@jeffusion/bungee-core 5.18.0 → 5.19.0

package/dist/gateway/contracts.d.ts

@@ -1,5 +1,5 @@
 /** Typed extension stages shared by built-in and project plugins. */
-import type { AppConfig, RouteConfig, CorsConfig } from '@jeffusion/bungee-types';
+import type { AppConfig, RouteConfig, CorsConfig, LLMProtocol } from '@jeffusion/bungee-types';
 import type { ExpressionContext } from '../expression-engine';
 import type { EffectiveRouteConfig, RuntimeUpstream, RequestSnapshot } from '../worker/types';
 import type { HandleRequestRuntimeContext } from './request-plugin';
@@ -24,6 +24,33 @@ export type GatewayBodyRuleArguments = [body: Record<string, any>, rules: Modifi
 export type GatewayHeaderRuleArguments = [headers: Headers, rules: ModificationRules['headers'], context: ExpressionContext];
 export type GatewayCorsArguments = [response: Response, cors: CorsConfig | undefined, request: Request];
 export type GatewayQueryRuleArguments = [params: URLSearchParams, rules: ModificationRules['query'], context: ExpressionContext, requestLog: any];
+export interface GatewayDispatchTarget {
+    readonly type: 'route' | 'service';
+    readonly id: string;
+}
+export interface DispatchRequestInput {
+    readonly context: import('../hooks').MutableRequestContext;
+    readonly targets: readonly (GatewayDispatchTarget & {
+        readonly protocol?: LLMProtocol;
+    })[];
+    readonly principal?: import('../plugin-extensions').DataPrincipal;
+    readonly signal: AbortSignal;
+    readonly servingRevision?: number;
+}
+export interface DispatchRequestDecision {
+    readonly target: GatewayDispatchTarget;
+}
+export interface GatewayDispatchInput extends Omit<DispatchRequestInput, 'targets'> {
+    readonly config: AppConfig;
+    readonly entry: RouteConfig;
+}
+export interface GatewayDispatchDecision {
+    readonly route: RouteConfig;
+    readonly effective: EffectiveRouteConfig;
+    readonly context: import('../hooks').MutableRequestContext;
+    readonly entryRouteId?: string;
+    readonly target?: GatewayDispatchTarget;
+}
 export interface GatewayRouteInput {
     readonly request: Request;
     readonly config: AppConfig;
@@ -107,4 +134,4 @@ export interface GatewayLogResult {
     readonly logger?: RequestLogger;
 }
 /** Provider stages are fixed, required, and registered exactly once at startup. */
-export declare const GATEWAY_PROVIDER_STAGES: readonly ["onGatewayWebSocket", "onGatewayBody", "onGatewayRequest", "onGatewayRoute", "onGatewayAdmission", "onGatewayAdmissionSession", "onGatewayAdmissionPrepare", "onGatewaySelect", "onGatewayFailover", "onGatewayRetry", "onGatewayForward", "onGatewayHeaderRules", "onGatewayCors", "onGatewayBodyRules", "onGatewayQueryRules", "onGatewayResponseRules", "onGatewayLog"];
+export declare const GATEWAY_PROVIDER_STAGES: readonly ["onGatewayWebSocket", "onGatewayBody", "onGatewayRequest", "onGatewayRoute", "onGatewayDispatch", "onGatewayAdmission", "onGatewayAdmissionSession", "onGatewayAdmissionPrepare", "onGatewaySelect", "onGatewayFailover", "onGatewayRetry", "onGatewayForward", "onGatewayHeaderRules", "onGatewayCors", "onGatewayBodyRules", "onGatewayQueryRules", "onGatewayResponseRules", "onGatewayLog"];

package/dist/gateway/dispatch-plugin.d.ts

@@ -0,0 +1,7 @@
+import type { Plugin, PluginHooks } from './plugin';
+export declare class DispatchPlugin implements Plugin {
+    bodyRequirements(): {
+        request: "none";
+    };
+    register(hooks: PluginHooks): void;
+}

package/dist/gateway/dispatch-targets.d.ts

@@ -0,0 +1,4 @@
+import type { PluginConfigField } from '../plugin.types';
+import type { GatewayDispatchTarget } from './contracts';
+/** Extract references only from the trusted schema, never from arbitrary request JSON. */
+export declare function declaredDispatchTargets(options: Record<string, unknown>, fields: readonly PluginConfigField[]): GatewayDispatchTarget[];

