@usine/gateway 0.0.0-stage → 0.2.0

package/dist/github/github.js

@@ -0,0 +1,112 @@
+import { RepositoryName } from "@usine/core/repository";
+import { Option, Redacted, Result, Schema } from "effect";
+import { Base64 } from "effect/encoding";
+import { Headers } from "effect/http";
+import { UpstreamBase } from "../upstream.js";
+/** The github.com origins. */
+export const GITHUB_ORIGINS = {
+    web: UpstreamBase.make("https://github.com"),
+    api: UpstreamBase.make("https://api.github.com"),
+    uploads: UpstreamBase.make("https://uploads.github.com"),
+};
+/** GitHub's host names and what each serves. */
+export const GITHUB_HOSTS = new Map([
+    ["github.com", "web"],
+    ["api.github.com", "api"],
+    ["uploads.github.com", "uploads"],
+]);
+const GIT_PATH = /^\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?\/(?:info\/refs|git-upload-pack|git-receive-pack|info\/lfs(?:\/[^?#]*)?)$/u;
+/** `/OWNER/REPO/releases/download/TAG/FILE`, whose tag can contain `/`, and `/OWNER/REPO/releases/latest/download/FILE`. */
+const RELEASE_DOWNLOAD_PATH = /^\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/releases\/(?:download\/.+|latest\/download)\/[^/]+$/u;
+const WEB_PATHS = [
+    ["git", GIT_PATH],
+    ["release", RELEASE_DOWNLOAD_PATH],
+];
+const REPOSITORY_PATH = /^\/repos\/([^/]+)\/([^/]+)(?:\/|$)/u;
+const decodeRepository = Schema.decodeUnknownOption(RepositoryName);
+/** Returns the github.com route for a repository's git smart HTTP or release download path. */
+const webRoute = (origins, pathname, search) => {
+    for (const [protocol, pattern] of WEB_PATHS) {
+        const match = pattern.exec(pathname);
+        if (match !== null)
+            return Option.map(decodeRepository(`${match[1]}/${match[2]}`), (repository) => ({
+                protocol,
+                upstream: `${origins.web}${pathname}${search}`,
+                repository: Option.some(repository),
+            }));
+    }
+    return Option.none();
+};
+/** Returns the route for an API path, or `None` for a `/repos/OWNER/REPO` path whose segments aren't a valid repository name. */
+const apiRoute = (base, rest, search) => {
+    const path = rest === "" ? "/" : rest;
+    const match = REPOSITORY_PATH.exec(path);
+    const repository = match === null
+        ? Option.some(Option.none())
+        : Option.map(decodeRepository(`${match[1]}/${match[2]}`), Option.some);
+    return Option.map(repository, (named) => ({
+        protocol: "api",
+        upstream: `${base}${path}${search}`,
+        repository: named,
+    }));
+};
+/** Returns `value` as a URL if it is an absolute URL. */
+export const absoluteUrl = (value) => Result.getSuccess(Result.try(() => new URL(value)));
+/** Returns `pathname` after `prefix`, if it is `prefix` or a path under it. */
+export const afterPrefix = (pathname, prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`)
+    ? Option.some(pathname.slice(prefix.length))
+    : Option.none();
+/**
+ * Returns the upstream URL and repository for a GitHub request. Returns `None` for paths
+ * outside git smart HTTP, Git LFS, release downloads, and the API, such as web pages.
+ */
+export const githubRoute = (origins, host, pathname, search) => {
+    switch (host) {
+        case "web":
+            return webRoute(origins, pathname, search);
+        case "api":
+            return apiRoute(origins.api, pathname, search);
+        case "uploads":
+            return apiRoute(origins.uploads, pathname, search);
+        case "gateway": {
+            if (pathname === "/api/graphql")
+                return apiRoute(origins.api, "/graphql", search);
+            const rest = afterPrefix(pathname, "/api/v3");
+            if (Option.isSome(rest))
+                return apiRoute(origins.api, rest.value, search);
+            const upload = afterPrefix(pathname, "/api/uploads");
+            if (Option.isSome(upload))
+                return apiRoute(origins.uploads, upload.value, search);
+            return webRoute(origins, pathname, search);
+        }
+    }
+};
+/**
+ * Returns `location` on `git.<domain>` if it points at github.com or api.github.com, with its
+ * path and query, so a Worker follows GitHub's redirects, such as those for a renamed
+ * repository, through the gateway. API paths move under `/api/v3`. Returns `None` for other
+ * hosts, such as the release asset hosts.
+ */
+export const gatewayLocation = (origins, gitHost, location) => {
+    const target = `${location.origin}${location.pathname}`;
+    const onGateway = (prefix) => (rest) => new URL(`http://${gitHost}${prefix}${rest}${location.search}${location.hash}`);
+    return Option.map(afterPrefix(target, origins.web), onGateway("")).pipe(Option.orElse(() => Option.map(afterPrefix(target, origins.api), onGateway("/api/v3"))));
+};
+/**
+ * Adds the attachment's credential to a GitHub request whose caller credential was removed: as
+ * the `x-access-token` password for github.com, which serves git and release downloads, or as a
+ * bearer token for the API. An anonymous attachment adds nothing.
+ */
+export const withGitHubCredential = (protocol, credential, headers) => {
+    switch (credential._tag) {
+        case "AnonymousCredential":
+            return headers;
+        case "InstallationCredential": {
+            const token = Redacted.value(credential.token);
+            return Headers.set(headers, "authorization", protocol === "api"
+                ? `Bearer ${token}`
+                : `Basic ${Base64.encode(`x-access-token:${token}`)}`);
+        }
+    }
+};
+//# sourceMappingURL=github.js.map

