the-moby-effect 1.51.0 → 1.51.1

package/src/MobyPlatforms.ts

@@ -6,16 +6,16 @@
 
 import type * as HttpClient from "@effect/platform/HttpClient";
 import type * as Socket from "@effect/platform/Socket";
-import type * as MobyConnection from "./MobyConnection.js";
+import type * as MobyConnection from "./MobyConnection.ts";
 
 import type * as Layer from "effect/Layer";
-import * as internalAgnostic from "./internal/platforms/agnostic.js";
-import * as internalBun from "./internal/platforms/bun.js";
-import * as internalDeno from "./internal/platforms/deno.js";
-import * as internalFetch from "./internal/platforms/fetch.js";
-import * as internalNode from "./internal/platforms/node.js";
-import * as internalUndici from "./internal/platforms/undici.js";
-import * as internalWeb from "./internal/platforms/web.js";
+import * as internalAgnostic from "./internal/platforms/agnostic.ts";
+import * as internalBun from "./internal/platforms/bun.ts";
+import * as internalDeno from "./internal/platforms/deno.ts";
+import * as internalFetch from "./internal/platforms/fetch.ts";
+import * as internalNode from "./internal/platforms/node.ts";
+import * as internalUndici from "./internal/platforms/undici.ts";
+import * as internalWeb from "./internal/platforms/web.ts";
 
 /**
  * Given the moby connection options, it will construct a layer that provides a

package/src/MobySchemas.ts

@@ -5,7 +5,7 @@
  */
 
 /** @since 1.0.0 */
-export * from "./internal/generated/index.js";
+export * from "./internal/generated/index.ts";
 
 /** @since 1.0.0 */
 export * from "./internal/schemas/id.ts";

package/src/PodmanEngine.ts

@@ -6,12 +6,12 @@
 
 import type * as HttpClient from "@effect/platform/HttpClient";
 import type * as Socket from "@effect/platform/Socket";
-import type * as MobyConnection from "./MobyConnection.js";
+import type * as MobyConnection from "./MobyConnection.ts";
 
 import * as Function from "effect/Function";
 import * as Layer from "effect/Layer";
-import * as MobyEndpoints from "./MobyEndpoints.js";
-import * as MobyPlatforms from "./MobyPlatforms.js";
+import * as MobyEndpoints from "./MobyEndpoints.ts";
+import * as MobyPlatforms from "./MobyPlatforms.ts";
 
 /**
  * @since 1.0.0

package/src/Promises.ts

@@ -5,15 +5,15 @@
  */
 
 import type * as Layer from "effect/Layer";
-import type * as MobySchemas from "./MobySchemas.js";
+import type * as MobySchemas from "./MobySchemas.ts";
 
 import * as Chunk from "effect/Chunk";
 import * as Effect from "effect/Effect";
 import * as Function from "effect/Function";
 import * as ManagedRuntime from "effect/ManagedRuntime";
 import * as Stream from "effect/Stream";
-import * as DockerEngine from "./DockerEngine.js";
-import * as MobyConvey from "./MobyConvey.js";
+import * as DockerEngine from "./DockerEngine.ts";
+import * as MobyConvey from "./MobyConvey.ts";
 
 /**
  * Create a promise client for the docker engine

package/src/internal/demux/multiplexed.ts

@@ -70,6 +70,15 @@ export const isMultiplexedChannel = <IE = unknown, OE = Socket.SocketError, R =
     u: unknown
 ): u is MobyDemux.MultiplexedChannel<IE, IE | OE, R> => Predicate.hasProperty(u, MultiplexedChannelTypeId);
 
+/** @internal */
+export const never: MobyDemux.MultiplexedChannel<never, never, never> = makeMultiplexedChannel<never, never, never>(
+    Channel.never
+);
+
+/** @internal */
+export const neverWith = <IE>(): MobyDemux.MultiplexedChannel<IE, IE, never> =>
+    makeMultiplexedChannel<IE, never, never>(Channel.never);
+
 /** @internal */
 export const responseIsMultiplexedResponse = (response: HttpClientResponse.HttpClientResponse): boolean =>
     response.headers["content-type"] === MultiplexedContentType;

package/src/internal/demux/raw.ts

@@ -65,6 +65,12 @@ export const isRawChannel = <IE = unknown, OE = Socket.SocketError, R = never>(
     u: unknown
 ): u is MobyDemux.RawChannel<IE, IE | OE, R> => Predicate.hasProperty(u, RawChannelTypeId);
 
