@usine/gateway 0.0.0-stage → 0.2.0

package/dist/node/environment.js

@@ -0,0 +1,140 @@
+import { GatewayDomain } from "@usine/core/worker";
+import { Config, ConfigProvider, Effect, FileSystem, Layer, Option, Schema } from "effect";
+import { parseEgressAllowlist } from "../egress/egress.js";
+import { GITHUB_ORIGINS } from "../github/github.js";
+import { checkAuthFileWritable, readAuthFile } from "../chatgpt/auth-file.js";
+import { CHATGPT_TOKEN_URL } from "../chatgpt/logins.js";
+import { AnthropicApiKey, AnthropicProvider, AnthropicSubscriptionToken, ChatGptLogin, HostFilePath, LlmProviderName, OpenAiApiKey, OpenAiProvider, } from "../llm/llm.js";
+import { AdminToken, CallerKey, GatewaySettings } from "../settings.js";
+import { UpstreamBase } from "../upstream.js";
+/** The allowlist path if `USINE_GATEWAY_EGRESS_ALLOWLIST` isn't set. */
+export const DEFAULT_EGRESS_ALLOWLIST_PATH = "/etc/usine-gateway/egress-allowlist";
+const Secret = Schema.RedactedFromValue(Schema.NonEmptyString);
+const upstream = (name, fallback) => Config.schema(UpstreamBase, name).pipe(Config.withDefault(UpstreamBase.make(fallback)));
+/** The error when two credentials are set for one provider, such as an API key and a subscription token. */
+export class ConflictingProviderCredentials extends Schema.TaggedError()("ConflictingProviderCredentials", { provider: LlmProviderName, message: Schema.String }) {
+}
+/** The error when a file listed in `USINE_GATEWAY_ENVIRONMENT_FILES` can't be read. */
+export class EnvironmentFileError extends Schema.TaggedError()("EnvironmentFileError", { path: Schema.String, message: Schema.String }) {
+}
+/**
+ * Reads the `:`-separated environment files listed in `USINE_GATEWAY_ENVIRONMENT_FILES` in
+ * `base`, one `KEY=value` per line, and layers them over `base`. Later files override earlier
+ * ones, as with systemd's `EnvironmentFile=`. Without that variable, returns `base` alone.
+ */
+export const readSettingsSource = Effect.fn("GatewayNode.readSettingsSource")(function* (base) {
+    const fs = yield* FileSystem.FileSystem;
+    const named = yield* Config.option(Config.String("USINE_GATEWAY_ENVIRONMENT_FILES")).parse(base);
+    const files = Option.match(named, {
+        onNone: () => [],
+        onSome: (value) => value.split(":").filter((path) => path !== ""),
+    });
+    const contents = yield* Effect.forEach(files, (path) => fs
+        .readFileString(path)
+        .pipe(Effect.mapError((error) => new EnvironmentFileError({ path, message: error.message }))));
+    const provider = contents.reduce((below, text) => ConfigProvider.fromDotEnvContents(text).pipe(ConfigProvider.orElse(below)), base);
+    return { files, provider };
+});
+/** Returns the credential set for `provider`, or fails if both of its variables are set. */
+const onlyOne = (provider, [firstName, first], [secondName, second]) => Option.isSome(first) && Option.isSome(second)
+    ? Effect.fail(new ConflictingProviderCredentials({
+        provider,
+        message: `${firstName} and ${secondName} are both set, and the gateway sends only one ${provider} credential. Unset one of them.`,
+    }))
+    : Effect.succeed(Option.isSome(first) ? first : second);
+/**
+ * The LLM providers and credentials from the settings. A ChatGPT login's auth file is read and
+ * parsed, and its directory checked for writing, so an unusable file fails here, before the
+ * Gateway listens or a reload applies it.
+ */
+export const llmProviders = Effect.gen(function* () {
+    const anthropicKey = yield* Config.option(Config.schema(Secret, "ANTHROPIC_API_KEY"));
+    const subscription = yield* Config.option(Config.schema(Secret, "USINE_GATEWAY_ANTHROPIC_SUBSCRIPTION_TOKEN"));
+    const openAiKey = yield* Config.option(Config.schema(Secret, "OPENAI_API_KEY"));
+    const chatGptAuthFile = yield* Config.option(Config.schema(HostFilePath, "USINE_GATEWAY_CHATGPT_AUTH_FILE"));
+    const anthropicUpstream = yield* upstream("USINE_GATEWAY_ANTHROPIC_UPSTREAM", "https://api.anthropic.com");
+    const openAiUpstream = yield* upstream("USINE_GATEWAY_OPENAI_UPSTREAM", "https://api.openai.com");
+    const chatGptUpstream = yield* upstream("USINE_GATEWAY_CHATGPT_UPSTREAM", "https://chatgpt.com/backend-api/codex");
+    const anthropicCredential = yield* onlyOne("anthropic", ["ANTHROPIC_API_KEY", Option.map(anthropicKey, (key) => new AnthropicApiKey({ key }))], [
+        "USINE_GATEWAY_ANTHROPIC_SUBSCRIPTION_TOKEN",
+        Option.map(subscription, (token) => new AnthropicSubscriptionToken({ token })),
+    ]);
+    const openAiCredential = yield* onlyOne("openai", ["OPENAI_API_KEY", Option.map(openAiKey, (key) => new OpenAiApiKey({ key }))], [
+        "USINE_GATEWAY_CHATGPT_AUTH_FILE",
+        Option.map(chatGptAuthFile, (authFile) => new ChatGptLogin({ authFile, tokenUrl: UpstreamBase.make(CHATGPT_TOKEN_URL) })),
+    ]);
+    if (Option.isSome(openAiCredential) && openAiCredential.value._tag === "ChatGptLogin") {
+        yield* readAuthFile(openAiCredential.value.authFile);
+        yield* checkAuthFileWritable(openAiCredential.value.authFile);
+    }
+    return {
+        anthropic: Option.map(anthropicCredential, (credential) => new AnthropicProvider({ upstream: anthropicUpstream, credential })),
+        openai: Option.map(openAiCredential, (credential) => new OpenAiProvider({
+            upstream: credential._tag === "ChatGptLogin" ? chatGptUpstream : openAiUpstream,
+            credential,
+        })),
+    };
+});
+/** Returns each provider's credential kind for a log line, or `none`. */
+const providerCredentials = ({ anthropic, openai }) => ({
+    anthropic: Option.match(anthropic, {
+        onNone: () => "none",
+        onSome: (held) => held.credential._tag,
+    }),
+    openai: Option.match(openai, { onNone: () => "none", onSome: (held) => held.credential._tag }),
+});
+export const egressAllowlistPath = Config.String("USINE_GATEWAY_EGRESS_ALLOWLIST").pipe(Config.withDefault(DEFAULT_EGRESS_ALLOWLIST_PATH));
+/** Reads and parses the allowlist file at `path`. */
+export const readEgressAllowlist = Effect.fn("GatewayNode.readEgressAllowlist")(function* (path) {
+    const fs = yield* FileSystem.FileSystem;
+    const text = yield* fs.readFileString(path);
+    return yield* Effect.fromResult(parseEgressAllowlist(text));
+});
+const listener = (prefix, host, port) => Config.all({
+    host: Config.String(`${prefix}_HOST`).pipe(Config.withDefault(host)),
+    port: Config.Port(`${prefix}_PORT`).pipe(Config.withDefault(port)),
+});
+/**
+ * Listeners from the environment. The proxies default to loopback, so an unconfigured Gateway
+ * is unreachable; the VM's unit sets its private address.
+ */
+export const listenersFromEnvironment = Config.all({
+    proxy: listener("USINE_GATEWAY_PROXY", "127.0.0.1", 80),
+    egress: listener("USINE_GATEWAY_EGRESS", "127.0.0.1", 3128),
+    admin: listener("USINE_GATEWAY_ADMIN", "127.0.0.1", 7070),
+});
+export const restartSettings = Config.all({
+    domain: Config.schema(GatewayDomain, "USINE_GATEWAY_DOMAIN"),
+    adminToken: Config.schema(AdminToken, "USINE_GATEWAY_ADMIN_TOKEN"),
+    callerKey: Config.schema(CallerKey, "USINE_GATEWAY_CALLER_KEY"),
+    listeners: listenersFromEnvironment,
+});
+const startupSettings = Effect.gen(function* () {
+    const { domain, adminToken, callerKey, listeners } = yield* restartSettings;
+    const path = yield* egressAllowlistPath;
+    const egress = yield* readEgressAllowlist(path);
+    yield* Effect.logInfo("Loaded the egress allowlist", { path, rules: egress.rules.length });
+    const providers = yield* llmProviders;
+    yield* Effect.logInfo("Configured LLM providers", providerCredentials(providers));
+    const settings = { domain, github: GITHUB_ORIGINS, providers, egress, adminToken, callerKey };
+    return { settings, listeners };
+});
+/**
+ * Reads the Gateway's settings from `source`. Fails on a missing secret, an invalid value, an
+ * unreadable allowlist, or an unusable ChatGPT auth file, so the Gateway stops before it listens.
+ */
+export const readStartupSettings = Effect.fn("GatewayNode.readStartupSettings")(function* (source) {
+    yield* Effect.logInfo("Reading the gateway settings", { environmentFiles: source.files });
+    return yield* startupSettings.pipe(Effect.provideService(ConfigProvider.ConfigProvider, source.provider));
+});
+/**
+ * The Gateway's settings, read once at startup from the files in
+ * `USINE_GATEWAY_ENVIRONMENT_FILES` over the process environment, plus the egress allowlist
+ * file. Fails on a missing secret, an invalid value, or an unreadable or unusable file.
+ */
+export const settingsFromEnvironment = Layer.effect(GatewaySettings, Effect.gen(function* () {
+    const source = yield* readSettingsSource(yield* ConfigProvider.ConfigProvider);
+    const { settings } = yield* readStartupSettings(source);
+    return settings;
+}));
+//# sourceMappingURL=environment.js.map

