@graftland/plugin-remote 0.3.3 → 0.4.1

package/src/internal/{ServeLifecycle.ts → RunnerLifecycle.ts}

@@ -1,5 +1,7 @@
 import { Context, Deferred, Effect, Exit, Option, Schema, Scope } from "effect"
-import * as Release from "./release"
+
+import * as Release from "@graftland/graft/Release"
+
 import type { TransportError } from "../Errors"
 
 export class StartupError extends Schema.TaggedError<
@@ -14,13 +16,13 @@ export class StartupError extends Schema.TaggedError<
 	}
 }
 
-export class ServeLifecycle extends Context.Service<
-	ServeLifecycle,
+export class RunnerLifecycle extends Context.Service<
+	RunnerLifecycle,
 	{
 		readonly ended: Deferred.Deferred<void, TransportError>
 		readonly released: Deferred.Deferred<void, StartupError>
 	}
->()("@graftland/plugin-remote/internal/ServeLifecycle") {}
+>()("@graftland/plugin-remote/internal/RunnerLifecycle") {}
 
 export const make = Effect.all({
 	ended: Deferred.make<void, TransportError>(),
@@ -29,7 +31,7 @@ export const make = Effect.all({
 
 /** Observe shutdown independently of the loader, which logs child cleanup failures. */
 export const resources = Effect.fnUntraced(function* (
-	lifecycle: Option.Option<typeof ServeLifecycle.Service>,
+	lifecycle: Option.Option<typeof RunnerLifecycle.Service>,
 ) {
 	return yield* Effect.acquireRelease(Scope.make(), (scope, exit) =>
 		Release.close(scope, exit).pipe(

package/src/internal/Supervisor.ts

@@ -1,9 +1,10 @@
 /** A listener hands an authenticated byte channel to the supervisor. */
-import { Context } from "effect"
-import type { Effect, Scope } from "effect"
-import type { Peer } from "./Peer"
-import type { Channel } from "../Transport"
+import { Context, type Effect, type Scope } from "effect"
+
 import type { TransportError } from "../Errors"
+import type { Channel } from "../Transport"
+import type { Peer } from "./Peer"
+
 export class Supervisor extends Context.Service<
 	Supervisor,
 	{

package/src/internal/assembly.ts

@@ -1,6 +1,3 @@
-import { findSubtree, isSubtreeActive } from "./forkTree"
-import { Peer } from "./Peer"
-import { Graft, Plugin, type Fork } from "@graftland/graft"
 import {
 	Array,
 	Context,
@@ -11,12 +8,16 @@ import {
 	Schema,
 	Stream,
 } from "effect"
+
+import { Graft, Plugin, type Fork } from "@graftland/graft"
+
 import {
 	Authenticator,
 	Credentials,
 	type AuthenticatorApi,
 	type CredentialsApi,
 } from "../Auth"
+import { AuthenticationFailed } from "../Errors"
 import {
 	Connector,
 	Listener,
@@ -24,11 +25,12 @@ import {
 	type Properties,
 	type Session,
 } from "../Transport"
-import { AuthenticationFailed } from "../Errors"
-import { Supervisor } from "./Supervisor"
 import { follow } from "./follow"
-import { connectionEnded, closedNormally } from "./runner/connectionEnded"
-import { ServeLifecycle } from "./ServeLifecycle"
+import { findSubtree, isSubtreeActive } from "./forkTree"
+import { Peer } from "./Peer"
+import { closedNormally, connectionEnded } from "./runner/connectionEnded"
+import { RunnerLifecycle } from "./RunnerLifecycle"
+import { Supervisor } from "./Supervisor"
 
 export class ListenerConfigError extends Schema.TaggedError<
 	ListenerConfigError,
@@ -291,13 +293,13 @@ export const makeListenerConsumer = (
 			Listener,
 			Authenticator,
 			Supervisor,
-			Plugin.optional(ServeLifecycle),
+			Plugin.optional(RunnerLifecycle),
 		],
 		apply: Effect.fnUntraced(function* () {
 			const listener = yield* Listener
 			const auth = yield* Authenticator
 			const supervisor = yield* Supervisor
-			const lifecycle = yield* Effect.serviceOption(ServeLifecycle)
+			const lifecycle = yield* Effect.serviceOption(RunnerLifecycle)
 			yield* prepare(listener.properties, auth)
 			yield* compatible(listener.properties, kind(auth)).pipe(
 				Effect.mapError((error) =>

