@mysten-incubation/devstack 0.0.0

package/dist/orchestrators/router/service.mjs

@@ -0,0 +1,421 @@
+import { IdentityContext } from "../../substrate/runtime/paths.mjs";
+import { checkHolderLiveness, ownHolder } from "../../substrate/runtime/cross-process/liveness.mjs";
+import { DispatchWriteFailed, RouteCollision, RouteReadinessProbeFailed, RouterBootFailed, RouterDisabledRouteUnsupported, RouterValidationError } from "./errors.mjs";
+import { dispatchFileId } from "./hostname.mjs";
+import { atomicWriteFile } from "../../substrate/runtime/atomic-write.mjs";
+import { DockerHost, DockerSpawner } from "../../runtime/docker/client.mjs";
+import { acquireStackLock } from "../../substrate/runtime/cross-process/stack-lock.mjs";
+import { connect, waitForIp } from "../../runtime/docker/network.mjs";
+import { waitForHttpEndpoint } from "../../substrate/runtime/http-probe.mjs";
+import { TraefikContainerOpsService, bootstrap } from "./traefik-container.mjs";
+import { EntrypointRegistry } from "./entrypoints.mjs";
+import { CORS_MIDDLEWARE_FILENAME, renderCorsMiddlewareYaml } from "./cors.mjs";
+import { detectCollisions, dispatchFileIdFromFilename, dispatchFilename, parseDispatchRouteFile, renderRouteYaml, resolveRoute } from "./file-provider.mjs";
+import { Context, Effect, FileSystem, Layer, Ref, SubscriptionRef } from "effect";
+import * as path from "node:path";
+import { request } from "node:http";
+//#region src/orchestrators/router/service.ts
+const ROUTER_LOCK_TIMEOUT_MILLIS = 12e4;
+var RouterConfig = class extends Context.Service()("@devstack-rewrite/orchestrators/router/RouterConfig") {};
+/** Default-config layer for tests. Production wires this from
+*  `runtime-composition.ts` at the engine boundary. */
+const layerRouterConfigLiteral = (cfg) => Layer.succeed(RouterConfig)(cfg);
+var UpstreamResolverService = class extends Context.Service()("@devstack-rewrite/orchestrators/router/UpstreamResolver") {};
+const layerDockerUpstreamResolver = (profile) => Layer.effect(UpstreamResolverService, Effect.gen(function* () {
+	const dockerHost = yield* DockerHost;
+	const dockerSpawner = yield* DockerSpawner;
+	const networkName = profile.networkName;
+	const provideDocker = (effect) => effect.pipe(Effect.provideService(DockerHost, dockerHost), Effect.provideService(DockerSpawner, dockerSpawner));
+	return UpstreamResolverService.of({
+		resolveContainer: (target) => provideDocker(connect(target.containerName, networkName).pipe(Effect.andThen(waitForIp(target.containerName, networkName)))).pipe(Effect.map((host) => ({
+			host,
+			port: target.containerPort
+		})), Effect.mapError((cause) => new RouterValidationError({
+			field: "upstreamUrl",
+			value: target.containerName,
+			detail: `failed to attach/read container upstream on router network: ${String(cause)}`
+		}))),
+		resolveHostLoopback: (target) => Effect.succeed({
+			host: "host.docker.internal",
+			port: target.port
+		})
+	});
+}));
+var RouterService = class extends Context.Service()("@devstack-rewrite/orchestrators/router/Router") {};
+const warnDispatchDecodeDiagnostic = (diagnostic) => Effect.gen(function* () {
+	yield* Effect.annotateCurrentSpan({
+		"router.dispatch.path": diagnostic.path,
+		"router.dispatch.file_id": diagnostic.dispatchFileId,
+		"router.dispatch.decode_reason": diagnostic.reason
+	});
+	yield* Effect.logWarning(`router dispatch route file ${diagnostic.path} could not be fully decoded; reason=${diagnostic.reason}; treating it as an unknown route lease where destructive bootstrap safety matters`);
+});
+const readDispatchRouteScan = (fs, dispatchDir, dispatchFileId, options = {}) => Effect.gen(function* () {
+	const routeFiles = (yield* fs.readDirectory(dispatchDir).pipe(Effect.mapError((cause) => new DispatchWriteFailed({
+		dispatchFileId,
+		path: dispatchDir,
+		detail: `readDirectory(${dispatchDir}) failed`,
+		cause
+	})))).map((filename) => ({
+		filename,
+		fileId: dispatchFileIdFromFilename(filename)
+	})).filter((entry) => entry.fileId !== null);
+	const parsed = yield* Effect.forEach(routeFiles, (entry) => {
+		const filePath = path.join(dispatchDir, entry.filename);
+		return fs.readFileString(filePath).pipe(Effect.map((body) => ({
+			path: filePath,
+			result: parseDispatchRouteFile(body, entry.fileId)
+		})), Effect.mapError((cause) => new DispatchWriteFailed({
+			dispatchFileId,
+			path: filePath,
+			detail: `readFileString(${filePath}) failed`,
+			cause
+		})));
+	}, { concurrency: "unbounded" });
+	const routes = [];
+	const unknownRouteFileIds = [];
+	const diagnostics = [];
+	for (const entry of parsed) {
+		for (const diagnostic of entry.result.diagnostics) {
+			const withPath = {
+				...diagnostic,
+				path: entry.path
+			};
+			diagnostics.push(withPath);
+			yield* warnDispatchDecodeDiagnostic(withPath);
+		}
+		if (entry.result._tag === "valid") routes.push(entry.result.route);
+		else unknownRouteFileIds.push(entry.result.dispatchFileId);
+	}
+	if (options.strict === true && diagnostics.length > 0) {
+		const first = diagnostics[0];
+		return yield* Effect.fail(new DispatchWriteFailed({
+			dispatchFileId: first?.dispatchFileId ?? dispatchFileId,
+			path: first?.path ?? dispatchDir,
+			detail: first?.detail ?? "dispatch route decode failed"
+		}));
+	}
+	return {
+		routes,
+		unknownRouteFileIds,
+		diagnostics
+	};
+});
+const classifyDispatchLease = (route) => {
+	if (route.lease === null) return Effect.succeed("unknown-owner");
+	return checkHolderLiveness(route.lease.owner).pipe(Effect.map((status) => status === "dead" ? "stale" : "live"), Effect.catch(() => Effect.succeed("live")));
+};
+const sweepStaleDispatchRoutes = (fs, profile, routes, dispatchFileId) => Effect.gen(function* () {
+	const active = [];
+	for (const route of routes) {
+		if ((yield* classifyDispatchLease(route)) === "stale") {
+			const filePath = path.join(profile.dispatchDir, dispatchFilename(route.dispatchFileId));
+			yield* fs.remove(filePath).pipe(Effect.mapError((cause) => new DispatchWriteFailed({
+				dispatchFileId,
+				path: filePath,
+				detail: `failed to remove stale route lease ${route.dispatchFileId}`,
+				cause
+			})));
+			continue;
+		}
+		active.push(route);
+	}
+	return active;
+});
+const makeRouteLease = (profile, identity) => ({
+	version: 1,
+	routerProfileId: profile.id,
+	app: String(identity.app),
+	stack: String(identity.stack),
+	owner: ownHolder()
+});
+const sameRouteSurface = (a, b) => a.hostname === b.hostname && a.entrypointName === b.entrypointName && a.entrypointPort === b.entrypointPort && a.wireProtocol === b.wireProtocol;
+const liveRouteLeaseMismatch = (existing, resolved) => new RouteCollision({
+	message: `router route ${resolved.dispatchFileId} is already leased by a live process with a different public route (existing ${existing.entrypointName}/${existing.hostname}, attempted ${resolved.entrypointName}/${resolved.hostname})`,
+	hostname: resolved.hostname,
+	entrypoint: resolved.entrypointName,
+	dispatchIds: [existing.dispatchFileId, resolved.dispatchFileId]
+});
+const resolvedWireProtocolFor = (decl) => decl.wireProtocol === "tcp" ? "tcp" : decl.wireProtocol === "h2c" ? "h2c" : "http";
+const validateWireProtocolFamily = (decl, entrypoint) => {
+	const wireProtocol = resolvedWireProtocolFor(decl);
+	if ((wireProtocol === "tcp" ? "tcp" : "http") === (entrypoint.protocol === "tcp" ? "tcp" : "http")) return Effect.succeed(wireProtocol);
+	return Effect.fail(new RouterValidationError({
+		field: "entrypointName",
+		value: entrypoint.name,
+		detail: `wireProtocol family mismatch: decl is '${wireProtocol}' but entrypoint '${entrypoint.name}' is '${entrypoint.protocol}'`
+	}));
+};
+const directLoopbackHost = "127.0.0.1";
+const DEFAULT_ROUTE_READINESS_INTERVAL_MS = 100;
+const DEFAULT_ROUTE_READINESS_REQUEST_TIMEOUT_MS = 750;
+const proxyGatewayStatuses = new Set([
+	502,
+	503,
+	504
+]);
+const responseHasReadyRoute = (response, resolved) => response.headers.get("X-Devstack-Route-Id") === resolved.dispatchFileId && !proxyGatewayStatuses.has(response.status);
+const fetchHttpRouteViaLoopback = (input, init) => new Promise((resolveResponse, rejectResponse) => {
+	const url = new URL(String(input));
+	const headers = new Headers(init?.headers);
+	const signal = init?.signal ?? void 0;
+	const hostHeader = headers.get("host") ?? headers.get("Host") ?? url.host;
+	headers.delete("host");
+	headers.delete("Host");
+	const requestHeaders = {};
+	headers.forEach((value, key) => {
+		requestHeaders[key] = value;
+	});
+	requestHeaders.host = hostHeader;
+	let settled = false;
+	let req = null;
+	function onAbort() {
+		const cause = /* @__PURE__ */ new Error("route readiness probe aborted");
+		req?.destroy(cause);
