@mysten-incubation/devstack 0.0.1 → 0.1.1

package/dist/orchestrators/router/file-provider.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"file-provider.mjs","names":[],"sources":["../../../src/orchestrators/router/file-provider.ts"],"sourcesContent":["// File-provider config generator.\n//\n// Architecture invariant #1: file-provider ONLY, never docker-provider.\n// We materialize per-backend dispatch entries as YAML files in a\n// watched directory; Traefik's file-provider polls + reloads on\n// change. The docker-provider was rejected because the container IP\n// we need is the *shared-network* IP that lands AFTER `network connect`,\n// and the docker-provider captures the per-stack IP at first event\n// and never refreshes.\n//\n// One file per canonical route identity. Each file carries exactly\n// one router + one service (and references the shared CORS middleware\n// when `cors: true`). This layout means atomic add/remove of a route\n// is one file create/unlink — no merge step, no race.\n//\n// Two YAML shapes live under this renderer, discriminated by the\n// resolved route's `wireProtocol`:\n//\n//   HTTP / h2c (Host-header dispatch on a shared port):\n//\n//     http:\n//       routers:\n//         <id>-router:\n//           rule: \"Host(`<hostname>`)\"\n//           entryPoints: [\"<entrypointName>\"]\n//           service: \"<id>-svc\"\n//           middlewares: [\"devstack-cors\"]  # when cors: true\n//       services:\n//         <id>-svc:\n//           loadBalancer:\n//             servers:\n//               - url: \"http://<upstream-host>:<upstream-port>\"\n//\n//   TCP (per-entrypoint-port dispatch; ONE backend per entrypoint):\n//\n//     tcp:\n//       routers:\n//         <id>-router:\n//           rule: \"HostSNI(`*`)\"\n//           entryPoints: [\"<entrypointName>\"]\n//           service: \"<id>-svc\"\n//       services:\n//         <id>-svc:\n//           loadBalancer:\n//             servers:\n//               - address: \"<upstream-host>:<upstream-port>\"\n//\n// HostSNI(`*`) matches any incoming TCP connection on the entrypoint\n// (Traefik requires every TCP router to have a rule; `*` is the wildcard\n// that means \"any client\"). No CORS section — TCP isn't HTTP and the\n// shared CORS middleware lives under `http.middlewares`.\n\nimport { Effect } from 'effect';\n\nimport type { RoutableDecl } from '../../contracts/routable.ts';\nimport type { RosterHolder } from '../../substrate/cross-process.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport { CORS_MIDDLEWARE_NAME } from './cors.ts';\nimport type { EntrypointRegistryShape } from './entrypoints.ts';\nimport { RouteCollision, RouterValidationError, type UnknownEntrypoint } from './errors.ts';\nimport { dispatchFileId, renderUrl, routerHostname } from './hostname.ts';\n\nexport const ROUTE_READINESS_HEADER = 'X-Devstack-Route-Id';\n\n// ---------------------------------------------------------------------------\n// Resolved-route data structure\n// ---------------------------------------------------------------------------\n\n/** Resolved wire-protocol. `'tcp'` carries no hostname matcher and no\n *  CORS. The router orchestrator's renderer + collision-detector branch\n *  on this. */\nexport type ResolvedWireProtocol = 'http' | 'h2c' | 'tcp';\n\n/** A `RoutableDecl` resolved by the orchestrator: hostname minted,\n *  dispatch-id stringified, entrypoint port resolved, upstream URL\n *  resolved. This is the shape the file-provider renderer consumes —\n *  decoupled from the resolution path so testing the renderer is\n *  pure. */\nexport interface ResolvedRoute {\n\treadonly dispatchFileId: string;\n\t/** Minted hostname for HTTP routes. For TCP routes this is still\n\t *  computed (it's the host string the URL surfaces to consumers),\n\t *  but the Traefik router rule is `HostSNI(\\`*\\`)` — TCP dispatches\n\t *  by entrypoint port, not Host. */\n\treadonly hostname: string;\n\treadonly entrypointName: string;\n\treadonly entrypointPort: number;\n\t/** Upstream URL string. For HTTP this is `http://<host>:<port>`; for\n\t *  TCP it's still rendered as `tcp://<host>:<port>` so the renderer\n\t *  can pull host+port back out for the `address:` field. */\n\treadonly upstreamUrl: string;\n\treadonly cors: boolean;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}\n\nexport interface RouteCollisionMetadata {\n\treadonly dispatchFileId: string;\n\treadonly hostname: string;\n\treadonly entrypointName: string;\n\treadonly entrypointPort: number | null;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}\n\nexport const ROUTER_ROUTE_LEASE_VERSION = 1;\n\nexport interface RouteLeaseMetadata {\n\treadonly version: typeof ROUTER_ROUTE_LEASE_VERSION;\n\treadonly routerProfileId: string;\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly owner: RosterHolder;\n}\n\nexport interface DispatchRouteMetadata extends RouteCollisionMetadata {\n\treadonly lease: RouteLeaseMetadata | null;\n}\n\nexport type DispatchRouteDecodeReason =\n\t| 'missing-required-route-metadata'\n\t| 'unknown-route-lease-version'\n\t| 'invalid-route-lease-metadata';\n\nexport interface DispatchRouteDecodeDiagnostic {\n\treadonly _tag: 'DispatchRouteDecodeDiagnostic';\n\treadonly dispatchFileId: string;\n\treadonly reason: DispatchRouteDecodeReason;\n\treadonly detail: string;\n}\n\nexport type DispatchRouteParseResult =\n\t| {\n\t\t\treadonly _tag: 'valid';\n\t\t\treadonly route: DispatchRouteMetadata;\n\t\t\treadonly diagnostics: ReadonlyArray<DispatchRouteDecodeDiagnostic>;\n\t  }\n\t| {\n\t\t\treadonly _tag: 'invalid';\n\t\t\treadonly dispatchFileId: string;\n\t\t\treadonly diagnostics: ReadonlyArray<DispatchRouteDecodeDiagnostic>;\n\t  };\n\n/** Filename within the dispatch directory for a given file-id. The\n *  `10-` prefix sorts behind the shared CORS middleware (`00-`) so\n *  Traefik picks up the middleware before any router referencing it. */\nexport const dispatchFilename = (fileId: string): string => `10-${fileId}.yml`;\n\n// ---------------------------------------------------------------------------\n// Resolution — Routable + Identity + EntrypointRegistry + upstream → ResolvedRoute\n// ---------------------------------------------------------------------------\n\n/** Upstream-resolution interface the file-provider needs. The\n *  orchestrator threads in concrete resolvers (`runtime/docker` for\n *  containers, the port broker for host-loopback) without leaking\n *  service knowledge. Architecture: \"router has no compiled-in\n *  awareness of which services exist.\" */\nexport interface UpstreamResolver {\n\t/** For a container-kind upstream, return `(host, port)` where host\n\t *  is the container's shared-network IP and port is the container\n\t *  port from the plugin. Bounded retry lives inside the resolver\n\t *  (architecture invariant #3). */\n\treadonly resolveContainer: (target: {\n\t\treadonly containerName: string;\n\t\treadonly containerPort: number;\n\t}) => Effect.Effect<{ readonly host: string; readonly port: number }, RouterValidationError>;\n\t/** For a host-loopback-kind upstream, return the bound loopback\n\t *  port. The plugin owns port allocation and stamps the resolved\n\t *  port into its Routable decl after acquire. */\n\treadonly resolveHostLoopback: (target: {\n\t\treadonly port: number;\n\t}) => Effect.Effect<{ readonly host: string; readonly port: number }, RouterValidationError>;\n}\n\n/** Resolve a single Routable into a ResolvedRoute. Pure-ish: the only\n *  effectful bit is the upstream resolver (which talks to docker /\n *  the port broker) and the entrypoint lookup.\n *\n *  Takes the registry as a parameter rather than yielding the service\n *  tag so the calling orchestrator can pre-bind it once at layer-\n *  construction time, keeping the per-Routable hot path free of\n *  Context lookups. */\nexport const resolveRoute = (\n\tidentity: Identity,\n\tdecl: RoutableDecl,\n\tregistry: EntrypointRegistryShape,\n\tupstreams: UpstreamResolver,\n): Effect.Effect<ResolvedRoute, RouterValidationError | UnknownEntrypoint> =>\n\tEffect.gen(function* () {\n\t\tconst entrypoint = yield* registry.byName(decl.endpointName);\n\t\tconst hostname = yield* routerHostname(identity, decl.dispatchId.role);\n\t\tconst fileId = yield* dispatchFileId({ identity, dispatch: decl.dispatchId });\n\t\tconst upstream =\n\t\t\tdecl.upstream.type === 'container'\n\t\t\t\t? yield* upstreams.resolveContainer({\n\t\t\t\t\t\tcontainerName: decl.upstream.containerName,\n\t\t\t\t\t\tcontainerPort: decl.upstream.containerPort,\n\t\t\t\t\t})\n\t\t\t\t: yield* upstreams.resolveHostLoopback({ port: decl.upstream.port });\n\t\tconst wireProtocol: ResolvedWireProtocol =\n\t\t\tdecl.wireProtocol === 'tcp' ? 'tcp' : decl.wireProtocol === 'h2c' ? 'h2c' : 'http';\n\t\t// The router contract says: a `wireProtocol: 'tcp'` decl MUST\n\t\t// reference an entrypoint whose protocol is also `'tcp'`. The\n\t\t// converse holds — HTTP/h2c decls must reference HTTP-family\n\t\t// entrypoints. Mismatch is a programming error in the plugin\n\t\t// author (caught here once, not at every render).\n\t\tconst expectFamily: 'tcp' | 'http' = wireProtocol === 'tcp' ? 'tcp' : 'http';\n\t\tconst entrypointFamily: 'tcp' | 'http' = entrypoint.protocol === 'tcp' ? 'tcp' : 'http';\n\t\tif (expectFamily !== entrypointFamily) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'entrypointName',\n\t\t\t\t\tvalue: entrypoint.name,\n\t\t\t\t\tdetail:\n\t\t\t\t\t\t`wireProtocol family mismatch: decl is '${wireProtocol}' but ` +\n\t\t\t\t\t\t`entrypoint '${entrypoint.name}' is '${entrypoint.protocol}'`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\t// Validate the upstream URL — defense in depth (the resolvers\n\t\t// already produce safe values, but this stops a future resolver\n\t\t// that returns junk from corrupting the YAML). TCP carries the\n\t\t// `tcp://` scheme so we differentiate from the HTTP path; the\n\t\t// renderer pulls host+port back out either way.\n\t\tconst upstreamUrl = renderUrl({\n\t\t\tprotocol: wireProtocol === 'tcp' ? 'tcp' : 'http',\n\t\t\thostname: upstream.host,\n\t\t\tport: upstream.port,\n\t\t});\n\t\tif (!/^(?:http|tcp):\\/\\/[A-Za-z0-9_.:-]+:\\d+$/.test(upstreamUrl)) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'upstreamUrl',\n\t\t\t\t\tvalue: upstreamUrl,\n\t\t\t\t\tdetail: 'expected http://<host>:<port> or tcp://<host>:<port>',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\t// CORS is HTTP-only — TCP decls don't carry the field. Render\n\t\t// uses this; the resolved shape carries `false` for TCP.\n\t\tconst cors = decl.wireProtocol === 'tcp' ? false : decl.cors;\n\t\treturn {\n\t\t\tdispatchFileId: fileId,\n\t\t\thostname,\n\t\t\tentrypointName: entrypoint.name,\n\t\t\tentrypointPort: entrypoint.port,\n\t\t\tupstreamUrl,\n\t\t\tcors,\n\t\t\twireProtocol,\n\t\t};\n\t});\n\n// ---------------------------------------------------------------------------\n// Render — ResolvedRoute → YAML body\n// ---------------------------------------------------------------------------\n\n/** Pull host+port out of an `<scheme>://<host>:<port>` URL. Used by the\n *  TCP renderer to write the `address:` field. Safe because\n *  `resolveRoute` validates the URL shape before we get here. */\nconst splitUpstream = (url: string): { host: string; port: string } => {\n\tconst stripped = url.replace(/^(?:http|tcp):\\/\\//, '');\n\tconst lastColon = stripped.lastIndexOf(':');\n\treturn {\n\t\thost: stripped.slice(0, lastColon),\n\t\tport: stripped.slice(lastColon + 1),\n\t};\n};\n\nconst renderLeaseHeader = (lease: RouteLeaseMetadata): ReadonlyArray<string> => [\n\t`# routeLeaseVersion: ${lease.version}`,\n\t`# routerProfileId: ${lease.routerProfileId}`,\n\t`# ownerApp: ${lease.app}`,\n\t`# ownerStack: ${lease.stack}`,\n\t`# ownerPid: ${lease.owner.pid}`,\n\t`# ownerStartTime: ${lease.owner.startTime}`,\n\t`# ownerHostname: ${lease.owner.hostname}`,\n\t`# ownerClaimedAt: ${lease.owner.claimedAt}`,\n\t`# ownerHeartbeatAt: ${lease.owner.heartbeatAt}`,\n\t`# ownerIntent: ${lease.owner.intent}`,\n];\n\n/** Render the YAML body for a single resolved route. Hand-rolled\n *  (same rationale as `cors.ts`): static, controlled, byte-stable so\n *  no-op rewrites don't wake the watcher. */\nexport const renderRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tif (route.wireProtocol === 'tcp') return renderTcpRouteYaml(route, lease);\n\treturn renderHttpRouteYaml(route, lease);\n};\n\nconst routeReadinessMiddlewareName = (route: ResolvedRoute): string =>\n\t`${route.dispatchFileId}-route-ready`;\n\nconst renderHttpRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tconst middlewares = [\n\t\trouteReadinessMiddlewareName(route),\n\t\t...