@usine/gateway 0.1.0 → 0.2.0

package/README.md

@@ -1,14 +1,14 @@
 # @usine/gateway
 
-The service on the gateway host in front of usine's worker VMs ([ADR 0027](../../docs/adr/0027-gateway-credential-proxy.md), [#223](https://github.com/basaltbytes/usine/issues/223)). Worker VMs have no public address, GitHub token, or API key. They reach GitHub through the gateway, which adds the credential. They reach an LLM provider the same way if the gateway has that provider's API key, and otherwise with the harness's own login through the gateway's forward proxy, which allows only allowlisted hosts: package registries and the harness login hosts. [Workers and the gateway](https://docs.usine.dev/architecture/workers-and-gateway/) describes the deployment.
+The service on the gateway host in front of usine's worker VMs ([ADR 0027](../../docs/adr/0027-gateway-credential-proxy.md), [#223](https://github.com/basaltbytes/usine/issues/223)). Worker VMs have no public address, GitHub token, API key, or subscription login. They reach GitHub through the gateway, which adds the credential. They reach an LLM provider the same way if the gateway has that provider's credential: an API key, a Claude subscription token, or a ChatGPT login. Otherwise they use the harness's own login through the gateway's forward proxy, which allows only allowlisted hosts: package registries and the harness login hosts. [Workers and the gateway](https://docs.usine.dev/architecture/workers-and-gateway/) describes the deployment.
 
 The gateway serves:
 
-- **A reverse proxy** for workers on the private network. `git.<domain>` serves git smart HTTP at `/OWNER/REPO.git` and the GitHub REST and GraphQL API under `/api/`, as GitHub Enterprise Server does, so `gh` works with `GH_HOST=git.<domain>`. It adds the installation token that the executor attached for that worker and repo. `llm.<domain>` serves the Anthropic API under `/anthropic` and an OpenAI-compatible API under `/openai` with the gateway's API key. Other hosts are refused; the forward proxy serves the allowlisted ones.
+- **A reverse proxy** for workers on the private network. `git.<domain>` serves git smart HTTP at `/OWNER/REPO.git`, release downloads, and the GitHub REST and GraphQL API under `/api/`, as GitHub Enterprise Server does, so `gh` works with `GH_HOST=git.<domain>`. It adds the installation token that the executor attached for that worker and repo; see [GitHub paths](#github-paths). `llm.<domain>` serves the Anthropic API under `/anthropic`, and under `/openai` an OpenAI-compatible API or, with a [ChatGPT login](#chatgpt-login), the ChatGPT backend that Codex uses, with the gateway's credential. Other hosts are refused; the forward proxy serves the allowlisted ones.
 - **A forward proxy** for `HTTPS_PROXY` and `HTTP_PROXY`: `CONNECT` on port 443 for HTTPS and absolute-form requests for plain HTTP mirrors, to allowlisted hosts only. A tunnel opens only if the client's TLS ClientHello names the CONNECT host. A ClientHello naming another host or none, an encrypted ClientHello, or non-TLS bytes end the tunnel (`server-name-mismatch`, `server-name-missing`, `not-tls`). It resolves each name itself and refuses private, loopback, and link-local addresses. Before a plain HTTP request leaves, it removes `X-Usine-Gateway-Token` and any `Authorization` or `x-api-key` value that is a caller token, and leaves other credentials alone.
 - **An admin API** for the executor: attach, renew, detach, and list a worker's repo credentials, and list the [LLM providers](#llm-providers) it has credentials for. It requires the admin token as a bearer token. Attachments are kept in memory; the executor attaches again when it renews or restarts. A [reload](#reload) keeps them.
 
-Refused requests log `Gateway refused a request` at warning level, with the reason, host, client address, and the caller token's worker. Forwarded requests log at info with the worker, repo, method, path, and status. No token, key, or request body is logged.
+Refused requests log `Gateway refused a request` at warning level, with the reason, host, client address, and the caller token's worker. Forwarded requests log at info with the worker, repo, method, path, and status, and with the host of the response's `Location` header (`target`), if any; release downloads log as `Served a GitHub release download`. A [rewritten](#github-paths) `Location` header also logs `Rewrote a GitHub Location header to the gateway`, with the original host (`from`) and the new path. A repo's [new name](#github-paths) that an attachment learns from GitHub logs `Learned the new name of an attached repository`, with `newName`; a new name that GitHub's API doesn't confirm logs `GitHub's API didn't confirm the new name of an attached repository` at warning level, with `newName` and the `reason`. A ChatGPT login logs each load, refresh, and failure; see [ChatGPT login](#chatgpt-login). No token, key, request body, or query string is logged.
