, AuthenticatorUnavailable } from \"../../Errors\"\nimport * as Token from \"../../internal/auth/token\"\n\nexport const ClockTolerance = Schema.DurationFromString.check(\n\tSchema.makeFilter(\n\t\t(duration) =>\n\t\t\tDuration.isFinite(duration) && Duration.toMillis(duration) >= 0,\n\t\t{ expected: \"a finite, non-negative duration\" },\n\t),\n)\nexport const Config = Schema.Struct({\n\tissuer: Schema.NonEmptyString,\n\taudience: Schema.NonEmptyArray(Schema.NonEmptyString),\n\talgorithms: Schema.NonEmptyArray(Jwk.AsymmetricAlgorithm),\n\tidentityClaim: Schema.NonEmptyString.pipe(\n\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"sub\")),\n\t),\n\tclockTolerance: ClockTolerance.pipe(\n\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"5 seconds\")),\n\t),\n\tkeys: Schema.Union([\n\t\tSchema.Struct({\n\t\t\tjwksUrl: Schema.String,\n\t\t\tpublicKey: Schema.optionalKey(Schema.Never),\n\t\t}),\n\t\tSchema.Struct({\n\t\t\tpublicKey: Schema.String,\n\t\t\tjwksUrl: Schema.optionalKey(Schema.Never),\n\t\t}),\n\t]),\n})\nconst keys = Effect.fnUntraced(function* (config: typeof Config.Type) {\n\tif (config.keys.jwksUrl !== undefined)\n\t\treturn Jwks.layerRemote({ url: config.keys.jwksUrl })\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst directory = yield* ConfigDirectory.pipe(\n\t\tEffect.map(Option.getOrElse(() => \".\")),\n\t)\n\tconst pem = yield* fs.readFileString(\n\t\tpath.resolve(directory, config.keys.publicKey),\n\t)\n\t// A single PEM must support the allowed algorithms; use JWKS for multiple key types.\n\tconst keys = yield* Effect.forEach(config.algorithms, (algorithm) =>\n\t\tJwk.importSpki(pem, algorithm).pipe(Effect.flatMap(Jwk.exportPublic)),\n\t)\n\treturn Jwks.layerLocal({ keys })\n})\nexport default Plugin.make({\n\tname: \"remote-jwt-authenticator\",\n\tconfig: Config,\n\tinject: [\n\t\tFileSystem.FileSystem,\n\t\tPath.Path,\n\t\tSignature.Signature,\n\t\tHttpClient.HttpClient,\n\t],\n\tapply: Effect.fnUntraced(function* (config) {\n\t\tconst keySet = yield* keys(config)\n\t\tconst services = yield* Layer.build(keySet)\n\t\tconst signature = yield* Signature.Signature\n\t\tyield* Graft.provide(Authenticator, {\n\t\t\t_tag: \"Header\",\n\t\t\tissuer: config.issuer,\n\t\t\tauthenticate: (authorization) =>\n\t\t\t\tToken.read(authorization).pipe(\n\t\t\t\t\tEffect.flatMap((token) =>\n\t\t\t\t\t\tJwt.verifyWithKeySet(\n\t\t\t\t\t\t\tSchema.Record(Schema.String, Schema.Unknown),\n\t\t\t\t\t\t\ttoken,\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tissuer: config.issuer,\n\t\t\t\t\t\t\t\taudience: config.audience,\n\t\t\t\t\t\t\t\talgorithms: config.algorithms,\n\t\t\t\t\t\t\t\tclockTolerance: config.clockTolerance,\n\t\t\t\t\t\t\t\trequiredClaims: [\"exp\"],\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t).pipe(\n\t\t\t\t\t\t\tEffect.flatMap((verified) =>\n\t\t\t\t\t\t\t\tSchema.decodeUnknownEffect(Schema.NonEmptyString)(\n\t\t\t\t\t\t\t\t\tverified.claims[config.identityClaim],\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t// An unreachable key set says nothing about the token; the client must not discard it.