@usine/gateway 0.0.0-stage → 0.1.0

package/dist/llm/llm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm.d.ts","sourceRoot":"","sources":["../../src/llm/llm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAY,MAAM,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;;;;AAK/C,0DAA0D;AAC1D,qBAAa,eAAgB,SAAQ,oBAEnC;CAAG;;;;AAEL;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,+BAG/C;CAAG;AAEJ,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,oFAA8D,CAAC;AAC/F,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAC;;;;;AAElE,sGAAsG;AACtG,qBAAa,iBAAkB,SAAQ,sBAGtC;CAAG;;;;;AAEJ;;;GAGG;AACH,qBAAa,cAAe,SAAQ,mBAGlC;CAAG;AAEL,2GAA2G;AAC3G,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;CAChD;AAID,eAAO,MAAM,eAAe,mDAAsC,CAAC;AACnE,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAC;AAI1D,+DAA+D;AAC/D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,6HAA6H;AAC7H,eAAO,MAAM,SAAS,aAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAKnE,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,cAAc,aACf,iBAAiB,GAAG,cAAc,KAC3C,qBAYF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,cAClB,YAAY,QACjB,eAAe,KACpB,MAAM,CAAC,MAAM,CAAC,iBAAiB,GAAG,cAAc,CACY,CAAC;AAgBhE;;;GAGG;AACH,eAAO,MAAM,sBAAsB,aACvB,iBAAiB,GAAG,cAAc,WACnC,OAAO,CAAC,OAAO,KACvB,OAAO,CAAC,OAiBV,CAAC"}

package/dist/llm/llm.js

@@ -0,0 +1,92 @@
+import { Option, Redacted, Schema } from "effect";
+import { Headers } from "effect/unstable/http";
+import { UpstreamBase } from "../upstream.js";
+const Secret = Schema.Redacted(Schema.NonEmptyString);
+/** An Anthropic API key, sent upstream as `x-api-key`. */
+export class AnthropicApiKey extends Schema.TaggedClass()("AnthropicApiKey", {
+    key: Secret,
+}) {
+}
+/**
+ * A Claude subscription token from `claude setup-token`, sent upstream as a bearer token with
+ * the OAuth beta flag. Anthropic doesn't document swapping a placeholder for one through a
+ * proxy; `test/placeholder-swap` checks that it works.
+ */
+export class AnthropicSubscriptionToken extends Schema.TaggedClass()("AnthropicSubscriptionToken", { token: Secret }) {
+}
+/** The credential added to Anthropic requests. */
+export const AnthropicCredential = Schema.Union([AnthropicApiKey, AnthropicSubscriptionToken]);
+/** Claude Code's upstream. On the Worker, `ANTHROPIC_BASE_URL` is `http://llm.<domain>/anthropic`. */
+export class AnthropicProvider extends Schema.TaggedClass()("AnthropicProvider", { upstream: UpstreamBase, credential: AnthropicCredential }) {
+}
+/**
+ * An OpenAI-compatible upstream for Codex. On the Worker, the `model_provider` `base_url` is
+ * `http://llm.<domain>/openai/v1`. The key is sent as a bearer token.
