@usine/gateway 0.0.0-stage → 0.1.0

package/dist/node/reload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reload.js","sourceRoot":"","sources":["../../src/node/reload.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,cAAc,EACd,OAAO,EACP,MAAM,EACN,UAAU,EACV,KAAK,EACL,MAAM,EACN,KAAK,EACL,QAAQ,EACR,SAAS,GACV,MAAM,QAAQ,CAAC;AAGhB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAElB,eAAe,GAGhB,MAAM,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAS/C,CAAC,mCAAmC,CAAC;CAAG;AAE3C,wEAAwE;AACxE,MAAM,aAAa,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAmB,EAAE,EAAE,CAAC,CAAC;IACxF,oBAAoB,EAAE,MAAM;IAC5B,yBAAyB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;IACrD,wBAAwB,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;IACnD,wBAAwB,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI;IAC9C,wBAAwB,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;IACtD,yBAAyB,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;IAChD,yBAAyB,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IACxD,wBAAwB,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI;IAC9C,wBAAwB,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;CACvD,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAgB,EAAE,EAAE;IAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CACtC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CACzD,CAAC;IACF,OAAO;QACL,iBAAiB,EACf,UAAU,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACrF,0CAA0C,EACxC,UAAU,EAAE,IAAI,KAAK,4BAA4B;YAC/C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAClC,CAAC,CAAC,SAAS;QACf,cAAc,EAAE,MAAM,CAAC,cAAc,CACnC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAC/D;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,qGAAqG;AACrG,MAAM,gBAAgB,GAAG,CAAC,MAAoB,EAAE,KAAmB,EAAyB,EAAE;IAC5F,MAAM,OAAO,GAAG,CACd,GAAiD,EACjD,EAAgD,EAChD,EAAE,CACF,MAAM,CAAC,SAAS,CACd,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,EAC1E,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;IACJ,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC;AACJ,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,CACvB,MAAoD,EACpD,KAAmD,EAC5B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAE/F,gFAAgF;AAChF,MAAM,oBAAoB,GAAG,CAAC,OAAwB,EAAE,EAAE,CACxD,eAAe,CAAC,IAAI,CAClB,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;IACrB,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,wDAAwD,EAAE;YAC1E,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;AACT,CAAC,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CACvC,MAAM,CAAC,UAAU,CAAC,iEAAiE,EAAE;IACnF,KAAK,EAAE,KAAK,CAAC,OAAO;CACrB,CAAC,CACH,CACF,CAAC;AAEJ,gGAAgG;AAChG,MAAM,aAAa,GAAG,CAAC,QAAyB,EAAE,EAAE,CAClD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,oHAAoH;IACpH,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,MAAiD,EAAE,EAAE,CACjE,MAAM,CAAC,QAAQ,CAAC,oCAAoC,EAAE;QACpD,IAAI;QACJ,GAAG,MAAM;QACT,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;KAC7B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAmB,EAAE,CAAC,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAC/D,MAAM,CAAC,SAAS,CAAC;QACf,oBAAoB,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC3E,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACzD,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,EAAE,CACtC,MAAM,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAgB,CAAC,CACvC,CAAC;AAEJ,2DAA2D;AAC3D,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CACrC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EACvB,MAAM,CAAC,SAAS,CAAC;IACf,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC;IACpD,+BAA+B,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC;CACzE,CAAC,CACH,CAAC;AAEF,wHAAwH;AACxH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAwB,EAAE,IAAmC,EAAE,EAAE,CAClG,KAAK,CAAC,MAAM,CACV,aAAa,EACb,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3D,MAAM,sBAAsB,GAAoB;QAC9C,MAAM;QACN,UAAU;QACV,SAAS;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,MAAsB,EAAE,EAAE,CAC5C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,KAAK,CAAC,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;QACvC,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACjE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;SACjE,CAAC;QACF,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,+BAA+B,EAAE;YACrD,gBAAgB,EAAE,MAAM,CAAC,KAAK;YAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;YAChE,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;YAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;YACzD,OAAO,EAAE;gBACP,GAAG,gBAAgB,CACjB,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EACpC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CACjC;gBACD,GAAG,gBAAgB,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;aACxD;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC;QACtD,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,CAClC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAC1B,MAAM,CAAC,SAAS,CAAC;YACf,oBAAoB,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1C,MAAM,CAAC,QAAQ,CAAC,kEAAkE,EAAE;gBAClF,IAAI;gBACJ,KAAK,EAAE,OAAO;aACf,CAAC;YACJ,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC3B,MAAM,CAAC,QAAQ,CAAC,8DAA8D,EAAE;gBAC9E,KAAK,EAAE,OAAO;aACf,CAAC;SACL,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,UAAU;aACf,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACxB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,CAC/C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAO,CAAC,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EACjD,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CACzD,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,IAAI,CAChF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IACtB,8DAA8D;IAC9D,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CACnE,CACF,CAAC;IACF,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;AACjG,CAAC,CAAC,CACH,CAAC"}