\n\t\t\t\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\t\t\t\terror._tag === \"JoseError\" &&\n\t\t\t\t\t\t\t\terror.reason._tag === \"KeySetUnavailable\"\n\t\t\t\t\t\t\t\t\t? AuthenticatorUnavailable.make({ cause: Cause.fail(error) })\n\t\t\t\t\t\t\t\t\t: AuthenticationFailed.make({\n\t\t\t\t\t\t\t\t\t\t\treason: \"invalid\",\n\t\t\t\t\t\t\t\t\t\t\tchallenge: 'Bearer error=\"invalid_token\"',\n\t\t\t\t\t\t\t\t\t\t\tcause: Cause.fail(error),\n\t\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tEffect.provideService(Signature.Signature, signature),\n\t\t\t\t\t\t\tEffect.provideContext(services),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t})\n\t}),\n})\n"],"mappings":";;;;;;;;;;AAmBA,MAAa,iBAAiB,OAAO,mBAAmB,MACvD,OAAO,YACL,aACA,SAAS,SAAS,QAAQ,KAAK,SAAS,SAAS,QAAQ,KAAK,GAC/D,EAAE,UAAU,kCAAkC,CAC/C,CACD;AACA,MAAa,SAAS,OAAO,OAAO;CACnC,QAAQ,OAAO;CACf,UAAU,OAAO,cAAc,OAAO,cAAc;CACpD,YAAY,OAAO,cAAc,IAAI,mBAAmB;CACxD,eAAe,OAAO,eAAe,KACpC,OAAO,uBAAuB,OAAO,QAAQ,KAAK,CAAC,CACpD;CACA,gBAAgB,eAAe,KAC9B,OAAO,uBAAuB,OAAO,QAAQ,WAAW,CAAC,CAC1D;CACA,MAAM,OAAO,MAAM,CAClB,OAAO,OAAO;EACb,SAAS,OAAO;EAChB,WAAW,OAAO,YAAY,OAAO,KAAK;CAC3C,CAAC,GACD,OAAO,OAAO;EACb,WAAW,OAAO;EAClB,SAAS,OAAO,YAAY,OAAO,KAAK;CACzC,CAAC,CACF,CAAC;AACF,CAAC;AACD,MAAM,OAAO,OAAO,WAAW,WAAW,QAA4B;CACrE,IAAI,OAAO,KAAK,YAAY,KAAA,GAC3B,OAAO,KAAK,YAAY,EAAE,KAAK,OAAO,KAAK,QAAQ,CAAC;CACrD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,YAAY,OAAO,gBAAgB,KACxC,OAAO,IAAI,OAAO,gBAAgB,GAAG,CAAC,CACvC;CACA,MAAM,MAAM,OAAO,GAAG,eACrB,KAAK,QAAQ,WAAW,OAAO,KAAK,SAAS,CAC9C;CAEA,MAAM,OAAO,OAAO,OAAO,QAAQ,OAAO,aAAa,cACtD,IAAI,WAAW,KAAK,SAAS,CAAC,CAAC,KAAK,OAAO,QAAQ,IAAI,YAAY,CAAC,CACrE;CACA,OAAO,KAAK,WAAW,EAAE,KAAK,CAAC;AAChC,CAAC;AACD,IAAA,cAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQ;CACR,QAAQ;EACP,WAAW;EACX,KAAK;EACL,UAAU;EACV,WAAW;CACZ;CACA,OAAO,OAAO,WAAW,WAAW,QAAQ;EAC3C,MAAM,SAAS,OAAO,KAAK,MAAM;EACjC,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM;EAC1C,MAAM,YAAY,OAAO,UAAU;EACnC,OAAO,MAAM,QAAQ,eAAe;GACnC,MAAM;GACN,QAAQ,OAAO;GACf,eAAe,kBACdA,KAAW,aAAa,CAAC,CAAC,KACzB,OAAO,SAAS,UACf,IAAI,iBACH,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,GAC3C,OACA;IACC,QAAQ,OAAO;IACf,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,gBAAgB,OAAO;IACvB,gBAAgB,CAAC,KAAK;GACvB,CACD,CAAC,CAAC,KACD,OAAO,SAAS,aACf,OAAO,oBAAoB,OAAO,cAAc,CAAC,CAChD,SAAS,OAAO,OAAO,cACxB,CACD,GAEA,OAAO,UAAU,UAChB,MAAM,SAAS,eACf,MAAM,OAAO,SAAS,sBACnB,yBAAyB,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,EAAE,CAAC,IAC1D,qBAAqB,KAAK;IAC1B,QAAQ;IACR,WAAW;IACX,OAAO,MAAM,KAAK,KAAK;GACxB,CAAC,CACJ,GACA,OAAO,eAAe,UAAU,WAAW,SAAS,GACpD,OAAO,eAAe,QAAQ,CAC/B,CACD,CACD;EACF,CAAC;CACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"jwt.js","names":["Config","Token.read","Jwt"],"sources":["../../../src/runner/auth/jwt.ts"],"sourcesContent":["import { Cause, Effect, FileSystem, Layer, Option, Path, Schema } from \"effect\"\nimport { Signature } from \"effect/crypto\"\nimport { HttpClient } from \"effect/http\"\nimport { Jwk, Jwks, Jwt } from \"effect/jose\"\n\nimport { Graft, Plugin } from \"@graftland/graft\"\nimport { ConfigDirectory } from \"@graftland/loader\"\n\nimport { Authenticator } from \"../../Auth\"\nimport { AuthenticationFailed, AuthenticatorUnavailable } from \"../../Errors\"\nimport { Jwt as Config } from \"../../internal/auth/config\"\nimport * as Token from \"../../internal/auth/token\"\n\nexport { ClockTolerance } from \"../../internal/auth/config\"\n\nexport { Config }\nconst keys = Effect.fnUntraced(function* (config: typeof Config.Type) {\n\tif (config.keys.jwksUrl !== undefined)\n\t\treturn Jwks.layerRemote({ url: config.keys.jwksUrl })\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst directory = yield* ConfigDirectory.pipe(\n\t\tEffect.map(Option.getOrElse(() => \".\")),\n\t)\n\tconst pem = yield* fs.readFileString(\n\t\tpath.resolve(directory, config.keys.publicKey),\n\t)\n\t// A single PEM must support the allowed algorithms; use JWKS for multiple key types.