@statewalker/webrun-http-proxy 0.1.0 → 0.2.0

package/README.md

@@ -1,80 +1,69 @@
 # @statewalker/webrun-http-proxy
 
-A reverse proxy as a fetch handler: one route table, two kinds of upstream — an
-in-process handler, or a remote origin.
+Re-issue an HTTP request to an outside origin, safely. **One function.**
 
-**Zero runtime dependencies.**
-
-**The reverse proxy and "expose a local app" are one mechanism.** Twelve
-scenarios establish it: only the last step differs — a local handler is
-*called*, a URL upstream is *re-issued*. Matching, rewriting, the listing, the
-marker header and streaming are shared.
-
-The scenarios moved here with the code rather than being rewritten, because a
-list that changes when it moves proves nothing about the move. **They run in
-Node here, and only Node.** The prototype also ran them in Chromium, which is
-what established that both upstream kinds behave identically on both platforms
-and that exactly one row cannot pass in a browser (below). That second column
-needs a bundler and a browser and does not exist in this package yet;
-`tests/scenarios.test.ts` says so in its own header.
+**Zero runtime dependencies. One entry point.**
 
 ```ts
-import { routeTable, urlUpstream } from "@statewalker/webrun-http-proxy";
+import { Hono } from "hono";
+import { urlUpstream } from "@statewalker/webrun-http-proxy";
 
-const handler = routeTable({
-  routes: () => [
-    { prefix: "/openai", describe: "OpenAI", upstream: urlUpstream({ base: "https://api.openai.com/v1" }) },
-    { prefix: "/local",  describe: "in-process", upstream: myHandler },
-  ],
+const openai = urlUpstream({
+  base: "https://api.openai.com/v1",
+  credential: () => ({ authorization: `Bearer ${apiKey()}` }),
 });
-```
-
-## `routes` may be a thunk, and that is load-bearing
-
-The proxy page edits routes and types credentials **while traffic flows**. The
-table is re-read per request for exactly that reason; a snapshot taken at
-construction would serve the old table until something restarted it.
-
-## Secrets are never persisted
-
-A route may carry a credential. The header's **name** is configuration and is
-saved; the header's **value** lives in memory and is merged per request.
-
-`StoredRoute` has no field a value fits in, and `save()` **throws** rather than
-dropping one quietly — a silent drop means a route that worked before a reload
-and 401s after it. `assertNoSecrets` is exported so an adapter written
-elsewhere enforces the same rule instead of inventing its own idea of what a
-secret looks like.
-
-This is not hypothetical: an earlier shape of this API stored a whole `Route`,
-and building the proxy page on it would have written bearer keys into
-`localStorage` — where they survive a reload, a shared machine, and anyone who
-opens devtools.
 
-`load()` returns `undefined` for **never written**, which is not the same as
-`[]`. A first visit seeds its defaults; a visit after the operator deleted
-every route must not bring them back.
-
-## Hygiene belongs to the URL upstream, not to the table
-
-Two measured rows force the asymmetry:
-
-- Re-issuing to a third party **consumes** the caller's `authorization`, the
-  way `Proxy-Authorization` is consumed by the proxy it names. Forwarding it
-  handed a bearer token to an upstream that echoed it straight back.
-- Calling a **local** handler must not strip it, because a handler on this side
-  of the proxy still needs to know who is calling.
-
-Same rule, `stripRequestHeaders` for anything else your system treats as
-identity.
-
-## Two shipping defects, fixed and pinned
+const app = new Hono();
+app.all("/openai/:rest{.*}", (c) => {
+  const { pathname, search } = new URL(c.req.url);
+  return openai(new Request(`http://upstream${pathname.slice("/openai".length)}${search}`, c.req.raw));
+});
+```
 
-- A **redirecting upstream** was reported as `502 upstream-unreachable`: an
-  opaque redirect has status `0`, and constructing a `Response` with it throws
-  *inside* the `try`.
-- The outbound request carried **no `signal`**, so an aborted caller left the
-  upstream call running.
+## Bring your own router
+
+This package used to ship a route table as well — prefix matching, path
+rewriting, a listing endpoint, a marker header on unmatched paths, a route
+store. That turned out to be the uninteresting half: it is what a router does,
+and every caller already has one.
+
+The evidence is in `tests/scenarios.ts`. Twelve scenarios established this
+proxy's behaviour in the prototype; they now run against **a plain Hono
+router** and pass unchanged. Nothing was lost with the table, and the segment
+matching got better — Hono matches on segment boundaries, so `/open` no longer
+swallows `/openai`, which the hand-written table had to special-case.
+
+Persisting route configuration went with the router, for the same reason: the
+shape of that configuration belongs to whoever defines the routes. If you store
+routes, store the credential's header **name** and never its **value** — the
+value belongs in memory, merged per request through `credential`. (An earlier
+shape of this API stored a whole route, and building a proxy page on it would
+have written bearer keys into `localStorage`.)
+
+## What `urlUpstream` actually does
+
+None of this is obvious, and all of it was found by measurement:
+
+- Whatever `stripRequestHeaders` names — the caller's own credential and
+  whatever else its system treats as proven identity — is **consumed by this
+  hop**, the way `Proxy-Authorization` is consumed by the proxy it names. A
+  third-party origin has no business seeing it: forwarding a mesh token once
+  handed it to an upstream that echoed it straight back.
+- `authorization` is **not** special. It belongs to the application calling
+  the upstream (a page calling an API with that API's key) and is forwarded
+  unless you name it in `stripRequestHeaders`. `credential` still wins over it.
+- Hop-by-hop headers (RFC 9110 §7.6.1) are dropped.
+- `credential` is read at **request** time, so a key can be typed while traffic
+  flows.
+- The body **streams** rather than buffering, and the caller's `signal` is
+  forwarded, so an abandoned request abandons the upstream call.
+- An **opaque redirect** is reported as a redirect. It has status `0`, and
+  constructing a `Response` with status 0 throws *inside* the `try` — which
+  reported a redirecting upstream as `502 upstream-unreachable`.