package/src/internal/auth/config.ts

@@ -0,0 +1,44 @@
+import { Duration, Effect, Schema } from "effect"
+import { Jwk } from "effect/jose"
+
+export const ClockTolerance = Schema.DurationFromString.check(
+	Schema.makeFilter(
+		(duration) =>
+			Duration.isFinite(duration) && Duration.toMillis(duration) >= 0,
+		{ expected: "a finite, non-negative duration" },
+	),
+)
+export const Jwt = Schema.Struct({
+	issuer: Schema.NonEmptyString,
+	audience: Schema.NonEmptyArray(Schema.NonEmptyString),
+	algorithms: Schema.NonEmptyArray(Jwk.AsymmetricAlgorithm),
+	identityClaim: Schema.NonEmptyString.pipe(
+		Schema.withDecodingDefaultKey(Effect.succeed("sub")),
+	),
+	clockTolerance: ClockTolerance.pipe(
+		Schema.withDecodingDefaultKey(Effect.succeed("5 seconds")),
+	),
+	keys: Schema.Union([
+		Schema.Struct({
+			jwksUrl: Schema.String,
+			publicKey: Schema.optionalKey(Schema.Never),
+		}),
+		Schema.Struct({
+			publicKey: Schema.String,
+			jwksUrl: Schema.optionalKey(Schema.Never),
+		}),
+	]),
+})
+
+export const Certificate = Schema.Struct({
+	cert: Schema.String,
+	key: Schema.String,
+})
+export const Token = Schema.Struct({
+	token: Schema.Union([Schema.String, Schema.Struct({ file: Schema.String })]),
+})
+export const Mtls = Schema.Struct({ ca: Schema.String })
+export const Bearer = Schema.Struct({ tokens: Schema.String })
+export const None = Schema.Struct({
+	identity: Schema.optionalKey(Schema.String),
+})

package/src/internal/auth/mtls.ts

@@ -1,4 +1,5 @@
 import { Array, Cause, Effect, Schema, String } from "effect"
+
 import { AuthenticationFailed } from "../../Errors"
 
 // Node JSON-quotes SAN values containing separators, escaping commas inside the value.

package/src/internal/auth/token.ts

@@ -1,4 +1,5 @@
 import { Effect, Option, Redacted } from "effect"
+
 import { AuthenticationFailed } from "../../Errors"
 
 export const invalid = () =>

package/src/internal/auth/tokenCredentials.ts

@@ -1,5 +1,3 @@
-import { Graft, Plugin } from "@graftland/graft"
-import { ConfigDirectory } from "@graftland/loader"
 import {
 	Cause,
 	Effect,
@@ -9,6 +7,10 @@ import {
 	Redacted,
 	Schema,
 } from "effect"
+
+import { Graft, Plugin } from "@graftland/graft"
+import { ConfigDirectory } from "@graftland/loader"
+
 import { Credentials, type Prepared } from "../../Auth"
 import { CredentialsError } from "../../Errors"
 import { prepare } from "./token"

package/src/internal/child.ts

@@ -1,6 +1,3 @@
-import { loadModule } from "./loadModule"
-import { AlreadyLoaded, ActivationFailed } from "./childErrors"
-import { Graft, Plugin, type Fork } from "@graftland/graft"
 import {
 	Array,
 	Cause,
@@ -18,12 +15,17 @@ import {
 	Scope,
 	Stream,
 	SynchronizedRef,
+	type Schema,
 } from "effect"
-import type { Schema } from "effect"
-import { type RunnerContract } from "./contract"
+
+import { Graft, Plugin, type Fork } from "@graftland/graft"
+
 import { Instance, type Identity } from "../Instance"
-import type * as Port from "./port"
+import { ActivationFailed, AlreadyLoaded } from "./childErrors"
+import { type RunnerContract } from "./contract"
 import type { Event, Log, LogEvent } from "./control"
+import { loadModule } from "./loadModule"
+import type * as Port from "./port"
 