(route.cors ? [CORS_MIDDLEWARE_NAME] : []),\n\t];\n\tconst schemeHint =\n\t\troute.wireProtocol === 'h2c'\n\t\t\t? `        # h2c upstream — gRPC-friendly cleartext HTTP/2.\\n`\n\t\t\t: '';\n\treturn [\n\t\t`# Auto-generated by devstack router orchestrator. Do not edit by hand.`,\n\t\t`# dispatchFileId: ${route.dispatchFileId}`,\n\t\t`# wireProtocol: ${route.wireProtocol}`,\n\t\t`# entrypointName: ${route.entrypointName}`,\n\t\t`# entrypointPort: ${route.entrypointPort}`,\n\t\t`# hostname: ${route.hostname}`,\n\t\t...renderLeaseHeader(lease),\n\t\t`http:`,\n\t\t`  routers:`,\n\t\t`    ${route.dispatchFileId}-router:`,\n\t\t`      rule: \"Host(\\`${route.hostname}\\`)\"`,\n\t\t`      entryPoints: [\"${route.entrypointName}\"]`,\n\t\t`      service: \"${route.dispatchFileId}-svc\"`,\n\t\t`      middlewares: [${middlewares.map((name) => `\"${name}\"`).join(', ')}]`,\n\t\t`  middlewares:`,\n\t\t`    ${routeReadinessMiddlewareName(route)}:`,\n\t\t`      headers:`,\n\t\t`        customResponseHeaders:`,\n\t\t`          ${ROUTE_READINESS_HEADER}: \"${route.dispatchFileId}\"`,\n\t\t`  services:`,\n\t\t`    ${route.dispatchFileId}-svc:`,\n\t\t`      loadBalancer:`,\n\t\tschemeHint.length > 0 ? schemeHint.trimEnd() : null,\n\t\t`        servers:`,\n\t\t`          - url: \"${route.upstreamUrl}\"`,\n\t\t``,\n\t]\n\t\t.filter((line): line is string => line !== null)\n\t\t.join('\\n');\n};\n\nconst renderTcpRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tconst { host, port } = splitUpstream(route.upstreamUrl);\n\treturn [\n\t\t`# Auto-generated by devstack router orchestrator. Do not edit by hand.`,\n\t\t`# dispatchFileId: ${route.dispatchFileId}`,\n\t\t`# wireProtocol: tcp`,\n\t\t`# entrypointName: ${route.entrypointName}`,\n\t\t`# entrypointPort: ${route.entrypointPort}`,\n\t\t`# hostname: ${route.hostname}`,\n\t\t`# tcpDispatch: entrypoint-port dispatch; HostSNI wildcard`,\n\t\t...renderLeaseHeader(lease),\n\t\t`tcp:`,\n\t\t`  routers:`,\n\t\t`    ${route.dispatchFileId}-router:`,\n\t\t`      rule: \"HostSNI(\\`*\\`)\"`,\n\t\t`      entryPoints: [\"${route.entrypointName}\"]`,\n\t\t`      service: \"${route.dispatchFileId}-svc\"`,\n\t\t`  services:`,\n\t\t`    ${route.dispatchFileId}-svc:`,\n\t\t`      loadBalancer:`,\n\t\t`        servers:`,\n\t\t`          - address: \"${host}:${port}\"`,\n\t\t``,\n\t].join('\\n');\n};\n\nexport const dispatchFileIdFromFilename = (filename: string): string | null => {\n\tconst match = /^10-(.+)\\.yml$/.exec(filename);\n\treturn match?.[1] ?? null;\n};\n\nconst commentValue = (body: string, key: string): string | null => {\n\tconst escaped = key.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\tconst match = new RegExp(`^# ${escaped}: (.*)$`, 'm').exec(body);\n\treturn match?.[1]?.trim() ?? null;\n};\n\nconst matchValue = (body: string, pattern: RegExp): string | null =>\n\tpattern.exec(body)?.[1]?.trim() ?? null;\n\nconst commentNumber = (body: string, key: string): number | null => {\n\tconst raw = commentValue(body, key);\n\tif (raw === null || !/^\\d+$/.test(raw)) return null;\n\treturn Number.parseInt(raw, 10);\n};\n\nconst parseWireProtocol = (body: string): ResolvedWireProtocol | null => {\n\tconst fromComment = commentValue(body, 'wireProtocol');\n\tif (fromComment === 'http' || fromComment === 'h2c' || fromComment === 'tcp') {\n\t\treturn fromComment;\n\t}\n\tif (/^tcp:/m.test(body)) return 'tcp';\n\tif (/^http:/m.test(body)) return 'http';\n\treturn null;\n};\n\nconst hasRouteLeaseMetadata = (body: string): boolean =>\n\t[\n\t\t'routeLeaseVersion',\n\t\t'routerProfileId',\n\t\t'ownerApp',\n\t\t'ownerStack',\n\t\t'ownerPid',\n\t\t'ownerStartTime',\n\t\t'ownerHostname',\n\t\t'ownerClaimedAt',\n\t\t'ownerHeartbeatAt',\n\t\t'ownerIntent',\n\t].some((key) => commentValue(body, key) !== null);\n\nconst parseRouteLeaseMetadata = (\n\tbody: string,\n\tdispatchFileId: string,\n): {\n\treadonly lease: RouteLeaseMetadata | null;\n\treadonly diagnostic: DispatchRouteDecodeDiagnostic | null;\n} => {\n\tif (!hasRouteLeaseMetadata(body)) return { lease: null, diagnostic: null };\n\tconst rawVersion = commentValue(body, 'routeLeaseVersion');\n\tconst version = commentNumber(body, 'routeLeaseVersion');\n\tconst routerProfileId = commentValue(body, 'routerProfileId');\n\tconst app = commentValue(body, 'ownerApp');\n\tconst stack = commentValue(body, 'ownerStack');\n\tconst pid = commentNumber(body, 'ownerPid');\n\tconst startTime = commentNumber(body, 'ownerStartTime');\n\tconst hostname = commentValue(body, 'ownerHostname');\n\tconst claimedAt = commentNumber(body, 'ownerClaimedAt');\n\tconst heartbeatAt = commentNumber(body, 'ownerHeartbeatAt');\n\tconst intent = commentValue(body, 'ownerIntent');\n\tif (version !== ROUTER_ROUTE_LEASE_VERSION) {\n\t\treturn {\n\t\t\tlease: null,\n\t\t\tdiagnostic: {\n\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\tdispatchFileId,\n\t\t\t\treason: 'unknown-route-lease-version',\n\t\t\t\tdetail: `expected routeLeaseVersion ${ROUTER_ROUTE_LEASE_VERSION}, got ${rawVersion ?? '<missing>'}`,\n\t\t\t},\n\t\t};\n\t}\n\tif (\n\t\trouterProfileId === null ||\n\t\tapp === null ||\n\t\tstack === null ||\n\t\tpid === null ||\n\t\tstartTime === null ||\n\t\thostname === null ||\n\t\tclaimedAt === null ||\n\t\theartbeatAt === null ||\n\t\t(intent !== 'normal' && intent !== 'snapshot')\n\t) {\n\t\treturn {\n\t\t\tlease: null,\n\t\t\tdiagnostic: {\n\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\tdispatchFileId,\n\t\t\t\treason: 'invalid-route-lease-metadata',\n\t\t\t\tdetail: 'route lease metadata is incomplete or malformed',\n\t\t\t},\n\t\t};\n\t}\n\treturn {\n\t\tlease: {\n\t\t\tversion: ROUTER_ROUTE_LEASE_VERSION,\n\t\t\trouterProfileId,\n\t\t\tapp,\n\t\t\tstack,\n\t\t\towner: {\n\t\t\t\tpid,\n\t\t\t\tstartTime,\n\t\t\t\thostname,\n\t\t\t\tclaimedAt,\n\t\t\t\theartbeatAt,\n\t\t\t\tintent,\n\t\t\t},\n\t\t},\n\t\tdiagnostic: null,\n\t};\n};\n\nexport const parseDispatchRouteFile = (\n\tbody: string,\n\tfallbackDispatchFileId: string | null = null,\n): DispatchRouteParseResult => {\n\tconst dispatchFileId = commentValue(body, 'dispatchFileId') ?? fallbackDispatchFileId;\n\tconst wireProtocol = parseWireProtocol(body);\n\tconst entrypointName =\n\t\tcommentValue(body, 'entrypointName') ?? matchValue(body, /entryPoints: \\[\"([^\"]+)\"\\]/);\n\tconst hostname =\n\t\tcommentValue(body, 'hostname') ??\n\t\tmatchValue(body, /Host\\(`([^`]+)`\\)/) ??\n\t\t(wireProtocol === 'tcp' ? '' : null);\n\tconst portRaw = commentValue(body, 'entrypointPort');\n\tconst entrypointPort =\n\t\tportRaw === null || !/^\\d+$/.test(portRaw) ? null : Number.parseInt(portRaw, 10);\n\n\tif (\n\t\tdispatchFileId === null ||\n\t\twireProtocol === null ||\n\t\tentrypointName === null ||\n\t\thostname === null\n\t) {\n\t\tconst protectedDispatchFileId = dispatchFileId ?? '<unknown>';\n\t\treturn {\n\t\t\t_tag: 'invalid',\n\t\t\tdispatchFileId: protectedDispatchFileId,\n\t\t\tdiagnostics: [\n\t\t\t\t{\n\t\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\t\tdispatchFileId: protectedDispatchFileId,\n\t\t\t\t\treason: 'missing-required-route-metadata',\n\t\t\t\t\tdetail:\n\t\t\t\t\t\t'route file is missing dispatchFileId, wireProtocol/http|tcp block, entrypointName, or hostname metadata',\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\t}\n\tconst leaseResult = parseRouteLeaseMetadata(body, dispatchFileId);\n\n\treturn {\n\t\t_tag: 'valid',\n\t\troute: {\n\t\t\tdispatchFileId,\n\t\t\thostname,\n\t\t\tentrypointName,\n\t\t\tentrypointPort,\n\t\t\twireProtocol,\n\t\t\tlease: leaseResult.lease,\n\t\t},\n\t\tdiagnostics: leaseResult.diagnostic === null ? [] : [leaseResult.diagnostic],\n\t};\n};\n\nexport const parseDispatchRouteMetadata = (\n\tbody: string,\n\tfallbackDispatchFileId: string | null = null,\n): DispatchRouteMetadata | null => {\n\tconst parsed = parseDispatchRouteFile(body, fallbackDispatchFileId);\n\treturn parsed._tag === 'valid' ? parsed.route : null;\n};\n\n// ---------------------------------------------------------------------------\n// Collision detection\n// ---------------------------------------------------------------------------\n\n/** Assert no two resolved routes share dispatch keys.\n *\n *  - HTTP routes collide on `(entrypoint, hostname)` — two HTTP backends\n *    on the same entrypoint port can coexist via different Host headers,\n *    so the Host *is* part of the key.\n *  - TCP routes collide on `entrypoint` alone — TCP has no Host header,\n *    so an entrypoint can serve exactly ONE backend. Two TCP decls on\n *    the same entrypoint are an unambiguous error (parallel stacks of\n *    a TCP service share the host port and would clobber each other).\n *\n *  Architecture invariant #7 — distinct identity → distinct dispatch\n *  URL. The TCP arm is the new clause; HTTP arm unchanged. */\nexport const detectCollisions = (\n\troutes: ReadonlyArray<RouteCollisionMetadata>,\n): RouteCollision | null => {\n\tconst seen = new Map<string, Array<RouteCollisionMetadata>>();\n\tfor (const r of routes) {\n\t\tconst portKey =\n\t\t\tr.entrypointPort === null ? `entrypoint:${r.entrypointName}` : `port:${r.entrypointPort}`;\n\t\tconst key = r.wireProtocol === 'tcp' ? `tcp@${portKey}` : `http@${portKey}@${r.hostname}`;\n\t\tconst acc = seen.get(key);\n\t\tif (acc) acc.push(r);\n\t\telse seen.set(key, [r]);\n\t}\n\tfor (const [key, colliding] of seen) {\n\t\tif (colliding.length > 1) {\n\t\t\tconst ids = colliding.map((route) => route.dispatchFileId);\n\t\t\tconst first = colliding[0];\n\t\t\tif (key.startsWith('tcp@')) {\n\t\t\t\treturn new RouteCollision({\n\t\t\t\t\tmessage: routeCollisionMessage({\n\t\t\t\t\t\thostname: '',\n\t\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t\t\twireProtocol: 'tcp',\n\t\t\t\t\t}),\n\t\t\t\t\thostname: '',\n\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn new RouteCollision({\n\t\t\t\tmessage: routeCollisionMessage({\n\t\t\t\t\thostname: first?.hostname ?? '',\n\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t\twireProtocol: 'http',\n\t\t\t\t}),\n\t\t\t\thostname: first?.hostname ?? '',\n\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\tdispatchIds: ids,\n\t\t\t});\n\t\t}\n\t}\n\treturn null;\n};\n\nconst routeCollisionMessage = (collision: {\n\treadonly hostname: string;\n\treadonly entrypoint: string;\n\treadonly dispatchIds: ReadonlyArray<string>;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}): string => {\n\tconst ids = collision.dispatchIds.join(', ');\n\tif (collision.wireProtocol === 'tcp') {\n\t\treturn `router TCP route collision on entrypoint '${collision.entrypoint}' for dispatch ids: ${ids}`;\n\t}\n\treturn (\n\t\t`router route collision on entrypoint '${collision.entrypoint}' ` +\n\t\t`and hostname '${collision.hostname}' for dispatch ids: ${ids}`\n\t);\n};\n\n// ---------------------------------------------------------------------------\n// Static base file — Traefik provider directive\n// ---------------------------------------------------------------------------\n\n/** Filename for the file-provider static config. Traefik is launched\n *  with `--providers.file.directory=/etc/traefik/dispatch` so it\n *  reads from there directly; this static file is OPTIONAL polish\n *  and currently unused. Reserved for future provider tuning. */\nexport const STATIC_PROVIDER_FILENAME = '00-providers.yml';\n"],"mappings":";;;;;AA8DA,MAAa,yBAAyB;;;;AAkFtC,MAAa,oBAAoB,WAA2B,MAAM,OAAO;;;;;;;;;AAoCzE,MAAa,gBACZ,UACA,MACA,UACA,cAEA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,OAAO,SAAS,OAAO,KAAK,aAAa;CAC5D,MAAM,WAAW,OAAO,eAAe,UAAU,KAAK,WAAW,KAAK;CACtE,MAAM,SAAS,OAAO,eAAe;EAAE;EAAU,UAAU,KAAK;EAAY,CAAC;CAC7E,MAAM,WACL,KAAK,SAAS,SAAS,cACpB,OAAO,UAAU,iBAAiB;EAClC,eAAe,KAAK,SAAS;EAC7B,eAAe,KAAK,SAAS;EAC7B,CAAC,GACD,OAAO,UAAU,oBAAoB,EAAE,MAAM,KAAK,SAAS,MAAM,CAAC;CACtE,MAAM,eACL,KAAK,iBAAiB,QAAQ,QAAQ,KAAK,iBAAiB,QAAQ,QAAQ;AAQ7E,MAFqC,iBAAiB,QAAQ,QAAQ,aAC7B,WAAW,aAAa,QAAQ,QAAQ,QAEhF,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO,WAAW;EAClB,QACC,0CAA0C,aAAa,oBACxC,WAAW,KAAK,QAAQ,WAAW,SAAS;EAC5D,CAAC,CACF;CAOF,MAAM,cAAc,UAAU;EAC7B,UAAU,iBAAiB,QAAQ,QAAQ;EAC3C,UAAU,SAAS;EACnB,MAAM,SAAS;EACf,CAAC;AACF,KAAI,CAAC,0CAA0C,KAAK,YAAY,CAC/D,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO;EACP,QAAQ;EACR,CAAC,CACF;CAIF,MAAM,OAAO,KAAK,iBAAiB,QAAQ,QAAQ,KAAK;AACxD,QAAO;EACN,gBAAgB;EAChB;EACA,gBAAgB,WAAW;EAC3B,gBAAgB,WAAW;EAC3B;EACA;EACA;EACA;EACA;;;;AASH,MAAM,iBAAiB,QAAgD;CACtE,MAAM,WAAW,IAAI,QAAQ,sBAAsB,GAAG;CACtD,MAAM,YAAY,SAAS,YAAY,IAAI;AAC3C,QAAO;EACN,MAAM,SAAS,MAAM,GAAG,UAAU;EAClC,MAAM,SAAS,MAAM,YAAY,EAAE;EACnC;;AAGF,MAAM,qBAAqB,UAAqD;CAC/E,wBAAwB,MAAM;CAC9B,sBAAsB,MAAM;CAC5B,eAAe,MAAM;CACrB,iBAAiB,MAAM;CACvB,eAAe,MAAM,MAAM;CAC3B,qBAAqB,MAAM,MAAM;CACjC,oBAAoB,MAAM,MAAM;CAChC,qBAAqB,MAAM,MAAM;CACjC,uBAAuB,MAAM,MAAM;CACnC,kBAAkB,MAAM,MAAM;CAC9B;;;;AAKD,MAAa,mBAAmB,OAAsB,UAAsC;AAC3F,KAAI,MAAM,iBAAiB,MAAO,QAAO,mBAAmB,OAAO,MAAM;AACzE,QAAO,oBAAoB,OAAO,MAAM;;AAGzC,MAAM,gCAAgC,UACrC,GAAG,MAAM,eAAe;AAEzB,MAAM,uBAAuB,OAAsB,UAAsC;CACxF,MAAM,cAAc,CACnB,6BAA6B,MAAM,EACnC,GAAI,MAAM,OAAO,CAAC,qBAAqB,GAAG,EAAE,CAC5C;CACD,MAAM,aACL,MAAM,iBAAiB,QACpB,+DACA;AACJ,QAAO;EACN;EACA,qBAAqB,MAAM;EAC3B,mBAAmB,MAAM;EACzB,qBAAqB,MAAM;EAC3B,qBAAqB,MAAM;EAC3B,eAAe,MAAM;EACrB,GAAG,kBAAkB,MAAM;EAC3B;EACA;EACA,OAAO,MAAM,eAAe;EAC5B,uBAAuB,MAAM,SAAS;EACtC,wBAAwB,MAAM,eAAe;EAC7C,mBAAmB,MAAM,eAAe;EACxC,uBAAuB,YAAY,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,KAAK,KAAK,CAAC;EACzE;EACA,OAAO,6BAA6B,MAAM,CAAC;EAC3C;EACA;EACA,aAAa,uBAAuB,KAAK,MAAM,eAAe;EAC9D;EACA,OAAO,MAAM,eAAe;EAC5B;EACA,WAAW,SAAS,IAAI,WAAW,SAAS,GAAG;EAC/C;EACA,qBAAqB,MAAM,YAAY;EACvC;EACA,CACC,QAAQ,SAAyB,SAAS,KAAK,CAC/C,KAAK,KAAK;;AAGb,MAAM,sBAAsB,OAAsB,UAAsC;CACvF,MAAM,EAAE,MAAM,SAAS,cAAc,MAAM,YAAY;AACvD,QAAO;EACN;EACA,qBAAqB,MAAM;EAC3B;EACA,qBAAqB,MAAM;EAC3B,qBAAqB,MAAM;EAC3B,eAAe,MAAM;EACrB;EACA,GAAG,kBAAkB,MAAM;EAC3B;EACA;EACA,OAAO,MAAM,eAAe;EAC5B;EACA,wBAAwB,MAAM,eAAe;EAC7C,mBAAmB,MAAM,eAAe;EACxC;EACA,OAAO,MAAM,eAAe;EAC5B;EACA;EACA,yBAAyB,KAAK,GAAG,KAAK;EACtC;EACA,CAAC,KAAK,KAAK;;AAGb,MAAa,8BAA8B,aAAoC;AAE9E,QADc,iBAAiB,KAAK,SACxB,GAAG,MAAM;;AAGtB,MAAM,gBAAgB,MAAc,QAA+B;CAClE,MAAM,UAAU,IAAI,QAAQ,uBAAuB,OAAO;AAE1D,QADc,IAAI,OAAO,MAAM,QAAQ,UAAU,IAAI,CAAC,KAAK,KAC/C,GAAG,IAAI,MAAM,IAAI;;AAG9B,MAAM,cAAc,MAAc,YACjC,QAAQ,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI;AAEpC,MAAM,iBAAiB,MAAc,QAA+B;CACnE,MAAM,MAAM,aAAa,MAAM,IAAI;AACnC,KAAI,QAAQ,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAE,QAAO;AAC/C,QAAO,OAAO,SAAS,KAAK,GAAG;;AAGhC,MAAM,qBAAqB,SAA8C;CACxE,MAAM,cAAc,aAAa,MAAM,eAAe;AACtD,KAAI,gBAAgB,UAAU,gBAAgB,SAAS,gBAAgB,MACtE,QAAO;AAER,KAAI,SAAS,KAAK,KAAK,CAAE,QAAO;AAChC,KAAI,UAAU,KAAK,KAAK,CAAE,QAAO;AACjC,QAAO;;AAGR,MAAM,yBAAyB,SAC9B;CACC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC,MAAM,QAAQ,aAAa,MAAM,IAAI,KAAK,KAAK;AAElD,MAAM,2BACL,MACA,mBAII;AACJ,KAAI,CAAC,sBAAsB,KAAK,CAAE,QAAO;EAAE,OAAO;EAAM,YAAY;EAAM;CAC1E,MAAM,aAAa,aAAa,MAAM,oBAAoB;CAC1D,MAAM,UAAU,cAAc,MAAM,oBAAoB;CACxD,MAAM,kBAAkB,aAAa,MAAM,kBAAkB;CAC7D,MAAM,MAAM,aAAa,MAAM,WAAW;CAC1C,MAAM,QAAQ,aAAa,MAAM,aAAa;CAC9C,MAAM,MAAM,cAAc,MAAM,WAAW;CAC3C,MAAM,YAAY,cAAc,MAAM,iBAAiB;CACvD,MAAM,WAAW,aAAa,MAAM,gBAAgB;CACpD,MAAM,YAAY,cAAc,MAAM,iBAAiB;CACvD,MAAM,cAAc,cAAc,MAAM,mBAAmB;CAC3D,MAAM,SAAS,aAAa,MAAM,cAAc;AAChD,KAAI,YAAA,EACH,QAAO;EACN,OAAO;EACP,YAAY;GACX,MAAM;GACN;GACA,QAAQ;GACR,QAAQ,qCAAiE,cAAc;GACvF;EACD;AAEF,KACC,oBAAoB,QACpB,QAAQ,QACR,UAAU,QACV,QAAQ,QACR,cAAc,QACd,aAAa,QACb,cAAc,QACd,gBAAgB,QACf,WAAW,YAAY,WAAW,WAEnC,QAAO;EACN,OAAO;EACP,YAAY;GACX,MAAM;GACN;GACA,QAAQ;GACR,QAAQ;GACR;EACD;AAEF,QAAO;EACN,OAAO;GACN,SAAA;GACA;GACA;GACA;GACA,OAAO;IACN;IACA;IACA;IACA;IACA;IACA;IACA;GACD;EACD,YAAY;EACZ;;AAGF,MAAa,0BACZ,MACA,yBAAwC,SACV;CAC9B,MAAM,iBAAiB,aAAa,MAAM,iBAAiB,IAAI;CAC/D,MAAM,eAAe,kBAAkB,KAAK;CAC5C,MAAM,iBACL,aAAa,MAAM,iBAAiB,IAAI,WAAW,MAAM,6BAA6B;CACvF,MAAM,WACL,aAAa,MAAM,WAAW,IAC9B,WAAW,MAAM,oBAAoB,KACpC,iBAAiB,QAAQ,KAAK;CAChC,MAAM,UAAU,aAAa,MAAM,iBAAiB;CACpD,MAAM,iBACL,YAAY,QAAQ,CAAC,QAAQ,KAAK,QAAQ,GAAG,OAAO,OAAO,SAAS,SAAS,GAAG;AAEjF,KACC,mBAAmB,QACnB,iBAAiB,QACjB,mBAAmB,QACnB,aAAa,MACZ;EACD,MAAM,0BAA0B,kBAAkB;AAClD,SAAO;GACN,MAAM;GACN,gBAAgB;GAChB,aAAa,CACZ;IACC,MAAM;IACN,gBAAgB;IAChB,QAAQ;IACR,QACC;IACD,CACD;GACD;;CAEF,MAAM,cAAc,wBAAwB,MAAM,eAAe;AAEjE,QAAO;EACN,MAAM;EACN,OAAO;GACN;GACA;GACA;GACA;GACA;GACA,OAAO,YAAY;GACnB;EACD,aAAa,YAAY,eAAe,OAAO,EAAE,GAAG,CAAC,YAAY,WAAW;EAC5E;;;;;;;;;;;;;;AA2BF,MAAa,oBACZ,WAC2B;CAC3B,MAAM,uBAAO,IAAI,KAA4C;AAC7D,MAAK,MAAM,KAAK,QAAQ;EACvB,MAAM,UACL,EAAE,mBAAmB,OAAO,cAAc,EAAE,mBAAmB,QAAQ,EAAE;EAC1E,MAAM,MAAM,EAAE,iBAAiB,QAAQ,OAAO,YAAY,QAAQ,QAAQ,GAAG,EAAE;EAC/E,MAAM,MAAM,KAAK,IAAI,IAAI;AACzB,MAAI,IAAK,KAAI,KAAK,EAAE;MACf,MAAK,IAAI,KAAK,CAAC,EAAE,CAAC;;AAExB,MAAK,MAAM,CAAC,KAAK,cAAc,KAC9B,KAAI,UAAU,SAAS,GAAG;EACzB,MAAM,MAAM,UAAU,KAAK,UAAU,MAAM,eAAe;EAC1D,MAAM,QAAQ,UAAU;AACxB,MAAI,IAAI,WAAW,OAAO,CACzB,QAAO,IAAI,eAAe;GACzB,SAAS,sBAAsB;IAC9B,UAAU;IACV,YAAY,OAAO,kBAAkB;IACrC,aAAa;IACb,cAAc;IACd,CAAC;GACF,UAAU;GACV,YAAY,OAAO,kBAAkB;GACrC,aAAa;GACb,CAAC;AAEH,SAAO,IAAI,eAAe;GACzB,SAAS,sBAAsB;IAC9B,UAAU,OAAO,YAAY;IAC7B,YAAY,OAAO,kBAAkB;IACrC,aAAa;IACb,cAAc;IACd,CAAC;GACF,UAAU,OAAO,YAAY;GAC7B,YAAY,OAAO,kBAAkB;GACrC,aAAa;GACb,CAAC;;AAGJ,QAAO;;AAGR,MAAM,yBAAyB,cAKjB;CACb,MAAM,MAAM,UAAU,YAAY,KAAK,KAAK;AAC5C,KAAI,UAAU,iBAAiB,MAC9B,QAAO,6CAA6C,UAAU,WAAW,sBAAsB;AAEhG,QACC,yCAAyC,UAAU,WAAW,kBAC7C,UAAU,SAAS,sBAAsB"}
+{"version":3,"file":"file-provider.mjs","names":[],"sources":["../../../src/orchestrators/router/file-provider.ts"],"sourcesContent":["// File-provider config generator.\n//\n// Architecture invariant #1: file-provider ONLY, never docker-provider.\n// We materialize per-backend dispatch entries as YAML files in a\n// watched directory; Traefik's file-provider polls + reloads on\n// change. The docker-provider was rejected because the container IP\n// we need is the *shared-network* IP that lands AFTER `network connect`,\n// and the docker-provider captures the per-stack IP at first event\n// and never refreshes.\n//\n// One file per canonical route identity. Each file carries exactly\n// one router + one service (and references the shared CORS middleware\n// when `cors: true`). This layout means atomic add/remove of a route\n// is one file create/unlink — no merge step, no race.\n//\n// Two YAML shapes live under this renderer, discriminated by the\n// resolved route's `wireProtocol`:\n//\n//   HTTP / h2c (Host-header dispatch on a shared port):\n//\n//     http:\n//       routers:\n//         <id>-router:\n//           rule: \"Host(`<hostname>`)\"\n//           entryPoints: [\"<entrypointName>\"]\n//           service: \"<id>-svc\"\n//           middlewares: [\"devstack-cors\"]  # when cors: true\n//       services:\n//         <id>-svc:\n//           loadBalancer:\n//             servers:\n//               - url: \"http://<upstream-host>:<upstream-port>\"\n//\n//   TCP (per-entrypoint-port dispatch; ONE backend per entrypoint):\n//\n//     tcp:\n//       routers:\n//         <id>-router:\n//           rule: \"HostSNI(`*`)\"\n//           entryPoints: [\"<entrypointName>\"]\n//           service: \"<id>-svc\"\n//       services:\n//         <id>-svc:\n//           loadBalancer:\n//             servers:\n//               - address: \"<upstream-host>:<upstream-port>\"\n//\n// HostSNI(`*`) matches any incoming TCP connection on the entrypoint\n// (Traefik requires every TCP router to have a rule; `*` is the wildcard\n// that means \"any client\"). No CORS section — TCP isn't HTTP and the\n// shared CORS middleware lives under `http.middlewares`.\n\nimport { Effect } from 'effect';\n\nimport type { RoutableDecl } from '../../contracts/routable.ts';\nimport type { RosterHolder } from '../../substrate/cross-process.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport { CORS_MIDDLEWARE_NAME } from './cors.ts';\nimport type { EntrypointRegistryShape } from './entrypoints.ts';\nimport { RouteCollision, RouterValidationError, type UnknownEntrypoint } from './errors.ts';\nimport { dispatchFileId, renderUrl, routerHostname } from './hostname.ts';\n\nexport const ROUTE_READINESS_HEADER = 'X-Devstack-Route-Id';\n\n/** Dispatch-file filename prefix. `10-` sorts behind the shared CORS\n *  middleware (`00-`) so Traefik's file-provider loads the middleware\n *  before any router that references it. Single source of truth for\n *  the file-write side (`dispatchFilename`) and the file-read side\n *  (`dispatchFileIdFromFilename`) — keep them in lockstep here. */\nconst DISPATCH_FILENAME_PREFIX = '10-';\n\n// ---------------------------------------------------------------------------\n// Resolved-route data structure\n// ---------------------------------------------------------------------------\n\n/** Resolved wire-protocol. `'tcp'` carries no hostname matcher and no\n *  CORS. The router orchestrator's renderer + collision-detector branch\n *  on this. */\nexport type ResolvedWireProtocol = 'http' | 'h2c' | 'tcp';\n\n/** A `RoutableDecl` resolved by the orchestrator: hostname minted,\n *  dispatch-id stringified, entrypoint port resolved, upstream URL\n *  resolved. This is the shape the file-provider renderer consumes —\n *  decoupled from the resolution path so testing the renderer is\n *  pure. */\nexport interface ResolvedRoute {\n\treadonly dispatchFileId: string;\n\t/** Minted hostname for HTTP routes. For TCP routes this is still\n\t *  computed (it's the host string the URL surfaces to consumers),\n\t *  but the Traefik router rule is `HostSNI(\\`*\\`)` — TCP dispatches\n\t *  by entrypoint port, not Host. */\n\treadonly hostname: string;\n\treadonly entrypointName: string;\n\treadonly entrypointPort: number;\n\t/** Upstream URL string. For HTTP this is `http://<host>:<port>`; for\n\t *  TCP it's still rendered as `tcp://<host>:<port>` so the renderer\n\t *  can pull host+port back out for the `address:` field. */\n\treadonly upstreamUrl: string;\n\treadonly cors: boolean;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}\n\nexport interface RouteCollisionMetadata {\n\treadonly dispatchFileId: string;\n\treadonly hostname: string;\n\treadonly entrypointName: string;\n\treadonly entrypointPort: number | null;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}\n\nexport const ROUTER_ROUTE_LEASE_VERSION = 1;\n\nexport interface RouteLeaseMetadata {\n\treadonly version: typeof ROUTER_ROUTE_LEASE_VERSION;\n\treadonly routerProfileId: string;\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly owner: RosterHolder;\n}\n\nexport interface DispatchRouteMetadata extends RouteCollisionMetadata {\n\treadonly lease: RouteLeaseMetadata | null;\n}\n\nexport type DispatchRouteDecodeReason =\n\t| 'missing-required-route-metadata'\n\t| 'unknown-route-lease-version'\n\t| 'invalid-route-lease-metadata';\n\nexport interface DispatchRouteDecodeDiagnostic {\n\treadonly _tag: 'DispatchRouteDecodeDiagnostic';\n\treadonly dispatchFileId: string;\n\treadonly reason: DispatchRouteDecodeReason;\n\treadonly detail: string;\n}\n\nexport type DispatchRouteParseResult =\n\t| {\n\t\t\treadonly _tag: 'valid';\n\t\t\treadonly route: DispatchRouteMetadata;\n\t\t\treadonly diagnostics: ReadonlyArray<DispatchRouteDecodeDiagnostic>;\n\t  }\n\t| {\n\t\t\treadonly _tag: 'invalid';\n\t\t\treadonly dispatchFileId: string;\n\t\t\treadonly diagnostics: ReadonlyArray<DispatchRouteDecodeDiagnostic>;\n\t  };\n\n/** Filename within the dispatch directory for a given file-id. The\n *  prefix (`DISPATCH_FILENAME_PREFIX`) sorts behind the shared CORS\n *  middleware (`00-`) so Traefik picks up the middleware before any\n *  router referencing it. */\nexport const dispatchFilename = (fileId: string): string =>\n\t`${DISPATCH_FILENAME_PREFIX}${fileId}.yml`;\n\n// ---------------------------------------------------------------------------\n// Resolution — Routable + Identity + EntrypointRegistry + upstream → ResolvedRoute\n// ---------------------------------------------------------------------------\n\n/** Upstream-resolution interface the file-provider needs. The\n *  orchestrator threads in concrete resolvers (`runtime/docker` for\n *  containers, the port broker for host-loopback) without leaking\n *  service knowledge. Architecture: \"router has no compiled-in\n *  awareness of which services exist.