package/dist/gateway/plugin.js

@@ -325,6 +325,8 @@ function createPluginHooks() {
     onGatewayBody: new SyncBailHook("onGatewayBody"),
     onGatewayRequest: new AsyncSeriesBailHook("onGatewayRequest"),
     onGatewayRoute: new AsyncSeriesBailHook("onGatewayRoute"),
+    onGatewayDispatch: new AsyncSeriesBailHook("onGatewayDispatch"),
+    onDispatchRequest: new AsyncSeriesBailHook("onDispatchRequest"),
     onGatewayAdmission: new AsyncSeriesBailHook("onGatewayAdmission"),
     onGatewayAdmissionSession: new AsyncSeriesBailHook("onGatewayAdmissionSession"),
     onGatewayAdmissionPrepare: new AsyncSeriesBailHook("onGatewayAdmissionPrepare"),

package/dist/gateway/routing-plugin.d.ts

@@ -1,5 +1,7 @@
-import type { CorsConfig } from '@jeffusion/bungee-types';
+import type { AppConfig, RouteConfig, CorsConfig } from '@jeffusion/bungee-types';
+import type { EffectiveRouteConfig } from '../worker/types';
 import type { Plugin, PluginHooks } from '@jeffusion/bungee-core/plugin';
+export declare function resolveEffectiveRoute(config: AppConfig, route: RouteConfig): EffectiveRouteConfig;
 export declare function applyCorsHeaders(response: Response, cors: CorsConfig | undefined, request: Request): Response;
 export declare class RoutingPlugin implements Plugin {
     bodyRequirements(): {

package/dist/hooks/plugin-hooks.d.ts

@@ -11,7 +11,7 @@ import type { PluginServices } from '../plugin-services';
 import type { PluginStorage, SSEEnvelope } from '../plugin.types';
 import type { InterceptResult, PluginPhase } from '@jeffusion/bungee-types';
 import type { RawResponseResult } from '../plugin-control/contracts';
-import type { GatewayBodyArguments, GatewayRequestArguments, GatewayForwardArguments, GatewayResponseRuleArguments, GatewayBodyRuleArguments, GatewayQueryRuleArguments, GatewayHeaderRuleArguments, GatewayCorsArguments, GatewayRouteInput, GatewayRouteDecision, GatewayAdmissionInput, GatewayAdmissionDecision, GatewayAdmissionSessionInput, GatewayAdmissionPrepareInput, GatewaySelectInput, GatewaySelectDecision, GatewayFailoverInput, GatewayRetryInput, GatewayLogInput, GatewayLogResult } from '../gateway/contracts';
+import type { GatewayBodyArguments, GatewayRequestArguments, GatewayForwardArguments, GatewayResponseRuleArguments, GatewayBodyRuleArguments, GatewayQueryRuleArguments, GatewayHeaderRuleArguments, GatewayCorsArguments, GatewayRouteInput, GatewayRouteDecision, GatewayDispatchInput, GatewayDispatchDecision, DispatchRequestInput, DispatchRequestDecision, GatewayAdmissionInput, GatewayAdmissionDecision, GatewayAdmissionSessionInput, GatewayAdmissionPrepareInput, GatewaySelectInput, GatewaySelectDecision, GatewayFailoverInput, GatewayRetryInput, GatewayLogInput, GatewayLogResult } from '../gateway/contracts';
 import type { WorkerRequestAdmission, PreparedAdmissionAttempt } from '../data-admission/worker';
 import type { FailoverCoordinator } from '../worker/upstream/failover-coordinator';
 import type { ProxyRequestResult } from '../gateway/forward-plugin';
@@ -233,6 +233,8 @@ export interface PluginHooks {
     onGatewayCors: AsyncSeriesBailHook<GatewayCorsArguments, Response>;
     onGatewayRequest: AsyncSeriesBailHook<GatewayRequestArguments, Response>;
     onGatewayRoute: AsyncSeriesBailHook<[GatewayRouteInput], GatewayRouteDecision>;
+    onGatewayDispatch: AsyncSeriesBailHook<[GatewayDispatchInput], GatewayDispatchDecision>;
+    onDispatchRequest: AsyncSeriesBailHook<[DispatchRequestInput], DispatchRequestDecision>;
     onGatewayAdmission: AsyncSeriesBailHook<[GatewayAdmissionInput], GatewayAdmissionDecision>;
     onGatewayAdmissionSession: AsyncSeriesBailHook<[GatewayAdmissionSessionInput], WorkerRequestAdmission>;
     onGatewayAdmissionPrepare: AsyncSeriesBailHook<[GatewayAdmissionPrepareInput], PreparedAdmissionAttempt[]>;