+/** @internal */
+export const never: MobyDemux.RawChannel<never, never, never> = makeRawChannel<never, never, never>(Channel.never);
+
+/** @internal */
+export const neverWith = <IE>(): MobyDemux.RawChannel<IE, IE, never> => makeRawChannel<IE, never, never>(Channel.never);
+
 /** @internal */
 export const responseIsRawResponse = (response: HttpClientResponse.HttpClientResponse): boolean =>
     response.headers["content-type"] === RawContentType;

package/src/internal/endpoints/auth.ts

@@ -0,0 +1,120 @@
+import { HttpClient, HttpClientRequest, type HttpApiEndpoint } from "@effect/platform";
+import { Effect, Layer, Option, pipe, Predicate, Redacted, type Array } from "effect";
+
+import { DockerError } from "./circular.ts";
+import { System } from "./system.js";
+
+/**
+ * @since 1.0.0
+ * @category Auth
+ * @see https://docs.docker.com/reference/api/engine/version/v1.51/#section/Authentication
+ */
+export class RegistryAuth extends Effect.Service<RegistryAuth>()(
+    "the-moby-effect/endpoints/httpApiHacks/RegistryAuth",
+    {
+        accessors: false,
+        dependencies: [],
+        effect: (authHeader: Redacted.Redacted<string>) =>
+            Effect.gen(function* () {
+                return { authHeader } as const;
+            }),
+    }
+) {
+    /**
+     * @since 1.0.0
+     * @category Auth
+     * @see https://docs.docker.com/reference/api/engine/version/v1.51/#section/Authentication
+     */
+    static readonly Live = RegistryAuth.Default;
+
+    /**
+     * @since 1.0.0
+     * @category Auth
+     * @see https://docs.docker.com/reference/api/engine/version/v1.51/#section/Authentication
+     */
+    static readonly Credentials = (credentials: {
+        serverAddress?: string | undefined;
+        username: Redacted.Redacted<string>;
+        password: Redacted.Redacted<string>;
+        email?: Redacted.Redacted<string> | undefined;
+    }) =>
+        Layer.sync(RegistryAuth, () => {
+            const encoded = Buffer.from(
+                JSON.stringify({
+                    serveraddress: credentials.serverAddress,
+                    username: Redacted.value(credentials.username),
+                    password: Redacted.value(credentials.password),
+                    email: credentials.email ? Redacted.value(credentials.email) : undefined,
+                })
+            ).toString("base64");
+
+            const redacted = Redacted.make(encoded);
+            return RegistryAuth.make({ authHeader: redacted });
+        });
+
+    /**
+     * @since 1.0.0
+     * @category Auth
+     * @see https://docs.docker.com/reference/api/engine/version/v1.51/#section/Authentication
+     */
+    static readonly Token = (credentials: {
+        serverAddress?: string | undefined;
+        username: Redacted.Redacted<string>;
+        password: Redacted.Redacted<string>;
+        email?: Redacted.Redacted<string> | undefined;
+    }) =>
+        pipe(
+            System.use((systems) =>
+                systems.auth({
+                    serveraddress: credentials.serverAddress,
+                    username: Redacted.value(credentials.username),
+                    password: Redacted.value(credentials.password),
+                    email: credentials.email ? Redacted.value(credentials.email) : undefined,
+                })
+            ),
+            Effect.flatMap((response) => {
+                const WrapError = DockerError.WrapForModule("system")("auth");
+
+                if (Predicate.isObject(response) && "IdentityToken" in response) {
+                    return Effect.succeed(response.IdentityToken);
+                }
+
+                return WrapError(new Error("Registry authentication returned no response"));
+            }),
+            Effect.map((token) =>
+                RegistryAuth.make({
+                    authHeader: Redacted.make(token),
+                })
+            ),
+            Layer.effect(RegistryAuth)
+        );
+}
+
+/**
+ * @since 1.0.0
+ * @category Auth
+ * @see https://docs.docker.com/reference/api/engine/version/v1.51/#section/Authentication
+ */
+export const WithRegistryAuthHeader = (
+    ...sendHeaderWithEndpoints: Array.NonEmptyReadonlyArray<HttpApiEndpoint.HttpApiEndpoint.Any & { path: string }>
+) =>
+    HttpClient.mapRequestEffect(
+        Effect.fn("HttpApiHacks.withRegistryAUthHeader")(function* (request: HttpClientRequest.HttpClientRequest) {
+            const url = HttpClientRequest.toUrl(request);
+            if (Option.isNone(url)) {
+                return request;
+            }
+
+            if (!sendHeaderWithEndpoints.some((endpoint) => url.value.pathname.startsWith(endpoint.path))) {
+                return request;
+            }
+
+            const auth = yield* Effect.serviceOption(RegistryAuth);
+            if (Option.isNone(auth)) {
+                return request;
+            }
+
+            const header = Redacted.value(auth.value.authHeader);
+            return HttpClientRequest.setHeader(request, "X-Registry-Auth", header);
+        })
+    );