+ */
+export class OpenAiProvider extends Schema.TaggedClass()("OpenAiProvider", {
+    upstream: UpstreamBase,
+    key: Secret,
+}) {
+}
+/** The `llm.<domain>` path prefixes that select a provider. */
+const LLM_PROVIDER_NAMES = ["anthropic", "openai"];
+export const LlmProviderName = Schema.Literals(LLM_PROVIDER_NAMES);
+const isProviderName = Schema.is(LlmProviderName);
+/** Returns the provider from the first path segment; for example, `/anthropic/v1/messages` is Anthropic's `/v1/messages`. */
+export const llmTarget = (pathname) => {
+    const match = /^\/([a-z]+)(\/.*)?$/u.exec(pathname);
+    const provider = match?.[1];
+    if (match === null || provider === undefined || !isProviderName(provider))
+        return Option.none();
+    return Option.some({ provider, rest: match[2] ?? "" });
+};
+/** Returns the credential kind sent to `provider`; always an API key for OpenAI. */
+export const credentialKind = (provider) => {
+    switch (provider._tag) {
+        case "OpenAiProvider":
+            return "api-key";
+        case "AnthropicProvider":
+            switch (provider.credential._tag) {
+                case "AnthropicApiKey":
+                    return "api-key";
+                case "AnthropicSubscriptionToken":
+                    return "subscription";
+            }
+    }
+};
+/** Returns the configured provider for `name` as a single forwardable value. */
+export const configuredProvider = (providers, name) => name === "anthropic" ? providers.anthropic : providers.openai;
+const OAUTH_BETA = "oauth-2025-04-20";
+const withBeta = (incoming, flag) => {
+    const flags = Option.match(incoming, {
+        onNone: () => [],
+        onSome: (value) => value
+            .split(",")
+            .map((part) => part.trim())
+            .filter((part) => part !== ""),
+    });
+    return (flags.includes(flag) ? flags : [...flags, flag]).join(",");
+};
+/**
+ * Adds the provider's credential to headers without the caller's credential. For a
+ * subscription token, also merges the OAuth beta flag into the harness's flags.
+ */
+export const withProviderCredential = (provider, headers) => {
+    switch (provider._tag) {
+        case "OpenAiProvider":
+            return Headers.set(headers, "authorization", `Bearer ${Redacted.value(provider.key)}`);
+        case "AnthropicProvider": {
+            const credential = provider.credential;
+            switch (credential._tag) {
+                case "AnthropicApiKey":
+                    return Headers.set(headers, "x-api-key", Redacted.value(credential.key));
+                case "AnthropicSubscriptionToken":
+                    return Headers.setAll(headers, {
+                        authorization: `Bearer ${Redacted.value(credential.token)}`,
+                        "anthropic-beta": withBeta(Headers.get(headers, "anthropic-beta"), OAUTH_BETA),
+                    });
+            }
+        }
+    }
+};
+//# sourceMappingURL=llm.js.map

package/dist/llm/llm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm.js","sourceRoot":"","sources":["../../src/llm/llm.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AAEtD,0DAA0D;AAC1D,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CAAC,iBAAiB,EAAE;IAC5F,GAAG,EAAE,MAAM;CACZ,CAAC;CAAG;AAEL;;;;GAIG;AACH,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,EAA8B,CAC9F,4BAA4B,EAC5B,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB;CAAG;AAEJ,kDAAkD;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAG/F,sGAAsG;AACtG,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAC5D;CAAG;AAEJ;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,EAAkB,CAAC,gBAAgB,EAAE;IACzF,QAAQ,EAAE,YAAY;IACtB,GAAG,EAAE,MAAM;CACZ,CAAC;CAAG;AAQL,+DAA+D;AAC/D,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;AAGnE,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;AAQlD,6HAA6H;AAC7H,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAA4B,EAAE;IACtE,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAChG,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,QAA4C,EACrB,EAAE;IACzB,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,gBAAgB;YACnB,OAAO,SAAS,CAAC;QACnB,KAAK,mBAAmB;YACtB,QAAQ,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACjC,KAAK,iBAAiB;oBACpB,OAAO,SAAS,CAAC;gBACnB,KAAK,4BAA4B;oBAC/B,OAAO,cAAc,CAAC;YAC1B,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAAuB,EACvB,IAAqB,EAC8B,EAAE,CACrD,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;AAEhE,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC,MAAM,QAAQ,GAAG,CAAC,QAA+B,EAAE,IAAY,EAAU,EAAE;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,GAA0B,EAAE,CAAC,EAAE;QACvC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,KAAK;aACF,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,QAA4C,EAC5C,OAAwB,EACP,EAAE;IACnB,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,gBAAgB;YACnB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzF,KAAK,mBAAmB,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;YACvC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;gBACxB,KAAK,iBAAiB;oBACpB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3E,KAAK,4BAA4B;oBAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE;wBAC7B,aAAa,EAAE,UAAU,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE;wBAC3D,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,UAAU,CAAC;qBAC/E,CAAC,CAAC;YACP,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC"}

package/dist/node/egress-proxy.d.ts

@@ -0,0 +1,30 @@
+import { Effect, Schema } from "effect";
+import { CallerTokens } from "../caller/caller.ts";
+import { GatewaySettings, SettingsInForce } from "../settings.ts";
+import type { Listener } from "./environment.ts";
+declare const EgressProxyListenError_base: Schema.Class<EgressProxyListenError, Schema.TaggedStruct<"EgressProxyListenError", {
+    readonly host: Schema.String;
+    readonly port: Schema.Int;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The error when the forward proxy can't listen on its address. */
+export declare class EgressProxyListenError extends EgressProxyListenError_base {
+}
+/**
+ * Serves the forward proxy that Workers use for package registries and other allowlisted
+ * hosts: `CONNECT host:443` for HTTPS, and absolute-form requests (`GET http://host/...`) for
+ * plain HTTP mirrors such as apt.