package/dist/github/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/github/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAS9C,8BAA8B;AAC9B,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC;IAC5C,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChD,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,4BAA4B,CAAC;CACzD,CAAC;AAUF,gDAAgD;AAChD,MAAM,CAAC,MAAM,YAAY,GAAoC,IAAI,GAAG,CAAC;IACnE,CAAC,YAAY,EAAE,KAAK,CAAC;IACrB,CAAC,gBAAgB,EAAE,KAAK,CAAC;IACzB,CAAC,oBAAoB,EAAE,SAAS,CAAC;CAClC,CAAC,CAAC;AAYH,MAAM,QAAQ,GACZ,8HAA8H,CAAC;AAEjI,4HAA4H;AAC5H,MAAM,qBAAqB,GACzB,+FAA+F,CAAC;AAElG,MAAM,SAAS,GAAG;IAChB,CAAC,KAAK,EAAE,QAAQ,CAAC;IACjB,CAAC,SAAS,EAAE,qBAAqB,CAAC;CAC1B,CAAC;AAEX,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAE9D,MAAM,gBAAgB,GAAG,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAEpE,+FAA+F;AAC/F,MAAM,QAAQ,GAAG,CACf,OAAsB,EACtB,QAAgB,EAChB,MAAc,EACc,EAAE;IAC9B,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,IAAI;YAChB,OAAO,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBAC9E,QAAQ;gBACR,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,QAAQ,GAAG,MAAM,EAAE;gBAC9C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;aACpC,CAAC,CAAC,CAAC;IACR,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AAEF,iIAAiI;AACjI,MAAM,QAAQ,GAAG,CAAC,IAAkB,EAAE,IAAY,EAAE,MAAc,EAA8B,EAAE;IAChG,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,UAAU,GACd,KAAK,KAAK,IAAI;QACZ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,MAAM,EAAE;QACnC,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAsB,EAAE,CAC/D,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEtD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,MAAc,EAAyB,EAAE,CACrF,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;IACtD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAEpB;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,OAAsB,EACtB,IAAgB,EAChB,QAAgB,EAChB,MAAc,EACc,EAAE;IAC9B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,SAAS,EAAE,CAAC;YACf,IAAI,QAAQ,KAAK,cAAc;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YAClF,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAClF,OAAO,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAsB,EACtB,OAAe,EACf,QAAa,EACO,EAAE;IACtB,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,EAAE,CACrD,IAAI,GAAG,CAAC,UAAU,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CACrE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CACxF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,QAAiC,EACjC,UAAgC,EAChC,OAAwB,EACP,EAAE;IACnB,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,qBAAqB;YACxB,OAAO,OAAO,CAAC;QACjB,KAAK,wBAAwB,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/C,OAAO,OAAO,CAAC,GAAG,CAChB,OAAO,EACP,eAAe,EACf,QAAQ,KAAK,KAAK;gBAChB,CAAC,CAAC,UAAU,KAAK,EAAE;gBACnB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,EAAE,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC"}

package/dist/github/rename.d.ts

@@ -0,0 +1,30 @@
+import { RepositoryName } from "@usine/core/repository";
+import { Effect, Option, Schema } from "effect";
+import { HttpClient } from "effect/http";
+import type { Attachment } from "../attachment/attachment.ts";
+import { type GitHubOrigins } from "./github.ts";
+/** The statuses GitHub uses to redirect a renamed or transferred repository's former name. */
+export declare const PERMANENT_REDIRECTS: ReadonlySet<number>;
+/**
+ * Returns the repository name in `location`, GitHub's redirect of the upstream URL `requested`,
+ * if both are git's `/OWNER/REPO/info/refs` or both are the API's `/repos/OWNER/REPO`, so only
+ * the owner and repository differ. Returns `None` for other redirects, such as a release
+ * download's, which can point at another repository without a rename.
+ */
+export declare const redirectedName: (origins: GitHubOrigins, requested: URL, location: URL) => Option.Option<RepositoryName>;
+declare const RenameUnconfirmed_base: Schema.Class<RenameUnconfirmed, Schema.TaggedStruct<"RenameUnconfirmed", {
+    readonly reason: Schema.Literals<readonly ["former-name-not-redirected", "repository-unreadable", "other-current-name", "github-unreachable"]>;
+    readonly detail: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** Why GitHub's API didn't confirm that the attached repository has a redirect's name. */
+declare class RenameUnconfirmed extends RenameUnconfirmed_base {
+}
+/**
+ * Confirms with GitHub's API, using the attachment's credential, that `newName` is the attached
+ * repository's current name: `/repos/OWNER/REPO` for the attached name must answer a permanent
+ * redirect to `/repositories/ID`, and the `full_name` of repository ID must be `newName`. Fails
+ * with `RenameUnconfirmed` otherwise, or if GitHub can't be reached.
+ */
+export declare const confirmRename: (client: HttpClient.HttpClient, origins: GitHubOrigins, attachment: Attachment, newName: string & import("effect/Brand").Brand<"RepositoryName">) => Effect.Effect<undefined, RenameUnconfirmed, never>;
+export {};
+//# sourceMappingURL=rename.d.ts.map