+		settle(rejectResponse, cause);
+	}
+	const settle = (fn, value) => {
+		if (settled) return;
+		settled = true;
+		if (signal !== void 0) signal.removeEventListener("abort", onAbort);
+		fn(value);
+	};
+	req = request({
+		hostname: directLoopbackHost,
+		port: url.port === "" ? 80 : Number(url.port),
+		path: `${url.pathname}${url.search}`,
+		method: init?.method ?? "GET",
+		headers: requestHeaders
+	}, (res) => {
+		const chunks = [];
+		res.on("data", (chunk) => {
+			chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+		});
+		res.on("end", () => {
+			const responseHeaders = new Headers();
+			for (const [key, value] of Object.entries(res.headers)) {
+				if (value === void 0) continue;
+				if (Array.isArray(value)) for (const item of value) responseHeaders.append(key, item);
+				else responseHeaders.set(key, value);
+			}
+			settle(resolveResponse, new Response(new Uint8Array(Buffer.concat(chunks)), {
+				status: res.statusCode ?? 599,
+				statusText: res.statusMessage,
+				headers: responseHeaders
+			}));
+		});
+	});
+	if (signal?.aborted === true) {
+		onAbort();
+		return;
+	}
+	signal?.addEventListener("abort", onAbort, { once: true });
+	req.on("error", (cause) => settle(rejectResponse, cause));
+	req.end();
+});
+const resolveDisabledDirectRoute = (identity, decl, registry) => Effect.gen(function* () {
+	if (decl.upstream.type === "container") return yield* Effect.fail(new RouterDisabledRouteUnsupported({
+		endpointName: decl.endpointName,
+		upstreamKind: "container",
+		detail: "router is disabled, but container upstreams are only reachable through the router network/proxy; use a host-loopback upstream or publish an explicit direct endpoint instead"
+	}));
+	const port = decl.upstream.port;
+	if (!Number.isInteger(port) || port <= 0 || port > 65535) return yield* Effect.fail(new RouterValidationError({
+		field: "upstreamUrl",
+		value: `${directLoopbackHost}:${port}`,
+		detail: "disabled-router direct host-loopback routes require a concrete TCP port 1-65535"
+	}));
+	const entrypoint = yield* registry.byName(decl.endpointName);
+	const wireProtocol = yield* validateWireProtocolFamily(decl, entrypoint);
+	const fileId = yield* dispatchFileId({
+		identity,
+		dispatch: decl.dispatchId
+	});
+	const scheme = wireProtocol === "tcp" ? "tcp" : "http";
+	return {
+		dispatchFileId: fileId,
+		hostname: directLoopbackHost,
+		entrypointName: entrypoint.name,
+		entrypointPort: port,
+		upstreamUrl: `${scheme}://${directLoopbackHost}:${port}`,
+		cors: decl.wireProtocol === "tcp" ? false : decl.cors,
+		wireProtocol
+	};
+});
+const endpointFromResolvedRoute = (decl, resolved) => {
+	const url = resolved.wireProtocol === "tcp" ? `tcp://127.0.0.1:${resolved.entrypointPort}` : `http://${resolved.hostname}:${resolved.entrypointPort}`;
+	return {
+		endpointName: decl.endpointName,
+		hostname: resolved.hostname,
+		entrypointPort: resolved.entrypointPort,
+		url,
+		wireProtocol: resolved.wireProtocol
+	};
+};
+const removeDispatchFile = (fs, profile, resolved) => fs.remove(path.join(profile.dispatchDir, dispatchFilename(resolved.dispatchFileId))).pipe(Effect.ignore);
+const waitForPublicRouteReadiness = (cfg, endpoint, resolved) => {
+	const options = cfg.routeReadinessProbe;
+	if (options?.enabled !== true || cfg.disabled || resolved.wireProtocol === "tcp") return Effect.void;
+	const timeoutMs = options.timeoutMs ?? 6e4;
+	const intervalMs = options.intervalMs ?? DEFAULT_ROUTE_READINESS_INTERVAL_MS;
+	const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_ROUTE_READINESS_REQUEST_TIMEOUT_MS;
+	const probeUrl = `http://${directLoopbackHost}:${resolved.entrypointPort}`;
+	return waitForHttpEndpoint({
+		endpoint: probeUrl,
+		timeoutMs,
+		intervalMs,
+		requestTimeoutMs,
+		requestInit: { headers: { host: resolved.hostname } },
+		fetch: options.fetch ?? fetchHttpRouteViaLoopback,
+		validate: (response) => responseHasReadyRoute(response, resolved)
+	}).pipe(Effect.mapError((cause) => new RouteReadinessProbeFailed({
+		dispatchFileId: resolved.dispatchFileId,
+		url: endpoint.url,
+		timeoutMs,
+		detail: `public router endpoint ${endpoint.url} did not serve route ${resolved.dispatchFileId} within ${timeoutMs}ms (probeUrl=${probeUrl}, hostHeader=${resolved.hostname})`,
+		cause
+	})));
+};
+const layerRouterService = Layer.effect(RouterService, Effect.gen(function* () {
+	const cfg = yield* RouterConfig;
+	const identity = yield* IdentityContext;
+	const registry = yield* EntrypointRegistry;
+	const upstreams = yield* UpstreamResolverService;
+	const fs = yield* FileSystem.FileSystem;
+	const traefikOps = yield* TraefikContainerOpsService;
+	const bootRef = yield* Ref.make(null);
+	const applied = yield* SubscriptionRef.make([]);
+	const boot = () => Effect.gen(function* () {
+		const profile = cfg.profile;
+		if (cfg.disabled) {
+			const report = {
+				decision: "opt-out",
+				containerId: null,
+				networkId: null,
+				imageMatches: true
+			};
+			yield* Ref.set(bootRef, report);
+			return report;
+		}
+		const cached = yield* Ref.get(bootRef);
+		if (cached !== null) return cached;
+		const protectedRouteLeaseIds = yield* Effect.scoped(Effect.gen(function* () {
+			yield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS).pipe(Effect.mapError((cause) => new RouterBootFailed({
+				stage: "ensure-container",
+				detail: `failed to acquire router dispatch lock ${profile.dispatchLockFile}`,
+				cause
+			})));
+			yield* fs.makeDirectory(profile.dispatchDir, { recursive: true }).pipe(Effect.mapError((cause) => new RouterBootFailed({
+				stage: "write-shared-config",
+				detail: `makeDirectory(${profile.dispatchDir}) failed`,
+				cause
+			})));
+			yield* atomicWriteFile(path.join(profile.dispatchDir, CORS_MIDDLEWARE_FILENAME), new TextEncoder().encode(renderCorsMiddlewareYaml()), { mode: 420 }).pipe(Effect.mapError((cause) => new RouterBootFailed({
+				stage: "write-shared-config",
+				detail: `atomicWriteFile(${CORS_MIDDLEWARE_FILENAME}) failed at stage ${cause.stage}`,
+				cause
+			})), Effect.provideService(FileSystem.FileSystem, fs));
+			const existingDispatchScan = yield* readDispatchRouteScan(fs, profile.dispatchDir, "router-boot").pipe(Effect.mapError((cause) => new RouterBootFailed({
+				stage: "inspect",
+				detail: cause.detail,
+				cause
+			})));
+			return [...(yield* sweepStaleDispatchRoutes(fs, profile, existingDispatchScan.routes, "router-boot").pipe(Effect.mapError((cause) => new RouterBootFailed({
+				stage: "write-shared-config",
+				detail: cause.detail,
+				cause
+			})))).map((route) => route.dispatchFileId), ...existingDispatchScan.unknownRouteFileIds];
+		}));
+		const report = yield* Effect.scoped(Effect.gen(function* () {
+			yield* acquireStackLock(profile.bootstrapLockFile, ROUTER_LOCK_TIMEOUT_MILLIS).pipe(Effect.mapError((cause) => new RouterBootFailed({
+				stage: "ensure-container",
+				detail: `failed to acquire router bootstrap lock ${profile.bootstrapLockFile}`,
+				cause
+			})));
+			return yield* bootstrap({
+				image: cfg.image,
+				entrypoints: registry.all(),
+				profile,
+				protectedRouteLeaseIds
+			}).pipe(Effect.provideService(TraefikContainerOpsService, traefikOps));
+		}));
+		yield* Ref.set(bootRef, report);
+		return report;
+	}).pipe(Effect.withSpan("orchestrator.router.boot"));
+	const contributeRoute = (decl) => Effect.gen(function* () {
+		const profile = cfg.profile;
+		const resolved = cfg.disabled ? yield* resolveDisabledDirectRoute(identity, decl, registry) : yield* resolveRoute(identity, decl, registry, upstreams);
+		const lease = makeRouteLease(profile, identity);
+		const endpoint = endpointFromResolvedRoute(decl, resolved);
+		const publishRouteFile = Effect.gen(function* () {
+			if (cfg.disabled) return "direct";
+			if (!cfg.disabled) yield* fs.makeDirectory(profile.dispatchDir, { recursive: true }).pipe(Effect.mapError((cause) => new DispatchWriteFailed({
+				dispatchFileId: resolved.dispatchFileId,
+				path: profile.dispatchDir,
+				detail: `makeDirectory(${profile.dispatchDir}) failed`,
+				cause
+			})));
+			const currentApplied = yield* SubscriptionRef.get(applied);
+			const currentIds = new Set(currentApplied.map((route) => route.dispatchFileId));
+			let reuseLiveRoute = false;
+			const activeDispatchRoutes = yield* sweepStaleDispatchRoutes(fs, profile, (yield* readDispatchRouteScan(fs, profile.dispatchDir, resolved.dispatchFileId)).routes, resolved.dispatchFileId);
+			const existingSameDispatchRoute = activeDispatchRoutes.find((route) => route.dispatchFileId === resolved.dispatchFileId);
+			if (existingSameDispatchRoute !== void 0 && !currentIds.has(existingSameDispatchRoute.dispatchFileId)) {