package/src/internal/endpoints/containers.ts

@@ -512,7 +512,7 @@ export class Containers extends Effect.Service<Containers>()("@the-moby-effect/e
                 )({
                     path: { identifier },
                     urlParams: { ...options },
-                    headers: { Connection: "Upgrade", Upgrade: "tcp" },
+                    headers: { Connection: "Upgrade", Upgrade: "tcp" }, // FIXME: Broken on undici
                 }),
                 ContainersError("attach")
             );
@@ -522,7 +522,10 @@ export class Containers extends Effect.Service<Containers>()("@the-moby-effect/e
                     ContainersApi,
                     "containers",
                     "attachWebsocket"
-                )({ path: { identifier }, urlParams: { ...options } }).pipe(Effect.provide(context)),
+                )({
+                    path: { identifier },
+                    urlParams: { ...options },
+                }).pipe(Effect.provide(context)),
                 ContainersError("attachWebsocket")
             );
         const wait_ = (identifier: ContainerIdentifier, options?: Options<"wait">) =>
@@ -550,7 +553,7 @@ export class Containers extends Effect.Service<Containers>()("@the-moby-effect/e
                     Effect.flatMap(
                         HttpClientResponse.schemaHeaders(
                             Schema.Struct({
-                                "X-Docker-Container-Path-Stat": Schema.compose(
+                                "x-docker-container-path-stat": Schema.compose(
                                     Schema.StringFromBase64,
                                     Schema.parseJson()
                                 ).pipe(Schema.optional),
@@ -558,7 +561,7 @@ export class Containers extends Effect.Service<Containers>()("@the-moby-effect/e
                         )
                     )
                 )
-                .pipe(Effect.map(({ "X-Docker-Container-Path-Stat": pathStat }) => pathStat))
+                .pipe(Effect.map(({ "x-docker-container-path-stat": pathStat }) => pathStat))
                 .pipe(Effect.mapError(ContainersError("archiveInfo")));
         const putArchive_ = <E, R>(
             identifier: ContainerIdentifier,

package/src/internal/endpoints/execs.ts

@@ -24,7 +24,12 @@ const createExecEndpoint = HttpApiEndpoint.post("container", "/containers/:id/ex
 /** @see https://docs.docker.com/reference/api/engine/latest/#tag/Exec/operation/ExecStart */
 const startExecEndpoint = HttpApiEndpoint.post("start", "/exec/:id/start")
     .setPath(Schema.Struct({ id: ExecIdentifier }))
-    .setHeaders(Schema.Struct({ Upgrade: Schema.Literal("tcp"), Connection: Schema.Literal("Upgrade") }))
+    .setHeaders(
+        Schema.Struct({
+            Upgrade: Schema.Literal("tcp"),
+            Connection: Schema.Literal("Upgrade"),
+        })
+    )
     .setPayload(ContainerExecStartOptions)
     .addSuccess(HttpApiSchema.Empty(101))
     .addSuccess(HttpApiSchema.Empty(200))
@@ -102,7 +107,7 @@ export class Execs extends Effect.Service<Execs>()("@the-moby-effect/endpoints/E
             )({
                 path: { id },
                 payload: ContainerExecStartOptions.make(payload),
-                headers: { Connection: "Upgrade", Upgrade: "tcp" },
+                headers: { Connection: "Upgrade", Upgrade: "tcp" }, // FIXME: Broken on undici
             })
                 .pipe(
                     Effect.map(