\" */\nexport interface UpstreamResolver {\n\t/** For a container-kind upstream, return `(host, port)` where host\n\t *  is the container's shared-network IP and port is the container\n\t *  port from the plugin. Bounded retry lives inside the resolver\n\t *  (architecture invariant #3). */\n\treadonly resolveContainer: (target: {\n\t\treadonly containerName: string;\n\t\treadonly containerPort: number;\n\t}) => Effect.Effect<{ readonly host: string; readonly port: number }, RouterValidationError>;\n\t/** For a host-loopback-kind upstream, return the bound loopback\n\t *  port. The plugin owns port allocation and stamps the resolved\n\t *  port into its Routable decl after acquire. */\n\treadonly resolveHostLoopback: (target: {\n\t\treadonly port: number;\n\t}) => Effect.Effect<{ readonly host: string; readonly port: number }, RouterValidationError>;\n}\n\n/** Resolve a single Routable into a ResolvedRoute. Pure-ish: the only\n *  effectful bit is the upstream resolver (which talks to docker /\n *  the port broker) and the entrypoint lookup.\n *\n *  Takes the registry as a parameter rather than yielding the service\n *  tag so the calling orchestrator can pre-bind it once at layer-\n *  construction time, keeping the per-Routable hot path free of\n *  Context lookups. */\nexport const resolveRoute = (\n\tidentity: Identity,\n\tdecl: RoutableDecl,\n\tregistry: EntrypointRegistryShape,\n\tupstreams: UpstreamResolver,\n): Effect.Effect<ResolvedRoute, RouterValidationError | UnknownEntrypoint> =>\n\tEffect.gen(function* () {\n\t\tconst entrypoint = yield* registry.byName(decl.endpointName);\n\t\tconst hostname = yield* routerHostname(identity, decl.dispatchId.role);\n\t\tconst fileId = yield* dispatchFileId({ identity, dispatch: decl.dispatchId });\n\t\tconst upstream =\n\t\t\tdecl.upstream.type === 'container'\n\t\t\t\t? yield* upstreams.resolveContainer({\n\t\t\t\t\t\tcontainerName: decl.upstream.containerName,\n\t\t\t\t\t\tcontainerPort: decl.upstream.containerPort,\n\t\t\t\t\t})\n\t\t\t\t: yield* upstreams.resolveHostLoopback({ port: decl.upstream.port });\n\t\tconst wireProtocol: ResolvedWireProtocol =\n\t\t\tdecl.wireProtocol === 'tcp' ? 'tcp' : decl.wireProtocol === 'h2c' ? 'h2c' : 'http';\n\t\t// The router contract says: a `wireProtocol: 'tcp'` decl MUST\n\t\t// reference an entrypoint whose protocol is also `'tcp'`. The\n\t\t// converse holds — HTTP/h2c decls must reference HTTP-family\n\t\t// entrypoints. Mismatch is a programming error in the plugin\n\t\t// author (caught here once, not at every render).\n\t\tconst expectFamily: 'tcp' | 'http' = wireProtocol === 'tcp' ? 'tcp' : 'http';\n\t\tconst entrypointFamily: 'tcp' | 'http' = entrypoint.protocol === 'tcp' ? 'tcp' : 'http';\n\t\tif (expectFamily !== entrypointFamily) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'entrypointName',\n\t\t\t\t\tvalue: entrypoint.name,\n\t\t\t\t\tdetail:\n\t\t\t\t\t\t`wireProtocol family mismatch: decl is '${wireProtocol}' but ` +\n\t\t\t\t\t\t`entrypoint '${entrypoint.name}' is '${entrypoint.protocol}'`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\t// Validate the upstream URL — defense in depth (the resolvers\n\t\t// already produce safe values, but this stops a future resolver\n\t\t// that returns junk from corrupting the YAML). TCP carries the\n\t\t// `tcp://` scheme so we differentiate from the HTTP path; the\n\t\t// renderer pulls host+port back out either way.\n\t\tconst upstreamUrl = renderUrl({\n\t\t\tprotocol: wireProtocol === 'tcp' ? 'tcp' : 'http',\n\t\t\thostname: upstream.host,\n\t\t\tport: upstream.port,\n\t\t});\n\t\tif (!/^(?:http|tcp):\\/\\/[A-Za-z0-9_.:-]+:\\d+$/.test(upstreamUrl)) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'upstreamUrl',\n\t\t\t\t\tvalue: upstreamUrl,\n\t\t\t\t\tdetail: 'expected http://<host>:<port> or tcp://<host>:<port>',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\t// CORS is HTTP-only — TCP decls don't carry the field. Render\n\t\t// uses this; the resolved shape carries `false` for TCP.\n\t\tconst cors = decl.wireProtocol === 'tcp' ? false : decl.cors;\n\t\treturn {\n\t\t\tdispatchFileId: fileId,\n\t\t\thostname,\n\t\t\tentrypointName: entrypoint.name,\n\t\t\tentrypointPort: entrypoint.port,\n\t\t\tupstreamUrl,\n\t\t\tcors,\n\t\t\twireProtocol,\n\t\t};\n\t});\n\n// ---------------------------------------------------------------------------\n// Render — ResolvedRoute → YAML body\n// ---------------------------------------------------------------------------\n\n/** Pull host+port out of an `<scheme>://<host>:<port>` URL. Used by the\n *  TCP renderer to write the `address:` field. Safe because\n *  `resolveRoute` validates the URL shape before we get here. */\nconst splitUpstream = (url: string): { host: string; port: string } => {\n\tconst stripped = url.replace(/^(?:http|tcp):\\/\\//, '');\n\tconst lastColon = stripped.lastIndexOf(':');\n\treturn {\n\t\thost: stripped.slice(0, lastColon),\n\t\tport: stripped.slice(lastColon + 1),\n\t};\n};\n\nconst renderLeaseHeader = (lease: RouteLeaseMetadata): ReadonlyArray<string> => [\n\t`# routeLeaseVersion: ${lease.version}`,\n\t`# routerProfileId: ${lease.routerProfileId}`,\n\t`# ownerApp: ${lease.app}`,\n\t`# ownerStack: ${lease.stack}`,\n\t`# ownerPid: ${lease.owner.pid}`,\n\t`# ownerStartTime: ${lease.owner.startTime}`,\n\t`# ownerHostname: ${lease.owner.hostname}`,\n\t`# ownerClaimedAt: ${lease.owner.claimedAt}`,\n\t`# ownerHeartbeatAt: ${lease.owner.heartbeatAt}`,\n\t`# ownerIntent: ${lease.owner.intent}`,\n];\n\n/** Render the YAML body for a single resolved route. Hand-rolled\n *  (same rationale as `cors.ts`): static, controlled, byte-stable so\n *  no-op rewrites don't wake the watcher. */\nexport const renderRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tif (route.wireProtocol === 'tcp') return renderTcpRouteYaml(route, lease);\n\treturn renderHttpRouteYaml(route, lease);\n};\n\nconst routeReadinessMiddlewareName = (route: ResolvedRoute): string =>\n\t`${route.dispatchFileId}-route-ready`;\n\nconst renderHttpRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tconst middlewares = [\n\t\trouteReadinessMiddlewareName(route),\n\t\t...(route.cors ? [CORS_MIDDLEWARE_NAME] : []),\n\t];\n\tconst schemeHint =\n\t\troute.wireProtocol === 'h2c'\n\t\t\t? `        # h2c upstream — gRPC-friendly cleartext HTTP/2.\\n`\n\t\t\t: '';\n\treturn [\n\t\t`# Auto-generated by devstack router orchestrator. Do not edit by hand.`,\n\t\t`# dispatchFileId: ${route.dispatchFileId}`,\n\t\t`# wireProtocol: ${route.wireProtocol}`,\n\t\t`# entrypointName: ${route.entrypointName}`,\n\t\t`# entrypointPort: ${route.entrypointPort}`,\n\t\t`# hostname: ${route.hostname}`,\n\t\t...renderLeaseHeader(lease),\n\t\t`http:`,\n\t\t`  routers:`,\n\t\t`    ${route.dispatchFileId}-router:`,\n\t\t`      rule: \"Host(\\`${route.hostname}\\`)\"`,\n\t\t`      entryPoints: [\"${route.entrypointName}\"]`,\n\t\t`      service: \"${route.dispatchFileId}-svc\"`,\n\t\t`      middlewares: [${middlewares.map((name) => `\"${name}\"`).join(', ')}]`,\n\t\t`  middlewares:`,\n\t\t`    ${routeReadinessMiddlewareName(route)}:`,\n\t\t`      headers:`,\n\t\t`        customResponseHeaders:`,\n\t\t`          ${ROUTE_READINESS_HEADER}: \"${route.dispatchFileId}\"`,\n\t\t`  services:`,\n\t\t`    ${route.dispatchFileId}-svc:`,\n\t\t`      loadBalancer:`,\n\t\tschemeHint.length > 0 ? schemeHint.trimEnd() : null,\n\t\t`        servers:`,\n\t\t`          - url: \"${route.upstreamUrl}\"`,\n\t\t``,\n\t]\n\t\t.filter((line): line is string => line !== null)\n\t\t.join('\\n');\n};\n\nconst renderTcpRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tconst { host, port } = splitUpstream(route.upstreamUrl);\n\treturn [\n\t\t`# Auto-generated by devstack router orchestrator. Do not edit by hand.`,\n\t\t`# dispatchFileId: ${route.dispatchFileId}`,\n\t\t`# wireProtocol: tcp`,\n\t\t`# entrypointName: ${route.entrypointName}`,\n\t\t`# entrypointPort: ${route.entrypointPort}`,\n\t\t`# hostname: ${route.hostname}`,\n\t\t`# tcpDispatch: entrypoint-port dispatch; HostSNI wildcard`,\n\t\t...renderLeaseHeader(lease),\n\t\t`tcp:`,\n\t\t`  routers:`,\n\t\t`    ${route.dispatchFileId}-router:`,\n\t\t`      rule: \"HostSNI(\\`*\\`)\"`,\n\t\t`      entryPoints: [\"${route.entrypointName}\"]`,\n\t\t`      service: \"${route.dispatchFileId}-svc\"`,\n\t\t`  services:`,\n\t\t`    ${route.dispatchFileId}-svc:`,\n\t\t`      loadBalancer:`,\n\t\t`        servers:`,\n\t\t`          - address: \"${host}:${port}\"`,\n\t\t``,\n\t].join('\\n');\n};\n\nexport const dispatchFileIdFromFilename = (filename: string): string | null => {\n\t// Escape `DISPATCH_FILENAME_PREFIX` for use inside a RegExp literal —\n\t// today it's a plain `10-` so no regex metacharacters are at play,\n\t// but the escape makes the read side robust to future prefix changes.\n\tconst escapedPrefix = DISPATCH_FILENAME_PREFIX.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\tconst match = new RegExp(`^${escapedPrefix}(.+)\\\\.yml$`).exec(filename);\n\treturn match?.[1] ?? null;\n};\n\nconst commentValue = (body: string, key: string): string | null => {\n\tconst escaped = key.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\tconst match = new RegExp(`^# ${escaped}: (.*)$`, 'm').exec(body);\n\treturn match?.[1]?.trim() ?? null;\n};\n\nconst matchValue = (body: string, pattern: RegExp): string | null =>\n\tpattern.exec(body)?.[1]?.trim() ?? null;\n\nconst commentNumber = (body: string, key: string): number | null => {\n\tconst raw = commentValue(body, key);\n\tif (raw === null || !/^\\d+$/.test(raw)) return null;\n\treturn Number.parseInt(raw, 10);\n};\n\nconst parseWireProtocol = (body: string): ResolvedWireProtocol | null => {\n\tconst fromComment = commentValue(body, 'wireProtocol');\n\tif (fromComment === 'http' || fromComment === 'h2c' || fromComment === 'tcp') {\n\t\treturn fromComment;\n\t}\n\tif (/^tcp:/m.test(body)) return 'tcp';\n\tif (/^http:/m.test(body)) return 'http';\n\treturn null;\n};\n\nconst hasRouteLeaseMetadata = (body: string): boolean =>\n\t[\n\t\t'routeLeaseVersion',\n\t\t'routerProfileId',\n\t\t'ownerApp',\n\t\t'ownerStack',\n\t\t'ownerPid',\n\t\t'ownerStartTime',\n\t\t'ownerHostname',\n\t\t'ownerClaimedAt',\n\t\t'ownerHeartbeatAt',\n\t\t'ownerIntent',\n\t].some((key) => commentValue(body, key) !== null);\n\nconst parseRouteLeaseMetadata = (\n\tbody: string,\n\tdispatchFileId: string,\n): {\n\treadonly lease: RouteLeaseMetadata | null;\n\treadonly diagnostic: DispatchRouteDecodeDiagnostic | null;\n} => {\n\tif (!hasRouteLeaseMetadata(body)) return { lease: null, diagnostic: null };\n\tconst rawVersion = commentValue(body, 'routeLeaseVersion');\n\tconst version = commentNumber(body, 'routeLeaseVersion');\n\tconst routerProfileId = commentValue(body, 'routerProfileId');\n\tconst app = commentValue(body, 'ownerApp');\n\tconst stack = commentValue(body, 'ownerStack');\n\tconst pid = commentNumber(body, 'ownerPid');\n\tconst startTime = commentNumber(body, 'ownerStartTime');\n\tconst hostname = commentValue(body, 'ownerHostname');\n\tconst claimedAt = commentNumber(body, 'ownerClaimedAt');\n\tconst heartbeatAt = commentNumber(body, 'ownerHeartbeatAt');\n\tconst intent = commentValue(body, 'ownerIntent');\n\tif (version !