+ *
+ * - A tunnel opens only after the ClientHello's server name matches the CONNECT host.
+ * - The proxy resolves names itself and refuses one that resolves to a private address.
+ * - Requests for `git.<domain>` and `llm.<domain>` on port 80 go to the reverse proxy at
+ *   `gateway`, so a client that proxies everything (Claude Code with `HTTPS_PROXY`) still
+ *   connects to them.
+ * - A caller token in `Proxy-Authorization` is optional and only identifies the Worker in logs.
+ * - Each refusal is logged with the host, reason, and client address.
+ * - Each request is checked against the allowlist current at arrival, so an open tunnel stays
+ *   open after a reload removes its host.
+ */
+export declare const serveEgressProxy: (listener: Listener, gateway: Listener) => Effect.Effect<Listener, EgressProxyListenError, CallerTokens | GatewaySettings | import("effect/Scope").Scope | SettingsInForce>;
+export {};
+//# sourceMappingURL=egress-proxy.d.ts.map

package/dist/node/egress-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-proxy.d.ts","sourceRoot":"","sources":["../../src/node/egress-proxy.ts"],"names":[],"mappings":"AAUA,OAAO,EAAQ,MAAM,EAAmC,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE/E,OAAO,EAA0B,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAK3E,OAAO,EAAE,eAAe,EAAgB,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;;;;;;AAqCjD,oEAAoE;AACpE,qBAAa,sBAAuB,SAAQ,2BAG3C;CAAG;AA4KJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,6KA0a3B,CAAC"}

package/dist/node/egress-proxy.js

@@ -0,0 +1,491 @@
+import { lookup } from "node:dns/promises";
+import { createServer, request as httpRequest, } from "node:http";
+import { BlockList, connect } from "node:net";
+import { Data, Effect, Fiber, Match, Option, Predicate, Schema } from "effect";
+import { Headers } from "effect/unstable/http";
+import { tokenFromAuthorization, CallerTokens } from "../caller/caller.js";
+import { ClientHelloReader, comparableHost } from "../egress/client-hello.js";
+import { EgressRefused } from "../egress/egress.js";
+import { endToEndHeaders } from "../proxy/forward.js";
+import { REFUSAL_HEADER } from "../proxy/proxy.js";
+import { GatewaySettings, gatewayHosts, SettingsInForce } from "../settings.js";
+/**
+ * Returns the ranges a public name must never resolve to: private, loopback, link-local,
+ * shared, multicast, and reserved. Node checks IPv4-mapped IPv6 addresses against the IPv4
+ * ranges, so there's no `::ffff:0:0/96` rule, which would match every IPv4 address.