package/dist/github/rename.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename.d.ts","sourceRoot":"","sources":["../../src/github/rename.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAW,UAAU,EAAqB,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAA4B,KAAK,aAAa,EAAwB,MAAM,aAAa,CAAC;AAEjG,8FAA8F;AAC9F,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAuB,CAAC;AAmC5E;;;;;GAKG;AACH,eAAO,MAAM,cAAc,YAChB,aAAa,aACX,GAAG,YACJ,GAAG,KACZ,MAAM,CAAC,MAAM,CAAC,cAAc,CAM5B,CAAC;;;;;AAEJ,0FAA0F;AAC1F,cAAM,iBAAkB,SAAQ,sBAQ9B;CAAG;AAcL;;;;;GAKG;AACH,eAAO,MAAM,aAAa,yMAqDxB,CAAC"}

package/dist/github/rename.js

@@ -0,0 +1,83 @@
+import { canonicalRepositoryName, RepositoryName } from "@usine/core/repository";
+import { Effect, Option, Schema } from "effect";
+import { Headers, HttpClient, HttpClientRequest } from "effect/http";
+import { absoluteUrl, afterPrefix, withGitHubCredential } from "./github.js";
+/** The statuses GitHub uses to redirect a renamed or transferred repository's former name. */
+export const PERMANENT_REDIRECTS = new Set([301, 308]);
+const GIT_REFS_PATH = /^\/([^/]+)\/([^/]+?)(?:\.git)?\/info\/refs$/u;
+const API_REPOSITORY_PATH = /^\/repos\/([^/]+)\/([^/]+)$/u;
+const decodeRepository = Schema.decodeUnknownOption(RepositoryName);
+const repositoryItself = (origins, url) => {
+    const target = `${url.origin}${url.pathname}`;
+    const named = (resource, pattern) => (path) => {
+        const match = pattern.exec(path);
+        return match === null
+            ? Option.none()
+            : Option.map(decodeRepository(`${match[1]}/${match[2]}`), (repository) => ({
+                resource,
+                repository,
+            }));
+    };
+    return Option.flatMap(afterPrefix(target, origins.web), named("git-refs", GIT_REFS_PATH)).pipe(Option.orElse(() => Option.flatMap(afterPrefix(target, origins.api), named("api-repository", API_REPOSITORY_PATH))));
+};
+/**
+ * Returns the repository name in `location`, GitHub's redirect of the upstream URL `requested`,
+ * if both are git's `/OWNER/REPO/info/refs` or both are the API's `/repos/OWNER/REPO`, so only
+ * the owner and repository differ. Returns `None` for other redirects, such as a release
+ * download's, which can point at another repository without a rename.
+ */
+export const redirectedName = (origins, requested, location) => Option.flatMap(repositoryItself(origins, requested), ({ resource }) => repositoryItself(origins, location).pipe(Option.filter((redirected) => redirected.resource === resource), Option.map(({ repository }) => repository)));
+/** Why GitHub's API didn't confirm that the attached repository has a redirect's name. */
+class RenameUnconfirmed extends Schema.TaggedError()("RenameUnconfirmed", {
+    reason: Schema.Literals([
+        "former-name-not-redirected",
+        "repository-unreadable",
+        "other-current-name",
+        "github-unreachable",
+    ]),
+    detail: Schema.String,
+}) {
+}
+/** Where GitHub's API redirects a renamed or transferred repository's former name. */
+const REPOSITORY_BY_ID_PATH = /^\/repositories\/[1-9][0-9]*$/u;
+const decodeCurrentName = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Struct({ full_name: RepositoryName })));
+const API_HEADERS = Headers.fromInput({
+    accept: "application/vnd.github+json",
+    "user-agent": "usine-gateway",
+});
+/**
+ * Confirms with GitHub's API, using the attachment's credential, that `newName` is the attached
+ * repository's current name: `/repos/OWNER/REPO` for the attached name must answer a permanent
+ * redirect to `/repositories/ID`, and the `full_name` of repository ID must be `newName`. Fails
+ * with `RenameUnconfirmed` otherwise, or if GitHub can't be reached.
+ */
+export const confirmRename = Effect.fn("GitHubRename.confirm")(function* (client, origins, attachment, newName) {
+    yield* Effect.annotateCurrentSpan({ attachment: attachment.id, newName });
+    const get = (url) => client
+        .execute(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeaders(withGitHubCredential("api", attachment.credential, API_HEADERS))))
+        .pipe(Effect.flatMap((response) => Effect.map(response.text, (body) => ({
+        status: response.status,
+        location: Headers.get(response.headers, "location"),
+        body,
+    }))), Effect.provideService(HttpClient.TracerDisabledWhen, () => true), Effect.mapError((error) => new RenameUnconfirmed({ reason: "github-unreachable", detail: error.reason._tag })));
+    const former = yield* get(`${origins.api}/repos/${attachment.repository}`);
+    const byId = Option.flatMap(former.location, (location) => Option.flatMap(absoluteUrl(location), (url) => afterPrefix(`${url.origin}${url.pathname}`, origins.api))).pipe(Option.filter((path) => REPOSITORY_BY_ID_PATH.test(path)));
+    if (!PERMANENT_REDIRECTS.has(former.status) || Option.isNone(byId))
+        return yield* new RenameUnconfirmed({
+            reason: "former-name-not-redirected",
+            detail: `/repos/${attachment.repository} answered ${String(former.status)}`,
+        });
+    const current = yield* get(`${origins.api}${byId.value}`);
+    const name = current.status === 200 ? decodeCurrentName(current.body) : Option.none();
+    if (Option.isNone(name))
+        return yield* new RenameUnconfirmed({
+            reason: "repository-unreadable",
+            detail: `${byId.value} answered ${String(current.status)}`,
+        });
+    if (canonicalRepositoryName(name.value.full_name) !== canonicalRepositoryName(newName))
+        return yield* new RenameUnconfirmed({
+            reason: "other-current-name",
+            detail: `${byId.value} is ${name.value.full_name}`,
+        });
+});
+//# sourceMappingURL=rename.js.map