package/src/internal/endpoints/images.ts

@@ -1,6 +1,7 @@
 import { HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup, HttpApiSchema, HttpClient } from "@effect/platform";
 import { Effect, Schema, Stream, type Layer } from "effect";
 
+import * as ParseResult from "effect/ParseResult";
 import { MobyConnectionOptions } from "../../MobyConnection.js";
 import { makeAgnosticHttpClientLayer } from "../../MobyPlatforms.js";
 import { mapError } from "../convey/sinks.ts";
@@ -13,6 +14,7 @@ import {
     JSONMessage,
     RegistrySearchResult,
 } from "../generated/index.js";
+import { WithRegistryAuthHeader } from "./auth.ts";
 import { DockerError } from "./circular.ts";
 import {
     BadRequest,
@@ -38,8 +40,20 @@ export class ListFilters extends Schema.parseJson(
 /** @since 1.0.0 */
 export class SearchFilters extends Schema.parseJson(
     Schema.Struct({
-        "is-official": Schema.optional(Schema.BooleanFromString),
-        "is-automated": Schema.optional(Schema.BooleanFromString),
+        "is-official": Schema.transformOrFail(Schema.Tuple(Schema.String), Schema.BooleanFromString, {
+            decode: (_fromA, _options, ast) =>
+                ParseResult.fail(
+                    new ParseResult.Forbidden(ast, _fromA, "Decoding 'is-official' filter is not supported")
+                ),
+            encode: (automated) => ParseResult.succeed([automated] as const),
+        }).pipe(Schema.optional),
+        "is-automated": Schema.transformOrFail(Schema.Tuple(Schema.String), Schema.BooleanFromString, {
+            decode: (_fromA, _options, ast) =>
+                ParseResult.fail(
+                    new ParseResult.Forbidden(ast, _fromA, "Decoding 'is-automated' filter is not supported")
+                ),
+            encode: (automated) => ParseResult.succeed([automated] as const),
+        }).pipe(Schema.optional),
         stars: Schema.optional(Schema.NumberFromString),
     })
 ) {}
@@ -155,7 +169,7 @@ const historyImageEndpoint = HttpApiEndpoint.get("history", "/images/:name/histo
 const pushImageEndpoint = HttpApiEndpoint.post("push", "/images/:name/push")
     .setPath(Schema.Struct({ name: Schema.String }))
     .setUrlParams(Schema.Struct({ tag: Schema.optional(Schema.String), platform: Schema.optional(Schema.String) }))
-    .setHeaders(Schema.Struct({ "X-Registry-Auth": Schema.String }))
+    .setHeaders(Schema.Struct({ "X-Registry-Auth": Schema.optional(Schema.String) }))
     .addSuccess(HttpApiSchema.Empty(200))
     .addError(NotFound); // 404 No such image
 
@@ -203,7 +217,7 @@ const pruneImagesEndpoint = HttpApiEndpoint.post("prune", "/images/prune")
     .addSuccess(
         Schema.Struct({
             SpaceReclaimed: Schema.Number,
-            ImagesDeleted: Schema.optional(Schema.Array(ImageDeleteResponse)),
+            ImagesDeleted: Schema.NullishOr(Schema.Array(ImageDeleteResponse)),
         }),
         { status: 200 }
     );
@@ -297,7 +311,11 @@ export class Images extends Effect.Service<Images>()("@the-moby-effect/endpoints
                 HttpApiEndpoint.HttpApiEndpoint.WithName<(typeof ImagesGroup.endpoints)[number], Name>
             >;
 