+				if ((yield* classifyDispatchLease(existingSameDispatchRoute)) === "live") {
+					if (!sameRouteSurface(existingSameDispatchRoute, resolved)) return yield* Effect.fail(liveRouteLeaseMismatch(existingSameDispatchRoute, resolved));
+					reuseLiveRoute = true;
+				}
+			}
+			const collision = detectCollisions([
+				...activeDispatchRoutes.filter((route) => !currentIds.has(route.dispatchFileId) && route.dispatchFileId !== resolved.dispatchFileId),
+				...currentApplied,
+				resolved
+			]);
+			if (collision) return yield* Effect.fail(collision);
+			if (reuseLiveRoute) return "reused-live";
+			const filePath = path.join(profile.dispatchDir, dispatchFilename(resolved.dispatchFileId));
+			yield* atomicWriteFile(filePath, new TextEncoder().encode(renderRouteYaml(resolved, lease)), { mode: 420 }).pipe(Effect.mapError((cause) => new DispatchWriteFailed({
+				dispatchFileId: resolved.dispatchFileId,
+				path: filePath,
+				detail: `atomicWriteFile failed at stage ${cause.stage}`,
+				cause
+			})), Effect.provideService(FileSystem.FileSystem, fs));
+			return "owned";
+		});
+		let publishOwnership;
+		if (cfg.disabled) publishOwnership = yield* publishRouteFile;
+		else publishOwnership = yield* Effect.scoped(Effect.gen(function* () {
+			yield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS).pipe(Effect.mapError((cause) => new DispatchWriteFailed({
+				dispatchFileId: resolved.dispatchFileId,
+				path: profile.dispatchLockFile,
+				detail: `failed to acquire dispatch lock ${profile.dispatchLockFile}`,
+				cause
+			})));
+			return yield* publishRouteFile;
+		}));
+		yield* waitForPublicRouteReadiness(cfg, endpoint, resolved).pipe(Effect.onError(() => cfg.disabled || publishOwnership !== "owned" ? Effect.void : Effect.scoped(Effect.gen(function* () {
+			yield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS).pipe(Effect.ignore);
+			yield* removeDispatchFile(fs, profile, resolved);
+		}))));
+		if (publishOwnership !== "reused-live") {
+			yield* SubscriptionRef.update(applied, (arr) => [...arr, resolved]);
+			yield* Effect.addFinalizer(() => Effect.gen(function* () {
+				if (publishOwnership === "owned") yield* Effect.scoped(Effect.gen(function* () {
+					yield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS);
+					yield* removeDispatchFile(fs, profile, resolved);
+				})).pipe(Effect.ignore);
+				yield* SubscriptionRef.update(applied, (arr) => arr.filter((r) => r.dispatchFileId !== resolved.dispatchFileId));
+			}));
+		}
+		return endpoint;
+	}).pipe(Effect.withSpan("orchestrator.router.contributeRoute"));
+	return RouterService.of({
+		boot,
+		contributeRoute,
+		applied
+	});
+}));
+//#endregion
+export { RouterService, layerDockerUpstreamResolver, layerRouterConfigLiteral, layerRouterService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/orchestrators/router/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["httpRequest"],"sources":["../../../src/orchestrators/router/service.ts"],"sourcesContent":["// Router orchestrator — the L3 service that walks `Routable`\n// contributions, mints hostnames + ids, resolves upstream URLs, and\n// writes file-provider config to a watched directory.\n//\n// Architecture distilled-doc §\"Responsibilities\":\n//   1. Ensure exactly one Traefik container and one docker network\n//      exist for the router profile. → `bootstrap()`\n//   2. Maintain the profile dispatch directory mounted into that\n//      singleton (one file per backend). → `contributeRoute()`\n//   3. Mint per-backend hostnames + ids from `(app, stack, service)`. → `hostname.ts`\n//   4. Provide a single shared, permissive CORS middleware. → `cors.ts`\n//   5. Tear down per-backend dispatch entries when their owning scope\n//      closes; leave the shared container running. → scope finalizers\n//\n// What this orchestrator DOES NOT do (architecture §\"What's NOT in it\"):\n//   - Hardcode service names. The orchestrator iterates Routable decls,\n//     resolves them by upstream-kind, and renders YAML — no `if (decl.endpointName === 'wallet')`\n//     anywhere.\n//   - Talk to docker directly. The Traefik container lives behind\n//     `TraefikContainerOpsService`. Upstream IP resolution lives behind\n//     `UpstreamResolver`. Production composition wires both seams.\n//   - Hold module-level mutable state. Contribution state is a\n//     `SubscriptionRef`; the shared-network-id and boot decision live\n//     in fiber-scoped Refs.\n//\n// Hot-reload protocol:\n//   - Contributions are exposed as a `SubscriptionRef<Map<dispatchFileId, RoutableDecl>>`.\n//   - Each `contributeRoute(decl)` updates the ref and is paired with a\n//     scope finalizer that removes the decl on scope close.\n//   - A background fiber watches the ref's change stream; on each\n//     emission it diffs against the last applied set and:\n//       * for each ADD: resolves upstream + atomically writes the\n//         dispatch file.\n//       * for each REMOVE: best-effort unlinks the dispatch file.\n//   - All writes go through `atomicWriteFile` (tmp + rename) per\n//     architecture invariant #5.\n\nimport { Context, Effect, FileSystem, Layer, Ref, Stream, SubscriptionRef } from 'effect';\nimport { request as httpRequest } from 'node:http';\nimport * as path from 'node:path';\n\nimport type { RoutableDecl } from '../../contracts/routable.ts';\nimport { connect, DockerHost, DockerSpawner, waitForIp } from '../../runtime/docker/index.ts';\nimport { atomicWriteFile } from '../../substrate/runtime/atomic-write.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport { checkHolderLiveness, ownHolder } from '../../substrate/runtime/cross-process/liveness.ts';\nimport { acquireStackLock } from '../../substrate/runtime/cross-process/stack-lock.ts';\nimport { waitForHttpEndpoint, type HttpProbeFetch } from '../../substrate/runtime/http-probe.ts';\nimport { IdentityContext } from '../../substrate/runtime/paths.ts';\nimport { CORS_MIDDLEWARE_FILENAME, renderCorsMiddlewareYaml } from './cors.ts';\nimport { EntrypointRegistry, type EntrypointRegistryShape } from './entrypoints.ts';\nimport {\n\tDispatchWriteFailed,\n\tRouteCollision,\n\tRouteReadinessProbeFailed,\n\tRouterBootFailed,\n\tRouterDisabledRouteUnsupported,\n\tRouterValidationError,\n\ttype UnknownEntrypoint,\n\ttype RouterError,\n} from './errors.ts';\nimport {\n\tdispatchFilename,\n\tdispatchFileIdFromFilename,\n\ttype DispatchRouteMetadata,\n\ttype DispatchRouteDecodeDiagnostic,\n\ttype ResolvedRoute,\n\ttype ResolvedWireProtocol,\n\ttype RouteLeaseMetadata,\n\ttype UpstreamResolver,\n\tdetectCollisions,\n\tparseDispatchRouteFile,\n\trenderRouteYaml,\n\tROUTE_READINESS_HEADER,\n\tresolveRoute,\n\tROUTER_ROUTE_LEASE_VERSION,\n} from './file-provider.ts';\nimport { dispatchFileId } from './hostname.ts';\nimport type { RouterProfile } from './profile.ts';\nimport { bootstrap, type BootReport, TraefikContainerOpsService } from './traefik-container.ts';\n\n// Router operations are shared across every stack using the same Docker\n// context. The generic stack-lock default stays short for normal metadata\n// mutations; router boot and dispatch can legitimately queue behind other\n// devstack processes during multi-example CI or local parallel runs.\nconst ROUTER_LOCK_TIMEOUT_MILLIS = 120_000;\n\n// ---------------------------------------------------------------------------\n// RouterConfig — orchestrator-level knobs\n// ---------------------------------------------------------------------------\n\n/** Knobs surfaced through `defineDevstack({ router: {...