package/dist/github/rename.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename.js","sourceRoot":"","sources":["../../src/github/rename.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAsB,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEjG,8FAA8F;AAC9F,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAQ5E,MAAM,aAAa,GAAG,8CAA8C,CAAC;AAErE,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAE3D,MAAM,gBAAgB,GAAG,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAEpE,MAAM,gBAAgB,GAAG,CAAC,OAAsB,EAAE,GAAQ,EAAE,EAAE;IAC5D,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,QAA4B,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,EAAE;QAChF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,KAAK,KAAK,IAAI;YACnB,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YACf,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACvE,QAAQ;gBACR,UAAU;aACX,CAAC,CAAC,CAAC;IACV,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAC5F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CACjB,MAAM,CAAC,OAAO,CACZ,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,EAChC,KAAK,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAC7C,CACF,CACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAsB,EACtB,SAAc,EACd,QAAa,EACkB,EAAE,CACjC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CACpE,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAC3C,CACF,CAAC;AAEJ,0FAA0F;AAC1F,MAAM,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAAC,mBAAmB,EAAE;IAC3F,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC;QACtB,4BAA4B;QAC5B,uBAAuB;QACvB,oBAAoB;QACpB,oBAAoB;KACrB,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC;CAAG;AAEL,sFAAsF;AACtF,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAClD,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,CACpE,CAAC;AAEF,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,EAAE,6BAA6B;IACrC,YAAY,EAAE,eAAe;CAC9B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EACtE,MAA6B,EAC7B,OAAsB,EACtB,UAAsB,EACtB,OAAuB;IAEvB,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAC1B,MAAM;SACH,OAAO,CACN,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAC7B,iBAAiB,CAAC,UAAU,CAC1B,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,WAAW,CAAC,CAChE,CACF,CACF;SACA,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;QACnD,IAAI;KACL,CAAC,CAAC,CACJ,EACD,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAChE,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CACrF,CACF,CAAC;IACN,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,UAAU,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACxD,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAC5C,WAAW,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CACzD,CACF,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAChE,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC;YAClC,MAAM,EAAE,4BAA4B;YACpC,MAAM,EAAE,UAAU,UAAU,CAAC,UAAU,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;SAC5E,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtF,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACrB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC;YAClC,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;SAC3D,CAAC,CAAC;IACL,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,uBAAuB,CAAC,OAAO,CAAC;QACpF,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC;YAClC,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;SACnD,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/llm/llm.d.ts

