@usine/gateway 0.0.0-stage → 0.2.0

package/dist/attachment/attachment.d.ts

@@ -0,0 +1,84 @@
+import { RepositoryName } from "@usine/core/repository";
+import { DateTime, Effect, Schema } from "effect";
+/**
+ * The ID of an attachment, unchanged by renewals. A new attach for the same Worker and
+ * repository gets a new ID, so an earlier caller token is never accepted again.
+ */
+export declare const AttachmentId: Schema.brand<Schema.String, "AttachmentId">;
+export type AttachmentId = typeof AttachmentId.Type;
+/** Returns a new attachment ID of 128 random bits from the platform's cryptographic generator. */
+export declare const newAttachmentId: Effect.Effect<string & import("effect/Brand").Brand<"AttachmentId">, never, never>;
+declare const InstallationCredential_base: Schema.Class<InstallationCredential, Schema.TaggedStruct<"InstallationCredential", {
+    readonly token: Schema.Redacted<Schema.NonEmptyString>;
+}>, {}>;
+/** A GitHub App installation token added to the Worker's requests for the repository. */
+export declare class InstallationCredential extends InstallationCredential_base {
+}
+declare const AnonymousCredential_base: Schema.Class<AnonymousCredential, Schema.TaggedStruct<"AnonymousCredential", {}>, {}>;
+/**
+ * No credential: requests are forwarded unchanged, so only anonymous GitHub access works, such
+ * as reading a public repository.
+ */
+export declare class AnonymousCredential extends AnonymousCredential_base {
+}
+/** The credential added to a Worker's GitHub requests for an attached repository. */
+export declare const AttachmentCredential: Schema.Union<readonly [typeof InstallationCredential, typeof AnonymousCredential]>;
+export type AttachmentCredential = typeof AttachmentCredential.Type;
+declare const Attachment_base: Schema.Class<Attachment, Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "AttachmentId">;
+    readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+    readonly credential: Schema.Union<readonly [typeof InstallationCredential, typeof AnonymousCredential]>;
+    readonly expiresAt: Schema.DateTimeUtc;
+}>, {}>;
+/**
+ * A grant to one Worker VM for one repository. Until `expiresAt`, the Gateway adds `credential`
+ * to the VM's requests for that repository and accepts the attachment's caller token.
+ * `expiresAt` is the token's expiry. A Worker and repository can have several attachments, one
+ * per Attempt.
+ */
+export declare class Attachment extends Attachment_base {
+    /** Returns whether the attachment grants access at `now`. */
+    isLiveAt(now: DateTime.Utc): boolean;
+}
+declare const LiveAttachment_base: Schema.Class<LiveAttachment, Schema.TaggedStruct<"LiveAttachment", {
+    readonly attachment: typeof Attachment;
+    readonly newNames: Schema.$Array<Schema.brand<Schema.String, "RepositoryName">>;
+}>, {}>;
+/**
+ * A lookup result for an active attachment. `newNames` are the names GitHub's permanent
+ * redirects gave the attached repository after a rename or transfer.
+ */
+export declare class LiveAttachment extends LiveAttachment_base {
+    /** Returns whether `repository` is the attached repository, by its attached name or a new name. */
+    serves(repository: RepositoryName): boolean;
+}
+declare const ExpiredAttachment_base: Schema.Class<ExpiredAttachment, Schema.TaggedStruct<"ExpiredAttachment", {
+    readonly expiredAt: Schema.DateTimeUtc;
+}>, {}>;
+/** A lookup result for an attachment whose token expired without renewal. */
+export declare class ExpiredAttachment extends ExpiredAttachment_base {
+}
+declare const MissingAttachment_base: Schema.Class<MissingAttachment, Schema.TaggedStruct<"MissingAttachment", {}>, {}>;
+/** A lookup result for an ID that isn't in the store because it was detached or never attached on this Gateway. */
+export declare class MissingAttachment extends MissingAttachment_base {
+}
+export type AttachmentLookup = LiveAttachment | ExpiredAttachment | MissingAttachment;
+declare const AttachmentAlreadyExpired_base: Schema.Class<AttachmentAlreadyExpired, Schema.TaggedStruct<"AttachmentAlreadyExpired", {
+    readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+    readonly expiresAt: Schema.DateTimeUtc;
+}>, import("effect/Cause").YieldableError>;
+/** The error when an attach request has an expired token. */
+export declare class AttachmentAlreadyExpired extends AttachmentAlreadyExpired_base {
+}
+declare const AttachmentConflict_base: Schema.Class<AttachmentConflict, Schema.TaggedStruct<"AttachmentConflict", {
+    readonly id: Schema.brand<Schema.String, "AttachmentId">;
+    readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+}>, import("effect/Cause").YieldableError>;
+/** The error when a renewal uses an attachment ID that belongs to another Worker or repository. */
+export declare class AttachmentConflict extends AttachmentConflict_base {
+}
+export {};
+//# sourceMappingURL=attachment.d.ts.map