== ROUTER_ROUTE_LEASE_VERSION) {\n\t\treturn {\n\t\t\tlease: null,\n\t\t\tdiagnostic: {\n\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\tdispatchFileId,\n\t\t\t\treason: 'unknown-route-lease-version',\n\t\t\t\tdetail: `expected routeLeaseVersion ${ROUTER_ROUTE_LEASE_VERSION}, got ${rawVersion ?? '<missing>'}`,\n\t\t\t},\n\t\t};\n\t}\n\tif (\n\t\trouterProfileId === null ||\n\t\tapp === null ||\n\t\tstack === null ||\n\t\tpid === null ||\n\t\tstartTime === null ||\n\t\thostname === null ||\n\t\tclaimedAt === null ||\n\t\theartbeatAt === null ||\n\t\t(intent !== 'normal' && intent !== 'snapshot')\n\t) {\n\t\treturn {\n\t\t\tlease: null,\n\t\t\tdiagnostic: {\n\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\tdispatchFileId,\n\t\t\t\treason: 'invalid-route-lease-metadata',\n\t\t\t\tdetail: 'route lease metadata is incomplete or malformed',\n\t\t\t},\n\t\t};\n\t}\n\treturn {\n\t\tlease: {\n\t\t\tversion: ROUTER_ROUTE_LEASE_VERSION,\n\t\t\trouterProfileId,\n\t\t\tapp,\n\t\t\tstack,\n\t\t\towner: {\n\t\t\t\tpid,\n\t\t\t\tstartTime,\n\t\t\t\thostname,\n\t\t\t\tclaimedAt,\n\t\t\t\theartbeatAt,\n\t\t\t\tintent,\n\t\t\t},\n\t\t},\n\t\tdiagnostic: null,\n\t};\n};\n\nexport const parseDispatchRouteFile = (\n\tbody: string,\n\tfallbackDispatchFileId: string | null = null,\n): DispatchRouteParseResult => {\n\tconst dispatchFileId = commentValue(body, 'dispatchFileId') ?? fallbackDispatchFileId;\n\tconst wireProtocol = parseWireProtocol(body);\n\tconst entrypointName =\n\t\tcommentValue(body, 'entrypointName') ?? matchValue(body, /entryPoints: \\[\"([^\"]+)\"\\]/);\n\tconst hostname =\n\t\tcommentValue(body, 'hostname') ??\n\t\tmatchValue(body, /Host\\(`([^`]+)`\\)/) ??\n\t\t(wireProtocol === 'tcp' ? '' : null);\n\tconst portRaw = commentValue(body, 'entrypointPort');\n\tconst entrypointPort =\n\t\tportRaw === null || !/^\\d+$/.test(portRaw) ? null : Number.parseInt(portRaw, 10);\n\n\tif (\n\t\tdispatchFileId === null ||\n\t\twireProtocol === null ||\n\t\tentrypointName === null ||\n\t\thostname === null\n\t) {\n\t\tconst protectedDispatchFileId = dispatchFileId ?? '<unknown>';\n\t\treturn {\n\t\t\t_tag: 'invalid',\n\t\t\tdispatchFileId: protectedDispatchFileId,\n\t\t\tdiagnostics: [\n\t\t\t\t{\n\t\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\t\tdispatchFileId: protectedDispatchFileId,\n\t\t\t\t\treason: 'missing-required-route-metadata',\n\t\t\t\t\tdetail:\n\t\t\t\t\t\t'route file is missing dispatchFileId, wireProtocol/http|tcp block, entrypointName, or hostname metadata',\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\t}\n\tconst leaseResult = parseRouteLeaseMetadata(body, dispatchFileId);\n\n\treturn {\n\t\t_tag: 'valid',\n\t\troute: {\n\t\t\tdispatchFileId,\n\t\t\thostname,\n\t\t\tentrypointName,\n\t\t\tentrypointPort,\n\t\t\twireProtocol,\n\t\t\tlease: leaseResult.lease,\n\t\t},\n\t\tdiagnostics: leaseResult.diagnostic === null ? [] : [leaseResult.diagnostic],\n\t};\n};\n\nexport const parseDispatchRouteMetadata = (\n\tbody: string,\n\tfallbackDispatchFileId: string | null = null,\n): DispatchRouteMetadata | null => {\n\tconst parsed = parseDispatchRouteFile(body, fallbackDispatchFileId);\n\treturn parsed._tag === 'valid' ? parsed.route : null;\n};\n\n// ---------------------------------------------------------------------------\n// Collision detection\n// ---------------------------------------------------------------------------\n\n/** Assert no two resolved routes share dispatch keys.\n *\n *  - HTTP routes collide on `(entrypoint, hostname)` — two HTTP backends\n *    on the same entrypoint port can coexist via different Host headers,\n *    so the Host *is* part of the key.\n *  - TCP routes collide on `entrypoint` alone — TCP has no Host header,\n *    so an entrypoint can serve exactly ONE backend. Two TCP decls on\n *    the same entrypoint are an unambiguous error (parallel stacks of\n *    a TCP service share the host port and would clobber each other).\n *\n *  Architecture invariant #7 — distinct identity → distinct dispatch\n *  URL. The TCP arm is the new clause; HTTP arm unchanged. */\nexport const detectCollisions = (\n\troutes: ReadonlyArray<RouteCollisionMetadata>,\n): RouteCollision | null => {\n\tconst seen = new Map<string, Array<RouteCollisionMetadata>>();\n\tfor (const r of routes) {\n\t\tconst portKey =\n\t\t\tr.entrypointPort === null ? `entrypoint:${r.entrypointName}` : `port:${r.entrypointPort}`;\n\t\tconst key = r.wireProtocol === 'tcp' ? `tcp@${portKey}` : `http@${portKey}@${r.hostname}`;\n\t\tconst acc = seen.get(key);\n\t\tif (acc) acc.push(r);\n\t\telse seen.set(key, [r]);\n\t}\n\tfor (const [key, colliding] of seen) {\n\t\tif (colliding.length > 1) {\n\t\t\tconst ids = colliding.map((route) => route.dispatchFileId);\n\t\t\tconst first = colliding[0];\n\t\t\tif (key.startsWith('tcp@')) {\n\t\t\t\treturn new RouteCollision({\n\t\t\t\t\tmessage: routeCollisionMessage({\n\t\t\t\t\t\thostname: '',\n\t\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t\t\twireProtocol: 'tcp',\n\t\t\t\t\t}),\n\t\t\t\t\thostname: '',\n\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn new RouteCollision({\n\t\t\t\tmessage: routeCollisionMessage({\n\t\t\t\t\thostname: first?.hostname ?? '',\n\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t\twireProtocol: 'http',\n\t\t\t\t}),\n\t\t\t\thostname: first?.hostname ?? '',\n\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\tdispatchIds: ids,\n\t\t\t});\n\t\t}\n\t}\n\treturn null;\n};\n\nconst routeCollisionMessage = (collision: {\n\treadonly hostname: string;\n\treadonly entrypoint: string;\n\treadonly dispatchIds: ReadonlyArray<string>;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}): string => {\n\tconst ids = collision.dispatchIds.join(', ');\n\tif (collision.wireProtocol === 'tcp') {\n\t\treturn `router TCP route collision on entrypoint '${collision.entrypoint}' for dispatch ids: ${ids}`;\n\t}\n\treturn (\n\t\t`router route collision on entrypoint '${collision.entrypoint}' ` +\n\t\t`and hostname '${collision.hostname}' for dispatch ids: ${ids}`\n\t);\n};\n\n"],"mappings":";;;;;;AA8DA,MAAa,yBAAyB;;;;;;AAOtC,MAAM,2BAA2B;;;;;AAmFjC,MAAa,oBAAoB,WAChC,GAAG,2BAA2B,OAAO;;;;;;;;;AAoCtC,MAAa,gBACZ,UACA,MACA,UACA,cAEA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,OAAO,SAAS,OAAO,KAAK,aAAa;CAC5D,MAAM,WAAW,OAAO,eAAe,UAAU,KAAK,WAAW,KAAK;CACtE,MAAM,SAAS,OAAO,eAAe;EAAE;EAAU,UAAU,KAAK;EAAY,CAAC;CAC7E,MAAM,WACL,KAAK,SAAS,SAAS,cACpB,OAAO,UAAU,iBAAiB;EAClC,eAAe,KAAK,SAAS;EAC7B,eAAe,KAAK,SAAS;EAC7B,CAAC,GACD,OAAO,UAAU,oBAAoB,EAAE,MAAM,KAAK,SAAS,MAAM,CAAC;CACtE,MAAM,eACL,KAAK,iBAAiB,QAAQ,QAAQ,KAAK,iBAAiB,QAAQ,QAAQ;AAQ7E,MAFqC,iBAAiB,QAAQ,QAAQ,aAC7B,WAAW,aAAa,QAAQ,QAAQ,QAEhF,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO,WAAW;EAClB,QACC,0CAA0C,aAAa,oBACxC,WAAW,KAAK,QAAQ,WAAW,SAAS;EAC5D,CAAC,CACF;CAOF,MAAM,cAAc,UAAU;EAC7B,UAAU,iBAAiB,QAAQ,QAAQ;EAC3C,UAAU,SAAS;EACnB,MAAM,SAAS;EACf,CAAC;AACF,KAAI,CAAC,0CAA0C,KAAK,YAAY,CAC/D,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO;EACP,QAAQ;EACR,CAAC,CACF;CAIF,MAAM,OAAO,KAAK,iBAAiB,QAAQ,QAAQ,KAAK;AACxD,QAAO;EACN,gBAAgB;EAChB;EACA,gBAAgB,WAAW;EAC3B,gBAAgB,WAAW;EAC3B;EACA;EACA;EACA;EACA;;;;AASH,MAAM,iBAAiB,QAAgD;CACtE,MAAM,WAAW,IAAI,QAAQ,sBAAsB,GAAG;CACtD,MAAM,YAAY,SAAS,YAAY,IAAI;AAC3C,QAAO;EACN,MAAM,SAAS,MAAM,GAAG,UAAU;EAClC,MAAM,SAAS,MAAM,YAAY,EAAE;EACnC;;AAGF,MAAM,qBAAqB,UAAqD;CAC/E,wBAAwB,MAAM;CAC9B,sBAAsB,MAAM;CAC5B,eAAe,MAAM;CACrB,iBAAiB,MAAM;CACvB,eAAe,MAAM,MAAM;CAC3B,qBAAqB,MAAM,MAAM;CACjC,oBAAoB,MAAM,MAAM;CAChC,qBAAqB,MAAM,MAAM;CACjC,uBAAuB,MAAM,MAAM;CACnC,kBAAkB,MAAM,MAAM;CAC9B;;;;AAKD,MAAa,mBAAmB,OAAsB,UAAsC;AAC3F,KAAI,MAAM,iBAAiB,MAAO,QAAO,mBAAmB,OAAO,MAAM;AACzE,QAAO,oBAAoB,OAAO,MAAM;;AAGzC,MAAM,gCAAgC,UACrC,GAAG,MAAM,eAAe;AAEzB,MAAM,uBAAuB,OAAsB,UAAsC;CACxF,MAAM,cAAc,CACnB,6BAA6B,MAAM,EACnC,GAAI,MAAM,OAAO,CAAC,qBAAqB,GAAG,EAAE,CAC5C;CACD,MAAM,aACL,MAAM,iBAAiB,QACpB,+DACA;AACJ,QAAO;EACN;EACA,qBAAqB,MAAM;EAC3B,mBAAmB,MAAM;EACzB,qBAAqB,MAAM;EAC3B,qBAAqB,MAAM;EAC3B,eAAe,MAAM;EACrB,GAAG,kBAAkB,MAAM;EAC3B;EACA;EACA,OAAO,MAAM,eAAe;EAC5B,uBAAuB,MAAM,SAAS;EACtC,wBAAwB,MAAM,eAAe;EAC7C,mBAAmB,MAAM,eAAe;EACxC,uBAAuB,YAAY,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,KAAK,KAAK,CAAC;EACzE;EACA,OAAO,6BAA6B,MAAM,CAAC;EAC3C;EACA;EACA,aAAa,uBAAuB,KAAK,MAAM,eAAe;EAC9D;EACA,OAAO,MAAM,eAAe;EAC5B;EACA,WAAW,SAAS,IAAI,WAAW,SAAS,GAAG;EAC/C;EACA,qBAAqB,MAAM,YAAY;EACvC;EACA,CACC,QAAQ,SAAyB,SAAS,KAAK,CAC/C,KAAK,KAAK;;AAGb,MAAM,sBAAsB,OAAsB,UAAsC;CACvF,MAAM,EAAE,MAAM,SAAS,cAAc,MAAM,YAAY;AACvD,QAAO;EACN;EACA,qBAAqB,MAAM;EAC3B;EACA,qBAAqB,MAAM;EAC3B,qBAAqB,MAAM;EAC3B,eAAe,MAAM;EACrB;EACA,GAAG,kBAAkB,MAAM;EAC3B;EACA;EACA,OAAO,MAAM,eAAe;EAC5B;EACA,wBAAwB,MAAM,eAAe;EAC7C,mBAAmB,MAAM,eAAe;EACxC;EACA,OAAO,MAAM,eAAe;EAC5B;EACA;EACA,yBAAyB,KAAK,GAAG,KAAK;EACtC;EACA,CAAC,KAAK,KAAK;;AAGb,MAAa,8BAA8B,aAAoC;CAI9E,MAAM,gBAAgB,yBAAyB,QAAQ,uBAAuB,OAAO;AAErF,QADc,IAAI,OAAO,IAAI,cAAc,aAAa,CAAC,KAAK,SAClD,GAAG,MAAM;;AAGtB,MAAM,gBAAgB,MAAc,QAA+B;CAClE,MAAM,UAAU,IAAI,QAAQ,uBAAuB,OAAO;AAE1D,QADc,IAAI,OAAO,MAAM,QAAQ,UAAU,IAAI,CAAC,KAAK,KAC/C,GAAG,IAAI,MAAM,IAAI;;AAG9B,MAAM,cAAc,MAAc,YACjC,QAAQ,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI;AAEpC,MAAM,iBAAiB,MAAc,QAA+B;CACnE,MAAM,MAAM,aAAa,MAAM,IAAI;AACnC,KAAI,QAAQ,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAE,QAAO;AAC/C,QAAO,OAAO,SAAS,KAAK,GAAG;;AAGhC,MAAM,qBAAqB,SAA8C;CACxE,MAAM,cAAc,aAAa,MAAM,eAAe;AACtD,KAAI,gBAAgB,UAAU,gBAAgB,SAAS,gBAAgB,MACtE,QAAO;AAER,KAAI,SAAS,KAAK,KAAK,CAAE,QAAO;AAChC,KAAI,UAAU,KAAK,KAAK,CAAE,QAAO;AACjC,QAAO;;AAGR,MAAM,yBAAyB,SAC9B;CACC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC,MAAM,QAAQ,aAAa,MAAM,IAAI,KAAK,KAAK;AAElD,MAAM,2BACL,MACA,mBAII;AACJ,KAAI,CAAC,sBAAsB,KAAK,CAAE,QAAO;EAAE,OAAO;EAAM,YAAY;EAAM;CAC1E,MAAM,aAAa,aAAa,MAAM,oBAAoB;CAC1D,MAAM,UAAU,cAAc,MAAM,oBAAoB;CACxD,MAAM,kBAAkB,aAAa,MAAM,kBAAkB;CAC7D,MAAM,MAAM,aAAa,MAAM,WAAW;CAC1C,MAAM,QAAQ,aAAa,MAAM,aAAa;CAC9C,MAAM,MAAM,cAAc,MAAM,WAAW;CAC3C,MAAM,YAAY,cAAc,MAAM,iBAAiB;CACvD,MAAM,WAAW,aAAa,MAAM,gBAAgB;CACpD,MAAM,YAAY,cAAc,MAAM,iBAAiB;CACvD,MAAM,cAAc,cAAc,MAAM,mBAAmB;CAC3D,MAAM,SAAS,aAAa,MAAM,cAAc;AAChD,KAAI,YAAA,EACH,QAAO;EACN,OAAO;EACP,YAAY;GACX,MAAM;GACN;GACA,QAAQ;GACR,QAAQ,qCAAiE,cAAc;GACvF;EACD;AAEF,KACC,oBAAoB,QACpB,QAAQ,QACR,UAAU,QACV,QAAQ,QACR,cAAc,QACd,aAAa,QACb,cAAc,QACd,gBAAgB,QACf,WAAW,YAAY,WAAW,WAEnC,QAAO;EACN,OAAO;EACP,YAAY;GACX,MAAM;GACN;GACA,QAAQ;GACR,QAAQ;GACR;EACD;AAEF,QAAO;EACN,OAAO;GACN,SAAA;GACA;GACA;GACA;GACA,OAAO;IACN;IACA;IACA;IACA;IACA;IACA;IACA;GACD;EACD,YAAY;EACZ;;AAGF,MAAa,0BACZ,MACA,yBAAwC,SACV;CAC9B,MAAM,iBAAiB,aAAa,MAAM,iBAAiB,IAAI;CAC/D,MAAM,eAAe,kBAAkB,KAAK;CAC5C,MAAM,iBACL,aAAa,MAAM,iBAAiB,IAAI,WAAW,MAAM,6BAA6B;CACvF,MAAM,WACL,aAAa,MAAM,WAAW,IAC9B,WAAW,MAAM,oBAAoB,KACpC,iBAAiB,QAAQ,KAAK;CAChC,MAAM,UAAU,aAAa,MAAM,iBAAiB;CACpD,MAAM,iBACL,YAAY,QAAQ,CAAC,QAAQ,KAAK,QAAQ,GAAG,OAAO,OAAO,SAAS,SAAS,GAAG;AAEjF,KACC,mBAAmB,QACnB,iBAAiB,QACjB,mBAAmB,QACnB,aAAa,MACZ;EACD,MAAM,0BAA0B,kBAAkB;AAClD,SAAO;GACN,MAAM;GACN,gBAAgB;GAChB,aAAa,CACZ;IACC,MAAM;IACN,gBAAgB;IAChB,QAAQ;IACR,QACC;IACD,CACD;GACD;;CAEF,MAAM,cAAc,wBAAwB,MAAM,eAAe;AAEjE,QAAO;EACN,MAAM;EACN,OAAO;GACN;GACA;GACA;GACA;GACA;GACA,OAAO,YAAY;GACnB;EACD,aAAa,YAAY,eAAe,OAAO,EAAE,GAAG,CAAC,YAAY,WAAW;EAC5E;;;;;;;;;;;;;;AA2BF,MAAa,oBACZ,WAC2B;CAC3B,MAAM,uBAAO,IAAI,KAA4C;AAC7D,MAAK,MAAM,KAAK,QAAQ;EACvB,MAAM,UACL,EAAE,mBAAmB,OAAO,cAAc,EAAE,mBAAmB,QAAQ,EAAE;EAC1E,MAAM,MAAM,EAAE,iBAAiB,QAAQ,OAAO,YAAY,QAAQ,QAAQ,GAAG,EAAE;EAC/E,MAAM,MAAM,KAAK,IAAI,IAAI;AACzB,MAAI,IAAK,KAAI,KAAK,EAAE;MACf,MAAK,IAAI,KAAK,CAAC,EAAE,CAAC;;AAExB,MAAK,MAAM,CAAC,KAAK,cAAc,KAC9B,KAAI,UAAU,SAAS,GAAG;EACzB,MAAM,MAAM,UAAU,KAAK,UAAU,MAAM,eAAe;EAC1D,MAAM,QAAQ,UAAU;AACxB,MAAI,IAAI,WAAW,OAAO,CACzB,QAAO,IAAI,eAAe;GACzB,SAAS,sBAAsB;IAC9B,UAAU;IACV,YAAY,OAAO,kBAAkB;IACrC,aAAa;IACb,cAAc;IACd,CAAC;GACF,UAAU;GACV,YAAY,OAAO,kBAAkB;GACrC,aAAa;GACb,CAAC;AAEH,SAAO,IAAI,eAAe;GACzB,SAAS,sBAAsB;IAC9B,UAAU,OAAO,YAAY;IAC7B,YAAY,OAAO,kBAAkB;IACrC,aAAa;IACb,cAAc;IACd,CAAC;GACF,UAAU,OAAO,YAAY;GAC7B,YAAY,OAAO,kBAAkB;GACrC,aAAa;GACb,CAAC;;AAGJ,QAAO;;AAGR,MAAM,yBAAyB,cAKjB;CACb,MAAM,MAAM,UAAU,YAAY,KAAK,KAAK;AAC5C,KAAI,UAAU,iBAAiB,MAC9B,QAAO,6CAA6C,UAAU,WAAW,sBAAsB;AAEhG,QACC,yCAAyC,UAAU,WAAW,kBAC7C,UAAU,SAAS,sBAAsB"}

