@mysten-incubation/devstack 0.0.0

package/dist/orchestrators/router/cleanup.mjs

@@ -0,0 +1,58 @@
+import { dispatchFileIdFromFilename, parseDispatchRouteFile } from "./file-provider.mjs";
+import { Effect } from "effect";
+import { existsSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
+import { join } from "node:path";
+//#region src/orchestrators/router/cleanup.ts
+const ROUTER_SHARED_APP = "devstack-router";
+const ROUTER_CONTAINER_NAME_PREFIX = "devstack-router-";
+const routerStateRoot = (runtimeRoot) => join(runtimeRoot, "router");
+const safeDirectories = (dir) => {
+	try {
+		return readdirSync(dir).filter((entry) => statSync(join(dir, entry)).isDirectory());
+	} catch {
+		return [];
+	}
+};
+const removeRouterDispatchFilesForStack = (inputs) => Effect.sync(() => {
+	let removed = 0;
+	for (const profileDir of safeDirectories(routerStateRoot(inputs.runtimeRoot))) {
+		const dispatchDir = join(routerStateRoot(inputs.runtimeRoot), profileDir, "dispatch");
+		if (!existsSync(dispatchDir)) continue;
+		for (const filename of readdirSync(dispatchDir)) {
+			const dispatchFileId = dispatchFileIdFromFilename(filename);
+			if (dispatchFileId === null) continue;
+			const file = join(dispatchDir, filename);
+			let body;
+			try {
+				body = readFileSync(file, "utf8");
+			} catch {
+				continue;
+			}
+			const parsed = parseDispatchRouteFile(body, dispatchFileId);
+			if (parsed._tag === "valid" && parsed.route.lease?.app === inputs.app && parsed.route.lease.stack === inputs.stack) {
+				rmSync(file, { force: true });
+				removed += 1;
+			}
+		}
+	}
+	return removed;
+});
+const removeRouterProfileStateForDockerStack = (inputs) => Effect.sync(() => {
+	if (!inputs.routerStack.startsWith("devstack-router-")) return 0;
+	const fingerprint = inputs.routerStack.slice(16);
+	if (fingerprint.length === 0) return 0;
+	let removed = 0;
+	for (const profileDir of safeDirectories(routerStateRoot(inputs.runtimeRoot))) {
+		if (!profileDir.endsWith(`-${fingerprint}`)) continue;
+		rmSync(join(routerStateRoot(inputs.runtimeRoot), profileDir), {
+			recursive: true,
+			force: true
+		});
+		removed += 1;
+	}
+	return removed;
+});
+//#endregion
+export { ROUTER_CONTAINER_NAME_PREFIX, ROUTER_SHARED_APP, removeRouterDispatchFilesForStack, removeRouterProfileStateForDockerStack };
+
+//# sourceMappingURL=cleanup.mjs.map

package/dist/orchestrators/router/cleanup.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.mjs","names":[],"sources":["../../../src/orchestrators/router/cleanup.ts"],"sourcesContent":["import { existsSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';\nimport { join } from 'node:path';\n\nimport { Effect } from 'effect';\n\nimport { dispatchFileIdFromFilename, parseDispatchRouteFile } from './file-provider.ts';\n\nexport const ROUTER_SHARED_APP = 'devstack-router';\nexport const ROUTER_CONTAINER_NAME_PREFIX = 'devstack-router-';\n\nconst routerStateRoot = (runtimeRoot: string): string => join(runtimeRoot, 'router');\n\nconst safeDirectories = (dir: string): ReadonlyArray<string> => {\n\ttry {\n\t\treturn readdirSync(dir).filter((entry) => statSync(join(dir, entry)).isDirectory());\n\t} catch {\n\t\treturn [];\n\t}\n};\n\nexport const removeRouterDispatchFilesForStack = (inputs: {\n\treadonly runtimeRoot: string;\n\treadonly app: string;\n\treadonly stack: string;\n}): Effect.Effect<number> =>\n\tEffect.sync(() => {\n\t\tlet removed = 0;\n\t\tfor (const profileDir of safeDirectories(routerStateRoot(inputs.runtimeRoot))) {\n\t\t\tconst dispatchDir = join(routerStateRoot(inputs.runtimeRoot), profileDir, 'dispatch');\n\t\t\tif (!existsSync(dispatchDir)) continue;\n\t\t\tfor (const filename of readdirSync(dispatchDir)) {\n\t\t\t\tconst dispatchFileId = dispatchFileIdFromFilename(filename);\n\t\t\t\tif (dispatchFileId === null) continue;\n\t\t\t\tconst file = join(dispatchDir, filename);\n\t\t\t\tlet body: string;\n\t\t\t\ttry {\n\t\t\t\t\tbody = readFileSync(file, 'utf8');\n\t\t\t\t} catch {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst parsed = parseDispatchRouteFile(body, dispatchFileId);\n\t\t\t\tif (\n\t\t\t\t\tparsed._tag === 'valid' &&\n\t\t\t\t\tparsed.route.lease?.app === inputs.app &&\n\t\t\t\t\tparsed.route.lease.stack === inputs.stack\n\t\t\t\t) {\n\t\t\t\t\trmSync(file, { force: true });\n\t\t\t\t\tremoved += 1;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn removed;\n\t});\n\nexport const removeRouterProfileStateForDockerStack = (inputs: {\n\treadonly runtimeRoot: string;\n\treadonly routerStack: string;\n}): Effect.Effect<number> =>\n\tEffect.sync(() => {\n\t\tif (!inputs.routerStack.startsWith(ROUTER_CONTAINER_NAME_PREFIX)) return 0;\n\t\tconst fingerprint = inputs.routerStack.slice(ROUTER_CONTAINER_NAME_PREFIX.length);\n\t\tif (fingerprint.length === 0) return 0;\n\n\t\tlet removed = 0;\n\t\tfor (const profileDir of safeDirectories(routerStateRoot(inputs.runtimeRoot))) {\n\t\t\tif (!profileDir.endsWith(`-${fingerprint}`)) continue;\n\t\t\trmSync(join(routerStateRoot(inputs.runtimeRoot), profileDir), {\n\t\t\t\trecursive: true,\n\t\t\t\tforce: true,\n\t\t\t});\n\t\t\tremoved += 1;\n\t\t}\n\t\treturn removed;\n\t});\n"],"mappings":";;;;;AAOA,MAAa,oBAAoB;AACjC,MAAa,+BAA+B;AAE5C,MAAM,mBAAmB,gBAAgC,KAAK,aAAa,SAAS;AAEpF,MAAM,mBAAmB,QAAuC;AAC/D,KAAI;AACH,SAAO,YAAY,IAAI,CAAC,QAAQ,UAAU,SAAS,KAAK,KAAK,MAAM,CAAC,CAAC,aAAa,CAAC;SAC5E;AACP,SAAO,EAAE;;;AAIX,MAAa,qCAAqC,WAKjD,OAAO,WAAW;CACjB,IAAI,UAAU;AACd,MAAK,MAAM,cAAc,gBAAgB,gBAAgB,OAAO,YAAY,CAAC,EAAE;EAC9E,MAAM,cAAc,KAAK,gBAAgB,OAAO,YAAY,EAAE,YAAY,WAAW;AACrF,MAAI,CAAC,WAAW,YAAY,CAAE;AAC9B,OAAK,MAAM,YAAY,YAAY,YAAY,EAAE;GAChD,MAAM,iBAAiB,2BAA2B,SAAS;AAC3D,OAAI,mBAAmB,KAAM;GAC7B,MAAM,OAAO,KAAK,aAAa,SAAS;GACxC,IAAI;AACJ,OAAI;AACH,WAAO,aAAa,MAAM,OAAO;WAC1B;AACP;;GAED,MAAM,SAAS,uBAAuB,MAAM,eAAe;AAC3D,OACC,OAAO,SAAS,WAChB,OAAO,MAAM,OAAO,QAAQ,OAAO,OACnC,OAAO,MAAM,MAAM,UAAU,OAAO,OACnC;AACD,WAAO,MAAM,EAAE,OAAO,MAAM,CAAC;AAC7B,eAAW;;;;AAId,QAAO;EACN;AAEH,MAAa,0CAA0C,WAItD,OAAO,WAAW;AACjB,KAAI,CAAC,OAAO,YAAY,WAAA,mBAAwC,CAAE,QAAO;CACzE,MAAM,cAAc,OAAO,YAAY,MAAM,GAAoC;AACjF,KAAI,YAAY,WAAW,EAAG,QAAO;CAErC,IAAI,UAAU;AACd,MAAK,MAAM,cAAc,gBAAgB,gBAAgB,OAAO,YAAY,CAAC,EAAE;AAC9E,MAAI,CAAC,WAAW,SAAS,IAAI,cAAc,CAAE;AAC7C,SAAO,KAAK,gBAAgB,OAAO,YAAY,EAAE,WAAW,EAAE;GAC7D,WAAW;GACX,OAAO;GACP,CAAC;AACF,aAAW;;AAEZ,QAAO;EACN"}