 type Peer = Port.Port
 type ChildEvent = Data.TaggedEnum<{

package/src/{bin.ts → internal/childMain.ts}

@@ -1,64 +1,20 @@
 #!/usr/bin/env node
-/** Runs local children and WebSocket supervisors, and issues their deployment certificates. */
-import { Graft } from "@graftland/graft"
-import { NodeRuntime } from "@effect/platform-node"
-import { Console, Array, Effect, Layer, Logger, Option, Schema } from "effect"
-import { Argument, CliError, Command, Flag } from "effect/cli"
+/** Internal executable for local and supervised child runtimes. */
 import process from "node:process"
 import { pathToFileURL } from "node:url"
-import { platform } from "./internal/platform"
-import { bytes } from "./internal/stdioChannel"
-import { load, run } from "./internal/childRuntime"
-import { Bootstrap } from "./internal/runner/Bootstrap"
-import * as Watchdog from "./internal/runner/Watchdog"
-import * as Serve from "./internal/serve"
-import * as Certificates from "./internal/Certificates"
 
-const serve = Command.make(
-	"serve",
-	{ config: Flag.String("config") },
-	({ config }) => Serve.run(config),
-)
-const certificates = Command.make(
-	"certificates",
-	{
-		out: Flag.String("out").pipe(
-			Flag.withDescription("Directory for the CA and issued certificates"),
-		),
-		server: Flag.String("server").pipe(
-			Flag.atLeast(0),
-			Flag.withDescription(
-				"Runner DNS name or IP address; repeat for additional SANs",
-			),
-		),
-		identity: Flag.String("identity").pipe(
-			Flag.atLeast(0),
-			Flag.withDescription(
-				"Host identity; repeat to issue multiple client certificates",
-			),
-		),
-		days: Flag.Int("days").pipe(
-			Flag.withDefault(365),
-			Flag.filter(
-				(days) => days > 0,
-				() => "Days must be a positive integer",
-			),
-		),
-		force: Flag.Boolean("force").pipe(
-			Flag.withDefault(false),
-			Flag.withDescription(
-				"Replace requested leaf certificates, keeping the existing CA",
-			),
-		),
-	},
-	(options) =>
-		Certificates.generate(options).pipe(
-			Effect.andThen(Console.log(`Certificates written to ${options.out}`)),
-			Effect.catchTag("CertificateExists", (error) =>
-				CliError.UserError.make({ cause: error, userMessage: error.message }),
-			),
-		),
-)
+import { Array, Effect, Layer, Logger, Option, Schema } from "effect"
+import { Argument, CliError, Command } from "effect/cli"
+import { NodeRuntime } from "@effect/platform-node"
+
+import { Graft } from "@graftland/graft"
+
+import { load, run } from "./childRuntime"
+import { platform } from "./platform"
+import { Bootstrap } from "./runner/Bootstrap"
+import * as Watchdog from "./runner/Watchdog"
+import { bytes } from "./stdioChannel"
+
 const child = Command.make(
 	"child",
 	{
@@ -87,7 +43,7 @@ const child = Command.make(
 	}),
 )
 const cli = Command.make(
-	"graft-remote",
+	"remote-child",
 	{
 		contract: Argument.String("contract").pipe(Argument.optional),
 		session: Argument.String("session").pipe(Argument.withDefault("local")),
@@ -96,14 +52,13 @@ const cli = Command.make(
 		if (Option.isNone(contract))
 			return yield* CliError.UserError.make({
 				cause: "Missing contract module",
-				userMessage:
-					"A contract module or the child/serve/certificates subcommand is required",
+				userMessage: "A contract module or the child subcommand is required",
 			})
 		const definition = yield* load(contract.value)
 		const channel = yield* bytes
 		return yield* run(definition, channel, session)
 	}),
-).pipe(Command.withSubcommands([child, serve, certificates]))
+).pipe(Command.withSubcommands([child]))
 