-        const httpClient = yield* HttpClient.HttpClient;
+        const httpClient = yield* Effect.map(
+            HttpClient.HttpClient,
+            WithRegistryAuthHeader(buildImageEndpoint, createImageEndpoint, pushImageEndpoint)
+        );
+
         const ImagesError = DockerError.WrapForModule("images");
         const client = yield* HttpApiClient.group(ImagesApi, { group: "images", httpClient });
 
@@ -328,8 +346,8 @@ export class Images extends Effect.Service<Images>()("@the-moby-effect/endpoints
                 "create",
                 httpClient
             )({
+                headers: {},
                 urlParams: { ...options },
-                headers: { "X-Registry-Auth": undefined },
             })
                 .pipe(Stream.decodeText())
                 .pipe(Stream.splitLines)
@@ -349,7 +367,7 @@ export class Images extends Effect.Service<Images>()("@the-moby-effect/endpoints
             )({
                 path: { name },
                 urlParams: { ...options },
-                headers: { "X-Registry-Auth": "" },
+                headers: {},
             })
                 .pipe(Stream.decodeText())
                 .pipe(Stream.splitLines)
@@ -367,25 +385,42 @@ export class Images extends Effect.Service<Images>()("@the-moby-effect/endpoints
         const commit_ = (payload: ContainerCreateRequest, options: Options<"commit">) =>
             Effect.mapError(client.commit({ urlParams: { ...options }, payload }), ImagesError("commit"));
         const export_ = (name: string, options?: Options<"export">) =>
-            Stream.mapError(
-                HttpApiStreamingResponse(
-                    ImagesApi,
-                    "images",
-                    "export",
-                    httpClient
-                )({ path: { name }, urlParams: { ...options } }),
-                ImagesError("export")
-            );
+            HttpApiStreamingResponse(
+                ImagesApi,
+                "images",
+                "export",
+                httpClient
+            )({ path: { name }, urlParams: { ...options } })
+                .pipe(Stream.decodeText())
+                .pipe(Stream.splitLines)
+                .pipe(Stream.mapEffect(Schema.decode(Schema.parseJson(JSONMessage))))
+                .pipe(mapError)
+                .pipe(Stream.mapError(ImagesError("export")));
         const exportMany_ = (options?: Options<"exportMany">) =>
-            Stream.mapError(
-                HttpApiStreamingResponse(ImagesApi, "images", "exportMany", httpClient)({ urlParams: { ...options } }),
-                ImagesError("exportMany")
-            );
+            HttpApiStreamingResponse(
+                ImagesApi,
+                "images",
+                "exportMany",
+                httpClient
+            )({ urlParams: { ...options } })
+                .pipe(Stream.decodeText())
+                .pipe(Stream.splitLines)
+                .pipe(Stream.mapEffect(Schema.decode(Schema.parseJson(JSONMessage))))
+                .pipe(mapError)
+                .pipe(Stream.mapError(ImagesError("exportMany")));
         const import_ = <E>(context: Stream.Stream<Uint8Array, E, never>, options?: Options<"import">) =>
-            Stream.mapError(
-                HttpApiStreamingBoth(ImagesApi, "images", "import", httpClient, context)({ urlParams: { ...options } }),
-                ImagesError("import")
-            );
+            HttpApiStreamingBoth(
+                ImagesApi,
+                "images",
+                "import",
+                httpClient,
+                context
+            )({ urlParams: { ...options } })
+                .pipe(Stream.decodeText())
+                .pipe(Stream.splitLines)
+                .pipe(Stream.mapEffect(Schema.decode(Schema.parseJson(JSONMessage))))
+                .pipe(mapError)
+                .pipe(Stream.mapError(ImagesError("import")));
 
         return {
             list: list_,

package/src/internal/endpoints/networks.ts

@@ -81,7 +81,7 @@ const disconnectNetworkEndpoint = HttpApiEndpoint.post("disconnect", "/:id/disco
 /** @see https://docs.docker.com/reference/api/engine/latest/#tag/Network/operation/NetworkPrune */
 const pruneNetworkEndpoint = HttpApiEndpoint.post("prune", "/prune")
     .setUrlParams(Schema.Struct({ filters: Schema.optional(PruneFilters) }))
-    .addSuccess(Schema.Struct({ NetworksDeleted: Schema.optional(Schema.Array(Schema.String)) }), { status: 200 });
+    .addSuccess(Schema.Struct({ NetworksDeleted: Schema.NullishOr(Schema.Array(Schema.String)) }), { status: 200 });
 