package/dist/attachment/attachment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment.d.ts","sourceRoot":"","sources":["../../src/attachment/attachment.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEjF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGlD;;;GAGG;AACH,eAAO,MAAM,YAAY,6CAEW,CAAC;AACrC,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AAEpD,kGAAkG;AAClG,eAAO,MAAM,eAAe,oFAE3B,CAAC;;;;AAEF,yFAAyF;AACzF,qBAAa,sBAAuB,SAAQ,2BAG3C;CAAG;;AAEJ;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,wBAGxC;CAAG;AAEJ,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,oFAA8D,CAAC;AAChG,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAC;;;;;;;;AAEpE;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,eAM9B;IACA,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,CAEnC;CACF;;;;;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,mBAGlC;IACA,mGAAmG;IACnG,MAAM,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAK1C;CACF;;;;AAED,6EAA6E;AAC7E,qBAAa,iBAAkB,SAAQ,sBAGtC;CAAG;;AAEJ,mHAAmH;AACnH,qBAAa,iBAAkB,SAAQ,sBAGtC;CAAG;AAEJ,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;;;;;;AAEtF,6DAA6D;AAC7D,qBAAa,wBAAyB,SAAQ,6BAG7C;CAAG;;;;;;AAEJ,mGAAmG;AACnG,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG"}

package/dist/attachment/attachment.js

@@ -0,0 +1,67 @@
+import { canonicalRepositoryName, RepositoryName } from "@usine/core/repository";
+import { WorkerName } from "@usine/core/worker";
+import { DateTime, Effect, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
+/**
+ * The ID of an attachment, unchanged by renewals. A new attach for the same Worker and
+ * repository gets a new ID, so an earlier caller token is never accepted again.
+ */
+export const AttachmentId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/u, { message: "Expected a 22-character attachment ID" })).pipe(Schema.brand("AttachmentId"));
+/** Returns a new attachment ID of 128 random bits from the platform's cryptographic generator. */
+export const newAttachmentId = Effect.sync(() => AttachmentId.make(Base64Url.encode(crypto.getRandomValues(new Uint8Array(16)))));
+/** A GitHub App installation token added to the Worker's requests for the repository. */
+export class InstallationCredential extends Schema.TaggedClass()("InstallationCredential", { token: Schema.Redacted(Schema.NonEmptyString) }) {
+}
+/**
+ * No credential: requests are forwarded unchanged, so only anonymous GitHub access works, such
+ * as reading a public repository.
+ */
+export class AnonymousCredential extends Schema.TaggedClass()("AnonymousCredential", {}) {
+}
+/** The credential added to a Worker's GitHub requests for an attached repository. */
+export const AttachmentCredential = Schema.Union([InstallationCredential, AnonymousCredential]);
+/**
+ * A grant to one Worker VM for one repository. Until `expiresAt`, the Gateway adds `credential`
+ * to the VM's requests for that repository and accepts the attachment's caller token.
+ * `expiresAt` is the token's expiry. A Worker and repository can have several attachments, one
+ * per Attempt.
+ */
+export class Attachment extends Schema.Class("@usine/gateway/Attachment")({
+    id: AttachmentId,
+    worker: WorkerName,
+    repository: RepositoryName,
+    credential: AttachmentCredential,
+    expiresAt: Schema.DateTimeUtc,
+}) {
+    /** Returns whether the attachment grants access at `now`. */
+    isLiveAt(now) {
+        return DateTime.isLessThan(now, this.expiresAt);
+    }
+}
+/**
+ * A lookup result for an active attachment. `newNames` are the names GitHub's permanent
+ * redirects gave the attached repository after a rename or transfer.
+ */
+export class LiveAttachment extends Schema.TaggedClass()("LiveAttachment", {
+    attachment: Attachment,
+    newNames: Schema.Array(RepositoryName),
+}) {
+    /** Returns whether `repository` is the attached repository, by its attached name or a new name. */
+    serves(repository) {
+        const wanted = canonicalRepositoryName(repository);
+        return [this.attachment.repository, ...this.newNames].some((name) => canonicalRepositoryName(name) === wanted);
+    }
+}
+/** A lookup result for an attachment whose token expired without renewal. */
+export class ExpiredAttachment extends Schema.TaggedClass()("ExpiredAttachment", { expiredAt: Schema.DateTimeUtc }) {
+}
+/** A lookup result for an ID that isn't in the store because it was detached or never attached on this Gateway. */
+export class MissingAttachment extends Schema.TaggedClass()("MissingAttachment", {}) {
+}
+/** The error when an attach request has an expired token. */
+export class AttachmentAlreadyExpired extends Schema.TaggedError()("AttachmentAlreadyExpired", { worker: WorkerName, repository: RepositoryName, expiresAt: Schema.DateTimeUtc }) {
+}
+/** The error when a renewal uses an attachment ID that belongs to another Worker or repository. */
+export class AttachmentConflict extends Schema.TaggedError()("AttachmentConflict", { id: AttachmentId, worker: WorkerName, repository: RepositoryName }) {
+}
+//# sourceMappingURL=attachment.js.map