\n\tconst keys = yield* Effect.forEach(config.algorithms, (algorithm) =>\n\t\tJwk.importSpki(pem, algorithm).pipe(Effect.flatMap(Jwk.exportPublic)),\n\t)\n\treturn Jwks.layerLocal({ keys })\n})\nexport default Plugin.make({\n\tname: \"remote-jwt-authenticator\",\n\tconfig: Config,\n\tinject: [\n\t\tFileSystem.FileSystem,\n\t\tPath.Path,\n\t\tSignature.Signature,\n\t\tHttpClient.HttpClient,\n\t],\n\tapply: Effect.fnUntraced(function* (config) {\n\t\tconst keySet = yield* keys(config)\n\t\tconst services = yield* Layer.build(keySet)\n\t\tconst signature = yield* Signature.Signature\n\t\tyield* Graft.provide(Authenticator, {\n\t\t\t_tag: \"Header\",\n\t\t\tissuer: config.issuer,\n\t\t\tauthenticate: (authorization) =>\n\t\t\t\tToken.read(authorization).pipe(\n\t\t\t\t\tEffect.flatMap((token) =>\n\t\t\t\t\t\tJwt.verifyWithKeySet(\n\t\t\t\t\t\t\tSchema.Record(Schema.String, Schema.Unknown),\n\t\t\t\t\t\t\ttoken,\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tissuer: config.issuer,\n\t\t\t\t\t\t\t\taudience: config.audience,\n\t\t\t\t\t\t\t\talgorithms: config.algorithms,\n\t\t\t\t\t\t\t\tclockTolerance: config.clockTolerance,\n\t\t\t\t\t\t\t\trequiredClaims: [\"exp\"],\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t).pipe(\n\t\t\t\t\t\t\tEffect.flatMap((verified) =>\n\t\t\t\t\t\t\t\tSchema.decodeUnknownEffect(Schema.NonEmptyString)(\n\t\t\t\t\t\t\t\t\tverified.claims[config.identityClaim],\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t// An unreachable key set says nothing about the token; the client must not discard it.\n\t\t\t\t\t\t\tEffect.mapError((error) =>\n\t\t\t\t\t\t\t\terror._tag === \"JoseError\" &&\n\t\t\t\t\t\t\t\terror.reason._tag === \"KeySetUnavailable\"\n\t\t\t\t\t\t\t\t\t? AuthenticatorUnavailable.make({ cause: Cause.fail(error) })\n\t\t\t\t\t\t\t\t\t: AuthenticationFailed.make({\n\t\t\t\t\t\t\t\t\t\t\treason: \"invalid\",\n\t\t\t\t\t\t\t\t\t\t\tchallenge: 'Bearer error=\"invalid_token\"',\n\t\t\t\t\t\t\t\t\t\t\tcause: Cause.fail(error),\n\t\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tEffect.provideService(Signature.Signature, signature),\n\t\t\t\t\t\t\tEffect.provideContext(services),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t})\n\t}),\n})\n"],"mappings":";;;;;;;;;;;AAgBA,MAAM,OAAO,OAAO,WAAW,WAAW,QAA4B;CACrE,IAAI,OAAO,KAAK,YAAY,KAAA,GAC3B,OAAO,KAAK,YAAY,EAAE,KAAK,OAAO,KAAK,QAAQ,CAAC;CACrD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,YAAY,OAAO,gBAAgB,KACxC,OAAO,IAAI,OAAO,gBAAgB,GAAG,CAAC,CACvC;CACA,MAAM,MAAM,OAAO,GAAG,eACrB,KAAK,QAAQ,WAAW,OAAO,KAAK,SAAS,CAC9C;CAEA,MAAM,OAAO,OAAO,OAAO,QAAQ,OAAO,aAAa,cACtD,IAAI,WAAW,KAAK,SAAS,CAAC,CAAC,KAAK,OAAO,QAAQ,IAAI,YAAY,CAAC,CACrE;CACA,OAAO,KAAK,WAAW,EAAE,KAAK,CAAC;AAChC,CAAC;AACD,IAAA,cAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQA;CACR,QAAQ;EACP,WAAW;EACX,KAAK;EACL,UAAU;EACV,WAAW;CACZ;CACA,OAAO,OAAO,WAAW,WAAW,QAAQ;EAC3C,MAAM,SAAS,OAAO,KAAK,MAAM;EACjC,MAAM,WAAW,OAAO,MAAM,MAAM,MAAM;EAC1C,MAAM,YAAY,OAAO,UAAU;EACnC,OAAO,MAAM,QAAQ,eAAe;GACnC,MAAM;GACN,QAAQ,OAAO;GACf,eAAe,kBACdC,KAAW,aAAa,CAAC,CAAC,KACzB,OAAO,SAAS,UACfC,MAAI,iBACH,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,GAC3C,OACA;IACC,QAAQ,OAAO;IACf,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,gBAAgB,OAAO;IACvB,gBAAgB,CAAC,KAAK;GACvB,CACD,CAAC,CAAC,KACD,OAAO,SAAS,aACf,OAAO,oBAAoB,OAAO,cAAc,CAAC,CAChD,SAAS,OAAO,OAAO,cACxB,CACD,GAEA,OAAO,UAAU,UAChB,MAAM,SAAS,eACf,MAAM,OAAO,SAAS,sBACnB,yBAAyB,KAAK,EAAE,OAAO,MAAM,KAAK,KAAK,EAAE,CAAC,IAC1D,qBAAqB,KAAK;IAC1B,QAAQ;IACR,WAAW;IACX,OAAO,MAAM,KAAK,KAAK;GACxB,CAAC,CACJ,GACA,OAAO,eAAe,UAAU,WAAW,SAAS,GACpD,OAAO,eAAe,QAAQ,CAC/B,CACD,CACD;EACF,CAAC;CACF,CAAC;AACF,CAAC"}