+ */
+const privateAddresses = () => {
+    const list = new BlockList();
+    for (const [network, prefix] of [
+        ["0.0.0.0", 8],
+        ["10.0.0.0", 8],
+        ["100.64.0.0", 10],
+        ["127.0.0.0", 8],
+        ["169.254.0.0", 16],
+        ["172.16.0.0", 12],
+        ["192.0.0.0", 24],
+        ["192.168.0.0", 16],
+        ["198.18.0.0", 15],
+        ["224.0.0.0", 3],
+    ])
+        list.addSubnet(network, prefix, "ipv4");
+    for (const [network, prefix] of [
+        ["::", 127],
+        ["fc00::", 7],
+        ["fe80::", 10],
+        ["ff00::", 8],
+    ])
+        list.addSubnet(network, prefix, "ipv6");
+    return list;
+};
+/** The error when the DNS lookup of an allowed host fails or returns nothing. */
+class Unresolvable extends Schema.TaggedError()("Unresolvable", {
+    host: Schema.String,
+}) {
+}
+/** The error when the forward proxy can't listen on its address. */
+export class EgressProxyListenError extends Schema.TaggedError()("EgressProxyListenError", { host: Schema.String, port: Schema.Int, message: Schema.String }) {
+}
+/** The error when the upstream connection can't be opened or its response doesn't finish. */
+class Unreachable extends Schema.TaggedError()("Unreachable", {
+    host: Schema.String,
+    port: Schema.Int,
+    message: Schema.String,
+}) {
+}
+/**
+ * The error for a tunnel refused after `200 Connection Established`: the first bytes weren't a
+ * TLS ClientHello; the ClientHello had no server name, hid it with ECH, or had a different one
+ * than the CONNECT host; or the host resolved to a private address. `serverName` is the
+ * ClientHello's server name, if any.
+ */
+class TunnelRefused extends Data.TaggedError("TunnelRefused") {
+}
+/** The error when the client closes a tunnel before sending any bytes. */
+class TunnelAbandoned extends Data.TaggedError("TunnelAbandoned") {
+}
+/** A fatal TLS `unrecognized_name` alert (RFC 8446, section 6), sent so the client can report why the handshake ended. */
+const UNRECOGNIZED_NAME_ALERT = Buffer.from([0x15, 0x03, 0x03, 0x00, 0x02, 0x02, 0x70]);
+const CLIENT_HELLO_TIMEOUT = "5 seconds";
+const notTls = (detail) => new TunnelRefused({ reason: "not-tls", detail, serverName: Option.none() });
+/**
+ * Buffers a tunnel's first bytes, including `head`, until they contain a complete ClientHello
+ * (at most 16 KiB and five seconds), then pauses the client so nothing more is read before the
+ * upstream connection exists. Fails with `TunnelAbandoned` if the client closes before sending
+ * any bytes.
+ */
+const clientHello = (client, head) => Effect.callback((resume) => {
+    const reader = new ClientHelloReader();
+    const stop = () => {
+        client.off("data", onData);
+        client.off("end", onEnd);
+        client.off("close", onEnd);
+    };
+    function onData(chunk) {
+        const read = reader.push(chunk);
+        if (read._tag === "Incomplete")
+            return;
+        stop();
+        client.pause();
+        if (read._tag === "NotTls")
+            return resume(Effect.fail(notTls(read.detail)));
+        resume(Effect.succeed({
+            buffered: Buffer.from(reader.bytes),
+            serverName: read.serverName,
+            encryptedClientHello: read.encryptedClientHello,
+        }));
+    }
+    function onEnd() {
+        stop();
+        resume(Effect.fail(reader.bytes.length === 0
+            ? new TunnelAbandoned()
+            : notTls("the client closed the tunnel before its ClientHello was complete")));
+    }
+    client.on("data", onData);
+    client.once("end", onEnd);
+    client.once("close", onEnd);
+    if (head.length > 0)
+        onData(head);
+    return Effect.sync(stop);
+}).pipe(Effect.timeoutOrElse({
+    duration: CLIENT_HELLO_TIMEOUT,
+    orElse: () => Effect.fail(notTls("no ClientHello arrived within five seconds")),
+}));
+/**
+ * Checks that the ClientHello's server name is the CONNECT host, so a tunnel to a shared CDN
+ * address can't connect to another tenant of that address.