package/dist/proxy/forward.d.ts

@@ -0,0 +1,12 @@
+import { Effect } from "effect";
+import { Headers, HttpClient, type HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+/** Returns `headers` without hop-by-hop headers, including those listed in `Connection`. */
+export declare const endToEndHeaders: (headers: Headers.Headers) => Headers.Headers;
+/**
+ * Sends `request` to `upstream` with `headers` and streams the response back unchanged:
+ * status, end-to-end headers, and body bytes, including any `content-encoding`. Bodies stream
+ * in both directions without buffering. The client span is disabled, so no header value is
+ * recorded in a trace.
+ */
+export declare const forwardRequest: (client: HttpClient.HttpClient, request: HttpServerRequest.HttpServerRequest, upstream: string, headers: Headers.Headers) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("effect/unstable/http/HttpClientError").HttpClientError, never>;
+//# sourceMappingURL=forward.d.ts.map

package/dist/proxy/forward.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.d.ts","sourceRoot":"","sources":["../../src/proxy/forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EACL,OAAO,EACP,UAAU,EAEV,KAAK,iBAAiB,EACtB,kBAAkB,EACnB,MAAM,sBAAsB,CAAC;AAiB9B,4FAA4F;AAC5F,eAAO,MAAM,eAAe,YAAa,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,OASlE,CAAC;AASF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,WACjB,UAAU,CAAC,UAAU,WACpB,iBAAiB,CAAC,iBAAiB,YAClC,MAAM,WACP,OAAO,CAAC,OAAO,gIAezB,CAAC"}

package/dist/proxy/forward.js

@@ -0,0 +1,44 @@
+import { Effect, Option } from "effect";
+import { Headers, HttpClient, HttpClientRequest, HttpServerResponse, } from "effect/unstable/http";
+/** Connection-level headers that are never forwarded (RFC 9110, section 7.6.1). */
+const HOP_BY_HOP = [
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "expect",
+    "host",
+];
+/** Returns `headers` without hop-by-hop headers, including those listed in `Connection`. */
+export const endToEndHeaders = (headers) => {
+    const listed = Option.match(Headers.get(headers, "connection"), {
+        onNone: () => [],
+        onSome: (value) => value.split(",").map((name) => name.trim().toLowerCase()),
+    });
+    return [...HOP_BY_HOP, ...listed].reduce((remaining, name) => Headers.remove(remaining, name), headers);
+};
+const hasBody = (request) => Option.isSome(Headers.get(request.headers, "transfer-encoding")) ||
+    Option.match(Headers.get(request.headers, "content-length"), {
+        onNone: () => false,
+        onSome: (length) => length.trim() !== "0",
+    });
+/**
+ * Sends `request` to `upstream` with `headers` and streams the response back unchanged:
+ * status, end-to-end headers, and body bytes, including any `content-encoding`. Bodies stream
+ * in both directions without buffering. The client span is disabled, so no header value is
+ * recorded in a trace.
+ */
+export const forwardRequest = (client, request, upstream, headers) => {
+    const base = HttpClientRequest.make(request.method)(upstream);
+    const outgoing = (hasBody(request) ? HttpClientRequest.bodyStream(base, request.stream) : base).pipe(HttpClientRequest.setHeaders(headers));
+    return client.execute(outgoing).pipe(Effect.provideService(HttpClient.TracerDisabledWhen, () => true), Effect.map((response) => HttpServerResponse.stream(response.stream, {
+        status: response.status,
+        headers: endToEndHeaders(response.headers),
+    })));
+};
+//# sourceMappingURL=forward.js.map

package/dist/proxy/forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../../src/proxy/forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EACL,OAAO,EACP,UAAU,EACV,iBAAiB,EAEjB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,mFAAmF;AACnF,MAAM,UAAU,GAAG;IACjB,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;IAClB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,QAAQ;IACR,MAAM;CACE,CAAC;AAEX,4FAA4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAwB,EAAmB,EAAE;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QAC9D,MAAM,EAAE,GAA0B,EAAE,CAAC,EAAE;QACvC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;KAC7E,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,CACtC,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EACpD,OAAO,CACR,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,OAA4C,EAAW,EAAE,CACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE;QAC3D,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;QACnB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG;KAC1C,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAA6B,EAC7B,OAA4C,EAC5C,QAAgB,EAChB,OAAwB,EACxB,EAAE;IACF,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,CACf,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAChE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;QACzC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;KAC3C,CAAC,CACH,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/proxy/proxy.d.ts