+
+A **local** handler is just a `FetchHandler` you route to directly: do not put
+it behind this. Calling a handler on this side of the proxy must **not** strip
+the caller's credential, because it still needs to know who is calling.
 
 ## One row a browser cannot pass
 
@@ -83,31 +72,20 @@ and the browser drops it with no error. ADR-0015 has an intermediary announce
 itself with `Via`, so that part is unimplementable in a browser-hosted
 intermediary. A fact about the platform, not about this code.
 
-## Entry points
+## No platform
 
-| Import | Holds |
-|---|---|
-| `.` | `routeTable`, `urlUpstream`, `RouteStore`, `assertNoSecrets`, `rehydrate` |
-| `./node` | `fileRouteStore(path)` — write-then-rename |
-| `./browser` | `localStorageRouteStore(key?)` |
-
-No transport, no crypto, no platform at the root — proxying needs none of
-them, which is why a proxy **page** and a Node process share this package.
-`tests/boundary.test.ts` asserts it, and the dependency list is **empty**.
+No transport, no crypto, no platform code at all — re-issuing a request needs
+none of it, which is why a proxy **page** and a Node process use the same entry
+point. `tests/boundary.test.ts` asserts there is no platform entry point left
+to exempt, and the dependency list is **empty**.
 
 ## Where it came from
 
 Extracted from `@statewalker/httpeers-expose`, where it was a mesh concept by
-accident of where it was written. Nothing in it is about peers: it moves a
-`Request` to an upstream and a `Response` back. The one place the old package
-knew about meshes is now **`stripRequestHeaders`** — request headers to drop
-before re-issuing upstream, beyond the `authorization` and hop-by-hop sets it
-always drops. httpeers passes its proven-peer header there, because re-issuing
-to a third party must not tell an outside origin which mesh peer called.
-
-The single import it carried was `FetchHandler`, a one-line type. Extracting it
-therefore *dropped* a dependency rather than moving one.
-
-**22 tests**, and the twelve scenarios run inside two of them — the suite
-asserts that every scenario ran (guarding against an empty list) and that
-none failed.
+accident of where it was written. Nothing in it is about peers. The one place
+the old package knew about meshes is now `stripRequestHeaders`: httpeers passes
+its membership-token and proven-peer headers there.
+
+**9 tests**, and the twelve scenarios run inside two of them — the suite
+asserts that every scenario ran (guarding against an empty list) and that none
+failed.

package/dist/index.d.ts

@@ -1,18 +1,33 @@
 /**
- * A reverse proxy as a fetch handler.
+ * Re-issuing a request to an outside origin, safely. That is the whole
+ * package.
  *
- * "Reverse proxy" and "expose a local app" are ONE MECHANISM, and twelve
- * scenarios establish it: only the last step differs — a local handler is
- * *called*, a URL upstream is *re-issued*. Matching, rewriting, the listing,
- * the marker header and streaming are shared.
+ * It used to ship a route table too — prefix matching, a listing, a marker on
+ * unmatched paths. All of that is what a ROUTER does, and every caller already
+ * has one: the twelve scenarios that established this proxy's behaviour now
+ * run against a plain Hono router and pass unchanged, which is the evidence
+ * that removing it lost nothing.
  *
- * EXTRACTED FROM `@statewalker/httpeers-expose`, where it was a mesh concept
- * by accident of where it was written. Nothing in it is about peers: it moves
- * a `Request` to an upstream and a `Response` back. The one place the old
- * package knew about meshes is now `stripRequestHeaders`, which any caller
- * uses for whatever its own system treats as proven identity.
+ * What is genuinely this package's own is `urlUpstream`, and it is not
+ * obvious:
+ *
+ *   - `stripRequestHeaders` names the caller's own credential and whatever
+ *     else its system treats as identity; those are CONSUMED by this hop, the
+ *     way `Proxy-Authorization` is consumed by the proxy it names, because a
+ *     third-party origin has no business seeing them. `authorization` is not
+ *     special: it belongs to the application calling the upstream and is
+ *     forwarded unless named;
+ *   - hop-by-hop headers (RFC 9110 §7.6.1) are dropped;
+ *   - the credential is read at REQUEST time, so it can be typed while traffic
+ *     flows;
+ *   - the body streams rather than buffering, and the caller's `signal` is
+ *     forwarded so an abandoned request abandons the upstream call;
+ *   - an opaque redirect (status 0) is reported as a redirect rather than as
+ *     `502 upstream-unreachable`, which is what constructing a `Response` with
+ *     status 0 throwing inside a `try` used to produce.
+ *
+ * Persisting route configuration went with the router, for the same reason:
+ * the shape of that configuration belongs to whoever defines the routes.
  */
-export { type FetchHandler, MARKER, type Route, routeTable, type RouteTableInit, type Upstream, urlUpstream, type UrlUpstreamInit, } from "./proxy.js";
-export { matchRoute, type ProxyRoute, upstreamUrl } from "./routes.js";
-export { assertNoSecrets, rehydrate, type RehydrateInit, type RouteStore, SecretNotPersistableError, type StoredRoute, toStoredRoute, } from "./store.js";
+export { type FetchHandler, MARKER, type Upstream, type UrlUpstreamInit, urlUpstream, } from "./proxy.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,KAAK,YAAY,EACjB,MAAM,EACN,KAAK,KAAK,EACV,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,WAAW,EACX,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,eAAe,EACf,SAAS,EACT,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,yBAAyB,EACzB,KAAK,WAAW,EAChB,aAAa,GACd,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EACL,KAAK,YAAY,EACjB,MAAM,EACN,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,WAAW,GACZ,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,75 +1,7 @@
-import { i as toStoredRoute, n as assertNoSecrets, r as rehydrate, t as SecretNotPersistableError } from "./store-BwcCz3M9.js";
-//#region src/routes.ts
-/**
-* The route owning `pathname`, and what follows its prefix.
-*
-* LONGEST PREFIX WINS, so `/openai/admin` can go somewhere other than
-* `/openai`, and the answer does not depend on the order routes were added --
-* an ordering dependency would make the UI's list order silently meaningful.