package/dist/main.js

@@ -455,14 +455,17 @@ var require_main = __commonJS(function(exports, module) {
 function validateGatewayTargets(config, schemas, context) {
   if (!schemas)
     return;
-  const routes = new Set(config.routes.map((route) => route.id));
-  const services = new Set(config.services.map((service) => service.id));
+  const routes = new Map(config.routes.map((route) => [route.id, route]));
+  const services = new Map(config.services.map((service) => [service.id, service]));
   const edges = new Map;
   const visit = (value, field, owner, path) => {
     if (field.type === "gateway_target" && value && typeof value === "object") {
       const target = value;
-      if (!(target.type === "route" ? routes : services).has(target.id))
+      const entity = (target.type === "route" ? routes : services).get(target.id);
+      if (!entity)
         context.add("invalid_value", path, "Dispatch target does not exist");
+      else if (!entity.llm_protocol)
+        context.add("invalid_value", path, "Dispatch target requires an explicit receiving protocol");
       const refs = edges.get(owner) ?? new Set;
       refs.add(`${target.type}:${target.id}`);
       edges.set(owner, refs);
@@ -30765,7 +30768,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@jeffusion/bungee-core",
-    version: "5.18.0",
+    version: "5.19.0",
     description: "Bungee reverse proxy core engine",
     main: "./dist/main.js",
     types: "./dist/main.d.ts",
@@ -202919,6 +202922,8 @@ function createPluginHooks() {
     onGatewayBody: new SyncBailHook("onGatewayBody"),
     onGatewayRequest: new AsyncSeriesBailHook("onGatewayRequest"),
     onGatewayRoute: new AsyncSeriesBailHook("onGatewayRoute"),
+    onGatewayDispatch: new AsyncSeriesBailHook("onGatewayDispatch"),
+    onDispatchRequest: new AsyncSeriesBailHook("onDispatchRequest"),
     onGatewayAdmission: new AsyncSeriesBailHook("onGatewayAdmission"),
     onGatewayAdmissionSession: new AsyncSeriesBailHook("onGatewayAdmissionSession"),
     onGatewayAdmissionPrepare: new AsyncSeriesBailHook("onGatewayAdmissionPrepare"),
@@ -202990,6 +202995,23 @@ var init_hooks = __esm(() => {
   init_plugin_hooks();
 });
 