} })` per\n *  distilled-doc open question #5. We model them as a typed Context\n *  service so the orchestrator reads from a single source and tests\n *  can override per scenario. */\nexport interface RouterConfigShape {\n\t/** Disable the router entirely. Only host-loopback Routables can\n\t *  produce direct URLs in this mode; container upstreams require\n\t *  the router's Docker network + proxy entrypoint and fail\n\t *  explicitly. */\n\treadonly disabled: boolean;\n\t/** User + Docker-daemon scoped router profile. Runtime roots own\n\t *  route leases; the profile owns the singleton proxy process,\n\t *  dispatch directory, network name, and cross-process locks. */\n\treadonly profile: RouterProfile;\n\t/** Traefik image (tag or digest). */\n\treadonly image: string;\n\t/** Optional production gate that waits for Traefik to serve each\n\t *  public HTTP route before the endpoint is published. Tests that\n\t *  use the stub Traefik layer omit this. */\n\treadonly routeReadinessProbe?: RouteReadinessProbeConfig;\n}\n\nexport interface RouteReadinessProbeConfig {\n\treadonly enabled: boolean;\n\treadonly timeoutMs?: number;\n\treadonly intervalMs?: number;\n\treadonly requestTimeoutMs?: number;\n\treadonly fetch?: HttpProbeFetch;\n}\n\nexport class RouterConfig extends Context.Service<RouterConfig, RouterConfigShape>()(\n\t'@devstack-rewrite/orchestrators/router/RouterConfig',\n) {}\n\n/** Default-config layer for tests. Production wires this from\n *  `runtime-composition.ts` at the engine boundary. */\nexport const layerRouterConfigLiteral = (cfg: RouterConfigShape): Layer.Layer<RouterConfig> =>\n\tLayer.succeed(RouterConfig)(cfg);\n\n// ---------------------------------------------------------------------------\n// UpstreamResolverService — Context wrapper around the seam\n// ---------------------------------------------------------------------------\n\nexport class UpstreamResolverService extends Context.Service<\n\tUpstreamResolverService,\n\tUpstreamResolver\n>()('@devstack-rewrite/orchestrators/router/UpstreamResolver') {}\n\nexport const layerDockerUpstreamResolver = (\n\tprofile: RouterProfile,\n): Layer.Layer<UpstreamResolverService, never, DockerHost | DockerSpawner> =>\n\tLayer.effect(\n\t\tUpstreamResolverService,\n\t\tEffect.gen(function* () {\n\t\t\tconst dockerHost = yield* DockerHost;\n\t\t\tconst dockerSpawner = yield* DockerSpawner;\n\t\t\tconst networkName = profile.networkName;\n\t\t\tconst provideDocker = <A, E>(\n\t\t\t\teffect: Effect.Effect<A, E, DockerHost | DockerSpawner>,\n\t\t\t): Effect.Effect<A, E, never> =>\n\t\t\t\teffect.pipe(\n\t\t\t\t\tEffect.provideService(DockerHost, dockerHost),\n\t\t\t\t\tEffect.provideService(DockerSpawner, dockerSpawner),\n\t\t\t\t);\n\n\t\t\treturn UpstreamResolverService.of({\n\t\t\t\tresolveContainer: (target) =>\n\t\t\t\t\tprovideDocker(\n\t\t\t\t\t\tconnect(target.containerName, networkName).pipe(\n\t\t\t\t\t\t\tEffect.andThen(waitForIp(target.containerName, networkName)),\n\t\t\t\t\t\t),\n\t\t\t\t\t).pipe(\n\t\t\t\t\t\tEffect.map((host) => ({ host, port: target.containerPort })),\n\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t(cause) =>\n\t\t\t\t\t\t\t\tnew RouterValidationError({\n\t\t\t\t\t\t\t\t\tfield: 'upstreamUrl',\n\t\t\t\t\t\t\t\t\tvalue: target.containerName,\n\t\t\t\t\t\t\t\t\tdetail: `failed to attach/read container upstream on router network: ${String(cause)}`,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\tresolveHostLoopback: (target) =>\n\t\t\t\t\tEffect.succeed({ host: 'host.docker.internal', port: target.port }),\n\t\t\t});\n\t\t}),\n\t);\n\n// ---------------------------------------------------------------------------\n// Router service surface\n// ---------------------------------------------------------------------------\n\nexport interface RouterServiceShape {\n\t/** Boot the Traefik container once per supervisor lifetime.\n\t *  Idempotent. Architecture invariant #11 — caller mounts this on\n\t *  the long-lived outer scope, NOT inside the hot-reload loop. */\n\treadonly boot: () => Effect.Effect<BootReport, RouterError>;\n\n\t/** Contribute a `RoutableDecl`. The orchestrator resolves the\n\t *  upstream URL, renders the file-provider YAML, and writes it\n\t *  atomically. The returned `EndpointUrl` is the dispatched URL the\n\t *  manifest writer + codegen consume.\n\t *\n\t *  Scope-bound: when the caller's scope closes, the dispatch file\n\t *  is removed (best-effort) and the contribution is dropped from the\n\t *  subscribable map. */\n\treadonly contributeRoute: (\n\t\tdecl: RoutableDecl,\n\t) => Effect.Effect<EndpointUrl, RouterError, import('effect').Scope.Scope>;\n\n\t/** Subscribable view of currently-applied routes. Surfaces +\n\t *  diagnostics consume this. */\n\treadonly applied: SubscriptionRef.SubscriptionRef<ReadonlyArray<ResolvedRoute>>;\n}\n\n/** What `contributeRoute` returns — the post-mint URL and the metadata\n *  the manifest needs. `wireProtocol: 'tcp'` carries `tcp://` URLs;\n *  consumers (codegen, manifest) translate to their protocol-specific\n *  scheme (`postgres://`, `redis://`, …). */\nexport interface EndpointUrl {\n\treadonly endpointName: string;\n\treadonly hostname: string;\n\treadonly entrypointPort: number;\n\treadonly url: string;\n\treadonly wireProtocol: 'http' | 'h2c' | 'tcp';\n}\n\nexport class RouterService extends Context.Service<RouterService, RouterServiceShape>()(\n\t'@devstack-rewrite/orchestrators/router/Router',\n) {}\n\ninterface DispatchRouteScanDiagnostic extends DispatchRouteDecodeDiagnostic {\n\treadonly path: string;\n}\n\ninterface DispatchRouteScan {\n\treadonly routes: ReadonlyArray<DispatchRouteMetadata>;\n\treadonly unknownRouteFileIds: ReadonlyArray<string>;\n\treadonly diagnostics: ReadonlyArray<DispatchRouteScanDiagnostic>;\n}\n\nconst warnDispatchDecodeDiagnostic = (\n\tdiagnostic: DispatchRouteScanDiagnostic,\n): Effect.Effect<void> =>\n\tEffect.gen(function* () {\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t'router.dispatch.path': diagnostic.path,\n\t\t\t'router.dispatch.file_id': diagnostic.dispatchFileId,\n\t\t\t'router.dispatch.decode_reason': diagnostic.reason,\n\t\t});\n\t\tyield* Effect.logWarning(\n\t\t\t`router dispatch route file ${diagnostic.path} could not be fully decoded; ` +\n\t\t\t\t`reason=${diagnostic.reason}; treating it as an unknown route lease where destructive bootstrap safety matters`,\n\t\t);\n\t});\n\nconst readDispatchRouteScan = (\n\tfs: FileSystem.FileSystem,\n\tdispatchDir: string,\n\tdispatchFileId: string,\n\toptions: { readonly strict?: boolean } = {},\n): Effect.Effect<DispatchRouteScan, DispatchWriteFailed> =>\n\tEffect.gen(function* () {\n\t\tconst files = yield* fs.readDirectory(dispatchDir).pipe(\n\t\t\tEffect.mapError(\n\t\t\t\t(cause): DispatchWriteFailed =>\n\t\t\t\t\tnew DispatchWriteFailed({\n\t\t\t\t\t\tdispatchFileId,\n\t\t\t\t\t\tpath: dispatchDir,\n\t\t\t\t\t\tdetail: `readDirectory(${dispatchDir}) failed`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tconst routeFiles = files\n\t\t\t.map((filename) => ({ filename, fileId: dispatchFileIdFromFilename(filename) }))\n\t\t\t.filter(\n\t\t\t\t(entry): entry is { readonly filename: string; readonly fileId: string } =>\n\t\t\t\t\tentry.fileId !== null,\n\t\t\t);\n\t\tconst parsed = yield* Effect.forEach(\n\t\t\trouteFiles,\n\t\t\t(entry) => {\n\t\t\t\tconst filePath = path.join(dispatchDir, entry.filename);\n\t\t\t\treturn fs.readFileString(filePath).pipe(\n\t\t\t\t\tEffect.map((body) => ({\n\t\t\t\t\t\tpath: filePath,\n\t\t\t\t\t\tresult: parseDispatchRouteFile(body, entry.fileId),\n\t\t\t\t\t})),\n\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t(cause): DispatchWriteFailed =>\n\t\t\t\t\t\t\tnew DispatchWriteFailed({\n\t\t\t\t\t\t\t\tdispatchFileId,\n\t\t\t\t\t\t\t\tpath: filePath,\n\t\t\t\t\t\t\t\tdetail: `readFileString(${filePath}) failed`,\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t},\n\t\t\t{ concurrency: 'unbounded' },\n\t\t);\n\t\tconst routes: DispatchRouteMetadata[] = [];\n\t\tconst unknownRouteFileIds: string[] = [];\n\t\tconst diagnostics: DispatchRouteScanDiagnostic[] = [];\n\t\tfor (const entry of parsed) {\n\t\t\tfor (const diagnostic of entry.result.diagnostics) {\n\t\t\t\tconst withPath = { ...diagnostic, path: entry.path };\n\t\t\t\tdiagnostics.push(withPath);\n\t\t\t\tyield* warnDispatchDecodeDiagnostic(withPath);\n\t\t\t}\n\t\t\tif (entry.result._tag === 'valid') {\n\t\t\t\troutes.push(entry.result.route);\n\t\t\t} else {\n\t\t\t\tunknownRouteFileIds.push(entry.result.dispatchFileId);\n\t\t\t}\n\t\t}\n\t\tif (options.strict === true && diagnostics.length > 0) {\n\t\t\tconst first = diagnostics[0];\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew DispatchWriteFailed({\n\t\t\t\t\tdispatchFileId: first?.dispatchFileId ?? dispatchFileId,\n\t\t\t\t\tpath: first?.path ?? dispatchDir,\n\t\t\t\t\tdetail: first?.detail ?? 'dispatch route decode failed',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn { routes, unknownRouteFileIds, diagnostics };\n\t});\n\ntype DispatchLeaseStatus = 'live' | 'stale' | 'unknown-owner';\ntype RoutePublishOwnership = 'direct' | 'owned' | 'reused-live';\n\nconst classifyDispatchLease = (\n\troute: DispatchRouteMetadata,\n): Effect.Effect<DispatchLeaseStatus> => {\n\tif (route.lease === null) return Effect.succeed('unknown-owner');\n\treturn checkHolderLiveness(route.lease.owner).pipe(\n\t\tEffect.map((status) => (status === 'dead' ? 