package/dist/node/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../src/node/environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,YAAY,EACZ,YAAY,EACZ,eAAe,EAEf,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;AAEnF,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AAE/D,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,EAAE,CAClD,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE1F,4GAA4G;AAC5G,MAAM,OAAO,8BAA+B,SAAQ,MAAM,CAAC,WAAW,EAAkC,CACtG,gCAAgC,EAChC,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CACtD;CAAG;AAEJ,uFAAuF;AACvF,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,EAAwB,CAClF,sBAAsB,EACtB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAChD;CAAG;AASJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAAC,EACrF,IAAmC;IAEnC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;QAChC,MAAM,EAAE,GAA0B,EAAE,CAAC,EAAE;QACvC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;KAClE,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACrD,EAAE;SACC,cAAc,CAAC,IAAI,CAAC;SACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAChG,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAC3F,IAAI,CACL,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAA2B,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,OAAO,GAAG,CACd,QAAyB,EACzB,CAAC,SAAS,EAAE,KAAK,CAAsC,EACvD,CAAC,UAAU,EAAE,MAAM,CAAsC,EACY,EAAE,CACvE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IAC3C,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,8BAA8B,CAAC;QACjC,QAAQ;QACR,OAAO,EAAE,GAAG,SAAS,QAAQ,UAAU,iDAAiD,QAAQ,iCAAiC;KAClI,CAAC,CACH;IACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9C,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CACvC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,4CAA4C,CAAC,CACpE,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAC1C,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,iCAAiC,CAAC,CAC/D,CAAC;IACF,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,QAAQ,CACvC,kCAAkC,EAClC,2BAA2B,CAC5B,CAAC;IACF,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,+BAA+B,EAAE,wBAAwB,CAAC,CAAC;IAClG,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,QAAQ,CACrC,gCAAgC,EAChC,uCAAuC,CACxC,CAAC;IACF,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,OAAO,CACxC,WAAW,EACX,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EACtF;QACE,4CAA4C;QAC5C,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,0BAA0B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;KAC/E,CACF,CAAC;IACF,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,OAAO,CACrC,QAAQ,EACR,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAC7E;QACE,iCAAiC;QACjC,MAAM,CAAC,GAAG,CACR,eAAe,EACf,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CACjF;KACF,CACF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACtF,KAAK,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,KAAK,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,GAAG,CACnB,mBAAmB,EACnB,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CACnF;QACD,MAAM,EAAE,MAAM,CAAC,GAAG,CAChB,gBAAgB,EAChB,CAAC,UAAU,EAAE,EAAE,CACb,IAAI,cAAc,CAAC;YACjB,QAAQ,EAAE,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;YAC/E,UAAU;SACX,CAAC,CACL;KACqB,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAgB,EAAE,EAAE,CAAC,CAAC;IACpE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;QACjC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QACpB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI;KACvC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;CAC/F,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC,IAAI,CACrF,MAAM,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAClD,CAAC;AAEF,qDAAqD;AACrD,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EACvF,IAAY;IAEZ,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAcH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE,CAC9D,MAAM,CAAC,GAAG,CAAC;IACT,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;CACnE,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAC;IACjD,KAAK,EAAE,QAAQ,CAAC,qBAAqB,EAAE,WAAW,EAAE,EAAE,CAAC;IACvD,MAAM,EAAE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,EAAE,IAAI,CAAC;IAC3D,KAAK,EAAE,QAAQ,CAAC,qBAAqB,EAAE,WAAW,EAAE,IAAI,CAAC;CAC1D,CAAC,CAAC;AAUH,MAAM,CAAC,MAAM,eAAe,GAAmC,MAAM,CAAC,GAAG,CAAC;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,sBAAsB,CAAC;IAC5D,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAClE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,0BAA0B,CAAC;IAC/D,SAAS,EAAE,wBAAwB;CACpC,CAAC,CAAC;AAOH,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;IACtC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC9F,OAAO,EAAE,QAAQ,EAAE,SAAS,EAA4B,CAAC;AAC3D,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EACvF,MAAsB;IAEtB,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAChC,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CACtE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,MAAM,CACjD,eAAe,EACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IAC/E,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC,CACH,CAAC"}