 
 ## Install
 
@@ -32,7 +32,7 @@ On Hetzner Cloud, `gateway.sh install` does either on the gateway VM and restart
 
 | Import | Contents |
 | --- | --- |
-| `@usine/gateway` | The platform-free core: `GatewaySettings`, `SettingsInForce` (the allowlist and LLM providers that a reload replaces), `Attachments`, `CallerTokens`, `GatewayProxy` (the reverse proxy as an `HttpServerRequest` handler), `adminRoutes` (the admin API for an `HttpRouter`), `gatewayServices`, the egress allowlist parser, and the domain records. It needs an `HttpClient` that leaves `content-encoding` alone. |
+| `@usine/gateway` | The platform-free core: `GatewaySettings`, `SettingsInForce` (the allowlist and LLM providers that a reload replaces), `Attachments`, `CallerTokens`, `ChatGptLogins` (the ChatGPT logins and their refresh), `GatewayProxy` (the reverse proxy as an `HttpServerRequest` handler), `adminRoutes` (the admin API for an `HttpRouter`), `gatewayServices`, the egress allowlist parser, and the domain records. It needs an `HttpClient` that leaves `content-encoding` alone, and a `FileSystem` for ChatGPT auth files. |
 | `@usine/gateway/admin` | `GatewayAdminApi`, the admin API contract for `HttpApiClient.make` in the executor, with the records a client sends and reads (`AttachRequest`, `InstallationCredential`, `Attached`, `AttachmentId`, `CallerToken`, `Detached`, `AttachmentList`, `LlmProviderList`) and `GATEWAY_TOKEN_HEADER`. |
 | `@usine/gateway/node` | `gatewayLayer` (the three servers on Node, with undici upstream), `gatewayFromEnvironment`, `settingsFromEnvironment`, `GatewayAddresses`, and `GatewayReload`. |
 | `usine-gateway` | The gateway VM's command. It reads the settings below, reloads on SIGHUP, and logs one JSON object per line. |
@@ -60,6 +60,37 @@ A caller token works only while its attachment is in force. After a detach or to
 
 A child sends its caller token wherever its tool sends a credential: the `X-Usine-Gateway-Token` header, `Authorization` as `Bearer`, `token`, or `Basic` (password), or `x-api-key`. The gateway removes all of them before forwarding.
 
+## GitHub paths
+
+`git.<domain>` serves these paths with the attachment's installation token. A path that names another repo than the caller token is refused with `repository-mismatch`, unless it's the repo's new name after a rename (see below); other paths, such as web pages, with `unsupported-path`. Paths that name no repo, such as `/api/graphql`, `/api/v3/user`, and `/api/v3/repositories/ID/...`, have no repo for the gateway to check: the installation token, issued for the attempt's repo only, limits them.
+
+| Path on `git.<domain>` | Upstream | Token sent as |
+| --- | --- | --- |
+| `/OWNER/REPO.git/info/refs`, `/OWNER/REPO.git/git-upload-pack`, `/OWNER/REPO.git/git-receive-pack`, `/OWNER/REPO.git/info/lfs/...`, each also without `.git` | `https://github.com` | the `x-access-token` password |
+| `/OWNER/REPO/releases/download/TAG/FILE`, `/OWNER/REPO/releases/latest/download/FILE` | `https://github.com` | the `x-access-token` password |
+| `/api/v3/...`, `/api/graphql` | `https://api.github.com` | a bearer token |
+| `/api/uploads/...` | `https://uploads.github.com` | a bearer token |
+
+GitHub answers a release download with a redirect to an asset host, such as `release-assets.githubusercontent.com` or `objects.githubusercontent.com`, in a URL signed for that file for a few minutes. The gateway returns the redirect unchanged and doesn't follow it, so the token goes only to github.com. The worker fetches the asset through the forward proxy, which needs the asset hosts on the egress allowlist: the GitHub release assets rows of [`egress-allowlist`](../../infra/hetzner/gateway/egress-allowlist). On a worker, where `GH_TOKEN` holds the caller token:
+
+```sh
+curl -fL -u ":$GH_TOKEN" -o tool.tar.gz http://git.<domain>/OWNER/REPO/releases/download/TAG/FILE
+```
+
+curl sends `-u` credentials only to the host of the first URL; a header set with `-H` would also reach the asset host.
+
+gh can't download from these hosts. It sends every request to the gateway through its socket, followed redirects included, so `gh release download` reaches the reverse proxy for the asset host, which refuses it with `unknown-host`. For a host on the egress allowlist, the refusal says to use curl instead: the command above for a release asset, or this one for an archive, which GitHub redirects to `codeload.github.com`:
+
+```sh
+curl -fL -u ":$GH_TOKEN" -o repo.tar.gz http://git.<domain>/api/v3/repos/OWNER/REPO/tarball/REF
+```
+
+Actions logs and artifacts redirect to `results-receiver.actions.githubusercontent.com` and Azure Blob Storage, which the allowlist doesn't list, so `gh run view --log`, `gh run view --log-failed`, and `gh run download` don't work on a worker, with gh or curl ([#540](https://github.com/basaltbytes/usine/issues/540)). [ADR 0027](../../docs/adr/0027-gateway-credential-proxy.md) records why the reverse proxy doesn't fetch other hosts.
+
+GitHub redirects some requests for a renamed or transferred repo: API calls to `https://api.github.com/repositories/ID/...`, and release downloads to the new name on github.com. The gateway rewrites a `Location` on github.com or api.github.com to `http://git.<domain>`, with API paths under `/api/v3`, and keeps the path and query, so the client follows it through the gateway. A `Location` on any other host passes unchanged.
