@smthrs/control 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/ControlRpcs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ControlRpcs.d.ts","sourceRoot":"","sources":["../../src/ControlRpcs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAwB,MAAM,QAAQ,CAAA;AAC7E,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EACL,eAAe,EACf,SAAS,EACT,SAAS,EAET,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,YAAY,EACZ,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAQL,KAAK,SAAS,EAOf,MAAM,oBAAoB,CAAA;;;;;;AAE3B;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,qBAErC;CAAG;;AAEJ;;;;;GAKG;AACH,qBAAa,WAAY,SAAQ,gBAEoB;CAAG;AAExD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa;0BACF,CAAC,SAAS,EAAE,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO;EACe,CAAA;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,sDAAsD,CAAA;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,aAAa,qGAMxB,CAAA;AAuBF;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mfAmHC,CAAA;AAEzB;;;;;;;GAOG;AACH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,CACrB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,IAAI,CAAC,EAAE,IAAI,GAAG,SAAS,KACpB,MAAM,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;CACxD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAA;CAC1C;AASD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAG,MAAM,GAAG,SAKrF,CAAA;AAqBD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,iBAAiB,KAAG,aAU/D,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,gBAAgB,aAAa,CAAC,aAAa,CAAC,KAAG,aAO9E,CAAA;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,SAAS,CAAA;CACnF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,eAAe,aAAa,EAAE,UAAS,WAAgB,2CAchF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAAI,SAAS,iBAAiB,2CACY,CAAA;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,YAAW,OAAO,SAAS,CAAC,IAIzD,2CAA8F,CAAA"}

package/dist/cjs/ControlRpcs.js

@@ -0,0 +1,247 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ControlRpcs_exports = {};
+__export(ControlRpcs_exports, {
+  ControlAuth: () => ControlAuth,
+  ControlDefect: () => ControlDefect,
+  ControlPrincipal: () => ControlPrincipal,
+  ControlRpcs: () => ControlRpcs,
+  RunVisibility: () => RunVisibility,
+  anyAuthenticator: () => anyAuthenticator,
+  bearerAuthenticator: () => bearerAuthenticator,
+  bearerCredential: () => bearerCredential,
+  defectMessage: () => defectMessage,
+  layerAuth: () => layerAuth,
+  layerBearerAuth: () => layerBearerAuth,
+  layerNoopAuth: () => layerNoopAuth
+});
+module.exports = __toCommonJS(ControlRpcs_exports);
+var import_NotificationQueue = require("@smthrs/notifications/NotificationQueue");
+var import_effect = require("effect");
+var import_rpc = require("effect/unstable/rpc");
+var import_ControlError = require("./ControlError.js");
+var import_ControlSchema = require("./ControlSchema.js");
+class ControlPrincipal extends import_effect.Context.Service()(
+  "/control/ControlPrincipal"
+) {
+}
+class ControlAuth extends import_rpc.RpcMiddleware.Service()("/control/ControlAuth", { error: import_ControlError.Unauthorized }) {
+}
+const RunVisibility = import_effect.Context.Reference("/control/RunVisibility", { defaultValue: () => ({ seesAllRuns: () => false }) });
+const defectMessage = "Something went wrong on our side. Not your fault.";
+const ControlDefect = import_effect.Schema.Json.pipe(import_effect.Schema.decodeTo(
+  import_effect.Schema.Unknown,
+  import_effect.SchemaTransformation.transform({
+    decode: import_effect.Schema.decodeSync(import_effect.Schema.Defect()),
+    encode: (defect) => typeof defect === "string" ? defect : { name: "Error", message: defectMessage }
+  })
+));
+const mutationErrors = import_effect.Schema.Union([
+  import_ControlError.RunNotFound,
+  import_ControlError.ClaimLost,
+  import_ControlError.InvalidInput,
+  import_ControlError.PersistenceError,
+  import_ControlError.Unavailable,
+  import_ControlError.TransportError,
+  import_ControlError.Unauthorized
+]);
+const resumeErrors = import_effect.Schema.Union([
+  import_ControlError.RunNotFound,
+  import_ControlError.ClaimLost,
+  import_ControlError.CodeDrift,
+  import_ControlError.InvalidInput,
+  import_ControlError.PersistenceError,
+  import_ControlError.Unavailable,
