@smthrs/platform-node 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/AtomicFileSystem.js

@@ -0,0 +1,234 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var AtomicFileSystem_exports = {};
+__export(AtomicFileSystem_exports, {
+  AtomicHelperError: () => import_AtomicHelperError2.AtomicHelperError,
+  AtomicHelperErrorCode: () => import_AtomicHelperError2.AtomicHelperErrorCode,
+  defaultConcurrency: () => defaultConcurrency,
+  defaultExecutable: () => defaultExecutable,
+  defaultLimits: () => defaultLimits,
+  defaultTimeoutMs: () => defaultTimeoutMs,
+  helperSpawns: () => helperSpawns,
+  layer: () => layer,
+  layerWith: () => layerWith,
+  resolveHelper: () => resolveHelper
+});
+module.exports = __toCommonJS(AtomicFileSystem_exports);
+var NodeFileSystem = __toESM(require("../vendor/cjs/node/NodeFileSystem.js"), 1);
+var KernelFileSystem = __toESM(require("@smthrs/kernel/FileSystem"), 1);
+var import_effect = require("effect");
+var import_promises = require("node:fs/promises");
+var import_node_os = require("node:os");
+var import_AtomicFileSystemExecutable = require("./internal/AtomicFileSystemExecutable.js");
+var Protocol = __toESM(require("./internal/AtomicFileSystemProtocol.js"), 1);
+var Transport = __toESM(require("./internal/AtomicFileSystemTransport.js"), 1);
+var import_AtomicHelperError = require("./internal/AtomicHelperError.js");
+var import_AtomicHelperError2 = require("./internal/AtomicHelperError.js");
+const defaultExecutable = "/usr/local/bin/smithers-jj-export";
+const defaultLimits = {
+  content: 16 * 1024 * 1024,
+  request: 24 * 1024 * 1024,
+  response: 24 * 1024 * 1024,
+  stderr: 64 * 1024,
+  batchSize: KernelFileSystem.maxBatchSize,
+  batchEntry: 24 * 1024 * 1024
+};
+const defaultConcurrency = (0, import_node_os.availableParallelism)();
+const defaultTimeoutMs = 3e5;
+const helperSpawns = () => Transport.started();
+const hardLimitBytes = 256 * 1024 * 1024;
+const maxTimeoutMs = 2147483647;
+const resolveLimits = (overrides) => {
+  const limits = {
+    content: overrides?.content ?? defaultLimits.content,
+    request: overrides?.request ?? defaultLimits.request,
+    response: overrides?.response ?? defaultLimits.response,
+    stderr: overrides?.stderr ?? defaultLimits.stderr,
+    batchSize: overrides?.batchSize ?? defaultLimits.batchSize,
+    batchEntry: overrides?.batchEntry ?? defaultLimits.batchEntry
+  };
+  for (const [name, value] of Object.entries(limits)) {
+    if (!Number.isSafeInteger(value) || value <= 0 || value > hardLimitBytes) {
+      throw new import_AtomicHelperError.AtomicHelperError({
+        code: "limit_invalid",
+        message: `atomic helper ${name} limit must be a positive integer no greater than ${hardLimitBytes}`
+      });
+    }
+  }
+  if (limits.batchSize > KernelFileSystem.maxBatchSize) {
+    throw new import_AtomicHelperError.AtomicHelperError({
+      code: "limit_invalid",
+      message: `atomic helper batchSize limit must be no greater than ${KernelFileSystem.maxBatchSize}`
+    });
+  }
+  return limits;
+};
+const resolveSettings = (options) => {
+  try {
+    const limits = resolveLimits(options.limits);
+    const concurrency = options.concurrency ?? defaultConcurrency;
+    if (!Number.isSafeInteger(concurrency) || concurrency <= 0) {
+      throw new import_AtomicHelperError.AtomicHelperError({
+        code: "concurrency_invalid",
+        message: "atomic helper concurrency must be a positive integer"
+      });
+    }
+    const timeoutMs = options.timeoutMs ?? defaultTimeoutMs;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > maxTimeoutMs) {
+      throw new import_AtomicHelperError.AtomicHelperError({
+        code: "timeout_invalid",
+        message: "atomic helper timeoutMs must be a positive integer no greater than 2147483647"
+      });
+    }
+    return { limits, timeoutMs, semaphore: import_effect.Semaphore.makeUnsafe(concurrency) };
+  } catch (invalid) {
+    return { invalid };
+  }
+};
+const executeFramed = (options, resolved) => (request) => import_effect.Effect.suspend(() => {
+  if ("invalid" in resolved) {
+    const cause = resolved.invalid;
+    return import_effect.Effect.fail(import_effect.PlatformError.badArgument({
+      module: Protocol.moduleName,
+      method: request.operation,
+      description: cause instanceof Error ? cause.message : "atomic helper limits are invalid",
+      cause
+    }));
+  }
+  const limits = resolved.limits;
+  if (request.operation === "batch" && (!Array.isArray(request.requests) || request.requests.length === 0 || request.requests.length > limits.batchSize)) {
+    return import_effect.Effect.fail(import_effect.PlatformError.badArgument({
+      module: Protocol.moduleName,
+      method: "batch",
+      description: `atomic batch must contain 1 to ${limits.batchSize} operations`
+    }));
+  }
+  return resolved.semaphore.withPermits(1)(import_effect.Effect.suspend(() => {
+    let body;
+    try {
+      const serialized = JSON.stringify(
+        request.operation === "batch" ? { ...request, batchSize: limits.batchSize, batchEntry: limits.batchEntry } : request
+      );
+      if (serialized === void 0) {
+        throw new import_AtomicHelperError.AtomicHelperError({
+          code: "request_not_serializable",
+          message: "atomic request is not serializable"
+        });
+      }
+      body = Buffer.from(serialized, "utf8");
+    } catch (cause) {
+      return import_effect.Effect.fail(import_effect.PlatformError.badArgument({
+        module: Protocol.moduleName,
+        method: request.operation,
+        description: "atomic request is not serializable",
+        cause
+      }));
+    }
+    if (body.byteLength > limits.request) {
+      return import_effect.Effect.fail(import_effect.PlatformError.badArgument({
+        module: Protocol.moduleName,
+        method: request.operation,
+        description: `atomic request of ${body.byteLength} bytes exceeds the ${limits.request} byte limit`
+      }));
+    }
+    let executable;
+    try {
+      executable = resolveExecutable(options, request.boundaryRoot);
+    } catch (cause) {
+      return import_effect.Effect.fail(Protocol.failure(request, cause));
+    }
+    return Transport.spawnHelper(request, executable, Protocol.encode(body, limits), resolved);
+  }));
+});
+const resolveExecutable = (options, boundaryRoot) => {
+  const configured = process.env.SMITHERS_WORKSPACE_JJ_EXPORT_BINARY;
+  return options.executable !== void 0 ? Transport.usableExecutable(options.executable, boundaryRoot) : configured === void 0 ? (0, import_AtomicFileSystemExecutable.resolveDefaultExecutable)(import_AtomicFileSystemExecutable.packageRoot, boundaryRoot, defaultExecutable) : (0, import_AtomicFileSystemExecutable.resolveConfiguredExecutable)(configured, boundaryRoot);
+};
+const resolveHelper = () => resolveExecutable({}, void 0);
+const execute = (options, resolved) => {
+  const framed = executeFramed(options, resolved);
+  return (request) => framed(request);
+};
+const nativeRealPath = (path) => import_effect.Effect.tryPromise({
+  try: () => (0, import_promises.realpath)(path),
+  catch: (cause) => Protocol.failure({ operation: "realPath", path }, cause, {
+    ok: false,
+    code: cause.code ?? null,
+    message: cause.message,
+    syscall: "realpath"
+  })
+});
+const layerWith = (options) => {
+  const settings = resolveSettings(options);
+  return import_effect.Layer.effect(
+    import_effect.FileSystem.FileSystem,
+    import_effect.Effect.map(
+      // The packaged helper is pinned while the host is built, before any flow
+      // can rewrite a workspace-local install of this package.