@@ -0,0 +1,28 @@
+import { Context, Effect, Layer, Schema } from "effect";
+import { HttpClient, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+import { Attachments } from "../attachment/store.ts";
+import { CallerTokens } from "../caller/caller.ts";
+import { GatewaySettings, SettingsInForce } from "../settings.ts";
+/**
+ * The reason the Gateway refused a request. Each refusal is logged at warning level with the
+ * reason, host, and Worker (if known), and returned in `x-usine-gateway-refusal`.
+ */
+export declare const RefusalReason: Schema.Literals<readonly ["unknown-host", "unsupported-path", "missing-caller-token", "invalid-caller-token", "stale-caller-token", "attachment-expired", "repository-mismatch", "provider-not-configured"]>;
+export type RefusalReason = typeof RefusalReason.Type;
+/** The response header that contains the refusal reason. */
+export declare const REFUSAL_HEADER = "x-usine-gateway-refusal";
+declare const GatewayProxy_base: Context.ServiceClass<GatewayProxy, "@usine/gateway/GatewayProxy", {
+    /** Forwards one Worker request with the attached credential, or refuses and logs it. */
+    readonly handle: Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest>;
+}>;
+/**
+ * The reverse proxy for Worker VMs on the private network. `git.<domain>` serves GitHub with
+ * the attached installation token, and `llm.<domain>` serves the LLM providers with the
+ * current credentials. Every request must have a caller token for an active attachment; other
+ * hosts are refused.
+ */
+export declare class GatewayProxy extends GatewayProxy_base {
+    static readonly layer: Layer.Layer<GatewayProxy, never, Attachments | CallerTokens | GatewaySettings | HttpClient.HttpClient | SettingsInForce>;
+}
+export {};
+//# sourceMappingURL=proxy.d.ts.map

package/dist/proxy/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy/proxy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAyB,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrF,OAAO,EAEL,UAAU,EAEV,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAEL,YAAY,EAGb,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EAAE,eAAe,EAAgB,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGhF;;;GAGG;AACH,eAAO,MAAM,aAAa,8MASxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAEtD,4DAA4D;AAC5D,eAAO,MAAM,cAAc,4BAA4B,CAAC;;IA6DpD,wFAAwF;qBACvE,MAAM,CAAC,MAAM,CAC5B,kBAAkB,CAAC,kBAAkB,EACrC,KAAK,EACL,iBAAiB,CAAC,iBAAiB,CACpC;;AAdL;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,iBAUA;IAChC,MAAM,CAAC,QAAQ,CAAC,KAAK,2HAgKnB;CACH"}