+ */
+const pinnedServerName = (host, hello) => {
+    if (hello.encryptedClientHello)
+        return Effect.fail(new TunnelRefused({
+            reason: "server-name-missing",
+            detail: "the ClientHello encrypts its server name (ECH), so it cannot be checked",
+            serverName: hello.serverName,
+        }));
+    if (Option.isNone(hello.serverName))
+        return Effect.fail(new TunnelRefused({
+            reason: "server-name-missing",
+            detail: "the ClientHello names no server",
+            serverName: Option.none(),
+        }));
+    const serverName = hello.serverName.value;
+    return comparableHost(serverName) === comparableHost(host)
+        ? Effect.succeed({ buffered: hello.buffered, serverName })
+        : Effect.fail(new TunnelRefused({
+            reason: "server-name-mismatch",
+            detail: `the ClientHello asks for ${serverName}, not the CONNECT host`,
+            serverName: hello.serverName,
+        }));
+};
+const RelayEnd = Data.taggedEnum();
+const AUTHORITY = /^(?:\[([0-9a-fA-F:.]+)\]|([^:[\]]+)):(\d{1,5})$/u;
+const parseAuthority = (authority) => {
+    const match = AUTHORITY.exec(authority);
+    const host = match?.[1] ?? match?.[2];
+    if (match === null || host === undefined)
+        return Option.none();
+    return Option.some({ host, port: Number(match[3]) });
+};
+const statusLine = (status, reason, body, refusal) => [
+    `HTTP/1.1 ${status} ${reason}`,
+    "Content-Type: text/plain; charset=utf-8",
+    `Content-Length: ${Buffer.byteLength(body)}`,
+    ...Option.match(refusal, {
+        onNone: () => [],
+        onSome: (value) => [`${REFUSAL_HEADER}: ${value}`],
+    }),
+    "Connection: close",
+    "",
+    body,
+].join("\r\n");
+/**
+ * Serves the forward proxy that Workers use for package registries and other allowlisted
+ * hosts: `CONNECT host:443` for HTTPS, and absolute-form requests (`GET http://host/...`) for
+ * plain HTTP mirrors such as apt.
+ *
+ * - A tunnel opens only after the ClientHello's server name matches the CONNECT host.
+ * - The proxy resolves names itself and refuses one that resolves to a private address.
+ * - Requests for `git.<domain>` and `llm.<domain>` on port 80 go to the reverse proxy at
+ *   `gateway`, so a client that proxies everything (Claude Code with `HTTPS_PROXY`) still
+ *   connects to them.
+ * - A caller token in `Proxy-Authorization` is optional and only identifies the Worker in logs.
+ * - Each refusal is logged with the host, reason, and client address.
+ * - Each request is checked against the allowlist current at arrival, so an open tunnel stays
+ *   open after a reload removes its host.
+ */
+export const serveEgressProxy = Effect.fn("EgressProxy.serve")(function* (listener, gateway) {
+    const settings = yield* GatewaySettings;
+    const ownHosts = new Set(Object.values(gatewayHosts(settings.domain)));
+    const inForce = yield* SettingsInForce;
+    const callers = yield* CallerTokens;
+    const blocked = privateAddresses();
+    const scope = yield* Effect.scope;
+    const context = yield* Effect.context();
+    /** Returns the log fields for a request's caller: the Worker from a valid caller token, if any. */
+    const caller = (value) => Option.fromNullishOr(value).pipe(Option.flatMap(tokenFromAuthorization), Option.match({
+        onNone: () => Effect.succeed({ caller: "none" }),
+        onSome: (token) => callers.verify(token).pipe(Effect.map(({ worker }) => ({ worker })), Effect.orElseSucceed(() => ({ caller: "invalid-token" }))),
+    }));
+    const logRefusal = (refusal, client, who) => Effect.logWarning("Gateway refused a request", {
+        reason: refusal.reason,
+        host: refusal.host,
+        port: refusal.port,
+        client,
+        ...who,
+    });
+    /** Resolves an allowed host and returns its first address. Fails if any address is private. */
+    const resolve = Effect.fn("EgressProxy.resolve")(function* (permitted) {
+        const addresses = yield* Effect.tryPromise({
+            try: () => lookup(permitted.host, { all: true, verbatim: true }),
+            catch: () => new Unresolvable({ host: permitted.host }),
+        });
+        const first = addresses[0];
+        if (first === undefined)
+            return yield* new Unresolvable({ host: permitted.host });
+        if (addresses.some(({ address, family }) => blocked.check(address, family === 6 ? "ipv6" : "ipv4")))
+            return yield* Effect.fail(new EgressRefused({
+                host: permitted.host,
+                port: permitted.port,
+                reason: "private-address",
+            }));