package/dist/node/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/node/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/node/main.ts"],"names":[],"mappings":""}

package/dist/node/main.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { NodeRuntime, NodeServices } from "@effect/platform-node";
+import { Cause, Effect, Exit, Layer, Logger, Runtime } from "effect";
+import { gatewayFromEnvironment } from "./node.js";
+// One JSON object per line, so `journalctl -o cat | jq` can filter journald output.
+const logger = Logger.layer([Logger.consoleJson]);
+NodeRuntime.runMain(Layer.launch(gatewayFromEnvironment).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, logger))), {
+    // The Gateway runs until a signal interrupts it, so systemd records the stop as a success.
+    teardown: (exit, onExit) => Exit.isFailure(exit) && Cause.hasInterruptsOnly(exit.cause)
+        ? onExit(0)
+        : Runtime.defaultTeardown(exit, onExit),
+});
+//# sourceMappingURL=main.js.map

package/dist/node/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/node/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAEnD,oFAAoF;AACpF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;AAElD,WAAW,CAAC,OAAO,CACjB,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,CACvC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAC3D,EACD;IACE,2FAA2F;IAC3F,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACX,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC;CAC5C,CACF,CAAC"}

package/dist/node/node.d.ts

@@ -0,0 +1,28 @@
+import { Context, Layer } from "effect";
+import { GatewaySettings } from "../settings.ts";
+import { type GatewayListeners, type Listener } from "./environment.ts";
+export { ConflictingProviderCredentials, DEFAULT_EGRESS_ALLOWLIST_PATH, EnvironmentFileError, type GatewayListeners, type Listener, listenersFromEnvironment, settingsFromEnvironment, } from "./environment.ts";
+export { EgressProxyListenError } from "./egress-proxy.ts";
+export { GatewayReload } from "./reload.ts";
+declare const GatewayAddresses_base: Context.ServiceClass<GatewayAddresses, "@usine/gateway/node/GatewayAddresses", {
+    readonly proxy: Listener;
+    readonly egress: Listener;
+    readonly admin: Listener;
+}>;
+/** The bound addresses of the Gateway's three servers, with any port 0 replaced by the assigned port. */
+export declare class GatewayAddresses extends GatewayAddresses_base {
+}
+/**
+ * The Gateway on Node: the reverse proxy, forward proxy, and admin API on their listeners,
+ * sharing one attachment store, caller token signer, settings, and ChatGPT logins. Upstream
+ * requests use undici, which doesn't change `content-encoding`, so compressed bodies pass
+ * through unchanged. ChatGPT logins read and write their auth files with Node's file system.
+ */
+export declare const gatewayLayer: (listeners: GatewayListeners) => Layer.Layer<import("../gateway.ts").Attachments | import("../gateway.ts").CallerTokens | import("../gateway.ts").ChatGptLogins | GatewayAddresses | import("../settings.ts").SettingsInForce, import("./egress-proxy.ts").EgressProxyListenError | import("effect/http/HttpServerError").ServeError, GatewaySettings>;
+/**
+ * The Gateway configured from its environment files, the process environment, and its
+ * allowlist file, as run by the `usine-gateway` command. On SIGHUP, reloads the egress
+ * allowlist and LLM providers with `GatewayReload`.
+ */
+export declare const gatewayFromEnvironment: Layer.Layer<import("../gateway.ts").Attachments | import("../gateway.ts").CallerTokens | import("../gateway.ts").ChatGptLogins | GatewayAddresses | import("./reload.ts").GatewayReload | import("../settings.ts").SettingsInForce, import("../gateway.ts").ChatGptAuthFileError | import("effect/Config").ConfigError | import("./environment.ts").ConflictingProviderCredentials | import("../gateway.ts").EgressAllowlistError | import("./egress-proxy.ts").EgressProxyListenError | import("./environment.ts").EnvironmentFileError | import("effect/PlatformError").PlatformError | import("effect/http/HttpServerError").ServeError, import("effect/FileSystem").FileSystem>;
+//# sourceMappingURL=node.d.ts.map