package/dist/orchestrators/router/cors.mjs

@@ -0,0 +1,31 @@
+//#region src/orchestrators/router/cors.ts
+const CORS_MIDDLEWARE_NAME = "devstack-cors";
+/** Filename for the shared-middlewares file. The `00-` prefix forces
+*  alphabetic-sort ordering ahead of per-backend dispatch files. */
+const CORS_MIDDLEWARE_FILENAME = "00-shared-middlewares.yml";
+/** Render the permissive shared-CORS middleware as a Traefik
+*  file-provider YAML body. Backends that set `cors: true` reference
+*  this middleware by name (`devstack-cors`) from their per-backend
+*  routers section. */
+const renderCorsMiddlewareYaml = () => {
+	return [
+		`# Devstack shared CORS middleware. Permissive — dev-only.`,
+		`# Architecture distilled-doc §"Shared CORS middleware".`,
+		`http:`,
+		`  middlewares:`,
+		`    ${CORS_MIDDLEWARE_NAME}:`,
+		`      headers:`,
+		`        accessControlAllowOriginList: ["*"]`,
+		`        accessControlAllowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH", "HEAD"]`,
+		`        accessControlAllowHeaders: ["*"]`,
+		`        accessControlExposeHeaders: ["*"]`,
+		`        accessControlAllowCredentials: true`,
+		`        accessControlMaxAge: 86400`,
+		`        addVaryHeader: true`,
+		``
+	].join("\n");
+};
+//#endregion
+export { CORS_MIDDLEWARE_FILENAME, CORS_MIDDLEWARE_NAME, renderCorsMiddlewareYaml };
+
+//# sourceMappingURL=cors.mjs.map

package/dist/orchestrators/router/cors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.mjs","names":[],"sources":["../../../src/orchestrators/router/cors.ts"],"sourcesContent":["// CORS middleware factory.\n//\n// Architecture distilled-doc §\"Shared CORS middleware\":\n//   - ONE shared permissive CORS middleware. Backends opt in by setting\n//     `Routable.cors: true`; the orchestrator wires the middleware\n//     reference into the dispatch file. Backends never write CORS\n//     headers themselves.\n//\n//   - The middleware file is rewritten on each router boot, BEFORE any\n//     per-backend file references it. It sorts lexicographically\n//     ahead of per-backend filenames (we prefix with `00-`) so the\n//     file-provider watcher loads it first.\n//\n//   - Permissive (`*` allow-origin, very long max-age) — fine for the\n//     dev-loop, footgun if copied elsewhere; documented at the call\n//     site, not in production-ready posture.\n\n// The Traefik middleware name baked into the file-provider config. We\n// use a constant so the same string flows through `file-provider.ts`'s\n// route renderer.\nexport const CORS_MIDDLEWARE_NAME = 'devstack-cors';\n\n/** Filename for the shared-middlewares file. The `00-` prefix forces\n *  alphabetic-sort ordering ahead of per-backend dispatch files. */\nexport const CORS_MIDDLEWARE_FILENAME = '00-shared-middlewares.yml';\n\n/** Render the permissive shared-CORS middleware as a Traefik\n *  file-provider YAML body. Backends that set `cors: true` reference\n *  this middleware by name (`devstack-cors`) from their per-backend\n *  routers section. */\nexport const renderCorsMiddlewareYaml = (): string => {\n\t// The YAML body below is hand-rolled (no yaml lib dep) because:\n\t//   - it is a static, fully-controlled string,\n\t//   - the values are constants known at compile time,\n\t//   - we explicitly want byte-identical output cycle-to-cycle so\n\t//     the file-provider watcher doesn't wake on no-op rewrites.\n\treturn [\n\t\t`# Devstack shared CORS middleware. Permissive — dev-only.`,\n\t\t`# Architecture distilled-doc §\"Shared CORS middleware\".`,\n\t\t`http:`,\n\t\t`  middlewares:`,\n\t\t`    ${CORS_MIDDLEWARE_NAME}:`,\n\t\t`      headers:`,\n\t\t`        accessControlAllowOriginList: [\"*\"]`,\n\t\t`        accessControlAllowMethods: [\"GET\", \"POST\", \"PUT\", \"DELETE\", \"OPTIONS\", \"PATCH\", \"HEAD\"]`,\n\t\t`        accessControlAllowHeaders: [\"*\"]`,\n\t\t`        accessControlExposeHeaders: [\"*\"]`,\n\t\t`        accessControlAllowCredentials: true`,\n\t\t`        accessControlMaxAge: 86400`,\n\t\t`        addVaryHeader: true`,\n\t\t``, // trailing newline; Traefik tolerates either way\n\t].join('\\n');\n};\n"],"mappings":";AAoBA,MAAa,uBAAuB;;;AAIpC,MAAa,2BAA2B;;;;;AAMxC,MAAa,iCAAyC;AAMrD,QAAO;EACN;EACA;EACA;EACA;EACA,OAAO,qBAAqB;EAC5B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC,KAAK,KAAK"}

package/dist/orchestrators/router/entrypoints.d.mts

@@ -0,0 +1 @@
+import { Context, Effect, Layer } from "effect";