+  import_ControlError.TransportError,
+  import_ControlError.Unauthorized
+]);
+const ControlRpcs = import_rpc.RpcGroup.make(
+  import_rpc.Rpc.make("Plan", {
+    defect: ControlDefect,
+    payload: import_ControlSchema.PlanInputSchema,
+    success: import_ControlSchema.PlanCard,
+    error: import_effect.Schema.Union([import_ControlError.FlowNotFound, import_ControlError.InvalidInput, import_ControlError.PersistenceError, import_ControlError.Unavailable, import_ControlError.TransportError, import_ControlError.Unauthorized])
+  }),
+  import_rpc.Rpc.make("Run", {
+    defect: ControlDefect,
+    payload: import_ControlSchema.RunInputSchema,
+    success: import_ControlSchema.Receipt,
+    error: import_effect.Schema.Union([
+      import_ControlError.RunNotFound,
+      import_ControlError.PlanNotFound,
+      import_ControlError.PlanDenied,
+      import_ControlError.PlanDigestMismatch,
+      import_ControlError.EnvelopeMismatch,
+      import_ControlError.ClaimLost,
+      import_ControlError.CodeDrift,
+      import_ControlError.InvalidInput,
+      import_ControlError.LaunchFailed,
+      import_ControlError.PersistenceError,
+      import_ControlError.Unavailable,
+      import_ControlError.TransportError,
+      import_ControlError.Unauthorized
+    ])
+  }),
+  import_rpc.Rpc.make("Approve", {
+    defect: ControlDefect,
+    payload: import_ControlSchema.ApprovalInputSchema,
+    success: import_ControlSchema.Receipt,
+    error: import_effect.Schema.Union([
+      import_ControlError.PlanDigestMismatch,
+      import_ControlError.EnvelopeMismatch,
+      import_ControlError.AlreadyResolved,
+      import_ControlError.PlanNotFound,
+      import_ControlError.RunNotFound,
+      import_ControlError.CodeDrift,
+      import_ControlError.InvalidInput,
+      import_ControlError.Unauthorized,
+      import_ControlError.PersistenceError,
+      import_ControlError.Unavailable,
+      import_ControlError.TransportError
+    ])
+  }),
+  import_rpc.Rpc.make("Deny", {
+    defect: ControlDefect,
+    payload: import_ControlSchema.ApprovalInputSchema,
+    success: import_ControlSchema.Receipt,
+    error: import_effect.Schema.Union([
+      import_ControlError.PlanDigestMismatch,
+      import_ControlError.EnvelopeMismatch,
+      import_ControlError.AlreadyResolved,
+      import_ControlError.PlanNotFound,
+      import_ControlError.RunNotFound,
+      import_ControlError.CodeDrift,
+      import_ControlError.InvalidInput,
+      import_ControlError.Unauthorized,
+      import_ControlError.PersistenceError,
+      import_ControlError.Unavailable,
+      import_ControlError.TransportError
+    ])
+  }),
+  import_rpc.Rpc.make("Steer", {
+    defect: ControlDefect,
+    payload: import_ControlSchema.SteerInputSchema,
+    success: import_ControlSchema.Receipt,
+    error: import_effect.Schema.Union([
+      import_ControlError.RunNotFound,
+      import_ControlError.InvalidInput,
+      import_ControlError.PersistenceError,
+      import_ControlError.Unavailable,
+      import_ControlError.TransportError,
+      import_ControlError.Unauthorized,
+      import_NotificationQueue.NotificationError
+    ])
+  }),
+  import_rpc.Rpc.make("Signal", {
+    defect: ControlDefect,
+    payload: import_ControlSchema.SignalInputSchema,
+    success: import_ControlSchema.Receipt,
+    error: import_effect.Schema.Union([
+      import_ControlError.RunNotFound,
+      import_ControlError.NoMatchingWait,
+      import_ControlError.InvalidInput,
+      import_ControlError.PersistenceError,
+      import_ControlError.Unavailable,
+      import_ControlError.TransportError,
+      import_ControlError.Unauthorized
+    ])
+  }),
+  import_rpc.Rpc.make("Cancel", { defect: ControlDefect, payload: import_ControlSchema.CancelInputSchema, success: import_ControlSchema.Receipt, error: mutationErrors }),
+  import_rpc.Rpc.make("Resume", {
+    defect: ControlDefect,
+    payload: import_ControlSchema.ResumeInputSchema,
+    success: import_ControlSchema.Receipt,
+    error: resumeErrors
+  }),
+  // `list` and `watch` carry the whole `ControlError` union in their contract,
+  // so they name it once rather than restating its members. Two hand-copied
+  // lists is how `CredentialConflict` came to be a control error the union did
+  // not admit.