+
+The gateway checks the followed request like any other. An attachment learns the repo's new name only from a permanent redirect (301 or 308) of the repo itself to the same path with another owner or repo name: git's `/OWNER/REPO/info/refs`, which starts every clone and fetch, or the API's `/repos/OWNER/REPO`. Before the attachment learns the name, the gateway confirms it with GitHub's API and the attachment's credential: `/repos/OWNER/REPO` with the attached name must redirect to `/repositories/ID`, and the `full_name` of that repo must be the new name. The attachment then serves paths with either name until it's detached or expires. Other attachments, temporary redirects, redirects of anything else, such as a release download or `/repositories/ID/...`, and names that the API doesn't confirm teach no name, so a path with another name is still refused with `repository-mismatch`. A release download under the repo's former name works once a git clone or fetch under that name has taught the attachment the new name.
+
 ## LLM providers
 
 `GET /v1/providers` lists the providers the gateway has a credential for, with each credential's kind, never the credential:
@@ -68,31 +99,83 @@ A child sends its caller token wherever its tool sends a credential: the `X-Usin
 {"providers": [{"provider": "anthropic", "credential": "api-key"}]}
 ```
 
-`credential` is `api-key` for `ANTHROPIC_API_KEY` and `OPENAI_API_KEY`, and `subscription` for `USINE_GATEWAY_ANTHROPIC_SUBSCRIPTION_TOKEN`. Providers without a credential are absent. The list follows a [reload](#reload). The executor reads it when it checks a worker whose `llm_providers` lists `anthropic`, so usage counts Claude Code children on the gateway's API key in the API keys pool, not the Claude plan ([ADR 0013](../../docs/adr/0013-cost-accounting-native-meters-guardrails.md)). Gateways released before this endpoint answer 404.
+`credential` is `api-key` for `ANTHROPIC_API_KEY` and `OPENAI_API_KEY`, and `subscription` for `USINE_GATEWAY_ANTHROPIC_SUBSCRIPTION_TOKEN` and `USINE_GATEWAY_CHATGPT_AUTH_FILE`. Providers without a credential are absent. The list follows a [reload](#reload). The executor reads it when it checks a worker whose `llm_providers` lists a provider, so usage counts Claude Code and Codex children on the gateway's API key in the API keys pool, and on a subscription in the Claude or ChatGPT plan pool ([ADR 0013](../../docs/adr/0013-cost-accounting-native-meters-guardrails.md)). Gateways released before this endpoint answer 404.
 
 ## Worker environment
 
-`infra/hetzner/gateway/worker-cloud-init.yaml` sets up the machine. For each attempt, the executor adds the caller token and sends each variable that contains it over the SSH connection, not the command line; the worker's sshd accepts them with `AcceptEnv`. The Claude Code row applies if the gateway has the Anthropic credential; otherwise Claude Code, like Codex, uses its login on the worker and `HTTPS_PROXY`. The Codex row is what a Codex child would need to use the gateway's OpenAI route; the executor doesn't set it ([#235](https://github.com/basaltbytes/usine/issues/235)).
+`infra/hetzner/gateway/worker-cloud-init.yaml` sets up the machine. For each attempt, the executor adds the caller token and sends each variable that contains it over the SSH connection, not the command line; the worker's sshd accepts them with `AcceptEnv`. The Claude Code row applies if the gateway has the Anthropic credential, and the Codex row if it has the OpenAI credential; otherwise the harness uses its login on the worker and `HTTPS_PROXY`.
 
 | Tool | Setting |
 | --- | --- |
 | git | remote `http://git.<domain>/OWNER/REPO.git`; `GIT_CONFIG_KEY_0=http.http://git.<domain>/.extraHeader`, `GIT_CONFIG_VALUE_0="X-Usine-Gateway-Token: <caller token>"`, and `url.http://git.<domain>/.insteadOf` for `https://github.com/` and `https://git.<domain>/` |
 | gh | `GH_HOST=git.<domain>`, `GH_ENTERPRISE_TOKEN=<caller token>`, `GH_TOKEN=<caller token>`; gh's config sets `http_unix_socket: /run/usine-gateway/http.sock`, which `systemd-socket-proxyd` forwards to the gateway, because gh speaks only HTTPS to a custom host but plain HTTP over a socket |
 | Claude Code | `ANTHROPIC_BASE_URL=http://llm.<domain>/anthropic`, `ANTHROPIC_AUTH_TOKEN=<caller token>` |
-| Codex | a `model_provider` with `base_url = "http://llm.<domain>/openai/v1"`, `env_key` naming a variable that contains the caller token, `wire_api = "responses"` |
+| Codex | `CODEX_HOME=<root>/workers/<worker>/codex/<attempt>`, whose `config.toml` sets `model_provider = "usine-gateway"` with `base_url = "http://llm.<domain>/openai/v1"`, `env_key = "USINE_GATEWAY_TOKEN"`, `wire_api = "responses"`, and `requires_openai_auth = false`; `USINE_GATEWAY_TOKEN=<caller token>` |
 | package managers, harness logins | `HTTPS_PROXY` and `HTTP_PROXY` set to `http://<gateway>:3128`, `NO_PROXY=<domain>` |
 
+Codex with this `model_provider` sends its caller token as a bearer token, needs no login, and calls only `POST <base_url>/responses` over HTTP with server-sent events, since a custom provider uses neither the Responses WebSocket nor the remote model list. The same configuration works whether the gateway holds an API key or a ChatGPT login.