 /** @see https://docs.docker.com/reference/api/engine/latest/#tag/Network */
 const NetworksGroup = HttpApiGroup.make("networks")
@@ -129,13 +129,19 @@ export class Networks extends Effect.Service<Networks>()("@the-moby-effect/endpo
 
         const list_ = (filters?: Schema.Schema.Type<ListFilters>) =>
             Effect.mapError(client.list({ urlParams: { filters } }), NetworksError("list"));
-        const create_ = (payload: NetworkCreateRequest) =>
-            Effect.mapError(client.create({ payload }), NetworksError("create"));
+        const create_ = (...payload: ConstructorParameters<typeof NetworkCreateRequest>) =>
+            Effect.mapError(client.create({ payload: NetworkCreateRequest.make(...payload) }), NetworksError("create"));
         const inspect_ = (id: string, options?: Options<"inspect">) =>
             Effect.mapError(client.inspect({ path: { id }, urlParams: { ...options } }), NetworksError("inspect"));
         const delete_ = (id: string) => Effect.mapError(client.delete({ path: { id } }), NetworksError("delete"));
-        const connect_ = (id: string, payload: NetworkConnectOptions) =>
-            Effect.mapError(client.connect({ path: { id }, payload }), NetworksError("connect"));
+        const connect_ = (id: string, ...payload: ConstructorParameters<typeof NetworkConnectOptions>) =>
+            Effect.mapError(
+                client.connect({
+                    path: { id },
+                    payload: NetworkConnectOptions.make(...payload),
+                }),
+                NetworksError("connect")
+            );
         const disconnect_ = (
             id: string,
             containerId: ContainerIdentifier,

package/src/internal/endpoints/plugins.ts

@@ -1,18 +1,23 @@
 import { HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup, HttpApiSchema, HttpClient } from "@effect/platform";
-import { Array, Effect, Schema, Stream, type Layer } from "effect";
+import { Array, Effect, ParseResult, Schema, Stream, type Layer } from "effect";
 
 import { MobyConnectionOptions } from "../../MobyConnection.js";
 import { makeAgnosticHttpClientLayer } from "../../MobyPlatforms.js";
 import { mapError } from "../convey/sinks.ts";
 import { JSONMessage, TypesPlugin as Plugin, RuntimePluginPrivilege as PluginPrivilege } from "../generated/index.js";
+import { WithRegistryAuthHeader } from "./auth.ts";
 import { DockerError } from "./circular.ts";
 import { HttpApiStreamingRequest, HttpApiStreamingResponse, InternalServerError, NotFound } from "./httpApiHacks.js";
 
 /** @since 1.0.0 */
 export class ListFilters extends Schema.parseJson(
     Schema.Struct({
-        enabled: Schema.optional(Schema.BooleanFromString),
-        capability: Schema.optional(Schema.String),
+        capability: Schema.optional(Schema.Array(Schema.String)),
+        enabled: Schema.transformOrFail(Schema.Tuple(Schema.String), Schema.BooleanFromString, {
+            decode: (_fromA, _options, ast) =>
+                ParseResult.fail(new ParseResult.Forbidden(ast, _fromA, "Decoding 'enabled' filter is not supported")),
+            encode: (automated) => ParseResult.succeed([automated] as const),
+        }).pipe(Schema.optional),
     })
 ) {}
 
@@ -67,7 +72,8 @@ const upgradePluginEndpoint = HttpApiEndpoint.post("upgrade", "/:name/upgrade")
     .setUrlParams(Schema.Struct({ remote: Schema.String }))
     .setHeaders(Schema.Struct({ "X-Registry-Auth": Schema.optional(Schema.String) }))
     .setPayload(Schema.Array(PluginPrivilege))
-    .addSuccess(HttpApiSchema.NoContent) // 204 No Content
+    .addSuccess(HttpApiSchema.Empty(200)) // 200 OK
+    .addSuccess(HttpApiSchema.Empty(204)) // 204 No Content
     .addError(NotFound); // 404 No such plugin
 
