@usine/gateway 0.0.0-stage → 0.2.0

package/dist/egress/client-hello.d.ts

@@ -0,0 +1,120 @@
+import { Data, Option } from "effect";
+/** The maximum bytes the forward proxy buffers while waiting for a complete ClientHello. */
+export declare const CLIENT_HELLO_LIMIT: number;
+/**
+ * The result of reading a tunnel's first bytes: incomplete with the byte count needed, not a
+ * TLS ClientHello, or a ClientHello with its server name and whether it uses ECH.
+ */
+export type ClientHelloRead = Data.TaggedEnum<{
+    Incomplete: {
+        readonly needed: number;
+    };
+    NotTls: {
+        readonly detail: string;
+    };
+    ClientHello: {
+        readonly serverName: Option.Option<string>;
+        readonly encryptedClientHello: boolean;
+    };
+}>;
+export declare const ClientHelloRead: {
+    readonly $is: <Tag extends "ClientHello" | "Incomplete" | "NotTls">(tag: Tag) => (u: unknown) => u is Extract<{
+        readonly _tag: "ClientHello";
+        readonly serverName: Option.Option<string>;
+        readonly encryptedClientHello: boolean;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "Incomplete";
+        readonly needed: number;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "NotTls";
+        readonly detail: string;
+    }, {
+        readonly _tag: Tag;
+    }>;
+    readonly $match: {
+        <Cases extends { readonly [Tag in "ClientHello" | "Incomplete" | "NotTls"]: (args: Extract<{
+            readonly _tag: "ClientHello";
+            readonly serverName: Option.Option<string>;
+            readonly encryptedClientHello: boolean;
+        } | {
+            readonly _tag: "Incomplete";
+            readonly needed: number;
+        } | {
+            readonly _tag: "NotTls";
+            readonly detail: string;
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(cases: Cases): (value: {
+            readonly _tag: "ClientHello";
+            readonly serverName: Option.Option<string>;
+            readonly encryptedClientHello: boolean;
+        } | {
+            readonly _tag: "Incomplete";
+            readonly needed: number;
+        } | {
+            readonly _tag: "NotTls";
+            readonly detail: string;
+        }) => import("effect/Unify").Unify<ReturnType<Cases["ClientHello" | "Incomplete" | "NotTls"]>>;
+        <Cases extends { readonly [Tag in "ClientHello" | "Incomplete" | "NotTls"]: (args: Extract<{
+            readonly _tag: "ClientHello";
+            readonly serverName: Option.Option<string>;
+            readonly encryptedClientHello: boolean;
+        } | {
+            readonly _tag: "Incomplete";
+            readonly needed: number;
+        } | {
+            readonly _tag: "NotTls";
+            readonly detail: string;
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(value: {
+            readonly _tag: "ClientHello";
+            readonly serverName: Option.Option<string>;
+            readonly encryptedClientHello: boolean;
+        } | {
+            readonly _tag: "Incomplete";
+            readonly needed: number;
+        } | {
+            readonly _tag: "NotTls";
+            readonly detail: string;
+        }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["ClientHello" | "Incomplete" | "NotTls"]>>;
+    };
+    readonly ClientHello: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "ClientHello";
+        readonly serverName: Option.Option<string>;
+        readonly encryptedClientHello: boolean;
+    }, "_tag">;
+    readonly Incomplete: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "Incomplete";
+        readonly needed: number;
+    }, "_tag">;
+    readonly NotTls: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "NotTls";
+        readonly detail: string;
+    }, "_tag">;
+};
+/**
+ * Reads the TLS ClientHello at the start of `bytes`, joining handshake records if the client
+ * split it. For `Incomplete`, `needed` is the smallest byte count that can change the result.
+ */
+export declare const readClientHello: (bytes: Uint8Array) => ClientHelloRead;
+/**
+ * A buffer for a tunnel's first bytes that parses only when the byte count the last parse
+ * needed is reached. A ClientHello longer than 16 KiB is read as `NotTls`.
+ */
+export declare class ClientHelloReader {
+    #private;
+    /** Adds bytes from the client and returns the current read result. */
+    push(chunk: Uint8Array): ClientHelloRead;
+    /** All bytes collected so far, in order; the proxy writes them upstream once the tunnel opens. */
+    get bytes(): Uint8Array;
+    /** The number of parses so far. */
+    get parses(): number;
+}
+/** Returns `host` lowercased and without a trailing dot, for comparing TLS and CONNECT host names. */
+export declare const comparableHost: (host: string) => string;
+//# sourceMappingURL=client-hello.d.ts.map