+      import_effect.Effect.andThen(
+        import_effect.Effect.sync(() => {
+          if (options.executable === void 0 && process.env.SMITHERS_WORKSPACE_JJ_EXPORT_BINARY === void 0) {
+            (0, import_AtomicFileSystemExecutable.stagePackaged)(import_AtomicFileSystemExecutable.packageRoot);
+          }
+        }),
+        import_effect.FileSystem.FileSystem
+      ),
+      (fileSystem) => KernelFileSystem.withAtomicFileSystem({
+        ...fileSystem,
+        // Expand DOS names before pinning roots or opening native watchers.
+        realPath: nativeRealPath,
+        watch: (path, options2) => process.platform !== "win32" ? fileSystem.watch(path, options2) : import_effect.Stream.unwrap(
+          nativeRealPath(path).pipe(import_effect.Effect.map((canonical) => fileSystem.watch(canonical, options2)))
+        )
+      }, {
+        noFollowAuthorization: true,
+        execute: execute(options, settings),
+        identifyRoot: (path) => import_effect.Effect.tryPromise({
+          try: async () => {
+            const info = await (0, import_promises.stat)(path, { bigint: true });
+            return `${info.dev}:${info.ino}`;
+          },
+          catch: (cause) => Protocol.failure({ operation: "stat", path }, cause, {
+            ok: false,
+            code: cause.code ?? null,
+            message: cause.message,
+            syscall: "stat"
+          })
+        }),
+        batchLimits: {
+          size: "invalid" in settings ? defaultLimits.batchSize : settings.limits.batchSize,
+          response: "invalid" in settings ? defaultLimits.response : settings.limits.response
+        },
+        contentLimit: "invalid" in settings ? defaultLimits.content : settings.limits.content
+      })
+    )
+  ).pipe(import_effect.Layer.provide(NodeFileSystem.layer));
+};
+const layer = layerWith({});
+//# sourceMappingURL=AtomicFileSystem.js.map

package/dist/cjs/AtomicFileSystem.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/AtomicFileSystem.ts"],
+  "sourcesContent": ["/**\n * Descriptor-relative filesystem operations through the packaged Rust helper.\n * The helper pins the workspace root and walks each component with O_NOFOLLOW.\n * Requests and responses are length-framed, size-limited, and cancellable.\n * @since 0.1.0\n */\n\nimport * as NodeFileSystem from \"@effect/platform-node/NodeFileSystem\"\nimport * as KernelFileSystem from \"@smthrs/kernel/FileSystem\"\nimport { Effect, FileSystem, Layer, PlatformError, Semaphore, Stream } from \"effect\"\nimport { realpath, stat } from \"node:fs/promises\"\nimport { availableParallelism } from \"node:os\"\nimport {\n  packageRoot,\n  resolveConfiguredExecutable,\n  resolveDefaultExecutable,\n  stagePackaged\n} from \"./internal/AtomicFileSystemExecutable.ts\"\nimport * as Protocol from \"./internal/AtomicFileSystemProtocol.ts\"\nimport * as Transport from \"./internal/AtomicFileSystemTransport.ts\"\nimport { AtomicHelperError } from \"./internal/AtomicHelperError.ts\"\n\nexport { AtomicHelperError, AtomicHelperErrorCode } from \"./internal/AtomicHelperError.ts\"\n\n/**\n * The legacy system installation path, used after package and checkout paths.\n * Helper selection never consults `PATH` or the process working directory.\n *\n * @since 0.1.0\n * @category constants\n */\nexport const defaultExecutable = \"/usr/local/bin/smithers-jj-export\"\n\n/**\n * Byte ceilings for the helper protocol. Every one of them is a contract, not\n * a tuning knob: without them a large file, a large directory tree, or a\n * malfunctioning helper makes the host allocate until it dies.\n *\n * - `content` bounds the bytes a single `readFile`/`writeFile` may carry.\n * - `request` bounds the framed request; an over-limit request is refused\n *   before an helper is even started.\n * - `response` bounds the framed response, and is what a directory listing is\n *   charged against as it is built. It bounds the REJECTION envelope too, so a\n *   ceiling small enough to cut one off degrades that operation's typed reason\n *   to the fail-closed one.\n * - `stderr` bounds the diagnostic text retained from a failing helper.\n * - `batchEntry` bounds one batch member's encoded success or failure envelope.\n * - `batchSize` bounds the number of operations in one batch, at most 128.\n *\n * All except `batchSize` count bytes. The two ceilings that decide whether the host\n * survives a wide fan-out are {@link Options.concurrency}, which bounds how\n * many helpers run at once, and {@link Options.timeoutMs}, which bounds\n * how long any one of them may take.\n *\n * @since 0.1.0\n * @category models\n */\nexport interface Limits {\n  readonly content: number\n  readonly request: number\n  readonly response: number\n  readonly stderr: number\n  /** Maximum operations in one helper invocation, at most 128. */\n  readonly batchSize: number\n  /** Maximum encoded result bytes for one batch member. */\n  readonly batchEntry: number\n}\n\n/**\n * 16 MiB of file content, 24 MiB of framed request and response (base64\n * expands 16 MiB to 22369624 bytes, which has to fit), and 64 KiB of retained\n * helper diagnostics.