@maiaos/sdk 0.1.0-canary.2

package/dist/node/http.js

@@ -0,0 +1,258 @@
+import { MAX_NODE_API_BODY_BYTES, NODE_API_AUTHORIZATION_HEADER, NODE_API_COORDINATOR_PRINCIPAL, NODE_API_HTTP_METHOD, NODE_API_INVOCATION_CREDENTIAL_HEADER, NODE_API_JSON_CONTENT_TYPE, NODE_API_OPERATION_PATH, NODE_API_PRINCIPAL_HEADER, NODE_API_SESSION_CREDENTIAL_SCHEME, nodeApiAuthenticationSchema, nodeApiEndpointSchema, nodeApiHttpRequestSchema, nodeApiHttpResponseSchema, nodeApiInvocationAuthenticationSchema, } from "@maiaos/protocol";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import * as Semaphore from "effect/Semaphore";
+import { makeLocalNodeEffectClient, } from "../client/effect.js";
+import { makeLocalNodeEffectRequester, } from "../request/effect.js";
+import { MaiaClientError, } from "../request/index.js";
+import { platformFetch } from "./fetch.js";
+const MAX_HTTP_IN_FLIGHT_REQUESTS = 8;
+const REQUEST_DEADLINE_MS = 5000;
+class NodeApiTransportError extends Data.TaggedError("NodeApiTransportError") {
+}
+const transportError = (reason, message) => new NodeApiTransportError({ message, reason });
+const CLIENT_ERROR_CODES = new Map([
+    ["cancelled", "cancelled"],
+    ["deadline_exceeded", "deadline_exceeded"],
+    ["invalid_response", "invalid_response"],
+    ["outcome_unknown", "outcome_unknown"],
+    ["saturated", "saturated"],
+    ["transport_failure", "transport_failure"],
+]);
+export const toClientError = (error, signal) => {
+    if (error instanceof MaiaClientError)
+        return error;
+    if (signal?.aborted === true) {
+        return new MaiaClientError("cancelled", "The Maia Node API request was cancelled.", { cause: error });
+    }
+    if (error instanceof NodeApiTransportError) {
+        const code = CLIENT_ERROR_CODES.get(error.reason) ?? "transport_failure";
+        return new MaiaClientError(code, error.message, { cause: error });
+    }
+    return new MaiaClientError("transport_failure", "The Maia Node API transport failed.", { cause: error });
+};
+const invalidOptions = () => transportError("transport_failure", "The Maia Node API transport options are invalid.");
+const requireSingleAuthority = (options) => (options.authorizationScheme === "session" &&
+    (options.invocationAuthentication !== undefined ||
+        options.principal !== undefined)) ||
+    (options.principal !== undefined &&
+        options.invocationAuthentication !== undefined)
+    ? Effect.fail(invalidOptions())
+    : Effect.succeed(options);
+const parseOptions = (options) => Effect.try({
+    catch: invalidOptions,
+    try: () => ({
+        authorizationScheme: options.authorizationScheme ?? "bearer",
+        credential: options.credential,
+        endpoint: nodeApiEndpointSchema.parse(options.endpoint),
+        fetch: options.fetch ?? platformFetch(),
+        ...(options.principal === undefined
+            ? {}
+            : { principal: options.principal }),
+        ...(options.invocationAuthentication === undefined
+            ? {}
+            : {
+                invocationAuthentication: nodeApiInvocationAuthenticationSchema.parse(options.invocationAuthentication),
+            }),
+    }),
+});
+const validateCredential = (token) => Effect.try({
+    catch: () => transportError("transport_failure", "The Maia Node API credential is invalid."),
+    try: () => nodeApiAuthenticationSchema.parse({
+        scheme: "maia.node.bearer/v1",
+        token,
+    }).token,
+});
+const credentialUnavailable = () => transportError("transport_failure", "The Maia Node API credential is unavailable.");
+const readCredentialSource = (credential) => {
+    if (typeof credential === "string")
+        return Effect.succeed(credential);
+    return Effect.isEffect(credential)
+        ? Effect.mapError(credential, credentialUnavailable)
+        : Effect.tryPromise({ catch: credentialUnavailable, try: credential });
+};
+export const resolveCredential = (credential) => readCredentialSource(credential).pipe(Effect.flatMap(validateCredential));
+const responseTooLarge = () => new TypeError("Response body exceeds its resource limit.");
+const decodeBody = (bytes, state) => Effect.try({
+    catch: (error) => error,
+    try: () => {
+        if (state.offset === 0)
+            throw new TypeError("Response body is empty.");
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, state.offset));