+// src/gateway/dispatch-targets.ts
+function declaredDispatchTargets(options, fields) {
+  const result = [];
+  const walk = (value, field) => {
+    if (field.type === "gateway_target" && value && typeof value === "object") {
+      const target = value;
+      if (["route", "service"].includes(target.type) && typeof target.id === "string")
+        result.push({ type: target.type, id: target.id });
+    } else if (field.type === "array" && field.items && Array.isArray(value))
+      value.forEach((item) => walk(item, field.items));
+    else if (field.type === "object" && field.properties && value && typeof value === "object")
+      field.properties.forEach((property) => walk(value[property.name], property));
+  };
+  fields.forEach((field) => walk(options[field.name], field));
+  return result;
+}
+
 // src/plugin-services/rpc-runtime.ts
 import { isProxy as isProxy4 } from "util/types";
 function positiveLimit2(value, fallback, label) {
@@ -213763,6 +213785,9 @@ ${errorMessages}`);
   getGlobalAdmissionHandlers() {
     return this.globalInstances.map((instance) => instance.handler);
   }
+  getDeclaredDispatchTargets(routeId) {
+    return (this.routeInstances.get(routeId) ?? []).flatMap((instance) => declaredDispatchTargets(instance.config.options ?? {}, this.pluginClasses.get(instance.handler.pluginName)?.configSchema ?? []));
+  }
   async initializeFromConfig(config, dependencies) {
     this.dependencies = dependencies;
     if (dependencies) {
@@ -213835,8 +213860,9 @@ ${errorMessages}`);
           logger2.error({ error: result.error, pluginConfig, routeId }, "Failed to create route plugin instance after retries");
         }
       }
-      if (route.service) {
-        const service = config.services?.find((candidate) => candidate.name === route.service);
+      const dispatchServices = this.getDeclaredDispatchTargets(routeId).filter((target) => target.type === "service").map((target) => config.services?.find((service) => service.id === target.id)).filter((service) => !!service);
+      const relatedServices = [...new Map([...config.services?.filter((service) => service.name === route.service) ?? [], ...dispatchServices].map((service) => [service.name, service])).values()];
+      for (const service of relatedServices) {
         if (service?.plugins?.length) {
           const serviceName = service.name;
           for (const pluginConfig of orderBindings(service.plugins)) {
@@ -213853,7 +213879,15 @@ ${errorMessages}`);
           }
         }
       }
-      const endpoints = resolveEffectiveRouteEndpoints(route, config.services);
+      const endpoints = [...resolveEffectiveRouteEndpoints(route, config.services)];
+      const endpointIds = new Set(endpoints.flatMap((endpoint) => endpoint.id ? [endpoint.id] : []));
+      for (const endpoint of dispatchServices.flatMap((service) => service.endpoints)) {
+        if (endpoint.id && endpointIds.has(endpoint.id))
+          continue;
+        if (endpoint.id)
+          endpointIds.add(endpoint.id);
+        endpoints.push(endpoint);
+      }
       for (const [upstreamIndex, upstream] of endpoints.entries()) {
         const upstreamId = upstream.id || String(upstreamIndex);
         for (const pluginConfig of orderBindings(upstream.plugins || [])) {
@@ -214333,6 +214367,7 @@ var init_contracts = __esm(() => {
     "onGatewayBody",
     "onGatewayRequest",
     "onGatewayRoute",
+    "onGatewayDispatch",
     "onGatewayAdmission",
     "onGatewayAdmissionSession",
     "onGatewayAdmissionPrepare",
@@ -214609,7 +214644,7 @@ class DataAdmissionHost {
     if (this.options.authorizeWorker(worker) !== "active")
       throw new DataAdmissionError(503, "admission_worker_not_active");
     for (const requirement of this.routeRequirements)
-      if (requirement.routeIds.includes(target.routeId) && !this.plugins.some((runtime) => runtime.publication.name === requirement.plugin && runtime.plugin.resolveIdentity))
+      if ((requirement.routeIds.includes(target.routeId) || !!target.entryRouteId && requirement.routeIds.includes(target.entryRouteId)) && !this.plugins.some((runtime) => runtime.publication.name === requirement.plugin && runtime.plugin.resolveIdentity))
         throw new DataAdmissionError(503, "route_protection_unavailable");
     let principal = ANONYMOUS_PRINCIPAL;
     for (const runtime of this.plugins)
@@ -214620,7 +214655,7 @@ class DataAdmissionHost {