package/dist/egress/client-hello.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-hello.d.ts","sourceRoot":"","sources":["../../src/egress/client-hello.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEtC,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,QAAY,CAAC;AAS5C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC;IAC5C,UAAU,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,WAAW,EAAE;QACX,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;KACxC,CAAC;CACH,CAAC,CAAC;AACH,eAAO,MAAM,eAAe;;;6BAJH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;uCACX,OAAO;;;;;yBAJT,MAAM;;;;;yBACV,MAAM;;;;;;;iCAEV,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;2CACX,OAAO;;;6BAJT,MAAM;;;6BACV,MAAM;;;;;;;;;;;;;;;;iCAEV,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;2CACX,OAAO;;;6BAJT,MAAM;;;6BACV,MAAM;;;;;;;;;;;;;;;;;6BAEV,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;uCACX,OAAO;;;;yBAJT,MAAM;;;;yBACV,MAAM;;CAM8B,CAAC;AAsDlE;;;GAGG;AACH,eAAO,MAAM,eAAe,UAAW,UAAU,KAAG,eA+BnD,CAAC;AAEF;;;GAGG;AACH,qBAAa,iBAAiB;;IAM5B,sEAAsE;IACtE,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,eAAe,CAUvC;IAED,kGAAkG;IAClG,IAAI,KAAK,IAAI,UAAU,CAWtB;IAED,mCAAmC;IACnC,IAAI,MAAM,IAAI,MAAM,CAEnB;CACF;AAED,sGAAsG;AACtG,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,MAAgD,CAAC"}

package/dist/egress/client-hello.js

@@ -0,0 +1,155 @@
+import { Data, Option } from "effect";
+/** The maximum bytes the forward proxy buffers while waiting for a complete ClientHello. */
+export const CLIENT_HELLO_LIMIT = 16 * 1024;
+const HANDSHAKE_RECORD = 0x16;
+const CLIENT_HELLO = 0x01;
+const SERVER_NAME = 0x0000;
+const HOST_NAME = 0x00;
+const ENCRYPTED_CLIENT_HELLO = 0xfe0d;
+const MAX_RECORD_LENGTH = 1 << 14;
+export const ClientHelloRead = Data.taggedEnum();
+const notTls = (detail) => ClientHelloRead.NotTls({ detail });
+const u16 = (bytes, at) => ((bytes[at] ?? 0) << 8) | (bytes[at + 1] ?? 0);
+/** Returns the `host_name` entry of a `server_name` extension (RFC 6066, section 3). */
+const hostName = (data) => {
+    if (data.length < 2 || u16(data, 0) !== data.length - 2)
+        return Option.none();
+    let at = 2;
+    while (at + 3 <= data.length) {
+        const type = data[at];
+        const length = u16(data, at + 1);
+        const start = at + 3;
+        if (start + length > data.length)
+            return Option.none();
+        if (type === HOST_NAME && length > 0)
+            return Option.some(new TextDecoder().decode(data.subarray(start, start + length)));
+        at = start + length;
+    }
+    return Option.none();
+};
+/** Parses a ClientHello body (RFC 8446, section 4.1.2). */
+const clientHelloBody = (body) => {
+    let at = 2 + 32;
+    if (at + 1 > body.length)
+        return notTls("ClientHello is truncated");
+    at += 1 + (body[at] ?? 0);
+    if (at + 2 > body.length)
+        return notTls("ClientHello is truncated");
+    at += 2 + u16(body, at);
+    if (at + 1 > body.length)
+        return notTls("ClientHello is truncated");
+    at += 1 + (body[at] ?? 0);
+    if (at > body.length)
+        return notTls("ClientHello is truncated");
+    if (at === body.length)
+        return ClientHelloRead.ClientHello({ serverName: Option.none(), encryptedClientHello: false });
+    if (at + 2 > body.length)
+        return notTls("ClientHello extensions are truncated");
+    const end = at + 2 + u16(body, at);
+    if (end > body.length)
+        return notTls("ClientHello extensions are truncated");
+    at += 2;
+    let serverName = Option.none();
+    let encryptedClientHello = false;
+    while (at + 4 <= end) {
+        const type = u16(body, at);
+        const length = u16(body, at + 2);
+        const start = at + 4;
+        if (start + length > end)
+            return notTls("a ClientHello extension is truncated");
+        if (type === SERVER_NAME && Option.isNone(serverName))
+            serverName = hostName(body.subarray(start, start + length));
+        if (type === ENCRYPTED_CLIENT_HELLO)
+            encryptedClientHello = true;
+        at = start + length;
+    }
+    return ClientHelloRead.ClientHello({ serverName, encryptedClientHello });
+};
+/**
+ * Reads the TLS ClientHello at the start of `bytes`, joining handshake records if the client
+ * split it. For `Incomplete`, `needed` is the smallest byte count that can change the result.
+ */
+export const readClientHello = (bytes) => {
+    const chunks = [];
+    let handshakeLength = 0;
+    let at = 0;
+    for (;;) {
+        if (bytes.length > at && bytes[at] !== HANDSHAKE_RECORD)
+            return notTls("the first bytes are not a TLS handshake record");
+        if (bytes.length < at + 5)
+            return ClientHelloRead.Incomplete({ needed: at + 5 });
+        if (bytes[at + 1] !== 0x03)
+            return notTls("the record version is not TLS");
+        const length = u16(bytes, at + 3);
+        if (length === 0 || length > MAX_RECORD_LENGTH)
+            return notTls("the record length is invalid");
+        if (bytes.length < at + 5 + length)
+            return ClientHelloRead.Incomplete({ needed: at + 5 + length });
+        chunks.push(bytes.subarray(at + 5, at + 5 + length));
+        handshakeLength += length;
+        at += 5 + length;
+        if (handshakeLength < 4)
+            continue;
+        const handshake = new Uint8Array(handshakeLength);
+        let filled = 0;
+        for (const chunk of chunks) {
+            handshake.set(chunk, filled);
+            filled += chunk.length;
+        }
+        if (handshake[0] !== CLIENT_HELLO)
+            return notTls("the handshake is not a ClientHello");
+        const messageLength = ((handshake[1] ?? 0) << 16) | u16(handshake, 2);
+        if (messageLength > CLIENT_HELLO_LIMIT)
+            return notTls("the ClientHello is too large");
+        if (handshakeLength >= 4 + messageLength)
+            return clientHelloBody(handshake.subarray(4, 4 + messageLength));
+        const rest = at + 5 + (4 + messageLength - handshakeLength);
+        if (bytes.length < rest)
+            return ClientHelloRead.Incomplete({ needed: rest });
+    }
+};
+/**
+ * A buffer for a tunnel's first bytes that parses only when the byte count the last parse
+ * needed is reached. A ClientHello longer than 16 KiB is read as `NotTls`.
+ */
+export class ClientHelloReader {
+    #chunks = [];
+    #length = 0;
+    #needed = 1;
+    #parses = 0;
+    /** Adds bytes from the client and returns the current read result. */
+    push(chunk) {
+        this.#chunks.push(chunk);
+        this.#length += chunk.length;
+        if (this.#length < this.#needed)
+            return ClientHelloRead.Incomplete({ needed: this.#needed });
+        this.#parses += 1;
+        const read = readClientHello(this.bytes);
+        if (read._tag !== "Incomplete")
+            return read;
+        if (read.needed > CLIENT_HELLO_LIMIT)
+            return notTls("the ClientHello is larger than 16 KiB");
+        this.#needed = read.needed;
+        return read;
+    }
+    /** All bytes collected so far, in order; the proxy writes them upstream once the tunnel opens. */
+    get bytes() {
+        if (this.#chunks.length !== 1) {
+            const joined = new Uint8Array(this.#length);
+            let at = 0;
+            for (const chunk of this.#chunks) {
+                joined.set(chunk, at);
+                at += chunk.length;
+            }
+            this.#chunks = [joined];
+        }
+        return this.#chunks[0] ?? new Uint8Array(0);
+    }
+    /** The number of parses so far. */
+    get parses() {
+        return this.#parses;
+    }
+}
+/** Returns `host` lowercased and without a trailing dot, for comparing TLS and CONNECT host names. */
+export const comparableHost = (host) => host.toLowerCase().replace(/\.$/u, "");
+//# sourceMappingURL=client-hello.js.map