-*/
-function matchRoute(routes, pathname) {
-	let best = null;
-	for (const route of routes) {
-		if (!pathname.startsWith(route.prefix)) continue;
-		const rest = pathname.slice(route.prefix.length);
-		if (rest !== "" && !rest.startsWith("/")) continue;
-		if (best == null || route.prefix.length > best.route.prefix.length) best = {
-			route,
-			rest
-		};
-	}
-	return best;
-}
-/** The absolute upstream URL for a matched route, carrying `search` unchanged. */
-function upstreamUrl(route, rest, search) {
-	return `${route.upstream.endsWith("/") ? route.upstream.slice(0, -1) : route.upstream}${rest}${search}`;
-}
-//#endregion
 //#region src/proxy.ts
 /** Marks this layer's OWN responses, so they are never mistaken for an upstream's. Same header the proxy already uses. */
 const MARKER = "x-webrun-proxy";
 /**
-* The mount: match, strip, delegate. Identical on both platforms — it touches
-* no DOM, no `node:` module and no network of its own.
-*/
-function routeTable(init) {
-	const mountPrefix = init.mountPrefix ?? "/proxy";
-	return async (request) => {
-		const url = new URL(request.url);
-		const pathname = url.pathname.startsWith(mountPrefix) ? url.pathname.slice(mountPrefix.length) : url.pathname;
-		if ((pathname === "" || pathname === "/") && request.method === "GET") {
-			const body = JSON.stringify({ routes: init.routes().map((r) => ({
-				prefix: r.prefix,
-				upstream: r.describe
-			})) });
-			return new Response(body, { headers: { "content-type": "application/json" } });
-		}
-		const found = matchRoute(init.routes().map((r) => ({
-			prefix: r.prefix,
-			upstream: r.describe,
-			headers: {}
-		})), pathname);
-		if (found == null) return new Response(`no route for ${pathname}`, {
-			status: 404,
-			headers: { [MARKER]: "no-route" }
-		});
-		const route = init.routes().find((r) => r.prefix === found.route.prefix);
-		if (route == null) return new Response(`no route for ${pathname}`, {
-			status: 404,
-			headers: { [MARKER]: "no-route" }
-		});
-		const rewritten = new URL(`${found.rest || "/"}${url.search}`, url.origin);
-		const forwarded = new Request(rewritten, {
-			method: request.method,
-			headers: request.headers,
-			body: request.body,
-			...request.body != null ? { duplex: "half" } : {},
-			signal: request.signal
-		});
-		return route.upstream(forwarded);
-	};
-}
-/**
 * Re-issue the request to a URL — the "reverse proxy" half.
 *
 * THE HYGIENE IS HERE AND NOT IN THE TABLE, because it applies only when a
@@ -82,7 +14,6 @@ function urlUpstream(init) {
 		const from = new URL(request.url);
 		const target = new URL(`.${from.pathname}${from.search}`, ensureSlash(init.base));
 		const headers = new Headers(request.headers);
-		headers.delete("authorization");
 		for (const name of init.stripRequestHeaders ?? []) headers.delete(name);
 		for (const hop of HOP_BY_HOP) headers.delete(hop);
 		if (init.via != null) headers.set("via", init.via);
@@ -130,4 +61,4 @@ function ensureSlash(base) {
 	return base.endsWith("/") ? base : `${base}/`;
 }
 //#endregion
-export { MARKER, SecretNotPersistableError, assertNoSecrets, matchRoute, rehydrate, routeTable, toStoredRoute, upstreamUrl, urlUpstream };
+export { MARKER, urlUpstream };

package/dist/proxy.d.ts

@@ -10,7 +10,7 @@
  * Everything except the upstream kind is lifted from `services/proxy.ts` and
  * `services/proxy-routes.ts`, which already run in the mesh: longest-prefix
  * matching on segment boundaries, the listing at the mount root, the marker
- * header, the `authorization` rule, route headers applied last, and the body
+ * header, the credential-stripping rule, route headers applied last, and the body
  * handed on unread.
  *
  * TWO DEFECTS OF THE PROVEN CODE ARE FIXED HERE, both measured in the tests:
@@ -36,31 +36,14 @@ export declare const MARKER = "x-webrun-proxy";
  * remote origin and another peer are all `(Request) => Promise<Response>`.
  */
 export type Upstream = FetchHandler;
-export interface Route {
-    /** Path prefix, matched on segment boundaries, longest first. */
-    prefix: string;
-    /** What this route reaches, for the listing at the mount root. Never a credential. */
-    describe: string;
-    upstream: Upstream;
-}
-export interface RouteTableInit {
-    /** Read per request, never snapshotted, so routes can be edited live. */
-    routes: () => readonly Route[];
-    /** Where this table is mounted; stripped before matching. */
-    mountPrefix?: string;
-}
-/**
- * The mount: match, strip, delegate. Identical on both platforms — it touches
- * no DOM, no `node:` module and no network of its own.
- */
-export declare function routeTable(init: RouteTableInit): FetchHandler;
 export interface UrlUpstreamInit {
     /**
-     * Request headers to drop before re-issuing upstream, beyond the ones this
-     * proxy always drops (`authorization` and the hop-by-hop set).
+     * Request headers to drop before re-issuing upstream, beyond the hop-by-hop
+     * set this proxy always drops.
      *
-     * For anything the surrounding system treats as proven identity and that a
-     * third-party origin has no business seeing.
+     * For the surrounding system's own credential and anything it treats as
+     * proven identity -- what a third-party origin has no business seeing.
+     * `authorization` is forwarded unless it is named here.