package/dist/node/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/node/node.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,OAAO,EAAU,KAAK,EAAU,MAAM,QAAQ,CAAC;AAaxE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EAGd,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;;oBAKxB,QAAQ;qBAAmB,QAAQ;oBAAkB,QAAQ;;AAHjF,yGAAyG;AACzG,qBAAa,gBAAiB,SAAQ,qBAGK;CAAG;AA0D9C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,cAAe,gBAAgB,0TAgBrD,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,qpBAUlC,CAAC"}

package/dist/node/node.js

@@ -0,0 +1,81 @@
+import { createServer } from "node:http";
+import { NodeFileSystem, NodeHttpClient, NodeHttpServer } from "@effect/platform-node";
+import { ConfigProvider, Context, Effect, Layer, Stream } from "effect";
+import { HttpMiddleware, HttpBody, HttpRouter, HttpServer, HttpServerRequest, HttpServerResponse, } from "effect/http";
+import { NetAddress } from "effect/net";
+import { adminRoutes } from "../admin/server.js";
+import { gatewayServices } from "../gateway.js";
+import { GatewayProxy } from "../proxy/proxy.js";
+import { GatewaySettings } from "../settings.js";
+import { serveEgressProxy } from "./egress-proxy.js";
+import { readSettingsSource, readStartupSettings, } from "./environment.js";
+import { gatewayReloadLayer, reloadOnHangup } from "./reload.js";
+export { ConflictingProviderCredentials, DEFAULT_EGRESS_ALLOWLIST_PATH, EnvironmentFileError, listenersFromEnvironment, settingsFromEnvironment, } from "./environment.js";
+export { EgressProxyListenError } from "./egress-proxy.js";
+export { GatewayReload } from "./reload.js";
+/** The bound addresses of the Gateway's three servers, with any port 0 replaced by the assigned port. */
+export class GatewayAddresses extends Context.Service()("@usine/gateway/node/GatewayAddresses") {
+}
+const boundTo = (address, requested) => address._tag === "UnixPathAddress"
+    ? requested
+    : { host: NetAddress.formatHost(address), port: address.port };
+/** Returns an address this process can connect to for `listener`, which may be bound to all interfaces. */
+const reachable = (listener) => listener.host === "0.0.0.0" || listener.host === "::"
+    ? { host: "127.0.0.1", port: listener.port }
+    : listener;
+const serveProxy = Effect.fn("GatewayNode.serveProxy")(function* (listener) {
+    const proxy = yield* GatewayProxy;
+    // A git push or a long model response can exceed Node's default request timeout.
+    const server = yield* NodeHttpServer.make(() => createServer({ requestTimeout: 0 }), listener);
+    yield* server.serve(Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const response = yield* proxy.handle;
+        if (response.body._tag !== "Stream")
+            return response;
+        // The server destroys a response whose body fails after its headers, so the Worker sees a
+        // partial download or model response as incomplete.
+        const body = response.body.stream.pipe(Stream.onError(() => Effect.logError("The reverse proxy response body failed", {
+            host: request.headers.host,
+            method: request.method,
+            path: request.url.split("?")[0],
+            error: "UpstreamBodyFailure",
+        })));
+        return HttpServerResponse.setBody(response, HttpBody.stream(body, response.body.contentType, response.body.contentLength));
+    }));
+    const bound = boundTo(server.address, listener);
+    yield* Effect.logInfo("The gateway proxy is listening", bound);
+    return bound;
+});
+const serveAdmin = Effect.fn("GatewayNode.serveAdmin")(function* (listener) {
+    const server = yield* NodeHttpServer.make(() => createServer(), listener);
+    yield* Layer.build(HttpRouter.serve(adminRoutes, { disableListenLog: true }).pipe(Layer.provide(Layer.succeed(HttpServer.HttpServer)(server)), Layer.provide(NodeHttpServer.layerHttpServices)));
+    const bound = boundTo(server.address, listener);
+    yield* Effect.logInfo("The gateway admin API is listening", bound);
+    return bound;
+});
+/**
+ * The Gateway on Node: the reverse proxy, forward proxy, and admin API on their listeners,
+ * sharing one attachment store, caller token signer, settings, and ChatGPT logins. Upstream
+ * requests use undici, which doesn't change `content-encoding`, so compressed bodies pass
+ * through unchanged. ChatGPT logins read and write their auth files with Node's file system.
+ */
+export const gatewayLayer = (listeners) => Layer.effect(GatewayAddresses, Effect.gen(function* () {
+    const proxy = yield* serveProxy(listeners.proxy);
+    const egress = yield* serveEgressProxy(listeners.egress, reachable(proxy));
+    const admin = yield* serveAdmin(listeners.admin);
+    return { proxy, egress, admin };
+})).pipe(Layer.provide(GatewayProxy.layer), Layer.provideMerge(gatewayServices), Layer.provide(Layer.mergeAll(NodeHttpClient.layerUndici, NodeFileSystem.layer)), 
+// No automatic HTTP span records the incoming headers. Named Gateway spans record safe fields
+// without incoming credentials.
+Layer.provide(Layer.succeed(HttpMiddleware.TracerDisabledWhen)(() => true)));
+/**
+ * The Gateway configured from its environment files, the process environment, and its
+ * allowlist file, as run by the `usine-gateway` command. On SIGHUP, reloads the egress
+ * allowlist and LLM providers with `GatewayReload`.
+ */
+export const gatewayFromEnvironment = Layer.unwrap(Effect.gen(function* () {
+    const base = yield* ConfigProvider.ConfigProvider;
+    const started = yield* readStartupSettings(yield* readSettingsSource(base));
+    return reloadOnHangup.pipe(Layer.provideMerge(gatewayReloadLayer(started, base)), Layer.provideMerge(gatewayLayer(started.listeners)), Layer.provide(Layer.succeed(GatewaySettings)(started.settings)));
+}));
+//# sourceMappingURL=node.js.map