package/dist/egress/client-hello.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-hello.js","sourceRoot":"","sources":["../../src/egress/client-hello.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEtC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,CAAC;AAclC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAmB,CAAC;AAElE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAEtE,MAAM,GAAG,GAAG,CAAC,KAAiB,EAAE,EAAU,EAAU,EAAE,CACpD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAEjD,wFAAwF;AACxF,MAAM,QAAQ,GAAG,CAAC,IAAgB,EAAyB,EAAE;IAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,IAAI,KAAK,GAAG,MAAM,GAAG,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,GAAG,CAAC;YAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrF,EAAE,GAAG,KAAK,GAAG,MAAM,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AAEF,2DAA2D;AAC3D,MAAM,eAAe,GAAG,CAAC,IAAgB,EAAmB,EAAE;IAC5D,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IAChB,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACpE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACpE,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxB,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACpE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAChE,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM;QACpB,OAAO,eAAe,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;IACjG,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,sCAAsC,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,sCAAsC,CAAC,CAAC;IAC7E,EAAE,IAAI,CAAC,CAAC;IACR,IAAI,UAAU,GAA0B,MAAM,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,OAAO,EAAE,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG;YAAE,OAAO,MAAM,CAAC,sCAAsC,CAAC,CAAC;QAChF,IAAI,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YACnD,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,sBAAsB;YAAE,oBAAoB,GAAG,IAAI,CAAC;QACjE,EAAE,GAAG,KAAK,GAAG,MAAM,CAAC;IACtB,CAAC;IACD,OAAO,eAAe,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAmB,EAAE;IACpE,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,SAAS,CAAC;QACR,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,gBAAgB;YACrD,OAAO,MAAM,CAAC,gDAAgD,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACjF,IAAI,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,GAAG,iBAAiB;YAAE,OAAO,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC9F,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM;YAChC,OAAO,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;QACrD,eAAe,IAAI,MAAM,CAAC;QAC1B,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC;QACjB,IAAI,eAAe,GAAG,CAAC;YAAE,SAAS;QAClC,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;QAClD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,YAAY;YAAE,OAAO,MAAM,CAAC,oCAAoC,CAAC,CAAC;QACvF,MAAM,aAAa,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,aAAa,GAAG,kBAAkB;YAAE,OAAO,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACtF,IAAI,eAAe,IAAI,CAAC,GAAG,aAAa;YACtC,OAAO,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,GAAG,eAAe,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IAC5B,OAAO,GAAsB,EAAE,CAAC;IAChC,OAAO,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC,CAAC;IAEZ,sEAAsE;IACtE,IAAI,CAAC,KAAiB;QACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;QAC7B,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB;YAAE,OAAO,MAAM,CAAC,uCAAuC,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kGAAkG;IAClG,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,EAAE,GAAG,CAAC,CAAC;YACX,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,mCAAmC;IACnC,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC"}