package/dist/proxy/proxy.js

@@ -0,0 +1,189 @@
+import { canonicalRepositoryName } from "@usine/core/repository";
+import { Context, Data, Effect, Layer, Match, Option, Result, Schema } from "effect";
+import { Headers, HttpClient, HttpServerRequest, HttpServerResponse, } from "effect/unstable/http";
+import { Attachments } from "../attachment/store.js";
+import { CallerTokens, presentedToken, withoutCallerCredentials, } from "../caller/caller.js";
+import { GITHUB_HOSTS, githubRoute, withGitHubCredential, } from "../github/github.js";
+import { configuredProvider, llmTarget, withProviderCredential } from "../llm/llm.js";
+import { GatewaySettings, gatewayHosts, SettingsInForce } from "../settings.js";
+import { endToEndHeaders, forwardRequest } from "./forward.js";
+/**
+ * The reason the Gateway refused a request. Each refusal is logged at warning level with the
+ * reason, host, and Worker (if known), and returned in `x-usine-gateway-refusal`.
+ */
+export const RefusalReason = Schema.Literals([
+    "unknown-host",
+    "unsupported-path",
+    "missing-caller-token",
+    "invalid-caller-token",
+    "stale-caller-token",
+    "attachment-expired",
+    "repository-mismatch",
+    "provider-not-configured",
+]);
+/** The response header that contains the refusal reason. */
+export const REFUSAL_HEADER = "x-usine-gateway-refusal";
+const REFUSAL_STATUS = {
+    "unknown-host": 404,
+    "unsupported-path": 404,
+    "missing-caller-token": 401,
+    "invalid-caller-token": 401,
+    "stale-caller-token": 403,
+    "attachment-expired": 403,
+    "repository-mismatch": 403,
+    "provider-not-configured": 503,
+};
+/** A refusal, with the caller's claims once its token is verified. */
+class Refused extends Data.TaggedError("Refused") {
+}
+/** Returns a refusal for a request whose caller token isn't verified yet. */
+const refused = (reason, message) => new Refused({ reason, message, caller: Option.none() });
+/** Returns a refusal for a verified caller. */
+const refusedCaller = (claims, reason, message) => new Refused({ reason, message, caller: Option.some(claims) });
+/** Returns the target from an origin-form request and its `Host`, or from an absolute-form URL. */
+const requestTarget = (request) => {
+    const parse = (base) => Result.getSuccess(Result.try(() => new URL(request.url, base)));
+    return parse().pipe(Option.orElse(() => Option.flatMap(Headers.get(request.headers, "host"), (host) => parse(`http://${host}`))), Option.map((url) => ({
+        host: url.hostname.toLowerCase(),
+        pathname: url.pathname,
+        search: url.search,
+    })));
+};
+/**
+ * The reverse proxy for Worker VMs on the private network. `git.<domain>` serves GitHub with
+ * the attached installation token, and `llm.<domain>` serves the LLM providers with the
+ * current credentials. Every request must have a caller token for an active attachment; other
+ * hosts are refused.
+ */
+export class GatewayProxy extends Context.Service()("@usine/gateway/GatewayProxy") {
+    static layer = Layer.effect(GatewayProxy, Effect.gen(function* () {
+        const settings = yield* GatewaySettings;
+        const inForce = yield* SettingsInForce;
+        const attachments = yield* Attachments;
+        const callers = yield* CallerTokens;
+        const client = yield* HttpClient.HttpClient;
+        const hosts = gatewayHosts(settings.domain);
+        const authenticate = Effect.fn("GatewayProxy.authenticate")(function* (request) {
+            const presented = presentedToken(request.headers);
+            if (Option.isNone(presented))
+                return yield* refused("missing-caller-token", "The request has no gateway caller token.");
+            const claims = yield* callers
+                .verify(presented.value)
+                .pipe(Effect.mapError(({ reason }) => refused("invalid-caller-token", `The gateway didn't issue this caller token (${reason}).`)));
+            yield* Effect.annotateCurrentSpan({
+                attachment: claims.attachment,
+                worker: claims.worker,
+                repository: claims.repository,
+            });
+            const stale = refusedCaller(claims, "stale-caller-token", `The caller token belongs to attachment ${claims.attachment} of ${claims.repository} on worker "${claims.worker}", which is no longer attached.`);
+            const lookup = yield* attachments.find(claims.attachment);
+            return yield* Match.valueTags(lookup, {
+                LiveAttachment: ({ attachment }) => attachment.worker === claims.worker &&
+                    canonicalRepositoryName(attachment.repository) ===
+                        canonicalRepositoryName(claims.repository)
+                    ? Effect.succeed({ claims, attachment })
+                    : Effect.fail(stale),
+                ExpiredAttachment: () => Effect.fail(refusedCaller(claims, "attachment-expired", `The attachment of ${claims.repository} to worker "${claims.worker}" has expired.`)),
+                MissingAttachment: () => Effect.fail(stale),
+            });
+        });
+        const github = Effect.fn("GatewayProxy.github")(function* (request, target, host) {
+            const { claims, attachment } = yield* authenticate(request);
+            const route = githubRoute(settings.github, host, target.pathname, target.search);
+            if (Option.isNone(route))
+                return yield* refusedCaller(claims, "unsupported-path", `The gateway serves Git smart HTTP and the GitHub API, not ${target.pathname}.`);