package/dist/orchestrators/router/hostname.mjs

@@ -1,54 +1,31 @@
 import { RouterValidationError } from "./errors.mjs";
+import { routedHostname } from "../../substrate/runtime/routed-url.mjs";
 import { Effect } from "effect";
 import { createHash } from "node:crypto";
-const LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+//#region src/orchestrators/router/hostname.ts
 const MAX_DISPATCH_ID_LEN = 140;
 const MAX_DISPATCH_ID_READABLE_LEN = 48;
-const MAX_HOSTNAME_LEN = 200;
-/** Validate a single label-shaped string. Returns the input or fails
-*  with a typed `RouterValidationError`. */
-const validateLabel = (field, value) => {
-	if (!LABEL.test(value)) return Effect.fail(new RouterValidationError({
-		field,
-		value,
-		detail: "expected lower-case RFC-1035 label (alphanumeric + internal hyphens, 1-63 chars)"
-	}));
-	return Effect.succeed(value);
-};
-/** Fold dots → hyphens (architecture invariant #8) and lower-case.
-*  Pure, no validation. The output is fed to `validateLabel`. */
-const normalizeServiceSegment = (raw) => raw.toLowerCase().replace(/\./g, "-");
 /** Build the human-readable prefix of a dispatch id. This is not the
 *  identity key; uniqueness comes from the hash over the canonical
 *  tuple in `dispatchFileId`. */
 const normalizeDispatchSegment = (raw) => raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || "route";
-/** Mint the per-Routable hostname from `(identity, role)`.
-*
-*  Default stack: `<role>.<app>.localhost`
-*  Other stacks:  `<role>.<stack>.<app>.localhost`
-*
-*  The `role` segment is folded + validated; the `app` and `stack`
-*  segments are also validated (they come from `Identity`, which the
-*  substrate has already validated once at boot, but defense-in-depth
-*  is cheap and the failure mode is a programming error).
-*
-*  Architecture invariant #7: this MUST embed the stack dimension for
-*  non-default stacks. Distinct identities → distinct hostnames. */
-const routerHostname = (identity, role) => Effect.gen(function* () {
-	const app = yield* validateLabel("hostname", identity.app);
-	const roleSafe = yield* validateLabel("hostname", normalizeServiceSegment(role));
-	const host = (() => {
-		if (identity.stack === "main") return `${roleSafe}.${app}.localhost`;
-		return `${roleSafe}.${identity.stack.toLowerCase()}.${app}.localhost`;
-	})();
-	if (host.length > MAX_HOSTNAME_LEN) return yield* Effect.fail(new RouterValidationError({
-		field: "hostname",
-		value: host,
-		detail: `exceeds ${MAX_HOSTNAME_LEN}-char limit`
-	}));
-	if (identity.stack !== "main") yield* validateLabel("hostname", identity.stack.toLowerCase());
-	return host;
+/** Project the substrate-blind hostname error into the router error
+*  union. The shape is identical (tagged class with field/value/detail);
+*  this exists so intra-L3 composers (file-provider, resolveRoute) can
+*  keep returning the existing `RouterError` union without a per-call
+*  `mapError` at every call site. */
+const liftHostnameError = (cause) => new RouterValidationError({
+	field: cause.field,
+	value: cause.value,
+	detail: cause.detail
 });
+/** Intra-L3 alias for substrate's `routedHostname` that maps the
+*  substrate error onto the router orchestrator's `RouterError` union.
+*
+*  L2 plugins MUST NOT import this — they import `routedHostname` from
+*  `substrate/runtime/routed-url.ts` directly. This adapter exists only
+*  for the orchestrator's own composers. */
+const routerHostname = (identity, role) => routedHostname(identity, role).pipe(Effect.mapError(liftHostnameError));
 const canonicalDispatchTuple = (inputs) => JSON.stringify([
 	"devstack-router-dispatch-v1",
 	inputs.identity.app,
@@ -88,20 +65,7 @@ const dispatchFileId = (inputs) => Effect.gen(function* () {
 	}));
 	return id;
 });
-/** URL-construction helper: `<scheme>://<hostname>:<port>`.
-*
-*  - `http` / `h2c` → `http://…` (h2c is HTTP/2 cleartext; Traefik
-*    handles upstream selection internally, the URL scheme is still
-*    `http`).
-*  - `tcp` → `tcp://…` — used by the file-provider renderer to
-*    distinguish from HTTP at YAML-emit time. Consumers of the
-*    resolved URL (manifest, codegen) translate back to whatever
-*    scheme their protocol expects (e.g. `postgres://`, `redis://`). */
-const renderUrl = (parts) => {
-	if (parts.protocol === "tcp") return `tcp://${parts.hostname}:${parts.port}`;
-	return `http://${parts.hostname}:${parts.port}`;
-};
 //#endregion
-export { dispatchFileId, renderUrl, routerHostname };
+export { dispatchFileId, normalizeDispatchSegment, routerHostname };
 