+
 A client that sends every request through `HTTPS_PROXY`, as Claude Code does, still reaches `git.<domain>` and `llm.<domain>`: the forward proxy sends their port 80 requests to the reverse proxy.
 
 ## Configuration
 
 The [CLI reference](https://docs.usine.dev/reference/configuration/cli/) lists every `usine-gateway` variable, with defaults and the environment file rules. Changing `USINE_GATEWAY_CALLER_KEY` invalidates every caller token.
 
-The gateway sends `ANTHROPIC_API_KEY` as `x-api-key` on `/anthropic`, `USINE_GATEWAY_ANTHROPIC_SUBSCRIPTION_TOKEN` (from `claude setup-token`) as a bearer token with the OAuth beta flag, and `OPENAI_API_KEY` as a bearer token on `/openai`. `USINE_GATEWAY_OPENAI_UPSTREAM` can be any OpenAI-compatible provider. Run the placeholder swap test in [Tests](#tests) before you rely on the subscription token. A provider without a credential is refused with `provider-not-configured`.
+Each provider holds one credential; setting both of a provider's variables is an error.
+
+| Provider | Variable | Credential | Sent upstream as |
+| --- | --- | --- | --- |
+| `anthropic` | `ANTHROPIC_API_KEY` | An Anthropic API key | `x-api-key` |
+| `anthropic` | `USINE_GATEWAY_ANTHROPIC_SUBSCRIPTION_TOKEN` | A Claude subscription token from `claude setup-token` | A bearer token, with the OAuth beta flag merged into `anthropic-beta` |
+| `openai` | `OPENAI_API_KEY` | An OpenAI-compatible API key | A bearer token |
+| `openai` | `USINE_GATEWAY_CHATGPT_AUTH_FILE` | The absolute path of a Codex `auth.json` with a ChatGPT login | A bearer token with the login's access token, and `ChatGPT-Account-ID`; see [ChatGPT login](#chatgpt-login) |
+
+`USINE_GATEWAY_ANTHROPIC_UPSTREAM` (default `https://api.anthropic.com`) is the Anthropic upstream. `USINE_GATEWAY_OPENAI_UPSTREAM` (default `https://api.openai.com`) is the upstream for an OpenAI API key and can be any OpenAI-compatible provider, and `USINE_GATEWAY_CHATGPT_UPSTREAM` (default `https://chatgpt.com/backend-api/codex`) the one for a ChatGPT login. A provider without a credential is refused with `provider-not-configured`.
+
+### LLM routes
+
+Each provider serves only the routes its harness calls, whatever the credential, so a worker can't use the gateway's credential for the rest of the provider's API, such as files, batches, or organization administration. A route matches whole path segments, so a percent-encoded separator (`%2F`, `%5C`), a doubled or trailing `/`, or a dot segment, which URL parsing resolves first, never reaches the upstream. Other paths are refused with `unsupported-path` before any credential is used or refreshed.
+
+| Prefix | Routes | Harness |
+| --- | --- | --- |
+| `/anthropic` | `/v1/messages`, `/v1/messages/count_tokens`, `/v1/models`, `/v1/models/MODEL` | Claude Code |
+| `/openai` | `/v1/responses`, `/v1/responses/compact`, `/v1/models` | Codex |
+
+The query string passes unchanged, such as Claude Code's `?beta=true`.
+
+## Claude subscription token
+
+A `claude setup-token` token is valid for one year and has no refresh token, so the gateway doesn't refresh it ([authentication](https://code.claude.com/docs/en/authentication)). Before it expires, run `claude setup-token` again, replace `USINE_GATEWAY_ANTHROPIC_SUBSCRIPTION_TOKEN`, and reload. The token is opaque, so the gateway can't tell when it expires; once it has, Anthropic refuses each request and Claude Code reports the error. Run the placeholder swap test in [Tests](#tests) before you rely on the subscription token.
+
+## ChatGPT login
+
+With `USINE_GATEWAY_CHATGPT_AUTH_FILE`, the gateway serves Codex's [LLM routes](#llm-routes) under `/openai` on `llm.<domain>` from the ChatGPT backend, which has them without `/v1`: Codex's `/openai/v1/responses` goes to `https://chatgpt.com/backend-api/codex/responses`. The gateway replaces the caller token with `Authorization: Bearer <access token>`, sets `ChatGPT-Account-ID` to the login's account, and passes Codex's other headers, such as `originator` and `session-id`, and the streamed body unchanged.
+
+The file is the `auth.json` that `codex login` writes in `CODEX_HOME`. The gateway reads its `tokens.access_token`, `tokens.refresh_token`, and `tokens.account_id` (or the account in `tokens.id_token`) on first use and on each [reload](#reload), and keeps them in memory. It refreshes the access token as Codex does:
+
+- When the access token expires within five minutes, or the backend answered a request with 401, the next request first sends the refresh token to `https://auth.openai.com/oauth/token` with Codex's client ID. A 401 for a token refreshed less than a minute earlier doesn't start another refresh.