 /** @see https://docs.docker.com/reference/api/engine/latest/#tag/Plugin/operation/PluginCreate */
@@ -132,7 +138,11 @@ export class Plugins extends Effect.Service<Plugins>()("@the-moby-effect/endpoin
                 HttpApiEndpoint.HttpApiEndpoint.WithName<(typeof PluginsGroup.endpoints)[number], Name>
             >;
 
-        const httpClient = yield* HttpClient.HttpClient;
+        const httpClient = yield* Effect.map(
+            HttpClient.HttpClient,
+            WithRegistryAuthHeader(pullPluginEndpoint, upgradePluginEndpoint)
+        );
+
         const PluginsError = DockerError.WrapForModule("plugins");
         const client = yield* HttpApiClient.group(PluginsApi, { group: "plugins", httpClient });
 
@@ -153,7 +163,7 @@ export class Plugins extends Effect.Service<Plugins>()("@the-moby-effect/endpoin
                 "pull",
                 httpClient
             )({
-                headers: { "X-Registry-Auth": undefined },
+                headers: {},
                 urlParams: { remote, name: options?.name },
                 payload: Array.map(options?.privileges ?? [], (privilege) => PluginPrivilege.make(privilege)),
             })
@@ -182,9 +192,9 @@ export class Plugins extends Effect.Service<Plugins>()("@the-moby-effect/endpoin
         ) =>
             Effect.mapError(
                 client.upgrade({
+                    headers: {},
                     path: { name },
                     urlParams: { remote },
-                    headers: { "X-Registry-Auth": "" },
                     payload: Array.map(privileges ?? [], (privilege) => PluginPrivilege.make(privilege)),
                 }),
                 PluginsError("upgrade")

package/src/internal/endpoints/services.ts

@@ -5,6 +5,7 @@ import { MobyConnectionOptions } from "../../MobyConnection.js";
 import { makeAgnosticHttpClientLayer } from "../../MobyPlatforms.js";
 import { SwarmService, SwarmServiceSpec } from "../generated/index.js";
 import { ServiceIdentifier } from "../schemas/id.js";
+import { WithRegistryAuthHeader } from "./auth.ts";
 import { DockerError } from "./circular.ts";
 import {
     BadRequest,
@@ -151,24 +152,38 @@ export class Services extends Effect.Service<Services>()("@the-moby-effect/endpo
                 HttpApiEndpoint.HttpApiEndpoint.WithName<(typeof ServicesGroup.endpoints)[number], Name>
             >;
 
-        const httpClient = yield* HttpClient.HttpClient;
+        const httpClient = yield* Effect.map(
+            HttpClient.HttpClient,
+            WithRegistryAuthHeader(createServiceEndpoint, updateServiceEndpoint)
+        );
+
         const ServicesError = DockerError.WrapForModule("services");
         const client = yield* HttpApiClient.group(ServicesApi, { group: "services", httpClient });
 
         const list_ = (options?: Options<"list">) =>
             Effect.mapError(client.list({ urlParams: { ...options } }), ServicesError("list"));
-        const create_ = (payload: SwarmServiceSpec) =>
-            Effect.mapError(client.create({ payload, headers: { "X-Registry-Auth": "" } }), ServicesError("create"));
+        const create_ = (...payload: ConstructorParameters<typeof SwarmServiceSpec>) =>
+            Effect.mapError(
+                client.create({
+                    headers: {},
+                    payload: SwarmServiceSpec.make(...payload),
+                }),
+                ServicesError("create")
+            );
         const delete_ = (id: string) => Effect.mapError(client.delete({ path: { id } }), ServicesError("delete"));
         const inspect_ = (id: string, options?: Options<"inspect">) =>
             Effect.mapError(client.inspect({ path: { id }, urlParams: { ...options } }), ServicesError("inspect"));
-        const update_ = (id: string, payload: SwarmServiceSpec, options: Options<"update">) =>
+        const update_ = (
+            id: string,
+            options: Options<"update">,
+            ...payload: ConstructorParameters<typeof SwarmServiceSpec>
+        ) =>
             Effect.mapError(
                 client.update({
-                    payload,
+                    headers: {},
                     path: { id },
                     urlParams: { ...options },
-                    headers: { "X-Registry-Auth": "" },
+                    payload: SwarmServiceSpec.make(...payload),
                 }),
                 ServicesError("update")
             );