+    },
+});
+const readBodyChunks = (reader, bytes, state) => Effect.tryPromise({ catch: (error) => error, try: () => reader.read() }).pipe(Effect.flatMap((next) => {
+    if (next.done)
+        return decodeBody(bytes, state);
+    if (state.offset + next.value.byteLength > bytes.byteLength) {
+        return Effect.tryPromise({
+            catch: (error) => error,
+            try: () => reader.cancel("response_too_large"),
+        }).pipe(Effect.andThen(Effect.fail(responseTooLarge())));
+    }
+    bytes.set(next.value, state.offset);
+    state.offset += next.value.byteLength;
+    return readBodyChunks(reader, bytes, state);
+}));
+const readBoundedBody = (body) => Effect.acquireUseRelease(Effect.try({ catch: (error) => error, try: () => body.getReader() }), (reader) => readBodyChunks(reader, new Uint8Array(MAX_NODE_API_BODY_BYTES), {
+    offset: 0,
+}).pipe(Effect.onInterrupt(() => Effect.sync(() => {
+    void reader.cancel().catch(() => false);
+}))), (reader) => Effect.sync(() => {
+    reader.releaseLock();
+}));
+const hasOversizedContentLength = (response) => {
+    const raw = response.headers.get("content-length");
+    if (raw === null || !/^\d+$/u.test(raw))
+        return false;
+    return Number(raw) > MAX_NODE_API_BODY_BYTES;
+};
+const readBoundedResponse = (response) => (hasOversizedContentLength(response) || response.body === null
+    ? Effect.fail(responseTooLarge())
+    : readBoundedBody(response.body)).pipe(Effect.mapError(() => transportError("invalid_response", "The Maia Node API response could not be read within its limits.")));
+const validateResponseMetadata = (response) => {
+    if (response.redirected || response.url === "") {
+        return Effect.fail(transportError("invalid_response", "The Maia Node API returned an invalid HTTP response."));
+    }
+    const contentType = response.headers
+        .get("content-type")
+        ?.split(";", 1)[0]
+        ?.trim();
+    return contentType === NODE_API_JSON_CONTENT_TYPE
+        ? Effect.void
+        : Effect.fail(transportError("invalid_response", "The Maia Node API returned an unsupported response type."));
+};
+const decodeJson = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown));
+const decodeResponseBody = (body) => decodeJson(body).pipe(Effect.flatMap((value) => Effect.try({
+    catch: (error) => error,
+    try: () => nodeApiHttpResponseSchema.parse(value),
+})), Effect.mapError(() => transportError("invalid_response", "The Maia Node API response failed runtime validation.")));
+const decodeHttpResponse = Effect.fn("NodeApiTransport.decodeResponse")(function* (response, requestUrl) {
+    const decoded = yield* validateResponseMetadata(response).pipe(Effect.andThen(readBoundedResponse(response)), Effect.flatMap(decodeResponseBody), Effect.mapError(() => dispatchFailure(true)));
+    if (response.status === 401 &&
+        response.url === requestUrl &&
+        decoded.correlationId === undefined &&
+        !decoded.payload.ok &&
+        decoded.payload.error.code === "authentication_failed") {
+        return yield* Effect.fail(new MaiaClientError("remote_error", "The Maia Node API rejected authentication.", { remoteError: decoded.payload.error }));
+    }
+    return decoded;
+});
+const encodeHttpBody = (envelope) => Effect.try({
+    catch: () => transportError("transport_failure", "The Maia Node API request failed runtime validation."),
+    try: () => JSON.stringify(nodeApiHttpRequestSchema.parse(envelope)),
+}).pipe(Effect.filterOrFail((body) => new TextEncoder().encode(body).byteLength <= MAX_NODE_API_BODY_BYTES, () => transportError("transport_failure", "The Maia Node API request exceeded its resource limit.")));
+const authorizationValue = (options, token) => options.authorizationScheme === "session"
+    ? `${NODE_API_SESSION_CREDENTIAL_SCHEME} ${token}`
+    : `Bearer ${token}`;
+const requestHeaders = (options, token) => {
+    const headers = new Headers([
+        ["content-type", NODE_API_JSON_CONTENT_TYPE],
+        [NODE_API_AUTHORIZATION_HEADER, authorizationValue(options, token)],
+    ]);
+    if (options.invocationAuthentication !== undefined) {
+        headers.set(NODE_API_INVOCATION_CREDENTIAL_HEADER, options.invocationAuthentication.credential);
+    }
+    if (options.principal !== undefined)
+        headers.set(NODE_API_PRINCIPAL_HEADER, NODE_API_COORDINATOR_PRINCIPAL);