 //# sourceMappingURL=hostname.mjs.map

package/dist/orchestrators/router/hostname.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"hostname.mjs","names":[],"sources":["../../../src/orchestrators/router/hostname.ts"],"sourcesContent":["// Hostname + dispatch-id minting helpers.\n//\n// Architecture distilled-doc §\"Outputs / capabilities provided\":\n//\n//   - default (\"main\") stack: `<service>.<app>.localhost`\n//   - every other stack:      `<service>.<stack>.<app>.localhost`\n//\n// \"service\" here is the dispatch-id's `role` segment — NOT the\n// plugin's name. Plugins emit a `(serviceKey, role)` DispatchId; we\n// fold the role into the hostname, since the role is the\n// user-meaningful side (\"api\", \"key-server\", \"indexer-metrics\") and\n// the service key already encodes plugin + app + stack on the\n// dispatch-file side.\n//\n// Architecture invariants:\n//   #7 — Distinct `(app, stack, service)` triples MUST produce\n//         distinct hostnames AND distinct dispatch ids. The default-\n//         stack omission is intentional UX; every other stack\n//         includes the stack segment so parallel stacks of the same\n//         app never collide.\n//   #8 — Hostname service labels fold dots to a label-safe separator.\n//         Dispatch ids are minted from a canonical source tuple plus a\n//         SHA-256 digest, so lossy readable folding cannot collide.\n//   #13 — User-influenceable strings are validated against a\n//         conservative character set before render.\n\nimport { createHash } from 'node:crypto';\n\nimport { Effect } from 'effect';\nimport type { DispatchId } from '../../contracts/routable.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport { RouterValidationError } from './errors.ts';\n\n/** The conventional \"default\" stack name. Hostnames for this stack\n *  omit the stack segment per the architecture's UX rule. */\nexport const DEFAULT_STACK = 'main';\n\n// RFC-1035 single-label regex: starts/ends with alphanumeric, allows\n// internal hyphens, length 1-63. We use the same shape for app, role,\n// and (post-fold) the stack segment.\nconst LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;\n// The readable prefix is capped, and the SHA-256 suffix is fixed size.\nconst MAX_DISPATCH_ID_LEN = 140;\nconst MAX_DISPATCH_ID_READABLE_LEN = 48;\n// 253 chars is the RFC-1035 full-name max. We stay well below.\nconst MAX_HOSTNAME_LEN = 200;\n\n/** Validate a single label-shaped string. Returns the input or fails\n *  with a typed `RouterValidationError`. */\nconst validateLabel = (\n\tfield: RouterValidationError['field'],\n\tvalue: string,\n): Effect.Effect<string, RouterValidationError> => {\n\tif (!LABEL.test(value)) {\n\t\treturn Effect.fail(\n\t\t\tnew RouterValidationError({\n\t\t\t\tfield,\n\t\t\t\tvalue,\n\t\t\t\tdetail: 'expected lower-case RFC-1035 label (alphanumeric + internal hyphens, 1-63 chars)',\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.succeed(value);\n};\n\n/** Fold dots → hyphens (architecture invariant #8) and lower-case.\n *  Pure, no validation. The output is fed to `validateLabel`. */\nexport const normalizeServiceSegment = (raw: string): string =>\n\traw.toLowerCase().replace(/\\./g, '-');\n\n/** Build the human-readable prefix of a dispatch id. This is not the\n *  identity key; uniqueness comes from the hash over the canonical\n *  tuple in `dispatchFileId`. */\nexport const normalizeDispatchSegment = (raw: string): string =>\n\traw\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9]+/g, '-')\n\t\t.replace(/-+/g, '-')\n\t\t.replace(/^-|-$/g, '') || 'route';\n\n// ---------------------------------------------------------------------------\n// Hostname minting\n// ---------------------------------------------------------------------------\n\n/** Mint the per-Routable hostname from `(identity, role)`.\n *\n *  Default stack: `<role>.<app>.localhost`\n *  Other stacks:  `<role>.<stack>.<app>.localhost`\n *\n *  The `role` segment is folded + validated; the `app` and `stack`\n *  segments are also validated (they come from `Identity`, which the\n *  substrate has already validated once at boot, but defense-in-depth\n *  is cheap and the failure mode is a programming error).\n *\n *  Architecture invariant #7: this MUST embed the stack dimension for\n *  non-default stacks. Distinct identities → distinct hostnames. */\nexport const routerHostname = (\n\tidentity: Identity,\n\trole: string,\n): Effect.Effect<string, RouterValidationError> =>\n\tEffect.gen(function* () {\n\t\tconst app = yield* validateLabel('hostname', identity.app);\n\t\tconst folded = normalizeServiceSegment(role);\n\t\tconst roleSafe = yield* validateLabel('hostname', folded);\n\t\tconst host = (() => {\n\t\t\tif (identity.stack === DEFAULT_STACK) {\n\t\t\t\treturn `${roleSafe}.${app}.localhost`;\n\t\t\t}\n\t\t\tconst stackSafe = identity.stack.toLowerCase();\n\t\t\t// `validateLabel` runs *after* lower-casing so the stack name\n\t\t\t// (Identity brand) is held to the same character set as the\n\t\t\t// role and the app. Boot validation should already enforce\n\t\t\t// this; we re-check defensively.\n\t\t\treturn `${roleSafe}.${stackSafe}.${app}.localhost`;\n\t\t})();\n\t\tif (host.length > MAX_HOSTNAME_LEN) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'hostname',\n\t\t\t\t\tvalue: host,\n\t\t\t\t\tdetail: `exceeds ${MAX_HOSTNAME_LEN}-char limit`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\t// Re-validate the stack segment for non-default stacks now that\n\t\t// it's part of a composed hostname.\n\t\tif (identity.stack !== DEFAULT_STACK) {\n\t\t\tyield* validateLabel('hostname', identity.stack.toLowerCase());\n\t\t}\n\t\treturn host;\n\t});\n\n// ---------------------------------------------------------------------------\n// Dispatch-file id minting\n// ---------------------------------------------------------------------------\n\nexport interface DispatchFileIdInputs {\n\treadonly identity: Identity;\n\treadonly dispatch: DispatchId;\n}\n\nconst canonicalDispatchTuple = (inputs: DispatchFileIdInputs): string =>\n\tJSON.stringify([\n\t\t'devstack-router-dispatch-v1',\n\t\tinputs.identity.app,\n\t\tinputs.identity.stack,\n\t\tinputs.dispatch.serviceKey,\n\t\tinputs.dispatch.role,\n\t]);\n\nconst truncateReadable = (value: string): string =>\n\t(value.length <= MAX_DISPATCH_ID_READABLE_LEN\n\t\t? value\n\t\t: value.slice(0, MAX_DISPATCH_ID_READABLE_LEN).replace(/-+$/g, '')) || 'route';\n\n/** Mint a dispatch-file id from the full route identity tuple. The id\n *  is used as the file name in the global file-provider directory\n *  (one file per backend), and as the Traefik router/service name\n *  inside the file.\n *\n *  Format: `r1-<readable-prefix>-<sha256>`.\n *\n *  The readable prefix is intentionally lossy; it exists only to make\n *  directory listings diagnosable. The SHA-256 suffix is over the\n *  canonical `(version, app, stack, serviceKey, role)` tuple, so\n *  raw underscores, separator strings, case, and dot/hyphen folding do\n *  not affect identity. */\nexport const dispatchFileId = (\n\tinputs: DispatchFileIdInputs,\n): Effect.Effect<string, RouterValidationError> =>\n\tEffect.gen(function* () {\n\t\tconst readable = truncateReadable(\n\t\t\tnormalizeDispatchSegment(\n\t\t\t\t[\n\t\t\t\t\tinputs.identity.app,\n\t\t\t\t\tinputs.identity.stack,\n\t\t\t\t\tinputs.dispatch.serviceKey,\n\t\t\t\t\tinputs.dispatch.role,\n\t\t\t\t].join('-'),\n\t\t\t),\n\t\t);\n\t\tconst hash = createHash('sha256').update(canonicalDispatchTuple(inputs)).digest('hex');\n\t\tconst id = `r1-${readable}-${hash}`;\n\t\tif (id.length > MAX_DISPATCH_ID_LEN) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'dispatchId',\n\t\t\t\t\tvalue: id,\n\t\t\t\t\tdetail: `exceeds ${MAX_DISPATCH_ID_LEN}-char limit`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tif (!/^r1-[a-z0-9][a-z0-9-]*-[a-f0-9]{64}$/.test(id)) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'dispatchId',\n\t\t\t\t\tvalue: id,\n\t\t\t\t\tdetail: 'expected r1-<lower-case-slug>-<sha256-hex>',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn id;\n\t});\n\n/** URL-construction helper: `<scheme>://<hostname>:<port>`.\n *\n *  - `http` / `h2c` → `http://…` (h2c is HTTP/2 cleartext; Traefik\n *    handles upstream selection internally, the URL scheme is still\n *    `http`).\n *  - `tcp` → `tcp://…` — used by the file-provider renderer to\n *    distinguish from HTTP at YAML-emit time. Consumers of the\n *    resolved URL (manifest, codegen) translate back to whatever\n *    scheme their protocol expects (e.g. `postgres://`, `redis://`). */\nexport const renderUrl = (parts: {\n\treadonly protocol: 'http' | 'h2c' | 'tcp';\n\treadonly hostname: string;\n\treadonly port: number;\n}): string => {\n\tif (parts.protocol === 'tcp') return `tcp://${parts.hostname}:${parts.port}`;\n\treturn `http://${parts.hostname}:${parts.port}`;\n};\n"],"mappings":";;;AAwCA,MAAM,QAAQ;AAEd,MAAM,sBAAsB;AAC5B,MAAM,+BAA+B;AAErC,MAAM,mBAAmB;;;AAIzB,MAAM,iBACL,OACA,UACkD;AAClD,KAAI,CAAC,MAAM,KAAK,MAAM,CACrB,QAAO,OAAO,KACb,IAAI,sBAAsB;EACzB;EACA;EACA,QAAQ;EACR,CAAC,CACF;AAEF,QAAO,OAAO,QAAQ,MAAM;;;;AAK7B,MAAa,2BAA2B,QACvC,IAAI,aAAa,CAAC,QAAQ,OAAO,IAAI;;;;AAKtC,MAAa,4BAA4B,QACxC,IACE,aAAa,CACb,QAAQ,eAAe,IAAI,CAC3B,QAAQ,OAAO,IAAI,CACnB,QAAQ,UAAU,GAAG,IAAI;;;;;;;;;;;;;AAkB5B,MAAa,kBACZ,UACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,MAAM,OAAO,cAAc,YAAY,SAAS,IAAI;CAE1D,MAAM,WAAW,OAAO,cAAc,YADvB,wBAAwB,KACiB,CAAC;CACzD,MAAM,cAAc;AACnB,MAAI,SAAS,UAAA,OACZ,QAAO,GAAG,SAAS,GAAG,IAAI;AAO3B,SAAO,GAAG,SAAS,GALD,SAAS,MAAM,aAKF,CAAC,GAAG,IAAI;KACpC;AACJ,KAAI,KAAK,SAAS,iBACjB,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO;EACP,QAAQ,WAAW,iBAAiB;EACpC,CAAC,CACF;AAIF,KAAI,SAAS,UAAA,OACZ,QAAO,cAAc,YAAY,SAAS,MAAM,aAAa,CAAC;AAE/D,QAAO;EACN;AAWH,MAAM,0BAA0B,WAC/B,KAAK,UAAU;CACd;CACA,OAAO,SAAS;CAChB,OAAO,SAAS;CAChB,OAAO,SAAS;CAChB,OAAO,SAAS;CAChB,CAAC;AAEH,MAAM,oBAAoB,WACxB,MAAM,UAAU,+BACd,QACA,MAAM,MAAM,GAAG,6BAA6B,CAAC,QAAQ,QAAQ,GAAG,KAAK;;;;;;;;;;;;;AAczE,MAAa,kBACZ,WAEA,OAAO,IAAI,aAAa;CAYvB,MAAM,KAAK,MAXM,iBAChB,yBACC;EACC,OAAO,SAAS;EAChB,OAAO,SAAS;EAChB,OAAO,SAAS;EAChB,OAAO,SAAS;EAChB,CAAC,KAAK,IAAI,CACX,CAGuB,CAAC,GADb,WAAW,SAAS,CAAC,OAAO,uBAAuB,OAAO,CAAC,CAAC,OAAO,MAC/C;AACjC,KAAI,GAAG,SAAS,oBACf,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO;EACP,QAAQ,WAAW,oBAAoB;EACvC,CAAC,CACF;AAEF,KAAI,CAAC,uCAAuC,KAAK,GAAG,CACnD,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO;EACP,QAAQ;EACR,CAAC,CACF;AAEF,QAAO;EACN;;;;;;;;;;AAWH,MAAa,aAAa,UAIZ;AACb,KAAI,MAAM,aAAa,MAAO,QAAO,SAAS,MAAM,SAAS,GAAG,MAAM;AACtE,QAAO,UAAU,MAAM,SAAS,GAAG,MAAM"}
+{"version":3,"file":"hostname.mjs","names":[],"sources":["../../../src/orchestrators/router/hostname.ts"],"sourcesContent":["// Hostname + dispatch-id minting helpers.\n//\n// Architecture distilled-doc §\"Outputs / capabilities provided\":\n//\n//   - default (\"main\") stack: `<service>.<app>.localhost`\n//   - every other stack:      `<service>.<stack>.<app>.localhost`\n//\n// \"service\" here is the dispatch-id's `role` segment — NOT the\n// plugin's name. Plugins emit a `(serviceKey, role)` DispatchId; we\n// fold the role into the hostname, since the role is the\n// user-meaningful side (\"api\", \"key-server\", \"indexer-metrics\") and\n// the service key already encodes plugin + app + stack on the\n// dispatch-file side.\n//\n// Architecture invariants:\n//   #7 — Distinct `(app, stack, service)` triples MUST produce\n//         distinct hostnames AND distinct dispatch ids. The default-\n//         stack omission is intentional UX; every other stack\n//         includes the stack segment so parallel stacks of the same\n//         app never collide.\n//   #8 — Hostname service labels fold dots to a label-safe separator.\n//         Dispatch ids are minted from a canonical source tuple plus a\n//         SHA-256 digest, so lossy readable folding cannot collide.\n//   #13 — User-influenceable strings are validated against a\n//         conservative character set before render.\n//\n// As of B1 (boundary-repair): pure URL composition + hostname minting\n// live in `substrate/runtime/routed-url.ts` so L2 plugins can call\n// them without reaching across the L2→L3 boundary. This module re-\n// exports the substrate primitives, owns dispatch-file id minting\n// (router-orchestrator-specific), and provides a `routerHostname`\n// adapter that projects substrate's `HostnameValidationError` into the\n// router's `RouterValidationError` union for intra-L3 callers\n// (file-provider, resolveRoute).\n\nimport { createHash } from 'node:crypto';\n\nimport { Effect } from 'effect';\nimport type { DispatchId } from '../../contracts/routable.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport {\n\tDEFAULT_STACK,\n\tHostnameValidationError,\n\tnormalizeServiceSegment,\n\trenderUrl,\n\troutedHostname,\n} from '../../substrate/runtime/routed-url.ts';\nimport { RouterValidationError } from './errors.ts';\n\n// Re-export substrate-blind primitives for intra-L3 callers that\n// continue to import from this module path.\nexport { DEFAULT_STACK, normalizeServiceSegment, renderUrl };\n\n// The readable prefix is capped, and the SHA-256 suffix is fixed size.\nconst MAX_DISPATCH_ID_LEN = 140;\nconst MAX_DISPATCH_ID_READABLE_LEN = 48;\n\n/** Build the human-readable prefix of a dispatch id. This is not the\n *  identity key; uniqueness comes from the hash over the canonical\n *  tuple in `dispatchFileId`. */\nexport const normalizeDispatchSegment = (raw: string): string =>\n\traw\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9]+/g, '-')\n\t\t.replace(/-+/g, '-')\n\t\t.replace(/^-|-$/g, '') || 'route';\n\n// ---------------------------------------------------------------------------\n// Hostname minting — orchestrator-internal adapter\n// ---------------------------------------------------------------------------\n\n/** Project the substrate-blind hostname error into the router error\n *  union. The shape is identical (tagged class with field/value/detail);\n *  this exists so intra-L3 composers (file-provider, resolveRoute) can\n *  keep returning the existing `RouterError` union without a per-call\n *  `mapError` at every call site. */\nconst liftHostnameError = (cause: HostnameValidationError): RouterValidationError =>\n\tnew RouterValidationError({\n\t\tfield: cause.field,\n\t\tvalue: cause.value,\n\t\tdetail: cause.detail,\n\t});\n\n/** Intra-L3 alias for substrate's `routedHostname` that maps the\n *  substrate error onto the router orchestrator's `RouterError` union.\n *\n *  L2 plugins MUST NOT import this — they import `routedHostname` from\n *  `substrate/runtime/routed-url.ts` directly. This adapter exists only\n *  for the orchestrator's own composers. */\nexport const routerHostname = (\n\tidentity: Identity,\n\trole: string,\n): Effect.Effect<string, RouterValidationError> =>\n\troutedHostname(identity, role).pipe(Effect.mapError(liftHostnameError));\n\n// ---------------------------------------------------------------------------\n// Dispatch-file id minting\n// ---------------------------------------------------------------------------\n\nexport interface DispatchFileIdInputs {\n\treadonly identity: Identity;\n\treadonly dispatch: DispatchId;\n}\n\nconst canonicalDispatchTuple = (inputs: DispatchFileIdInputs): string =>\n\tJSON.stringify([\n\t\t'devstack-router-dispatch-v1',\n\t\tinputs.identity.app,\n\t\tinputs.identity.stack,\n\t\tinputs.dispatch.serviceKey,\n\t\tinputs.dispatch.role,\n\t]);\n\nconst truncateReadable = (value: string): string =>\n\t(value.length <= MAX_DISPATCH_ID_READABLE_LEN\n\t\t? value\n\t\t: value.slice(0, MAX_DISPATCH_ID_READABLE_LEN).replace(/-+$/g, '')) || 'route';\n\n/** Mint a dispatch-file id from the full route identity tuple. The id\n *  is used as the file name in the global file-provider directory\n *  (one file per backend), and as the Traefik router/service name\n *  inside the file.\n *\n *  Format: `r1-<readable-prefix>-<sha256>`.\n *\n *  The readable prefix is intentionally lossy; it exists only to make\n *  directory listings diagnosable. The SHA-256 suffix is over the\n *  canonical `(version, app, stack, serviceKey, role)` tuple, so\n *  raw underscores, separator strings, case, and dot/hyphen folding do\n *  not affect identity. */\nexport const dispatchFileId = (\n\tinputs: DispatchFileIdInputs,\n): Effect.Effect<string, RouterValidationError> =>\n\tEffect.gen(function* () {\n\t\tconst readable = truncateReadable(\n\t\t\tnormalizeDispatchSegment(\n\t\t\t\t[\n\t\t\t\t\tinputs.identity.app,\n\t\t\t\t\tinputs.identity.stack,\n\t\t\t\t\tinputs.dispatch.serviceKey,\n\t\t\t\t\tinputs.dispatch.role,\n\t\t\t\t].join('-'),\n\t\t\t),\n\t\t);\n\t\tconst hash = createHash('sha256').update(canonicalDispatchTuple(inputs)).digest('hex');\n\t\tconst id = `r1-${readable}-${hash}`;\n\t\tif (id.length > MAX_DISPATCH_ID_LEN) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'dispatchId',\n\t\t\t\t\tvalue: id,\n\t\t\t\t\tdetail: `exceeds ${MAX_DISPATCH_ID_LEN}-char limit`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tif (!/^r1-[a-z0-9][a-z0-9-]*-[a-f0-9]{64}$/.test(id)) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'dispatchId',\n\t\t\t\t\tvalue: id,\n\t\t\t\t\tdetail: 'expected r1-<lower-case-slug>-<sha256-hex>',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn id;\n\t});\n"],"mappings":";;;;;AAsDA,MAAM,sBAAsB;AAC5B,MAAM,+BAA+B;;;;AAKrC,MAAa,4BAA4B,QACxC,IACE,aAAa,CACb,QAAQ,eAAe,IAAI,CAC3B,QAAQ,OAAO,IAAI,CACnB,QAAQ,UAAU,GAAG,IAAI;;;;;;AAW5B,MAAM,qBAAqB,UAC1B,IAAI,sBAAsB;CACzB,OAAO,MAAM;CACb,OAAO,MAAM;CACb,QAAQ,MAAM;CACd,CAAC;;;;;;;AAQH,MAAa,kBACZ,UACA,SAEA,eAAe,UAAU,KAAK,CAAC,KAAK,OAAO,SAAS,kBAAkB,CAAC;AAWxE,MAAM,0BAA0B,WAC/B,KAAK,UAAU;CACd;CACA,OAAO,SAAS;CAChB,OAAO,SAAS;CAChB,OAAO,SAAS;CAChB,OAAO,SAAS;CAChB,CAAC;AAEH,MAAM,oBAAoB,WACxB,MAAM,UAAU,+BACd,QACA,MAAM,MAAM,GAAG,6BAA6B,CAAC,QAAQ,QAAQ,GAAG,KAAK;;;;;;;;;;;;;AAczE,MAAa,kBACZ,WAEA,OAAO,IAAI,aAAa;CAYvB,MAAM,KAAK,MAXM,iBAChB,yBACC;EACC,OAAO,SAAS;EAChB,OAAO,SAAS;EAChB,OAAO,SAAS;EAChB,OAAO,SAAS;EAChB,CAAC,KAAK,IAAI,CACX,CAGuB,CAAC,GADb,WAAW,SAAS,CAAC,OAAO,uBAAuB,OAAO,CAAC,CAAC,OAAO,MAC/C;AACjC,KAAI,GAAG,SAAS,oBACf,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO;EACP,QAAQ,WAAW,oBAAoB;EACvC,CAAC,CACF;AAEF,KAAI,CAAC,uCAAuC,KAAK,GAAG,CACnD,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO;EACP,QAAQ;EACR,CAAC,CACF;AAEF,QAAO;EACN"}

package/dist/orchestrators/router/index.mjs

@@ -0,0 +1,11 @@
+import "./errors.mjs";
+import "./sentinels.mjs";
+import "./traefik-container.mjs";
+import "./profile.mjs";
+import "./entrypoints.mjs";
+import "./cors.mjs";
+import "../../substrate/runtime/routed-url.mjs";
+import "./hostname.mjs";
+import "./file-provider.mjs";
+import "./service.mjs";
+export {};

package/dist/orchestrators/router/profile.mjs

@@ -1,5 +1,5 @@
-import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { execFileSync } from "node:child_process";
 import { homedir, userInfo } from "node:os";
@@ -104,6 +104,6 @@ const makeDefaultRouterProfile = (options = {}) => makeRouterProfile({
 	...options.stateRoot === void 0 ? {} : { stateRoot: options.stateRoot }
 });
 //#endregion
-export { makeDefaultRouterProfile };
+export { currentRouterUserId, makeDefaultRouterProfile, makeRouterProfile, resolveDockerContextId };
 