package/dist/attachment/attachment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment.js","sourceRoot":"","sources":["../../src/attachment/attachment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAC7C,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAC/F,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;AAGrC,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAC9C,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAChF,CAAC;AAEF,yFAAyF;AACzF,MAAM,OAAO,sBAAuB,SAAQ,MAAM,CAAC,WAAW,EAA0B,CACtF,wBAAwB,EACxB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAClD;CAAG;AAEJ;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,WAAW,EAAuB,CAChF,qBAAqB,EACrB,EAAE,CACH;CAAG;AAEJ,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAGhG;;;;;GAKG;AACH,MAAM,OAAO,UAAW,SAAQ,MAAM,CAAC,KAAK,CAAa,2BAA2B,CAAC,CAAC;IACpF,EAAE,EAAE,YAAY;IAChB,MAAM,EAAE,UAAU;IAClB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,MAAM,CAAC,WAAW;CAC9B,CAAC;IACA,6DAA6D;IAC7D,QAAQ,CAAC,GAAiB;QACxB,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,EAAkB,CAAC,gBAAgB,EAAE;IACzF,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;CACvC,CAAC;IACA,mGAAmG;IACnG,MAAM,CAAC,UAA0B;QAC/B,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACxD,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,MAAM,CACnD,CAAC;IACJ,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAClC;CAAG;AAEJ,mHAAmH;AACnH,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB,EAAE,CACH;CAAG;AAIJ,6DAA6D;AAC7D,MAAM,OAAO,wBAAyB,SAAQ,MAAM,CAAC,WAAW,EAA4B,CAC1F,0BAA0B,EAC1B,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAClF;CAAG;AAEJ,mGAAmG;AACnG,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAC9E,oBAAoB,EACpB,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,CACrE;CAAG"}

package/dist/attachment/store.d.ts

@@ -0,0 +1,34 @@
+import { type RepositoryName } from "@usine/core/repository";
+import { Context, Effect, Layer } from "effect";
+import { type Attachment, AttachmentAlreadyExpired, AttachmentConflict, type AttachmentId, type AttachmentLookup } from "./attachment.ts";
+declare const Attachments_base: Context.ServiceClass<Attachments, "@usine/gateway/Attachments", {
+    /**
+     * Stores an attachment, or replaces the credential and expiry of the one with the same ID.
+     * Fails with `AttachmentConflict` if the ID belongs to another Worker or repository.
+     */
+    readonly attach: (attachment: Attachment) => Effect.Effect<void, AttachmentAlreadyExpired | AttachmentConflict>;
+    /** Removes the attachment. Returns `false` if it didn't exist. */
+    readonly detach: (id: AttachmentId) => Effect.Effect<boolean>;
+    /** Returns the active attachments, earliest expiry first. */
+    readonly list: () => Effect.Effect<ReadonlyArray<Attachment>>;
+    /** Returns whether the attachment is active, expired, or missing. */
+    readonly find: (id: AttachmentId) => Effect.Effect<AttachmentLookup>;
+    /**
+     * Records `name` as the attached repository's new name, from GitHub's permanent redirect of a
+     * request for it, so the attachment serves paths that name it until detach or expiry. Does
+     * nothing if the attachment isn't live or already serves `name`.
+     */
+    readonly learnNewName: (id: AttachmentId, name: RepositoryName) => Effect.Effect<void>;
+    /** Removes expired attachments and returns the number removed. */
+    readonly sweep: () => Effect.Effect<number>;
+}>;
+/**
+ * The in-memory attachment store, keyed by attachment ID. A Gateway restart clears it; the
+ * executor re-attaches with the same IDs when it renews or restarts.
+ */
+export declare class Attachments extends Attachments_base {
+    /** An empty store that removes expired attachments every minute while the layer is in scope. */
+    static readonly layer: Layer.Layer<Attachments, never, never>;
+}
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/attachment/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/attachment/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,OAAO,EAAkB,MAAM,EAAE,KAAK,EAAc,MAAM,QAAQ,CAAC;AAC5E,OAAO,EACL,KAAK,UAAU,EACf,wBAAwB,EACxB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAItB,MAAM,iBAAiB,CAAC;;IA4BrB;;;OAGG;qBACc,CACf,UAAU,EAAE,UAAU,KACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAG,kBAAkB,CAAC;IACvE,kEAAkE;qBACjD,CAAC,EAAE,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAC7D,6DAA6D;mBAC9C,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7D,qEAAqE;mBACtD,CAAC,EAAE,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACpE;;;;OAIG;2BACoB,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IACtF,kEAAkE;oBAClD,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;;AA3B/C;;;GAGG;AACH,qBAAa,WAAY,SAAQ,gBAyBA;IAC/B,gGAAgG;IAChG,MAAM,CAAC,QAAQ,CAAC,KAAK,yCA4InB;CACH"}