package/dist/node/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/node/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxE,OAAO,EACL,cAAc,EACd,QAAQ,EACR,UAAU,EACV,UAAU,EACV,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAGL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,oBAAoB,EAGpB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,yGAAyG;AACzG,MAAM,OAAO,gBAAiB,SAAQ,OAAO,CAAC,OAAO,EAGlD,CAAC,sCAAsC,CAAC;CAAG;AAE9C,MAAM,OAAO,GAAG,CAAC,OAAiC,EAAE,SAAmB,EAAY,EAAE,CACnF,OAAO,CAAC,IAAI,KAAK,iBAAiB;IAChC,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAEnE,2GAA2G;AAC3G,MAAM,SAAS,GAAG,CAAC,QAAkB,EAAY,EAAE,CACjD,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;IACnD,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;IAC5C,CAAC,CAAC,QAAQ,CAAC;AAEf,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAkB;IAClF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;IAClC,iFAAiF;IACjF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/F,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACrD,0FAA0F;QAC1F,oDAAoD;QACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACpC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,MAAM,CAAC,QAAQ,CAAC,wCAAwC,EAAE;YACxD,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/B,KAAK,EAAE,qBAAqB;SAC7B,CAAC,CACH,CACF,CAAC;QACF,OAAO,kBAAkB,CAAC,OAAO,CAC/B,QAAQ,EACR,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAC9E,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAkB;IAClF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1E,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAChB,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,EAC3D,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAChD,CACF,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAA2B,EAAE,EAAE,CAC1D,KAAK,CAAC,MAAM,CACV,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EACjC,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,EACnC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/E,8FAA8F;AAC9F,gCAAgC;AAChC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAC5E,CAAC;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC,MAAM,CAChD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,cAAc,CAAC,IAAI,CACxB,KAAK,CAAC,YAAY,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EACrD,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EACnD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/dist/node/reload.d.ts

@@ -0,0 +1,27 @@
+import { ConfigProvider, Context, Effect, FileSystem, Layer } from "effect";
+import { ChatGptLogins } from "../chatgpt/logins.ts";
+import { SettingsInForce } from "../settings.ts";
+import { type StartupSettings } from "./environment.ts";
+declare const GatewayReload_base: Context.ServiceClass<GatewayReload, "@usine/gateway/node/GatewayReload", {
+    /**
+     * Reloads once, after any reload in progress. Never fails: an unreadable or invalid file keeps
+     * the current settings, restart-only settings are unchanged, and both cases are logged.
+     */
+    readonly reload: Effect.Effect<void>;
+}>;
+/**
+ * The service that reloads the egress allowlist and LLM providers from the startup environment
+ * and allowlist files. Attachments, the admin API, listeners, and open tunnels are unchanged.
+ * `usine-gateway` runs it on SIGHUP.
+ */
+export declare class GatewayReload extends GatewayReload_base {
+}
+/** Returns the reload for a Gateway started with `started`, reading settings from the environment files over `base`. */
+export declare const gatewayReloadLayer: (started: StartupSettings, base: ConfigProvider.ConfigProvider) => Layer.Layer<GatewayReload, never, ChatGptLogins | FileSystem.FileSystem | SettingsInForce>;
+/**
+ * Runs the reload on each SIGHUP while the layer is in scope, one at a time; signals during a
+ * reload trigger one more. The listener also prevents Node's default exit on SIGHUP.
+ */
+export declare const reloadOnHangup: Layer.Layer<never, never, GatewayReload>;
+export {};
+//# sourceMappingURL=reload.d.ts.map

package/dist/node/reload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reload.d.ts","sourceRoot":"","sources":["../../src/node/reload.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,cAAc,EACd,OAAO,EACP,MAAM,EACN,UAAU,EACV,KAAK,EAKN,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAQL,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;;IAUtB;;;OAGG;qBACc,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;;AAZxC;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,kBASK;CAAG;AA0I3C,wHAAwH;AACxH,eAAO,MAAM,kBAAkB,YAAa,eAAe,QAAQ,cAAc,CAAC,cAAc,+FAmE7F,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,cAAc,0CAoB1B,CAAC"}