 //# sourceMappingURL=profile.mjs.map

package/dist/orchestrators/router/sentinels.mjs

@@ -0,0 +1,26 @@
+import { LabelKey } from "../../runtime/docker/labels.mjs";
+import "../../runtime/docker/index.mjs";
+//#region src/orchestrators/router/sentinels.ts
+/** Synthetic app name stamped onto the router-singleton container. The
+*  lifecycle-prune orchestrator uses this to distinguish the router
+*  group from per-stack groups (per-stack `wipe` doesn't touch the
+*  router). */
+const ROUTER_SHARED_APP = "devstack-router";
+/** Prefix for the router-singleton container name. The on-disk
+*  profile-state directory under `runtime/router/<profile-fingerprint>/`
+*  is matched against this prefix during profile-state cleanup so a
+*  router-stack removal also drops the profile dir. */
+const ROUTER_CONTAINER_NAME_PREFIX = "devstack-router-";
+/** Value stamped into the L1 generic `LabelKey.kind` slot for router
+*  containers. L1 is plugin-blind: the router orchestrator owns this
+*  literal. */
+const ROUTER_KIND_LABEL_VALUE = "router";
+/** Label key carrying the router profile id (so `docker ps` filters by
+*  profile alone resolve the right router container). Reuses the L1
+*  generic `subkind` slot — same plugin-blind convention as
+*  `LabelKey.kind`. */
+const ROUTER_PROFILE_LABEL = LabelKey.subkind;
+//#endregion
+export { ROUTER_CONTAINER_NAME_PREFIX, ROUTER_KIND_LABEL_VALUE, ROUTER_PROFILE_LABEL, ROUTER_SHARED_APP };
+
+//# sourceMappingURL=sentinels.mjs.map

package/dist/orchestrators/router/sentinels.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinels.mjs","names":[],"sources":["../../../src/orchestrators/router/sentinels.ts"],"sourcesContent":["// Router-singleton sentinels.\n//\n// The router orchestrator owns one Traefik container per router profile\n// (NOT per-stack); these literals identify that container in label\n// matchers, lifecycle-prune predicates, and on-disk profile-state\n// fingerprints. Centralizing them here means cleanup, traefik-container,\n// and lifecycle-prune all read the same source.\n//\n// Architecture distilled-doc §\"Layer composition\" — the router is L3;\n// these sentinels are not plugin-author-visible (they're orchestrator-\n// owned) but must stay consistent across the router's modules.\n\nimport { LabelKey } from '../../runtime/docker/index.ts';\n\n/** Synthetic app name stamped onto the router-singleton container. The\n *  lifecycle-prune orchestrator uses this to distinguish the router\n *  group from per-stack groups (per-stack `wipe` doesn't touch the\n *  router). */\nexport const ROUTER_SHARED_APP = 'devstack-router';\n\n/** Prefix for the router-singleton container name. The on-disk\n *  profile-state directory under `runtime/router/<profile-fingerprint>/`\n *  is matched against this prefix during profile-state cleanup so a\n *  router-stack removal also drops the profile dir. */\nexport const ROUTER_CONTAINER_NAME_PREFIX = 'devstack-router-';\n\n/** Value stamped into the L1 generic `LabelKey.kind` slot for router\n *  containers. L1 is plugin-blind: the router orchestrator owns this\n *  literal. */\nexport const ROUTER_KIND_LABEL_VALUE = 'router';\n\n/** Label key carrying the router profile id (so `docker ps` filters by\n *  profile alone resolve the right router container). Reuses the L1\n *  generic `subkind` slot — same plugin-blind convention as\n *  `LabelKey.kind`. */\nexport const ROUTER_PROFILE_LABEL = LabelKey.subkind;\n\n/** Bumps when the traefik-container ops shape changes. Mismatched\n *  containers are recreated rather than adopted. */\nexport const ROUTER_CONTAINER_SPEC_VERSION = '3';\n"],"mappings":";;;;;;;AAkBA,MAAa,oBAAoB;;;;;AAMjC,MAAa,+BAA+B;;;;AAK5C,MAAa,0BAA0B;;;;;AAMvC,MAAa,uBAAuB,SAAS"}

package/dist/orchestrators/router/service.mjs

@@ -1,26 +1,29 @@
 import { IdentityContext } from "../../substrate/runtime/paths.mjs";
-import { checkHolderLiveness, ownHolder } from "../../substrate/runtime/cross-process/liveness.mjs";
-import { DispatchWriteFailed, RouteCollision, RouteReadinessProbeFailed, RouterBootFailed, RouterDisabledRouteUnsupported, RouterValidationError } from "./errors.mjs";
-import { dispatchFileId } from "./hostname.mjs";
 import { atomicWriteFile } from "../../substrate/runtime/atomic-write.mjs";
-import { DockerHost, DockerSpawner } from "../../runtime/docker/client.mjs";
+import { logWarningAndIgnore } from "../../substrate/runtime/observability/ignore-with-log.mjs";
+import { LivenessProbeScope, checkHolderLiveness, layerLivenessProbeScope, ownHolder } from "../../substrate/runtime/cross-process/liveness.mjs";
 import { acquireStackLock } from "../../substrate/runtime/cross-process/stack-lock.mjs";
+import "../../substrate/runtime/observability/index.mjs";
+import { DockerHost, DockerSpawner } from "../../runtime/docker/client.mjs";
 import { connect, waitForIp } from "../../runtime/docker/network.mjs";
-import { waitForHttpEndpoint } from "../../substrate/runtime/http-probe.mjs";
+import "../../runtime/docker/index.mjs";
+import { DispatchWriteFailed, RouteCollision, RouteReadinessProbeFailed, RouterBootFailed, RouterDisabledRouteUnsupported, RouterValidationError } from "./errors.mjs";
 import { TraefikContainerOpsService, bootstrap } from "./traefik-container.mjs";
 import { EntrypointRegistry } from "./entrypoints.mjs";
 import { CORS_MIDDLEWARE_FILENAME, renderCorsMiddlewareYaml } from "./cors.mjs";
+import { dispatchFileId } from "./hostname.mjs";
 import { detectCollisions, dispatchFileIdFromFilename, dispatchFilename, parseDispatchRouteFile, renderRouteYaml, resolveRoute } from "./file-provider.mjs";
+import { waitForHttpEndpoint } from "../../substrate/runtime/http-probe.mjs";
 import { Context, Effect, FileSystem, Layer, Ref, SubscriptionRef } from "effect";
 import * as path from "node:path";
 import { request } from "node:http";
 //#region src/orchestrators/router/service.ts
 const ROUTER_LOCK_TIMEOUT_MILLIS = 12e4;
-var RouterConfig = class extends Context.Service()("@devstack-rewrite/orchestrators/router/RouterConfig") {};
+var RouterConfig = class extends Context.Service()("@devstack/orchestrators/router/RouterConfig") {};
 /** Default-config layer for tests. Production wires this from
 *  `runtime-composition.ts` at the engine boundary. */
 const layerRouterConfigLiteral = (cfg) => Layer.succeed(RouterConfig)(cfg);
-var UpstreamResolverService = class extends Context.Service()("@devstack-rewrite/orchestrators/router/UpstreamResolver") {};
+var UpstreamResolverService = class extends Context.Service()("@devstack/orchestrators/router/UpstreamResolver") {};
 const layerDockerUpstreamResolver = (profile) => Layer.effect(UpstreamResolverService, Effect.gen(function* () {
 	const dockerHost = yield* DockerHost;
 	const dockerSpawner = yield* DockerSpawner;
@@ -41,7 +44,7 @@ const layerDockerUpstreamResolver = (profile) => Layer.effect(UpstreamResolverSe
 		})
 	});
 }));
-var RouterService = class extends Context.Service()("@devstack-rewrite/orchestrators/router/Router") {};
+var RouterService = class extends Context.Service()("@devstack/orchestrators/router/Router") {};
 const warnDispatchDecodeDiagnostic = (diagnostic) => Effect.gen(function* () {
 	yield* Effect.annotateCurrentSpan({
 		"router.dispatch.path": diagnostic.path,
@@ -106,9 +109,10 @@ const classifyDispatchLease = (route) => {
 	return checkHolderLiveness(route.lease.owner).pipe(Effect.map((status) => status === "dead" ? "stale" : "live"), Effect.catch(() => Effect.succeed("live")));
 };
 const sweepStaleDispatchRoutes = (fs, profile, routes, dispatchFileId) => Effect.gen(function* () {
+	const probe = yield* LivenessProbeScope;
 	const active = [];
 	for (const route of routes) {
-		if ((yield* classifyDispatchLease(route)) === "stale") {
+		if ((route.lease === null ? "unknown-owner" : yield* probe.probeHolderLiveness(route.lease.owner).pipe(Effect.map((s) => s === "dead" ? "stale" : "live"), Effect.catch(() => Effect.succeed("live")))) === "stale") {
 			const filePath = path.join(profile.dispatchDir, dispatchFilename(route.dispatchFileId));
 			yield* fs.remove(filePath).pipe(Effect.mapError((cause) => new DispatchWriteFailed({
 				dispatchFileId,
@@ -121,7 +125,7 @@ const sweepStaleDispatchRoutes = (fs, profile, routes, dispatchFileId) => Effect
 		active.push(route);
 	}
 	return active;
-});
+}).pipe(Effect.provide(layerLivenessProbeScope));
 const makeRouteLease = (profile, identity) => ({
 	version: 1,
 	routerProfileId: profile.id,
@@ -253,9 +257,9 @@ const endpointFromResolvedRoute = (decl, resolved) => {
 	};
 };
 const removeDispatchFile = (fs, profile, resolved) => fs.remove(path.join(profile.dispatchDir, dispatchFilename(resolved.dispatchFileId))).pipe(Effect.ignore);
-const waitForPublicRouteReadiness = (cfg, endpoint, resolved) => {
+const waitForPublicRouteReadiness = (cfg, decl, endpoint, resolved) => {
 	const options = cfg.routeReadinessProbe;
-	if (options?.enabled !== true || cfg.disabled || resolved.wireProtocol === "tcp") return Effect.void;
+	if (options?.enabled !== true || cfg.disabled || resolved.wireProtocol === "tcp" || decl.readiness === "deferred") return Effect.void;
 	const timeoutMs = options.timeoutMs ?? 6e4;
 	const intervalMs = options.intervalMs ?? DEFAULT_ROUTE_READINESS_INTERVAL_MS;
 	const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_ROUTE_READINESS_REQUEST_TIMEOUT_MS;
@@ -299,12 +303,14 @@ const layerRouterService = Layer.effect(RouterService, Effect.gen(function* () {
 		}
 		const cached = yield* Ref.get(bootRef);
 		if (cached !== null) return cached;
-		const protectedRouteLeaseIds = yield* Effect.scoped(Effect.gen(function* () {
+		return yield* Effect.scoped(Effect.gen(function* () {
 			yield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS).pipe(Effect.mapError((cause) => new RouterBootFailed({
 				stage: "ensure-container",
 				detail: `failed to acquire router dispatch lock ${profile.dispatchLockFile}`,
 				cause
 			})));
+			const bootedByPeer = yield* Ref.get(bootRef);
+			if (bootedByPeer !== null) return bootedByPeer;
 			yield* fs.makeDirectory(profile.dispatchDir, { recursive: true }).pipe(Effect.mapError((cause) => new RouterBootFailed({
 				stage: "write-shared-config",
 				detail: `makeDirectory(${profile.dispatchDir}) failed`,
@@ -320,27 +326,25 @@ const layerRouterService = Layer.effect(RouterService, Effect.gen(function* () {
 				detail: cause.detail,
 				cause
 			})));
-			return [...(yield* sweepStaleDispatchRoutes(fs, profile, existingDispatchScan.routes, "router-boot").pipe(Effect.mapError((cause) => new RouterBootFailed({
+			const protectedRouteLeaseIds = [...(yield* sweepStaleDispatchRoutes(fs, profile, existingDispatchScan.routes, "router-boot").pipe(Effect.mapError((cause) => new RouterBootFailed({
 				stage: "write-shared-config",
 				detail: cause.detail,
 				cause
 			})))).map((route) => route.dispatchFileId), ...existingDispatchScan.unknownRouteFileIds];
-		}));
-		const report = yield* Effect.scoped(Effect.gen(function* () {
 			yield* acquireStackLock(profile.bootstrapLockFile, ROUTER_LOCK_TIMEOUT_MILLIS).pipe(Effect.mapError((cause) => new RouterBootFailed({
 				stage: "ensure-container",
 				detail: `failed to acquire router bootstrap lock ${profile.bootstrapLockFile}`,
 				cause
 			})));
-			return yield* bootstrap({
+			const booted = yield* bootstrap({
 				image: cfg.image,
 				entrypoints: registry.all(),
 				profile,
 				protectedRouteLeaseIds
 			}).pipe(Effect.provideService(TraefikContainerOpsService, traefikOps));
+			yield* Ref.set(bootRef, booted);
+			return booted;
 		}));
-		yield* Ref.set(bootRef, report);
-		return report;
 	}).pipe(Effect.withSpan("orchestrator.router.boot"));
 	const contributeRoute = (decl) => Effect.gen(function* () {
 		const profile = cfg.profile;
@@ -383,30 +387,29 @@ const layerRouterService = Layer.effect(RouterService, Effect.gen(function* () {
 			return "owned";
 		});
 		let publishOwnership;
-		if (cfg.disabled) publishOwnership = yield* publishRouteFile;
-		else publishOwnership = yield* Effect.scoped(Effect.gen(function* () {
+		if (cfg.disabled) {
+			publishOwnership = yield* publishRouteFile;
+			yield* waitForPublicRouteReadiness(cfg, decl, endpoint, resolved);
+			if (publishOwnership !== "reused-live") yield* SubscriptionRef.update(applied, (arr) => [...arr, resolved]);
+		} else publishOwnership = yield* Effect.scoped(Effect.gen(function* () {
 			yield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS).pipe(Effect.mapError((cause) => new DispatchWriteFailed({
 				dispatchFileId: resolved.dispatchFileId,
 				path: profile.dispatchLockFile,
 				detail: `failed to acquire dispatch lock ${profile.dispatchLockFile}`,
 				cause
 			})));
-			return yield* publishRouteFile;
+			const ownership = yield* publishRouteFile;
+			yield* waitForPublicRouteReadiness(cfg, decl, endpoint, resolved).pipe(Effect.onError(() => ownership !== "owned" ? Effect.void : removeDispatchFile(fs, profile, resolved)));
+			if (ownership !== "reused-live") yield* SubscriptionRef.update(applied, (arr) => [...arr, resolved]);
+			return ownership;
+		}));
+		if (publishOwnership !== "reused-live") yield* Effect.addFinalizer(() => Effect.gen(function* () {
+			if (publishOwnership === "owned") yield* Effect.scoped(Effect.gen(function* () {
+				yield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS);
+				yield* removeDispatchFile(fs, profile, resolved);
+			})).pipe(logWarningAndIgnore("router scope-close cleanup failed", { dispatchFileId: resolved.dispatchFileId }));
+			yield* SubscriptionRef.update(applied, (arr) => arr.filter((r) => r.dispatchFileId !== resolved.dispatchFileId));
 		}));
-		yield* waitForPublicRouteReadiness(cfg, endpoint, resolved).pipe(Effect.onError(() => cfg.disabled || publishOwnership !== "owned" ? Effect.void : Effect.scoped(Effect.gen(function* () {
-			yield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS).pipe(Effect.ignore);
-			yield* removeDispatchFile(fs, profile, resolved);
-		}))));
-		if (publishOwnership !== "reused-live") {
-			yield* SubscriptionRef.update(applied, (arr) => [...arr, resolved]);
-			yield* Effect.addFinalizer(() => Effect.gen(function* () {
-				if (publishOwnership === "owned") yield* Effect.scoped(Effect.gen(function* () {
-					yield* acquireStackLock(profile.dispatchLockFile, ROUTER_LOCK_TIMEOUT_MILLIS);
-					yield* removeDispatchFile(fs, profile, resolved);
-				})).pipe(Effect.ignore);
-				yield* SubscriptionRef.update(applied, (arr) => arr.filter((r) => r.dispatchFileId !== resolved.dispatchFileId));
-			}));
-		}
 		return endpoint;
 	}).pipe(Effect.withSpan("orchestrator.router.contributeRoute"));
 	return RouterService.of({
@@ -416,6 +419,6 @@ const layerRouterService = Layer.effect(RouterService, Effect.gen(function* () {
 	});
 }));
 //#endregion
-export { RouterService, layerDockerUpstreamResolver, layerRouterConfigLiteral, layerRouterService };
+export { RouterConfig, RouterService, UpstreamResolverService, layerDockerUpstreamResolver, layerRouterConfigLiteral, layerRouterService };
 
 //# sourceMappingURL=service.mjs.map