package/dist/attachment/store.js

@@ -0,0 +1,133 @@
+import { canonicalRepositoryName } from "@usine/core/repository";
+import { Context, Data, DateTime, Effect, Layer, Match, Ref } from "effect";
+import { AttachmentAlreadyExpired, AttachmentConflict, ExpiredAttachment, LiveAttachment, MissingAttachment, } from "./attachment.js";
+const SWEEP_INTERVAL = "1 minute";
+const samePair = (left, right) => left.worker === right.worker &&
+    canonicalRepositoryName(left.repository) === canonicalRepositoryName(right.repository);
+const Learning = Data.taggedEnum();
+/**
+ * The in-memory attachment store, keyed by attachment ID. A Gateway restart clears it; the
+ * executor re-attaches with the same IDs when it renews or restarts.
+ */
+export class Attachments extends Context.Service()("@usine/gateway/Attachments") {
+    /** An empty store that removes expired attachments every minute while the layer is in scope. */
+    static layer = Layer.effect(Attachments, Effect.gen(function* () {
+        const entries = yield* Ref.make(new Map());
+        const attach = Effect.fn("Attachments.attach")(function* (attachment) {
+            const { id, worker, repository, expiresAt } = attachment;
+            yield* Effect.annotateCurrentSpan({ attachment: id, worker, repository });
+            const now = yield* DateTime.now;
+            if (!attachment.isLiveAt(now))
+                return yield* new AttachmentAlreadyExpired({ worker, repository, expiresAt });
+            const outcome = yield* Ref.modify(entries, (current) => {
+                const previous = current.get(id);
+                if (previous !== undefined && !samePair(previous.attachment, attachment))
+                    return ["conflict", current];
+                return [
+                    previous === undefined ? "attached" : "renewed",
+                    new Map(current).set(id, { attachment, newNames: previous?.newNames ?? [] }),
+                ];
+            });
+            if (outcome === "conflict")
+                return yield* new AttachmentConflict({ id, worker, repository });
+            yield* Effect.logInfo(outcome === "attached" ? "Attached a GitHub credential" : "Renewed a GitHub credential", {
+                attachment: id,
+                worker,
+                repository,
+                credential: attachment.credential._tag,
+                expiresAt: DateTime.formatIso(expiresAt),
+            });
+        });
+        const detach = Effect.fn("Attachments.detach")(function* (id) {
+            yield* Effect.annotateCurrentSpan({ attachment: id });
+            const removed = yield* Ref.modify(entries, (current) => {
+                const entry = current.get(id);
+                if (entry === undefined)
+                    return [entry, current];
+                const next = new Map(current);
+                next.delete(id);
+                return [entry.attachment, next];
+            });
+            if (removed === undefined) {
+                yield* Effect.logInfo("Nothing to detach", { attachment: id });
+                return false;
+            }
+            yield* Effect.logInfo("Detached a GitHub credential", {
+                attachment: id,
+                worker: removed.worker,
+                repository: removed.repository,
+            });
+            return true;
+        });
+        const list = Effect.fn("Attachments.list")(function* () {
+            const now = yield* DateTime.now;
+            const current = yield* Ref.get(entries);
+            return [...current.values()]
+                .map(({ attachment }) => attachment)
+                .filter((attachment) => attachment.isLiveAt(now))
+                .sort((left, right) => DateTime.toEpochMillis(left.expiresAt) - DateTime.toEpochMillis(right.expiresAt));
+        });
+        const find = Effect.fn("Attachments.find")(function* (id) {
+            const now = yield* DateTime.now;
+            const entry = (yield* Ref.get(entries)).get(id);
+            if (entry === undefined)
+                return new MissingAttachment();
+            return entry.attachment.isLiveAt(now)
+                ? new LiveAttachment(entry)
+                : new ExpiredAttachment({ expiredAt: entry.attachment.expiresAt });
+        });
+        const learnNewName = Effect.fn("Attachments.learnNewName")(function* (id, name) {
+            yield* Effect.annotateCurrentSpan({ attachment: id, newName: name });
+            const now = yield* DateTime.now;
+            const learning = yield* Ref.modify(entries, (current) => {
+                const entry = current.get(id);
+                if (entry === undefined || !entry.attachment.isLiveAt(now))
+                    return [Learning.Kept({ reason: "not-live" }), current];
+                if (new LiveAttachment(entry).serves(name))
+                    return [Learning.Kept({ reason: "already-served" }), current];
+                return [
+                    Learning.Learned({ attachment: entry.attachment }),
+                    new Map(current).set(id, { ...entry, newNames: [...entry.newNames, name] }),
+                ];
+            });
+            yield* Match.valueTags(learning, {
+                Learned: ({ attachment }) => Effect.logInfo("Learned the new name of an attached repository", {
+                    attachment: id,
+                    worker: attachment.worker,
+                    repository: attachment.repository,
+                    newName: name,
+                }),
+                Kept: ({ reason }) => Effect.logDebug("Kept the names an attachment serves", {
+                    attachment: id,
+                    newName: name,
+                    reason,
+                }),
+            });
+        });
+        const sweep = Effect.fn("Attachments.sweep")(function* () {
+            const now = yield* DateTime.now;
+            const expired = yield* Ref.modify(entries, (current) => {
+                const gone = [...current.values()]
+                    .map(({ attachment }) => attachment)
+                    .filter((attachment) => !attachment.isLiveAt(now));
+                if (gone.length === 0)
+                    return [gone, current];
+                const next = new Map(current);
+                for (const { id } of gone)
+                    next.delete(id);
+                return [gone, next];
+            });
+            for (const { id, worker, repository, expiresAt } of expired)
+                yield* Effect.logInfo("Forgot an expired GitHub credential", {
+                    attachment: id,
+                    worker,
+                    repository,
+                    expiredAt: DateTime.formatIso(expiresAt),
+                });
+            return expired.length;
+        });
+        yield* Effect.forever(Effect.sleep(SWEEP_INTERVAL).pipe(Effect.andThen(sweep()))).pipe(Effect.forkScoped);
+        return { attach, detach, list, find, learnNewName, sweep };
+    }));
+}
+//# sourceMappingURL=store.js.map