package/dist/egress/egress.d.ts

@@ -0,0 +1,66 @@
+import { Result, Schema } from "effect";
+/** A lowercase DNS host name without a trailing dot. */
+export declare const HostName: Schema.brand<Schema.String, "HostName">;
+export type HostName = typeof HostName.Type;
+export declare const Port: Schema.brand<Schema.Int, "Port">;
+export type Port = typeof Port.Type;
+declare const EgressRule_base: Schema.Class<EgressRule, Schema.Struct<{
+    readonly host: Schema.brand<Schema.String, "HostName">;
+    readonly match: Schema.Literals<readonly ["exact", "subdomains"]>;
+    readonly ports: Schema.NonEmptyArray<Schema.brand<Schema.Int, "Port">>;
+}>, {}>;
+/**
+ * An allowlist line. `exact` permits only that host; `subdomains` permits every name below the
+ * domain (`*.pythonhosted.org`) but not the domain itself.
+ */
+export declare class EgressRule extends EgressRule_base {
+    /** Returns whether this rule permits `host` on any port. */
+    covers(host: HostName): boolean;
+}
+declare const EgressAllowlistError_base: Schema.Class<EgressAllowlistError, Schema.TaggedStruct<"EgressAllowlistError", {
+    readonly line: Schema.Int;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The error for an unreadable allowlist file, with the line and the problem. */
+export declare class EgressAllowlistError extends EgressAllowlistError_base {
+}
+declare const EgressPermitted_base: Schema.Class<EgressPermitted, Schema.TaggedStruct<"EgressPermitted", {
+    readonly host: Schema.brand<Schema.String, "HostName">;
+    readonly port: Schema.brand<Schema.Int, "Port">;
+    readonly rule: typeof EgressRule;
+}>, {}>;
+/** A permitted destination and the rule that permits it. */
+export declare class EgressPermitted extends EgressPermitted_base {
+}
+/**
+ * The reason a destination is refused: unlisted host or port, an IP address, or a name that
+ * resolves to a private, loopback, or link-local address. For a tunnel, also: the first bytes
+ * aren't a TLS ClientHello, or the ClientHello has no server name, hides it with ECH, or has a
+ * different server name than the CONNECT host.
+ */
+export declare const EgressRefusalReason: Schema.Literals<readonly ["host-not-allowed", "port-not-allowed", "address-literal", "private-address", "not-tls", "server-name-missing", "server-name-mismatch"]>;
+export type EgressRefusalReason = typeof EgressRefusalReason.Type;
+declare const EgressRefused_base: Schema.Class<EgressRefused, Schema.TaggedStruct<"EgressRefused", {
+    readonly host: Schema.String;
+    readonly port: Schema.Int;
+    readonly reason: Schema.Literals<readonly ["host-not-allowed", "port-not-allowed", "address-literal", "private-address", "not-tls", "server-name-missing", "server-name-mismatch"]>;
+}>, {}>;
+/** A refused destination. `host` is the raw host the client requested. */
+export declare class EgressRefused extends EgressRefused_base {
+}
+export type EgressDecision = EgressPermitted | EgressRefused;
+declare const EgressAllowlist_base: Schema.Class<EgressAllowlist, Schema.Struct<{
+    readonly rules: Schema.$Array<typeof EgressRule>;
+}>, {}>;
+/** The hosts Workers can connect to through the forward proxy. Unlisted hosts and all IP addresses are refused. */
+export declare class EgressAllowlist extends EgressAllowlist_base {
+    /** Returns the decision for a connection to `host` on `port`. */
+    decide(host: string, port: number): EgressDecision;
+}
+/**
+ * Parses an allowlist file with one rule per line: `host` or `*.domain`, optionally with
+ * `:port` (443 and 80 by default). `#` starts a comment and blank lines are skipped.
+ */
+export declare const parseEgressAllowlist: (text: string) => Result.Result<EgressAllowlist, EgressAllowlistError>;
+export {};
+//# sourceMappingURL=egress.d.ts.map