@@ -0,0 +1,113 @@
+import { type GatewayCredentialKind, GatewayLlmProvider } from "@usine/core/worker";
+import { Option, Redacted, Schema } from "effect";
+import { Headers } from "effect/http";
+declare const AnthropicApiKey_base: Schema.Class<AnthropicApiKey, Schema.TaggedStruct<"AnthropicApiKey", {
+    readonly key: Schema.Redacted<Schema.NonEmptyString>;
+}>, {}>;
+/** An Anthropic API key, sent upstream as `x-api-key`. */
+export declare class AnthropicApiKey extends AnthropicApiKey_base {
+}
+declare const AnthropicSubscriptionToken_base: Schema.Class<AnthropicSubscriptionToken, Schema.TaggedStruct<"AnthropicSubscriptionToken", {
+    readonly token: Schema.Redacted<Schema.NonEmptyString>;
+}>, {}>;
+/**
+ * A Claude subscription token from `claude setup-token`, sent upstream as a bearer token with
+ * the OAuth beta flag. The token is valid for one year and has no refresh token. Anthropic
+ * doesn't document swapping a placeholder for one through a proxy; `test/placeholder-swap`
+ * checks that it works.
+ */
+export declare class AnthropicSubscriptionToken extends AnthropicSubscriptionToken_base {
+}
+/** The credential added to Anthropic requests. */
+export declare const AnthropicCredential: Schema.Union<readonly [typeof AnthropicApiKey, typeof AnthropicSubscriptionToken]>;
+export type AnthropicCredential = typeof AnthropicCredential.Type;
+declare const AnthropicProvider_base: Schema.Class<AnthropicProvider, Schema.TaggedStruct<"AnthropicProvider", {
+    readonly upstream: Schema.brand<Schema.String, "UpstreamBase">;
+    readonly credential: Schema.Union<readonly [typeof AnthropicApiKey, typeof AnthropicSubscriptionToken]>;
+}>, {}>;
+/** Claude Code's upstream. On the Worker, `ANTHROPIC_BASE_URL` is `http://llm.<domain>/anthropic`. */
+export declare class AnthropicProvider extends AnthropicProvider_base {
+}
+declare const OpenAiApiKey_base: Schema.Class<OpenAiApiKey, Schema.TaggedStruct<"OpenAiApiKey", {
+    readonly key: Schema.Redacted<Schema.NonEmptyString>;
+}>, {}>;
+/** An OpenAI-compatible API key, sent upstream as a bearer token. */
+export declare class OpenAiApiKey extends OpenAiApiKey_base {
+}
+/** An absolute path to a file on the Gateway host. */
+export declare const HostFilePath: Schema.brand<Schema.String, "HostFilePath">;
+export type HostFilePath = typeof HostFilePath.Type;
+declare const ChatGptLogin_base: Schema.Class<ChatGptLogin, Schema.TaggedStruct<"ChatGptLogin", {
+    readonly authFile: Schema.brand<Schema.String, "HostFilePath">;
+    readonly tokenUrl: Schema.brand<Schema.String, "UpstreamBase">;
+}>, {}>;
+/**
+ * A ChatGPT login from `codex login`, read from the `auth.json` that Codex writes. The Gateway
+ * keeps its tokens in memory, refreshes them at `tokenUrl` before they expire, and writes the
+ * rotated tokens back to `authFile`.
+ */
+export declare class ChatGptLogin extends ChatGptLogin_base {
+}
+/** The credential added to OpenAI requests. */
+export declare const OpenAiCredential: Schema.Union<readonly [typeof OpenAiApiKey, typeof ChatGptLogin]>;
+export type OpenAiCredential = typeof OpenAiCredential.Type;
+declare const OpenAiProvider_base: Schema.Class<OpenAiProvider, Schema.TaggedStruct<"OpenAiProvider", {
+    readonly upstream: Schema.brand<Schema.String, "UpstreamBase">;
+    readonly credential: Schema.Union<readonly [typeof OpenAiApiKey, typeof ChatGptLogin]>;
+}>, {}>;
+/**
+ * Codex's upstream: an OpenAI-compatible API with an API key, or the ChatGPT backend with a
+ * ChatGPT login. On the Worker, the `model_provider` `base_url` is `http://llm.<domain>/openai/v1`
+ * in both cases.
+ */
+export declare class OpenAiProvider extends OpenAiProvider_base {
+}
+/** The LLM upstreams the Gateway forwards to. Requests for a provider without a credential are refused. */
+export interface LlmProviders {
+    readonly anthropic: Option.Option<AnthropicProvider>;
+    readonly openai: Option.Option<OpenAiProvider>;
+}
+/** A provider with its credential. */
+export type LlmProvider = AnthropicProvider | OpenAiProvider;
+/** The `llm.<domain>` path prefixes that select a provider. */
+export declare const LlmProviderName: Schema.Literals<readonly ["anthropic", "openai"]>;
+export type LlmProviderName = GatewayLlmProvider;
+/** An LLM request's provider and the path after its prefix. */
+export interface LlmTarget {
+    readonly provider: LlmProviderName;
+    readonly rest: string;
+}
+/** Returns the provider from the first path segment; for example, `/anthropic/v1/messages` is Anthropic's `/v1/messages`. */
+export declare const llmTarget: (pathname: string) => Option.Option<LlmTarget>;
+/** Returns the credential kind sent to `provider`: a subscription for a Claude token or a ChatGPT login. */
+export declare const credentialKind: (provider: LlmProvider) => GatewayCredentialKind;
+/** Returns the configured provider for `name` as a single forwardable value. */
+export declare const configuredProvider: (providers: LlmProviders, name: LlmProviderName) => Option.Option<LlmProvider>;
+/**
+ * Returns the upstream path for `rest`, the path after the provider's prefix, if it's one of the
+ * provider's `LLM_ROUTES`. Codex calls `<base_url>/responses` with `base_url` ending in `/v1`;
+ * the ChatGPT backend serves the same routes without `/v1`, so with a ChatGPT login
+ * `/v1/responses` is the backend's `/responses`.
+ */
+export declare const llmRoute: (provider: LlmProvider, rest: string) => Option.Option<string>;
+/** A credential sent as it's configured, without a refresh. */
+export type StaticCredential = AnthropicApiKey | AnthropicSubscriptionToken | OpenAiApiKey;
+/**
+ * Adds `credential` to headers without the caller's credential. For a subscription token, also
+ * merges the OAuth beta flag into the harness's flags.
+ */
+export declare const withStaticCredential: (credential: StaticCredential, headers: Headers.Headers) => Headers.Headers;
+/** A ChatGPT login's current access token and account, as Codex sends them to the ChatGPT backend. */
+export interface ChatGptAccess {
+    readonly accessToken: Redacted.Redacted<string>;
+    /** The ChatGPT account or workspace ID, sent as `ChatGPT-Account-ID`; `None` if the login has none. */
+    readonly accountId: Option.Option<string>;
+}
+/**
+ * Adds a ChatGPT login's access token as a bearer token and its account as `ChatGPT-Account-ID`,
+ * replacing any account header the caller sent. Other headers, such as Codex's `originator` and
+ * `session-id`, pass unchanged.
+ */
+export declare const withChatGptAccess: (access: ChatGptAccess, headers: Headers.Headers) => Headers.Headers;
+export {};
+//# sourceMappingURL=llm.d.ts.map