+    return headers;
+};
+const dispatchFailure = (dispatched) => dispatched
+    ? transportError("outcome_unknown", "The Maia Node API request outcome is unknown.")
+    : transportError("transport_failure", "The Maia Node API request could not be dispatched.");
+const forwardAbort = (source, target) => {
+    const abort = () => {
+        target.abort(source.reason);
+    };
+    if (source.aborted)
+        abort();
+    else
+        source.addEventListener("abort", abort, { once: true });
+    return () => {
+        source.removeEventListener("abort", abort);
+    };
+};
+const combinedRequestSignal = (effectSignal, callerSignal) => {
+    const controller = new AbortController();
+    const releases = [forwardAbort(effectSignal, controller)];
+    if (callerSignal !== undefined) {
+        releases.push(forwardAbort(callerSignal, controller));
+    }
+    return {
+        release: () => {
+            releases.forEach((release) => {
+                release();
+            });
+        },
+        signal: controller.signal,
+    };
+};
+const dispatchHttpRequest = (input) => Effect.tryPromise({
+    catch: () => dispatchFailure(input.context.dispatchState.dispatched),
+    try: (effectSignal) => {
+        const combined = combinedRequestSignal(effectSignal, input.context.signal);
+        input.context.dispatchState.dispatched = true;
+        return input.options
+            .fetch(`${input.options.endpoint.origin}${NODE_API_OPERATION_PATH}`, {
+            body: input.body,
+            cache: "no-store",
+            credentials: "omit",
+            headers: requestHeaders(input.options, input.token),
+            method: NODE_API_HTTP_METHOD,
+            redirect: "error",
+            referrerPolicy: "no-referrer",
+            signal: combined.signal,
+        })
+            .finally(combined.release);
+    },
+});
+const executeHttpRequest = Effect.fn("NodeApiTransport.request")(function* (context) {
+    const options = yield* requireSingleAuthority(context.options).pipe(Effect.flatMap(parseOptions));
+    if (typeof options.fetch !== "function") {
+        return yield* Effect.fail(transportError("transport_failure", "No Maia Node API HTTP implementation is available."));
+    }
+    const [body, token] = yield* Effect.all([
+        encodeHttpBody(context.envelope),
+        resolveCredential(options.credential),
+    ]);
+    const response = yield* dispatchHttpRequest({
+        body,
+        context,
+        options: { ...options, fetch: options.fetch },
+        token,
+    });
+    return yield* decodeHttpResponse(response, `${options.endpoint.origin}${NODE_API_OPERATION_PATH}`);
+});
+const deadlineFailure = (state) => state.dispatched
+    ? transportError("outcome_unknown", "The Maia Node API request outcome is unknown.")
+    : transportError("deadline_exceeded", "The Maia Node API request deadline expired before dispatch.");
+const admitHttpRequest = (concurrency, context) => concurrency
+    .withPermitsIfAvailable(1)(executeHttpRequest(context).pipe(Effect.timeoutOrElse({
+    duration: REQUEST_DEADLINE_MS,
+    orElse: () => Effect.fail(deadlineFailure(context.dispatchState)),
+})))
+    .pipe(Effect.flatMap((admitted) => Option.isSome(admitted)
+    ? Effect.succeed(admitted.value)
+    : Effect.fail(transportError("saturated", "The Maia Node API transport reached its concurrency limit."))));
+export const makeNodeApiHttpRequest = (options) => {
+    const concurrency = Semaphore.makeUnsafe(MAX_HTTP_IN_FLIGHT_REQUESTS);
+    return (envelope, requestOptions) => {
+        const signal = requestOptions?.signal;
+        return admitHttpRequest(concurrency, {
+            dispatchState: { dispatched: false },
+            envelope,
+            options,
+            ...(signal === undefined ? {} : { signal }),
+        });
+    };
+};
+export const makeNodeApiEffectTransport = (options) => {
+    const request = makeNodeApiHttpRequest(options);
+    return {
+        request: (envelope, requestOptions) => request(envelope, requestOptions).pipe(Effect.mapError((error) => toClientError(error, requestOptions?.signal))),
+    };
+};
+export const createNodeApiEffectClient = (options) => makeLocalNodeEffectClient(makeLocalNodeEffectRequester(makeNodeApiEffectTransport(options)));
+//# sourceMappingURL=http.js.map