+  import_rpc.Rpc.make("List", {
+    defect: ControlDefect,
+    payload: import_ControlSchema.ListRequest,
+    success: import_ControlSchema.ListResponse,
+    error: import_ControlError.ControlErrorSchema
+  }),
+  import_rpc.Rpc.make("Watch", {
+    defect: ControlDefect,
+    payload: import_ControlSchema.WatchFilter,
+    success: import_ControlSchema.ControlEvent,
+    error: import_ControlError.ControlErrorSchema,
+    stream: true
+  })
+).middleware(ControlAuth);
+const authorizationHeader = (headers) => {
+  for (const [name, value] of Object.entries(headers)) {
+    if (name.toLowerCase() === "authorization") return value;
+  }
+  return void 0;
+};
+const bearerCredential = (headers) => {
+  const authorization = authorizationHeader(headers);
+  if (authorization === void 0) return void 0;
+  const match = /^Bearer[\t ]+([^\t ]+)$/i.exec(authorization);
+  return match?.[1];
+};
+const encoder = new TextEncoder();
+const constantTimeTokenEqual = (expected, actual) => {
+  const expectedBytes = encoder.encode(expected);
+  const actualBytes = encoder.encode(actual);
+  const length = Math.max(expectedBytes.length, actualBytes.length);
+  let difference = expectedBytes.length ^ actualBytes.length;
+  for (let index = 0; index < length; index++) {
+    difference |= (expectedBytes[index] ?? 0) ^ (actualBytes[index] ?? 0);
+  }
+  return difference === 0;
+};
+const bearerAuthenticator = (options) => ({
+  authenticate: (headers) => {
+    const credential = bearerCredential(headers);
+    return options.token.length > 0 && credential !== void 0 && constantTimeTokenEqual(options.token, credential) ? import_effect.Effect.succeed({
+      ...options.principal,
+      stampedAt: options.now?.() ?? Date.now()
+    }) : import_effect.Effect.fail(new import_ControlError.Unauthorized({ message: "A valid bearer credential is required" }));
+  }
+});
+const anyAuthenticator = (authenticators) => ({
+  authenticate: (headers, call) => authenticators.reduce(
+    (attempt, authenticator) => import_effect.Effect.catchTag(attempt, "/control/Unauthorized", () => authenticator.authenticate(headers, call)),
+    import_effect.Effect.fail(new import_ControlError.Unauthorized({ message: "A valid bearer credential is required" }))
+  )
+});
+const layerAuth = (authenticator, options = {}) => {
+  const visibility = { seesAllRuns: options.seesAllRuns ?? (() => false) };
+  return import_effect.Layer.succeed(
+    ControlAuth,
+    (effect, call) => import_effect.Effect.flatMap(
+      authenticator.authenticate(call.headers, { rpc: call.rpc._tag, payload: call.payload }),
+      (principal) => effect.pipe(
+        import_effect.Effect.provideService(ControlPrincipal, principal),
+        import_effect.Effect.provideService(RunVisibility, visibility)
+      )
+    )
+  );
+};
+const layerBearerAuth = (options) => layerAuth(bearerAuthenticator(options), { seesAllRuns: () => true });
+const layerNoopAuth = (principal = {
+  id: "test-principal",
+  kind: "test",
+  stampedAt: 0
+}) => layerAuth({ authenticate: () => import_effect.Effect.succeed(principal) }, { seesAllRuns: () => true });
+//# sourceMappingURL=ControlRpcs.js.map

package/dist/cjs/ControlRpcs.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/ControlRpcs.ts"],