+            const named = route.value.repository;
+            if (Option.isSome(named) &&
+                canonicalRepositoryName(named.value) !== canonicalRepositoryName(claims.repository))
+                return yield* refusedCaller(claims, "repository-mismatch", `The caller token was issued for ${claims.repository}, not ${named.value}.`);
+            const headers = withGitHubCredential(route.value, attachment.credential, withoutCallerCredentials(endToEndHeaders(request.headers)));
+            const response = yield* forwardRequest(client, request, route.value.upstream, headers);
+            yield* forwarded("Forwarded a GitHub request", request, target, attachment, response, {
+                protocol: route.value.protocol,
+            });
+            return response;
+        });
+        const llm = Effect.fn("GatewayProxy.llm")(function* (request, target) {
+            const { claims, attachment } = yield* authenticate(request);
+            const destination = llmTarget(target.pathname);
+            if (Option.isNone(destination))
+                return yield* refusedCaller(claims, "unsupported-path", `The gateway serves /anthropic and /openai on ${hosts.llm}, not ${target.pathname}.`);
+            const { providers } = yield* inForce.current;
+            const provider = configuredProvider(providers, destination.value.provider);
+            if (Option.isNone(provider))
+                return yield* refusedCaller(claims, "provider-not-configured", `The gateway has no credential for ${destination.value.provider}.`);
+            const headers = withProviderCredential(provider.value, withoutCallerCredentials(endToEndHeaders(request.headers)));
+            const upstream = `${provider.value.upstream}${destination.value.rest}${target.search}`;
+            const response = yield* forwardRequest(client, request, upstream, headers);
+            yield* forwarded("Forwarded an LLM request", request, target, attachment, response, {
+                provider: destination.value.provider,
+            });
+            return response;
+        });
+        const route = (request, target) => {
+            if (target.host === hosts.git)
+                return github(request, target, "gateway");
+            const githubHost = GITHUB_HOSTS.get(target.host);
+            if (githubHost !== undefined)
+                return github(request, target, githubHost);
+            if (target.host === hosts.llm)
+                return llm(request, target);
+            return Effect.fail(refused("unknown-host", `The gateway serves ${hosts.git} and ${hosts.llm}, not ${target.host}. Send requests for other hosts through the forward proxy.`));
+        };
+        const handle = Effect.gen(function* () {
+            const request = yield* HttpServerRequest.HttpServerRequest;
+            const target = requestTarget(request);
+            if (Option.isNone(target)) {
+                const error = refused("unknown-host", "The request has no host.");
+                yield* Effect.logWarning("Gateway refused a request", {
+                    reason: error.reason,
+                    method: request.method,
+                    client: clientAddress(request),
+                });
+                return refusalResponse(error);
+            }
+            yield* Effect.annotateCurrentSpan({ host: target.value.host, method: request.method });
+            return yield* route(request, target.value).pipe(Effect.catchTags({
+                Refused: (error) => logRefusal(request, target.value, error).pipe(Effect.as(refusalResponse(error))),
+                HttpClientError: (error) => upstreamFailure(request, target.value, error),
+            }));
+        }).pipe(Effect.withSpan("GatewayProxy.handle"));
+        return { handle };
+    }));
+}
+const refusalResponse = (error) => HttpServerResponse.jsonUnsafe({ message: `usine gateway: ${error.message}`, reason: error.reason }, { status: REFUSAL_STATUS[error.reason], headers: { [REFUSAL_HEADER]: error.reason } });
+const clientAddress = (request) => Option.getOrElse(request.remoteAddress, () => "unknown");
+const logRefusal = (request, target, error) => {
+    const caller = Option.match(error.caller, {
+        onNone: () => ({ caller: "unverified" }),
+        onSome: ({ worker, repository }) => ({ worker, repository }),
+    });
+    return Effect.logWarning("Gateway refused a request", {
+        reason: error.reason,
+        host: target.host,
+        method: request.method,
+        path: target.pathname,
+        client: clientAddress(request),
+        ...caller,
+    });
+};
+const forwarded = (message, request, target, attachment, response, detail) => Effect.logInfo(message, {
+    ...detail,
+    worker: attachment.worker,
+    repository: attachment.repository,
+    host: target.host,
+    method: request.method,
+    path: target.pathname,
+    status: response.status,
+});
+const upstreamFailure = (request, target, error) => Effect.logError("The upstream of a Worker request could not be reached", {
+    host: target.host,
+    method: request.method,
+    path: target.pathname,
+    client: clientAddress(request),
+    error: error.reason._tag,
+}).pipe(Effect.as(HttpServerResponse.jsonUnsafe({
+    message: "usine gateway: the upstream is unreachable.",
+    reason: "upstream-unreachable",
+}, { status: 502 })));
+//# sourceMappingURL=proxy.js.map