      */
     stripRequestHeaders?: readonly string[];
     /** Origin (and optional base path) every request is re-issued against. */

package/dist/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAGnE,0HAA0H;AAC1H,eAAO,MAAM,MAAM,mBAAmB,CAAC;AAEvC;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,YAAY,CAAC;AAEpC,MAAM,WAAW,KAAK;IACpB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,MAAM,EAAE,MAAM,SAAS,KAAK,EAAE,CAAC;IAC/B,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAyD7D;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACtD,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,QAAQ,CA6D3D"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEnE,0HAA0H;AAC1H,eAAO,MAAM,MAAM,mBAAmB,CAAC;AAEvC;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,YAAY,CAAC;AAEpC,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACtD,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,QAAQ,CA+D3D"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@statewalker/webrun-http-proxy",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
-  "description": "A reverse proxy as a fetch handler: one route table, two kinds of upstream — a local handler or a remote origin.",
+  "description": "Re-issue an HTTP request to an outside origin, safely: credentials consumed, hop-by-hop headers dropped, body streamed.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -15,14 +15,6 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
-    },
-    "./node": {
-      "types": "./dist/node.d.ts",
-      "import": "./dist/node.js"
-    },
-    "./browser": {
-      "types": "./dist/browser.d.ts",
-      "import": "./dist/browser.js"
     }
   },
   "files": [
@@ -32,7 +24,9 @@
   "sideEffects": false,
   "dependencies": {},
   "devDependencies": {
+    "@biomejs/biome": "^2.5.8",
     "@types/node": "^26.2.0",
+    "hono": "^4.13.2",
     "rimraf": "^6.1.3",
     "rolldown": "^1.2.4",
     "typescript": "^7.0.2",

package/src/index.ts

@@ -1,35 +1,39 @@
 /**
- * A reverse proxy as a fetch handler.
+ * Re-issuing a request to an outside origin, safely. That is the whole
+ * package.
  *
- * "Reverse proxy" and "expose a local app" are ONE MECHANISM, and twelve
- * scenarios establish it: only the last step differs — a local handler is
- * *called*, a URL upstream is *re-issued*. Matching, rewriting, the listing,
- * the marker header and streaming are shared.
+ * It used to ship a route table too — prefix matching, a listing, a marker on
+ * unmatched paths. All of that is what a ROUTER does, and every caller already
+ * has one: the twelve scenarios that established this proxy's behaviour now
+ * run against a plain Hono router and pass unchanged, which is the evidence
+ * that removing it lost nothing.
  *
- * EXTRACTED FROM `@statewalker/httpeers-expose`, where it was a mesh concept
- * by accident of where it was written. Nothing in it is about peers: it moves
- * a `Request` to an upstream and a `Response` back. The one place the old
- * package knew about meshes is now `stripRequestHeaders`, which any caller
- * uses for whatever its own system treats as proven identity.
+ * What is genuinely this package's own is `urlUpstream`, and it is not
+ * obvious:
+ *
+ *   - `stripRequestHeaders` names the caller's own credential and whatever
+ *     else its system treats as identity; those are CONSUMED by this hop, the
+ *     way `Proxy-Authorization` is consumed by the proxy it names, because a
+ *     third-party origin has no business seeing them. `authorization` is not
+ *     special: it belongs to the application calling the upstream and is
+ *     forwarded unless named;
+ *   - hop-by-hop headers (RFC 9110 §7.6.1) are dropped;
+ *   - the credential is read at REQUEST time, so it can be typed while traffic
+ *     flows;
+ *   - the body streams rather than buffering, and the caller's `signal` is
+ *     forwarded so an abandoned request abandons the upstream call;
+ *   - an opaque redirect (status 0) is reported as a redirect rather than as
+ *     `502 upstream-unreachable`, which is what constructing a `Response` with
+ *     status 0 throwing inside a `try` used to produce.
+ *
+ * Persisting route configuration went with the router, for the same reason:
+ * the shape of that configuration belongs to whoever defines the routes.
  */
 
 export {
   type FetchHandler,
   MARKER,
-  type Route,
-  routeTable,
-  type RouteTableInit,
   type Upstream,
-  urlUpstream,
   type UrlUpstreamInit,
+  urlUpstream,
 } from "./proxy.js";
-export { matchRoute, type ProxyRoute, upstreamUrl } from "./routes.js";
-export {
-  assertNoSecrets,
-  rehydrate,
-  type RehydrateInit,
-  type RouteStore,
-  SecretNotPersistableError,
-  type StoredRoute,
-  toStoredRoute,
-} from "./store.js";

package/src/proxy.ts

@@ -10,7 +10,7 @@
  * Everything except the upstream kind is lifted from `services/proxy.ts` and
  * `services/proxy-routes.ts`, which already run in the mesh: longest-prefix
  * matching on segment boundaries, the listing at the mount root, the marker
- * header, the `authorization` rule, route headers applied last, and the body
+ * header, the credential-stripping rule, route headers applied last, and the body
  * handed on unread.
  *
  * TWO DEFECTS OF THE PROVEN CODE ARE FIXED HERE, both measured in the tests:
@@ -30,7 +30,6 @@
  * package for it would give a proxy a dependency it has no other use for.
  */
 export type FetchHandler = (request: Request) => Promise<Response>;
-import { matchRoute } from "./routes.js";
 
 /** Marks this layer's OWN responses, so they are never mistaken for an upstream's. Same header the proxy already uses. */
 export const MARKER = "x-webrun-proxy";
@@ -41,91 +40,14 @@ export const MARKER = "x-webrun-proxy";
  */
 export type Upstream = FetchHandler;
 
-export interface Route {
-  /** Path prefix, matched on segment boundaries, longest first. */
-  prefix: string;
-  /** What this route reaches, for the listing at the mount root. Never a credential. */
-  describe: string;
-  upstream: Upstream;
-}
-
-export interface RouteTableInit {
-  /** Read per request, never snapshotted, so routes can be edited live. */
-  routes: () => readonly Route[];
-  /** Where this table is mounted; stripped before matching. */
-  mountPrefix?: string;
-}
-
-/**
- * The mount: match, strip, delegate. Identical on both platforms — it touches
- * no DOM, no `node:` module and no network of its own.
- */
-export function routeTable(init: RouteTableInit): FetchHandler {
-  const mountPrefix = init.mountPrefix ?? "/proxy";
-
-  return async (request: Request): Promise<Response> => {
-    const url = new URL(request.url);
-    const pathname = url.pathname.startsWith(mountPrefix)
-      ? url.pathname.slice(mountPrefix.length)
-      : url.pathname;
-
-    // The listing: prefixes and descriptions, never headers — a header value
-    // is a credential and every member of the mesh can read this.