package/dist/runner/auth/mtls.d.ts

@@ -1,9 +1,6 @@
 import { AuthenticatorApi } from "../../Auth.js";
+import { Mtls } from "../../internal/auth/config.js";
 import { Graft, Plugin } from "@graftland/graft";
-import { Schema } from "effect";
-export declare const Config: Schema.Struct<{
-  readonly ca: Schema.String;
-}>;
 export declare const make: (ca: string) => Extract<AuthenticatorApi, {
   readonly _tag: "Mtls";
 }>;
@@ -11,6 +8,6 @@ declare const _default: Plugin.Definition<{
   readonly ca: string;
 }, {
   readonly ca: string;
-}, import("effect/PlatformError").PlatformError | Schema.SchemaError | Graft.ServiceConflict>;
-export { _default as default };
+}, import("effect/PlatformError").PlatformError | import("effect/Schema").SchemaError | Graft.ServiceConflict>;
+export { Mtls as Config, _default as default };
 //# sourceMappingURL=mtls.d.ts.map

package/dist/runner/auth/mtls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mtls.d.ts","names":[],"sources":["../../../src/runner/auth/mtls.ts"],"mappings":";;;qBAMa,QAAM,OAAA;;;qBASN,OAAI,eAEd,QAAQ;WAA6B"}
+{"version":3,"file":"mtls.d.ts","names":[],"sources":["../../../src/runner/auth/mtls.ts"],"mappings":";;;qBAkBa,OAAI,eAEd,QAAQ;WAA6B"}