package/dist/orchestrators/router/entrypoints.mjs

@@ -0,0 +1,80 @@
+import { EntrypointConflict, UnknownEntrypoint } from "./errors.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/orchestrators/router/entrypoints.ts
+var EntrypointRegistry = class extends Context.Service()("@devstack-rewrite/orchestrators/router/EntrypointRegistry") {};
+const entrypointFamily = (protocol) => protocol === "tcp" ? "tcp" : "http";
+/** Build a registry from a literal seed. Idempotent on identical
+*  `(name, port, protocol)` triples; throws synchronously on conflict
+*  per architecture invariant #6. The reason this is synchronous
+*  rather than yielded: registration is module-load wiring, not a
+*  runtime effect — the failure mode is "two callers wired the same
+*  name to different ports", which is a build-time bug.
+*
+*  Traefik cannot bind multiple entrypoints to the same container port.
+*  For HTTP-family aliases on one port, keep every declared name
+*  lookupable but resolve those aliases to the first listener registered
+*  for the port. */
+const makeEntrypointRegistry = (seed) => {
+	const declaredByName = /* @__PURE__ */ new Map();
+	const lookupByName = /* @__PURE__ */ new Map();
+	const listenerByPort = /* @__PURE__ */ new Map();
+	for (const e of seed) {
+		const existing = declaredByName.get(e.name);
+		if (existing) {
+			if (existing.port === e.port && existing.protocol === e.protocol) continue;
+			throw new EntrypointConflict({
+				name: e.name,
+				existing: {
+					port: existing.port,
+					protocol: existing.protocol
+				},
+				attempted: {
+					port: e.port,
+					protocol: e.protocol
+				}
+			});
+		}
+		declaredByName.set(e.name, e);
+		const listener = listenerByPort.get(e.port);
+		if (listener) {
+			const listenerFamily = entrypointFamily(listener.protocol);
+			const attemptedFamily = entrypointFamily(e.protocol);
+			if (listenerFamily === "tcp" || listenerFamily !== attemptedFamily) throw new EntrypointConflict({
+				name: e.name,
+				existing: {
+					port: listener.port,
+					protocol: listener.protocol
+				},
+				attempted: {
+					port: e.port,
+					protocol: e.protocol
+				}
+			});
+			lookupByName.set(e.name, listener);
+			continue;
+		}
+		listenerByPort.set(e.port, e);
+		lookupByName.set(e.name, e);
+	}
+	const frozenListeners = Array.from(listenerByPort.values());
+	const knownNames = Array.from(declaredByName.keys());
+	return {
+		byName: (name) => {
+			const hit = lookupByName.get(name);
+			if (hit) return Effect.succeed(hit);
+			return Effect.fail(new UnknownEntrypoint({
+				name,
+				known: knownNames
+			}));
+		},
+		all: () => frozenListeners
+	};
+};
+/** Layer that pins the registry from a literal seed. The orchestrator
+*  takes this as a substrate dependency; plugins do NOT mutate the
+*  registry — they pick names from it via their Routable contributions. */
+const layerEntrypointRegistry = (seed) => Layer.succeed(EntrypointRegistry)(makeEntrypointRegistry(seed));
+//#endregion
+export { EntrypointRegistry, layerEntrypointRegistry };
+
+//# sourceMappingURL=entrypoints.mjs.map