+        return first.address;
+    });
+    const decide = (host, port) => Effect.flatMap(inForce.current, ({ egress }) => {
+        const decision = egress.decide(host, port);
+        return decision._tag === "EgressRefused" ? Effect.fail(decision) : Effect.succeed(decision);
+    });
+    /** Returns the target for `host` on `port`: the reverse proxy for the Gateway's own names, otherwise the resolved allowed host. */
+    const destination = (host, port) => ownHosts.has(host.toLowerCase()) && port === 80
+        ? Effect.succeed({ address: gateway.host, port: gateway.port, kind: "gateway" })
+        : decide(host, port).pipe(Effect.flatMap(resolve), Effect.map((address) => ({ address, port, kind: "egress" })));
+    const openTunnel = (address, port, host) => Effect.callback((resume) => {
+        const socket = connect({ host: address, port });
+        const onError = (error) => resume(Effect.fail(new Unreachable({ host, port, message: error.message })));
+        socket.once("error", onError);
+        socket.once("connect", () => {
+            socket.off("error", onError);
+            resume(Effect.succeed(socket));
+        });
+        return Effect.sync(() => socket.destroy());
+    });
+    /** Copies bytes both ways until either side closes, then closes both. */
+    const splice = (client, upstream) => Effect.callback((resume) => {
+        const close = () => {
+            client.destroy();
+            upstream.destroy();
+            resume(Effect.void);
+        };
+        client.on("error", close).on("close", close);
+        upstream.on("error", close).on("close", close);
+        client.pipe(upstream);
+        upstream.pipe(client);
+        return Effect.sync(close);
+    });
+    /** Closes a tunnel refused after its `200 Connection Established`. */
+    const closeRefused = (client, refusal) => {
+        if (refusal.reason === "not-tls")
+            client.destroy();
+        else
+            client.end(UNRECOGNIZED_NAME_ALERT);
+    };
+    const tunnel = Effect.fn("EgressProxy.tunnel")(function* (request, client, head) {
+        const from = request.socket.remoteAddress ?? "unknown";
+        const who = yield* caller(request.headers["proxy-authorization"]);
+        const authority = parseAuthority(request.url ?? "");
+        if (Option.isNone(authority)) {
+            client.end(statusLine(400, "Bad Request", "Expected CONNECT host:port\n", Option.none()));
+            return yield* Effect.logWarning("Gateway refused a request", {
+                reason: "malformed-connect",
+                client: from,
+                ...who,
+            });
+        }
+        const { host, port } = authority.value;
+        yield* Effect.annotateCurrentSpan({ host, port });
+        if (ownHosts.has(comparableHost(host)) && port === 80) {
+            const opened = yield* openTunnel(gateway.host, gateway.port, host).pipe(Effect.result);
+            if (opened._tag === "Failure") {
+                client.end(statusLine(502, "Bad Gateway", "usine gateway: the reverse proxy is unreachable.\n", Option.none()));
+                return yield* Effect.logError("The gateway's reverse proxy could not be reached", {
+                    host,
+                    port,
+                    client: from,
+                    ...who,
+                    error: opened.failure._tag,
+                });
+            }
+            client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+            if (head.length > 0)
+                opened.success.write(head);
+            yield* Effect.logInfo("Opened an egress tunnel", {
+                host,
+                port,
+                destination: "gateway",
+                client: from,
+                ...who,
+            });
+            return yield* splice(client, opened.success);
+        }
+        const decision = (yield* inForce.current).egress.decide(host, port);
+        // Only port 443 tunnels are allowed; plain HTTP goes through the absolute-form relay, which checks the host.
+        if (decision._tag === "EgressRefused" || port !== 443) {
+            const refused = decision._tag === "EgressRefused"
+                ? decision
+                : new EgressRefused({ host, port, reason: "port-not-allowed" });
+            client.end(statusLine(403, "Forbidden", `usine gateway: ${host}:${port} is refused (${refused.reason}).\n`, Option.some(refused.reason)));
+            return yield* logRefusal(refused, from, who);
+        }
+        // The client sends its ClientHello after this line; no upstream connection is opened until its server name is checked.