-    if ((pathname === "" || pathname === "/") && request.method === "GET") {
-      const body = JSON.stringify({
-        routes: init.routes().map((r) => ({ prefix: r.prefix, upstream: r.describe })),
-      });
-      return new Response(body, { headers: { "content-type": "application/json" } });
-    }
-
-    // `matchRoute` is the PROVEN matcher, imported rather than copied: it is
-    // what enforces segment boundaries, so `/files` does not swallow
-    // `/filesystem`. It expects `{prefix, upstream, headers}`-shaped records,
-    // so the route is presented to it with `upstream` as its description.
-    const shaped = init.routes().map((r) => ({
-      prefix: r.prefix,
-      upstream: r.describe,
-      headers: {},
-    }));
-    const found = matchRoute(shaped, pathname);
-    if (found == null) {
-      return new Response(`no route for ${pathname}`, {
-        status: 404,
-        headers: { [MARKER]: "no-route" },
-      });
-    }
-
-    const route = init.routes().find((r) => r.prefix === found.route.prefix);
-    if (route == null) {
-      return new Response(`no route for ${pathname}`, {
-        status: 404,
-        headers: { [MARKER]: "no-route" },
-      });
-    }
-
-    // The rest of the path, plus the query, as a request the upstream sees.
-    // The URL's origin is carried over so a handler upstream still gets a
-    // well-formed absolute URL; a `urlUpstream` replaces it entirely.
-    const rewritten = new URL(`${found.rest || "/"}${url.search}`, url.origin);
-    const forwarded = new Request(rewritten, {
-      method: request.method,
-      headers: request.headers,
-      body: request.body,
-      ...(request.body != null ? { duplex: "half" as const } : {}),
-      signal: request.signal,
-    });
-
-    return route.upstream(forwarded);
-  };
-}
-
 export interface UrlUpstreamInit {
   /**
-   * Request headers to drop before re-issuing upstream, beyond the ones this
-   * proxy always drops (`authorization` and the hop-by-hop set).
+   * Request headers to drop before re-issuing upstream, beyond the hop-by-hop
+   * set this proxy always drops.
    *
-   * For anything the surrounding system treats as proven identity and that a
-   * third-party origin has no business seeing.
+   * For the surrounding system's own credential and anything it treats as
+   * proven identity -- what a third-party origin has no business seeing.
+   * `authorization` is forwarded unless it is named here.
    */
   stripRequestHeaders?: readonly string[];
 
@@ -156,17 +78,19 @@ export function urlUpstream(init: UrlUpstreamInit): Upstream {
     const target = new URL(`.${from.pathname}${from.search}`, ensureSlash(init.base));
 
     const headers = new Headers(request.headers);
-    // The mesh's own credential is consumed by this hop, the way
-    // `Proxy-Authorization` is consumed by the proxy it names. Forwarding it
-    // handed mesh tokens to third parties (an upstream echoed one back) and
-    // turned every call into a preflighted one.
-    headers.delete("authorization");
-    // WHATEVER ELSE THE CALLER'S SYSTEM TREATS AS IDENTITY. This proxy knows
-    // nothing about the caller's trust model, so the names are configuration:
-    // httpeers passes its proven-peer header here, because re-issuing to a
-    // third party must not tell an outside origin which mesh peer called.
-    // Without this a caller would have to post-process the request, by which
-    // point it has already gone.
+    // WHATEVER THE CALLER'S SYSTEM TREATS AS ITS OWN CREDENTIAL OR IDENTITY
+    // is consumed by this hop, the way `Proxy-Authorization` is consumed by the
+    // proxy it names. This proxy knows nothing about the caller's trust model,
+    // so the names are configuration: httpeers passes its membership-token and
+    // proven-peer headers here, because re-issuing to a third party must hand
+    // it neither a mesh token (an upstream once echoed one back) nor which
+    // mesh peer called. Without this a caller would have to post-process the
+    // request, by which point it has already gone.
+    //
+    // `authorization` is NOT on any built-in list. It belongs to the
+    // application talking to the upstream -- a page calling an API with that
+    // API's own key -- and dropping it made such a call impossible through the
+    // proxy. A system that does put its credential there names it here.
     for (const name of init.stripRequestHeaders ?? []) headers.delete(name);
     // Hop-by-hop headers (RFC 9110 §7.6.1) are not the upstream's business.
     for (const hop of HOP_BY_HOP) headers.delete(hop);

package/dist/browser.d.ts

@@ -1,11 +0,0 @@
-/**
- * The browser profile: routes in `localStorage`.
- *
- * `localStorage` IS the reason `assertNoSecrets` exists. It survives a reload,
- * a shared machine and anyone who opens devtools, so a credential written here
- * is a credential leaked — which is exactly what building the proxy page on an
- * earlier shape of this API would have done.
- */
-import { type RouteStore } from "./store.js";
-export declare function localStorageRouteStore(key?: string): RouteStore;
-//# sourceMappingURL=browser.d.ts.map

package/dist/browser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAmB,KAAK,UAAU,EAAoB,MAAM,YAAY,CAAC;AAIhF,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAoB,GAAG,UAAU,CAmB5E"}

package/dist/browser.js

@@ -1,30 +0,0 @@
-import { n as assertNoSecrets } from "./store-BwcCz3M9.js";
-//#region src/browser.ts
-/**
-* The browser profile: routes in `localStorage`.
-*
-* `localStorage` IS the reason `assertNoSecrets` exists. It survives a reload,
-* a shared machine and anyone who opens devtools, so a credential written here
-* is a credential leaked — which is exactly what building the proxy page on an
-* earlier shape of this API would have done.