package/dist/llm/llm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm.d.ts","sourceRoot":"","sources":["../../src/llm/llm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;;;;AAKtC,0DAA0D;AAC1D,qBAAa,eAAgB,SAAQ,oBAEnC;CAAG;;;;AAEL;;;;;GAKG;AACH,qBAAa,0BAA2B,SAAQ,+BAG/C;CAAG;AAEJ,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,oFAA8D,CAAC;AAC/F,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAC;;;;;AAElE,sGAAsG;AACtG,qBAAa,iBAAkB,SAAQ,sBAGtC;CAAG;;;;AAEJ,qEAAqE;AACrE,qBAAa,YAAa,SAAQ,iBAEhC;CAAG;AAEL,sDAAsD;AACtD,eAAO,MAAM,YAAY,6CAEW,CAAC;AACrC,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;;;;;AAEpD;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,iBAGhC;CAAG;AAEL,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB,mEAA6C,CAAC;AAC3E,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAC;;;;;AAE5D;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,mBAGlC;CAAG;AAEL,2GAA2G;AAC3G,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAE7D,+DAA+D;AAC/D,eAAO,MAAM,eAAe,mDAAqB,CAAC;AAClD,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAIjD,+DAA+D;AAC/D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,6HAA6H;AAC7H,eAAO,MAAM,SAAS,aAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAKnE,CAAC;AAEF,4GAA4G;AAC5G,eAAO,MAAM,cAAc,aAAc,WAAW,KAAG,qBAStD,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,cAClB,YAAY,QACjB,eAAe,KACpB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAoE,CAAC;AAkBjG;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,aAAc,WAAW,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAIlF,CAAC;AAgBF,+DAA+D;AAC/D,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,0BAA0B,GAAG,YAAY,CAAC;AAE3F;;;GAGG;AACH,eAAO,MAAM,oBAAoB,eACnB,gBAAgB,WACnB,OAAO,CAAC,OAAO,KACvB,OAAO,CAAC,OAYV,CAAC;AAEF,sGAAsG;AACtG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,WACpB,aAAa,WACZ,OAAO,CAAC,OAAO,KACvB,OAAO,CAAC,OAUV,CAAC"}