'stale' : 'live')),\n\t\tEffect.catch(() => Effect.succeed('live' as const)),\n\t);\n};\n\nconst sweepStaleDispatchRoutes = (\n\tfs: FileSystem.FileSystem,\n\tprofile: RouterProfile,\n\troutes: ReadonlyArray<DispatchRouteMetadata>,\n\tdispatchFileId: string,\n): Effect.Effect<ReadonlyArray<DispatchRouteMetadata>, DispatchWriteFailed> =>\n\tEffect.gen(function* () {\n\t\tconst active: DispatchRouteMetadata[] = [];\n\t\tfor (const route of routes) {\n\t\t\tconst status = yield* classifyDispatchLease(route);\n\t\t\tif (status === 'stale') {\n\t\t\t\tconst filePath = path.join(profile.dispatchDir, dispatchFilename(route.dispatchFileId));\n\t\t\t\tyield* fs.remove(filePath).pipe(\n\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t(cause): DispatchWriteFailed =>\n\t\t\t\t\t\t\tnew DispatchWriteFailed({\n\t\t\t\t\t\t\t\tdispatchFileId,\n\t\t\t\t\t\t\t\tpath: filePath,\n\t\t\t\t\t\t\t\tdetail: `failed to remove stale route lease ${route.dispatchFileId}`,\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tactive.push(route);\n\t\t}\n\t\treturn active;\n\t});\n\nconst makeRouteLease = (profile: RouterProfile, identity: Identity): RouteLeaseMetadata => ({\n\tversion: ROUTER_ROUTE_LEASE_VERSION,\n\trouterProfileId: profile.id,\n\tapp: String(identity.app),\n\tstack: String(identity.stack),\n\towner: ownHolder(),\n});\n\nconst sameRouteSurface = (\n\ta: Pick<DispatchRouteMetadata, 'hostname' | 'entrypointName' | 'entrypointPort' | 'wireProtocol'>,\n\tb: Pick<ResolvedRoute, 'hostname' | 'entrypointName' | 'entrypointPort' | 'wireProtocol'>,\n): boolean =>\n\ta.hostname === b.hostname &&\n\ta.entrypointName === b.entrypointName &&\n\ta.entrypointPort === b.entrypointPort &&\n\ta.wireProtocol === b.wireProtocol;\n\nconst liveRouteLeaseMismatch = (\n\texisting: DispatchRouteMetadata,\n\tresolved: ResolvedRoute,\n): RouteCollision =>\n\tnew RouteCollision({\n\t\tmessage:\n\t\t\t`router route ${resolved.dispatchFileId} is already leased by a live process ` +\n\t\t\t`with a different public route (existing ${existing.entrypointName}/` +\n\t\t\t`${existing.hostname}, attempted ${resolved.entrypointName}/${resolved.hostname})`,\n\t\thostname: resolved.hostname,\n\t\tentrypoint: resolved.entrypointName,\n\t\tdispatchIds: [existing.dispatchFileId, resolved.dispatchFileId],\n\t});\n\nconst resolvedWireProtocolFor = (decl: RoutableDecl): ResolvedWireProtocol =>\n\tdecl.wireProtocol === 'tcp' ? 'tcp' : decl.wireProtocol === 'h2c' ? 'h2c' : 'http';\n\nconst validateWireProtocolFamily = (\n\tdecl: RoutableDecl,\n\tentrypoint: { readonly name: string; readonly protocol: 'http' | 'h2c' | 'tcp' },\n): Effect.Effect<ResolvedWireProtocol, RouterValidationError> => {\n\tconst wireProtocol = resolvedWireProtocolFor(decl);\n\tconst expectFamily: 'tcp' | 'http' = wireProtocol === 'tcp' ? 'tcp' : 'http';\n\tconst entrypointFamily: 'tcp' | 'http' = entrypoint.protocol === 'tcp' ? 'tcp' : 'http';\n\tif (expectFamily === entrypointFamily) return Effect.succeed(wireProtocol);\n\treturn Effect.fail(\n\t\tnew RouterValidationError({\n\t\t\tfield: 'entrypointName',\n\t\t\tvalue: entrypoint.name,\n\t\t\tdetail:\n\t\t\t\t`wireProtocol family mismatch: decl is '${wireProtocol}' but ` +\n\t\t\t\t`entrypoint '${entrypoint.name}' is '${entrypoint.protocol}'`,\n\t\t}),\n\t);\n};\n\nconst directLoopbackHost = '127.0.0.1';\nexport const DEFAULT_ROUTE_READINESS_TIMEOUT_MS = 60_000;\nconst DEFAULT_ROUTE_READINESS_INTERVAL_MS = 100;\nconst DEFAULT_ROUTE_READINESS_REQUEST_TIMEOUT_MS = 750;\nconst proxyGatewayStatuses = new Set([502, 503, 504]);\n\nconst responseHasReadyRoute = (response: Response, resolved: ResolvedRoute): boolean =>\n\tresponse.headers.get(ROUTE_READINESS_HEADER) === resolved.dispatchFileId &&\n\t!proxyGatewayStatuses.has(response.status);\n\nconst fetchHttpRouteViaLoopback: HttpProbeFetch = (input, init) =>\n\tnew Promise<Response>((resolveResponse, rejectResponse) => {\n\t\tconst url = new URL(String(input));\n\t\tconst headers = new Headers(init?.headers);\n\t\tconst signal = init?.signal ?? undefined;\n\t\tconst hostHeader = headers.get('host') ?? headers.get('Host') ?? url.host;\n\t\theaders.delete('host');\n\t\theaders.delete('Host');\n\t\tconst requestHeaders: Record<string, string> = {};\n\t\theaders.forEach((value, key) => {\n\t\t\trequestHeaders[key] = value;\n\t\t});\n\t\trequestHeaders.host = hostHeader;\n\t\tlet settled = false;\n\t\tlet req: ReturnType<typeof httpRequest> | null = null;\n\t\tfunction onAbort(): void {\n\t\t\tconst cause = new Error('route readiness probe aborted');\n\t\t\treq?.destroy(cause);\n\t\t\tsettle(rejectResponse, cause);\n\t\t}\n\t\tconst settle = <T>(fn: (value: T) => void, value: T): void => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tif (signal !== undefined) {\n\t\t\t\tsignal.removeEventListener('abort', onAbort);\n\t\t\t}\n\t\t\tfn(value);\n\t\t};\n\t\treq = httpRequest(\n\t\t\t{\n\t\t\t\thostname: directLoopbackHost,\n\t\t\t\tport: url.port === '' ? 80 : Number(url.port),\n\t\t\t\tpath: `${url.pathname}${url.search}`,\n\t\t\t\tmethod: init?.method ?? 'GET',\n\t\t\t\theaders: requestHeaders,\n\t\t\t},\n\t\t\t(res) => {\n\t\t\t\tconst chunks: Uint8Array[] = [];\n\t\t\t\tres.on('data', (chunk: Buffer | string) => {\n\t\t\t\t\tchunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);\n\t\t\t\t});\n\t\t\t\tres.on('end', () => {\n\t\t\t\t\tconst responseHeaders = new Headers();\n\t\t\t\t\tfor (const [key, value] of Object.entries(res.headers)) {\n\t\t\t\t\t\tif (value === undefined) continue;\n\t\t\t\t\t\tif (Array.isArray(value)) {\n\t\t\t\t\t\t\tfor (const item of value) responseHeaders.append(key, item);\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tresponseHeaders.set(key, value);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tsettle(\n\t\t\t\t\t\tresolveResponse,\n\t\t\t\t\t\tnew Response(new Uint8Array(Buffer.concat(chunks)), {\n\t\t\t\t\t\t\tstatus: res.statusCode ?? 599,\n\t\t\t\t\t\t\tstatusText: res.statusMessage,\n\t\t\t\t\t\t\theaders: responseHeaders,\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t});\n\t\t\t},\n\t\t);\n\t\tif (signal?.aborted === true) {\n\t\t\tonAbort();\n\t\t\treturn;\n\t\t}\n\t\tsignal?.addEventListener('abort', onAbort, { once: true });\n\t\treq.on('error', (cause) => settle(rejectResponse, cause));\n\t\treq.end();\n\t});\n\nconst resolveDisabledDirectRoute = (\n\tidentity: Identity,\n\tdecl: RoutableDecl,\n\tregistry: EntrypointRegistryShape,\n): Effect.Effect<\n\tResolvedRoute,\n\tUnknownEntrypoint | RouterDisabledRouteUnsupported | RouterValidationError\n> =>\n\tEffect.gen(function* () {\n\t\tif (decl.upstream.type === 'container') {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterDisabledRouteUnsupported({\n\t\t\t\t\tendpointName: decl.endpointName,\n\t\t\t\t\tupstreamKind: 'container',\n\t\t\t\t\tdetail:\n\t\t\t\t\t\t'router is disabled, but container upstreams are only reachable through the router network/proxy; ' +\n\t\t\t\t\t\t'use a host-loopback upstream or publish an explicit direct endpoint instead',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\tconst port = decl.upstream.port;\n\t\tif (!Number.isInteger(port) || port <= 0 || port > 65535) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'upstreamUrl',\n\t\t\t\t\tvalue: `${directLoopbackHost}:${port}`,\n\t\t\t\t\tdetail: 'disabled-router direct host-loopback routes require a concrete TCP port 1-65535',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\tconst entrypoint = yield* registry.byName(decl.endpointName);\n\t\tconst wireProtocol = yield* validateWireProtocolFamily(decl, entrypoint);\n\t\tconst fileId = yield* dispatchFileId({ identity, dispatch: decl.dispatchId });\n\t\tconst scheme = wireProtocol === 'tcp' ? 'tcp' : 'http';\n\t\treturn {\n\t\t\tdispatchFileId: fileId,\n\t\t\thostname: directLoopbackHost,\n\t\t\tentrypointName: entrypoint.name,\n\t\t\tentrypointPort: port,\n\t\t\tupstreamUrl: `${scheme}://${directLoopbackHost}:${port}`,\n\t\t\tcors: decl.wireProtocol === 'tcp' ? false : decl.cors,\n\t\t\twireProtocol,\n\t\t};\n\t});\n\nconst endpointFromResolvedRoute = (decl: RoutableDecl, resolved: ResolvedRoute): EndpointUrl => {\n\tconst url =\n\t\tresolved.wireProtocol === 'tcp'\n\t\t\t? `tcp://127.0.0.1:${resolved.entrypointPort}`\n\t\t\t: `http://${resolved.hostname}:${resolved.entrypointPort}`;\n\treturn {\n\t\tendpointName: decl.endpointName,\n\t\thostname: resolved.hostname,\n\t\tentrypointPort: resolved.entrypointPort,\n\t\turl,\n\t\twireProtocol: resolved.wireProtocol,\n\t};\n};\n\nconst removeDispatchFile = (\n\tfs: FileSystem.FileSystem,\n\tprofile: RouterProfile,\n\tresolved: ResolvedRoute,\n): Effect.Effect<void> =>\n\tfs\n\t\t.remove(path.join(profile.dispatchDir, dispatchFilename(resolved.dispatchFileId)))\n\t\t.pipe(Effect.ignore);\n\nconst waitForPublicRouteReadiness = (\n\tcfg: RouterConfigShape,\n\tendpoint: EndpointUrl,\n\tresolved: ResolvedRoute,\n): Effect.Effect<void, RouteReadinessProbeFailed> => {\n\tconst options = cfg.routeReadinessProbe;\n\tif (options?.enabled !