package/dist/node/reload.js

@@ -0,0 +1,170 @@
+import { Cause, ConfigProvider, Context, Effect, FileSystem, Layer, Option, Queue, Redacted, Semaphore, } from "effect";
+import { ChatGptLogins } from "../chatgpt/logins.js";
+import { SettingsInForce } from "../settings.js";
+import { egressAllowlistPath, llmProviders, readEgressAllowlist, readSettingsSource, restartSettings, } from "./environment.js";
+/**
+ * The service that reloads the egress allowlist and LLM providers from the startup environment
+ * and allowlist files. Attachments, the admin API, listeners, and open tunnels are unchanged.
+ * `usine-gateway` runs it on SIGHUP.
+ */
+export class GatewayReload extends Context.Service()("@usine/gateway/node/GatewayReload") {
+}
+/** Returns each restart-only setting as text, keyed by its variable. */
+const restartValues = ({ domain, adminToken, callerKey, listeners }) => ({
+    USINE_GATEWAY_DOMAIN: domain,
+    USINE_GATEWAY_ADMIN_TOKEN: Redacted.value(adminToken),
+    USINE_GATEWAY_CALLER_KEY: Redacted.value(callerKey),
+    USINE_GATEWAY_PROXY_HOST: listeners.proxy.host,
+    USINE_GATEWAY_PROXY_PORT: String(listeners.proxy.port),
+    USINE_GATEWAY_EGRESS_HOST: listeners.egress.host,
+    USINE_GATEWAY_EGRESS_PORT: String(listeners.egress.port),
+    USINE_GATEWAY_ADMIN_HOST: listeners.admin.host,
+    USINE_GATEWAY_ADMIN_PORT: String(listeners.admin.port),
+});
+/** Returns each credential variable with its value, or `undefined` if unset. */
+const credentialValues = ({ anthropic, openai }) => {
+    const anthropicCredential = Option.getOrUndefined(Option.map(anthropic, (provider) => provider.credential));
+    const openAiCredential = Option.getOrUndefined(Option.map(openai, (provider) => provider.credential));
+    return {
+        ANTHROPIC_API_KEY: anthropicCredential?._tag === "AnthropicApiKey"
+            ? Redacted.value(anthropicCredential.key)
+            : undefined,
+        USINE_GATEWAY_ANTHROPIC_SUBSCRIPTION_TOKEN: anthropicCredential?._tag === "AnthropicSubscriptionToken"
+            ? Redacted.value(anthropicCredential.token)
+            : undefined,
+        OPENAI_API_KEY: openAiCredential?._tag === "OpenAiApiKey" ? Redacted.value(openAiCredential.key) : undefined,
+        USINE_GATEWAY_CHATGPT_AUTH_FILE: openAiCredential?._tag === "ChatGptLogin" ? openAiCredential.authFile : undefined,
+    };
+};
+/** The variable that sets each credential's upstream. */
+const UPSTREAM_VARIABLES = {
+    AnthropicApiKey: "USINE_GATEWAY_ANTHROPIC_UPSTREAM",
+    AnthropicSubscriptionToken: "USINE_GATEWAY_ANTHROPIC_UPSTREAM",
+    OpenAiApiKey: "USINE_GATEWAY_OPENAI_UPSTREAM",
+    ChatGptLogin: "USINE_GATEWAY_CHATGPT_UPSTREAM",
+};
+/** Returns the upstream variables that changed, for providers with the same kind of credential before and after. */
+const changedUpstreams = (before, after) => {
+    const changed = (was, is) => Option.toArray(Option.flatMap(Option.zipWith(was, is, (left, right) => [left, right]), ([left, right]) => left.credential._tag === right.credential._tag && left.upstream !== right.upstream
+        ? Option.some(UPSTREAM_VARIABLES[right.credential._tag])
+        : Option.none()));
+    return [...changed(before.anthropic, after.anthropic), ...changed(before.openai, after.openai)];
+};
+/** Returns the names of the variables whose values differ, never the values. */
+const changedVariables = (before, after) => Object.keys(before).filter((name) => before[name] !== after[name]);
+/** Logs a warning for restart-only settings that changed or no longer parse. */
+const checkRestartSettings = (started) => restartSettings.pipe(Effect.flatMap((now) => {
+    const changed = changedVariables(restartValues(started), restartValues(now));
+    return changed.length === 0
+        ? Effect.void
+        : Effect.logWarning("Settings changed that take effect only after a restart", {
+            settings: changed,
+        });
+}), Effect.catchTag("ConfigError", (error) => Effect.logWarning("A restart would fail: a setting only a restart reads is invalid", {
+    error: error.message,
+})));
+/** Returns the allowlist path and its new contents, or `None` if it can't be read or parsed. */
+const nextAllowlist = (previous) => Effect.gen(function* () {
+    // The path has a default, so reading it fails only if the settings source fails, which an in-memory source doesn't.
+    const path = yield* Effect.orDie(egressAllowlistPath);
+    const kept = (fields) => Effect.logError("Kept the previous egress allowlist", {
+        path,
+        ...fields,
+        rules: previous.rules.length,
+    }).pipe(Effect.as({ path, egress: Option.none() }));
+    return yield* readEgressAllowlist(path).pipe(Effect.map((egress) => ({ path, egress: Option.some(egress) })), Effect.catchTags({
+        EgressAllowlistError: ({ line, message }) => kept({ line, error: message }),
+        PlatformError: (error) => kept({ error: error.message }),
+    }));
+});
+const keptProviders = (error) => Effect.logError("Kept the previous LLM providers", { error }).pipe(Effect.as(Option.none()));
+/** The new LLM providers, or `None` if they're invalid. */
+const nextProviders = llmProviders.pipe(Effect.map(Option.some), Effect.catchTags({
+    ConfigError: ({ message }) => keptProviders(message),
+    ConflictingProviderCredentials: ({ message }) => keptProviders(message),
+    ChatGptAuthFileError: ({ message }) => keptProviders(message),
+}));
+/**
+ * Reads a ChatGPT login's auth file again after a reload, so a login the operator copied
+ * replaces the one in memory. An unreadable file keeps the login in memory.
+ */
+const reloadChatGptLogin = (logins, providers) => {
+    const login = Option.getOrUndefined(Option.map(providers.openai, ({ credential }) => credential));
+    if (login?._tag !== "ChatGptLogin")
+        return Effect.void;
+    return logins.reload(login).pipe(Effect.catchTag("ChatGptAuthFileError", ({ message }) => Effect.logError("Kept the ChatGPT login in memory: its auth file could not be read", {
+        authFile: login.authFile,
+        error: message,
+    })));
+};
+/** Returns the reload for a Gateway started with `started`, reading settings from the environment files over `base`. */
+export const gatewayReloadLayer = (started, base) => Layer.effect(GatewayReload, Effect.gen(function* () {
+    const inForce = yield* SettingsInForce;
+    const logins = yield* ChatGptLogins;
+    const fileSystem = yield* FileSystem.FileSystem;
+    const oneAtATime = yield* Semaphore.make(1);
+    const { domain, adminToken, callerKey } = started.settings;
+    const startedRestartSettings = {
+        domain,
+        adminToken,
+        callerKey,
+        listeners: started.listeners,
+    };
+    const reloadFrom = (source) => Effect.gen(function* () {
+        yield* checkRestartSettings(startedRestartSettings);
+        const previous = yield* inForce.current;
+        const allowlist = yield* nextAllowlist(previous.egress);
+        const providers = yield* nextProviders;
+        const next = {
+            egress: Option.getOrElse(allowlist.egress, () => previous.egress),
+            providers: Option.getOrElse(providers, () => previous.providers),
+        };
+        yield* inForce.replace(next);
+        if (Option.isSome(providers))
+            yield* reloadChatGptLogin(logins, next.providers);
+        yield* Effect.logInfo("Reloaded the gateway settings", {
+            environmentFiles: source.files,
+            allowlist: Option.isSome(allowlist.egress) ? "reloaded" : "kept",
+            path: allowlist.path,
+            rules: next.egress.rules.length,
+            providers: Option.isSome(providers) ? "reloaded" : "kept",
+            changed: [
+                ...changedVariables(credentialValues(previous.providers), credentialValues(next.providers)),
+                ...changedUpstreams(previous.providers, next.providers),
+            ],
+        });
+    }).pipe(Effect.provideService(ConfigProvider.ConfigProvider, source.provider));
+    const reload = Effect.fn("GatewayNode.reload")(function* () {
+        yield* readSettingsSource(base).pipe(Effect.flatMap(reloadFrom), Effect.catchTags({
+            EnvironmentFileError: ({ path, message }) => Effect.logError("Kept the gateway settings: an environment file could not be read", {
+                path,
+                error: message,
+            }),
+            ConfigError: ({ message }) => Effect.logError("Kept the gateway settings: the environment could not be read", {
+                error: message,
+            }),
+        }));
+    });
+    return {
+        reload: oneAtATime
+            .withPermits(1)(reload())
+            .pipe(Effect.provideService(FileSystem.FileSystem, fileSystem)),
+    };
+}));
+/**
+ * Runs the reload on each SIGHUP while the layer is in scope, one at a time; signals during a
+ * reload trigger one more. The listener also prevents Node's default exit on SIGHUP.
+ */
+export const reloadOnHangup = Layer.effectDiscard(Effect.gen(function* () {
+    const { reload } = yield* GatewayReload;
+    const hangups = yield* Queue.sliding(1);
+    const onHangup = () => {
+        Queue.offerUnsafe(hangups, undefined);
+    };
+    yield* Effect.acquireRelease(Effect.sync(() => process.on("SIGHUP", onHangup)), () => Effect.sync(() => process.off("SIGHUP", onHangup)));
+    const reloadOnce = Effect.logInfo("Reloading the gateway settings on SIGHUP").pipe(Effect.andThen(reload), 
+    // Logs a defect in one reload; the next SIGHUP reloads again.
+    Effect.catchCause((cause) => Effect.logError("A reload failed", { cause: Cause.pretty(cause) })));
+    yield* Queue.take(hangups).pipe(Effect.andThen(reloadOnce), Effect.forever, Effect.forkScoped);
+}));
+//# sourceMappingURL=reload.js.map