package/dist/egress/egress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.d.ts","sourceRoot":"","sources":["../../src/egress/egress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhD,wDAAwD;AACxD,eAAO,MAAM,QAAQ,yCAOW,CAAC;AACjC,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C,eAAO,MAAM,IAAI,kCAEhB,CAAC;AACF,MAAM,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC;;;;;;AAKpC;;;GAGG;AACH,qBAAa,UAAW,SAAQ,eAI9B;IACA,4DAA4D;IAC5D,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAE9B;CACF;;;;;AAED,iFAAiF;AACjF,qBAAa,oBAAqB,SAAQ,yBAGzC;CAAG;;;;;;AAEJ,4DAA4D;AAC5D,qBAAa,eAAgB,SAAQ,oBAInC;CAAG;AAEL;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,oKAQ9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAC;;;;;;AAElE,0EAA0E;AAC1E,qBAAa,aAAc,SAAQ,kBAIjC;CAAG;AAEL,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,aAAa,CAAC;;;;AAO7D,mHAAmH;AACnH,qBAAa,eAAgB,SAAQ,oBAEC;IACpC,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAYjD;CACF;AA6BD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,SACzB,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,oBAAoB,CAWrD,CAAC"}

package/dist/egress/egress.js

@@ -0,0 +1,114 @@
+import { Option, Result, Schema } from "effect";
+/** A lowercase DNS host name without a trailing dot. */
+export const HostName = Schema.String.check(Schema.isPattern(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u, {
+    message: "Expected a lowercase DNS host name",
+})).pipe(Schema.brand("HostName"));
+export const Port = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 65_535 })).pipe(Schema.brand("Port"));
+/** The ports for an allowlist line without a port: HTTPS, and HTTP for apt mirrors. */
+const DEFAULT_PORTS = [Port.make(443), Port.make(80)];
+/**
+ * An allowlist line. `exact` permits only that host; `subdomains` permits every name below the
+ * domain (`*.pythonhosted.org`) but not the domain itself.
+ */
+export class EgressRule extends Schema.Class("@usine/gateway/EgressRule")({
+    host: HostName,
+    match: Schema.Literals(["exact", "subdomains"]),
+    ports: Schema.NonEmptyArray(Port),
+}) {
+    /** Returns whether this rule permits `host` on any port. */
+    covers(host) {
+        return this.match === "exact" ? host === this.host : host.endsWith(`.${this.host}`);
+    }
+}
+/** The error for an unreadable allowlist file, with the line and the problem. */
+export class EgressAllowlistError extends Schema.TaggedError()("EgressAllowlistError", { line: Schema.Int, message: Schema.String }) {
+}
+/** A permitted destination and the rule that permits it. */
+export class EgressPermitted extends Schema.TaggedClass()("EgressPermitted", {
+    host: HostName,
+    port: Port,
+    rule: EgressRule,
+}) {
+}
+/**
+ * The reason a destination is refused: unlisted host or port, an IP address, or a name that
+ * resolves to a private, loopback, or link-local address. For a tunnel, also: the first bytes
+ * aren't a TLS ClientHello, or the ClientHello has no server name, hides it with ECH, or has a
+ * different server name than the CONNECT host.
+ */
+export const EgressRefusalReason = Schema.Literals([
+    "host-not-allowed",
+    "port-not-allowed",
+    "address-literal",
+    "private-address",
+    "not-tls",
+    "server-name-missing",
+    "server-name-mismatch",
+]);
+/** A refused destination. `host` is the raw host the client requested. */
+export class EgressRefused extends Schema.TaggedClass()("EgressRefused", {
+    host: Schema.String,
+    port: Schema.Int,
+    reason: EgressRefusalReason,
+}) {
+}
+const IPV4_LITERAL = /^\d{1,3}(?:\.\d{1,3}){3}$/u;
+const isHostName = Schema.is(HostName);
+const isPort = Schema.is(Port);
+/** The hosts Workers can connect to through the forward proxy. Unlisted hosts and all IP addresses are refused. */
+export class EgressAllowlist extends Schema.Class("@usine/gateway/EgressAllowlist")({ rules: Schema.Array(EgressRule) }) {
+    /** Returns the decision for a connection to `host` on `port`. */
+    decide(host, port) {
+        const normalized = host.toLowerCase().replace(/\.$/u, "");
+        if (IPV4_LITERAL.test(normalized) || normalized.includes(":"))
+            return new EgressRefused({ host, port, reason: "address-literal" });
+        if (!isHostName(normalized) || !isPort(port))
+            return new EgressRefused({ host, port, reason: "host-not-allowed" });
+        const covering = this.rules.filter((rule) => rule.covers(normalized));
+        if (covering.length === 0)
+            return new EgressRefused({ host, port, reason: "host-not-allowed" });
+        const rule = covering.find((candidate) => candidate.ports.includes(port));
+        return rule === undefined
+            ? new EgressRefused({ host, port, reason: "port-not-allowed" })
+            : new EgressPermitted({ host: normalized, port, rule });
+    }
+}
+const parseLine = (text, line) => {
+    const match = /^(\*\.)?([^:\s]+)(?::(\d+))?$/u.exec(text);
+    const host = match?.[2]?.toLowerCase();
+    if (match === null || host === undefined || !isHostName(host) || IPV4_LITERAL.test(host))
+        return Result.fail(new EgressAllowlistError({
+            line,
+            message: `Expected a host name, or *. and a domain, optionally followed by :port, got "${text}"`,
+        }));
+    const port = Option.fromNullishOr(match[3]).pipe(Option.map(Number));
+    if (Option.isSome(port) && !isPort(port.value))
+        return Result.fail(new EgressAllowlistError({ line, message: `Port ${port.value} is not between 1 and 65535` }));
+    return Result.succeed(new EgressRule({
+        host,
+        match: match[1] === undefined ? "exact" : "subdomains",
+        ports: Option.match(port, {
+            onNone: () => DEFAULT_PORTS,
+            onSome: (value) => [Port.make(value)],
+        }),
+    }));
+};
+/**
+ * Parses an allowlist file with one rule per line: `host` or `*.domain`, optionally with
+ * `:port` (443 and 80 by default). `#` starts a comment and blank lines are skipped.
+ */
+export const parseEgressAllowlist = (text) => {
+    const rules = [];
+    const lines = text.split(/\r?\n/u);
+    for (const [index, raw] of lines.entries()) {
+        const content = raw.replace(/#.*$/u, "").trim();
+        if (content === "")
+            continue;
+        const parsed = parseLine(content, index + 1);
+        if (Result.isFailure(parsed))
+            return Result.fail(parsed.failure);
+        rules.push(parsed.success);
+    }
+    return Result.succeed(new EgressAllowlist({ rules }));
+};
+//# sourceMappingURL=egress.js.map