== true || cfg.disabled || resolved.wireProtocol === 'tcp') {\n\t\treturn Effect.void;\n\t}\n\tconst timeoutMs = options.timeoutMs ?? DEFAULT_ROUTE_READINESS_TIMEOUT_MS;\n\tconst intervalMs = options.intervalMs ?? DEFAULT_ROUTE_READINESS_INTERVAL_MS;\n\tconst requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_ROUTE_READINESS_REQUEST_TIMEOUT_MS;\n\tconst probeUrl = `http://${directLoopbackHost}:${resolved.entrypointPort}`;\n\treturn waitForHttpEndpoint({\n\t\tendpoint: probeUrl,\n\t\ttimeoutMs,\n\t\tintervalMs,\n\t\trequestTimeoutMs,\n\t\trequestInit: { headers: { host: resolved.hostname } },\n\t\tfetch: options.fetch ?? fetchHttpRouteViaLoopback,\n\t\tvalidate: (response) => responseHasReadyRoute(response, resolved),\n\t}).pipe(\n\t\tEffect.mapError(\n\t\t\t(cause): RouteReadinessProbeFailed =>\n\t\t\t\tnew RouteReadinessProbeFailed({\n\t\t\t\t\tdispatchFileId: resolved.dispatchFileId,\n\t\t\t\t\turl: endpoint.url,\n\t\t\t\t\ttimeoutMs,\n\t\t\t\t\tdetail:\n\t\t\t\t\t\t`public router endpoint ${endpoint.url} did not serve route ` +\n\t\t\t\t\t\t`${resolved.dispatchFileId} within ${timeoutMs}ms ` +\n\t\t\t\t\t\t`(probeUrl=${probeUrl}, hostHeader=${resolved.hostname})`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t),\n\t);\n};\n\n// ---------------------------------------------------------------------------\n// Layer — wire the orchestrator\n// ---------------------------------------------------------------------------\n\nexport const layerRouterService: Layer.Layer<\n\tRouterService,\n\tnever,\n\t| RouterConfig\n\t| IdentityContext\n\t| EntrypointRegistry\n\t| TraefikContainerOpsService\n\t| UpstreamResolverService\n\t| FileSystem.FileSystem\n> = Layer.effect(\n\tRouterService,\n\tEffect.gen(function* () {\n\t\tconst cfg = yield* RouterConfig;\n\t\tconst identity = yield* IdentityContext;\n\t\tconst registry = yield* EntrypointRegistry;\n\t\tconst upstreams = yield* UpstreamResolverService;\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\t// Capture the Traefik ops service in the layer's outer scope so\n\t\t// `bootstrap` (which reads it from Context) doesn't surface\n\t\t// requirements through `boot()`'s return type. Provided to\n\t\t// downstream calls via `Effect.provideService`.\n\t\tconst traefikOps = yield* TraefikContainerOpsService;\n\n\t\t// Cached boot report — set on first `boot()` call.\n\t\tconst bootRef = yield* Ref.make<BootReport | null>(null);\n\n\t\t// Applied routes — subscribable for diagnostics. Empty until the\n\t\t// first `contributeRoute()`. The orchestrator publishes the\n\t\t// *resolved* shape (post URL-resolution) rather than the raw\n\t\t// decls so downstream surfaces don't have to re-resolve.\n\t\tconst applied = yield* SubscriptionRef.make<ReadonlyArray<ResolvedRoute>>([]);\n\n\t\t// ---------------------------------------------------------------\n\t\t// boot — adopt-or-create the Traefik container.\n\t\t// ---------------------------------------------------------------\n\t\tconst boot: RouterServiceShape['boot'] = () =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst profile = cfg.profile;\n\t\t\t\tif (cfg.disabled) {\n\t\t\t\t\tconst report: BootReport = {\n\t\t\t\t\t\tdecision: 'opt-out',\n\t\t\t\t\t\tcontainerId: null,\n\t\t\t\t\t\tnetworkId: null,\n\t\t\t\t\t\timageMatches: true,\n\t\t\t\t\t};\n\t\t\t\t\tyield* Ref.set(bootRef, report);\n\t\t\t\t\treturn report;\n\t\t\t\t}\n\t\t\t\tconst cached = yield* Ref.get(bootRef);\n\t\t\t\tif (cached !== null) return cached;\n\t\t\t\tconst protectedRouteLeaseIds = yield* Effect.scoped(\n\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\tyield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): RouterBootFailed =>\n\t\t\t\t\t\t\t\t\tnew RouterBootFailed({\n\t\t\t\t\t\t\t\t\t\tstage: 'ensure-container',\n\t\t\t\t\t\t\t\t\t\tdetail: `failed to acquire router dispatch lock ${profile.dispatchLockFile}`,\n\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t\t// Write the shared CORS middleware file before reading\n\t\t\t\t\t\t// active dispatch routes so the later bootstrap phase can\n\t\t\t\t\t\t// hold only the bootstrap lock.\n\t\t\t\t\t\tyield* fs.makeDirectory(profile.dispatchDir, { recursive: true }).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): RouterBootFailed =>\n\t\t\t\t\t\t\t\t\tnew RouterBootFailed({\n\t\t\t\t\t\t\t\t\t\tstage: 'write-shared-config',\n\t\t\t\t\t\t\t\t\t\tdetail: `makeDirectory(${profile.dispatchDir}) failed`,\n\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t\tyield* atomicWriteFile(\n\t\t\t\t\t\t\tpath.join(profile.dispatchDir, CORS_MIDDLEWARE_FILENAME),\n\t\t\t\t\t\t\tnew TextEncoder().encode(renderCorsMiddlewareYaml()),\n\t\t\t\t\t\t\t{ mode: 0o644 },\n\t\t\t\t\t\t).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): RouterBootFailed =>\n\t\t\t\t\t\t\t\t\tnew RouterBootFailed({\n\t\t\t\t\t\t\t\t\t\tstage: 'write-shared-config',\n\t\t\t\t\t\t\t\t\t\tdetail: `atomicWriteFile(${CORS_MIDDLEWARE_FILENAME}) failed at stage ${cause.stage}`,\n\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tEffect.provideService(FileSystem.FileSystem, fs),\n\t\t\t\t\t\t);\n\t\t\t\t\t\tconst existingDispatchScan = yield* readDispatchRouteScan(\n\t\t\t\t\t\t\tfs,\n\t\t\t\t\t\t\tprofile.dispatchDir,\n\t\t\t\t\t\t\t'router-boot',\n\t\t\t\t\t\t).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): RouterBootFailed =>\n\t\t\t\t\t\t\t\t\tnew RouterBootFailed({\n\t\t\t\t\t\t\t\t\t\tstage: 'inspect',\n\t\t\t\t\t\t\t\t\t\tdetail: cause.detail,\n\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t\tconst activeDispatchRoutes = yield* sweepStaleDispatchRoutes(\n\t\t\t\t\t\t\tfs,\n\t\t\t\t\t\t\tprofile,\n\t\t\t\t\t\t\texistingDispatchScan.routes,\n\t\t\t\t\t\t\t'router-boot',\n\t\t\t\t\t\t).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): RouterBootFailed =>\n\t\t\t\t\t\t\t\t\tnew RouterBootFailed({\n\t\t\t\t\t\t\t\t\t\tstage: 'write-shared-config',\n\t\t\t\t\t\t\t\t\t\tdetail: cause.detail,\n\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn [\n\t\t\t\t\t\t\t...activeDispatchRoutes.map((route) => route.dispatchFileId),\n\t\t\t\t\t\t\t...existingDispatchScan.unknownRouteFileIds,\n\t\t\t\t\t\t];\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\tconst report = yield* Effect.scoped(\n\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\tyield* acquireStackLock(profile.bootstrapLockFile, ROUTER_LOCK_TIMEOUT_MILLIS).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): RouterBootFailed =>\n\t\t\t\t\t\t\t\t\tnew RouterBootFailed({\n\t\t\t\t\t\t\t\t\t\tstage: 'ensure-container',\n\t\t\t\t\t\t\t\t\t\tdetail: `failed to acquire router bootstrap lock ${profile.bootstrapLockFile}`,\n\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn yield* bootstrap({\n\t\t\t\t\t\t\timage: cfg.image,\n\t\t\t\t\t\t\tentrypoints: registry.all(),\n\t\t\t\t\t\t\tprofile,\n\t\t\t\t\t\t\tprotectedRouteLeaseIds,\n\t\t\t\t\t\t}).pipe(Effect.provideService(TraefikContainerOpsService, traefikOps));\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\tyield* Ref.set(bootRef, report);\n\t\t\t\treturn report;\n\t\t\t}).pipe(Effect.withSpan('orchestrator.router.boot'));\n\n\t\t// ---------------------------------------------------------------\n\t\t// contributeRoute — resolve + write dispatch file + scope finalizer.\n\t\t// ---------------------------------------------------------------\n\t\tconst contributeRoute: RouterServiceShape['contributeRoute'] = (decl) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst profile = cfg.profile;\n\t\t\t\tconst resolved = cfg.disabled\n\t\t\t\t\t? yield* resolveDisabledDirectRoute(identity, decl, registry)\n\t\t\t\t\t: yield* resolveRoute(identity, decl, registry, upstreams);\n\t\t\t\tconst lease = makeRouteLease(profile, identity);\n\t\t\t\tconst endpoint = endpointFromResolvedRoute(decl, resolved);\n\t\t\t\tconst publishRouteFile: Effect.Effect<\n\t\t\t\t\tRoutePublishOwnership,\n\t\t\t\t\tDispatchWriteFailed | RouteCollision\n\t\t\t\t> = Effect.gen(function* () {\n\t\t\t\t\t// Collision check against this process's applied set\n\t\t\t\t\t// plus files already present in the shared dispatch\n\t\t\t\t\t// directory. The dispatch lock makes the scan + write a\n\t\t\t\t\t// cross-process critical section.\n\t\t\t\t\tif (cfg.disabled) return 'direct';\n\t\t\t\t\tif (!cfg.disabled) {\n\t\t\t\t\t\tyield* fs.makeDirectory(profile.dispatchDir, { recursive: true }).pipe(\n\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t(cause): DispatchWriteFailed =>\n\t\t\t\t\t\t\t\t\tnew DispatchWriteFailed({\n\t\t\t\t\t\t\t\t\t\tdispatchFileId: resolved.dispatchFileId,\n\t\t\t\t\t\t\t\t\t\tpath: profile.dispatchDir,\n\t\t\t\t\t\t\t\t\t\tdetail: `makeDirectory(${profile.dispatchDir}) failed`,\n\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tconst currentApplied = yield* SubscriptionRef.get(applied);\n\t\t\t\t\tconst currentIds = new Set(currentApplied.map((route) => route.dispatchFileId));\n\t\t\t\t\tlet reuseLiveRoute = false;\n\t\t\t\t\tconst readScan = yield* readDispatchRouteScan(\n\t\t\t\t\t\tfs,\n\t\t\t\t\t\tprofile.dispatchDir,\n\t\t\t\t\t\tresolved.dispatchFileId,\n\t\t\t\t\t);\n\t\t\t\t\tconst activeDispatchRoutes = yield* sweepStaleDispatchRoutes(\n\t\t\t\t\t\tfs,\n\t\t\t\t\t\tprofile,\n\t\t\t\t\t\treadScan.routes,\n\t\t\t\t\t\tresolved.dispatchFileId,\n\t\t\t\t\t);\n\t\t\t\t\tconst existingSameDispatchRoute = activeDispatchRoutes.find(\n\t\t\t\t\t\t(route) => route.dispatchFileId === resolved.dispatchFileId,\n\t\t\t\t\t);\n\t\t\t\t\tif (\n\t\t\t\t\t\texistingSameDispatchRoute !