           throw normalizeAdmissionError(error) ?? new DataAdmissionError(503, "route_protection_unavailable");
         }
       }
-    if (principal.domain === "anonymous" && this.routeRequirements.some((requirement) => requirement.routeIds.includes(target.routeId)))
+    if (principal.domain === "anonymous" && this.routeRequirements.some((requirement) => requirement.routeIds.includes(target.routeId) || !!target.entryRouteId && requirement.routeIds.includes(target.entryRouteId)))
       throw new DataAdmissionError(503, "route_protection_unavailable");
     const requirements = {};
     for (const runtime of this.plugins) {
@@ -214651,7 +214686,7 @@ class DataAdmissionHost {
     if (this.options.authorizeWorker(worker) !== "active")
       throw new DataAdmissionError(503, "admission_worker_not_active");
     for (const requirement of this.routeRequirements) {
-      if (requirement.routeIds.includes(target.routeId) && !this.plugins.some((p) => p.publication.name === requirement.plugin && p.plugin.resolveIdentity)) {
+      if ((requirement.routeIds.includes(target.routeId) || !!target.entryRouteId && requirement.routeIds.includes(target.entryRouteId)) && !this.plugins.some((p) => p.publication.name === requirement.plugin && p.plugin.resolveIdentity)) {
         throw new DataAdmissionError(503, "route_protection_unavailable");
       }
     }
@@ -214667,10 +214702,10 @@ class DataAdmissionHost {
           throw new DataAdmissionError(503, "route_protection_unavailable");
         }
       }
-    if (principal.domain === "anonymous" && this.routeRequirements.some((r) => r.routeIds.includes(target.routeId)))
+    if (principal.domain === "anonymous" && this.routeRequirements.some((r) => r.routeIds.includes(target.routeId) || !!target.entryRouteId && r.routeIds.includes(target.entryRouteId)))
       throw new DataAdmissionError(503, "route_protection_unavailable");
     const ticket = this.previews.get(target.requestId);
-    if (!preview && expectedVersion !== undefined && (!ticket || ticket.version !== this.version || ticket.expires <= this.now() || ticket.worker !== workerKey(worker) || ticket.target.attemptId !== target.attemptId || ticket.target.url !== target.url || ticket.target.model !== target.model || ticket.target.routeId !== target.routeId || JSON.stringify(ticket.target.principal) !== JSON.stringify(principal) || ticket.target.serviceId !== target.serviceId || ticket.target.upstreamId !== target.upstreamId)) {
+    if (!preview && expectedVersion !== undefined && (!ticket || ticket.version !== this.version || ticket.expires <= this.now() || ticket.worker !== workerKey(worker) || ticket.target.attemptId !== target.attemptId || ticket.target.url !== target.url || ticket.target.model !== target.model || ticket.target.routeId !== target.routeId || ticket.target.entryRouteId !== target.entryRouteId || JSON.stringify(ticket.target.principal) !== JSON.stringify(principal) || ticket.target.serviceId !== target.serviceId || ticket.target.upstreamId !== target.upstreamId)) {
       throw new DataAdmissionError(409, "admission_preview_changed");
     }
     const nowTarget = Object.freeze({ ...target, principal, now: !preview && ticket ? ticket.target.now : this.now() });
@@ -214716,7 +214751,7 @@ class DataAdmissionHost {
           plan.runtime.state = plan.state;
       }
     this.previews.delete(target.requestId);
-    this.grants.set(target.requestId, { routeId: target.routeId, sourcePrincipal: structuredClone(target.principal), worker: workerKey(worker), grant, plugins: this.plugins.map((runtime) => ({ publication: runtime.publication, plugin: runtime.plugin, state: null })), expires: null });
+    this.grants.set(target.requestId, { entryRouteId: target.entryRouteId, routeId: target.routeId, sourcePrincipal: structuredClone(target.principal), worker: workerKey(worker), grant, plugins: this.plugins.map((runtime) => ({ publication: runtime.publication, plugin: runtime.plugin, state: null })), expires: null });
     return grant;
   }
   beforeAttempt(target, worker) {
@@ -214739,7 +214774,7 @@ class DataAdmissionHost {
       stored.expires = this.now() + 15000;
   }
   assertGrant(stored, target, worker) {
-    if (stored.worker !== workerKey(worker) || stored.routeId !== target.routeId || JSON.stringify(stored.sourcePrincipal) !== JSON.stringify(target.principal) || !["active", "retired"].includes(this.options.authorizeWorker(worker)))