package/dist/llm/llm.js

@@ -0,0 +1,144 @@
+import { GatewayLlmProvider } from "@usine/core/worker";
+import { Option, Redacted, Schema } from "effect";
+import { Headers } from "effect/http";
+import { UpstreamBase } from "../upstream.js";
+const Secret = Schema.Redacted(Schema.NonEmptyString);
+/** An Anthropic API key, sent upstream as `x-api-key`. */
+export class AnthropicApiKey extends Schema.TaggedClass()("AnthropicApiKey", {
+    key: Secret,
+}) {
+}
+/**
+ * A Claude subscription token from `claude setup-token`, sent upstream as a bearer token with
+ * the OAuth beta flag. The token is valid for one year and has no refresh token. Anthropic
+ * doesn't document swapping a placeholder for one through a proxy; `test/placeholder-swap`
+ * checks that it works.
+ */
+export class AnthropicSubscriptionToken extends Schema.TaggedClass()("AnthropicSubscriptionToken", { token: Secret }) {
+}
+/** The credential added to Anthropic requests. */
+export const AnthropicCredential = Schema.Union([AnthropicApiKey, AnthropicSubscriptionToken]);
+/** Claude Code's upstream. On the Worker, `ANTHROPIC_BASE_URL` is `http://llm.<domain>/anthropic`. */
+export class AnthropicProvider extends Schema.TaggedClass()("AnthropicProvider", { upstream: UpstreamBase, credential: AnthropicCredential }) {
+}
+/** An OpenAI-compatible API key, sent upstream as a bearer token. */
+export class OpenAiApiKey extends Schema.TaggedClass()("OpenAiApiKey", {
+    key: Secret,
+}) {
+}
+/** An absolute path to a file on the Gateway host. */
+export const HostFilePath = Schema.String.check(Schema.isPattern(/^\/\S*[^/\s]$/u, { message: "Expected an absolute file path" })).pipe(Schema.brand("HostFilePath"));
+/**
+ * A ChatGPT login from `codex login`, read from the `auth.json` that Codex writes. The Gateway
+ * keeps its tokens in memory, refreshes them at `tokenUrl` before they expire, and writes the
+ * rotated tokens back to `authFile`.
+ */
+export class ChatGptLogin extends Schema.TaggedClass()("ChatGptLogin", {
+    authFile: HostFilePath,
+    tokenUrl: UpstreamBase,
+}) {
+}
+/** The credential added to OpenAI requests. */
+export const OpenAiCredential = Schema.Union([OpenAiApiKey, ChatGptLogin]);
+/**
+ * Codex's upstream: an OpenAI-compatible API with an API key, or the ChatGPT backend with a
+ * ChatGPT login. On the Worker, the `model_provider` `base_url` is `http://llm.<domain>/openai/v1`
+ * in both cases.
+ */
+export class OpenAiProvider extends Schema.TaggedClass()("OpenAiProvider", {
+    upstream: UpstreamBase,
+    credential: OpenAiCredential,
+}) {
+}
+/** The `llm.<domain>` path prefixes that select a provider. */
+export const LlmProviderName = GatewayLlmProvider;
+const isProviderName = Schema.is(LlmProviderName);
+/** Returns the provider from the first path segment; for example, `/anthropic/v1/messages` is Anthropic's `/v1/messages`. */
+export const llmTarget = (pathname) => {
+    const match = /^\/([a-z]+)(\/.*)?$/u.exec(pathname);
+    const provider = match?.[1];
+    if (match === null || provider === undefined || !isProviderName(provider))
+        return Option.none();
+    return Option.some({ provider, rest: match[2] ?? "" });
+};
+/** Returns the credential kind sent to `provider`: a subscription for a Claude token or a ChatGPT login. */
+export const credentialKind = (provider) => {
+    switch (provider.credential._tag) {
+        case "AnthropicApiKey":
+        case "OpenAiApiKey":
+            return "api-key";
+        case "AnthropicSubscriptionToken":
+        case "ChatGptLogin":
+            return "subscription";
+    }
+};
+/** Returns the configured provider for `name` as a single forwardable value. */
+export const configuredProvider = (providers, name) => (name === "anthropic" ? providers.anthropic : providers.openai);
+/**
+ * The routes each provider serves after its prefix: those Claude Code and Codex call. Each
+ * pattern matches whole plain segments, so a percent-encoded separator or a dot segment never
+ * matches, and other parts of the provider's API, such as files or organization administration,
+ * can't be reached with the Gateway's credential.
+ */
+const LLM_ROUTES = {
+    anthropic: [
+        /^\/v1\/messages$/u,
+        /^\/v1\/messages\/count_tokens$/u,
+        /^\/v1\/models$/u,
+        /^\/v1\/models\/[A-Za-z0-9][A-Za-z0-9._-]*$/u,
+    ],
+    openai: [/^\/v1\/responses$/u, /^\/v1\/responses\/compact$/u, /^\/v1\/models$/u],
+};
+/**
+ * Returns the upstream path for `rest`, the path after the provider's prefix, if it's one of the
+ * provider's `LLM_ROUTES`. Codex calls `<base_url>/responses` with `base_url` ending in `/v1`;
+ * the ChatGPT backend serves the same routes without `/v1`, so with a ChatGPT login
+ * `/v1/responses` is the backend's `/responses`.
+ */
+export const llmRoute = (provider, rest) => {
+    const routes = provider._tag === "AnthropicProvider" ? LLM_ROUTES.anthropic : LLM_ROUTES.openai;
+    if (!routes.some((route) => route.test(rest)))
+        return Option.none();
+    return Option.some(provider.credential._tag === "ChatGptLogin" ? rest.slice("/v1".length) : rest);
+};
+const OAUTH_BETA = "oauth-2025-04-20";
+const withBeta = (incoming, flag) => {
+    const flags = Option.match(incoming, {
+        onNone: () => [],
+        onSome: (value) => value
+            .split(",")
+            .map((part) => part.trim())
+            .filter((part) => part !== ""),
+    });
+    return (flags.includes(flag) ? flags : [...flags, flag]).join(",");
+};
+/**
+ * Adds `credential` to headers without the caller's credential. For a subscription token, also
+ * merges the OAuth beta flag into the harness's flags.
+ */
+export const withStaticCredential = (credential, headers) => {
+    switch (credential._tag) {
+        case "OpenAiApiKey":
+            return Headers.set(headers, "authorization", `Bearer ${Redacted.value(credential.key)}`);
+        case "AnthropicApiKey":
+            return Headers.set(headers, "x-api-key", Redacted.value(credential.key));
+        case "AnthropicSubscriptionToken":
+            return Headers.setAll(headers, {
+                authorization: `Bearer ${Redacted.value(credential.token)}`,
+                "anthropic-beta": withBeta(Headers.get(headers, "anthropic-beta"), OAUTH_BETA),
+            });
+    }
+};
+/**
+ * Adds a ChatGPT login's access token as a bearer token and its account as `ChatGPT-Account-ID`,
+ * replacing any account header the caller sent. Other headers, such as Codex's `originator` and
+ * `session-id`, pass unchanged.
+ */
+export const withChatGptAccess = (access, headers) => {
+    const bearer = Headers.set(Headers.remove(headers, "chatgpt-account-id"), "authorization", `Bearer ${Redacted.value(access.accessToken)}`);
+    return Option.match(access.accountId, {
+        onNone: () => bearer,
+        onSome: (accountId) => Headers.set(bearer, "chatgpt-account-id", accountId),
+    });
+};
+//# sourceMappingURL=llm.js.map