\n *\n * @since 0.1.0\n * @category constants\n */\nexport const defaultLimits: Limits = {\n  content: 16 * 1024 * 1024,\n  request: 24 * 1024 * 1024,\n  response: 24 * 1024 * 1024,\n  stderr: 64 * 1024,\n  batchSize: KernelFileSystem.maxBatchSize,\n  batchEntry: 24 * 1024 * 1024\n}\n\n/**\n * The default number of helper processes that may run at once:\n * `os.availableParallelism()`.\n *\n * @since 1.0.0-rc.0\n * @category constants\n */\nexport const defaultConcurrency: number = availableParallelism()\n\n/**\n * How long one helper may run before it is killed and the operation fails\n * closed: five minutes.\n *\n * It is a backstop, not a latency budget. A read at the content ceiling over a\n * slow disk has to fit under it, so it is generous; what it bounds is a helper\n * that will never answer at all.\n *\n * @since 1.0.0-rc.0\n * @category constants\n */\nexport const defaultTimeoutMs = 300_000\n\n/**\n * The deliberate seam for a POSIX host that installs the native helper somewhere other\n * than {@link defaultExecutable}, or that needs different ceilings. It is\n * configuration, never discovery: the executable is validated as an absolute,\n * executable regular file outside the confined workspace on every request, and\n * every other field is read ONCE, when the layer is built.\n *\n * @since 0.1.0\n * @category models\n */\nexport interface Options {\n  readonly executable?: string | undefined\n  readonly limits?: Partial<Limits> | undefined\n  /**\n   * How many helper processes may run at once. Default\n   * {@link defaultConcurrency}.\n   *\n   * Each ordinary operation or batch starts one helper, so an unbounded\n   * `Effect.forEach` over a directory would start\n   * one helper per entry. This ceiling is what keeps a wide fan-out from\n   * pinning every core; it is a contract, not a tuning knob.\n   */\n  readonly concurrency?: number | undefined\n  /**\n   * How long one helper may run before it is killed and the operation fails\n   * closed, in milliseconds. Default {@link defaultTimeoutMs}.\n   */\n  readonly timeoutMs?: number | undefined\n}\n\n/**\n * Everything read out of {@link Options} once, when the layer is built.\n *\n * Snapshotted rather than re-read per request: `Options` is a plain object the\n * caller still holds, and a byte ceiling that changes under a running host is\n * not a ceiling. The executable is deliberately NOT here \u2014 it is re-validated\n * per request, because the file it names can be replaced while the host runs.\n */\ninterface Settings {\n  readonly limits: Limits\n  readonly timeoutMs: number\n  readonly semaphore: Semaphore.Semaphore\n}\n\n/**\n * Process-local helper starts, for cost counters and local measurements.\n * Includes helpers later cancelled or refused; rejected preflight starts none.\n *\n * @since 1.0.0\n * @category metrics\n */\nexport const helperSpawns = (): number => Transport.started()\n\n/** The helper enforces the same ceiling before it trusts a declared limit. */\nconst hardLimitBytes = 256 * 1024 * 1024\n/** `setTimeout` clamps a longer delay to 1 ms, so a bigger backstop is none. */\nconst maxTimeoutMs = 2_147_483_647\n\n/** Resolves every optional byte ceiling and refuses values that could disable a bound. */\nconst resolveLimits = (overrides: Partial<Limits> | undefined): Limits => {\n  const limits: Limits = {\n    content: overrides?.content ?? defaultLimits.content,\n    request: overrides?.request ?? defaultLimits.request,\n    response: overrides?.response ?? defaultLimits.response,\n    stderr: overrides?.stderr ?? defaultLimits.stderr,\n    batchSize: overrides?.batchSize ?? defaultLimits.batchSize,\n    batchEntry: overrides?.batchEntry ?? defaultLimits.batchEntry\n  }\n  for (const [name, value] of Object.entries(limits)) {\n    if (!Number.isSafeInteger(value) || value <= 0 || value > hardLimitBytes) {\n      throw new AtomicHelperError({\n        code: \"limit_invalid\",\n        message: `atomic helper ${name} limit must be a positive integer no greater than ${hardLimitBytes}`\n      })\n    }\n  }\n  if (limits.batchSize > KernelFileSystem.maxBatchSize) {\n    throw new AtomicHelperError({\n      code: \"limit_invalid\",\n      message: `atomic helper batchSize limit must be no greater than ${KernelFileSystem.maxBatchSize}`\n    })\n  }\n  return limits\n}\n\n/**\n * Reads the whole of {@link Options} once, at layer construction.\n *\n * A rejected value is carried rather than thrown, because the failure a caller\n * sees for it is a typed `BadArgument` on the first operation and not an\n * exception escaping a layer.