+    if (stored.worker !== workerKey(worker) || stored.routeId !== target.routeId || stored.entryRouteId !== target.entryRouteId || JSON.stringify(stored.sourcePrincipal) !== JSON.stringify(target.principal) || !["active", "retired"].includes(this.options.authorizeWorker(worker)))
       throw new DataAdmissionError(403, "admission_identity_mismatch");
   }
 }
@@ -221778,7 +221813,7 @@ async function executeHttpRequestInternal(req, config, runtimeContextOrSelector,
 === Incoming Request ===`);
     const routeMatchStart = performance.now();
     const routeDecision = requireGatewayResult(await gatewayHooks().onGatewayRoute.promise({ request: req, config }), "onGatewayRoute");
-    const route = routeDecision.route;
+    let route = routeDecision.route;
     if (!route) {
       logger2.error({ request: requestLog }, `No route found for path: ${url.pathname}`);
       success = false;
@@ -221793,39 +221828,62 @@ async function executeHttpRequestInternal(req, config, runtimeContextOrSelector,
       originalHeaders[key] = value;
     });
     reqLogger.setOriginalRequestHeaders(redactRequestHeaders(originalHeaders));
-    routeId = route.path;
-    routeServiceName = route.service;
-    const currentRouteId = route.path;
-    const effectiveRoute = requireGatewayResult(routeDecision.effective, "onGatewayRoute");
-    const endpoints = effectiveRoute.endpoints;
-    const runtimeStateKey = route.service ?? route.path;
     if (hasWorkerAdmissionSession() && !trustedIdentity) {
       success = false;
       responseStatus = 401;
       return finalizeLocalResponse(Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } }));
     }
+    if (routeDecision.response) {
+      responseStatus = routeDecision.response.status;
+      success = responseStatus < 400;
+      return routeDecision.responseKind === "rule" ? finalizeRootStreamingResponse(routeDecision.response) : finalizeLocalResponse(routeDecision.response);
+    }
+    const snapshotStart = performance.now();
+    const processingDeadline = AbortSignal.timeout(route.timeouts?.request_ms ?? 30000);
+    const processingSignal = AbortSignal.any([req.signal, processingDeadline]);
+    const requestSnapshot = await createRequestSnapshot(req, config.body_parser_limit, processingSignal, originalBody, { requestId, attemptId: requestId, direction: "request", stage: "original-request", version: 0, contentType: req.headers.get("content-type") ?? "", contentEncoding: req.headers.get("content-encoding") ?? "" });
+    requestBodySource = requestSnapshot.bodySource;
+    const entryRoute = route;
+    const dispatchContext = createPhaseContext(requestSnapshot, requestId, entryRoute.path, entryRoute.service);
+    const dispatchHooks = requestRegistry?.getRoutePrecompiledHooks?.(entryRoute.path);
+    if (dispatchHooks?.hooks.onDispatchRequest.hasCallbacks()) {
+      await readSnapshotJson(requestSnapshot, "internal-dispatch", true);
+      dispatchContext.body = structuredClone(requestSnapshot.body);
+    }
+    const dispatch = requireGatewayResult(await gatewayHooks().onGatewayDispatch.promise({
+      config,
+      entry: entryRoute,
+      context: dispatchContext,
+      signal: processingSignal,
+      principal: trustedIdentity?.principal,
+      servingRevision: runtimeContext?.servingRevision
+    }), "onGatewayDispatch");
+    route = dispatch.route;
+    if (dispatch.target) {
+      requestSnapshot.body = dispatch.context.body;
+      reqLogger.addStep("internal_dispatch", { entry: entryRoute.id ?? entryRoute.path, target: dispatch.target, model: dispatch.context.body?.model });
+    }
+    routeId = route.path;
+    routeServiceName = route.service;
+    const currentRouteId = route.path;
+    const effectiveRoute = dispatch.effective;
+    const endpoints = effectiveRoute.endpoints;
+    const runtimeStateKey = route.service ?? route.path;
     if (trustedIdentity) {
       for (const handler of admissionHandlers)
         retainOwner(handler.pluginName);
       dataAdmission = requireGatewayResult(await gatewayHooks().onGatewayAdmissionSession.promise({ handlers: admissionHandlers, identity: {
         requestId,
         principal: trustedIdentity.principal,
+        ...dispatch.entryRouteId ? { entryRouteId: dispatch.entryRouteId } : {},
         routeId: route.id ?? currentRouteId,
         serviceId: route.service_id ?? config.services?.find((service) => service.name === route.service)?.id ?? null
       }, invoke: (plugin, method, payload, target) => requestRegistry.invokeAdmissionRpc(plugin, method, payload, target, ownerLeases.get(`${plugin}\x00global`)) }), "onGatewayAdmissionSession");