+  "sourcesContent": ["/**\n * Schema-backed RPC projection of the control service.\n *\n * @since 0.1.0\n */\n\nimport { NotificationError } from \"@smthrs/notifications/NotificationQueue\"\nimport { Context, Effect, Layer, Schema, SchemaTransformation } from \"effect\"\nimport { Rpc, RpcGroup, RpcMiddleware } from \"effect/unstable/rpc\"\nimport {\n  AlreadyResolved,\n  ClaimLost,\n  CodeDrift,\n  ControlErrorSchema,\n  EnvelopeMismatch,\n  FlowNotFound,\n  InvalidInput,\n  LaunchFailed,\n  NoMatchingWait,\n  PersistenceError,\n  PlanDenied,\n  PlanDigestMismatch,\n  PlanNotFound,\n  RunNotFound,\n  TransportError,\n  Unauthorized,\n  Unavailable\n} from \"./ControlError.ts\"\nimport {\n  ApprovalInputSchema,\n  CancelInputSchema,\n  ControlEvent,\n  ListRequest,\n  ListResponse,\n  PlanCard,\n  PlanInputSchema,\n  type Principal,\n  Receipt,\n  ResumeInputSchema,\n  RunInputSchema,\n  SignalInputSchema,\n  SteerInputSchema,\n  WatchFilter\n} from \"./ControlSchema.ts\"\n\n/**\n * Authenticated principal made available to control RPC handlers.\n *\n * @category services\n * @since 0.1.0\n */\nexport class ControlPrincipal extends Context.Service<ControlPrincipal, typeof Principal.Type>()(\n  \"/control/ControlPrincipal\"\n) {}\n\n/**\n * Middleware boundary that authenticates control RPC requests.\n *\n * @category middleware\n * @since 0.1.0\n */\nexport class ControlAuth extends RpcMiddleware.Service<ControlAuth, {\n  provides: ControlPrincipal\n}>()(\"/control/ControlAuth\", { error: Unauthorized }) {}\n\n/**\n * Which authenticated principals read every run.\n *\n * `List` and `Watch` answer a principal this returns `true` for with every\n * run: that principal is an operator. Every other principal reads only the\n * runs it launched (`RunSummary.launchedBy`) and, from `Watch`, only their\n * events. The authentication layer decides, because it is what knows which\n * identities it can stamp: `layerBearerAuth` and `layerNoopAuth` stamp one\n * principal and make it the operator, and `layerAuth` takes the rule as an\n * option. Where nothing provides one, no principal is an operator.\n *\n * @category services\n * @since 1.0.0\n */\nexport const RunVisibility = Context.Reference<{\n  readonly seesAllRuns: (principal: typeof Principal.Type) => boolean\n}>(\"/control/RunVisibility\", { defaultValue: () => ({ seesAllRuns: () => false }) })\n\n/**\n * The sentence a client reads when a control handler dies.\n *\n * @category defects\n * @since 1.0.0\n */\nexport const defectMessage = \"Something went wrong on our side. Not your fault.\"\n\n/**\n * Wire schema for a control RPC defect: an untyped failure that no procedure\n * declares.\n *\n * Encoding replaces a defect value (an `Error`, a failure an `orDie` turned\n * into a defect, any non-string value) with `{ name: \"Error\", message }`\n * carrying {@link defectMessage}, so a driver message, path, or stack never\n * reaches a client. The server logs the raw defect. A string passes unchanged:\n * the RPC server's own request-decoding sentence, which describes the caller's\n * payload, is one, and so is an author-written `Effect.die` sentence.\n *\n * Decoding is Effect's default `Schema.Defect()` decoding, so a client reads\n * this shape and an older server's shape alike, and an older client reads this\n * shape as an `Error`.