package/dist/attachment/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/attachment/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAuB,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAC5E,OAAO,EAEL,wBAAwB,EACxB,kBAAkB,EAGlB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC,MAAM,QAAQ,GAAG,CAAC,IAAgB,EAAE,KAAiB,EAAW,EAAE,CAChE,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;IAC5B,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAazF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAY,CAAC;AAE7C;;;GAGG;AACH,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAyB7C,CAAC,4BAA4B,CAAC;IAC/B,gGAAgG;IAChG,MAAM,CAAU,KAAK,GAAG,KAAK,CAAC,MAAM,CAClC,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAmC,IAAI,GAAG,EAAE,CAAC,CAAC;QAE7E,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAE,UAAsB;YAC9E,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;YACzD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;YAChF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;oBACtE,OAAO,CAAC,UAAmB,EAAE,OAAO,CAAC,CAAC;gBACxC,OAAO;oBACL,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAE,UAAoB,CAAC,CAAC,CAAE,SAAmB;oBACrE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;iBAC7E,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,KAAK,UAAU;gBACxB,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACnE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,6BAA6B,EACvF;gBACE,UAAU,EAAE,EAAE;gBACd,MAAM;gBACN,UAAU;gBACV,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI;gBACtC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;aACzC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAgB;YACxE,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;gBACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC/D,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE;gBACpD,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC;YAClD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;iBACzB,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC;iBACnC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;iBAChD,IAAI,CACH,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CACnF,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAgB;YACpE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACnC,CAAC,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC;gBAC3B,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAClE,EAAgB,EAChB,IAAoB;YAEpB,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAChC,OAAO,EACP,CAAC,OAAO,EAAgD,EAAE;gBACxD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACxD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC1D,IAAI,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;oBACxC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;gBAChE,OAAO;oBACL,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;oBAClD,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;iBAC5E,CAAC;YACJ,CAAC,CACF,CAAC;YACF,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAC/B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAC1B,MAAM,CAAC,OAAO,CAAC,gDAAgD,EAAE;oBAC/D,UAAU,EAAE,EAAE;oBACd,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,OAAO,EAAE,IAAI;iBACd,CAAC;gBACJ,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACnB,MAAM,CAAC,QAAQ,CAAC,qCAAqC,EAAE;oBACrD,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,IAAI;oBACb,MAAM;iBACP,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC;YACpD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;gBACrD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;qBAC/B,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC;qBACnC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBACrD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9B,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI;oBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3C,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,OAAO;gBACzD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,qCAAqC,EAAE;oBAC3D,UAAU,EAAE,EAAE;oBACd,MAAM;oBACN,UAAU;oBACV,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;iBACzC,CAAC,CAAC;YACL,OAAO,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CACpF,MAAM,CAAC,UAAU,CAClB,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC,CAAC,CACH,CAAC;CACH"}

package/dist/caller/caller.d.ts

@@ -0,0 +1,60 @@
+import { Context, Effect, Layer, Option, Schema } from "effect";
+import { Headers } from "effect/http";
+import { GatewaySettings } from "../settings.ts";
+declare const CallerClaims_base: Schema.Class<CallerClaims, Schema.Struct<{
+    readonly attachment: Schema.brand<Schema.String, "AttachmentId">;
+    readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+}>, {}>;
+/**
+ * The claims in a caller token: its attachment ID, Worker, and repository. Because the
+ * attachment ID is included, a token from an earlier attachment is rejected after a new attach.
+ */
+export declare class CallerClaims extends CallerClaims_base {
+}
+/**
+ * The token a Worker VM sends instead of a real credential. It's issued with each attachment
+ * and accepted only while that attachment is active.
+ */
+export declare const CallerToken: Schema.Redacted<Schema.NonEmptyString>;
+export type CallerToken = typeof CallerToken.Type;
+declare const CallerTokenRejected_base: Schema.Class<CallerTokenRejected, Schema.TaggedStruct<"CallerTokenRejected", {
+    readonly reason: Schema.Literals<readonly ["malformed", "bad-signature"]>;
+}>, import("effect/Cause").YieldableError>;
+/** The error for a caller token the Gateway didn't issue: `malformed` if the format is wrong, `bad-signature` if it wasn't signed with the Gateway's key. */
+export declare class CallerTokenRejected extends CallerTokenRejected_base {
+}
+/** The header for tools that can add one, such as git with `http.extraHeader`. */
+export declare const GATEWAY_TOKEN_HEADER = "x-usine-gateway-token";
+declare const CallerTokens_base: Context.ServiceClass<CallerTokens, "@usine/gateway/CallerTokens", {
+    readonly issue: (claims: CallerClaims) => Effect.Effect<CallerToken>;
+    readonly verify: (token: CallerToken) => Effect.Effect<CallerClaims, CallerTokenRejected>;
+    /**
+     * Removes caller tokens from headers for a host outside the Gateway: always the Gateway
+     * header, and `Authorization` or `x-api-key` only if the value verifies as a caller token.
+     */
+    readonly withoutCallerTokens: (headers: Headers.Headers) => Effect.Effect<Headers.Headers>;
+}>;
+/**
+ * Issues and verifies caller tokens of the form `ugw1.<claims>.<HMAC-SHA256>` under the
+ * Gateway's caller key. The same attachment always yields the same token, so no token table
+ * is kept.
+ */
+export declare class CallerTokens extends CallerTokens_base {
+    static readonly layer: Layer.Layer<CallerTokens, never, GatewaySettings>;
+}
+/**
+ * Returns the credential in an `Authorization` or `Proxy-Authorization` value: the `Bearer` or
+ * `token` parameter, or the `Basic` password (the user name if the password is empty).
+ */
+export declare const tokenFromAuthorization: (value: string) => Option.Option<CallerToken>;
+/**
+ * Returns the caller token from the request headers, checking the Gateway header, then
+ * `Authorization` (gh, Codex, git, and Claude Code with `ANTHROPIC_AUTH_TOKEN` or
+ * `CLAUDE_CODE_OAUTH_TOKEN`), then `x-api-key` (Claude Code with `ANTHROPIC_API_KEY`).
+ */
+export declare const presentedToken: (headers: Headers.Headers) => Option.Option<CallerToken>;
+/** Returns `headers` without any header that can contain a caller credential. */
+export declare const withoutCallerCredentials: (headers: Headers.Headers) => Headers.Headers;
+export {};
+//# sourceMappingURL=caller.d.ts.map