== undefined &&\n\t\t\t\t\t\t!currentIds.has(existingSameDispatchRoute.dispatchFileId)\n\t\t\t\t\t) {\n\t\t\t\t\t\tconst status = yield* classifyDispatchLease(existingSameDispatchRoute);\n\t\t\t\t\t\tif (status === 'live') {\n\t\t\t\t\t\t\tif (!sameRouteSurface(existingSameDispatchRoute, resolved)) {\n\t\t\t\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\t\t\t\tliveRouteLeaseMismatch(existingSameDispatchRoute, resolved),\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\treuseLiveRoute = true;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tconst existingDispatchRoutes = activeDispatchRoutes.filter(\n\t\t\t\t\t\t(route) =>\n\t\t\t\t\t\t\t!currentIds.has(route.dispatchFileId) &&\n\t\t\t\t\t\t\troute.dispatchFileId !== resolved.dispatchFileId,\n\t\t\t\t\t);\n\t\t\t\t\tconst collision = detectCollisions([\n\t\t\t\t\t\t...existingDispatchRoutes,\n\t\t\t\t\t\t...currentApplied,\n\t\t\t\t\t\tresolved,\n\t\t\t\t\t]);\n\t\t\t\t\tif (collision) return yield* Effect.fail(collision);\n\t\t\t\t\tif (reuseLiveRoute) return 'reused-live';\n\n\t\t\t\t\t// Atomic write — invariant #5. tmp + rename via the\n\t\t\t\t\t// substrate's `atomicWriteFile` helper; Traefik's\n\t\t\t\t\t// watcher tolerates rename atomically.\n\t\t\t\t\tconst filePath = path.join(\n\t\t\t\t\t\tprofile.dispatchDir,\n\t\t\t\t\t\tdispatchFilename(resolved.dispatchFileId),\n\t\t\t\t\t);\n\t\t\t\t\tyield* atomicWriteFile(\n\t\t\t\t\t\tfilePath,\n\t\t\t\t\t\tnew TextEncoder().encode(renderRouteYaml(resolved, lease)),\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tmode: 0o644,\n\t\t\t\t\t\t},\n\t\t\t\t\t).pipe(\n\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t(cause): DispatchWriteFailed =>\n\t\t\t\t\t\t\t\tnew DispatchWriteFailed({\n\t\t\t\t\t\t\t\t\tdispatchFileId: resolved.dispatchFileId,\n\t\t\t\t\t\t\t\t\tpath: filePath,\n\t\t\t\t\t\t\t\t\tdetail: `atomicWriteFile failed at stage ${cause.stage}`,\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t),\n\t\t\t\t\t\tEffect.provideService(FileSystem.FileSystem, fs),\n\t\t\t\t\t);\n\t\t\t\t\treturn 'owned';\n\t\t\t\t});\n\n\t\t\t\tlet publishOwnership: RoutePublishOwnership;\n\t\t\t\tif (cfg.disabled) {\n\t\t\t\t\tpublishOwnership = yield* publishRouteFile;\n\t\t\t\t} else {\n\t\t\t\t\tpublishOwnership = yield* Effect.scoped(\n\t\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\t\tyield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS).pipe(\n\t\t\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t\t\t(cause): DispatchWriteFailed =>\n\t\t\t\t\t\t\t\t\t\tnew DispatchWriteFailed({\n\t\t\t\t\t\t\t\t\t\t\tdispatchFileId: resolved.dispatchFileId,\n\t\t\t\t\t\t\t\t\t\t\tpath: profile.dispatchLockFile,\n\t\t\t\t\t\t\t\t\t\t\tdetail: `failed to acquire dispatch lock ${profile.dispatchLockFile}`,\n\t\t\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn yield* publishRouteFile;\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tyield* waitForPublicRouteReadiness(cfg, endpoint, resolved).pipe(\n\t\t\t\t\tEffect.onError(() =>\n\t\t\t\t\t\tcfg.disabled || publishOwnership !== 'owned'\n\t\t\t\t\t\t\t? Effect.void\n\t\t\t\t\t\t\t: Effect.scoped(\n\t\t\t\t\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\t\t\t\t\tyield* acquireStackLock(\n\t\t\t\t\t\t\t\t\t\t\tprofile.dispatchLockFile,\n\t\t\t\t\t\t\t\t\t\t\tROUTER_LOCK_TIMEOUT_MILLIS,\n\t\t\t\t\t\t\t\t\t\t).pipe(Effect.ignore);\n\t\t\t\t\t\t\t\t\t\tyield* removeDispatchFile(fs, profile, resolved);\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tif (publishOwnership !== 'reused-live') {\n\t\t\t\t\tyield* SubscriptionRef.update(applied, (arr) => [...arr, resolved]);\n\n\t\t\t\t\t// Scope finalizer — remove the file + drop from applied\n\t\t\t\t\t// when the caller's scope closes. Best-effort: \"already\n\t\t\t\t\t// gone\" is fine per distilled-doc.\n\t\t\t\t\tyield* Effect.addFinalizer(() =>\n\t\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\t\tif (publishOwnership === 'owned') {\n\t\t\t\t\t\t\t\tyield* Effect.scoped(\n\t\t\t\t\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\t\t\t\t\tyield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS);\n\t\t\t\t\t\t\t\t\t\tyield* removeDispatchFile(fs, profile, resolved);\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t).pipe(Effect.ignore);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tyield* SubscriptionRef.update(applied, (arr) =>\n\t\t\t\t\t\t\t\tarr.filter((r) => r.dispatchFileId !== resolved.dispatchFileId),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\treturn endpoint;\n\t\t\t}).pipe(Effect.withSpan('orchestrator.router.contributeRoute'));\n\n\t\treturn RouterService.of({ boot, contributeRoute, applied });\n\t}),\n);\n\n// ---------------------------------------------------------------------------\n// Helpers for tests + composition\n// ---------------------------------------------------------------------------\n\n/** Stream of the resolved-route set. Use from a renderer / inventory\n *  surface to react to route adds + removes. The supervisor's main\n *  loop subscribes through this stream. */\nexport const routesStream = (\n\trouter: RouterServiceShape,\n): Stream.Stream<ReadonlyArray<ResolvedRoute>> => SubscriptionRef.changes(router.applied);\n\n// Re-export for ergonomics — callers reach for the orchestrator\n// without having to spell out the sibling module paths.\nexport { type ResolvedRoute, type UpstreamResolver } from './file-provider.ts';\nexport type { BootReport } from './traefik-container.ts';\nexport type { UpstreamResolveTimeout } from './errors.ts';\nexport type { Identity } from '../../substrate/identity.ts';\nexport type { RoutableDecl } from '../../contracts/routable.ts';\n"],"mappings":";;;;;;;;;;;;;;;;;AAqFA,MAAM,6BAA6B;AAoCnC,IAAa,eAAb,cAAkC,QAAQ,SAA0C,CACnF,sDACA,CAAC;;;AAIF,MAAa,4BAA4B,QACxC,MAAM,QAAQ,aAAa,CAAC,IAAI;AAMjC,IAAa,0BAAb,cAA6C,QAAQ,SAGlD,CAAC,0DAA0D,CAAC;AAE/D,MAAa,+BACZ,YAEA,MAAM,OACL,yBACA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,OAAO;CAC1B,MAAM,gBAAgB,OAAO;CAC7B,MAAM,cAAc,QAAQ;CAC5B,MAAM,iBACL,WAEA,OAAO,KACN,OAAO,eAAe,YAAY,WAAW,EAC7C,OAAO,eAAe,eAAe,cAAc,CACnD;AAEF,QAAO,wBAAwB,GAAG;EACjC,mBAAmB,WAClB,cACC,QAAQ,OAAO,eAAe,YAAY,CAAC,KAC1C,OAAO,QAAQ,UAAU,OAAO,eAAe,YAAY,CAAC,CAC5D,CACD,CAAC,KACD,OAAO,KAAK,UAAU;GAAE;GAAM,MAAM,OAAO;GAAe,EAAE,EAC5D,OAAO,UACL,UACA,IAAI,sBAAsB;GACzB,OAAO;GACP,OAAO,OAAO;GACd,QAAQ,+DAA+D,OAAO,MAAM;GACpF,CAAC,CACH,CACD;EACF,sBAAsB,WACrB,OAAO,QAAQ;GAAE,MAAM;GAAwB,MAAM,OAAO;GAAM,CAAC;EACpE,CAAC;EACD,CACF;AAyCF,IAAa,gBAAb,cAAmC,QAAQ,SAA4C,CACtF,gDACA,CAAC;AAYF,MAAM,gCACL,eAEA,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO,oBAAoB;EACjC,wBAAwB,WAAW;EACnC,2BAA2B,WAAW;EACtC,iCAAiC,WAAW;EAC5C,CAAC;AACF,QAAO,OAAO,WACb,8BAA8B,WAAW,KAAK,sCACnC,WAAW,OAAO,oFAC7B;EACA;AAEH,MAAM,yBACL,IACA,aACA,gBACA,UAAyC,EAAE,KAE3C,OAAO,IAAI,aAAa;CAYvB,MAAM,cAAa,OAXE,GAAG,cAAc,YAAY,CAAC,KAClD,OAAO,UACL,UACA,IAAI,oBAAoB;EACvB;EACA,MAAM;EACN,QAAQ,iBAAiB,YAAY;EACrC;EACA,CAAC,CACH,CACD,EAEC,KAAK,cAAc;EAAE;EAAU,QAAQ,2BAA2B,SAAS;EAAE,EAAE,CAC/E,QACC,UACA,MAAM,WAAW,KAClB;CACF,MAAM,SAAS,OAAO,OAAO,QAC5B,aACC,UAAU;EACV,MAAM,WAAW,KAAK,KAAK,aAAa,MAAM,SAAS;AACvD,SAAO,GAAG,eAAe,SAAS,CAAC,KAClC,OAAO,KAAK,UAAU;GACrB,MAAM;GACN,QAAQ,uBAAuB,MAAM,MAAM,OAAO;GAClD,EAAE,EACH,OAAO,UACL,UACA,IAAI,oBAAoB;GACvB;GACA,MAAM;GACN,QAAQ,kBAAkB,SAAS;GACnC;GACA,CAAC,CACH,CACD;IAEF,EAAE,aAAa,aAAa,CAC5B;CACD,MAAM,SAAkC,EAAE;CAC1C,MAAM,sBAAgC,EAAE;CACxC,MAAM,cAA6C,EAAE;AACrD,MAAK,MAAM,SAAS,QAAQ;AAC3B,OAAK,MAAM,cAAc,MAAM,OAAO,aAAa;GAClD,MAAM,WAAW;IAAE,GAAG;IAAY,MAAM,MAAM;IAAM;AACpD,eAAY,KAAK,SAAS;AAC1B,UAAO,6BAA6B,SAAS;;AAE9C,MAAI,MAAM,OAAO,SAAS,QACzB,QAAO,KAAK,MAAM,OAAO,MAAM;MAE/B,qBAAoB,KAAK,MAAM,OAAO,eAAe;;AAGvD,KAAI,QAAQ,WAAW,QAAQ,YAAY,SAAS,GAAG;EACtD,MAAM,QAAQ,YAAY;AAC1B,SAAO,OAAO,OAAO,KACpB,IAAI,oBAAoB;GACvB,gBAAgB,OAAO,kBAAkB;GACzC,MAAM,OAAO,QAAQ;GACrB,QAAQ,OAAO,UAAU;GACzB,CAAC,CACF;;AAEF,QAAO;EAAE;EAAQ;EAAqB;EAAa;EAClD;AAKH,MAAM,yBACL,UACwC;AACxC,KAAI,MAAM,UAAU,KAAM,QAAO,OAAO,QAAQ,gBAAgB;AAChE,QAAO,oBAAoB,MAAM,MAAM,MAAM,CAAC,KAC7C,OAAO,KAAK,WAAY,WAAW,SAAS,UAAU,OAAQ,EAC9D,OAAO,YAAY,OAAO,QAAQ,OAAgB,CAAC,CACnD;;AAGF,MAAM,4BACL,IACA,SACA,QACA,mBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAkC,EAAE;AAC1C,MAAK,MAAM,SAAS,QAAQ;AAE3B,OAAI,OADkB,sBAAsB,MAAM,MACnC,SAAS;GACvB,MAAM,WAAW,KAAK,KAAK,QAAQ,aAAa,iBAAiB,MAAM,eAAe,CAAC;AACvF,UAAO,GAAG,OAAO,SAAS,CAAC,KAC1B,OAAO,UACL,UACA,IAAI,oBAAoB;IACvB;IACA,MAAM;IACN,QAAQ,sCAAsC,MAAM;IACpD;IACA,CAAC,CACH,CACD;AACD;;AAED,SAAO,KAAK,MAAM;;AAEnB,QAAO;EACN;AAEH,MAAM,kBAAkB,SAAwB,cAA4C;CAC3F,SAAA;CACA,iBAAiB,QAAQ;CACzB,KAAK,OAAO,SAAS,IAAI;CACzB,OAAO,OAAO,SAAS,MAAM;CAC7B,OAAO,WAAW;CAClB;AAED,MAAM,oBACL,GACA,MAEA,EAAE,aAAa,EAAE,YACjB,EAAE,mBAAmB,EAAE,kBACvB,EAAE,mBAAmB,EAAE,kBACvB,EAAE,iBAAiB,EAAE;AAEtB,MAAM,0BACL,UACA,aAEA,IAAI,eAAe;CAClB,SACC,gBAAgB,SAAS,eAAe,+EACG,SAAS,eAAe,GAChE,SAAS,SAAS,cAAc,SAAS,eAAe,GAAG,SAAS,SAAS;CACjF,UAAU,SAAS;CACnB,YAAY,SAAS;CACrB,aAAa,CAAC,SAAS,gBAAgB,SAAS,eAAe;CAC/D,CAAC;AAEH,MAAM,2BAA2B,SAChC,KAAK,iBAAiB,QAAQ,QAAQ,KAAK,iBAAiB,QAAQ,QAAQ;AAE7E,MAAM,8BACL,MACA,eACgE;CAChE,MAAM,eAAe,wBAAwB,KAAK;AAGlD,MAFqC,iBAAiB,QAAQ,QAAQ,aAC7B,WAAW,aAAa,QAAQ,QAAQ,QAC1C,QAAO,OAAO,QAAQ,aAAa;AAC1E,QAAO,OAAO,KACb,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO,WAAW;EAClB,QACC,0CAA0C,aAAa,oBACxC,WAAW,KAAK,QAAQ,WAAW,SAAS;EAC5D,CAAC,CACF;;AAGF,MAAM,qBAAqB;AAE3B,MAAM,sCAAsC;AAC5C,MAAM,6CAA6C;AACnD,MAAM,uBAAuB,IAAI,IAAI;CAAC;CAAK;CAAK;CAAI,CAAC;AAErD,MAAM,yBAAyB,UAAoB,aAClD,SAAS,QAAQ,IAAA,sBAA2B,KAAK,SAAS,kBAC1D,CAAC,qBAAqB,IAAI,SAAS,OAAO;AAE3C,MAAM,6BAA6C,OAAO,SACzD,IAAI,SAAmB,iBAAiB,mBAAmB;CAC1D,MAAM,MAAM,IAAI,IAAI,OAAO,MAAM,CAAC;CAClC,MAAM,UAAU,IAAI,QAAQ,MAAM,QAAQ;CAC1C,MAAM,SAAS,MAAM,UAAU,KAAA;CAC/B,MAAM,aAAa,QAAQ,IAAI,OAAO,IAAI,QAAQ,IAAI,OAAO,IAAI,IAAI;AACrE,SAAQ,OAAO,OAAO;AACtB,SAAQ,OAAO,OAAO;CACtB,MAAM,iBAAyC,EAAE;AACjD,SAAQ,SAAS,OAAO,QAAQ;AAC/B,iBAAe,OAAO;GACrB;AACF,gBAAe,OAAO;CACtB,IAAI,UAAU;CACd,IAAI,MAA6C;CACjD,SAAS,UAAgB;EACxB,MAAM,wBAAQ,IAAI,MAAM,gCAAgC;AACxD,OAAK,QAAQ,MAAM;AACnB,SAAO,gBAAgB,MAAM;;CAE9B,MAAM,UAAa,IAAwB,UAAmB;AAC7D,MAAI,QAAS;AACb,YAAU;AACV,MAAI,WAAW,KAAA,EACd,QAAO,oBAAoB,SAAS,QAAQ;AAE7C,KAAG,MAAM;;AAEV,OAAMA,QACL;EACC,UAAU;EACV,MAAM,IAAI,SAAS,KAAK,KAAK,OAAO,IAAI,KAAK;EAC7C,MAAM,GAAG,IAAI,WAAW,IAAI;EAC5B,QAAQ,MAAM,UAAU;EACxB,SAAS;EACT,GACA,QAAQ;EACR,MAAM,SAAuB,EAAE;AAC/B,MAAI,GAAG,SAAS,UAA2B;AAC1C,UAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,MAAM,GAAG,MAAM;IAClE;AACF,MAAI,GAAG,aAAa;GACnB,MAAM,kBAAkB,IAAI,SAAS;AACrC,QAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,QAAQ,EAAE;AACvD,QAAI,UAAU,KAAA,EAAW;AACzB,QAAI,MAAM,QAAQ,MAAM,CACvB,MAAK,MAAM,QAAQ,MAAO,iBAAgB,OAAO,KAAK,KAAK;QAE3D,iBAAgB,IAAI,KAAK,MAAM;;AAGjC,UACC,iBACA,IAAI,SAAS,IAAI,WAAW,OAAO,OAAO,OAAO,CAAC,EAAE;IACnD,QAAQ,IAAI,cAAc;IAC1B,YAAY,IAAI;IAChB,SAAS;IACT,CAAC,CACF;IACA;GAEH;AACD,KAAI,QAAQ,YAAY,MAAM;AAC7B,WAAS;AACT;;AAED,SAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1D,KAAI,GAAG,UAAU,UAAU,OAAO,gBAAgB,MAAM,CAAC;AACzD,KAAI,KAAK;EACR;AAEH,MAAM,8BACL,UACA,MACA,aAKA,OAAO,IAAI,aAAa;AACvB,KAAI,KAAK,SAAS,SAAS,YAC1B,QAAO,OAAO,OAAO,KACpB,IAAI,+BAA+B;EAClC,cAAc,KAAK;EACnB,cAAc;EACd,QACC;EAED,CAAC,CACF;CAGF,MAAM,OAAO,KAAK,SAAS;AAC3B,KAAI,CAAC,OAAO,UAAU,KAAK,IAAI,QAAQ,KAAK,OAAO,MAClD,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO,GAAG,mBAAmB,GAAG;EAChC,QAAQ;EACR,CAAC,CACF;CAGF,MAAM,aAAa,OAAO,SAAS,OAAO,KAAK,aAAa;CAC5D,MAAM,eAAe,OAAO,2BAA2B,MAAM,WAAW;CACxE,MAAM,SAAS,OAAO,eAAe;EAAE;EAAU,UAAU,KAAK;EAAY,CAAC;CAC7E,MAAM,SAAS,iBAAiB,QAAQ,QAAQ;AAChD,QAAO;EACN,gBAAgB;EAChB,UAAU;EACV,gBAAgB,WAAW;EAC3B,gBAAgB;EAChB,aAAa,GAAG,OAAO,KAAK,mBAAmB,GAAG;EAClD,MAAM,KAAK,iBAAiB,QAAQ,QAAQ,KAAK;EACjD;EACA;EACA;AAEH,MAAM,6BAA6B,MAAoB,aAAyC;CAC/F,MAAM,MACL,SAAS,iBAAiB,QACvB,mBAAmB,SAAS,mBAC5B,UAAU,SAAS,SAAS,GAAG,SAAS;AAC5C,QAAO;EACN,cAAc,KAAK;EACnB,UAAU,SAAS;EACnB,gBAAgB,SAAS;EACzB;EACA,cAAc,SAAS;EACvB;;AAGF,MAAM,sBACL,IACA,SACA,aAEA,GACE,OAAO,KAAK,KAAK,QAAQ,aAAa,iBAAiB,SAAS,eAAe,CAAC,CAAC,CACjF,KAAK,OAAO,OAAO;AAEtB,MAAM,+BACL,KACA,UACA,aACoD;CACpD,MAAM,UAAU,IAAI;AACpB,KAAI,SAAS,YAAY,QAAQ,IAAI,YAAY,SAAS,iBAAiB,MAC1E,QAAO,OAAO;CAEf,MAAM,YAAY,QAAQ,aAAA;CAC1B,MAAM,aAAa,QAAQ,cAAc;CACzC,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,WAAW,UAAU,mBAAmB,GAAG,SAAS;AAC1D,QAAO,oBAAoB;EAC1B,UAAU;EACV;EACA;EACA;EACA,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,UAAU,EAAE;EACrD,OAAO,QAAQ,SAAS;EACxB,WAAW,aAAa,sBAAsB,UAAU,SAAS;EACjE,CAAC,CAAC,KACF,OAAO,UACL,UACA,IAAI,0BAA0B;EAC7B,gBAAgB,SAAS;EACzB,KAAK,SAAS;EACd;EACA,QACC,0BAA0B,SAAS,IAAI,uBACpC,SAAS,eAAe,UAAU,UAAU,eAClC,SAAS,eAAe,SAAS,SAAS;EACxD;EACA,CAAC,CACH,CACD;;AAOF,MAAa,qBAST,MAAM,OACT,eACA,OAAO,IAAI,aAAa;CACvB,MAAM,MAAM,OAAO;CACnB,MAAM,WAAW,OAAO;CACxB,MAAM,WAAW,OAAO;CACxB,MAAM,YAAY,OAAO;CACzB,MAAM,KAAK,OAAO,WAAW;CAK7B,MAAM,aAAa,OAAO;CAG1B,MAAM,UAAU,OAAO,IAAI,KAAwB,KAAK;CAMxD,MAAM,UAAU,OAAO,gBAAgB,KAAmC,EAAE,CAAC;CAK7E,MAAM,aACL,OAAO,IAAI,aAAa;EACvB,MAAM,UAAU,IAAI;AACpB,MAAI,IAAI,UAAU;GACjB,MAAM,SAAqB;IAC1B,UAAU;IACV,aAAa;IACb,WAAW;IACX,cAAc;IACd;AACD,UAAO,IAAI,IAAI,SAAS,OAAO;AAC/B,UAAO;;EAER,MAAM,SAAS,OAAO,IAAI,IAAI,QAAQ;AACtC,MAAI,WAAW,KAAM,QAAO;EAC5B,MAAM,yBAAyB,OAAO,OAAO,OAC5C,OAAO,IAAI,aAAa;AACvB,UAAO,iBAAiB,QAAQ,kBAAkB,2BAA2B,CAAC,KAC7E,OAAO,UACL,UACA,IAAI,iBAAiB;IACpB,OAAO;IACP,QAAQ,0CAA0C,QAAQ;IAC1D;IACA,CAAC,CACH,CACD;AAID,UAAO,GAAG,cAAc,QAAQ,aAAa,EAAE,WAAW,MAAM,CAAC,CAAC,KACjE,OAAO,UACL,UACA,IAAI,iBAAiB;IACpB,OAAO;IACP,QAAQ,iBAAiB,QAAQ,YAAY;IAC7C;IACA,CAAC,CACH,CACD;AACD,UAAO,gBACN,KAAK,KAAK,QAAQ,aAAa,yBAAyB,EACxD,IAAI,aAAa,CAAC,OAAO,0BAA0B,CAAC,EACpD,EAAE,MAAM,KAAO,CACf,CAAC,KACD,OAAO,UACL,UACA,IAAI,iBAAiB;IACpB,OAAO;IACP,QAAQ,mBAAmB,yBAAyB,oBAAoB,MAAM;IAC9E;IACA,CAAC,CACH,EACD,OAAO,eAAe,WAAW,YAAY,GAAG,CAChD;GACD,MAAM,uBAAuB,OAAO,sBACnC,IACA,QAAQ,aACR,cACA,CAAC,KACD,OAAO,UACL,UACA,IAAI,iBAAiB;IACpB,OAAO;IACP,QAAQ,MAAM;IACd;IACA,CAAC,CACH,CACD;AAgBD,UAAO,CACN,IAAG,OAhBgC,yBACnC,IACA,SACA,qBAAqB,QACrB,cACA,CAAC,KACD,OAAO,UACL,UACA,IAAI,iBAAiB;IACpB,OAAO;IACP,QAAQ,MAAM;IACd;IACA,CAAC,CACH,CACD,EAEwB,KAAK,UAAU,MAAM,eAAe,EAC5D,GAAG,qBAAqB,oBACxB;IACA,CACF;EACD,MAAM,SAAS,OAAO,OAAO,OAC5B,OAAO,IAAI,aAAa;AACvB,UAAO,iBAAiB,QAAQ,mBAAmB,2BAA2B,CAAC,KAC9E,OAAO,UACL,UACA,IAAI,iBAAiB;IACpB,OAAO;IACP,QAAQ,2CAA2C,QAAQ;IAC3D;IACA,CAAC,CACH,CACD;AACD,UAAO,OAAO,UAAU;IACvB,OAAO,IAAI;IACX,aAAa,SAAS,KAAK;IAC3B;IACA;IACA,CAAC,CAAC,KAAK,OAAO,eAAe,4BAA4B,WAAW,CAAC;IACrE,CACF;AACD,SAAO,IAAI,IAAI,SAAS,OAAO;AAC/B,SAAO;GACN,CAAC,KAAK,OAAO,SAAS,2BAA2B,CAAC;CAKrD,MAAM,mBAA0D,SAC/D,OAAO,IAAI,aAAa;EACvB,MAAM,UAAU,IAAI;EACpB,MAAM,WAAW,IAAI,WAClB,OAAO,2BAA2B,UAAU,MAAM,SAAS,GAC3D,OAAO,aAAa,UAAU,MAAM,UAAU,UAAU;EAC3D,MAAM,QAAQ,eAAe,SAAS,SAAS;EAC/C,MAAM,WAAW,0BAA0B,MAAM,SAAS;EAC1D,MAAM,mBAGF,OAAO,IAAI,aAAa;AAK3B,OAAI,IAAI,SAAU,QAAO;AACzB,OAAI,CAAC,IAAI,SACR,QAAO,GAAG,cAAc,QAAQ,aAAa,EAAE,WAAW,MAAM,CAAC,CAAC,KACjE,OAAO,UACL,UACA,IAAI,oBAAoB;IACvB,gBAAgB,SAAS;IACzB,MAAM,QAAQ;IACd,QAAQ,iBAAiB,QAAQ,YAAY;IAC7C;IACA,CAAC,CACH,CACD;GAEF,MAAM,iBAAiB,OAAO,gBAAgB,IAAI,QAAQ;GAC1D,MAAM,aAAa,IAAI,IAAI,eAAe,KAAK,UAAU,MAAM,eAAe,CAAC;GAC/E,IAAI,iBAAiB;GAMrB,MAAM,uBAAuB,OAAO,yBACnC,IACA,UACA,OARuB,sBACvB,IACA,QAAQ,aACR,SAAS,eACT,EAIS,QACT,SAAS,eACT;GACD,MAAM,4BAA4B,qBAAqB,MACrD,UAAU,MAAM,mBAAmB,SAAS,eAC7C;AACD,OACC,8BAA8B,KAAA,KAC9B,CAAC,WAAW,IAAI,0BAA0B,eAAe;SAGrD,OADkB,sBAAsB,0BAA0B,MACvD,QAAQ;AACtB,SAAI,CAAC,iBAAiB,2BAA2B,SAAS,CACzD,QAAO,OAAO,OAAO,KACpB,uBAAuB,2BAA2B,SAAS,CAC3D;AAEF,sBAAiB;;;GAQnB,MAAM,YAAY,iBAAiB;IAClC,GAN8B,qBAAqB,QAClD,UACA,CAAC,WAAW,IAAI,MAAM,eAAe,IACrC,MAAM,mBAAmB,SAAS,eAGV;IACzB,GAAG;IACH;IACA,CAAC;AACF,OAAI,UAAW,QAAO,OAAO,OAAO,KAAK,UAAU;AACnD,OAAI,eAAgB,QAAO;GAK3B,MAAM,WAAW,KAAK,KACrB,QAAQ,aACR,iBAAiB,SAAS,eAAe,CACzC;AACD,UAAO,gBACN,UACA,IAAI,aAAa,CAAC,OAAO,gBAAgB,UAAU,MAAM,CAAC,EAC1D,EACC,MAAM,KACN,CACD,CAAC,KACD,OAAO,UACL,UACA,IAAI,oBAAoB;IACvB,gBAAgB,SAAS;IACzB,MAAM;IACN,QAAQ,mCAAmC,MAAM;IACjD;IACA,CAAC,CACH,EACD,OAAO,eAAe,WAAW,YAAY,GAAG,CAChD;AACD,UAAO;IACN;EAEF,IAAI;AACJ,MAAI,IAAI,SACP,oBAAmB,OAAO;MAE1B,oBAAmB,OAAO,OAAO,OAChC,OAAO,IAAI,aAAa;AACvB,UAAO,iBAAiB,QAAQ,kBAAkB,2BAA2B,CAAC,KAC7E,OAAO,UACL,UACA,IAAI,oBAAoB;IACvB,gBAAgB,SAAS;IACzB,MAAM,QAAQ;IACd,QAAQ,mCAAmC,QAAQ;IACnD;IACA,CAAC,CACH,CACD;AACD,UAAO,OAAO;IACb,CACF;AAGF,SAAO,4BAA4B,KAAK,UAAU,SAAS,CAAC,KAC3D,OAAO,cACN,IAAI,YAAY,qBAAqB,UAClC,OAAO,OACP,OAAO,OACP,OAAO,IAAI,aAAa;AACvB,UAAO,iBACN,QAAQ,kBACR,2BACA,CAAC,KAAK,OAAO,OAAO;AACrB,UAAO,mBAAmB,IAAI,SAAS,SAAS;IAC/C,CACF,CACH,CACD;AACD,MAAI,qBAAqB,eAAe;AACvC,UAAO,gBAAgB,OAAO,UAAU,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC;AAKnE,UAAO,OAAO,mBACb,OAAO,IAAI,aAAa;AACvB,QAAI,qBAAqB,QACxB,QAAO,OAAO,OACb,OAAO,IAAI,aAAa;AACvB,YAAO,iBAAiB,QAAQ,kBAAkB,2BAA2B;AAC7E,YAAO,mBAAmB,IAAI,SAAS,SAAS;MAC/C,CACF,CAAC,KAAK,OAAO,OAAO;AAEtB,WAAO,gBAAgB,OAAO,UAAU,QACvC,IAAI,QAAQ,MAAM,EAAE,mBAAmB,SAAS,eAAe,CAC/D;KACA,CACF;;AAGF,SAAO;GACN,CAAC,KAAK,OAAO,SAAS,sCAAsC,CAAC;AAEhE,QAAO,cAAc,GAAG;EAAE;EAAM;EAAiB;EAAS,CAAC;EAC1D,CACF"}

package/dist/orchestrators/router/traefik-container.d.mts

@@ -0,0 +1 @@
+import { Context, Effect, Layer } from "effect";