-*/
-const DEFAULT_KEY = "webrun:proxy:routes";
-function localStorageRouteStore(key = DEFAULT_KEY) {
-	return {
-		async load() {
-			const raw = globalThis.localStorage?.getItem(key);
-			if (raw == null) return void 0;
-			try {
-				return JSON.parse(raw);
-			} catch {
-				return [];
-			}
-		},
-		async save(routes) {
-			assertNoSecrets(routes);
-			globalThis.localStorage?.setItem(key, JSON.stringify(routes));
-		}
-	};
-}
-//#endregion
-export { localStorageRouteStore };

package/dist/node.d.ts

@@ -1,11 +0,0 @@
-/**
- * The Node profile: routes on disk.
- *
- * Write-then-rename, for the same reason the identity store does it — a
- * truncated file is not a corrupt file somebody notices, it is a table that
- * silently loses routes. Here the cost is smaller than a lost mesh identity,
- * but the fix is two lines and the failure is equally quiet.
- */
-import { type RouteStore } from "./store.js";
-export declare function fileRouteStore(path: string): RouteStore;
-//# sourceMappingURL=node.d.ts.map

package/dist/node.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAmB,KAAK,UAAU,EAAoB,MAAM,YAAY,CAAC;AAEhF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAoBvD"}

package/dist/node.js

@@ -1,33 +0,0 @@
-import { n as assertNoSecrets } from "./store-BwcCz3M9.js";
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-//#region src/node.ts
-/**
-* The Node profile: routes on disk.
-*
-* Write-then-rename, for the same reason the identity store does it — a
-* truncated file is not a corrupt file somebody notices, it is a table that
-* silently loses routes. Here the cost is smaller than a lost mesh identity,
-* but the fix is two lines and the failure is equally quiet.
-*/
-function fileRouteStore(path) {
-	return {
-		async load() {
-			try {
-				return JSON.parse(await readFile(path, "utf8"));
-			} catch (error) {
-				if (error.code === "ENOENT") return void 0;
-				throw error;
-			}
-		},
-		async save(routes) {
-			assertNoSecrets(routes);
-			await mkdir(dirname(path), { recursive: true });
-			const staging = `${path}.${process.pid}.${Date.now()}.tmp`;
-			await writeFile(staging, JSON.stringify(routes, null, 2), { mode: 384 });
-			await rename(staging, path);
-		}
-	};
-}
-//#endregion
-export { fileRouteStore };

package/dist/routes.d.ts

@@ -1,31 +0,0 @@
-/**
- * Which configured upstream a mesh-side path belongs to.
- *
- * THE UPSTREAM IS NEVER TAKEN FROM THE REQUEST. `cors-anywhere` puts the
- * destination in the URL (`/https://example.com/`), which is why its public
- * instance is permanently abused. Here a caller selects among upstreams the
- * operator configured and can reach nothing else, so this module must never
- * gain a wildcard or passthrough mode.
- */
-export interface ProxyRoute {
-    /** Mesh-side prefix, leading slash, no trailing slash: `/openai`. */
-    prefix: string;
-    /** Upstream base: `https://api.openai.com/v1`. */
-    upstream: string;
-    /** Applied to every forwarded request, last, so operator config wins. */
-    headers: Record<string, string>;
-}
-/**
- * The route owning `pathname`, and what follows its prefix.
- *
- * LONGEST PREFIX WINS, so `/openai/admin` can go somewhere other than
- * `/openai`, and the answer does not depend on the order routes were added --
- * an ordering dependency would make the UI's list order silently meaningful.
- */
-export declare function matchRoute(routes: readonly ProxyRoute[], pathname: string): {
-    route: ProxyRoute;
-    rest: string;
-} | null;
-/** The absolute upstream URL for a matched route, carrying `search` unchanged. */
-export declare function upstreamUrl(route: ProxyRoute, rest: string, search: string): string;
-//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAY5C;AAED,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnF"}

package/dist/store-BwcCz3M9.js

@@ -1,45 +0,0 @@
-//#region src/store.ts
-/** Thrown when a caller tries to persist something that looks like a secret. */
-var SecretNotPersistableError = class extends Error {
-	prefix;
-	constructor(prefix) {
-		super(`webrun-http-proxy: refusing to persist a credential value for route ${JSON.stringify(prefix)}. Store the header NAME (\`secretHeader\`) and keep the value in memory — a persisted credential survives a reload, a shared machine, and devtools.`);
-		this.prefix = prefix;
-		this.name = "SecretNotPersistableError";
-	}
-};
-/**
-* The check `save()` implementations run. Exported so an adapter written
-* elsewhere enforces the same rule rather than reimplementing its own idea of
-* what a secret looks like.
-*/
-function assertNoSecrets(routes) {
-	for (const route of routes) {
-		const carrier = route;
-		if (typeof carrier.secret === "string" || typeof carrier.secretValue === "string" || carrier.headers != null && typeof carrier.headers === "object") throw new SecretNotPersistableError(route.prefix);
-	}
-}
-/** Keep only the persistable fields, dropping anything else a caller passed. */
-function toStoredRoute(route) {
-	return {
-		prefix: route.prefix,
-		upstream: route.upstream,
-		describe: route.describe,
-		secretHeader: route.secretHeader ?? null
-	};
-}
-/**
-* Stored routes back into live ones.
-*
-* The secret re-enters here, from wherever the caller keeps it in memory —
-* which is the only place it ever was.
-*/
-function rehydrate(stored, init) {
-	return stored.map((route) => ({
-		prefix: route.prefix,
-		describe: route.describe,
-		upstream: init.upstreamFor(route)
-	}));
-}
-//#endregion
-export { toStoredRoute as i, assertNoSecrets as n, rehydrate as r, SecretNotPersistableError as t };

package/dist/store.d.ts

@@ -1,72 +0,0 @@
-/**
- * Persisting routes — and refusing, mechanically, to persist a secret.
- *
- * THE RULE THIS FILE EXISTS TO ENFORCE. A route may carry a credential: an
- * upstream API key, a bearer token, whatever the operator typed into the proxy
- * page. The header's NAME is configuration and is saved. The header's VALUE is
- * a secret, lives in memory, and is merged per request.