package/dist/egress/egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.js","sourceRoot":"","sources":["../../src/egress/egress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhD,wDAAwD;AACxD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CACzC,MAAM,CAAC,SAAS,CACd,iGAAiG,EACjG;IACE,OAAO,EAAE,oCAAoC;CAC9C,CACF,CACF,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAGjC,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAC1F,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CACrB,CAAC;AAGF,uFAAuF;AACvF,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAU,CAAC;AAE/D;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,MAAM,CAAC,KAAK,CAAa,2BAA2B,CAAC,CAAC;IACpF,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/C,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;CAClC,CAAC;IACA,4DAA4D;IAC5D,MAAM,CAAC,IAAc;QACnB,OAAO,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,EAAwB,CAClF,sBAAsB,EACtB,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAC7C;CAAG;AAEJ,4DAA4D;AAC5D,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CAAC,iBAAiB,EAAE;IAC5F,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,UAAU;CACjB,CAAC;CAAG;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjD,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,SAAS;IACT,qBAAqB;IACrB,sBAAsB;CACvB,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,WAAW,EAAiB,CAAC,eAAe,EAAE;IACtF,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,IAAI,EAAE,MAAM,CAAC,GAAG;IAChB,MAAM,EAAE,mBAAmB;CAC5B,CAAC;CAAG;AAIL,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;AACvC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AAE/B,mHAAmH;AACnH,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAC/C,gCAAgC,CACjC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;IACpC,iEAAiE;IACjE,MAAM,CAAC,IAAY,EAAE,IAAY;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC3D,OAAO,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAC1C,OAAO,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YAC/D,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,IAAY,EAAmD,EAAE;IAChG,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QACtF,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,oBAAoB,CAAC;YACvB,IAAI;YACJ,OAAO,EAAE,gFAAgF,IAAI,GAAG;SACjG,CAAC,CACH,CAAC;IACJ,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5C,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,IAAI,CAAC,KAAK,6BAA6B,EAAE,CAAC,CAC7F,CAAC;IACJ,OAAO,MAAM,CAAC,OAAO,CACnB,IAAI,UAAU,CAAC;QACb,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY;QACtD,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG,EAAE,CAAC,aAAa;YAC3B,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAU;SAC/C,CAAC;KACH,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAY,EAC0C,EAAE;IACxD,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC"}