package/src/internal/endpoints/system.ts

@@ -1,5 +1,5 @@
 import { HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup, HttpApiSchema, HttpClient } from "@effect/platform";
-import { Effect, Schema, Stream, type Layer } from "effect";
+import { Effect, type Layer, Schema, Stream } from "effect";
 
 import { MobyConnectionOptions } from "../../MobyConnection.js";
 import { makeAgnosticHttpClientLayer } from "../../MobyPlatforms.js";

package/src/internal/engines/dind.ts

@@ -103,7 +103,7 @@ const makeDindBinds = <ExposeDindBy extends MobyConnection.MobyConnectionOptions
     Effect.gen(function* () {
         const acquireScopedVolume = Effect.acquireRelease(
             MobyEndpoints.Volumes.use((volumes) => volumes.create({})),
-            ({ Name }) => Effect.orDie(MobyEndpoints.Volumes.use((volumes) => volumes.delete(Name)))
+            ({ Name }) => Effect.orDie(MobyEndpoints.Volumes.use((volumes) => volumes.delete(Name, { force: true })))
         );
 
         const volume1 = yield* acquireScopedVolume;
@@ -111,7 +111,13 @@ const makeDindBinds = <ExposeDindBy extends MobyConnection.MobyConnectionOptions
 
         const tempSocketDirectory = yield* Effect.if(exposeDindBy === "socket", {
             onFalse: () => Effect.succeed(""),
-            onTrue: () => Effect.flatMap(FileSystem.FileSystem, (fs) => fs.makeTempDirectoryScoped()),
+            onTrue: () =>
+                Effect.gen(function* () {
+                    const fs = yield* FileSystem.FileSystem;
+                    const folder = yield* fs.makeTempDirectoryScoped();
+                    yield* fs.chmod(folder, 0o777); // Ew, for github actions where uid != 1000 🤮
+                    return folder;
+                }),
         });
 
         const boundDockerSocket = yield* Effect.if(exposeDindBy === "socket", {

package/src/internal/generated/ContainerConfig.generated.ts

@@ -33,7 +33,7 @@ export class ContainerConfig extends Schema.Class<ContainerConfig>("ContainerCon
             .pipe(Schema.withConstructorDefault(() => null)),
         NetworkDisabled: Schema.optional(Schema.Boolean),
         MacAddress: Schema.optional(Schema.String),
-        OnBuild: Schema.NullOr(Schema.Array(Schema.String))
+        OnBuild: Schema.NullishOr(Schema.Array(Schema.String))
             .pipe(Schema.propertySignature)
             .pipe(Schema.withConstructorDefault(() => null)),
         Labels: Schema.NullOr(Schema.Record({ key: Schema.String, value: Schema.String }))

package/src/internal/generated/ContainerContainerJSONBase.generated.ts

@@ -26,7 +26,7 @@ export class ContainerContainerJSONBase extends Schema.Class<ContainerContainerJ
         AppArmorProfile: Schema.String,
         ExecIDs: Schema.NullOr(Schema.Array(Schema.String)),
         HostConfig: Schema.NullOr(ContainerHostConfig.ContainerHostConfig),
-        GraphDriver: Schema.NullOr(StorageDriverData.StorageDriverData),
+        GraphDriver: Schema.NullishOr(StorageDriverData.StorageDriverData), // optional for docker.io/library/docker:26-dind-rootless
         SizeRw: Schema.optionalWith(EffectSchemas.Number.I64, { nullable: true }),
         SizeRootFs: Schema.optionalWith(EffectSchemas.Number.I64, { nullable: true }),
     },