package/dist/node/reload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reload.js","sourceRoot":"","sources":["../../src/node/reload.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,cAAc,EACd,OAAO,EACP,MAAM,EACN,UAAU,EACV,KAAK,EACL,MAAM,EACN,KAAK,EACL,QAAQ,EACR,SAAS,GACV,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAElB,eAAe,GAGhB,MAAM,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAS/C,CAAC,mCAAmC,CAAC;CAAG;AAE3C,wEAAwE;AACxE,MAAM,aAAa,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAmB,EAAE,EAAE,CAAC,CAAC;IACxF,oBAAoB,EAAE,MAAM;IAC5B,yBAAyB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;IACrD,wBAAwB,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;IACnD,wBAAwB,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI;IAC9C,wBAAwB,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;IACtD,yBAAyB,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;IAChD,yBAAyB,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IACxD,wBAAwB,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI;IAC9C,wBAAwB,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;CACvD,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAgB,EAAE,EAAE;IAC/D,MAAM,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAC/C,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CACzD,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,CAAC,cAAc,CAC5C,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtD,CAAC;IACF,OAAO;QACL,iBAAiB,EACf,mBAAmB,EAAE,IAAI,KAAK,iBAAiB;YAC7C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC;YACzC,CAAC,CAAC,SAAS;QACf,0CAA0C,EACxC,mBAAmB,EAAE,IAAI,KAAK,4BAA4B;YACxD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC3C,CAAC,CAAC,SAAS;QACf,cAAc,EACZ,gBAAgB,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9F,+BAA+B,EAC7B,gBAAgB,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACpF,CAAC;AACJ,CAAC,CAAC;AAEF,yDAAyD;AACzD,MAAM,kBAAkB,GAAG;IACzB,eAAe,EAAE,kCAAkC;IACnD,0BAA0B,EAAE,kCAAkC;IAC9D,YAAY,EAAE,+BAA+B;IAC7C,YAAY,EAAE,gCAAgC;CACsB,CAAC;AAEvE,oHAAoH;AACpH,MAAM,gBAAgB,GAAG,CAAC,MAAoB,EAAE,KAAmB,EAAyB,EAAE;IAC5F,MAAM,OAAO,GAAG,CAAC,GAA+B,EAAE,EAA8B,EAAE,EAAE,CAClF,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC,EAChE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAChF,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CACpB,CACF,CAAC;IACJ,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAClG,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,CACvB,MAAoD,EACpD,KAAmD,EAC5B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAE/F,gFAAgF;AAChF,MAAM,oBAAoB,GAAG,CAAC,OAAwB,EAAE,EAAE,CACxD,eAAe,CAAC,IAAI,CAClB,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;IACrB,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,wDAAwD,EAAE;YAC1E,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;AACT,CAAC,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CACvC,MAAM,CAAC,UAAU,CAAC,iEAAiE,EAAE;IACnF,KAAK,EAAE,KAAK,CAAC,OAAO;CACrB,CAAC,CACH,CACF,CAAC;AAEJ,gGAAgG;AAChG,MAAM,aAAa,GAAG,CAAC,QAAyB,EAAE,EAAE,CAClD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,oHAAoH;IACpH,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,MAAiD,EAAE,EAAE,CACjE,MAAM,CAAC,QAAQ,CAAC,oCAAoC,EAAE;QACpD,IAAI;QACJ,GAAG,MAAM;QACT,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;KAC7B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAmB,EAAE,CAAC,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAC/D,MAAM,CAAC,SAAS,CAAC;QACf,oBAAoB,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC3E,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACzD,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,EAAE,CACtC,MAAM,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAgB,CAAC,CACvC,CAAC;AAEJ,2DAA2D;AAC3D,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CACrC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EACvB,MAAM,CAAC,SAAS,CAAC;IACf,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC;IACpD,8BAA8B,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC;IACvE,oBAAoB,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC;CAC9D,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,kBAAkB,GAAG,CAAC,MAAgC,EAAE,SAAuB,EAAE,EAAE;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAClG,IAAI,KAAK,EAAE,IAAI,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAC9B,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtD,MAAM,CAAC,QAAQ,CAAC,mEAAmE,EAAE;QACnF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,OAAO;KACf,CAAC,CACH,CACF,CAAC;AACJ,CAAC,CAAC;AAEF,wHAAwH;AACxH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAwB,EAAE,IAAmC,EAAE,EAAE,CAClG,KAAK,CAAC,MAAM,CACV,aAAa,EACb,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3D,MAAM,sBAAsB,GAAoB;QAC9C,MAAM;QACN,UAAU;QACV,SAAS;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,MAAsB,EAAE,EAAE,CAC5C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,KAAK,CAAC,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;QACvC,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACjE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;SACjE,CAAC;QACF,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAChF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,+BAA+B,EAAE;YACrD,gBAAgB,EAAE,MAAM,CAAC,KAAK;YAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;YAChE,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;YAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;YACzD,OAAO,EAAE;gBACP,GAAG,gBAAgB,CACjB,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EACpC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CACjC;gBACD,GAAG,gBAAgB,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;aACxD;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC;QACtD,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,CAClC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAC1B,MAAM,CAAC,SAAS,CAAC;YACf,oBAAoB,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1C,MAAM,CAAC,QAAQ,CAAC,kEAAkE,EAAE;gBAClF,IAAI;gBACJ,KAAK,EAAE,OAAO;aACf,CAAC;YACJ,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC3B,MAAM,CAAC,QAAQ,CAAC,8DAA8D,EAAE;gBAC9E,KAAK,EAAE,OAAO;aACf,CAAC;SACL,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,UAAU;aACf,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACxB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,CAC/C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAO,CAAC,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EACjD,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CACzD,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,IAAI,CAChF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IACtB,8DAA8D;IAC9D,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CACnE,CACF,CAAC;IACF,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;AACjG,CAAC,CAAC,CACH,CAAC"}