package/dist/orchestrators/router/entrypoints.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.mjs","names":[],"sources":["../../../src/orchestrators/router/entrypoints.ts"],"sourcesContent":["// Entrypoint registry — a process-global allowlist of named host\n// ports the Traefik container will listen on.\n//\n// Architecture invariants:\n//   #6  — Routables select an entrypoint by *name* from a closed set\n//          populated at module-load time. The set is read ONCE at\n//          router launch.\n//   #12 — Every entrypoint is plain HTTP / h2c / TCP; no TLS surface.\n//          TCP entrypoints bind a host port and dispatch raw bytes to a\n//          single backend (postgres, redis, …); they cannot share the\n//          port across parallel stacks because TCP has no virtual-host\n//          concept. HTTP/h2c entrypoints DO share ports via Host-header\n//          dispatch.\n//\n// The registry is intentionally a typed Context service (Effect v4\n// idiom) rather than a module-mutable map: that lets tests build a\n// fresh registry per scenario, lets the orchestrator carry the\n// registration set forward immutably, and removes the\n// `ATTACHED_FOLLOWERS`-style hidden globals the architecture's\n// \"What's NOT in it\" section forbids.\n//\n// Construction surface:\n//   `makeEntrypointRegistry(...)` — pure constructor; throws synchronously\n//   on conflict registration (architecture invariant #6 is \"throw at\n//   registration time\", not at acquire time).\n//\n// Lookup surface:\n//   `EntrypointRegistry.byName(name)` — typed yieldable that fails\n//   `UnknownEntrypoint` if the caller spliced an unregistered name.\n\nimport { Context, Effect, Layer } from 'effect';\n\nimport type { EntrypointDecl } from '../../contracts/routable.ts';\nimport { EntrypointConflict, UnknownEntrypoint } from './errors.ts';\n\n/** A named entrypoint — a host port the Traefik container binds and\n *  listens on. `http`/`h2c` entrypoints support Host-header dispatch\n *  (one port → many backends). `tcp` entrypoints are point-to-point\n *  (one port → one backend) — siblings dial them directly. */\nexport type Entrypoint = EntrypointDecl;\n\n/** Registry shape. Closed map from declared name → canonical listener.\n *  HTTP-family declarations may share a port; Traefik still needs one\n *  listener name for that port, so aliases resolve to the first\n *  registered listener. */\nexport interface EntrypointRegistryShape {\n\treadonly byName: (name: string) => Effect.Effect<Entrypoint, UnknownEntrypoint>;\n\treadonly all: () => ReadonlyArray<Entrypoint>;\n}\n\nexport class EntrypointRegistry extends Context.Service<\n\tEntrypointRegistry,\n\tEntrypointRegistryShape\n>()('@devstack-rewrite/orchestrators/router/EntrypointRegistry') {}\n\nconst entrypointFamily = (protocol: Entrypoint['protocol']): 'http' | 'tcp' =>\n\tprotocol === 'tcp' ? 'tcp' : 'http';\n\n/** Build a registry from a literal seed. Idempotent on identical\n *  `(name, port, protocol)` triples; throws synchronously on conflict\n *  per architecture invariant #6. The reason this is synchronous\n *  rather than yielded: registration is module-load wiring, not a\n *  runtime effect — the failure mode is \"two callers wired the same\n *  name to different ports\", which is a build-time bug.\n *\n *  Traefik cannot bind multiple entrypoints to the same container port.\n *  For HTTP-family aliases on one port, keep every declared name\n *  lookupable but resolve those aliases to the first listener registered\n *  for the port. */\nexport const makeEntrypointRegistry = (\n\tseed: ReadonlyArray<Entrypoint>,\n): EntrypointRegistryShape => {\n\tconst declaredByName = new Map<string, Entrypoint>();\n\tconst lookupByName = new Map<string, Entrypoint>();\n\tconst listenerByPort = new Map<number, Entrypoint>();\n\tfor (const e of seed) {\n\t\tconst existing = declaredByName.get(e.name);\n\t\tif (existing) {\n\t\t\tif (existing.port === e.port && existing.protocol === e.protocol) continue;\n\t\t\tthrow new EntrypointConflict({\n\t\t\t\tname: e.name,\n\t\t\t\texisting: { port: existing.port, protocol: existing.protocol },\n\t\t\t\tattempted: { port: e.port, protocol: e.protocol },\n\t\t\t});\n\t\t}\n\t\tdeclaredByName.set(e.name, e);\n\n\t\tconst listener = listenerByPort.get(e.port);\n\t\tif (listener) {\n\t\t\tconst listenerFamily = entrypointFamily(listener.protocol);\n\t\t\tconst attemptedFamily = entrypointFamily(e.protocol);\n\t\t\tif (listenerFamily === 'tcp' || listenerFamily !== attemptedFamily) {\n\t\t\t\tthrow new EntrypointConflict({\n\t\t\t\t\tname: e.name,\n\t\t\t\t\texisting: { port: listener.port, protocol: listener.protocol },\n\t\t\t\t\tattempted: { port: e.port, protocol: e.protocol },\n\t\t\t\t});\n\t\t\t}\n\t\t\tlookupByName.set(e.name, listener);\n\t\t\tcontinue;\n\t\t}\n\n\t\tlistenerByPort.set(e.port, e);\n\t\tlookupByName.set(e.name, e);\n\t}\n\tconst frozenListeners: ReadonlyArray<Entrypoint> = Array.from(listenerByPort.values());\n\tconst knownNames = Array.from(declaredByName.keys());\n\treturn {\n\t\tbyName: (name) => {\n\t\t\tconst hit = lookupByName.get(name);\n\t\t\tif (hit) return Effect.succeed(hit);\n\t\t\treturn Effect.fail(\n\t\t\t\tnew UnknownEntrypoint({\n\t\t\t\t\tname,\n\t\t\t\t\tknown: knownNames,\n\t\t\t\t}),\n\t\t\t);\n\t\t},\n\t\tall: () => frozenListeners,\n\t};\n};\n\n/** Layer that pins the registry from a literal seed. The orchestrator\n *  takes this as a substrate dependency; plugins do NOT mutate the\n *  registry — they pick names from it via their Routable contributions. */\nexport const layerEntrypointRegistry = (\n\tseed: ReadonlyArray<Entrypoint>,\n): Layer.Layer<EntrypointRegistry> =>\n\tLayer.succeed(EntrypointRegistry)(makeEntrypointRegistry(seed));\n"],"mappings":";;;AAkDA,IAAa,qBAAb,cAAwC,QAAQ,SAG7C,CAAC,4DAA4D,CAAC;AAEjE,MAAM,oBAAoB,aACzB,aAAa,QAAQ,QAAQ;;;;;;;;;;;;AAa9B,MAAa,0BACZ,SAC6B;CAC7B,MAAM,iCAAiB,IAAI,KAAyB;CACpD,MAAM,+BAAe,IAAI,KAAyB;CAClD,MAAM,iCAAiB,IAAI,KAAyB;AACpD,MAAK,MAAM,KAAK,MAAM;EACrB,MAAM,WAAW,eAAe,IAAI,EAAE,KAAK;AAC3C,MAAI,UAAU;AACb,OAAI,SAAS,SAAS,EAAE,QAAQ,SAAS,aAAa,EAAE,SAAU;AAClE,SAAM,IAAI,mBAAmB;IAC5B,MAAM,EAAE;IACR,UAAU;KAAE,MAAM,SAAS;KAAM,UAAU,SAAS;KAAU;IAC9D,WAAW;KAAE,MAAM,EAAE;KAAM,UAAU,EAAE;KAAU;IACjD,CAAC;;AAEH,iBAAe,IAAI,EAAE,MAAM,EAAE;EAE7B,MAAM,WAAW,eAAe,IAAI,EAAE,KAAK;AAC3C,MAAI,UAAU;GACb,MAAM,iBAAiB,iBAAiB,SAAS,SAAS;GAC1D,MAAM,kBAAkB,iBAAiB,EAAE,SAAS;AACpD,OAAI,mBAAmB,SAAS,mBAAmB,gBAClD,OAAM,IAAI,mBAAmB;IAC5B,MAAM,EAAE;IACR,UAAU;KAAE,MAAM,SAAS;KAAM,UAAU,SAAS;KAAU;IAC9D,WAAW;KAAE,MAAM,EAAE;KAAM,UAAU,EAAE;KAAU;IACjD,CAAC;AAEH,gBAAa,IAAI,EAAE,MAAM,SAAS;AAClC;;AAGD,iBAAe,IAAI,EAAE,MAAM,EAAE;AAC7B,eAAa,IAAI,EAAE,MAAM,EAAE;;CAE5B,MAAM,kBAA6C,MAAM,KAAK,eAAe,QAAQ,CAAC;CACtF,MAAM,aAAa,MAAM,KAAK,eAAe,MAAM,CAAC;AACpD,QAAO;EACN,SAAS,SAAS;GACjB,MAAM,MAAM,aAAa,IAAI,KAAK;AAClC,OAAI,IAAK,QAAO,OAAO,QAAQ,IAAI;AACnC,UAAO,OAAO,KACb,IAAI,kBAAkB;IACrB;IACA,OAAO;IACP,CAAC,CACF;;EAEF,WAAW;EACX;;;;;AAMF,MAAa,2BACZ,SAEA,MAAM,QAAQ,mBAAmB,CAAC,uBAAuB,KAAK,CAAC"}

package/dist/orchestrators/router/errors.d.mts

@@ -0,0 +1 @@
+import { Schema } from "effect";