package/dist/node/index.d.ts

@@ -0,0 +1,3 @@
+export { acknowledgeAttachedSessionDelivery, type AttachedCurrentContextOptions, type AttachedLocalNodeOptions, checkAttachedSessionInbox, connectNodeApi, type DiscoveredNodeApiConnection, type LocalNodeConnection, type LocalNodeDiscoveryOptions, type NodeApiDiscoveryOptions, sendAttachedSessionMessage, showAttachedCurrentContext, } from "./local-node.js";
+export { attachSession, createNodeApiClient, createNodeApiTransport, type NodeApiConnection, type NodeApiCredential, type NodeApiObservationOptions, type NodeApiObservationRequest, type NodeApiTransportOptions, type SessionAttachOptions, type SessionAttachRequest, subscribeNodeApiObservations, } from "./transport.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/node/index.js

@@ -0,0 +1,3 @@
+export { acknowledgeAttachedSessionDelivery, checkAttachedSessionInbox, connectNodeApi, sendAttachedSessionMessage, showAttachedCurrentContext, } from "./local-node.js";
+export { attachSession, createNodeApiClient, createNodeApiTransport, subscribeNodeApiObservations, } from "./transport.js";
+//# sourceMappingURL=index.js.map

package/dist/node/local-node.d.ts

@@ -0,0 +1,26 @@
+import type { InvocationContextShowResult, LocalNodeStatusResult, SessionInboxAckParameters, SessionInboxAckResult, SessionInboxCheckParameters, SessionInboxCheckResult, SessionMessageSendParameters, SessionMessageSendResult } from "@maiaos/protocol";
+import { type NodeApiConnection } from "./transport.js";
+export type LocalNodeDiscoveryOptions = {
+    readonly principal?: "coordinator";
+    readonly profile?: string;
+    readonly runtimeRootOverride?: string;
+    readonly signal?: AbortSignal;
+};
+export type NodeApiDiscoveryOptions = LocalNodeDiscoveryOptions;
+export type DiscoveredNodeApiConnection = NodeApiConnection & {
+    readonly status: LocalNodeStatusResult;
+};
+export type LocalNodeConnection = DiscoveredNodeApiConnection;
+export declare const principalOf: (options: Pick<NodeApiDiscoveryOptions, "principal">) => {
+    readonly principal?: "coordinator";
+};
+export declare const connectNodeApi: (options?: NodeApiDiscoveryOptions) => Promise<DiscoveredNodeApiConnection>;
+export type AttachedLocalNodeOptions = LocalNodeDiscoveryOptions & {
+    readonly messageId?: string;
+};
+export type AttachedCurrentContextOptions = AttachedLocalNodeOptions;
+export declare const showAttachedCurrentContext: (options?: AttachedCurrentContextOptions) => Promise<InvocationContextShowResult>;
+export declare const sendAttachedSessionMessage: (parameters: SessionMessageSendParameters, options?: AttachedLocalNodeOptions) => Promise<SessionMessageSendResult>;
+export declare const checkAttachedSessionInbox: (parameters: SessionInboxCheckParameters, options?: AttachedLocalNodeOptions) => Promise<SessionInboxCheckResult>;
+export declare const acknowledgeAttachedSessionDelivery: (parameters: SessionInboxAckParameters, options?: AttachedLocalNodeOptions) => Promise<SessionInboxAckResult>;
+//# sourceMappingURL=local-node.d.ts.map

package/dist/node/local-node.js

@@ -0,0 +1,67 @@
+import { createHash, randomBytes } from "node:crypto";
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import * as PlatformError from "effect/PlatformError";
+import { MaiaClientError } from "../request/index.js";
+import { acquireAttachedCredential, attachedTransportOptions, connectDiscoveredNodeApi, discoveryFailure, newMessageId, requireAttachmentPlatform, } from "./discovery.js";
+import { createNodeApiClient } from "./transport.js";
+const digestAlgorithms = {
+    ["SHA-1"]: "sha1",
+    ["SHA-256"]: "sha256",
+    ["SHA-384"]: "sha384",