+        client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        const opened = yield* clientHello(client, head).pipe(Effect.flatMap((hello) => pinnedServerName(host, hello)), Effect.flatMap(({ buffered, serverName }) => resolve(decision).pipe(Effect.catchTag("EgressRefused", (refused) => Effect.fail(new TunnelRefused({
+            reason: "private-address",
+            detail: `${refused.host} resolves to a private address`,
+            serverName: Option.some(serverName),
+        }))), Effect.flatMap((address) => openTunnel(address, port, decision.host)), Effect.map((upstream) => ({ upstream, buffered, serverName })))), Effect.result);
+        if (opened._tag === "Failure") {
+            const failure = opened.failure;
+            if (failure._tag === "TunnelAbandoned") {
+                client.destroy();
+                return yield* Effect.logInfo("The client abandoned a tunnel before sending anything", {
+                    host,
+                    port,
+                    client: from,
+                    ...who,
+                });
+            }
+            if (failure._tag === "TunnelRefused") {
+                closeRefused(client, failure);
+                return yield* Effect.logWarning("Gateway refused a request", {
+                    reason: failure.reason,
+                    host,
+                    port,
+                    serverName: Option.getOrElse(failure.serverName, () => "none"),
+                    detail: failure.detail,
+                    client: from,
+                    ...who,
+                });
+            }
+            client.destroy();
+            return yield* Effect.logError("An allowed egress host could not be reached", {
+                host,
+                port,
+                client: from,
+                ...who,
+                error: failure._tag,
+            });
+        }
+        const { upstream, buffered, serverName } = opened.success;
+        upstream.write(buffered);
+        yield* Effect.logInfo("Opened an egress tunnel", {
+            host,
+            port,
+            serverName,
+            destination: "egress",
+            client: from,
+            ...who,
+        });
+        yield* splice(client, upstream);
+    });
+    const relay = Effect.fn("EgressProxy.relay")(function* (request, response) {
+        const from = request.socket.remoteAddress ?? "unknown";
+        const who = yield* caller(request.headers["proxy-authorization"]);
+        const url = Option.liftThrowable(() => new URL(request.url ?? ""))().pipe(Option.filter((parsed) => parsed.protocol === "http:"));
+        if (Option.isNone(url)) {
+            response.writeHead(400, { "content-type": "text/plain; charset=utf-8" });
+            response.end("usine gateway: the forward proxy accepts only CONNECT or an absolute http:// URL.\n");
+            return yield* Effect.logWarning("Gateway refused a request", {
+                reason: "not-a-proxy-request",
+                client: from,
+                ...who,
+            });
+        }
+        const port = url.value.port === "" ? 80 : Number(url.value.port);
+        const host = url.value.hostname.replace(/^\[(.*)\]$/u, "$1");
+        yield* Effect.annotateCurrentSpan({ host, port });
+        const forwarded = endToEndHeaders(Headers.fromInput(request.headers));
+        /**
+         * Sends the request to `target` and copies the response back until it ends or the client
+         * disconnects. If the client disconnects mid-transfer, destroys the upstream connection
+         * immediately. Fails with `Unreachable` if the upstream connection fails or ends early, after
+         * the client's response is destroyed or set to 502.
+         */
+        const copy = (target, headers) => Effect.callback((resume) => {
+            let settled = false;
+            const settle = (end) => {
+                settled = true;
+                resume(end);
+            };
+            const fail = (error) => {
+                if (settled)
+                    return;
+                if (response.headersSent)
+                    response.destroy();
+                else {
+                    response.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+                    response.end();
+                }
+                settle(Effect.fail(new Unreachable({ host, port, message: error.message })));
+            };
+            const outgoing = httpRequest({
+                host: target.address,
+                port: target.port,
+                method: request.method,
+                path: `${url.value.pathname}${url.value.search}`,
+                headers: { ...headers, host: url.value.host },
+                setHost: false,
+            }, (incoming) => {
+                const status = incoming.statusCode ?? 502;
+                response.writeHead(status, {
+                    ...endToEndHeaders(Headers.fromInput(incoming.headers)),
+                });
+                incoming.once("error", fail);
+                incoming.once("close", () => {
+                    if (!incoming.complete)
+                        fail(new Error("The upstream response ended prematurely"));
+                });
+                incoming.once("end", () => settle(Effect.succeed(RelayEnd.Relayed({ status }))));
+                incoming.pipe(response);
+            });
+            // `close` also fires after a finished response, which already completed the relay; before that, it means the client disconnected.