package/dist/orchestrators/router/errors.mjs

@@ -0,0 +1,103 @@
+import { Schema } from "effect";
+//#region src/orchestrators/router/errors.ts
+/** Caller registered (or referenced) an entrypoint that isn't in the
+*  process-global registry. Architecture invariant #6:
+*  registrations are read once at router launch; this surface is the
+*  programming-error path for callers that splice an unregistered
+*  name into a Routable. */
+var UnknownEntrypoint = class extends Schema.TaggedErrorClass()("UnknownEntrypoint", {
+	name: Schema.String,
+	known: Schema.Array(Schema.String)
+}) {};
+/** Two callers tried to register the same entrypoint *name* with
+*  conflicting `(port, protocol)`. Architecture invariant #6:
+*  re-registering identically is idempotent; re-registering with a
+*  conflict throws synchronously. */
+var EntrypointConflict = class extends Schema.TaggedErrorClass()("EntrypointConflict", {
+	name: Schema.String,
+	existing: Schema.Struct({
+		port: Schema.Number,
+		protocol: Schema.String
+	}),
+	attempted: Schema.Struct({
+		port: Schema.Number,
+		protocol: Schema.String
+	})
+}) {};
+/** A user-influenceable string (dispatch id / hostname / upstream URL
+*  / entrypoint name) didn't pass the validator. Architecture
+*  invariant #13. Always a programming error in the caller, NOT a
+*  transient. */
+var RouterValidationError = class extends Schema.TaggedErrorClass()("RouterValidationError", {
+	field: Schema.Literals([
+		"hostname",
+		"dispatchId",
+		"entrypointName",
+		"upstreamUrl"
+	]),
+	value: Schema.String,
+	detail: Schema.String
+}) {};
+/** Two `Routable` contributions minted the same `(hostname, entrypoint)`
+*  pair — i.e. the dispatch-id contract is violated upstream. Hard
+*  failure: routing would be ambiguous. */
+var RouteCollision = class extends Schema.TaggedErrorClass()("RouteCollision", {
+	message: Schema.String,
+	hostname: Schema.String,
+	entrypoint: Schema.String,
+	dispatchIds: Schema.Array(Schema.String)
+}) {};
+Schema.TaggedErrorClass()("UpstreamResolveTimeout", {
+	dispatchId: Schema.String,
+	upstreamKind: Schema.Literals(["container", "host-loopback"]),
+	waitedMillis: Schema.Number
+});
+/** The router boot failed (image-pull, network-create, container-run
+*  all roll up here). Distinct tag from `UnknownEntrypoint` so callers
+*  can `Effect.catchTag('RouterBootFailed', …)` and report proxy
+*  infrastructure failures separately from route validation. */
+var RouterBootFailed = class extends Schema.TaggedErrorClass()("RouterBootFailed", {
+	stage: Schema.Literals([
+		"ensure-network",
+		"ensure-container",
+		"write-shared-config",
+		"inspect"
+	]),
+	detail: Schema.String,
+	cause: Schema.optional(Schema.Defect)
+}) {};
+/** Router opt-out only supports endpoints that are already reachable
+*  from the host without Traefik. Container upstreams require the
+*  router's Docker network + proxy entrypoint, so disabled mode must
+*  fail explicitly instead of fabricating a localhost URL. */
+var RouterDisabledRouteUnsupported = class extends Schema.TaggedErrorClass()("RouterDisabledRouteUnsupported", {
+	endpointName: Schema.String,
+	upstreamKind: Schema.Literals(["container", "host-loopback"]),
+	detail: Schema.String
+}) {};
+/** Writing a per-backend dispatch file failed. Distinct from
+*  `RouterBootFailed` so callers can log/skip an individual route
+*  without failing boot, per distilled-doc:
+*  "the per-primitive route is silently absent; the route's hostname
+*  returns Traefik's default 404. Warning is logged…". */
+var DispatchWriteFailed = class extends Schema.TaggedErrorClass()("DispatchWriteFailed", {
+	dispatchFileId: Schema.String,
+	path: Schema.String,
+	detail: Schema.String,
+	cause: Schema.optional(Schema.Defect)
+}) {};
+/** The per-backend dispatch file was written, but the public router
+*  entrypoint did not start serving that route within the readiness
+*  budget. This catches Traefik file-provider reload races before the
+*  endpoint is surfaced to users. */
+var RouteReadinessProbeFailed = class extends Schema.TaggedErrorClass()("RouteReadinessProbeFailed", {
+	dispatchFileId: Schema.String,
+	url: Schema.String,
+	timeoutMs: Schema.Number,
+	detail: Schema.String,
+	cause: Schema.optional(Schema.Defect)
+}) {};
+//#endregion
+export { DispatchWriteFailed, EntrypointConflict, RouteCollision, RouteReadinessProbeFailed, RouterBootFailed, RouterDisabledRouteUnsupported, RouterValidationError, UnknownEntrypoint };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/orchestrators/router/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/orchestrators/router/errors.ts"],"sourcesContent":["// Typed errors emitted by the router orchestrator.\n//\n// One tagged class per discriminated failure surface; the router is\n// the only producer so the shapes are tight. Effect v4 `Schema.TaggedErrorClass`\n// pattern matches the rest of the substrate (see\n// `substrate/runtime/errors.ts`).