+    ["SHA-512"]: "sha512",
+};
+const facadeCrypto = Crypto.make({
+    digest: (algorithm, data) => Effect.try({
+        catch: (cause) => PlatformError.systemError({
+            _tag: "Unknown",
+            cause,
+            description: "Could not compute digest",
+            method: "digest",
+            module: "Crypto",
+        }),
+        try: () => Uint8Array.from(createHash(digestAlgorithms[algorithm]).update(data).digest()),
+    }),
+    randomBytes: (size) => randomBytes(size),
+});
+const runFacade = (program, signal) => Effect.runPromise(Effect.provideService(program, Crypto.Crypto, facadeCrypto), signal === undefined ? undefined : { signal });
+export const principalOf = (options) => options.principal === undefined ? {} : { principal: options.principal };
+export const connectNodeApi = (options = {}) => runFacade(connectDiscoveredNodeApi(options, (descriptor, token) => {
+    const client = createNodeApiClient({
+        credential: token,
+        endpoint: descriptor.endpoint,
+        ...principalOf(options),
+    });
+    return {
+        client,
+        status: (messageId) => Effect.tryPromise({
+            catch: (error) => error,
+            try: (signal) => client.status({ messageId, signal }),
+        }),
+    };
+}), options.signal).catch((error) => {
+    if (options.signal?.aborted === true) {
+        throw new MaiaClientError("cancelled", "The Maia Node API discovery was cancelled.", { cause: error });
+    }
+    throw discoveryFailure(error);
+});
+const readAttachedCredential = (options) => runFacade(acquireAttachedCredential(), options.signal).catch((error) => {
+    throw new MaiaClientError(options.signal?.aborted === true ? "cancelled" : "transport_failure", "The inherited Invocation attachment is invalid or unavailable.", { cause: error });
+});
+const attachedLocalNodeClient = (descriptor, credential) => createNodeApiClient(attachedTransportOptions(descriptor, credential, (read) => () => Effect.runPromise(read)));
+const attachedRequestOptions = (prefix, options) => runFacade(options.messageId === undefined
+    ? newMessageId(prefix)
+    : Effect.succeed(options.messageId)).then((messageId) => ({
+    messageId,
+    ...(options.signal === undefined ? {} : { signal: options.signal }),
+}));
+const withAttachedLocalNode = (options, operation) => runFacade(requireAttachmentPlatform())
+    .then(() => connectNodeApi(options))
+    .then((connection) => readAttachedCredential(options).then((credential) => operation(attachedLocalNodeClient(connection.descriptor, credential)).finally(() => {
+    credential.fill(0);
+})));
+export const showAttachedCurrentContext = (options = {}) => withAttachedLocalNode(options, (client) => attachedRequestOptions("context_attached", options).then((requestOptions) => client.showCurrentContext({}, requestOptions)));
+export const sendAttachedSessionMessage = (parameters, options = {}) => withAttachedLocalNode(options, (client) => attachedRequestOptions("session_message", options).then((requestOptions) => client.sendSessionMessage(parameters, requestOptions)));
+export const checkAttachedSessionInbox = (parameters, options = {}) => withAttachedLocalNode(options, (client) => attachedRequestOptions("session_inbox_check", options).then((requestOptions) => client.checkSessionInbox(parameters, requestOptions)));
+export const acknowledgeAttachedSessionDelivery = (parameters, options = {}) => withAttachedLocalNode(options, (client) => attachedRequestOptions("session_inbox_ack", options).then((requestOptions) => client.acknowledgeSessionDelivery(parameters, requestOptions)));
+//# sourceMappingURL=local-node.js.map