package/dist/caller/caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.d.ts","sourceRoot":"","sources":["../../src/caller/caller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAoB,MAAM,EAAE,MAAM,QAAQ,CAAC;AAElF,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;;;;;;AAEjD;;;GAGG;AACH,qBAAa,YAAa,SAAQ,iBAIhC;CAAG;AAEL;;;GAGG;AACH,eAAO,MAAM,WAAW,wCAAyC,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;;;;AAElD,6JAA6J;AAC7J,qBAAa,mBAAoB,SAAQ,wBAGxC;CAAG;AAEJ,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;;oBAgCxC,CAAC,MAAM,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;qBACnD,CAAC,KAAK,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,mBAAmB,CAAC;IACzF;;;OAGG;kCAC2B,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;;AAd9F;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,iBAWA;IAChC,MAAM,CAAC,QAAQ,CAAC,KAAK,oDAsFnB;CACH;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,UAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAgB/E,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,YAAa,OAAO,CAAC,OAAO,KAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAahF,CAAC;AAEJ,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,YAAa,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,OACqB,CAAC"}

package/dist/caller/caller.js

@@ -0,0 +1,131 @@
+import { RepositoryName } from "@usine/core/repository";
+import { WorkerName } from "@usine/core/worker";
+import { Context, Effect, Layer, Option, Redacted, Result, Schema } from "effect";
+import { Base64, Base64Url } from "effect/encoding";
+import { Headers } from "effect/http";
+import { AttachmentId } from "../attachment/attachment.js";
+import { GatewaySettings } from "../settings.js";
+/**
+ * The claims in a caller token: its attachment ID, Worker, and repository. Because the
+ * attachment ID is included, a token from an earlier attachment is rejected after a new attach.
+ */
+export class CallerClaims extends Schema.Class("@usine/gateway/CallerClaims")({
+    attachment: AttachmentId,
+    worker: WorkerName,
+    repository: RepositoryName,
+}) {
+}
+/**
+ * The token a Worker VM sends instead of a real credential. It's issued with each attachment
+ * and accepted only while that attachment is active.
+ */
+export const CallerToken = Schema.Redacted(Schema.NonEmptyString);
+/** The error for a caller token the Gateway didn't issue: `malformed` if the format is wrong, `bad-signature` if it wasn't signed with the Gateway's key. */
+export class CallerTokenRejected extends Schema.TaggedError()("CallerTokenRejected", { reason: Schema.Literals(["malformed", "bad-signature"]) }) {
+}
+/** The header for tools that can add one, such as git with `http.extraHeader`. */
+export const GATEWAY_TOKEN_HEADER = "x-usine-gateway-token";
+/** The headers that can contain a caller credential; all are removed before forwarding. */
+const CALLER_CREDENTIAL_HEADERS = [
+    GATEWAY_TOKEN_HEADER,
+    "authorization",
+    "x-api-key",
+    "proxy-authorization",
+];
+const TOKEN_FORMAT = /^ugw1\.([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/u;
+const encoder = new TextEncoder();
+const toArrayBuffer = (value) => {
+    const buffer = new ArrayBuffer(value.byteLength);
+    new Uint8Array(buffer).set(value);
+    return buffer;
+};
+const ClaimsJson = Schema.fromJsonString(CallerClaims);
+const encodeClaims = Schema.encodeSync(ClaimsJson);
+const decodeClaims = Schema.decodeUnknownOption(ClaimsJson);
+/**
+ * Issues and verifies caller tokens of the form `ugw1.<claims>.<HMAC-SHA256>` under the
+ * Gateway's caller key. The same attachment always yields the same token, so no token table
+ * is kept.
+ */
+export class CallerTokens extends Context.Service()("@usine/gateway/CallerTokens") {
+    static layer = Layer.effect(CallerTokens, Effect.gen(function* () {
+        const { callerKey } = yield* GatewaySettings;
+        const key = yield* Effect.promise(() => crypto.subtle.importKey("raw", toArrayBuffer(encoder.encode(Redacted.value(callerKey))), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]));
+        const issue = Effect.fn("CallerTokens.issue")(function* (claims) {
+            yield* Effect.annotateCurrentSpan({
+                attachment: claims.attachment,
+                worker: claims.worker,
+                repository: claims.repository,
+            });
+            const signed = `ugw1.${Base64Url.encode(encodeClaims(claims))}`;
+            const mac = yield* Effect.promise(() => crypto.subtle.sign("HMAC", key, toArrayBuffer(encoder.encode(signed))));