     }
-    if (routeDecision.response) {
-      responseStatus = routeDecision.response.status;
-      success = responseStatus < 400;
-      return routeDecision.responseKind === "rule" ? finalizeRootStreamingResponse(routeDecision.response) : finalizeLocalResponse(routeDecision.response);
-    }
-    const snapshotStart = performance.now();
-    const processingDeadline = AbortSignal.timeout(effectiveRoute.timeouts?.request_ms ?? 30000);
-    const processingSignal = AbortSignal.any([req.signal, processingDeadline]);
-    const requestSnapshot = await createRequestSnapshot(req, config.body_parser_limit, processingSignal, originalBody, { requestId, attemptId: requestId, direction: "request", stage: "original-request", version: 0, contentType: req.headers.get("content-type") ?? "", contentEncoding: req.headers.get("content-encoding") ?? "" });
-    requestBodySource = requestSnapshot.bodySource;
     const demandHooks = requestRegistry?.getPrecompiledHooks(currentRouteId, undefined, routeServiceName);
     const demandContext = createPhaseContext(requestSnapshot, requestId, currentRouteId, routeServiceName);
+    if (dispatch.target)
+      demandContext.url = new URL(dispatch.context.url);
     applyRoutePathRewriteToContext(demandContext, route, requestLog);
     const routeDemand = collectPluginBodyRequirements([demandHooks?.routePhase, demandHooks?.servicePhase], {
       requestId,
@@ -221844,7 +221902,7 @@ async function executeHttpRequestInternal(req, config, runtimeContextOrSelector,
     const routeNeedsBody = analyzeExpressionDependencies(routeRequestDemand, "request").requestBody || analyzeExpressionDependencies(route.response, "response").requestBody;
     if (routeDemand.replay || route.retry?.enabled || effectiveRoute.failover?.enabled)
       await requestBodySource?.buffer("configured-replay");
-    if (selectionNeedsBody || routeNeedsBody || routeDemand.request !== "none")
+    if (!requestSnapshot.is_json_body && (selectionNeedsBody || routeNeedsBody || routeDemand.request !== "none"))
       await readSnapshotJson(requestSnapshot, selectionNeedsBody ? "selection-expression" : routeDemand.request !== "none" ? "plugin-body-demand" : "route-expression", routeDemand.request === "json-write" && !["GET", "HEAD"].includes(req.method));
     reqLogger.addStep("request_body_plan", { mode: requestBodySource?.mode, reasons: requestBodySource?.reasons ?? [], replay: requestBodySource?.replayable ?? false, source: "wire" });
     reqLogger.addStepWithDuration("request_snapshot_created", performance.now() - snapshotStart, {
@@ -221863,6 +221921,11 @@ async function executeHttpRequestInternal(req, config, runtimeContextOrSelector,
       method: req.method,
       env: process.env
     };
+    if (dispatch.target && entryRoute.id !== route.id) {
+      const entryAdmission = requireGatewayResult(await gatewayHooks().onGatewayAdmission.promise({ route: entryRoute, trustedPeer: getTrustedWorkerPeer(req), context: expressionContext, servingRevision: runtimeContext?.servingRevision, signal: processingSignal }), "onGatewayAdmission");
+      if (!entryAdmission.allowed)
+        throw new DataAdmissionError(entryAdmission.retryAfterMs === undefined ? 503 : 429, "entry_route_rate_limited");
+    }
     const rateLimit = requireGatewayResult(await gatewayHooks().onGatewayAdmission.promise({
       route,
       trustedPeer: getTrustedWorkerPeer(req),
@@ -221891,7 +221954,9 @@ async function executeHttpRequestInternal(req, config, runtimeContextOrSelector,
     const scopedRegistry = requestRegistry;
     const requestPhaseHooks = scopedRegistry?.getPrecompiledHooks(currentRouteId, undefined, routeServiceName) ?? null;
     const phaseContext = createPhaseContext(requestSnapshot, requestId, currentRouteId, routeServiceName);
-    phaseContext.bodyWrite = routeDemand.request === "json-write";
+    phaseContext.bodyWrite = !!dispatch.target || routeDemand.request === "json-write";
+    if (dispatch.target)
+      phaseContext.url = new URL(dispatch.context.url);
     phaseContext.bodyRequirements = routeDemand;
     applyRoutePathRewriteToContext(phaseContext, route, requestLog);
     const routePhaseResponse = await executePreFailoverPhase(requestPhaseHooks?.routePhase, phaseContext, {
@@ -222942,6 +223007,49 @@ var init_routing_plugin = __esm(() => {
   init_endpoint_resolver();
 });
 