\n */\nconst resolveSettings = (options: Options): Settings | { readonly invalid: unknown } => {\n  try {\n    const limits = resolveLimits(options.limits)\n    const concurrency = options.concurrency ?? defaultConcurrency\n    if (!Number.isSafeInteger(concurrency) || concurrency <= 0) {\n      throw new AtomicHelperError({\n        code: \"concurrency_invalid\",\n        message: \"atomic helper concurrency must be a positive integer\"\n      })\n    }\n    const timeoutMs = options.timeoutMs ?? defaultTimeoutMs\n    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > maxTimeoutMs) {\n      throw new AtomicHelperError({\n        code: \"timeout_invalid\",\n        message: \"atomic helper timeoutMs must be a positive integer no greater than 2147483647\"\n      })\n    }\n    return { limits, timeoutMs, semaphore: Semaphore.makeUnsafe(concurrency) }\n  } catch (invalid) {\n    return { invalid }\n  }\n}\n\n/**\n * The framed half, one concrete result type. Nothing on this side of the pipe\n * can prove what the helper answered: the protocol pairs an operation with its\n * result, and {@link execute} restates that pairing for the kernel's typed\n * request. Keeping the decode `unknown` here confines that promise to one\n * assertion instead of one per caller.\n */\nconst executeFramed = (options: Options, resolved: Settings | { readonly invalid: unknown }) =>\n(\n  request: KernelFileSystem.AtomicRequest\n): Effect.Effect<unknown, PlatformError.PlatformError> =>\n  Effect.suspend(() => {\n    if (\"invalid\" in resolved) {\n      const cause = resolved.invalid\n      return Effect.fail(PlatformError.badArgument({\n        module: Protocol.moduleName,\n        method: request.operation,\n        description: cause instanceof Error ? cause.message : \"atomic helper limits are invalid\",\n        cause\n      }))\n    }\n    const limits = resolved.limits\n    if (\n      request.operation === \"batch\" &&\n      (!Array.isArray(request.requests) || request.requests.length === 0 || request.requests.length > limits.batchSize)\n    ) {\n      return Effect.fail(PlatformError.badArgument({\n        module: Protocol.moduleName,\n        method: \"batch\",\n        description: `atomic batch must contain 1 to ${limits.batchSize} operations`\n      }))\n    }\n    // Admission bounds request serialization and framing as well as children.\n    // Queued callers retain their input, without another full payload copy.\n    return resolved.semaphore.withPermits(1)(Effect.suspend(() => {\n      let body: Buffer\n      try {\n        const serialized = JSON.stringify(\n          request.operation === \"batch\"\n            ? { ...request, batchSize: limits.batchSize, batchEntry: limits.batchEntry }\n            : request\n        )\n        if (serialized === undefined) {\n          throw new AtomicHelperError({\n            code: \"request_not_serializable\",\n            message: \"atomic request is not serializable\"\n          })\n        }\n        body = Buffer.from(serialized, \"utf8\")\n      } catch (cause) {\n        return Effect.fail(PlatformError.badArgument({\n          module: Protocol.moduleName,\n          method: request.operation,\n          description: \"atomic request is not serializable\",\n          cause\n        }))\n      }\n      if (body.byteLength > limits.request) {\n        // Refused before an helper exists: an over-limit request is caller\n        // input, and nothing about it improves by being sent.\n        return Effect.fail(PlatformError.badArgument({\n          module: Protocol.moduleName,\n          method: request.operation,\n          description: `atomic request of ${body.byteLength} bytes exceeds the ${limits.request} byte limit`\n        }))\n      }\n      let executable: string\n      try {\n        executable = resolveExecutable(options, request.boundaryRoot)\n      } catch (cause) {\n        return Effect.fail(Protocol.failure(request, cause))\n      }\n      return Transport.spawnHelper<unknown>(request, executable, Protocol.encode(body, limits), resolved)\n    }))\n  })\n\nconst resolveExecutable = (options: Pick<Options, \"executable\">, boundaryRoot: string | undefined): string => {\n  const configured = process.env.SMITHERS_WORKSPACE_JJ_EXPORT_BINARY\n  return options.executable !== undefined\n    ? Transport.usableExecutable(options.executable, boundaryRoot)\n    : configured === undefined\n    ? resolveDefaultExecutable(packageRoot, boundaryRoot, defaultExecutable)\n    : resolveConfiguredExecutable(configured, boundaryRoot)\n}\n\n/**\n * The helper this process would start for an atomic operation, resolved exactly\n * as an operation resolves it: `SMITHERS_WORKSPACE_JJ_EXPORT_BINARY`, then the\n * packaged and checkout locations. Nothing is spawned. Throws an {@link AtomicHelperError} whose\n * message names what was searched and how to install the helper when none is\n * usable, so a diagnostic can report it before any operation needs it.