package/dist/runner/auth/mtls.js

@@ -1,28 +1,10 @@
-import { a as provide, l as make$1 } from "../../Graft-B71CPA2Y.js";
-import { t as Authenticator } from "../../Auth-BElTC9_X.js";
-import { t as ConfigDirectory } from "../../ConfigDirectory-BCC6q2R4.js";
-import { t as AuthenticationFailed } from "../../Errors-DYhsGZcZ.js";
-import { Array, Cause, Effect, FileSystem, Option, Path, Schema, String } from "effect";
-// packages/remote/src/internal/auth/mtls.ts
-const uriValue = (field) => {
-	const value = String.slice(4)(field);
-	return String.startsWith("\"")(value) ? Schema.decodeEffect(Schema.fromJsonString(Schema.String))(value).pipe(Effect.mapError((error) => AuthenticationFailed.make({
-		reason: "invalid",
-		cause: Cause.fail(error)
-	}))) : Effect.succeed(value);
-};
-/** Read exactly one graft URI from Node's plain or JSON-quoted SAN representation. */
-const identityFromSubjectAltName = Effect.fnUntraced(function* (san) {
-	const values = yield* Effect.forEach(Array.filter(String.split(san ?? "", ", "), String.startsWith("URI:")), uriValue);
-	const uris = Array.filter(values, String.startsWith("graft://"));
-	const [uri] = uris;
-	return yield* uris.length === 1 && uri !== void 0 ? Effect.succeed(uri) : Effect.fail(AuthenticationFailed.make({
-		reason: "invalid",
-		cause: Cause.fail("The peer certificate must contain exactly one graft SAN URI")
-	}));
-});
-// packages/remote/src/runner/auth/mtls.ts
-const Config = Schema.Struct({ ca: Schema.String });
+import { Authenticator } from "../../Auth.js";
+import { Mtls } from "../../internal/auth/config.js";
+import { identityFromSubjectAltName } from "../../internal/auth/mtls.js";
+import { Effect, FileSystem, Option, Path } from "effect";
+import { Graft, Plugin } from "@graftland/graft";
+import { ConfigDirectory } from "@graftland/loader";
+// src/runner/auth/mtls.ts
 const read = Effect.fnUntraced(function* (ca) {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -39,10 +21,12 @@ const make = (ca) => ({
 	},
 	authenticate: (peer) => identityFromSubjectAltName(Option.getOrUndefined(peer.subjectAltName))
 });
-var mtls_default = make$1({
+var mtls_default = Plugin.make({
 	name: "remote-certificate-authenticator",
-	config: Config,
+	config: Mtls,
 	inject: [FileSystem.FileSystem, Path.Path],
-	apply: ({ ca }) => read(ca).pipe(Effect.flatMap((ca) => provide(Authenticator, make(ca))))
+	apply: ({ ca }) => read(ca).pipe(Effect.flatMap((ca) => Graft.provide(Authenticator, make(ca))))
 });
-export { Config, mtls_default as default, make };
+export { Mtls as Config, mtls_default as default, make };
+
+//# sourceMappingURL=mtls.js.map