+// src/gateway/dispatch-plugin.ts
+class DispatchPlugin {
+  bodyRequirements() {
+    return { request: "none" };
+  }
+  register(hooks) {
+    hooks.onGatewayDispatch.tapPromise("builtin.dispatch", async ({ config, entry, context, signal, principal, servingRevision }) => {
+      const registry = getScopedPluginRegistry();
+      const references = registry?.getDeclaredDispatchTargets?.(entry.path) ?? [];
+      const targets = references.map((target) => {
+        const entity = (target.type === "route" ? config.routes : config.services ?? []).find((entity) => entity.id === target.id);
+        return { ...target, protocol: entity?.llm_protocol };
+      });
+      const dispatch = await registry?.getRoutePrecompiledHooks?.(entry.path)?.hooks.onDispatchRequest.promise({ context, signal, principal, servingRevision, targets });
+      if (!dispatch)
+        return { route: entry, effective: resolveEffectiveRoute(config, entry), context };
+      if (!targets.some((target) => target.type === dispatch.target.type && target.id === dispatch.target.id))
+        throw new DataAdmissionError(403, "dispatch_target_not_declared");
+      signal.throwIfAborted();
+      let route;
+      if (dispatch.target.type === "route") {
+        const target = config.routes.find((route) => route.id === dispatch.target.id);
+        if (!target || target.id === entry.id || target.direct_response?.enabled || target.redirect?.enabled || target.response_rules?.some((rule) => rule.enabled))
+          throw new DataAdmissionError(422, "dispatch_target_unavailable");
+        route = target;
+        const suffix = context.url.pathname.startsWith(entry.path) ? context.url.pathname.slice(entry.path.length) : "";
+        context.url.pathname = target.path.replace(/\/$/, "") + suffix;
+      } else {
+        const service = config.services?.find((service) => service.id === dispatch.target.id);
+        if (!service)
+          throw new DataAdmissionError(422, "dispatch_target_unavailable");
+        route = { ...entry, service: service.name, service_id: service.id, endpoints: undefined };
+      }
+      return { route, effective: resolveEffectiveRoute(config, route), context, entryRouteId: entry.id ?? entry.path, target: dispatch.target };
+    });
+  }
+}
+var init_dispatch_plugin = __esm(() => {
+  init_errors();
+  init_scoped_plugin_registry();
+  init_routing_plugin();
+});
+
 // src/rate-limit/json.ts
 class RateLimitJsonScanner {
   content;
@@ -224575,7 +224683,9 @@ function exact3(value, keys) {
 }
 function parseAdmissionTarget(value) {
   const target = object(value);
-  exact3(target, ["requestId", "attemptId", "principal", "routeId", "serviceId", "upstreamId", "url", "model", "now"]);
+  exact3(target, ["requestId", "attemptId", "principal", "routeId", "serviceId", "upstreamId", "url", "model", "now", ...Object.hasOwn(target, "entryRouteId") ? ["entryRouteId"] : []]);
+  if (Object.hasOwn(target, "entryRouteId") && (typeof target.entryRouteId !== "string" || !target.entryRouteId || target.entryRouteId.length > 256))
+    throw new Error("invalid RPC entry route");
   for (const name of ["requestId", "attemptId", "routeId", "upstreamId", "url"])
     if (typeof target[name] !== "string" || !target[name].length || target[name].length > (name === "url" ? 65536 : 256))
       throw new Error("invalid RPC target");
@@ -230573,6 +230683,7 @@ function gatewayBuiltins() {
     new BodyServicePlugin,
     new HttpRequestPlugin,
     new RoutingPlugin,
+    new DispatchPlugin,
     new AdmissionPlugin,
     new SelectionPlugin,
     new RetryPlugin,
@@ -230633,6 +230744,7 @@ var init_runtime = __esm(() => {
   init_contracts();
   init_request_plugin();
   init_forward_plugin();
+  init_dispatch_plugin();
   init_routing_plugin();
   init_admission_plugin();
   init_selection_plugin();

package/dist/plugin-extensions.d.ts

@@ -31,6 +31,8 @@ export interface ManagementProvider {
     sessionCookie?(request: Request): string | undefined;
 }
 export interface AdmissionTarget {
+    /** Host-pinned entry scope for one internal handoff. */
+    readonly entryRouteId?: string;
     readonly requestId: string;
     readonly attemptId: string;
     readonly principal: DataPrincipal;