package/dist/llm/llm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm.js","sourceRoot":"","sources":["../../src/llm/llm.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AAEtD,0DAA0D;AAC1D,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CAAC,iBAAiB,EAAE;IAC5F,GAAG,EAAE,MAAM;CACZ,CAAC;CAAG;AAEL;;;;;GAKG;AACH,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,EAA8B,CAC9F,4BAA4B,EAC5B,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB;CAAG;AAEJ,kDAAkD;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAG/F,sGAAsG;AACtG,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAC5D;CAAG;AAEJ,qEAAqE;AACrE,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,cAAc,EAAE;IACnF,GAAG,EAAE,MAAM;CACZ,CAAC;CAAG;AAEL,sDAAsD;AACtD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAC7C,MAAM,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAClF,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;AAGrC;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,cAAc,EAAE;IACnF,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,YAAY;CACvB,CAAC;CAAG;AAEL,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AAG3E;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,EAAkB,CAAC,gBAAgB,EAAE;IACzF,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,gBAAgB;CAC7B,CAAC;CAAG;AAWL,+DAA+D;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAGlD,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;AAQlD,6HAA6H;AAC7H,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAA4B,EAAE;IACtE,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAChG,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,4GAA4G;AAC5G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAqB,EAAyB,EAAE;IAC7E,QAAQ,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACjC,KAAK,iBAAiB,CAAC;QACvB,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC;QACnB,KAAK,4BAA4B,CAAC;QAClC,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC;IAC1B,CAAC;AACH,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAAuB,EACvB,IAAqB,EACO,EAAE,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAEjG;;;;;GAKG;AACH,MAAM,UAAU,GAAG;IACjB,SAAS,EAAE;QACT,mBAAmB;QACnB,iCAAiC;QACjC,iBAAiB;QACjB,6CAA6C;KAC9C;IACD,MAAM,EAAE,CAAC,oBAAoB,EAAE,6BAA6B,EAAE,iBAAiB,CAAC;CACf,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAqB,EAAE,IAAY,EAAyB,EAAE;IACrF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;IAChG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC,MAAM,QAAQ,GAAG,CAAC,QAA+B,EAAE,IAAY,EAAU,EAAE;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,GAA0B,EAAE,CAAC,EAAE;QACvC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,KAAK;aACF,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC,CAAC;AAKF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,UAA4B,EAC5B,OAAwB,EACP,EAAE;IACnB,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,cAAc;YACjB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,KAAK,iBAAiB;YACpB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,KAAK,4BAA4B;YAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE;gBAC7B,aAAa,EAAE,UAAU,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE;gBAC3D,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,UAAU,CAAC;aAC/E,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC;AASF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAAqB,EACrB,OAAwB,EACP,EAAE;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CACxB,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAC7C,eAAe,EACf,UAAU,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAC/C,CAAC;IACF,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;QACpC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QACpB,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,SAAS,CAAC;KAC5E,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/node/egress-proxy.d.ts

@@ -0,0 +1,30 @@
+import { Effect, Schema } from "effect";
+import { CallerTokens } from "../caller/caller.ts";
+import { GatewaySettings, SettingsInForce } from "../settings.ts";
+import type { Listener } from "./environment.ts";
+declare const EgressProxyListenError_base: Schema.Class<EgressProxyListenError, Schema.TaggedStruct<"EgressProxyListenError", {
+    readonly host: Schema.String;
+    readonly port: Schema.Int;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The error when the forward proxy can't listen on its address. */
+export declare class EgressProxyListenError extends EgressProxyListenError_base {
+}
+/**
+ * Serves the forward proxy that Workers use for package registries and other allowlisted
+ * hosts: `CONNECT host:443` for HTTPS, and absolute-form requests (`GET http://host/...`) for
+ * plain HTTP mirrors such as apt.
+ *
+ * - A tunnel opens only after the ClientHello's server name matches the CONNECT host.
+ * - The proxy resolves names itself and refuses one that resolves to a private address.
+ * - Requests for `git.<domain>` and `llm.<domain>` on port 80 go to the reverse proxy at
+ *   `gateway`, so a client that proxies everything (Claude Code with `HTTPS_PROXY`) still
+ *   connects to them.
+ * - A caller token in `Proxy-Authorization` is optional and only identifies the Worker in logs.
+ * - Each refusal is logged with the host, reason, and client address.
+ * - Each request is checked against the allowlist current at arrival, so an open tunnel stays
+ *   open after a reload removes its host.
+ */
+export declare const serveEgressProxy: (listener: Listener, gateway: Listener) => Effect.Effect<Listener, EgressProxyListenError, CallerTokens | GatewaySettings | import("effect/Scope").Scope | SettingsInForce>;
+export {};
+//# sourceMappingURL=egress-proxy.d.ts.map

package/dist/node/egress-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-proxy.d.ts","sourceRoot":"","sources":["../../src/node/egress-proxy.ts"],"names":[],"mappings":"AAUA,OAAO,EAAQ,MAAM,EAAmC,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE/E,OAAO,EAA0B,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAK3E,OAAO,EAAE,eAAe,EAAgB,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;;;;;;AAqCjD,oEAAoE;AACpE,qBAAa,sBAAuB,SAAQ,2BAG3C;CAAG;AA4KJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,6KA0a3B,CAAC"}