package/dist/node/session.d.ts

@@ -0,0 +1,15 @@
+import { type LocalNodeStatusResult } from "@maiaos/protocol";
+import type * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import type { LocalNodeEffectClient } from "../client/effect.js";
+import { MaiaClientError } from "../request/index.js";
+export type SessionNodeApiEffectOptions = {
+    readonly credential: string;
+    readonly origin: string;
+};
+export type SessionNodeApiEffectConnection = {
+    readonly client: LocalNodeEffectClient;
+    readonly status: LocalNodeStatusResult;
+};
+export declare const connectSessionNodeApiEffect: (options: SessionNodeApiEffectOptions) => Effect.Effect<SessionNodeApiEffectConnection, MaiaClientError, Crypto.Crypto>;
+//# sourceMappingURL=session.d.ts.map

package/dist/node/session.js

@@ -0,0 +1,27 @@
+import { NODE_API_OBSERVATION_PATH, NODE_API_OPERATION_PATH, nodeApiEndpointSchema, } from "@maiaos/protocol";
+import * as Effect from "effect/Effect";
+import { MaiaClientError } from "../request/index.js";
+import { newMessageId } from "./discovery.js";
+import { createNodeApiEffectClient } from "./http.js";
+const invalidOrigin = () => new MaiaClientError("transport_failure", "The Maia Node origin of this Session is invalid.");
+const sessionEndpoint = (origin) => Effect.try({
+    catch: invalidOrigin,
+    try: () => nodeApiEndpointSchema.parse({
+        observationPath: NODE_API_OBSERVATION_PATH,
+        operationPath: NODE_API_OPERATION_PATH,
+        origin,
+        transport: "http-websocket",
+    }),
+});
+export const connectSessionNodeApiEffect = (options) => Effect.gen(function* () {
+    const endpoint = yield* sessionEndpoint(options.origin);
+    const client = createNodeApiEffectClient({
+        authorizationScheme: "session",
+        credential: options.credential,
+        endpoint,
+    });
+    const messageId = yield* newMessageId("discovery");
+    const status = yield* client.status({ messageId });
+    return { client, status };
+});
+//# sourceMappingURL=session.js.map