\n\nimport { Schema } from 'effect';\n\n/** Caller registered (or referenced) an entrypoint that isn't in the\n *  process-global registry. Architecture invariant #6:\n *  registrations are read once at router launch; this surface is the\n *  programming-error path for callers that splice an unregistered\n *  name into a Routable. */\nexport class UnknownEntrypoint extends Schema.TaggedErrorClass<UnknownEntrypoint>()(\n\t'UnknownEntrypoint',\n\t{\n\t\tname: Schema.String,\n\t\tknown: Schema.Array(Schema.String),\n\t},\n) {}\n\n/** Two callers tried to register the same entrypoint *name* with\n *  conflicting `(port, protocol)`. Architecture invariant #6:\n *  re-registering identically is idempotent; re-registering with a\n *  conflict throws synchronously. */\nexport class EntrypointConflict extends Schema.TaggedErrorClass<EntrypointConflict>()(\n\t'EntrypointConflict',\n\t{\n\t\tname: Schema.String,\n\t\texisting: Schema.Struct({\n\t\t\tport: Schema.Number,\n\t\t\tprotocol: Schema.String,\n\t\t}),\n\t\tattempted: Schema.Struct({\n\t\t\tport: Schema.Number,\n\t\t\tprotocol: Schema.String,\n\t\t}),\n\t},\n) {}\n\n/** A user-influenceable string (dispatch id / hostname / upstream URL\n *  / entrypoint name) didn't pass the validator. Architecture\n *  invariant #13. Always a programming error in the caller, NOT a\n *  transient. */\nexport class RouterValidationError extends Schema.TaggedErrorClass<RouterValidationError>()(\n\t'RouterValidationError',\n\t{\n\t\tfield: Schema.Literals(['hostname', 'dispatchId', 'entrypointName', 'upstreamUrl']),\n\t\tvalue: Schema.String,\n\t\tdetail: Schema.String,\n\t},\n) {}\n\n/** Two `Routable` contributions minted the same `(hostname, entrypoint)`\n *  pair — i.e. the dispatch-id contract is violated upstream. Hard\n *  failure: routing would be ambiguous. */\nexport class RouteCollision extends Schema.TaggedErrorClass<RouteCollision>()('RouteCollision', {\n\tmessage: Schema.String,\n\thostname: Schema.String,\n\tentrypoint: Schema.String,\n\tdispatchIds: Schema.Array(Schema.String),\n}) {}\n\n/** The router upstream URL could not be resolved within the bounded\n *  retry budget — for container backends the network-connect's\n *  async IP-allocation never settled. Architecture invariant #3. */\nexport class UpstreamResolveTimeout extends Schema.TaggedErrorClass<UpstreamResolveTimeout>()(\n\t'UpstreamResolveTimeout',\n\t{\n\t\tdispatchId: Schema.String,\n\t\tupstreamKind: Schema.Literals(['container', 'host-loopback']),\n\t\twaitedMillis: Schema.Number,\n\t},\n) {}\n\n/** The router boot failed (image-pull, network-create, container-run\n *  all roll up here). Distinct tag from `UnknownEntrypoint` so callers\n *  can `Effect.catchTag('RouterBootFailed', …)` and report proxy\n *  infrastructure failures separately from route validation. */\nexport class RouterBootFailed extends Schema.TaggedErrorClass<RouterBootFailed>()(\n\t'RouterBootFailed',\n\t{\n\t\tstage: Schema.Literals([\n\t\t\t'ensure-network',\n\t\t\t'ensure-container',\n\t\t\t'write-shared-config',\n\t\t\t'inspect',\n\t\t]),\n\t\tdetail: Schema.String,\n\t\tcause: Schema.optional(Schema.Defect),\n\t},\n) {}\n\n/** Router opt-out only supports endpoints that are already reachable\n *  from the host without Traefik. Container upstreams require the\n *  router's Docker network + proxy entrypoint, so disabled mode must\n *  fail explicitly instead of fabricating a localhost URL. */\nexport class RouterDisabledRouteUnsupported extends Schema.TaggedErrorClass<RouterDisabledRouteUnsupported>()(\n\t'RouterDisabledRouteUnsupported',\n\t{\n\t\tendpointName: Schema.String,\n\t\tupstreamKind: Schema.Literals(['container', 'host-loopback']),\n\t\tdetail: Schema.String,\n\t},\n) {}\n\n/** Writing a per-backend dispatch file failed. Distinct from\n *  `RouterBootFailed` so callers can log/skip an individual route\n *  without failing boot, per distilled-doc:\n *  \"the per-primitive route is silently absent; the route's hostname\n *  returns Traefik's default 404. Warning is logged…\". */\nexport class DispatchWriteFailed extends Schema.TaggedErrorClass<DispatchWriteFailed>()(\n\t'DispatchWriteFailed',\n\t{\n\t\tdispatchFileId: Schema.String,\n\t\tpath: Schema.String,\n\t\tdetail: Schema.String,\n\t\tcause: Schema.optional(Schema.Defect),\n\t},\n) {}\n\n/** The per-backend dispatch file was written, but the public router\n *  entrypoint did not start serving that route within the readiness\n *  budget. This catches Traefik file-provider reload races before the\n *  endpoint is surfaced to users. */\nexport class RouteReadinessProbeFailed extends Schema.TaggedErrorClass<RouteReadinessProbeFailed>()(\n\t'RouteReadinessProbeFailed',\n\t{\n\t\tdispatchFileId: Schema.String,\n\t\turl: Schema.String,\n\t\ttimeoutMs: Schema.Number,\n\t\tdetail: Schema.String,\n\t\tcause: Schema.optional(Schema.Defect),\n\t},\n) {}\n\nexport type RouterError =\n\t| UnknownEntrypoint\n\t| EntrypointConflict\n\t| RouterValidationError\n\t| RouteCollision\n\t| UpstreamResolveTimeout\n\t| RouterBootFailed\n\t| RouterDisabledRouteUnsupported\n\t| DispatchWriteFailed\n\t| RouteReadinessProbeFailed;\n"],"mappings":";;;;;;;AAcA,IAAa,oBAAb,cAAuC,OAAO,kBAAqC,CAClF,qBACA;CACC,MAAM,OAAO;CACb,OAAO,OAAO,MAAM,OAAO,OAAO;CAClC,CACD,CAAC;;;;;AAMF,IAAa,qBAAb,cAAwC,OAAO,kBAAsC,CACpF,sBACA;CACC,MAAM,OAAO;CACb,UAAU,OAAO,OAAO;EACvB,MAAM,OAAO;EACb,UAAU,OAAO;EACjB,CAAC;CACF,WAAW,OAAO,OAAO;EACxB,MAAM,OAAO;EACb,UAAU,OAAO;EACjB,CAAC;CACF,CACD,CAAC;;;;;AAMF,IAAa,wBAAb,cAA2C,OAAO,kBAAyC,CAC1F,yBACA;CACC,OAAO,OAAO,SAAS;EAAC;EAAY;EAAc;EAAkB;EAAc,CAAC;CACnF,OAAO,OAAO;CACd,QAAQ,OAAO;CACf,CACD,CAAC;;;;AAKF,IAAa,iBAAb,cAAoC,OAAO,kBAAkC,CAAC,kBAAkB;CAC/F,SAAS,OAAO;CAChB,UAAU,OAAO;CACjB,YAAY,OAAO;CACnB,aAAa,OAAO,MAAM,OAAO,OAAO;CACxC,CAAC,CAAC;AAKyC,OAAO,kBAA0C,CAC5F,0BACA;CACC,YAAY,OAAO;CACnB,cAAc,OAAO,SAAS,CAAC,aAAa,gBAAgB,CAAC;CAC7D,cAAc,OAAO;CACrB,CACD;;;;;AAMD,IAAa,mBAAb,cAAsC,OAAO,kBAAoC,CAChF,oBACA;CACC,OAAO,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA,CAAC;CACF,QAAQ,OAAO;CACf,OAAO,OAAO,SAAS,OAAO,OAAO;CACrC,CACD,CAAC;;;;;AAMF,IAAa,iCAAb,cAAoD,OAAO,kBAAkD,CAC5G,kCACA;CACC,cAAc,OAAO;CACrB,cAAc,OAAO,SAAS,CAAC,aAAa,gBAAgB,CAAC;CAC7D,QAAQ,OAAO;CACf,CACD,CAAC;;;;;;AAOF,IAAa,sBAAb,cAAyC,OAAO,kBAAuC,CACtF,uBACA;CACC,gBAAgB,OAAO;CACvB,MAAM,OAAO;CACb,QAAQ,OAAO;CACf,OAAO,OAAO,SAAS,OAAO,OAAO;CACrC,CACD,CAAC;;;;;AAMF,IAAa,4BAAb,cAA+C,OAAO,kBAA6C,CAClG,6BACA;CACC,gBAAgB,OAAO;CACvB,KAAK,OAAO;CACZ,WAAW,OAAO;CAClB,QAAQ,OAAO;CACf,OAAO,OAAO,SAAS,OAAO,OAAO;CACrC,CACD,CAAC"}