package/dist/runner/auth/mtls.js.map

@@ -1 +1 @@
-{"version":3,"file":"mtls.js","names":[],"sources":["../../../src/runner/auth/mtls.ts"],"sourcesContent":["import { Graft, Plugin } from \"@graftland/graft\"\nimport { Effect, FileSystem, Option, Path, Schema } from \"effect\"\nimport { Authenticator, type AuthenticatorApi } from \"../../Auth\"\nimport { ConfigDirectory } from \"@graftland/loader\"\nimport { identityFromSubjectAltName } from \"../../internal/auth/mtls\"\n\nexport const Config = Schema.Struct({ ca: Schema.String })\nconst read = Effect.fnUntraced(function* (ca: string) {\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst directory = yield* ConfigDirectory.pipe(\n\t\tEffect.map(Option.getOrElse(() => \".\")),\n\t)\n\treturn yield* fs.readFileString(path.resolve(directory, ca))\n})\nexport const make = (\n\tca: string,\n): Extract<AuthenticatorApi, { readonly _tag: \"Mtls\" }> => ({\n\t_tag: \"Mtls\",\n\ttls: {\n\t\tca: [ca],\n\t\tminVersion: \"TLSv1.3\",\n\t\trequestCert: true,\n\t\trejectUnauthorized: true,\n\t},\n\tauthenticate: (peer) =>\n\t\tidentityFromSubjectAltName(Option.getOrUndefined(peer.subjectAltName)),\n})\nexport default Plugin.make({\n\tname: \"remote-certificate-authenticator\",\n\tconfig: Config,\n\tinject: [FileSystem.FileSystem, Path.Path],\n\tapply: ({ ca }) =>\n\t\tread(ca).pipe(\n\t\t\tEffect.flatMap((ca) => Graft.provide(Authenticator, make(ca))),\n\t\t),\n})\n"],"mappings":";;;;;;AAMA,MAAa,SAAS,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC;AACzD,MAAM,OAAO,OAAO,WAAW,WAAW,IAAY;CACrD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,YAAY,OAAO,gBAAgB,KACxC,OAAO,IAAI,OAAO,gBAAgB,GAAG,CAAC,CACvC;CACA,OAAO,OAAO,GAAG,eAAe,KAAK,QAAQ,WAAW,EAAE,CAAC;AAC5D,CAAC;AACD,MAAa,QACZ,QAC2D;CAC3D,MAAM;CACN,KAAK;EACJ,IAAI,CAAC,EAAE;EACP,YAAY;EACZ,aAAa;EACb,oBAAoB;CACrB;CACA,eAAe,SACd,2BAA2B,OAAO,eAAe,KAAK,cAAc,CAAC;AACvE;AACA,IAAA,eAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQ;CACR,QAAQ,CAAC,WAAW,YAAY,KAAK,IAAI;CACzC,QAAQ,EAAE,SACT,KAAK,EAAE,CAAC,CAAC,KACR,OAAO,SAAS,OAAO,MAAM,QAAQ,eAAe,KAAK,EAAE,CAAC,CAAC,CAC9D;AACF,CAAC"}
+{"version":3,"file":"mtls.js","names":["Config"],"sources":["../../../src/runner/auth/mtls.ts"],"sourcesContent":["import { Effect, FileSystem, Option, Path } from \"effect\"\n\nimport { Graft, Plugin } from \"@graftland/graft\"\nimport { ConfigDirectory } from \"@graftland/loader\"\n\nimport { Authenticator, type AuthenticatorApi } from \"../../Auth\"\nimport { Mtls as Config } from \"../../internal/auth/config\"\nimport { identityFromSubjectAltName } from \"../../internal/auth/mtls\"\n\nexport { Config }\nconst read = Effect.fnUntraced(function* (ca: string) {\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst directory = yield* ConfigDirectory.pipe(\n\t\tEffect.map(Option.getOrElse(() => \".\")),\n\t)\n\treturn yield* fs.readFileString(path.resolve(directory, ca))\n})\nexport const make = (\n\tca: string,\n): Extract<AuthenticatorApi, { readonly _tag: \"Mtls\" }> => ({\n\t_tag: \"Mtls\",\n\ttls: {\n\t\tca: [ca],\n\t\tminVersion: \"TLSv1.3\",\n\t\trequestCert: true,\n\t\trejectUnauthorized: true,\n\t},\n\tauthenticate: (peer) =>\n\t\tidentityFromSubjectAltName(Option.getOrUndefined(peer.subjectAltName)),\n})\nexport default Plugin.make({\n\tname: \"remote-certificate-authenticator\",\n\tconfig: Config,\n\tinject: [FileSystem.FileSystem, Path.Path],\n\tapply: ({ ca }) =>\n\t\tread(ca).pipe(\n\t\t\tEffect.flatMap((ca) => Graft.provide(Authenticator, make(ca))),\n\t\t),\n})\n"],"mappings":";;;;;;;AAUA,MAAM,OAAO,OAAO,WAAW,WAAW,IAAY;CACrD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,YAAY,OAAO,gBAAgB,KACxC,OAAO,IAAI,OAAO,gBAAgB,GAAG,CAAC,CACvC;CACA,OAAO,OAAO,GAAG,eAAe,KAAK,QAAQ,WAAW,EAAE,CAAC;AAC5D,CAAC;AACD,MAAa,QACZ,QAC2D;CAC3D,MAAM;CACN,KAAK;EACJ,IAAI,CAAC,EAAE;EACP,YAAY;EACZ,aAAa;EACb,oBAAoB;CACrB;CACA,eAAe,SACd,2BAA2B,OAAO,eAAe,KAAK,cAAc,CAAC;AACvE;AACA,IAAA,eAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQA;CACR,QAAQ,CAAC,WAAW,YAAY,KAAK,IAAI;CACzC,QAAQ,EAAE,SACT,KAAK,EAAE,CAAC,CAAC,KACR,OAAO,SAAS,OAAO,MAAM,QAAQ,eAAe,KAAK,EAAE,CAAC,CAAC,CAC9D;AACF,CAAC"}