+- Refreshes run one at a time, and requests that arrive during a refresh wait for its result. A refresh runs apart from the request that started it, so a request that ends early doesn't stop it between the rotation and the write-back.
+- The response's new access token, rotated refresh token, and ID token go to the file, through a temporary file with mode 0600 in the same directory that replaces it, so the service needs write access to the directory. The file's other fields stay. If the file holds a login the gateway didn't refresh, such as one you just copied in, it's left for the next reload.
+- If a refresh fails, the waiting requests are refused with `provider-login-unavailable`, and nothing is sent upstream with the old token. After a network error, a server error, a 408, or a 429 from the token endpoint, the refusal is 503, which Codex retries: requests fail without calling the token endpoint for ten seconds, then the next one tries again. Any other client error, such as `invalid_grant`, or the codes `refresh_token_expired`, `refresh_token_reused`, and `refresh_token_invalidated`, rejects the refresh token: the refusal is 401, which Codex doesn't retry, and the gateway doesn't try again until a reload reads another login. An auth file that can't be read is refused with 503. Refusals give a fixed message and never the token endpoint's text; the log has its error code.
+
+At startup and each reload, the gateway reads the file and checks that it can write next to it, and fails or keeps the previous providers if it can't. A reload keeps the tokens in memory if the file has their refresh token or one they replaced, so it never goes back to a used refresh token, and otherwise uses the file's login.
+
+| Log line | Level | When |
+| --- | --- | --- |
+| `Loaded the ChatGPT login` | info | The file was read, with `authFile`, the access token's `expiresAt`, and `replaced` on a reload |
+| `Refreshing the ChatGPT login`, `Refreshed the ChatGPT login` | info | A refresh started (`reason` is `expiring` or `refused-by-upstream`) and ended, with `rotated` |
+| `Wrote the refreshed ChatGPT login to its auth file` | info | The rotated tokens are in the file |
+| `Left the auth file as it is: it holds another ChatGPT login` | warning | The file has a login the gateway didn't refresh; reload to use it |
+| `Could not write the refreshed ChatGPT login to its auth file` | error | The login works from memory, but after a restart the file's refresh token may no longer work |
+| `Could not refresh the ChatGPT login; a later request tries again` | error | A network error or server error, with `error` and the `backoff` |
+| `The token endpoint rejected the ChatGPT login's refresh token` | error | The login needs a new `auth.json` and a reload |
+| `The ChatGPT backend refused the gateway's access token` | warning | The backend answered 401; the next request refreshes first, unless the token is less than a minute old |
+
+Make the gateway's login separate from the one on your own machine. A refresh token works once, so if two copies of one `auth.json` refresh, the second is rejected with `refresh_token_reused`. [`infra/hetzner/gateway/README.md`](../../infra/hetzner/gateway/README.md) gives the steps.
 
 ## Reload
 
-On SIGHUP, `usine-gateway` rereads its environment files and allowlist, and replaces the egress allowlist and the LLM provider settings: `ANTHROPIC_API_KEY`, `USINE_GATEWAY_ANTHROPIC_SUBSCRIPTION_TOKEN`, `OPENAI_API_KEY`, both upstreams, and `USINE_GATEWAY_EGRESS_ALLOWLIST`. Under systemd, `ExecReload=kill -HUP $MAINPID` makes `systemctl reload usine-gateway` send it.
+On SIGHUP, `usine-gateway` rereads its environment files and allowlist, and replaces the egress allowlist and the LLM provider settings: `ANTHROPIC_API_KEY`, `USINE_GATEWAY_ANTHROPIC_SUBSCRIPTION_TOKEN`, `OPENAI_API_KEY`, `USINE_GATEWAY_CHATGPT_AUTH_FILE`, the three upstreams, and `USINE_GATEWAY_EGRESS_ALLOWLIST`. It also rereads the ChatGPT auth file, so copying a new `auth.json` over the old one and reloading replaces the login. Under systemd, `ExecReload=kill -HUP $MAINPID` makes `systemctl reload usine-gateway` send it.
 
 Attachments, the admin API, listening sockets, and open tunnels stay, so running attempts keep their GitHub and LLM requests. An open tunnel stays until a side closes it; each new `CONNECT` or plain HTTP request uses the new allowlist, and each later LLM request the new key. The domain, listeners, admin token, and caller key change only with a restart. A reload that finds one of them changed logs `Settings changed that take effect only after a restart` at warning level with the variable names, and applies the rest.
 
@@ -101,7 +184,7 @@ Each reload ends with `Reloaded the gateway settings`, which gives the environme
 | Problem | The reload keeps | Log line, at error level |
 | --- | --- | --- |
 | The allowlist can't be read or doesn't parse | The previous allowlist | `Kept the previous egress allowlist`, with the path, the line, and the problem |
-| A provider setting is invalid, or both Anthropic credentials are set | The previous providers | `Kept the previous LLM providers` |
+| A provider setting is invalid, both of a provider's credentials are set, or the ChatGPT auth file can't be read or isn't a ChatGPT login | The previous providers | `Kept the previous LLM providers` |
 | An environment file can't be read | Everything | `Kept the gateway settings: an environment file could not be read`, with the path |
 
 `systemctl reload` returns before the reload ends; the journal has the result. Variables from the process environment at startup don't change, so a gateway without environment files reloads only its allowlist.