 NodeRuntime.runMain(
 	Effect.scoped(

package/src/internal/childRuntime.ts

@@ -1,19 +1,21 @@
-import { loadModule } from "./loadModule"
-import { ContractNotFound } from "./childErrors"
-import type { Graft } from "@graftland/graft"
 import { Effect, Logger, Option } from "effect"
 import { RpcServer } from "effect/rpc"
+
+import type { Graft } from "@graftland/graft"
+
 import { fromModule, type RunnerContract } from "../Contract"
-import * as Port from "./port"
-import { prepare, type RunnerContract as PreparedContract } from "./contract"
-import * as Services from "./services"
 import * as Child from "./child"
-import * as Multiplex from "./runner/Multiplex"
-import * as Wire from "./runner/Wire"
+import { ContractNotFound } from "./childErrors"
+import { prepare, type RunnerContract as PreparedContract } from "./contract"
+import { endpoint } from "./control"
+import { loadModule } from "./loadModule"
+import * as Port from "./port"
 import type { Bootstrap } from "./runner/Bootstrap"
-import { ExecutionError } from "./runner/model"
 import { closedNormally } from "./runner/connectionEnded"
-import { endpoint } from "./control"
+import { ExecutionError } from "./runner/model"
+import * as Multiplex from "./runner/Multiplex"
+import * as Wire from "./runner/Wire"
+import * as Services from "./services"
 
 /** Import a contract in the runner installation; importing this module performs no I/O. */
 export const load = Effect.fnUntraced(function* (specifier: string) {

package/src/internal/cleanup.ts

@@ -1,6 +1,7 @@
-import { Fork } from "@graftland/graft"
 import { Array, Cause, Effect, Schema, Scope } from "effect"
-import * as Release from "./release"
+
+import { Fork } from "@graftland/graft"
+import * as Release from "@graftland/graft/Release"
 
 /** Finalizers have no typed failure channel. Keep reasons and their annotations flat. */
 export const cleanupCause = (cause: Cause.Cause<unknown>): Cause.Cause<never> =>

package/src/internal/contract.ts

@@ -1,4 +1,5 @@
 import { Cause, Schema } from "effect"
+
 import * as Contract from "../Contract"
 import { ChildFailure } from "./childErrors"
 import * as Control from "./control"

package/src/internal/credentials.ts

@@ -1,5 +1,7 @@
-import { Graft, Plugin } from "@graftland/graft"
 import { Cause, Context, Effect, Redacted, Scope } from "effect"
+
+import { Graft, Plugin } from "@graftland/graft"
+
 import { Credentials, type ClientCertificate, type Prepared } from "../Auth"
 import { CredentialsError } from "../Errors"
 import { prepare } from "./auth/token"

package/src/internal/directTransport.ts

@@ -1,7 +1,14 @@
-import { Context } from "effect"
-import type { Effect, Option, Scope, PlatformError } from "effect"
+import {
+	Context,
+	type Effect,
+	type Option,
+	type PlatformError,
+	type Scope,
+} from "effect"
+
 import type { ProcessExited, TransportError } from "../Errors"
 import type { Channel } from "../Transport"
+
 export interface LocalOptions {
 	readonly command?: readonly [string, ...string[]]
 	readonly contractModule: string

package/src/internal/entry.ts

@@ -1,29 +1,30 @@
-import { Graft, Plugin, type Fork } from "@graftland/graft"
-import { ConfigDirectory, Entry, ModuleResolver } from "@graftland/loader"
 import {
 	Cause,
 	Effect,
 	Option,
 	Path,
-	Schema,
 	References,
+	Schema,
 	Scope,
 	String,
 } from "effect"
+import { SecureRandom } from "effect/crypto"
 import { ChildProcessSpawner } from "effect/process"
+
+import { Graft, Plugin, type Fork } from "@graftland/graft"
+import { ConfigDirectory, Entry, ModuleResolver } from "@graftland/loader"
+
 import * as Contract from "../Contract"
-import { MissingInstance, RemoteEntryError as EntryError } from "../Errors"
+import { RemoteEntryError as EntryError, MissingInstance } from "../Errors"
+import * as Assembly from "./assembly"
+import { children } from "./cleanup"
 import { LocalTransport, WorkerTransport } from "./directTransport"
 import * as Configuration from "./entryConfig"
-import * as Assembly from "./assembly"
-import { executionPlugin } from "./execution"
+import { executionPlugin, type ExecutionOptions } from "./execution"
 import { follow } from "./follow"
-import { children } from "./cleanup"
-import { resolveEntry } from "./runner/Packages"
-import type { LocalTarget, WorkerTarget } from "./runner/Connection"
-import type { ExecutionOptions } from "./execution"
 import * as Importer from "./importer"
-import { SecureRandom } from "effect/crypto"
+import type { LocalTarget, WorkerTarget } from "./runner/Connection"
+import { resolveEntry } from "./runner/Packages"
 