package/dist/runner/auth/none.d.ts

@@ -1,5 +1,5 @@
-import { Graft, Plugin } from "@graftland/graft";
 import { Schema } from "effect";
+import { Graft, Plugin } from "@graftland/graft";
 declare const _default: Plugin.Definition<{
   readonly identity: string;
 }, {

package/dist/runner/auth/none.js

@@ -1,13 +1,15 @@
-import { a as provide, l as make } from "../../Graft-B71CPA2Y.js";
-import { t as Authenticator } from "../../Auth-BElTC9_X.js";
+import { Authenticator } from "../../Auth.js";
 import { Effect, Schema } from "effect";
-// packages/remote/src/runner/auth/none.ts
-var none_default = make({
+import { Graft, Plugin } from "@graftland/graft";
+// src/runner/auth/none.ts
+var none_default = Plugin.make({
 	name: "remote-none-authenticator",
 	config: Schema.Struct({ identity: Schema.String.pipe(Schema.withDecodingDefaultKey(Effect.succeed("anonymous"))) }),
-	apply: (config) => provide(Authenticator, {
+	apply: (config) => Graft.provide(Authenticator, {
 		_tag: "None",
 		...config
 	})
 });
 export { none_default as default };
+
+//# sourceMappingURL=none.js.map

package/dist/runner/auth/none.js.map

@@ -1 +1 @@
-{"version":3,"file":"none.js","names":[],"sources":["../../../src/runner/auth/none.ts"],"sourcesContent":["import { Graft, Plugin } from \"@graftland/graft\"\nimport { Effect, Schema } from \"effect\"\nimport { Authenticator } from \"../../Auth\"\n\nexport default Plugin.make({\n\tname: \"remote-none-authenticator\",\n\tconfig: Schema.Struct({\n\t\tidentity: Schema.String.pipe(\n\t\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"anonymous\")),\n\t\t),\n\t}),\n\tapply: (config) => Graft.provide(Authenticator, { _tag: \"None\", ...config }),\n})\n"],"mappings":";;;;AAIA,IAAA,eAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQ,OAAO,OAAO,EACrB,UAAU,OAAO,OAAO,KACvB,OAAO,uBAAuB,OAAO,QAAQ,WAAW,CAAC,CAC1D,EACD,CAAC;CACD,QAAQ,WAAW,MAAM,QAAQ,eAAe;EAAE,MAAM;EAAQ,GAAG;CAAO,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"none.js","names":[],"sources":["../../../src/runner/auth/none.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\"\n\nimport { Graft, Plugin } from \"@graftland/graft\"\n\nimport { Authenticator } from \"../../Auth\"\n\nexport default Plugin.make({\n\tname: \"remote-none-authenticator\",\n\tconfig: Schema.Struct({\n\t\tidentity: Schema.String.pipe(\n\t\t\tSchema.withDecodingDefaultKey(Effect.succeed(\"anonymous\")),\n\t\t),\n\t}),\n\tapply: (config) => Graft.provide(Authenticator, { _tag: \"None\", ...config }),\n})\n"],"mappings":";;;;AAMA,IAAA,eAAe,OAAO,KAAK;CAC1B,MAAM;CACN,QAAQ,OAAO,OAAO,EACrB,UAAU,OAAO,OAAO,KACvB,OAAO,uBAAuB,OAAO,QAAQ,WAAW,CAAC,CAC1D,EACD,CAAC;CACD,QAAQ,WAAW,MAAM,QAAQ,eAAe;EAAE,MAAM;EAAQ,GAAG;CAAO,CAAC;AAC5E,CAAC"}