package/dist/proxy/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/proxy/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrF,OAAO,EACL,OAAO,EACP,UAAU,EAEV,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAEL,YAAY,EACZ,cAAc,EACd,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EAEZ,WAAW,EACX,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE/D;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3C,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtB,sBAAsB;IACtB,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,yBAAyB;CAC1B,CAAC,CAAC;AAGH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAG,yBAAyB,CAAC;AAExD,MAAM,cAAc,GAAG;IACrB,cAAc,EAAE,GAAG;IACnB,kBAAkB,EAAE,GAAG;IACvB,sBAAsB,EAAE,GAAG;IAC3B,sBAAsB,EAAE,GAAG;IAC3B,oBAAoB,EAAE,GAAG;IACzB,oBAAoB,EAAE,GAAG;IACzB,qBAAqB,EAAE,GAAG;IAC1B,yBAAyB,EAAE,GAAG;CACkB,CAAC;AAEnD,sEAAsE;AACtE,MAAM,OAAQ,SAAQ,IAAI,CAAC,WAAW,CAAC,SAAS,CAI9C;CAAG;AAEL,6EAA6E;AAC7E,MAAM,OAAO,GAAG,CAAC,MAAqB,EAAE,OAAe,EAAE,EAAE,CACzD,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAE1D,+CAA+C;AAC/C,MAAM,aAAa,GAAG,CAAC,MAAoB,EAAE,MAAqB,EAAE,OAAe,EAAE,EAAE,CACrF,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAShE,mGAAmG;AACnG,MAAM,aAAa,GAAG,CACpB,OAA4C,EACd,EAAE;IAChC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,KAAK,EAAE,CAAC,IAAI,CACjB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CACjB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CACxF,EACD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,OAAO,EAU9C,CAAC,6BAA6B,CAAC;IAChC,MAAM,CAAU,KAAK,GAAG,KAAK,CAAC,MAAM,CAClC,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QACvC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EACnE,OAA4C;YAE5C,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC1B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,0CAA0C,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO;iBAC1B,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;iBACvB,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAC7B,OAAO,CACL,sBAAsB,EACtB,+CAA+C,MAAM,IAAI,CAC1D,CACF,CACF,CAAC;YACJ,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAChC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,aAAa,CACzB,MAAM,EACN,oBAAoB,EACpB,0CAA0C,MAAM,CAAC,UAAU,OAAO,MAAM,CAAC,UAAU,eAAe,MAAM,CAAC,MAAM,iCAAiC,CACjJ,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE;gBACpC,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CACjC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;oBACnC,uBAAuB,CAAC,UAAU,CAAC,UAAU,CAAC;wBAC5C,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC;oBAC1C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;oBACxC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBACxB,iBAAiB,EAAE,GAAG,EAAE,CACtB,MAAM,CAAC,IAAI,CACT,aAAa,CACX,MAAM,EACN,oBAAoB,EACpB,qBAAqB,MAAM,CAAC,UAAU,eAAe,MAAM,CAAC,MAAM,gBAAgB,CACnF,CACF;gBACH,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EACvD,OAA4C,EAC5C,MAAqB,EACrB,IAAgB;YAEhB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBACtB,OAAO,KAAK,CAAC,CAAC,aAAa,CACzB,MAAM,EACN,kBAAkB,EAClB,6DAA6D,MAAM,CAAC,QAAQ,GAAG,CAChF,CAAC;YACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACrC,IACE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBACpB,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC;gBAEnF,OAAO,KAAK,CAAC,CAAC,aAAa,CACzB,MAAM,EACN,qBAAqB,EACrB,mCAAmC,MAAM,CAAC,UAAU,SAAS,KAAK,CAAC,KAAK,GAAG,CAC5E,CAAC;YACJ,MAAM,OAAO,GAAG,oBAAoB,CAClC,KAAK,CAAC,KAAK,EACX,UAAU,CAAC,UAAU,EACrB,wBAAwB,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAC3D,CAAC;YACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvF,KAAK,CAAC,CAAC,SAAS,CAAC,4BAA4B,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;gBACpF,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;aAC/B,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,EACjD,OAA4C,EAC5C,MAAqB;YAErB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,aAAa,CACzB,MAAM,EACN,kBAAkB,EAClB,gDAAgD,KAAK,CAAC,GAAG,SAAS,MAAM,CAAC,QAAQ,GAAG,CACrF,CAAC;YACJ,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC3E,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACzB,OAAO,KAAK,CAAC,CAAC,aAAa,CACzB,MAAM,EACN,yBAAyB,EACzB,qCAAqC,WAAW,CAAC,KAAK,CAAC,QAAQ,GAAG,CACnE,CAAC;YACJ,MAAM,OAAO,GAAG,sBAAsB,CACpC,QAAQ,CAAC,KAAK,EACd,wBAAwB,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAC3D,CAAC;YACF,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3E,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;gBAClF,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ;aACrC,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,CAAC,OAA4C,EAAE,MAAqB,EAAE,EAAE;YACpF,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG;gBAAE,OAAO,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACzE,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG;gBAAE,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,MAAM,CAAC,IAAI,CAChB,OAAO,CACL,cAAc,EACd,sBAAsB,KAAK,CAAC,GAAG,QAAQ,KAAK,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,4DAA4D,CACjI,CACF,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACjC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;YAC3D,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAClE,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,2BAA2B,EAAE;oBACpD,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;iBAC/B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvF,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,SAAS,CAAC;gBACf,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClF,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;aAC1E,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAEhD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,CAAC,CACH,CAAC;CACH;AAED,MAAM,eAAe,GAAG,CAAC,KAAc,EAAyC,EAAE,CAChF,kBAAkB,CAAC,UAAU,CAC3B,EAAE,OAAO,EAAE,kBAAkB,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EACpE,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CACtF,CAAC;AAEJ,MAAM,aAAa,GAAG,CAAC,OAA4C,EAAU,EAAE,CAC7E,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAE3D,MAAM,UAAU,GAAG,CACjB,OAA4C,EAC5C,MAAqB,EACrB,KAAc,EACd,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE;QACxC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;KAC7D,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,UAAU,CAAC,2BAA2B,EAAE;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;QAC9B,GAAG,MAAM;KACV,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,OAAe,EACf,OAA4C,EAC5C,MAAqB,EACrB,UAAsB,EACtB,QAA+C,EAC/C,MAAwC,EACxC,EAAE,CACF,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;IACtB,GAAG,MAAM;IACT,MAAM,EAAE,UAAU,CAAC,MAAM;IACzB,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,MAAM,EAAE,OAAO,CAAC,MAAM;IACtB,IAAI,EAAE,MAAM,CAAC,QAAQ;IACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;CACxB,CAAC,CAAC;AAEL,MAAM,eAAe,GAAG,CACtB,OAA4C,EAC5C,MAAqB,EACrB,KAAsC,EACtC,EAAE,CACF,MAAM,CAAC,QAAQ,CAAC,uDAAuD,EAAE;IACvE,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,MAAM,EAAE,OAAO,CAAC,MAAM;IACtB,IAAI,EAAE,MAAM,CAAC,QAAQ;IACrB,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;IAC9B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;CACzB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,EAAE,CACP,kBAAkB,CAAC,UAAU,CAC3B;IACE,OAAO,EAAE,6CAA6C;IACtD,MAAM,EAAE,sBAAsB;CAC/B,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CACF,CACF,CAAC"}