- *
- * That distinction cannot be left to callers. An earlier shape of this API
- * stored a whole `Route`, and building the proxy page on it would have written
- * bearer keys into `localStorage` — where they survive a reload, a shared
- * machine, and anyone who opens devtools. So `StoredRoute` has no field a
- * value could go in, and `save()` throws rather than silently dropping one:
- * silently dropping would mean a route that worked before a reload and
- * mysteriously 401s after it.
- *
- * `load()` RETURNS `undefined` FOR "NEVER WRITTEN", which is not the same as
- * an empty array and the difference is visible to a user. A first visit should
- * seed the demo routes; a visit after the operator deleted all of them should
- * not bring them back. One value distinguishes the two.
- */
-import type { Route, Upstream } from "./proxy.js";
-/**
- * A route as it is persisted: the upstream as a URL, and the header NAME only.
- *
- * There is deliberately no field for a header value. The type is the
- * enforcement; `save()`'s check is the belt to its braces.
- */
-export interface StoredRoute {
-    prefix: string;
-    /** The upstream base URL. A route whose upstream is a live handler cannot be stored. */
-    upstream: string;
-    describe: string;
-    /** The name of the header carrying a credential, or `null` for none. */
-    secretHeader: string | null;
-}
-export interface RouteStore {
-    /** `undefined` means NEVER WRITTEN — distinct from `[]`, which means "the operator deleted them all". */
-    load(): Promise<StoredRoute[] | undefined>;
-    /** Throws if any route carries a credential VALUE. */
-    save(routes: StoredRoute[]): Promise<void>;
-}
-/** Thrown when a caller tries to persist something that looks like a secret. */
-export declare class SecretNotPersistableError extends Error {
-    readonly prefix: string;
-    constructor(prefix: string);
-}
-/**
- * The check `save()` implementations run. Exported so an adapter written
- * elsewhere enforces the same rule rather than reimplementing its own idea of
- * what a secret looks like.
- */
-export declare function assertNoSecrets(routes: readonly StoredRoute[]): void;
-/** Keep only the persistable fields, dropping anything else a caller passed. */
-export declare function toStoredRoute(route: {
-    prefix: string;
-    upstream: string;
-    describe: string;
-    secretHeader?: string | null;
-}): StoredRoute;
-export interface RehydrateInit {
-    /** Build the live upstream for a stored route. Where the secret VALUE is re-supplied. */
-    upstreamFor: (stored: StoredRoute) => Upstream;
-}
-/**
- * Stored routes back into live ones.
- *
- * The secret re-enters here, from wherever the caller keeps it in memory —
- * which is the only place it ever was.
- */
-export declare function rehydrate(stored: readonly StoredRoute[], init: RehydrateInit): Route[];
-//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IACzB,yGAAyG;IACzG,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,CAAC;IAC3C,sDAAsD;IACtD,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,gFAAgF;AAChF,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,MAAM,EAAE,MAAM;IAA1C,YAA4B,MAAM,EAAE,MAAM,EAOzC;CACF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,IAAI,CAapE;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GAAG,WAAW,CAOd;AAED,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,WAAW,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,QAAQ,CAAC;CAChD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,GAAG,KAAK,EAAE,CAMtF"}

package/src/browser.ts

@@ -1,33 +0,0 @@
-/**
- * The browser profile: routes in `localStorage`.
- *
- * `localStorage` IS the reason `assertNoSecrets` exists. It survives a reload,
- * a shared machine and anyone who opens devtools, so a credential written here
- * is a credential leaked — which is exactly what building the proxy page on an
- * earlier shape of this API would have done.
- */
-
-import { assertNoSecrets, type RouteStore, type StoredRoute } from "./store.js";
-
-const DEFAULT_KEY = "webrun:proxy:routes";
-
-export function localStorageRouteStore(key: string = DEFAULT_KEY): RouteStore {
-  return {
-    async load() {
-      const raw = globalThis.localStorage?.getItem(key);
-      // `null` from `getItem` means never written. Distinct from `"[]"`.
-      if (raw == null) return undefined;
-      try {
-        return JSON.parse(raw) as StoredRoute[];
-      } catch {
-        // Corrupt is not "never written": resurrecting defaults over a table
-        // somebody edited would be worse than starting empty and saying so.
-        return [];
-      }
-    },
-    async save(routes) {
-      assertNoSecrets(routes);
-      globalThis.localStorage?.setItem(key, JSON.stringify(routes));
-    },
-  };
-}

package/src/node.ts

@@ -1,34 +0,0 @@
-/**
- * The Node profile: routes on disk.
- *
- * Write-then-rename, for the same reason the identity store does it — a
- * truncated file is not a corrupt file somebody notices, it is a table that
- * silently loses routes. Here the cost is smaller than a lost mesh identity,
- * but the fix is two lines and the failure is equally quiet.
- */
-
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-import { assertNoSecrets, type RouteStore, type StoredRoute } from "./store.js";
-
-export function fileRouteStore(path: string): RouteStore {
-  return {
-    async load() {
-      try {
-        return JSON.parse(await readFile(path, "utf8")) as StoredRoute[];
-      } catch (error) {
-        // NEVER WRITTEN, not empty. A first run seeds its defaults; a run
-        // after the operator deleted every route must not resurrect them.
-        if ((error as { code?: string }).code === "ENOENT") return undefined;
-        throw error;
-      }
-    },
-    async save(routes) {
-      assertNoSecrets(routes);
-      await mkdir(dirname(path), { recursive: true });
-      const staging = `${path}.${process.pid}.${Date.now()}.tmp`;
-      await writeFile(staging, JSON.stringify(routes, null, 2), { mode: 0o600 });
-      await rename(staging, path);
-    },
-  };
-}

package/src/routes.ts

@@ -1,48 +0,0 @@
-/**
- * Which configured upstream a mesh-side path belongs to.
- *
- * THE UPSTREAM IS NEVER TAKEN FROM THE REQUEST. `cors-anywhere` puts the
- * destination in the URL (`/https://example.com/`), which is why its public
- * instance is permanently abused. Here a caller selects among upstreams the
- * operator configured and can reach nothing else, so this module must never
- * gain a wildcard or passthrough mode.