+            response.once("close", () => {
+                if (settled)
+                    return;
+                outgoing.destroy();
+                settle(Effect.succeed(RelayEnd.Abandoned({
+                    status: response.headersSent ? Option.some(response.statusCode) : Option.none(),
+                })));
+            });
+            outgoing.once("error", fail);
+            request.pipe(outgoing);
+            return Effect.sync(() => outgoing.destroy());
+        });
+        const relayed = yield* destination(host, port).pipe(Effect.flatMap((target) => 
+        // Only the reverse proxy receives the caller token; hosts outside the Gateway must never receive it.
+        (target.kind === "gateway"
+            ? Effect.succeed(forwarded)
+            : callers.withoutCallerTokens(forwarded)).pipe(Effect.map((headers) => ({ target, headers })))), Effect.flatMap(({ target, headers }) => copy(target, headers).pipe(Effect.map((end) => ({ end, kind: target.kind })))), Effect.result);
+        if (relayed._tag === "Success") {
+            const fields = {
+                host,
+                port,
+                destination: relayed.success.kind,
+                method: request.method ?? "GET",
+                client: from,
+                ...who,
+            };
+            return yield* Match.valueTags(relayed.success.end, {
+                Relayed: ({ status }) => Effect.logInfo("Relayed a plain HTTP request", { ...fields, status }),
+                Abandoned: ({ status }) => Effect.logInfo("The client abandoned a relayed request", {
+                    ...fields,
+                    status: Option.getOrElse(status, () => "none"),
+                }),
+            });
+        }
+        const failure = relayed.failure;
+        if (failure._tag === "EgressRefused") {
+            response.writeHead(403, {
+                "content-type": "text/plain; charset=utf-8",
+                [REFUSAL_HEADER]: failure.reason,
+            });
+            response.end(`usine gateway: ${host}:${port} is refused (${failure.reason}).\n`);
+            return yield* logRefusal(failure, from, who);
+        }
+        if (!response.headersSent) {
+            response.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+            response.end(`usine gateway: ${host} is unreachable.\n`);
+        }
+        yield* Effect.logError("An allowed egress host could not be reached", {
+            host,
+            port,
+            client: from,
+            ...who,
+            error: failure._tag,
+        });
+    });
+    const server = createServer({ requestTimeout: 0 });
+    const run = (effect) => Fiber.runIn(Effect.runForkWith(context)(effect), scope);
+    server.on("connect", (request, client, head) => {
+        client.on("error", () => client.destroy());
+        // The server's sockets are half-open, so `server.close` waits for an interrupted tunnel until its client socket is destroyed.
+        run(tunnel(request, client, head).pipe(Effect.onInterrupt(() => Effect.sync(() => client.destroy()))));
+    });
+    server.on("request", (request, response) => run(relay(request, response)));
+    yield* Effect.acquireRelease(Effect.callback((resume) => {
+        server.once("error", (error) => resume(Effect.fail(new EgressProxyListenError({
+            host: listener.host,
+            port: listener.port,
+            message: error.message,
+        }))));
+        server.listen(listener.port, listener.host, () => resume(Effect.void));
+    }), () => Effect.callback((resume) => {
+        server.close(() => resume(Effect.void));
+        server.closeAllConnections();
+    }));
+    const address = server.address();
+    const bound = address === null || Predicate.isString(address)
+        ? listener
+        : { host: address.address, port: address.port };
+    yield* Effect.logInfo("The egress proxy is listening", bound);
+    return bound;
+});
+//# sourceMappingURL=egress-proxy.js.map