package/dist/orchestrators/router/file-provider.d.mts

@@ -0,0 +1 @@
+import { Effect } from "effect";

package/dist/orchestrators/router/file-provider.mjs

@@ -0,0 +1,320 @@
+import { RouteCollision, RouterValidationError } from "./errors.mjs";
+import { dispatchFileId, renderUrl, routerHostname } from "./hostname.mjs";
+import { CORS_MIDDLEWARE_NAME } from "./cors.mjs";
+import { Effect } from "effect";
+//#region src/orchestrators/router/file-provider.ts
+const ROUTE_READINESS_HEADER = "X-Devstack-Route-Id";
+/** Filename within the dispatch directory for a given file-id. The
+*  `10-` prefix sorts behind the shared CORS middleware (`00-`) so
+*  Traefik picks up the middleware before any router referencing it. */
+const dispatchFilename = (fileId) => `10-${fileId}.yml`;
+/** Resolve a single Routable into a ResolvedRoute. Pure-ish: the only
+*  effectful bit is the upstream resolver (which talks to docker /
+*  the port broker) and the entrypoint lookup.
+*
+*  Takes the registry as a parameter rather than yielding the service
+*  tag so the calling orchestrator can pre-bind it once at layer-
+*  construction time, keeping the per-Routable hot path free of
+*  Context lookups. */
+const resolveRoute = (identity, decl, registry, upstreams) => Effect.gen(function* () {
+	const entrypoint = yield* registry.byName(decl.endpointName);
+	const hostname = yield* routerHostname(identity, decl.dispatchId.role);
+	const fileId = yield* dispatchFileId({
+		identity,
+		dispatch: decl.dispatchId
+	});
+	const upstream = decl.upstream.type === "container" ? yield* upstreams.resolveContainer({
+		containerName: decl.upstream.containerName,
+		containerPort: decl.upstream.containerPort
+	}) : yield* upstreams.resolveHostLoopback({ port: decl.upstream.port });
+	const wireProtocol = decl.wireProtocol === "tcp" ? "tcp" : decl.wireProtocol === "h2c" ? "h2c" : "http";
+	if ((wireProtocol === "tcp" ? "tcp" : "http") !== (entrypoint.protocol === "tcp" ? "tcp" : "http")) return yield* Effect.fail(new RouterValidationError({
+		field: "entrypointName",
+		value: entrypoint.name,
+		detail: `wireProtocol family mismatch: decl is '${wireProtocol}' but entrypoint '${entrypoint.name}' is '${entrypoint.protocol}'`
+	}));
+	const upstreamUrl = renderUrl({
+		protocol: wireProtocol === "tcp" ? "tcp" : "http",
+		hostname: upstream.host,
+		port: upstream.port
+	});
+	if (!/^(?:http|tcp):\/\/[A-Za-z0-9_.:-]+:\d+$/.test(upstreamUrl)) return yield* Effect.fail(new RouterValidationError({
+		field: "upstreamUrl",
+		value: upstreamUrl,
+		detail: "expected http://<host>:<port> or tcp://<host>:<port>"
+	}));
+	const cors = decl.wireProtocol === "tcp" ? false : decl.cors;
+	return {
+		dispatchFileId: fileId,
+		hostname,
+		entrypointName: entrypoint.name,
+		entrypointPort: entrypoint.port,
+		upstreamUrl,
+		cors,
+		wireProtocol
+	};
+});
+/** Pull host+port out of an `<scheme>://<host>:<port>` URL. Used by the
+*  TCP renderer to write the `address:` field. Safe because
+*  `resolveRoute` validates the URL shape before we get here. */
+const splitUpstream = (url) => {
+	const stripped = url.replace(/^(?:http|tcp):\/\//, "");
+	const lastColon = stripped.lastIndexOf(":");
+	return {
+		host: stripped.slice(0, lastColon),
+		port: stripped.slice(lastColon + 1)
+	};
+};
+const renderLeaseHeader = (lease) => [
+	`# routeLeaseVersion: ${lease.version}`,
+	`# routerProfileId: ${lease.routerProfileId}`,
+	`# ownerApp: ${lease.app}`,
+	`# ownerStack: ${lease.stack}`,
+	`# ownerPid: ${lease.owner.pid}`,
+	`# ownerStartTime: ${lease.owner.startTime}`,
+	`# ownerHostname: ${lease.owner.hostname}`,
+	`# ownerClaimedAt: ${lease.owner.claimedAt}`,
+	`# ownerHeartbeatAt: ${lease.owner.heartbeatAt}`,
+	`# ownerIntent: ${lease.owner.intent}`
+];
+/** Render the YAML body for a single resolved route. Hand-rolled
+*  (same rationale as `cors.ts`): static, controlled, byte-stable so
+*  no-op rewrites don't wake the watcher. */
+const renderRouteYaml = (route, lease) => {
+	if (route.wireProtocol === "tcp") return renderTcpRouteYaml(route, lease);
+	return renderHttpRouteYaml(route, lease);
+};
+const routeReadinessMiddlewareName = (route) => `${route.dispatchFileId}-route-ready`;
+const renderHttpRouteYaml = (route, lease) => {
+	const middlewares = [routeReadinessMiddlewareName(route), ...route.cors ? [CORS_MIDDLEWARE_NAME] : []];
+	const schemeHint = route.wireProtocol === "h2c" ? `        # h2c upstream — gRPC-friendly cleartext HTTP/2.\n` : "";
+	return [
+		`# Auto-generated by devstack router orchestrator. Do not edit by hand.`,
+		`# dispatchFileId: ${route.dispatchFileId}`,
+		`# wireProtocol: ${route.wireProtocol}`,
+		`# entrypointName: ${route.entrypointName}`,
+		`# entrypointPort: ${route.entrypointPort}`,
+		`# hostname: ${route.hostname}`,
+		...renderLeaseHeader(lease),
+		`http:`,
+		`  routers:`,
+		`    ${route.dispatchFileId}-router:`,
+		`      rule: "Host(\`${route.hostname}\`)"`,
+		`      entryPoints: ["${route.entrypointName}"]`,
+		`      service: "${route.dispatchFileId}-svc"`,
+		`      middlewares: [${middlewares.map((name) => `"${name}"`).join(", ")}]`,
+		`  middlewares:`,
+		`    ${routeReadinessMiddlewareName(route)}:`,
+		`      headers:`,
+		`        customResponseHeaders:`,
+		`          ${ROUTE_READINESS_HEADER}: "${route.dispatchFileId}"`,
+		`  services:`,
+		`    ${route.dispatchFileId}-svc:`,
+		`      loadBalancer:`,
+		schemeHint.length > 0 ? schemeHint.trimEnd() : null,
+		`        servers:`,
+		`          - url: "${route.upstreamUrl}"`,
+		``
+	].filter((line) => line !== null).join("\n");
+};
+const renderTcpRouteYaml = (route, lease) => {
+	const { host, port } = splitUpstream(route.upstreamUrl);
+	return [
+		`# Auto-generated by devstack router orchestrator. Do not edit by hand.`,
+		`# dispatchFileId: ${route.dispatchFileId}`,
+		`# wireProtocol: tcp`,
+		`# entrypointName: ${route.entrypointName}`,
+		`# entrypointPort: ${route.entrypointPort}`,
+		`# hostname: ${route.hostname}`,
+		`# tcpDispatch: entrypoint-port dispatch; HostSNI wildcard`,
+		...renderLeaseHeader(lease),
+		`tcp:`,
+		`  routers:`,
+		`    ${route.dispatchFileId}-router:`,
+		`      rule: "HostSNI(\`*\`)"`,
+		`      entryPoints: ["${route.entrypointName}"]`,
+		`      service: "${route.dispatchFileId}-svc"`,
+		`  services:`,
+		`    ${route.dispatchFileId}-svc:`,
+		`      loadBalancer:`,
+		`        servers:`,
+		`          - address: "${host}:${port}"`,
+		``
+	].join("\n");
+};
+const dispatchFileIdFromFilename = (filename) => {
+	return /^10-(.+)\.yml$/.exec(filename)?.[1] ?? null;
+};
+const commentValue = (body, key) => {