package/dist/settings.d.ts

@@ -0,0 +1,52 @@
+import type { GatewayDomain } from "@usine/core/worker";
+import { Context, Effect, Layer, Schema } from "effect";
+import type { EgressAllowlist } from "./egress/egress.ts";
+import type { GitHubOrigins } from "./github/github.ts";
+import type { LlmProviders } from "./llm/llm.ts";
+/** The HMAC key that signs caller tokens, at least 32 characters, known only to the Gateway. */
+export declare const CallerKey: Schema.RedactedFromValue<Schema.String>;
+export type CallerKey = typeof CallerKey.Type;
+/** The bearer token the executor sends to the admin API, at least 32 characters. */
+export declare const AdminToken: Schema.RedactedFromValue<Schema.String>;
+export type AdminToken = typeof AdminToken.Type;
+declare const GatewaySettings_base: Context.ServiceClass<GatewaySettings, "@usine/gateway/GatewaySettings", {
+    readonly domain: GatewayDomain;
+    readonly github: GitHubOrigins;
+    readonly providers: LlmProviders;
+    readonly egress: EgressAllowlist;
+    readonly adminToken: AdminToken;
+    readonly callerKey: CallerKey;
+}>;
+/**
+ * The Gateway's configuration as read at startup. Secrets stay `Redacted` until sent or used to
+ * sign. `egress` and `providers` keep their startup values; reloaded values are in
+ * `SettingsInForce`. Other settings change only with a restart.
+ */
+export declare class GatewaySettings extends GatewaySettings_base {
+}
+/** The settings a reload replaces: the egress allowlist and LLM providers. */
+export interface ReloadableSettings {
+    readonly egress: EgressAllowlist;
+    readonly providers: LlmProviders;
+}
+declare const SettingsInForce_base: Context.ServiceClass<SettingsInForce, "@usine/gateway/SettingsInForce", {
+    /** Returns the current allowlist and providers. */
+    readonly current: Effect.Effect<ReloadableSettings>;
+    /** Replaces them for all later requests. */
+    readonly replace: (next: ReloadableSettings) => Effect.Effect<void>;
+}>;
+/**
+ * The current egress allowlist and LLM providers, initially from `GatewaySettings` and
+ * replaced by each reload. A request reads them once, so a tunnel opened under the previous
+ * allowlist stays open.
+ */
+export declare class SettingsInForce extends SettingsInForce_base {
+    static readonly layer: Layer.Layer<SettingsInForce, never, GatewaySettings>;
+}
+/** Returns the host names the Gateway serves under `domain`. */
+export declare const gatewayHosts: (domain: GatewayDomain) => {
+    readonly git: `git.${string & import("effect/Brand").Brand<"GatewayDomain">}`;
+    readonly llm: `llm.${string & import("effect/Brand").Brand<"GatewayDomain">}`;
+};
+export {};
+//# sourceMappingURL=settings.d.ts.map

package/dist/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAO,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,gGAAgG;AAChG,eAAO,MAAM,SAAS,yCAIrB,CAAC;AACF,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAC;AAE9C,oFAAoF;AACpF,eAAO,MAAM,UAAU,yCAItB,CAAC;AACF,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;;qBAU3B,aAAa;qBACb,aAAa;wBACV,YAAY;qBACf,eAAe;yBACX,UAAU;wBACX,SAAS;;AAbjC;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,oBAUA;CAAG;AAExC,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;CAClC;;IAUG,mDAAmD;sBACjC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;IACnD,4CAA4C;sBAC1B,CAAC,IAAI,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;;AAXvE;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,oBAQA;IACnC,MAAM,CAAC,QAAQ,CAAC,KAAK,uDAOnB;CACH;AAED,gEAAgE;AAChE,eAAO,MAAM,YAAY,WAAY,aAAa;aAC7C,GAAG;aAAmB,GAAG;CAA6B,CAAC"}