- */
-
-export interface ProxyRoute {
-  /** Mesh-side prefix, leading slash, no trailing slash: `/openai`. */
-  prefix: string;
-  /** Upstream base: `https://api.openai.com/v1`. */
-  upstream: string;
-  /** Applied to every forwarded request, last, so operator config wins. */
-  headers: Record<string, string>;
-}
-
-/**
- * The route owning `pathname`, and what follows its prefix.
- *
- * LONGEST PREFIX WINS, so `/openai/admin` can go somewhere other than
- * `/openai`, and the answer does not depend on the order routes were added --
- * an ordering dependency would make the UI's list order silently meaningful.
- */
-export function matchRoute(
-  routes: readonly ProxyRoute[],
-  pathname: string,
-): { route: ProxyRoute; rest: string } | null {
-  let best: { route: ProxyRoute; rest: string } | null = null;
-  for (const route of routes) {
-    if (!pathname.startsWith(route.prefix)) continue;
-    const rest = pathname.slice(route.prefix.length);
-    // A prefix is a SEGMENT, not a string prefix: `/open` must not swallow
-    // `/openai/models`, or adding a short route would silently capture longer
-    // unrelated ones.
-    if (rest !== "" && !rest.startsWith("/")) continue;
-    if (best == null || route.prefix.length > best.route.prefix.length) best = { route, rest };
-  }
-  return best;
-}
-
-/** The absolute upstream URL for a matched route, carrying `search` unchanged. */
-export function upstreamUrl(route: ProxyRoute, rest: string, search: string): string {
-  const base = route.upstream.endsWith("/") ? route.upstream.slice(0, -1) : route.upstream;
-  return `${base}${rest}${search}`;
-}

package/src/store.ts

@@ -1,111 +0,0 @@
-/**
- * Persisting routes — and refusing, mechanically, to persist a secret.
- *
- * THE RULE THIS FILE EXISTS TO ENFORCE. A route may carry a credential: an
- * upstream API key, a bearer token, whatever the operator typed into the proxy
- * page. The header's NAME is configuration and is saved. The header's VALUE is
- * a secret, lives in memory, and is merged per request.
- *
- * That distinction cannot be left to callers. An earlier shape of this API
- * stored a whole `Route`, and building the proxy page on it would have written
- * bearer keys into `localStorage` — where they survive a reload, a shared
- * machine, and anyone who opens devtools. So `StoredRoute` has no field a
- * value could go in, and `save()` throws rather than silently dropping one:
- * silently dropping would mean a route that worked before a reload and
- * mysteriously 401s after it.
- *
- * `load()` RETURNS `undefined` FOR "NEVER WRITTEN", which is not the same as
- * an empty array and the difference is visible to a user. A first visit should
- * seed the demo routes; a visit after the operator deleted all of them should
- * not bring them back. One value distinguishes the two.
- */
-
-import type { Route, Upstream } from "./proxy.js";
-
-/**
- * A route as it is persisted: the upstream as a URL, and the header NAME only.
- *
- * There is deliberately no field for a header value. The type is the
- * enforcement; `save()`'s check is the belt to its braces.
- */
-export interface StoredRoute {
-  prefix: string;
-  /** The upstream base URL. A route whose upstream is a live handler cannot be stored. */
-  upstream: string;
-  describe: string;
-  /** The name of the header carrying a credential, or `null` for none. */
-  secretHeader: string | null;
-}
-
-export interface RouteStore {
-  /** `undefined` means NEVER WRITTEN — distinct from `[]`, which means "the operator deleted them all". */
-  load(): Promise<StoredRoute[] | undefined>;
-  /** Throws if any route carries a credential VALUE. */
-  save(routes: StoredRoute[]): Promise<void>;
-}
-
-/** Thrown when a caller tries to persist something that looks like a secret. */
-export class SecretNotPersistableError extends Error {
-  constructor(public readonly prefix: string) {
-    super(
-      `webrun-http-proxy: refusing to persist a credential value for route ${JSON.stringify(prefix)}. ` +
-        "Store the header NAME (`secretHeader`) and keep the value in memory — a persisted " +
-        "credential survives a reload, a shared machine, and devtools.",
-    );
-    this.name = "SecretNotPersistableError";
-  }
-}
-
-/**
- * The check `save()` implementations run. Exported so an adapter written
- * elsewhere enforces the same rule rather than reimplementing its own idea of
- * what a secret looks like.
- */
-export function assertNoSecrets(routes: readonly StoredRoute[]): void {
-  for (const route of routes) {
-    const carrier = route as unknown as Record<string, unknown>;
-    // Any shape a value could arrive in. A caller passing a whole `Route`
-    // through by mistake is the case this catches, and it is the likely one.
-    if (
-      typeof carrier.secret === "string" ||
-      typeof carrier.secretValue === "string" ||
-      (carrier.headers != null && typeof carrier.headers === "object")
-    ) {
-      throw new SecretNotPersistableError(route.prefix);
-    }
-  }
-}
-
-/** Keep only the persistable fields, dropping anything else a caller passed. */
-export function toStoredRoute(route: {
-  prefix: string;
-  upstream: string;
-  describe: string;
-  secretHeader?: string | null;
-}): StoredRoute {
-  return {
-    prefix: route.prefix,
-    upstream: route.upstream,
-    describe: route.describe,
-    secretHeader: route.secretHeader ?? null,
-  };
-}
-
-export interface RehydrateInit {
-  /** Build the live upstream for a stored route. Where the secret VALUE is re-supplied. */
-  upstreamFor: (stored: StoredRoute) => Upstream;
-}
-
-/**
- * Stored routes back into live ones.
- *
- * The secret re-enters here, from wherever the caller keeps it in memory —
- * which is the only place it ever was.
- */
-export function rehydrate(stored: readonly StoredRoute[], init: RehydrateInit): Route[] {
-  return stored.map((route) => ({
-    prefix: route.prefix,
-    describe: route.describe,
-    upstream: init.upstreamFor(route),
-  }));
-}