+            return Redacted.make(`${signed}.${Base64Url.encode(new Uint8Array(mac))}`);
+        });
+        const verify = Effect.fn("CallerTokens.verify")(function* (token) {
+            const match = TOKEN_FORMAT.exec(Redacted.value(token));
+            const payload = match?.[1];
+            const mac = Option.fromNullishOr(match?.[2]).pipe(Option.flatMap((value) => Result.getSuccess(Base64Url.decode(value))));
+            if (payload === undefined || Option.isNone(mac))
+                return yield* new CallerTokenRejected({ reason: "malformed" });
+            const authentic = yield* Effect.promise(() => crypto.subtle.verify("HMAC", key, toArrayBuffer(mac.value), toArrayBuffer(encoder.encode(`ugw1.${payload}`))));
+            if (!authentic)
+                return yield* new CallerTokenRejected({ reason: "bad-signature" });
+            const claims = Result.getSuccess(Base64Url.decodeString(payload)).pipe(Option.flatMap(decodeClaims));
+            if (Option.isNone(claims))
+                return yield* new CallerTokenRejected({ reason: "malformed" });
+            yield* Effect.annotateCurrentSpan({
+                attachment: claims.value.attachment,
+                worker: claims.value.worker,
+                repository: claims.value.repository,
+            });
+            return claims.value;
+        });
+        const isCallerToken = (token) => Option.match(token, {
+            onNone: () => Effect.succeed(false),
+            onSome: (candidate) => verify(candidate).pipe(Effect.as(true), Effect.orElseSucceed(() => false)),
+        });
+        const withoutCallerTokens = Effect.fn("CallerTokens.withoutCallerTokens")(function* (headers) {
+            const remaining = Headers.remove(headers, GATEWAY_TOKEN_HEADER);
+            const authorization = Headers.get(remaining, "authorization").pipe(Option.flatMap(tokenFromAuthorization));
+            const apiKey = Headers.get(remaining, "x-api-key").pipe(Option.map((value) => Redacted.make(value.trim())));
+            const withoutAuthorization = (yield* isCallerToken(authorization))
+                ? Headers.remove(remaining, "authorization")
+                : remaining;
+            return (yield* isCallerToken(apiKey))
+                ? Headers.remove(withoutAuthorization, "x-api-key")
+                : withoutAuthorization;
+        });
+        return { issue, verify, withoutCallerTokens };
+    }));
+}
+/**
+ * Returns the credential in an `Authorization` or `Proxy-Authorization` value: the `Bearer` or
+ * `token` parameter, or the `Basic` password (the user name if the password is empty).
+ */
+export const tokenFromAuthorization = (value) => {
+    const match = /^(\S+)\s+(\S+)\s*$/u.exec(value.trim());
+    const scheme = match?.[1]?.toLowerCase();
+    const parameter = match?.[2];
+    if (scheme === undefined || parameter === undefined)
+        return Option.none();
+    if (scheme === "bearer" || scheme === "token")
+        return Option.some(Redacted.make(parameter));
+    if (scheme !== "basic")
+        return Option.none();
+    return Result.getSuccess(Base64.decodeString(parameter)).pipe(Option.flatMap((pair) => {
+        const separator = pair.indexOf(":");
+        const user = separator === -1 ? pair : pair.slice(0, separator);
+        const password = separator === -1 ? "" : pair.slice(separator + 1);
+        const secret = password === "" ? user : password;
+        return secret === "" ? Option.none() : Option.some(Redacted.make(secret));
+    }));
+};
+/**
+ * Returns the caller token from the request headers, checking the Gateway header, then
+ * `Authorization` (gh, Codex, git, and Claude Code with `ANTHROPIC_AUTH_TOKEN` or
+ * `CLAUDE_CODE_OAUTH_TOKEN`), then `x-api-key` (Claude Code with `ANTHROPIC_API_KEY`).
+ */
+export const presentedToken = (headers) => Headers.get(headers, GATEWAY_TOKEN_HEADER).pipe(Option.filter((value) => value.trim() !== ""), Option.map((value) => Redacted.make(value.trim())), Option.orElse(() => Headers.get(headers, "authorization").pipe(Option.flatMap(tokenFromAuthorization))), Option.orElse(() => Headers.get(headers, "x-api-key").pipe(Option.filter((value) => value.trim() !== ""), Option.map((value) => Redacted.make(value.trim())))));
+/** Returns `headers` without any header that can contain a caller credential. */
+export const withoutCallerCredentials = (headers) => CALLER_CREDENTIAL_HEADERS.reduce((remaining, name) => Headers.remove(remaining, name), headers);
+//# sourceMappingURL=caller.js.map