+	const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return new RegExp(`^# ${escaped}: (.*)$`, "m").exec(body)?.[1]?.trim() ?? null;
+};
+const matchValue = (body, pattern) => pattern.exec(body)?.[1]?.trim() ?? null;
+const commentNumber = (body, key) => {
+	const raw = commentValue(body, key);
+	if (raw === null || !/^\d+$/.test(raw)) return null;
+	return Number.parseInt(raw, 10);
+};
+const parseWireProtocol = (body) => {
+	const fromComment = commentValue(body, "wireProtocol");
+	if (fromComment === "http" || fromComment === "h2c" || fromComment === "tcp") return fromComment;
+	if (/^tcp:/m.test(body)) return "tcp";
+	if (/^http:/m.test(body)) return "http";
+	return null;
+};
+const hasRouteLeaseMetadata = (body) => [
+	"routeLeaseVersion",
+	"routerProfileId",
+	"ownerApp",
+	"ownerStack",
+	"ownerPid",
+	"ownerStartTime",
+	"ownerHostname",
+	"ownerClaimedAt",
+	"ownerHeartbeatAt",
+	"ownerIntent"
+].some((key) => commentValue(body, key) !== null);
+const parseRouteLeaseMetadata = (body, dispatchFileId) => {
+	if (!hasRouteLeaseMetadata(body)) return {
+		lease: null,
+		diagnostic: null
+	};
+	const rawVersion = commentValue(body, "routeLeaseVersion");
+	const version = commentNumber(body, "routeLeaseVersion");
+	const routerProfileId = commentValue(body, "routerProfileId");
+	const app = commentValue(body, "ownerApp");
+	const stack = commentValue(body, "ownerStack");
+	const pid = commentNumber(body, "ownerPid");
+	const startTime = commentNumber(body, "ownerStartTime");
+	const hostname = commentValue(body, "ownerHostname");
+	const claimedAt = commentNumber(body, "ownerClaimedAt");
+	const heartbeatAt = commentNumber(body, "ownerHeartbeatAt");
+	const intent = commentValue(body, "ownerIntent");
+	if (version !== 1) return {
+		lease: null,
+		diagnostic: {
+			_tag: "DispatchRouteDecodeDiagnostic",
+			dispatchFileId,
+			reason: "unknown-route-lease-version",
+			detail: `expected routeLeaseVersion 1, got ${rawVersion ?? "<missing>"}`
+		}
+	};
+	if (routerProfileId === null || app === null || stack === null || pid === null || startTime === null || hostname === null || claimedAt === null || heartbeatAt === null || intent !== "normal" && intent !== "snapshot") return {
+		lease: null,
+		diagnostic: {
+			_tag: "DispatchRouteDecodeDiagnostic",
+			dispatchFileId,
+			reason: "invalid-route-lease-metadata",
+			detail: "route lease metadata is incomplete or malformed"
+		}
+	};
+	return {
+		lease: {
+			version: 1,
+			routerProfileId,
+			app,
+			stack,
+			owner: {
+				pid,
+				startTime,
+				hostname,
+				claimedAt,
+				heartbeatAt,
+				intent
+			}
+		},
+		diagnostic: null
+	};
+};
+const parseDispatchRouteFile = (body, fallbackDispatchFileId = null) => {
+	const dispatchFileId = commentValue(body, "dispatchFileId") ?? fallbackDispatchFileId;
+	const wireProtocol = parseWireProtocol(body);
+	const entrypointName = commentValue(body, "entrypointName") ?? matchValue(body, /entryPoints: \["([^"]+)"\]/);
+	const hostname = commentValue(body, "hostname") ?? matchValue(body, /Host\(`([^`]+)`\)/) ?? (wireProtocol === "tcp" ? "" : null);
+	const portRaw = commentValue(body, "entrypointPort");
+	const entrypointPort = portRaw === null || !/^\d+$/.test(portRaw) ? null : Number.parseInt(portRaw, 10);
+	if (dispatchFileId === null || wireProtocol === null || entrypointName === null || hostname === null) {
+		const protectedDispatchFileId = dispatchFileId ?? "<unknown>";
+		return {
+			_tag: "invalid",
+			dispatchFileId: protectedDispatchFileId,
+			diagnostics: [{
+				_tag: "DispatchRouteDecodeDiagnostic",
+				dispatchFileId: protectedDispatchFileId,
+				reason: "missing-required-route-metadata",
+				detail: "route file is missing dispatchFileId, wireProtocol/http|tcp block, entrypointName, or hostname metadata"
+			}]
+		};
+	}
+	const leaseResult = parseRouteLeaseMetadata(body, dispatchFileId);
+	return {
+		_tag: "valid",
+		route: {
+			dispatchFileId,
+			hostname,
+			entrypointName,
+			entrypointPort,
+			wireProtocol,
+			lease: leaseResult.lease
+		},
+		diagnostics: leaseResult.diagnostic === null ? [] : [leaseResult.diagnostic]
+	};
+};
+/** Assert no two resolved routes share dispatch keys.
+*
+*  - HTTP routes collide on `(entrypoint, hostname)` — two HTTP backends
+*    on the same entrypoint port can coexist via different Host headers,
+*    so the Host *is* part of the key.
+*  - TCP routes collide on `entrypoint` alone — TCP has no Host header,
+*    so an entrypoint can serve exactly ONE backend. Two TCP decls on
+*    the same entrypoint are an unambiguous error (parallel stacks of
+*    a TCP service share the host port and would clobber each other).
+*
+*  Architecture invariant #7 — distinct identity → distinct dispatch
+*  URL. The TCP arm is the new clause; HTTP arm unchanged. */
+const detectCollisions = (routes) => {
+	const seen = /* @__PURE__ */ new Map();
+	for (const r of routes) {
+		const portKey = r.entrypointPort === null ? `entrypoint:${r.entrypointName}` : `port:${r.entrypointPort}`;
+		const key = r.wireProtocol === "tcp" ? `tcp@${portKey}` : `http@${portKey}@${r.hostname}`;
+		const acc = seen.get(key);
+		if (acc) acc.push(r);
+		else seen.set(key, [r]);
+	}
+	for (const [key, colliding] of seen) if (colliding.length > 1) {
+		const ids = colliding.map((route) => route.dispatchFileId);
+		const first = colliding[0];
+		if (key.startsWith("tcp@")) return new RouteCollision({
+			message: routeCollisionMessage({
+				hostname: "",
+				entrypoint: first?.entrypointName ?? "",
+				dispatchIds: ids,
+				wireProtocol: "tcp"
+			}),
+			hostname: "",
+			entrypoint: first?.entrypointName ?? "",
+			dispatchIds: ids
+		});
+		return new RouteCollision({
+			message: routeCollisionMessage({
+				hostname: first?.hostname ?? "",
+				entrypoint: first?.entrypointName ?? "",
+				dispatchIds: ids,
+				wireProtocol: "http"
+			}),
+			hostname: first?.hostname ?? "",
+			entrypoint: first?.entrypointName ?? "",
+			dispatchIds: ids
+		});
+	}
+	return null;
+};
+const routeCollisionMessage = (collision) => {
+	const ids = collision.dispatchIds.join(", ");
+	if (collision.wireProtocol === "tcp") return `router TCP route collision on entrypoint '${collision.entrypoint}' for dispatch ids: ${ids}`;
+	return `router route collision on entrypoint '${collision.entrypoint}' and hostname '${collision.hostname}' for dispatch ids: ${ids}`;
+};
+//#endregion
+export { ROUTE_READINESS_HEADER, detectCollisions, dispatchFileIdFromFilename, dispatchFilename, parseDispatchRouteFile, renderRouteYaml, resolveRoute };
+
+//# sourceMappingURL=file-provider.mjs.map