package/dist/settings.js

@@ -0,0 +1,27 @@
+import { Context, Effect, Layer, Ref, Schema } from "effect";
+/** The HMAC key that signs caller tokens, at least 32 characters, known only to the Gateway. */
+export const CallerKey = Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(32, { message: "Expected a caller key of at least 32 characters" })));
+/** The bearer token the executor sends to the admin API, at least 32 characters. */
+export const AdminToken = Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(32, { message: "Expected an admin token of at least 32 characters" })));
+/**
+ * The Gateway's configuration as read at startup. Secrets stay `Redacted` until sent or used to
+ * sign. `egress` and `providers` keep their startup values; reloaded values are in
+ * `SettingsInForce`. Other settings change only with a restart.
+ */
+export class GatewaySettings extends Context.Service()("@usine/gateway/GatewaySettings") {
+}
+/**
+ * The current egress allowlist and LLM providers, initially from `GatewaySettings` and
+ * replaced by each reload. A request reads them once, so a tunnel opened under the previous
+ * allowlist stays open.
+ */
+export class SettingsInForce extends Context.Service()("@usine/gateway/SettingsInForce") {
+    static layer = Layer.effect(SettingsInForce, Effect.gen(function* () {
+        const { egress, providers } = yield* GatewaySettings;
+        const inForce = yield* Ref.make({ egress, providers });
+        return { current: Ref.get(inForce), replace: (next) => Ref.set(inForce, next) };
+    }));
+}
+/** Returns the host names the Gateway serves under `domain`. */
+export const gatewayHosts = (domain) => ({ git: `git.${domain}`, llm: `llm.${domain}` });
+//# sourceMappingURL=settings.js.map

package/dist/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAK7D,gGAAgG;AAChG,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,CACjB,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CACvF,CACF,CAAC;AAGF,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAChD,MAAM,CAAC,MAAM,CAAC,KAAK,CACjB,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CACzF,CACF,CAAC;AAGF;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAUjD,CAAC,gCAAgC,CAAC;CAAG;AAQxC;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAQjD,CAAC,gCAAgC,CAAC;IACnC,MAAM,CAAU,KAAK,GAAG,KAAK,CAAC,MAAM,CAClC,eAAe,EACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAqB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;IAClF,CAAC,CAAC,CACH,CAAC;CACH;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAqB,EAAE,EAAE,CACpD,CAAC,EAAE,GAAG,EAAE,OAAO,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,MAAM,EAAE,EAAE,CAAU,CAAC"}

package/dist/upstream.d.ts

@@ -0,0 +1,5 @@
+import { Schema } from "effect";
+/** The base URL of an upstream API: scheme, host, and an optional path prefix, with no query, fragment, or trailing slash. */
+export declare const UpstreamBase: Schema.brand<Schema.String, "UpstreamBase">;
+export type UpstreamBase = typeof UpstreamBase.Type;
+//# sourceMappingURL=upstream.d.ts.map

package/dist/upstream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.d.ts","sourceRoot":"","sources":["../src/upstream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,8HAA8H;AAC9H,eAAO,MAAM,YAAY,6CAIW,CAAC;AACrC,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC"}

package/dist/upstream.js

@@ -0,0 +1,6 @@
+import { Schema } from "effect";
+/** The base URL of an upstream API: scheme, host, and an optional path prefix, with no query, fragment, or trailing slash. */
+export const UpstreamBase = Schema.String.check(Schema.isPattern(/^https?:\/\/[^/?#\s]+(?:\/[^?#\s]*[^/?#\s])?$/u, {
+    message: "Expected an http(s) base URL without a query or a trailing slash",
+})).pipe(Schema.brand("UpstreamBase"));
+//# sourceMappingURL=upstream.js.map

package/dist/upstream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.js","sourceRoot":"","sources":["../src/upstream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,8HAA8H;AAC9H,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAC7C,MAAM,CAAC,SAAS,CAAC,gDAAgD,EAAE;IACjE,OAAO,EAAE,kEAAkE;CAC5E,CAAC,CACH,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,61 @@
 {
   "name": "@usine/gateway",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "The usine gateway: a credential-injecting proxy for GitHub and LLM providers, and an egress allowlist, in front of Worker VMs.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/basaltbytes/usine.git",
+    "directory": "packages/gateway"
+  },
+  "bin": {
+    "usine-gateway": "./dist/node/main.js"
+  },
+  "files": [
+    "dist",
+    "!dist/tsconfig.tsbuildinfo"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/gateway.d.ts",
+      "default": "./dist/gateway.js"
+    },
+    "./admin": {
+      "types": "./dist/admin/api.d.ts",
+      "default": "./dist/admin/api.js"
+    },
+    "./node": {
+      "types": "./dist/node/node.d.ts",
+      "default": "./dist/node/node.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@effect/platform-node": "4.0.0-rc.111",
+    "@effect/platform-node-shared": "4.0.0-rc.111",
+    "@usine/core": "0.4.0"
+  },
+  "devDependencies": {
+    "@effect/vitest": "4.0.0-rc.111",
+    "effect": "4.0.0-rc.111",
+    "typescript": "7.0.2",
+    "vitest": "4.1.11",
+    "@usine/tsconfig": "0.0.0"
+  },
+  "peerDependencies": {
+    "effect": "4.0.0-rc.111"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "check": "tsc -p tsconfig.check.json",
+    "test": "vitest run --exclude 'test/placeholder-swap/**'",
+    "test:placeholder-swap": "vitest run test/placeholder-swap"
+  }
 }