package/dist/caller/caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.js","sourceRoot":"","sources":["../../src/caller/caller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,KAAK,CAAe,6BAA6B,CAAC,CAAC;IAC1F,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,UAAU;IAClB,UAAU,EAAE,cAAc;CAC3B,CAAC;CAAG;AAEL;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AAGlE,6JAA6J;AAC7J,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,WAAW,EAAuB,CAChF,qBAAqB,EACrB,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,EAAE,CAC5D;CAAG;AAEJ,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,2FAA2F;AAC3F,MAAM,yBAAyB,GAAG;IAChC,oBAAoB;IACpB,eAAe;IACf,WAAW;IACX,qBAAqB;CACb,CAAC;AAEX,MAAM,YAAY,GAAG,6CAA6C,CAAC;AAEnE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,aAAa,GAAG,CAAC,KAAiB,EAAe,EAAE;IACvD,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;AACvD,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,OAAO,EAW9C,CAAC,6BAA6B,CAAC;IAChC,MAAM,CAAU,KAAK,GAAG,KAAK,CAAC,MAAM,CAClC,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CACrB,KAAK,EACL,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EACxD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CACF,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAoB;YAC3E,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAChC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CACvE,CAAC;YACF,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAkB;YAC3E,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACtE,CAAC;YACF,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC7C,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAClB,MAAM,EACN,GAAG,EACH,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EACxB,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,CACjD,CACF,CAAC;YACF,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAC7B,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YAC1F,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAChC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;gBACnC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC3B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;aACpC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,CAAC,KAAiC,EAAE,EAAE,CAC1D,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;YAClB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CACpB,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CACpB,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EACf,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAClC;SACJ,CAAC,CAAC;QAEL,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,EACjF,OAAwB;YAExB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAChE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CACvC,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CACnD,CAAC;YACF,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;gBAChE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,WAAW,CAAC;gBACnD,CAAC,CAAC,oBAAoB,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAChD,CAAC,CAAC,CACH,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAa,EAA8B,EAAE;IAClF,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1E,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5F,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7C,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjD,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAwB,EAA8B,EAAE,CACrF,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAClD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CACjB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CACnF,EACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CACjB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CACnD,CACF,CACF,CAAC;AAEJ,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAwB,EAAmB,EAAE,CACpF,yBAAyB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC"}

package/dist/chatgpt/auth-file.d.ts

@@ -0,0 +1,47 @@
+import { DateTime, Effect, FileSystem, Option, Schema } from "effect";
+declare const ChatGptAuthFileError_base: Schema.Class<ChatGptAuthFileError, Schema.TaggedStruct<"ChatGptAuthFileError", {
+    readonly path: Schema.String;
+    readonly operation: Schema.Literals<readonly ["read", "write"]>;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The error when a ChatGPT login's `auth.json` can't be read or written, or isn't a Codex
+ * ChatGPT login. The message never contains a token.
+ */
+export declare class ChatGptAuthFileError extends ChatGptAuthFileError_base {
+}
+declare const ChatGptTokens_base: Schema.Class<ChatGptTokens, Schema.Struct<{
+    readonly accessToken: Schema.Redacted<Schema.NonEmptyString>;
+    readonly refreshToken: Schema.Redacted<Schema.NonEmptyString>;
+    /** The ChatGPT account or workspace ID, sent as `ChatGPT-Account-ID`. */
+    readonly accountId: Schema.Option<Schema.NonEmptyString>;
+    /** The access token's `exp` claim, if it has one. */
+    readonly expiresAt: Schema.Option<Schema.DateTimeUtc>;
+    /** When the tokens were last refreshed, from `last_refresh`. */
+    readonly lastRefresh: Schema.Option<Schema.DateTimeUtc>;
+}>, {}>;
+/** A ChatGPT login's tokens as the Gateway holds them in memory. */
+export declare class ChatGptTokens extends ChatGptTokens_base {
+}
+/** Returns the expiry in a JWT's `exp` claim, in seconds since the epoch. */
+export declare const jwtExpiry: (jwt: string) => Option.Option<DateTime.Utc>;
+/** Returns the ChatGPT account ID in an ID token's claims. */
+export declare const idTokenAccount: (idToken: string) => Option.Option<string>;
+/** Reads and parses the Codex `auth.json` at `path`. */
+export declare const readAuthFile: (path: string) => Effect.Effect<ChatGptTokens, ChatGptAuthFileError, FileSystem.FileSystem>;
+/**
+ * Writes rotated tokens into the Codex `auth.json` at `path` and sets `last_refresh`, keeping
+ * its other fields. Writes a temporary file with mode 0600 next to it and renames it over the
+ * file, so a reader sees either file whole, and removes the temporary file if that fails or is
+ * interrupted. Returns `false`, writing nothing, if the file's refresh token isn't one `owns`
+ * accepts, such as a login the operator copied in that the next reload reads.
+ */
+export declare const writeAuthFile: (path: string, tokens: ChatGptTokens, idToken: Option.Option<string>, owns: (refreshToken: string) => boolean) => Effect.Effect<boolean, ChatGptAuthFileError, FileSystem.FileSystem>;
+/**
+ * Checks that the Gateway can write the rotated tokens next to the auth file at `path`, by
+ * creating and removing a file there, so a missing write permission shows before the first
+ * refresh.
+ */
+export declare const checkAuthFileWritable: (path: string) => Effect.Effect<void, ChatGptAuthFileError, FileSystem.FileSystem>;
+export {};
+//# sourceMappingURL=auth-file.d.ts.map

package/dist/chatgpt/auth-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-file.d.ts","sourceRoot":"","sources":["../../src/chatgpt/auth-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAQ,UAAU,EAAE,MAAM,EAAoB,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;;;AAG9F;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,yBAOzC;CAAG;;;;IAQF,yEAAyE;;IAEzE,qDAAqD;;IAErD,gEAAgE;;;AARlE,oEAAoE;AACpE,qBAAa,aAAc,SAAQ,kBASjC;CAAG;AAmCL,6EAA6E;AAC7E,eAAO,MAAM,SAAS,QAAS,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAI/D,CAAC;AAEJ,8DAA8D;AAC9D,eAAO,MAAM,cAAc,YAAa,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAMlE,CAAC;AAiCJ,wDAAwD;AACxD,eAAO,MAAM,YAAY,6FAWvB,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,6FAIH,MAAM,KAAK,OAAO,wEAuCvC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,oFAiBhC,CAAC"}