 export const boundary = Effect.fnUntraced(function* (field: string) {
 	const entry = yield* Entry.CurrentId
@@ -77,7 +78,11 @@ export const loadContract = Effect.fnUntraced(function* (specifier: string) {
 /** Direct execution installs only its execution capability in a private realm. */
 export const direct = (
 	provider: Plugin.Plugin,
-	consumer: Plugin.Plugin,
+	consumer: Effect.Effect<
+		Plugin.Plugin,
+		ModuleResolver.ModuleInvalid,
+		Scope.Scope
+	>,
 	input: Schema.Json,
 	key: typeof LocalTransport | typeof WorkerTransport,
 ): Effect.Effect<Fork.Fork<never, unknown>, never, Graft.Graft | Scope.Scope> =>
@@ -89,7 +94,8 @@ export const direct = (
 				yield* follow(capability, (cause) =>
 					Effect.fail(Assembly.CapabilityFailed.make({ cause })),
 				)
-				const execution = yield* Graft.plugin(consumer, input)
+				const definition = yield* consumer
+				const execution = yield* Graft.plugin(definition, input)
 				yield* follow(execution, (cause) =>
 					Effect.fail(Assembly.CapabilityFailed.make({ cause })),
 				)
@@ -132,17 +138,48 @@ const directTarget = Effect.fnUntraced(function* <
 		},
 		"connect",
 	)
-	return yield* direct(
-		capability.plugin,
+
+	const watch = yield* ModuleResolver.Watch
+	const resolver = yield* Effect.serviceOption(ModuleResolver.ModuleResolver)
+	const current: Effect.Effect<
+		Contract.Contract<Contract.ConfigSchema, Contract.ErrorSchema>,
+		ModuleResolver.ModuleInvalid,
+		Scope.Scope
+	> = Option.isSome(watch) && Option.isSome(resolver)
+		? resolver.value.importModule(module).pipe(
+				Effect.flatMap((namespace) =>
+					Effect.fromOption(Contract.fromModule(namespace), () =>
+						ModuleResolver.ModuleInvalid.make({
+							specifier: module,
+							cause: "Expected a remote contract",
+						}),
+					),
+				),
+			)
+		: Effect.succeed(contract)
+	const loaded = yield* current
+	const consumer = Effect.succeed(
 		executionPlugin(
-			contract,
+			loaded,
 			{ ...options, contractModule: module },
 			selected,
 			annotations,
 		),
+	)
+	if (Option.isSome(watch)) {
+		const implementation = String.startsWith("file:")(loaded.module)
+			? loaded.module
+			: yield* resolveEntry(directory, loaded.module)
+		yield* ModuleResolver.observe([module, implementation])
+	}
+	const fork = yield* direct(
+		capability.plugin,
+		consumer,
 		input.config,
 		selected._tag === "Local" ? LocalTransport : WorkerTransport,
 	)
+
+	return fork
 })
 const runnerTarget = Effect.fnUntraced(function* <
 	S extends Schema.Top & {

package/src/internal/entryConfig.ts

@@ -1,122 +1,12 @@
-import { Effect, Schema } from "effect"
-import { PositiveDuration } from "./config"
+import {
+	Reference,
+	RunnerAuthentication,
+	type Authentication,
+	type Connect,
+	type Listen,
+} from "../Config"
 