package/dist/node/ssh.d.ts

@@ -0,0 +1,16 @@
+export declare const SSH_OPTIONS: readonly ["-o", "BatchMode=yes", "-o", "ConnectTimeout=15", "-o", "ServerAliveInterval=15", "-o", "ServerAliveCountMax=4", "-o", "ForwardAgent=no", "-o", "ForwardX11=no", "-o", "ClearAllForwardings=yes", "-o", "GSSAPIDelegateCredentials=no", "-o", "PermitLocalCommand=no", "-o", "Tunnel=no", "-o", "ControlMaster=no", "-o", "ControlPath=none", "-o", "SendEnv=-*"];
+export declare const PATH_SEGMENT_PATTERN: RegExp;
+export declare const isPlainAbsolutePath: (path: string) => boolean;
+export declare const shellQuote: (value: string) => string;
+export declare const REMOTE_BOOTSTRAP = "eval \"$(printf %s \"$1\" | base64 -d)\"";
+export declare const encodedScriptBytes: (script: string) => number;
+export declare const bootstrapArguments: (script: string) => readonly string[];
+export declare const remoteCommandWords: (script: string) => readonly string[];
+export declare const sshCommandArguments: (input: {
+    readonly compress?: boolean;
+    readonly host: string;
+    readonly script: string;
+    readonly terminal?: boolean;
+}) => readonly string[];
+export declare const bridgeScript: (launcherPath: string) => string;
+//# sourceMappingURL=ssh.d.ts.map

package/dist/node/ssh.js

@@ -0,0 +1,74 @@
+import { Buffer } from "node:buffer";
+import { REMOTE_NODE_SSH_HOST_PATTERN } from "@maiaos/protocol";
+export const SSH_OPTIONS = [
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "ConnectTimeout=15",
+    "-o",
+    "ServerAliveInterval=15",
+    "-o",
+    "ServerAliveCountMax=4",
+    "-o",
+    "ForwardAgent=no",
+    "-o",
+    "ForwardX11=no",
+    "-o",
+    "ClearAllForwardings=yes",
+    "-o",
+    "GSSAPIDelegateCredentials=no",
+    "-o",
+    "PermitLocalCommand=no",
+    "-o",
+    "Tunnel=no",
+    "-o",
+    "ControlMaster=no",
+    "-o",
+    "ControlPath=none",
+    "-o",
+    "SendEnv=-*",
+];
+export const PATH_SEGMENT_PATTERN = /^(?!\.{1,2}$)[A-Za-z0-9._-]{1,128}$/u;
+const ABSOLUTE_PATH_PATTERN = /^\/[A-Za-z0-9._/-]{1,512}$/u;
+export const isPlainAbsolutePath = (path) => ABSOLUTE_PATH_PATTERN.test(path) &&
+    path
+        .slice(1)
+        .split("/")
+        .every((segment) => PATH_SEGMENT_PATTERN.test(segment));
+export const shellQuote = (value) => `'${value.replaceAll("'", String.raw `'\''`)}'`;
+export const REMOTE_BOOTSTRAP = 'eval "$(printf %s "$1" | base64 -d)"';
+const encodeScript = (script) => Buffer.from(script, "utf8").toString("base64");
+export const encodedScriptBytes = (script) => Math.ceil(Buffer.byteLength(script, "utf8") / 3) * 4;
+export const bootstrapArguments = (script) => [
+    "-c",
+    REMOTE_BOOTSTRAP,
+    "maia-remote",
+    encodeScript(script),
+];
+export const remoteCommandWords = (script) => [
+    "sh",
+    "-c",
+    shellQuote(REMOTE_BOOTSTRAP),
+    "maia-remote",
+    encodeScript(script),
+];
+export const sshCommandArguments = (input) => {
+    if (!REMOTE_NODE_SSH_HOST_PATTERN.test(input.host)) {
+        throw new TypeError("The SSH host is invalid.");
+    }
+    return [
+        ...SSH_OPTIONS,
+        input.terminal === true ? "-t" : "-T",
+        ...(input.compress === true ? ["-o", "Compression=yes"] : []),
+        "--",
+        input.host,
+        ...remoteCommandWords(input.script),
+    ];
+};
+export const bridgeScript = (launcherPath) => {
+    if (!isPlainAbsolutePath(launcherPath)) {
+        throw new TypeError("The launcher path is not a plain absolute path.");
+    }
+    return `exec ${shellQuote(launcherPath)}`;
+};
+//# sourceMappingURL=ssh.js.map