package/dist/proxy/forward.d.ts

@@ -0,0 +1,12 @@
+import { Effect } from "effect";
+import { Headers, HttpClient, type HttpServerRequest, HttpServerResponse } from "effect/http";
+/** Returns `headers` without hop-by-hop headers, including those listed in `Connection`. */
+export declare const endToEndHeaders: (headers: Headers.Headers) => Headers.Headers;
+/**
+ * Sends `request` to `upstream` with `headers` and streams the response back unchanged:
+ * status, end-to-end headers, and body bytes, including any `content-encoding`. Bodies stream
+ * in both directions without buffering. The client span is disabled, so no header value is
+ * recorded in a trace.
+ */
+export declare const forwardRequest: (client: HttpClient.HttpClient, request: HttpServerRequest.HttpServerRequest, upstream: string, headers: Headers.Headers) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("effect/http/HttpClientError").HttpClientError, never>;
+//# sourceMappingURL=forward.d.ts.map

package/dist/proxy/forward.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.d.ts","sourceRoot":"","sources":["../../src/proxy/forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EACL,OAAO,EACP,UAAU,EAEV,KAAK,iBAAiB,EACtB,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAiBrB,4FAA4F;AAC5F,eAAO,MAAM,eAAe,YAAa,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,OASlE,CAAC;AASF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,WACjB,UAAU,CAAC,UAAU,WACpB,iBAAiB,CAAC,iBAAiB,YAClC,MAAM,WACP,OAAO,CAAC,OAAO,uHAezB,CAAC"}

package/dist/proxy/forward.js

@@ -0,0 +1,44 @@
+import { Effect, Option } from "effect";
+import { Headers, HttpClient, HttpClientRequest, HttpServerResponse, } from "effect/http";
+/** Connection-level headers that are never forwarded (RFC 9110, section 7.6.1). */
+const HOP_BY_HOP = [
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "expect",
+    "host",
+];
+/** Returns `headers` without hop-by-hop headers, including those listed in `Connection`. */
+export const endToEndHeaders = (headers) => {
+    const listed = Option.match(Headers.get(headers, "connection"), {
+        onNone: () => [],
+        onSome: (value) => value.split(",").map((name) => name.trim().toLowerCase()),
+    });
+    return [...HOP_BY_HOP, ...listed].reduce((remaining, name) => Headers.remove(remaining, name), headers);
+};
+const hasBody = (request) => Option.isSome(Headers.get(request.headers, "transfer-encoding")) ||
+    Option.match(Headers.get(request.headers, "content-length"), {
+        onNone: () => false,
+        onSome: (length) => length.trim() !== "0",
+    });
+/**
+ * Sends `request` to `upstream` with `headers` and streams the response back unchanged:
+ * status, end-to-end headers, and body bytes, including any `content-encoding`. Bodies stream
+ * in both directions without buffering. The client span is disabled, so no header value is
+ * recorded in a trace.
+ */
+export const forwardRequest = (client, request, upstream, headers) => {
+    const base = HttpClientRequest.make(request.method)(upstream);
+    const outgoing = (hasBody(request) ? HttpClientRequest.bodyStream(base, request.stream) : base).pipe(HttpClientRequest.setHeaders(headers));
+    return client.execute(outgoing).pipe(Effect.provideService(HttpClient.TracerDisabledWhen, () => true), Effect.map((response) => HttpServerResponse.stream(response.stream, {
+        status: response.status,
+        headers: endToEndHeaders(response.headers),
+    })));
+};
+//# sourceMappingURL=forward.js.map

package/dist/proxy/forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../../src/proxy/forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EACL,OAAO,EACP,UAAU,EACV,iBAAiB,EAEjB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,mFAAmF;AACnF,MAAM,UAAU,GAAG;IACjB,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;IAClB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,QAAQ;IACR,MAAM;CACE,CAAC;AAEX,4FAA4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAwB,EAAmB,EAAE;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QAC9D,MAAM,EAAE,GAA0B,EAAE,CAAC,EAAE;QACvC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;KAC7E,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,CACtC,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EACpD,OAAO,CACR,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,OAA4C,EAAW,EAAE,CACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE;QAC3D,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;QACnB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG;KAC1C,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAA6B,EAC7B,OAA4C,EAC5C,QAAgB,EAChB,OAAwB,EACxB,EAAE;IACF,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,CACf,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAChE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;QACzC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;KAC3C,CAAC,CACH,CACF,CAAC;AACJ,CAAC,CAAC"}