@@ -110,4 +193,9 @@ Each reload ends with `Reloaded the gateway settings`, which gives the environme
 
 `pnpm --filter @usine/gateway test` runs the unit tests and an end-to-end test that starts the gateway on loopback ports, clones `octocat/Hello-World` through it, calls `gh api` through a Unix socket as a worker does, and opens a tunnel to `registry.npmjs.org`. It needs network access but no secret.
 
-`pnpm --filter @usine/gateway test:placeholder-swap` checks whether Claude Code works when the worker has only a caller token as `CLAUDE_CODE_OAUTH_TOKEN` and the gateway sends a subscription token instead. It needs `claude` on `PATH`. The first case runs Claude Code against a local stand-in for the Anthropic API and checks what reached it. The second runs against `api.anthropic.com` with the real token in `CLAUDE_CODE_OAUTH_TOKEN`, and is skipped without it.
+The unit tests for the ChatGPT login (`test/chatgpt.test.ts`) use stand-ins for the token endpoint and the ChatGPT backend: refresh timing, write-back of rotated tokens, one refresh for concurrent requests, failed and rejected refreshes, header rewriting, refused paths, and streaming through the Node gateway.
+
+`pnpm --filter @usine/gateway test:placeholder-swap` runs the harnesses themselves against the gateway and local stand-ins, so CI, which has neither binary, doesn't run it. Run it on a machine with the harnesses on `PATH` before you rely on a subscription credential at the gateway:
+
+- Claude Code (needs `claude`): the worker has only a caller token as `CLAUDE_CODE_OAUTH_TOKEN`, and the gateway sends a subscription token instead. The first case runs Claude Code against a local stand-in for the Anthropic API and checks what reached it. The second runs against `api.anthropic.com` with the real token in `CLAUDE_CODE_OAUTH_TOKEN`, and is skipped without it.
+- Codex (needs `codex`): `codex exec` runs with the `model_provider` the executor writes and only a caller token, against a stand-in for the ChatGPT backend and its token endpoint. The login's access token expires within a minute, so the case checks that the gateway refreshes it, sends the new token and the account to the backend, and writes the rotated refresh token to the auth file. Nothing reaches OpenAI.

package/dist/admin/api.d.ts

@@ -1,5 +1,5 @@
 import { Schema } from "effect";
-import { HttpApi, HttpApiEndpoint, HttpApiError, HttpApiGroup, HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi";
+import { HttpApi, HttpApiEndpoint, HttpApiError, HttpApiGroup, HttpApiMiddleware, HttpApiSecurity } from "effect/http-api";
 import { type Attachment, AttachmentAlreadyExpired, AttachmentConflict } from "../attachment/attachment.ts";
 import { type LlmProviders } from "../llm/llm.ts";
 export { AttachmentId, InstallationCredential } from "../attachment/attachment.ts";
@@ -84,39 +84,7 @@ export declare class AdminAuthorization extends AdminAuthorization_base {
  * Attachments are in memory; after a Gateway restart, the executor's next renewal re-creates
  * each one under the same ID, so caller tokens stay valid.
  */
-export declare const GatewayAdminApi: HttpApi.HttpApi<"GatewayAdminApi", HttpApiGroup.HttpApiGroup<"attachments", HttpApiEndpoint.HttpApiEndpoint<"detach", "DELETE", "/v1/attachments/:id", Schema.toCodecStringTree<Schema.Struct<{
-    id: Schema.brand<Schema.String, "AttachmentId">;
-}>>, never, never, never, Schema.toCodecJson<typeof Detached>, never, AdminAuthorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/attachments", never, never, never, never, Schema.toCodecJson<typeof AttachmentList>, never, AdminAuthorization, never> | HttpApiEndpoint.HttpApiEndpoint<"attach", "POST", "/v1/attachments", never, never, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<AttachRequest, {
-    readonly worker: string;
-    readonly repository: string;
-    readonly credential: {
-        readonly _tag: "InstallationCredential";
-        readonly token: import("effect/Redacted").Redacted<string>;
-    } | {
-        readonly _tag: "AnonymousCredential";
-    };
-    readonly expiresAt: import("effect/DateTime").Utc;
-}, readonly [Schema.Struct<{
-    readonly worker: Schema.brand<Schema.String, "WorkerName">;
-    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
-    readonly credential: Schema.Union<readonly [typeof import("../attachment/attachment.ts").InstallationCredential, typeof import("../attachment/attachment.ts").AnonymousCredential]>;
-    readonly expiresAt: Schema.DateTimeUtc;
-}>], {
-    readonly worker: string & import("effect/Brand").Brand<"WorkerName">;
-    readonly repository: string & import("effect/Brand").Brand<"RepositoryName">;
-    readonly credential: {
-        readonly _tag: "InstallationCredential";