package/dist/node/transport.d.ts

@@ -0,0 +1,52 @@
+import { type NodeApiConnectionDescriptor, type NodeApiEndpoint, type NodeApiInvocationAuthentication, type NodeApiObservationFrame, type NodeApiObservationSubscribe, type SessionAttachFrame, type SessionAttachSubscribe } from "@maiaos/protocol";
+import * as Stream from "effect/Stream";
+import { type LocalNodeClient } from "../client/index.js";
+import { MaiaClientError, type MaiaTransport } from "../request/index.js";
+type Fetch = typeof globalThis.fetch;
+type WebSocketEvent = {
+    readonly data?: unknown;
+};
+type WebSocketCloseEvent = {
+    readonly code?: number;
+    readonly reason?: string;
+};
+type WebSocketLike = {
+    readonly addEventListener: (type: "close" | "error" | "message" | "open", listener: (event: WebSocketCloseEvent | WebSocketEvent) => void) => void;
+    readonly close: (code?: number, reason?: string) => void;
+    readonly readyState?: number;
+    readonly removeEventListener: (type: "close" | "error" | "message" | "open", listener: (event: WebSocketCloseEvent | WebSocketEvent) => void) => void;
+    readonly send: (data: string) => void;
+};
+type WebSocketFactory = (url: string, protocols: readonly string[]) => WebSocketLike;
+export type NodeApiCredential = (() => Promise<string>) | string;
+export type NodeApiTransportOptions = {
+    readonly authorizationScheme?: "bearer" | "session";
+    readonly credential: NodeApiCredential;
+    readonly endpoint: NodeApiEndpoint;
+    readonly fetch?: Fetch;
+    readonly invocationAuthentication?: NodeApiInvocationAuthentication;
+    readonly principal?: "coordinator";
+};
+export type NodeApiConnection = {
+    readonly client: LocalNodeClient;
+    readonly descriptor: NodeApiConnectionDescriptor;
+};
+export type NodeApiObservationRequest = Omit<NodeApiObservationSubscribe, "authentication">;
+export type NodeApiObservationOptions = {
+    readonly credential: NodeApiCredential;
+    readonly endpoint: NodeApiEndpoint;
+    readonly signal?: AbortSignal;
+    readonly subscribe: NodeApiObservationRequest;
+    readonly webSocketFactory?: WebSocketFactory;
+};
+export type SessionAttachRequest = Omit<SessionAttachSubscribe, "authentication">;
+export type SessionAttachOptions = Omit<NodeApiObservationOptions, "subscribe"> & {
+    readonly request: SessionAttachRequest;
+};
+export declare const createNodeApiTransport: (options: NodeApiTransportOptions) => MaiaTransport;
+export declare const createNodeApiClient: (options: NodeApiTransportOptions) => LocalNodeClient;
+export declare const subscribeNodeApiObservations: (options: NodeApiObservationOptions) => AsyncIterable<NodeApiObservationFrame>;
+export declare const makeSessionAttachStream: (options: SessionAttachOptions) => Stream.Stream<SessionAttachFrame, MaiaClientError>;
+export declare const attachSession: (options: SessionAttachOptions) => AsyncIterable<SessionAttachFrame>;
+export {};
+//# sourceMappingURL=transport.d.ts.map