\n *\n * @category defects\n * @since 1.0.0\n */\nexport const ControlDefect = Schema.Json.pipe(Schema.decodeTo(\n  Schema.Unknown,\n  SchemaTransformation.transform({\n    decode: Schema.decodeSync(Schema.Defect()),\n    encode: (defect): Schema.Json => typeof defect === \"string\" ? defect : { name: \"Error\", message: defectMessage }\n  })\n))\n\nconst mutationErrors = Schema.Union([\n  RunNotFound,\n  ClaimLost,\n  InvalidInput,\n  PersistenceError,\n  Unavailable,\n  TransportError,\n  Unauthorized\n])\n\nconst resumeErrors = Schema.Union([\n  RunNotFound,\n  ClaimLost,\n  CodeDrift,\n  InvalidInput,\n  PersistenceError,\n  Unavailable,\n  TransportError,\n  Unauthorized\n])\n\n/**\n * The ten remote procedures corresponding to `Control` operations.\n *\n * @category groups\n * @since 0.1.0\n */\nexport const ControlRpcs = RpcGroup.make(\n  Rpc.make(\"Plan\", {\n    defect: ControlDefect,\n    payload: PlanInputSchema,\n    success: PlanCard,\n    error: Schema.Union([FlowNotFound, InvalidInput, PersistenceError, Unavailable, TransportError, Unauthorized])\n  }),\n  Rpc.make(\"Run\", {\n    defect: ControlDefect,\n    payload: RunInputSchema,\n    success: Receipt,\n    error: Schema.Union([\n      RunNotFound,\n      PlanNotFound,\n      PlanDenied,\n      PlanDigestMismatch,\n      EnvelopeMismatch,\n      ClaimLost,\n      CodeDrift,\n      InvalidInput,\n      LaunchFailed,\n      PersistenceError,\n      Unavailable,\n      TransportError,\n      Unauthorized\n    ])\n  }),\n  Rpc.make(\"Approve\", {\n    defect: ControlDefect,\n    payload: ApprovalInputSchema,\n    success: Receipt,\n    error: Schema.Union([\n      PlanDigestMismatch,\n      EnvelopeMismatch,\n      AlreadyResolved,\n      PlanNotFound,\n      RunNotFound,\n      CodeDrift,\n      InvalidInput,\n      Unauthorized,\n      PersistenceError,\n      Unavailable,\n      TransportError\n    ])\n  }),\n  Rpc.make(\"Deny\", {\n    defect: ControlDefect,\n    payload: ApprovalInputSchema,\n    success: Receipt,\n    error: Schema.Union([\n      PlanDigestMismatch,\n      EnvelopeMismatch,\n      AlreadyResolved,\n      PlanNotFound,\n      RunNotFound,\n      CodeDrift,\n      InvalidInput,\n      Unauthorized,\n      PersistenceError,\n      Unavailable,\n      TransportError\n    ])\n  }),\n  Rpc.make(\"Steer\", {\n    defect: ControlDefect,\n    payload: SteerInputSchema,\n    success: Receipt,\n    error: Schema.Union([\n      RunNotFound,\n      InvalidInput,\n      PersistenceError,\n      Unavailable,\n      TransportError,\n      Unauthorized,\n      NotificationError\n    ])\n  }),\n  Rpc.make(\"Signal\", {\n    defect: ControlDefect,\n    payload: SignalInputSchema,\n    success: Receipt,\n    error: Schema.Union([\n      RunNotFound,\n      NoMatchingWait,\n      InvalidInput,\n      PersistenceError,\n      Unavailable,\n      TransportError,\n      Unauthorized\n    ])\n  }),\n  Rpc.make(\"Cancel\", { defect: ControlDefect, payload: CancelInputSchema, success: Receipt, error: mutationErrors }),\n  Rpc.make(\"Resume\", {\n    defect: ControlDefect,\n    payload: ResumeInputSchema,\n    success: Receipt,\n    error: resumeErrors\n  }),\n  // `list` and `watch` carry the whole `ControlError` union in their contract,\n  // so they name it once rather than restating its members. Two hand-copied\n  // lists is how `CredentialConflict` came to be a control error the union did\n  // not admit.