\n *\n * @since 1.0.0\n * @category constructors\n */\nexport const resolveHelper = (): string => resolveExecutable({}, undefined)\n\nconst execute = (\n  options: Options,\n  resolved: Settings | { readonly invalid: unknown }\n): KernelFileSystem.AtomicFileSystem[\"execute\"] => {\n  const framed = executeFramed(options, resolved)\n  return <R extends KernelFileSystem.AtomicRequest>(request: R) =>\n    framed(request) as Effect.Effect<KernelFileSystem.AtomicResult<R>, PlatformError.PlatformError>\n}\n\nconst nativeRealPath = (path: string) =>\n  Effect.tryPromise({\n    try: () => realpath(path),\n    catch: (cause) =>\n      Protocol.failure({ operation: \"realPath\", path }, cause, {\n        ok: false,\n        code: (cause as NodeJS.ErrnoException).code ?? null,\n        message: (cause as NodeJS.ErrnoException).message,\n        syscall: \"realpath\"\n      })\n  })\n\n/**\n * A Node filesystem layer carrying the kernel's atomic host extension, built\n * against an explicitly configured helper, byte limits, process ceiling,\n * and helper timeout.\n *\n * Every field of {@link Options} except `executable` is read once, here. The\n * concurrency ceiling is one semaphore for the whole layer rather than one per\n * request, which is the only arrangement that bounds anything.\n *\n * @since 0.1.0\n * @category layers\n */\nexport const layerWith = (options: Options): Layer.Layer<FileSystem.FileSystem> => {\n  // Outside the layer body on purpose. Inside it the settings would be read\n  // again on every BUILD, so two compositions of the same layer value could\n  // enforce two different ceilings out of one mutated object, and each would\n  // get a process ceiling of its own instead of sharing one.\n  const settings = resolveSettings(options)\n  return Layer.effect(\n    FileSystem.FileSystem,\n    Effect.map(\n      // The packaged helper is pinned while the host is built, before any flow\n      // can rewrite a workspace-local install of this package.\n      Effect.andThen(\n        Effect.sync(() => {\n          if (options.executable === undefined && process.env.SMITHERS_WORKSPACE_JJ_EXPORT_BINARY === undefined) {\n            stagePackaged(packageRoot)\n          }\n        }),\n        FileSystem.FileSystem\n      ),\n      (fileSystem) =>\n        KernelFileSystem.withAtomicFileSystem({\n          ...fileSystem,\n          // Expand DOS names before pinning roots or opening native watchers.\n          realPath: nativeRealPath,\n          watch: (path, options) =>\n            process.platform !== \"win32\"\n              ? fileSystem.watch(path, options)\n              : Stream.unwrap(\n                nativeRealPath(path).pipe(Effect.map((canonical) => fileSystem.watch(canonical, options)))\n              )\n        }, {\n          noFollowAuthorization: true,\n          execute: execute(options, settings),\n          identifyRoot: (path) =>\n            Effect.tryPromise({\n              try: async () => {\n                const info = await stat(path, { bigint: true })\n                return `${info.dev}:${info.ino}`\n              },\n              catch: (cause) =>\n                Protocol.failure({ operation: \"stat\", path }, cause, {\n                  ok: false,\n                  code: (cause as NodeJS.ErrnoException).code ?? null,\n                  message: (cause as NodeJS.ErrnoException).message,\n                  syscall: \"stat\"\n                })\n            }),\n          batchLimits: {\n            size: \"invalid\" in settings ? defaultLimits.batchSize : settings.limits.batchSize,\n            response: \"invalid\" in settings ? defaultLimits.response : settings.limits.response\n          },\n          contentLimit: \"invalid\" in settings ? defaultLimits.content : settings.limits.content\n        })\n    )\n  ).pipe(Layer.provide(NodeFileSystem.layer))\n}\n\n/** A Node filesystem layer carrying the kernel's atomic host extension.\n *\n * @since 0.1.0\n * @category layers\n */\nexport const layer: Layer.Layer<FileSystem.FileSystem> = layerWith({})\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,qBAAgC;AAChC,uBAAkC;AAClC,oBAA4E;AAC5E,sBAA+B;AAC/B,qBAAqC;AACrC,wCAKO;AACP,eAA0B;AAC1B,gBAA2B;AAC3B,+BAAkC;AAElC,IAAAA,4BAAyD;AASlD,MAAM,oBAAoB;AA6C1B,MAAM,gBAAwB;AAAA,EACnC,SAAS,KAAK,OAAO;AAAA,EACrB,SAAS,KAAK,OAAO;AAAA,EACrB,UAAU,KAAK,OAAO;AAAA,EACtB,QAAQ,KAAK;AAAA,EACb,WAAW,iBAAiB;AAAA,EAC5B,YAAY,KAAK,OAAO;AAC1B;AASO,MAAM,yBAA6B,qCAAqB;AAaxD,MAAM,mBAAmB;AAqDzB,MAAM,eAAe,MAAc,UAAU,QAAQ;AAG5D,MAAM,iBAAiB,MAAM,OAAO;AAEpC,MAAM,eAAe;AAGrB,MAAM,gBAAgB,CAAC,cAAmD;AACxE,QAAM,SAAiB;AAAA,IACrB,SAAS,WAAW,WAAW,cAAc;AAAA,IAC7C,SAAS,WAAW,WAAW,cAAc;AAAA,IAC7C,UAAU,WAAW,YAAY,cAAc;AAAA,IAC/C,QAAQ,WAAW,UAAU,cAAc;AAAA,IAC3C,WAAW,WAAW,aAAa,cAAc;AAAA,IACjD,YAAY,WAAW,cAAc,cAAc;AAAA,EACrD;AACA,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQ,gBAAgB;AACxE,YAAM,IAAI,2CAAkB;AAAA,QAC1B,MAAM;AAAA,QACN,SAAS,iBAAiB,IAAI,qDAAqD,cAAc;AAAA,MACnG,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,OAAO,YAAY,iBAAiB,cAAc;AACpD,UAAM,IAAI,2CAAkB;AAAA,MAC1B,MAAM;AAAA,MACN,SAAS,yDAAyD,iBAAiB,YAAY;AAAA,IACjG,CAAC;AAAA,EACH;AACA,SAAO;AACT;AASA,MAAM,kBAAkB,CAAC,YAA+D;AACtF,MAAI;AACF,UAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,UAAM,cAAc,QAAQ,eAAe;AAC3C,QAAI,CAAC,OAAO,cAAc,WAAW,KAAK,eAAe,GAAG;AAC1D,YAAM,IAAI,2CAAkB;AAAA,QAC1B,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,YAAY,QAAQ,aAAa;AACvC,QAAI,CAAC,OAAO,cAAc,SAAS,KAAK,aAAa,KAAK,YAAY,cAAc;AAClF,YAAM,IAAI,2CAAkB;AAAA,QAC1B,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,WAAO,EAAE,QAAQ,WAAW,WAAW,wBAAU,WAAW,WAAW,EAAE;AAAA,EAC3E,SAAS,SAAS;AAChB,WAAO,EAAE,QAAQ;AAAA,EACnB;AACF;AASA,MAAM,gBAAgB,CAAC,SAAkB,aACzC,CACE,YAEA,qBAAO,QAAQ,MAAM;AACnB,MAAI,aAAa,UAAU;AACzB,UAAM,QAAQ,SAAS;AACvB,WAAO,qBAAO,KAAK,4BAAc,YAAY;AAAA,MAC3C,QAAQ,SAAS;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,aAAa,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACtD;AAAA,IACF,CAAC,CAAC;AAAA,EACJ;AACA,QAAM,SAAS,SAAS;AACxB,MACE,QAAQ,cAAc,YACrB,CAAC,MAAM,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,SAAS,OAAO,YACvG;AACA,WAAO,qBAAO,KAAK,4BAAc,YAAY;AAAA,MAC3C,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,aAAa,kCAAkC,OAAO,SAAS;AAAA,IACjE,CAAC,CAAC;AAAA,EACJ;AAGA,SAAO,SAAS,UAAU,YAAY,CAAC,EAAE,qBAAO,QAAQ,MAAM;AAC5D,QAAI;AACJ,QAAI;AACF,YAAM,aAAa,KAAK;AAAA,QACtB,QAAQ,cAAc,UAClB,EAAE,GAAG,SAAS,WAAW,OAAO,WAAW,YAAY,OAAO,WAAW,IACzE;AAAA,MACN;AACA,UAAI,eAAe,QAAW;AAC5B,cAAM,IAAI,2CAAkB;AAAA,UAC1B,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,aAAO,OAAO,KAAK,YAAY,MAAM;AAAA,IACvC,SAAS,OAAO;AACd,aAAO,qBAAO,KAAK,4BAAc,YAAY;AAAA,QAC3C,QAAQ,SAAS;AAAA,QACjB,QAAQ,QAAQ;AAAA,QAChB,aAAa;AAAA,QACb;AAAA,MACF,CAAC,CAAC;AAAA,IACJ;AACA,QAAI,KAAK,aAAa,OAAO,SAAS;AAGpC,aAAO,qBAAO,KAAK,4BAAc,YAAY;AAAA,QAC3C,QAAQ,SAAS;AAAA,QACjB,QAAQ,QAAQ;AAAA,QAChB,aAAa,qBAAqB,KAAK,UAAU,sBAAsB,OAAO,OAAO;AAAA,MACvF,CAAC,CAAC;AAAA,IACJ;AACA,QAAI;AACJ,QAAI;AACF,mBAAa,kBAAkB,SAAS,QAAQ,YAAY;AAAA,IAC9D,SAAS,OAAO;AACd,aAAO,qBAAO,KAAK,SAAS,QAAQ,SAAS,KAAK,CAAC;AAAA,IACrD;AACA,WAAO,UAAU,YAAqB,SAAS,YAAY,SAAS,OAAO,MAAM,MAAM,GAAG,QAAQ;AAAA,EACpG,CAAC,CAAC;AACJ,CAAC;AAEH,MAAM,oBAAoB,CAAC,SAAsC,iBAA6C;AAC5G,QAAM,aAAa,QAAQ,IAAI;AAC/B,SAAO,QAAQ,eAAe,SAC1B,UAAU,iBAAiB,QAAQ,YAAY,YAAY,IAC3D,eAAe,aACf,4DAAyB,+CAAa,cAAc,iBAAiB,QACrE,+DAA4B,YAAY,YAAY;AAC1D;AAYO,MAAM,gBAAgB,MAAc,kBAAkB,CAAC,GAAG,MAAS;AAE1E,MAAM,UAAU,CACd,SACA,aACiD;AACjD,QAAM,SAAS,cAAc,SAAS,QAAQ;AAC9C,SAAO,CAA2C,YAChD,OAAO,OAAO;AAClB;AAEA,MAAM,iBAAiB,CAAC,SACtB,qBAAO,WAAW;AAAA,EAChB,KAAK,UAAM,0BAAS,IAAI;AAAA,EACxB,OAAO,CAAC,UACN,SAAS,QAAQ,EAAE,WAAW,YAAY,KAAK,GAAG,OAAO;AAAA,IACvD,IAAI;AAAA,IACJ,MAAO,MAAgC,QAAQ;AAAA,IAC/C,SAAU,MAAgC;AAAA,IAC1C,SAAS;AAAA,EACX,CAAC;AACL,CAAC;AAcI,MAAM,YAAY,CAAC,YAAyD;AAKjF,QAAM,WAAW,gBAAgB,OAAO;AACxC,SAAO,oBAAM;AAAA,IACX,yBAAW;AAAA,IACX,qBAAO;AAAA;AAAA;AAAA,MAGL,qBAAO;AAAA,QACL,qBAAO,KAAK,MAAM;AAChB,cAAI,QAAQ,eAAe,UAAa,QAAQ,IAAI,wCAAwC,QAAW;AACrG,iEAAc,6CAAW;AAAA,UAC3B;AAAA,QACF,CAAC;AAAA,QACD,yBAAW;AAAA,MACb;AAAA,MACA,CAAC,eACC,iBAAiB,qBAAqB;AAAA,QACpC,GAAG;AAAA;AAAA,QAEH,UAAU;AAAA,QACV,OAAO,CAAC,MAAMC,aACZ,QAAQ,aAAa,UACjB,WAAW,MAAM,MAAMA,QAAO,IAC9B,qBAAO;AAAA,UACP,eAAe,IAAI,EAAE,KAAK,qBAAO,IAAI,CAAC,cAAc,WAAW,MAAM,WAAWA,QAAO,CAAC,CAAC;AAAA,QAC3F;AAAA,MACN,GAAG;AAAA,QACD,uBAAuB;AAAA,QACvB,SAAS,QAAQ,SAAS,QAAQ;AAAA,QAClC,cAAc,CAAC,SACb,qBAAO,WAAW;AAAA,UAChB,KAAK,YAAY;AACf,kBAAM,OAAO,UAAM,sBAAK,MAAM,EAAE,QAAQ,KAAK,CAAC;AAC9C,mBAAO,GAAG,KAAK,GAAG,IAAI,KAAK,GAAG;AAAA,UAChC;AAAA,UACA,OAAO,CAAC,UACN,SAAS,QAAQ,EAAE,WAAW,QAAQ,KAAK,GAAG,OAAO;AAAA,YACnD,IAAI;AAAA,YACJ,MAAO,MAAgC,QAAQ;AAAA,YAC/C,SAAU,MAAgC;AAAA,YAC1C,SAAS;AAAA,UACX,CAAC;AAAA,QACL,CAAC;AAAA,QACH,aAAa;AAAA,UACX,MAAM,aAAa,WAAW,cAAc,YAAY,SAAS,OAAO;AAAA,UACxE,UAAU,aAAa,WAAW,cAAc,WAAW,SAAS,OAAO;AAAA,QAC7E;AAAA,QACA,cAAc,aAAa,WAAW,cAAc,UAAU,SAAS,OAAO;AAAA,MAChF,CAAC;AAAA,IACL;AAAA,EACF,EAAE,KAAK,oBAAM,QAAQ,eAAe,KAAK,CAAC;AAC5C;AAOO,MAAM,QAA4C,UAAU,CAAC,CAAC;",
+  "names": ["import_AtomicHelperError", "options"]
+}

package/dist/cjs/EgressHttpClient.d.ts

@@ -0,0 +1,106 @@
+/**
+ * The outbound HTTP client a Node process should use, read off its environment.
+ *
+ * `@effect/platform-node` ships `NodeHttpClient.layerUndici`, and its
+ * dispatcher is a bare Undici `Agent`. A bare `Agent` dials every origin
+ * directly: it does not read `HTTP_PROXY`, `HTTPS_PROXY` or `NO_PROXY`, and
+ * nothing at the call site says so. That is invisible on a developer machine
+ * with open egress and fatal inside a sandbox whose egress is default-deny
+ * behind a named proxy — the request leaves for the origin, the firewall drops
+ * it, and the only symptom is a transport failure far from the composition
+ * that chose the client.
+ *
+ * This module is the one place that decision is made. {@link layer} is the
+ * client every Node host composition installs; it honours the proxy the
+ * environment names. Requests without a web destination use a shared pool;
+ * web requests receive a fresh pinned dispatcher.
+ *
+ * The rule for loopback is fixed here, not by the environment: `localhost`,
+ * `127.0.0.1` and `[::1]` are always reached directly, even when the
+ * environment names a proxy and no exclusion, and every other origin follows
+ * `NO_PROXY`. A proxy is how a process leaves its machine, and
+ * `--remote http://127.0.0.1:3000` is not leaving it. The exemption is those
+ * three names and nothing wider: Undici matches `NO_PROXY` entries by name,
+ * never by resolved address, so `127.0.0.2` or a hostname that resolves to
+ * loopback is an origin like any other and goes through the proxy.