package/dist/gateway.d.ts

@@ -0,0 +1,27 @@
+import { Layer } from "effect";
+import { Attachments } from "./attachment/store.ts";
+import { CallerTokens } from "./caller/caller.ts";
+import { ChatGptLogins } from "./chatgpt/logins.ts";
+import { SettingsInForce } from "./settings.ts";
+export { adminRoutes } from "./admin/server.ts";
+export { AnonymousCredential, Attachment, AttachmentAlreadyExpired, AttachmentConflict, AttachmentCredential, AttachmentId, type AttachmentLookup, ExpiredAttachment, InstallationCredential, LiveAttachment, MissingAttachment, } from "./attachment/attachment.ts";
+export { Attachments } from "./attachment/store.ts";
+export { CallerClaims, CallerToken, CallerTokenRejected, CallerTokens, GATEWAY_TOKEN_HEADER, tokenFromAuthorization, } from "./caller/caller.ts";
+export { type EgressDecision, EgressAllowlist, EgressAllowlistError, EgressPermitted, EgressRefusalReason, EgressRefused, EgressRule, HostName, parseEgressAllowlist, Port, } from "./egress/egress.ts";
+export { GITHUB_ORIGINS, type GitHubOrigins } from "./github/github.ts";
+export { ChatGptAuthFileError, ChatGptTokens } from "./chatgpt/auth-file.ts";
+export { CHATGPT_TOKEN_URL, ChatGptLoginUnavailable, ChatGptLogins } from "./chatgpt/logins.ts";
+export { AnthropicApiKey, AnthropicCredential, AnthropicProvider, AnthropicSubscriptionToken, type ChatGptAccess, ChatGptLogin, HostFilePath, type LlmProvider, type LlmProviders, OpenAiApiKey, OpenAiCredential, OpenAiProvider, } from "./llm/llm.ts";
+export { endToEndHeaders } from "./proxy/forward.ts";
+export { GatewayProxy, REFUSAL_HEADER, RefusalReason } from "./proxy/proxy.ts";
+export { GatewayDomain } from "@usine/core/worker";
+export { AdminToken, CallerKey, GatewaySettings, gatewayHosts, type ReloadableSettings, SettingsInForce, } from "./settings.ts";
+export { UpstreamBase } from "./upstream.ts";
+/**
+ * The Gateway's shared state for one process: the attachment store, the caller token signer,
+ * the current settings, and the ChatGPT logins. Provide this layer once to the reverse proxy,
+ * forward proxy, admin API, and reload. The logins need a `FileSystem` for their auth files and
+ * an `HttpClient` for refreshes.
+ */
+export declare const gatewayServices: Layer.Layer<Attachments | CallerTokens | ChatGptLogins | SettingsInForce, never, import("effect/FileSystem").FileSystem | import("./settings.ts").GatewaySettings | import("effect/http/HttpClient").HttpClient>;
+//# sourceMappingURL=gateway.d.ts.map

package/dist/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,KAAK,gBAAgB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,cAAc,EACd,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,cAAc,EACnB,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,oBAAoB,EACpB,IAAI,GACL,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,aAAa,EAClB,YAAY,EACZ,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,YAAY,EACZ,gBAAgB,EAChB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EACL,UAAU,EACV,SAAS,EACT,eAAe,EACf,YAAY,EACZ,KAAK,kBAAkB,EACvB,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,eAAe,kNAK3B,CAAC"}

package/dist/gateway.js

@@ -0,0 +1,27 @@
+import { Layer } from "effect";
+import { Attachments } from "./attachment/store.js";
+import { CallerTokens } from "./caller/caller.js";
+import { ChatGptLogins } from "./chatgpt/logins.js";
+import { SettingsInForce } from "./settings.js";
+export { adminRoutes } from "./admin/server.js";
+export { AnonymousCredential, Attachment, AttachmentAlreadyExpired, AttachmentConflict, AttachmentCredential, AttachmentId, ExpiredAttachment, InstallationCredential, LiveAttachment, MissingAttachment, } from "./attachment/attachment.js";
+export { Attachments } from "./attachment/store.js";
+export { CallerClaims, CallerToken, CallerTokenRejected, CallerTokens, GATEWAY_TOKEN_HEADER, tokenFromAuthorization, } from "./caller/caller.js";
+export { EgressAllowlist, EgressAllowlistError, EgressPermitted, EgressRefusalReason, EgressRefused, EgressRule, HostName, parseEgressAllowlist, Port, } from "./egress/egress.js";
+export { GITHUB_ORIGINS } from "./github/github.js";
+export { ChatGptAuthFileError, ChatGptTokens } from "./chatgpt/auth-file.js";
+export { CHATGPT_TOKEN_URL, ChatGptLoginUnavailable, ChatGptLogins } from "./chatgpt/logins.js";
+export { AnthropicApiKey, AnthropicCredential, AnthropicProvider, AnthropicSubscriptionToken, ChatGptLogin, HostFilePath, OpenAiApiKey, OpenAiCredential, OpenAiProvider, } from "./llm/llm.js";
+export { endToEndHeaders } from "./proxy/forward.js";
+export { GatewayProxy, REFUSAL_HEADER, RefusalReason } from "./proxy/proxy.js";
+export { GatewayDomain } from "@usine/core/worker";
+export { AdminToken, CallerKey, GatewaySettings, gatewayHosts, SettingsInForce, } from "./settings.js";
+export { UpstreamBase } from "./upstream.js";
+/**
+ * The Gateway's shared state for one process: the attachment store, the caller token signer,
+ * the current settings, and the ChatGPT logins. Provide this layer once to the reverse proxy,
+ * forward proxy, admin API, and reload. The logins need a `FileSystem` for their auth files and
+ * an `HttpClient` for refreshes.
+ */
+export const gatewayServices = Layer.mergeAll(Attachments.layer, CallerTokens.layer, SettingsInForce.layer, ChatGptLogins.layer);
+//# sourceMappingURL=gateway.js.map