\n  Rpc.make(\"List\", {\n    defect: ControlDefect,\n    payload: ListRequest,\n    success: ListResponse,\n    error: ControlErrorSchema\n  }),\n  Rpc.make(\"Watch\", {\n    defect: ControlDefect,\n    payload: WatchFilter,\n    success: ControlEvent,\n    error: ControlErrorSchema,\n    stream: true\n  })\n).middleware(ControlAuth)\n\n/**\n * The call a boundary is authenticating, when it knows one: the procedure's\n * tag and the payload it was sent. An edge authenticating a socket upgrade\n * knows no call and passes none.\n *\n * @category models\n * @since 1.0.0\n */\nexport interface Call {\n  readonly rpc: string\n  readonly payload: unknown\n}\n\n/**\n * Header authenticator used by the control RPC boundary.\n *\n * `call` is present for an in-band RPC frame and absent at a transport edge.\n * An authenticator that grants everything ignores it; one that grants a\n * scope reads it, and admits an edge on the credential alone.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Authenticator {\n  readonly authenticate: (\n    headers: Readonly<Record<string, string>>,\n    call?: Call | undefined\n  ) => Effect.Effect<typeof Principal.Type, Unauthorized>\n}\n\n/**\n * Configuration for the single-token bearer authenticator.\n *\n * Every request carrying the configured token receives the same principal.\n * This is the intentionally small alpha trust boundary, not a per-user\n * authorization system.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface BearerAuthOptions {\n  readonly token: string\n  readonly principal: Omit<typeof Principal.Type, \"stampedAt\">\n  readonly now?: (() => number) | undefined\n}\n\nconst authorizationHeader = (headers: Readonly<Record<string, string>>): string | undefined => {\n  for (const [name, value] of Object.entries(headers)) {\n    if (name.toLowerCase() === \"authorization\") return value\n  }\n  return undefined\n}\n\n/**\n * The bearer credential a request carries, or `undefined` when its\n * `Authorization` header is absent or is not a well-formed bearer scheme.\n *\n * @category getters\n * @since 1.0.0\n */\nexport const bearerCredential = (headers: Readonly<Record<string, string>>): string | undefined => {\n  const authorization = authorizationHeader(headers)\n  if (authorization === undefined) return undefined\n  const match = /^Bearer[\\t ]+([^\\t ]+)$/i.exec(authorization)\n  return match?.[1]\n}\n\nconst encoder = new TextEncoder()\n\n/**\n * Compares UTF-8 credentials without returning early for a secret-dependent\n * byte or length difference.\n */\nconst constantTimeTokenEqual = (expected: string, actual: string): boolean => {\n  const expectedBytes = encoder.encode(expected)\n  const actualBytes = encoder.encode(actual)\n  const length = Math.max(expectedBytes.length, actualBytes.length)\n  let difference = expectedBytes.length ^ actualBytes.length\n\n  for (let index = 0; index < length; index++) {\n    difference |= (expectedBytes[index] ?? 0) ^ (actualBytes[index] ?? 0)\n  }\n\n  return difference === 0\n}\n\n/**\n * Authenticates one shared bearer token and stamps its server-owned principal.\n * Missing, malformed, empty, and incorrect credentials all fail closed with\n * the same `Unauthorized` response.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const bearerAuthenticator = (options: BearerAuthOptions): Authenticator => ({\n  authenticate: (headers) => {\n    const credential = bearerCredential(headers)\n    return options.token.length > 0 && credential !