-        readonly token: import("effect/Redacted").Redacted<string>;
-    } | {
-        readonly _tag: "AnonymousCredential";
-    };
-    readonly expiresAt: import("effect/DateTime").Utc;
-}>, Schema.Struct<{
-    readonly worker: Schema.brand<Schema.String, "WorkerName">;
-    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
-    readonly credential: Schema.Union<readonly [typeof import("../attachment/attachment.ts").InstallationCredential, typeof import("../attachment/attachment.ts").AnonymousCredential]>;
-    readonly expiresAt: Schema.DateTimeUtc;
-}>, never, never>>, never, Schema.toCodecJson<typeof Attached>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<AttachmentAlreadyExpired, {
+export declare const GatewayAdminApi: HttpApi.HttpApi<"GatewayAdminApi", HttpApiGroup.HttpApiGroup<"attachments", HttpApiEndpoint.HttpApiEndpoint<"attach", "POST", "/v1/attachments", never, never, Schema.toCodecJson<typeof AttachRequest>, never, Schema.toCodecJson<typeof Attached>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<AttachmentAlreadyExpired, {
     readonly _tag: "AttachmentAlreadyExpired";
     readonly worker: string;
     readonly repository: string;
@@ -134,39 +102,11 @@ export declare const GatewayAdminApi: HttpApi.HttpApi<"GatewayAdminApi", HttpApi
     readonly worker: Schema.brand<Schema.String, "WorkerName">;
     readonly repository: Schema.brand<Schema.String, "RepositoryName">;
     readonly expiresAt: Schema.DateTimeUtc;
-}>, never, never>>, AdminAuthorization, never> | HttpApiEndpoint.HttpApiEndpoint<"renew", "PUT", "/v1/attachments/:id", Schema.toCodecStringTree<Schema.Struct<{
+}>, never, never>>, AdminAuthorization, never> | HttpApiEndpoint.HttpApiEndpoint<"detach", "DELETE", "/v1/attachments/:id", Schema.toCodecStringTree<Schema.Struct<{
     id: Schema.brand<Schema.String, "AttachmentId">;
-}>>, never, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<AttachRequest, {
-    readonly worker: string;
-    readonly repository: string;
-    readonly credential: {
-        readonly _tag: "InstallationCredential";
-        readonly token: import("effect/Redacted").Redacted<string>;
-    } | {
-        readonly _tag: "AnonymousCredential";
-    };
-    readonly expiresAt: import("effect/DateTime").Utc;
-}, readonly [Schema.Struct<{
-    readonly worker: Schema.brand<Schema.String, "WorkerName">;
-    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
-    readonly credential: Schema.Union<readonly [typeof import("../attachment/attachment.ts").InstallationCredential, typeof import("../attachment/attachment.ts").AnonymousCredential]>;
-    readonly expiresAt: Schema.DateTimeUtc;
-}>], {
-    readonly worker: string & import("effect/Brand").Brand<"WorkerName">;
-    readonly repository: string & import("effect/Brand").Brand<"RepositoryName">;
-    readonly credential: {
-        readonly _tag: "InstallationCredential";
-        readonly token: import("effect/Redacted").Redacted<string>;
-    } | {
-        readonly _tag: "AnonymousCredential";
-    };
-    readonly expiresAt: import("effect/DateTime").Utc;
-}>, Schema.Struct<{
-    readonly worker: Schema.brand<Schema.String, "WorkerName">;
-    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
-    readonly credential: Schema.Union<readonly [typeof import("../attachment/attachment.ts").InstallationCredential, typeof import("../attachment/attachment.ts").AnonymousCredential]>;
-    readonly expiresAt: Schema.DateTimeUtc;
-}>, never, never>>, never, Schema.toCodecJson<typeof Attached>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<AttachmentAlreadyExpired, {
+}>>, never, never, never, Schema.toCodecJson<typeof Detached>, never, AdminAuthorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/attachments", never, never, never, never, Schema.toCodecJson<typeof AttachmentList>, never, AdminAuthorization, never> | HttpApiEndpoint.HttpApiEndpoint<"renew", "PUT", "/v1/attachments/:id", Schema.toCodecStringTree<Schema.Struct<{
+    id: Schema.brand<Schema.String, "AttachmentId">;
+}>>, never, Schema.toCodecJson<typeof AttachRequest>, never, Schema.toCodecJson<typeof Attached>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<AttachmentAlreadyExpired, {
     readonly _tag: "AttachmentAlreadyExpired";
     readonly worker: string;
     readonly repository: string;