-export const Reference = Schema.Struct({
-	name: Schema.String,
-	config: Schema.optionalKey(Schema.Unknown),
-})
-export type Reference = typeof Reference.Type
-const absent = Schema.optionalKey(Schema.Never)
-const authFields = {
-	name: absent,
-	config: absent,
-	mtls: absent,
-	bearer: absent,
-	jwt: absent,
-	none: absent,
-}
-export const Authentication = Schema.Union([
-	Schema.Struct({
-		...authFields,
-		name: Schema.String,
-		config: Schema.optionalKey(Schema.Unknown),
-	}),
-	Schema.Struct({ ...authFields, mtls: Schema.Unknown }),
-	Schema.Struct({ ...authFields, bearer: Schema.Unknown }),
-	Schema.Struct({ ...authFields, jwt: Schema.Unknown }),
-	Schema.Struct({ ...authFields, none: Schema.Unknown }),
-])
-const transportFields = {
-	url: absent,
-	unix: absent,
-	command: absent,
-	stdio: absent,
-	local: absent,
-	worker: absent,
-	transport: absent,
-}
-const auth = Schema.optionalKey(Authentication)
-const common = {
-	instance: Schema.optionalKey(Schema.String),
-	lease: Schema.optionalKey(PositiveDuration),
-	margin: Schema.optionalKey(PositiveDuration),
-	expect: Schema.optionalKey(
-		Schema.Struct({
-			version: Schema.optionalKey(Schema.String),
-			digest: Schema.optionalKey(Schema.String),
-		}),
-	),
-}
-const network = {
-	...transportFields,
-	...common,
-	auth,
-	url: Schema.String,
-	ca: Schema.optionalKey(Schema.String),
-	servername: Schema.optionalKey(Schema.String),
-}
-export const Connect = Schema.Union([
-	Schema.Struct(network),
-	Schema.Struct({ ...transportFields, ...common, auth, unix: Schema.String }),
-	Schema.Struct({
-		...transportFields,
-		...common,
-		command: Schema.NonEmptyArray(Schema.String),
-		auth: Schema.optionalKey(
-			Schema.Never.annotate({
-				message: "Direct and stdio transports do not accept auth",
-			}),
-		),
-		cwd: Schema.optionalKey(Schema.String),
-		env: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
-	}),
-	Schema.Struct({
-		...transportFields,
-		auth: Schema.optionalKey(
-			Schema.Never.annotate({
-				message: "Direct and stdio transports do not accept auth",
-			}),
-		),
-		local: Schema.Struct({
-			command: Schema.optionalKey(Schema.NonEmptyArray(Schema.String)),
-		}),
-	}),
-	Schema.Struct({
-		...transportFields,
-		auth: Schema.optionalKey(
-			Schema.Never.annotate({
-				message: "Direct and stdio transports do not accept auth",
-			}),
-		),
-		worker: Schema.Struct({
-			execArgv: Schema.optionalKey(Schema.Array(Schema.String)),
-		}),
-	}),
-	Schema.Struct({ ...transportFields, ...common, auth, transport: Reference }),
-])
-export type Connect = typeof Connect.Type
-export const Listen = Schema.Union([
-	Schema.Struct({
-		...transportFields,
-		auth,
-		url: Schema.String,
-		cert: Schema.optionalKey(Schema.String),
-		key: Schema.optionalKey(Schema.String),
-	}),
-	Schema.Struct({ ...transportFields, auth, unix: Schema.String }),
-	Schema.Struct({
-		...transportFields,
-		stdio: Schema.Literal(true),
-		auth: Schema.optionalKey(
-			Schema.Never.annotate({
-				message: "Direct and stdio transports do not accept auth",
-			}),
-		),
-		identity: Schema.optionalKey(Schema.String),
-	}),
-	Schema.Struct({ ...transportFields, auth, transport: Reference }),
-])
-export type Listen = typeof Listen.Type
+export * from "../Config"
 const capability = (
 	side: "host" | "runner",
 	name: string,
@@ -124,7 +14,8 @@ const capability = (
 ): Reference => ({ name: `@graftland/plugin-remote/${side}/${name}`, config })
 export const authentication = (
 	side: "host" | "runner",
-	input: typeof Authentication.Type | undefined,
+	input:
+		typeof Authentication.Type | typeof RunnerAuthentication.Type | undefined,
 ): Reference => {
 	if (input === undefined) return capability(side, "auth/none", {})
 	if (input.name !== undefined) return input
@@ -169,19 +60,6 @@ export const runnerTransport = (input: Listen): Reference => {
 		return capability("runner", "unix", { path: input.unix })
 	return capability("runner", "stdio", {})
 }
-export const Host = Schema.Struct({
-	contract: Schema.String,
-	connect: Connect,
-	config: Schema.Json.pipe(Schema.withDecodingDefaultKey(Effect.succeed({}))),
-})
-export const Runner = Schema.Struct({
-	root: Schema.String,
-	state: Schema.String,
-	lease: Schema.optionalKey(PositiveDuration),
-	grace: Schema.optionalKey(PositiveDuration),
-	listen: Schema.Array(Listen),
-})
-
 export const runnerAuthentication = (input: Listen): Reference =>
 	input.stdio !== undefined
 		? capability("runner", "auth/none", {