== undefined && constantTimeTokenEqual(options.token, credential)\n      ? Effect.succeed({\n        ...options.principal,\n        stampedAt: options.now?.() ?? Date.now()\n      })\n      : Effect.fail(new Unauthorized({ message: \"A valid bearer credential is required\" }))\n  }\n})\n\n/**\n * The first authenticator to accept a request answers for all of them. Each\n * is asked in order, and a request none accepts fails with the last refusal,\n * or with the plain `Unauthorized` when there is nothing to ask.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const anyAuthenticator = (authenticators: ReadonlyArray<Authenticator>): Authenticator => ({\n  authenticate: (headers, call) =>\n    authenticators.reduce<Effect.Effect<typeof Principal.Type, Unauthorized>>(\n      (attempt, authenticator) =>\n        Effect.catchTag(attempt, \"/control/Unauthorized\", () => authenticator.authenticate(headers, call)),\n      Effect.fail(new Unauthorized({ message: \"A valid bearer credential is required\" }))\n    )\n})\n\n/**\n * Options for {@link layerAuth}.\n *\n * @category models\n * @since 1.0.0\n */\nexport interface AuthOptions {\n  /**\n   * The operators: the principals `List` and `Watch` show every run. Omitted,\n   * every principal reads only the runs it launched. See {@link RunVisibility}.\n   */\n  readonly seesAllRuns?: ((principal: typeof Principal.Type) => boolean) | undefined\n}\n\n/**\n * Provides `ControlAuth` from a transport-header authenticator, telling it\n * which procedure and payload each frame carries. Each authenticated call\n * also receives the {@link RunVisibility} rule for the principal it stamps.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerAuth = (authenticator: Authenticator, options: AuthOptions = {}) => {\n  const visibility = { seesAllRuns: options.seesAllRuns ?? (() => false) }\n  return Layer.succeed(\n    ControlAuth,\n    (effect, call) =>\n      Effect.flatMap(\n        authenticator.authenticate(call.headers, { rpc: call.rpc._tag, payload: call.payload }),\n        (principal) =>\n          effect.pipe(\n            Effect.provideService(ControlPrincipal, principal),\n            Effect.provideService(RunVisibility, visibility)\n          )\n      )\n  )\n}\n\n/**\n * Provides `ControlAuth` using one shared bearer token. Its one principal is\n * the operator and reads every run.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerBearerAuth = (options: BearerAuthOptions) =>\n  layerAuth(bearerAuthenticator(options), { seesAllRuns: () => true })\n\n/**\n * Permissive authentication middleware for tests and trusted in-process use.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerNoopAuth = (principal: typeof Principal.Type = {\n  id: \"test-principal\",\n  kind: \"test\",\n  stampedAt: 0\n}) => layerAuth({ authenticate: () => Effect.succeed(principal) }, { seesAllRuns: () => true })\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,+BAAkC;AAClC,oBAAqE;AACrE,iBAA6C;AAC7C,0BAkBO;AACP,2BAeO;AAQA,MAAM,yBAAyB,sBAAQ,QAAiD;AAAA,EAC7F;AACF,EAAE;AAAC;AAQI,MAAM,oBAAoB,yBAAc,QAE5C,EAAE,wBAAwB,EAAE,OAAO,iCAAa,CAAC,EAAE;AAAC;AAgBhD,MAAM,gBAAgB,sBAAQ,UAElC,0BAA0B,EAAE,cAAc,OAAO,EAAE,aAAa,MAAM,MAAM,GAAG,CAAC;AAQ5E,MAAM,gBAAgB;AAoBtB,MAAM,gBAAgB,qBAAO,KAAK,KAAK,qBAAO;AAAA,EACnD,qBAAO;AAAA,EACP,mCAAqB,UAAU;AAAA,IAC7B,QAAQ,qBAAO,WAAW,qBAAO,OAAO,CAAC;AAAA,IACzC,QAAQ,CAAC,WAAwB,OAAO,WAAW,WAAW,SAAS,EAAE,MAAM,SAAS,SAAS,cAAc;AAAA,EACjH,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,qBAAO,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,MAAM,eAAe,qBAAO,MAAM;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,MAAM,cAAc,oBAAS;AAAA,EAClC,eAAI,KAAK,QAAQ;AAAA,IACf,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO,qBAAO,MAAM,CAAC,kCAAc,kCAAc,sCAAkB,iCAAa,oCAAgB,gCAAY,CAAC;AAAA,EAC/G,CAAC;AAAA,EACD,eAAI,KAAK,OAAO;AAAA,IACd,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO,qBAAO,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAAA,EACD,eAAI,KAAK,WAAW;AAAA,IAClB,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO,qBAAO,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAAA,EACD,eAAI,KAAK,QAAQ;AAAA,IACf,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO,qBAAO,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAAA,EACD,eAAI,KAAK,SAAS;AAAA,IAChB,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO,qBAAO,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAAA,EACD,eAAI,KAAK,UAAU;AAAA,IACjB,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO,qBAAO,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAAA,EACD,eAAI,KAAK,UAAU,EAAE,QAAQ,eAAe,SAAS,wCAAmB,SAAS,8BAAS,OAAO,eAAe,CAAC;AAAA,EACjH,eAAI,KAAK,UAAU;AAAA,IACjB,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO;AAAA,EACT,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,eAAI,KAAK,QAAQ;AAAA,IACf,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO;AAAA,EACT,CAAC;AAAA,EACD,eAAI,KAAK,SAAS;AAAA,IAChB,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO;AAAA,IACP,QAAQ;AAAA,EACV,CAAC;AACH,EAAE,WAAW,WAAW;AAgDxB,MAAM,sBAAsB,CAAC,YAAkE;AAC7F,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,QAAI,KAAK,YAAY,MAAM,gBAAiB,QAAO;AAAA,EACrD;AACA,SAAO;AACT;AASO,MAAM,mBAAmB,CAAC,YAAkE;AACjG,QAAM,gBAAgB,oBAAoB,OAAO;AACjD,MAAI,kBAAkB,OAAW,QAAO;AACxC,QAAM,QAAQ,2BAA2B,KAAK,aAAa;AAC3D,SAAO,QAAQ,CAAC;AAClB;AAEA,MAAM,UAAU,IAAI,YAAY;AAMhC,MAAM,yBAAyB,CAAC,UAAkB,WAA4B;AAC5E,QAAM,gBAAgB,QAAQ,OAAO,QAAQ;AAC7C,QAAM,cAAc,QAAQ,OAAO,MAAM;AACzC,QAAM,SAAS,KAAK,IAAI,cAAc,QAAQ,YAAY,MAAM;AAChE,MAAI,aAAa,cAAc,SAAS,YAAY;AAEpD,WAAS,QAAQ,GAAG,QAAQ,QAAQ,SAAS;AAC3C,mBAAe,cAAc,KAAK,KAAK,MAAM,YAAY,KAAK,KAAK;AAAA,EACrE;AAEA,SAAO,eAAe;AACxB;AAUO,MAAM,sBAAsB,CAAC,aAA+C;AAAA,EACjF,cAAc,CAAC,YAAY;AACzB,UAAM,aAAa,iBAAiB,OAAO;AAC3C,WAAO,QAAQ,MAAM,SAAS,KAAK,eAAe,UAAa,uBAAuB,QAAQ,OAAO,UAAU,IAC3G,qBAAO,QAAQ;AAAA,MACf,GAAG,QAAQ;AAAA,MACX,WAAW,QAAQ,MAAM,KAAK,KAAK,IAAI;AAAA,IACzC,CAAC,IACC,qBAAO,KAAK,IAAI,iCAAa,EAAE,SAAS,wCAAwC,CAAC,CAAC;AAAA,EACxF;AACF;AAUO,MAAM,mBAAmB,CAAC,oBAAiE;AAAA,EAChG,cAAc,CAAC,SAAS,SACtB,eAAe;AAAA,IACb,CAAC,SAAS,kBACR,qBAAO,SAAS,SAAS,yBAAyB,MAAM,cAAc,aAAa,SAAS,IAAI,CAAC;AAAA,IACnG,qBAAO,KAAK,IAAI,iCAAa,EAAE,SAAS,wCAAwC,CAAC,CAAC;AAAA,EACpF;AACJ;AAwBO,MAAM,YAAY,CAAC,eAA8B,UAAuB,CAAC,MAAM;AACpF,QAAM,aAAa,EAAE,aAAa,QAAQ,gBAAgB,MAAM,OAAO;AACvE,SAAO,oBAAM;AAAA,IACX;AAAA,IACA,CAAC,QAAQ,SACP,qBAAO;AAAA,MACL,cAAc,aAAa,KAAK,SAAS,EAAE,KAAK,KAAK,IAAI,MAAM,SAAS,KAAK,QAAQ,CAAC;AAAA,MACtF,CAAC,cACC,OAAO;AAAA,QACL,qBAAO,eAAe,kBAAkB,SAAS;AAAA,QACjD,qBAAO,eAAe,eAAe,UAAU;AAAA,MACjD;AAAA,IACJ;AAAA,EACJ;AACF;AASO,MAAM,kBAAkB,CAAC,YAC9B,UAAU,oBAAoB,OAAO,GAAG,EAAE,aAAa,MAAM,KAAK,CAAC;AAQ9D,MAAM,gBAAgB,CAAC,YAAmC;AAAA,EAC/D,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,WAAW;AACb,MAAM,UAAU,EAAE,cAAc,MAAM,qBAAO,QAAQ,SAAS,EAAE,GAAG,EAAE,aAAa,MAAM,KAAK,CAAC;",
+  "names": []
+}