+ *
+ * @since 1.0.0-rc.0
+ */
+import type * as Undici from "../vendor/cjs/node/Undici.js";
+import { GrantStore } from "@smthrs/kernel/GrantStore";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import * as Scope from "effect/Scope";
+import { HttpClient } from "effect/unstable/http/HttpClient";
+declare const EgressAddressError_base: Schema.Class<EgressAddressError, Schema.TaggedStruct<"@smthrs/platform-node/EgressAddressError", {
+    readonly code: Schema.Literal<"no_approved_address">;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A pinned connection asked for an address family none of the authorized
+ * addresses has. It is the `cause` of the `TransportError` the request fails
+ * with; `code` is always `no_approved_address`.
+ *
+ * @category errors
+ * @since 1.0.0
+ */
+export declare class EgressAddressError extends EgressAddressError_base {
+    readonly name = "EgressAddressError";
+}
+/**
+ * An Undici dispatcher that routes through the egress proxy the supplied
+ * environment names, or a direct one when it names none.
+ *
+ * The proxy variables are read in the order Undici itself reads them,
+ * lowercase first, and passed explicitly rather than left to
+ * `EnvHttpProxyAgent`'s own ambient lookup: a host serving a guest's
+ * environment is not the guest, and the pool has to follow the record it was
+ * handed. Loopback is always direct; see {@link exclusions}. Each dispatcher is
+ * acquired in the caller's scope and destroyed with it, so a composition that
+ * builds several still owns every pool it opened.
+ *
+ * @param environment the environment record whose proxy variables decide the route
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const dispatcher: (environment: Readonly<Record<string, string | undefined>>) => Effect.Effect<Undici.Dispatcher, never, Scope.Scope>;
+/**
+ * The Undici `HttpClient` to install, given the environment the process runs in.
+ *
+ * Use this wherever `NodeHttpClient.layerUndici` would otherwise be provided
+ * under a layer that takes `HttpClient` from context — a model transport, a
+ * judge, a fetch rule, a host bundle. The two differ only in whether the pool
+ * honours `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY`, which is the difference
+ * between a request that reaches the gateway from inside a default-deny
+ * sandbox and one the firewall drops.
+ *
+ * @param environment the environment record whose proxy variables decide the route
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layer: (environment: Readonly<Record<string, string | undefined>>) => Layer.Layer<HttpClient>;
+/**
+ * Owns one replaceable Undici pool in the caller's scope. Each replacement
+ * receives the same middleware and closes the previous pool.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export declare const rebuildableTransport: (acquire: Effect.Effect<Undici.Dispatcher, never, Scope.Scope>, decorate?: (client: HttpClient) => Effect.Effect<HttpClient>) => Effect.Effect<{
+    readonly client: HttpClient;
+    readonly rebuild: Effect.Effect<HttpClient>;
+}, never, Scope.Scope>;
+/**
+ * A model transport whose replacements retain the caller's grant store and
+ * environment proxy policy. Pass it to RequestExecutor.makeWith in the host scope.
+ *
+ * @category constructors
+ * @since 1.0.0
+ */
+export declare const guardedTransport: (environment: Readonly<Record<string, string | undefined>>) => Effect.Effect<{
+    readonly client: HttpClient;
+    readonly rebuild: Effect.Effect<HttpClient>;
+}, never, GrantStore | Scope.Scope>;
+export {};
+//# sourceMappingURL=EgressHttpClient.d.ts.map

package/dist/cjs/EgressHttpClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EgressHttpClient.d.ts","sourceRoot":"","sources":["../../src/EgressHttpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,KAAK,MAAM,MAAM,8BAA8B,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAGtD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;;;;;AAM5D;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,uBAGvC;IACC,SAAkB,IAAI,wBAAuB;CAC9C;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,UAAU,GACrB,aAAa,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAsBlD,CAAA;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,KAAK,GAChB,aAAa,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KACxD,KAAK,CAAC,KAAK,CAAC,UAAU,CAqHtB,CAAA;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAC7D,WAAU,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,CAAkB,KAC3E,MAAM,CAAC,MAAM,CACd;IACE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;CAC5C,EACD,KAAK,EACL,KAAK,CAAC,KAAK,CAqBT,CAAA;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,aAAa,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;qBAlCrE,UAAU;sBACT,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;mCAyC3C,CAAA"}

package/dist/cjs/EgressHttpClient.js

@@ -0,0 +1,202 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var EgressHttpClient_exports = {};
+__export(EgressHttpClient_exports, {
+  EgressAddressError: () => EgressAddressError,
+  dispatcher: () => dispatcher,
+  guardedTransport: () => guardedTransport,
+  layer: () => layer,
+  rebuildableTransport: () => rebuildableTransport
+});
+module.exports = __toCommonJS(EgressHttpClient_exports);
+var NodeHttpClient = __toESM(require("../vendor/cjs/node/NodeHttpClient.js"), 1);
+var import_GrantStore = require("@smthrs/kernel/GrantStore");
+var KernelHttpClient = __toESM(require("@smthrs/kernel/HttpClient"), 1);
+var import_HttpClient = require("@smthrs/kernel/HttpClient");
+var Effect = __toESM(require("effect/Effect"), 1);
+var Exit = __toESM(require("effect/Exit"), 1);
+var Layer = __toESM(require("effect/Layer"), 1);
+var Schema = __toESM(require("effect/Schema"), 1);
+var Scope = __toESM(require("effect/Scope"), 1);
+var Semaphore = __toESM(require("effect/Semaphore"), 1);
+var import_HttpClient2 = require("effect/unstable/http/HttpClient");
+var EffectHttpClient = __toESM(require("effect/unstable/http/HttpClient"), 1);
+var HttpClientError = __toESM(require("effect/unstable/http/HttpClientError"), 1);
+var HttpClientRequest = __toESM(require("effect/unstable/http/HttpClientRequest"), 1);
+var import_node_net = require("node:net");
+class EgressAddressError extends Schema.TaggedError()(
+  "@smthrs/platform-node/EgressAddressError",
+  { code: Schema.Literal("no_approved_address"), message: Schema.String }
+) {
+  name = "EgressAddressError";
+}
+const loopback = ["localhost", "127.0.0.1", "::1"];
+const exclusions = (declared) => declared === "*" ? declared : [declared, ...loopback].filter((entry) => entry !== "").join(",");