package/dist/runner/index.d.ts

@@ -1,312 +1,7 @@
 import { RemoteEntryError } from "../Errors.js";
-import { Plugin } from "@graftland/graft";
+import "../index.js";
 import { Schema } from "effect";
-declare const _default: Plugin.Definition<{
-  readonly root: string;
-  readonly state: string;
-  readonly lease?: import("effect/Duration").Duration;
-  readonly grace?: import("effect/Duration").Duration;
-  readonly listen: readonly ({
-    readonly unix?: never;
-    readonly command?: never;
-    readonly stdio?: never;
-    readonly local?: never;
-    readonly worker?: never;
-    readonly transport?: never;
-    readonly auth?: {
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly name: string;
-      readonly config?: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly mtls: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly bearer: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly none?: never;
-      readonly jwt: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none: unknown;
-    };
-    readonly url: string;
-    readonly cert?: string;
-    readonly key?: string;
-  } | {
-    readonly url?: never;
-    readonly command?: never;
-    readonly stdio?: never;
-    readonly local?: never;
-    readonly worker?: never;
-    readonly transport?: never;
-    readonly auth?: {
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly name: string;
-      readonly config?: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly mtls: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly bearer: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly none?: never;
-      readonly jwt: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none: unknown;
-    };
-    readonly unix: string;
-  } | {
-    readonly url?: never;
-    readonly unix?: never;
-    readonly command?: never;
-    readonly local?: never;
-    readonly worker?: never;
-    readonly transport?: never;
-    readonly stdio: true;
-    readonly auth?: never;
-    readonly identity?: string;
-  } | {
-    readonly url?: never;
-    readonly unix?: never;
-    readonly command?: never;
-    readonly stdio?: never;
-    readonly local?: never;
-    readonly worker?: never;
-    readonly auth?: {
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly name: string;
-      readonly config?: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly mtls: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly bearer: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly none?: never;
-      readonly jwt: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none: unknown;
-    };
-    readonly transport: {
-      readonly name: string;
-      readonly config?: unknown;
-    };
-  })[];
-}, {
-  readonly root: string;
-  readonly state: string;
-  readonly lease?: string;
-  readonly grace?: string;
-  readonly listen: readonly ({
-    readonly unix?: never;
-    readonly command?: never;
-    readonly stdio?: never;
-    readonly local?: never;
-    readonly worker?: never;
-    readonly transport?: never;
-    readonly auth?: {
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly name: string;
-      readonly config?: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly mtls: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly bearer: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly none?: never;
-      readonly jwt: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none: unknown;
-    };
-    readonly url: string;
-    readonly cert?: string;
-    readonly key?: string;
-  } | {
-    readonly url?: never;
-    readonly command?: never;
-    readonly stdio?: never;
-    readonly local?: never;
-    readonly worker?: never;
-    readonly transport?: never;
-    readonly auth?: {
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly name: string;
-      readonly config?: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly mtls: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly bearer: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly none?: never;
-      readonly jwt: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none: unknown;
-    };
-    readonly unix: string;
-  } | {
-    readonly url?: never;
-    readonly unix?: never;
-    readonly command?: never;
-    readonly local?: never;
-    readonly worker?: never;
-    readonly transport?: never;
-    readonly stdio: true;
-    readonly auth?: never;
-    readonly identity?: string;
-  } | {
-    readonly url?: never;
-    readonly unix?: never;
-    readonly command?: never;
-    readonly stdio?: never;
-    readonly local?: never;
-    readonly worker?: never;
-    readonly auth?: {
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly name: string;
-      readonly config?: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly mtls: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly jwt?: never;
-      readonly none?: never;
-      readonly bearer: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly none?: never;
-      readonly jwt: unknown;
-    } | {
-      readonly name?: never;
-      readonly config?: never;
-      readonly mtls?: never;
-      readonly bearer?: never;
-      readonly jwt?: never;
-      readonly none: unknown;
-    };
-    readonly transport: {
-      readonly name: string;
-      readonly config?: unknown;
-    };
-  })[];
-}, RemoteEntryError | Schema.SchemaError>;
+import { Plugin } from "@graftland/graft";
+declare const _default: Plugin.Definition<unknown, unknown, RemoteEntryError | Schema.SchemaError>;
 export { _default as default };
 //# sourceMappingURL=index.d.ts.map

package/dist/runner/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":["_$___Errors0.RemoteEntryError"],"sources":["../../src/runner/index.ts"],"mappings":""}
+{"version":3,"file":"index.d.ts","names":["_$__0.RemoteEntryError"],"sources":["../../src/runner/index.ts"],"mappings":""}