package/dist/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EAEZ,iBAAiB,EACjB,sBAAsB,EACtB,cAAc,EACd,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,oBAAoB,EACpB,IAAI,GACL,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAsB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAE1B,YAAY,EACZ,YAAY,EAGZ,YAAY,EACZ,gBAAgB,EAChB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EACL,UAAU,EACV,SAAS,EACT,eAAe,EACf,YAAY,EAEZ,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CAC3C,WAAW,CAAC,KAAK,EACjB,YAAY,CAAC,KAAK,EAClB,eAAe,CAAC,KAAK,EACrB,aAAa,CAAC,KAAK,CACpB,CAAC"}

package/dist/github/github.d.ts

@@ -0,0 +1,54 @@
+import { RepositoryName } from "@usine/core/repository";
+import { Option } from "effect";
+import { Headers } from "effect/http";
+import type { AttachmentCredential } from "../attachment/attachment.ts";
+import { UpstreamBase } from "../upstream.ts";
+/** The upstream origins for GitHub requests: `web` for git smart HTTP, `api` for REST and GraphQL, `uploads` for release asset uploads. */
+export interface GitHubOrigins {
+    readonly web: UpstreamBase;
+    readonly api: UpstreamBase;
+    readonly uploads: UpstreamBase;
+}
+/** The github.com origins. */
+export declare const GITHUB_ORIGINS: GitHubOrigins;
+/**
+ * The host a GitHub request was sent to. `gateway` is `git.<domain>`, which serves git at
+ * `/OWNER/REPO.git` and the API under `/api/` like GitHub Enterprise Server, so `gh` works with
+ * `GH_HOST` set to it. The others are GitHub's own hosts, used when `gh` sends requests through
+ * its `http_unix_socket`, for example to follow a URL from an API response.
+ */
+export type GitHubHost = "gateway" | "web" | "api" | "uploads";
+/** GitHub's host names and what each serves. */
+export declare const GITHUB_HOSTS: ReadonlyMap<string, GitHubHost>;
+/**
+ * A forwarded GitHub request: git smart HTTP or a release download for a repository, or an API
+ * call. `repository` is the repository in the path; GraphQL and calls such as `/user` have none.
+ */
+export interface GitHubRoute {
+    readonly protocol: "git" | "release" | "api";
+    readonly upstream: string;
+    readonly repository: Option.Option<RepositoryName>;
+}
+/** Returns `value` as a URL if it is an absolute URL. */
+export declare const absoluteUrl: (value: string) => Option.Option<URL>;
+/** Returns `pathname` after `prefix`, if it is `prefix` or a path under it. */
+export declare const afterPrefix: (pathname: string, prefix: string) => Option.Option<string>;
+/**
+ * Returns the upstream URL and repository for a GitHub request. Returns `None` for paths
+ * outside git smart HTTP, Git LFS, release downloads, and the API, such as web pages.
+ */
+export declare const githubRoute: (origins: GitHubOrigins, host: GitHubHost, pathname: string, search: string) => Option.Option<GitHubRoute>;
+/**
+ * Returns `location` on `git.<domain>` if it points at github.com or api.github.com, with its
+ * path and query, so a Worker follows GitHub's redirects, such as those for a renamed
+ * repository, through the gateway. API paths move under `/api/v3`. Returns `None` for other
+ * hosts, such as the release asset hosts.
+ */
+export declare const gatewayLocation: (origins: GitHubOrigins, gitHost: string, location: URL) => Option.Option<URL>;
+/**
+ * Adds the attachment's credential to a GitHub request whose caller credential was removed: as
+ * the `x-access-token` password for github.com, which serves git and release downloads, or as a
+ * bearer token for the API. An anonymous attachment adds nothing.
+ */
+export declare const withGitHubCredential: (protocol: GitHubRoute["protocol"], credential: AttachmentCredential, headers: Headers.Headers) => Headers.Headers;
+//# sourceMappingURL=github.d.ts.map

package/dist/github/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/github/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,MAAM,EAA4B,MAAM,QAAQ,CAAC;AAE1D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,2IAA2I;AAC3I,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;CAChC;AAED,8BAA8B;AAC9B,eAAO,MAAM,cAAc,EAAE,aAI5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;AAE/D,gDAAgD;AAChD,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAIvD,CAAC;AAEH;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;CACpD;AAmDD,yDAAyD;AACzD,eAAO,MAAM,WAAW,UAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CACR,CAAC;AAEtD,+EAA+E;AAC/E,eAAO,MAAM,WAAW,aAAc,MAAM,UAAU,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAGhE,CAAC;AAEpB;;;GAGG;AACH,eAAO,MAAM,WAAW,YACb,aAAa,QAChB,UAAU,YACN,MAAM,UACR,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,WAAW,CAiB3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,YACjB,aAAa,WACb,MAAM,YACL,GAAG,KACZ,MAAM,CAAC,MAAM,CAAC,GAAG,CAOnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,aACrB,WAAW,CAAC,UAAU,CAAC,cACrB,oBAAoB,WACvB,OAAO,CAAC,OAAO,KACvB,OAAO,CAAC,OAeV,CAAC"}