+const loadUndici = Effect.promise(
+  async () => (await import("undici/index.js")).default
+);
+const dispatcher = (environment) => Effect.suspend(() => {
+  const httpProxy = environment.http_proxy ?? environment.HTTP_PROXY ?? "";
+  const httpsProxy = environment.https_proxy ?? environment.HTTPS_PROXY ?? "";
+  const noProxy = exclusions(environment.no_proxy ?? environment.NO_PROXY ?? "");
+  return Effect.acquireRelease(
+    Effect.map(
+      loadUndici,
+      (undici) => new undici.EnvHttpProxyAgent({ httpProxy, httpsProxy, noProxy })
+    ),
+    (dispatcher2) => Effect.promise(() => dispatcher2.destroy())
+  );
+});
+const layer = (environment) => Layer.effect(
+  import_HttpClient2.HttpClient,
+  Effect.gen(function* () {
+    const shared = yield* dispatcher(environment);
+    const ordinary = yield* NodeHttpClient.makeUndici.pipe(Effect.provideService(NodeHttpClient.Dispatcher, shared));
+    return (0, import_HttpClient.withDestinationPinning)(EffectHttpClient.transform(ordinary, (execute, request) => Effect.gen(function* () {
+      const destination = yield* import_HttpClient.Destination;
+      if (destination === void 0) return yield* execute;
+      const url = new URL(request.url);
+      if (url.origin !== destination.origin || destination.addresses.length === 0 || destination.addresses.some((address) => (0, import_node_net.isIP)(address) === 0)) {
+        return yield* Effect.fail(
+          new HttpClientError.HttpClientError({
+            reason: new HttpClientError.TransportError({
+              request,
+              description: "Invalid pinned HTTP destination"
+            })
+          })
+        );
+      }
+      const proxies = [
+        environment.http_proxy ?? environment.HTTP_PROXY,
+        environment.https_proxy ?? environment.HTTPS_PROXY
+      ];
+      const validProxies = proxies.every((proxy) => {
+        if (!proxy) return true;
+        try {
+          return ["http:", "https:"].includes(new URL(proxy).protocol);
+        } catch {
+          return false;
+        }
+      });
+      if (!validProxies) {
+        return yield* Effect.fail(
+          new HttpClientError.HttpClientError({
+            reason: new HttpClientError.TransportError({
+              request,
+              description: "Pinned HTTP requests require HTTP or HTTPS proxies"
+            })
+          })
+        );
+      }
+      const undici = yield* loadUndici;
+      const addresses = destination.addresses.map((address) => ({ address, family: (0, import_node_net.isIP)(address) }));
+      return yield* Effect.uninterruptibleMask((restore) => {
+        const pinned = new undici.EnvHttpProxyAgent({
+          httpProxy: environment.http_proxy ?? environment.HTTP_PROXY ?? "",
+          httpsProxy: environment.https_proxy ?? environment.HTTPS_PROXY ?? "",
+          noProxy: exclusions(environment.no_proxy ?? environment.NO_PROXY ?? ""),
+          // Tunnelling HTTP too prevents the proxy resolving the target hostname.
+          proxyTunnel: true,
+          connect: {
+            lookup: (_hostname, options, callback) => {
+              const candidates = options.family ? addresses.filter((item) => item.family === options.family) : addresses;
+              const first = candidates[0];
+              if (first === void 0) {
+                return callback(
+                  new EgressAddressError({
+                    code: "no_approved_address",
+                    message: "No approved address for family"
+                  }),
+                  "",
+                  4
+                );
+              }
+              if (options.all) callback(null, candidates);
+              else callback(null, first.address, first.family);
+            }
+          },
+          clientFactory: (origin, options) => {
+            const proxy = new undici.Pool(origin, options);
+            const connect = proxy.connect.bind(proxy);
+            proxy.connect = (options2) => {
+              const address = addresses[0].address;
+              const host = (0, import_node_net.isIP)(address) === 6 ? `[${address}]` : address;
+              const authority = `${host}:${url.port || (url.protocol === "https:" ? "443" : "80")}`;
+              return connect({ ...options2, path: authority, headers: { ...options2.headers, host: authority } });
+            };
+            return proxy;
+          }
+        });
+        const pinnedRequest = request.pipe(
+          HttpClientRequest.setHeader("host", url.host),
+          HttpClientRequest.removeHeader("proxy-authorization"),
+          HttpClientRequest.removeHeader("connection"),
+          HttpClientRequest.removeHeader("transfer-encoding"),
+          HttpClientRequest.removeHeader("content-length")
+        );
+        return restore(NodeHttpClient.makeUndici.pipe(
+          Effect.provideService(NodeHttpClient.Dispatcher, pinned),
+          Effect.flatMap((client) => client.execute(pinnedRequest))
+        )).pipe(Effect.onExit(
+          (exit) => Exit.isFailure(exit) ? Effect.promise(() => pinned.destroy()) : Effect.sync(() => {
+            void pinned.close().catch(() => pinned.destroy());
+          })
+        ));
+      });
+    })));
+  })
+);
+const rebuildableTransport = (acquire, decorate = Effect.succeed) => Effect.gen(function* () {
+  const scope = yield* Scope.Scope;
+  const gate = yield* Semaphore.make(1);
+  let held = void 0;
+  const rebuild = gate.withPermit(Effect.uninterruptibleMask(
+    (restore) => Effect.gen(function* () {
+      const owned = yield* Scope.fork(scope);
+      const client = yield* restore(NodeHttpClient.makeUndici.pipe(
+        Effect.provideServiceEffect(NodeHttpClient.Dispatcher, acquire),
+        Effect.flatMap(decorate),
+        Effect.provideService(Scope.Scope, owned)
+      )).pipe(Effect.onExit((exit) => Exit.isSuccess(exit) ? Effect.void : Scope.close(owned, exit)));
+      const previous = held;
+      held = owned;
+      if (previous !== void 0) yield* Scope.close(previous, Exit.void);
+      return client;
+    })
+  ));
+  return { client: yield* rebuild, rebuild };
+});
+const guardedTransport = (environment) => Effect.gen(function* () {
+  const grants = yield* import_GrantStore.GrantStore;
+  return yield* rebuildableTransport(dispatcher(environment), (client) => import_HttpClient2.HttpClient.pipe(Effect.provide(KernelHttpClient.layer.pipe(
+    Layer.provide(Layer.succeed(import_HttpClient2.HttpClient)(client)),
+    Layer.provide(Layer.succeed(import_GrantStore.GrantStore)(grants))
+  ))));
+});
+//# sourceMappingURL=EgressHttpClient.js.map