package/dist/admin/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/admin/api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EACL,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,eAAe,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,UAAU,EACf,wBAAwB,EACxB,kBAAkB,EAGnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAIL,KAAK,YAAY,EAElB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;;;;;;;AAExE,mGAAmG;AACnG,qBAAa,aAAc,SAAQ,kBAKjC;CAAG;;;;;;;;AAEL,uCAAuC;AACvC,qBAAa,iBAAkB,SAAQ,sBAQrC;IACA,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,iBAAiB,CAQ/D;CACF;;;;;AAED;;;GAGG;AACH,qBAAa,QAAS,SAAQ,aAG5B;CAAG;;;;AAEL,8EAA8E;AAC9E,qBAAa,QAAS,SAAQ,aAE5B;CAAG;;;;AAEL,qBAAa,cAAe,SAAQ,mBAElC;CAAG;;;;;AAEL,yGAAyG;AACzG,qBAAa,kBAAmB,SAAQ,uBAKtC;CAAG;;;;AAEL,0HAA0H;AAC1H,qBAAa,eAAgB,SAAQ,oBAInC;IACA,MAAM,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,YAAY,GAAG,eAAe,CAczE;CACF;;;;;;;;;;;;;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG;AAIJ;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iRA2B3B,CAAC"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/admin/api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EACL,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,eAAe,EAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,UAAU,EACf,wBAAwB,EACxB,kBAAkB,EAGnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;;;;;;;AAExE,mGAAmG;AACnG,qBAAa,aAAc,SAAQ,kBAKjC;CAAG;;;;;;;;AAEL,uCAAuC;AACvC,qBAAa,iBAAkB,SAAQ,sBAQrC;IACA,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,iBAAiB,CAQ/D;CACF;;;;;AAED;;;GAGG;AACH,qBAAa,QAAS,SAAQ,aAG5B;CAAG;;;;AAEL,8EAA8E;AAC9E,qBAAa,QAAS,SAAQ,aAE5B;CAAG;;;;AAEL,qBAAa,cAAe,SAAQ,mBAElC;CAAG;;;;;AAEL,yGAAyG;AACzG,qBAAa,kBAAmB,SAAQ,uBAKtC;CAAG;;;;AAEL,0HAA0H;AAC1H,qBAAa,eAAgB,SAAQ,oBAInC;IACA,MAAM,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,YAAY,GAAG,eAAe,CAWzE;CACF;;;;;;;;;;;;;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iRA4B3B,CAAC"}

package/dist/admin/api.js

@@ -1,7 +1,7 @@
 import { RepositoryName } from "@usine/core/repository";
 import { GatewayCredentialKind, WorkerName } from "@usine/core/worker";
 import { Option, Schema } from "effect";
-import { HttpApi, HttpApiEndpoint, HttpApiError, HttpApiGroup, HttpApiMiddleware, HttpApiSecurity, } from "effect/unstable/httpapi";
+import { HttpApi, HttpApiEndpoint, HttpApiError, HttpApiGroup, HttpApiMiddleware, HttpApiSecurity, } from "effect/http-api";
 import { AttachmentAlreadyExpired, AttachmentConflict, AttachmentCredential, AttachmentId, } from "../attachment/attachment.js";
 import { CallerToken } from "../caller/caller.js";
 import { credentialKind, LlmProviderName, } from "../llm/llm.js";
@@ -75,7 +75,6 @@ export class LlmProviderList extends Schema.Class("@usine/gateway/LlmProviderLis
  */
 export class AdminAuthorization extends HttpApiMiddleware.Service()("@usine/gateway/AdminAuthorization", { error: HttpApiError.Unauthorized, security: { bearer: HttpApiSecurity.bearer } }) {
 }
-const strict = { parseOptions: { onExcessProperty: "error" } };
 /**
  * The admin API the executor uses to attach, renew, and detach a Worker VM's GitHub credential
  * for an Attempt, and to read the Gateway's LLM provider credential kinds (ADR 0013).
@@ -84,12 +83,12 @@ const strict = { parseOptions: { onExcessProperty: "error" } };
  */
 export const GatewayAdminApi = HttpApi.make("GatewayAdminApi").add(HttpApiGroup.make("attachments")
     .add(HttpApiEndpoint.post("attach", "/v1/attachments", {
-    payload: AttachRequest.annotate(strict),
+    payload: AttachRequest,
     success: Attached,
     error: AttachmentAlreadyExpired.annotate({ httpApiStatus: 422 }),
 }), HttpApiEndpoint.put("renew", "/v1/attachments/:id", {
     params: { id: AttachmentId },
-    payload: AttachRequest.annotate(strict),
+    payload: AttachRequest,
     success: Attached,
     error: [
         AttachmentAlreadyExpired.annotate({ httpApiStatus: 422 }),
@@ -99,6 +98,7 @@ export const GatewayAdminApi = HttpApi.make("GatewayAdminApi").add(HttpApiGroup.
     params: { id: AttachmentId },
     success: Detached,
 }), HttpApiEndpoint.get("list", "/v1/attachments", { success: AttachmentList }))
+    .annotate(HttpApi.PayloadParseOptions, { onExcessProperty: "error" })
     .middleware(AdminAuthorization), HttpApiGroup.make("llm")
     .add(HttpApiEndpoint.get("providers", "/v1/providers", { success: LlmProviderList }))
     .middleware(AdminAuthorization));

package/dist/admin/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/admin/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EACL,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,GACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAEL,cAAc,EACd,eAAe,GAGhB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAExE,mGAAmG;AACnG,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,KAAK,CAAgB,8BAA8B,CAAC,CAAC;IAC7F,MAAM,EAAE,UAAU;IAClB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,MAAM,CAAC,WAAW;CAC9B,CAAC;CAAG;AAEL,uCAAuC;AACvC,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,KAAK,CACjD,kCAAkC,CACnC,CAAC;IACA,EAAE,EAAE,YAAY;IAChB,MAAM,EAAE,UAAU;IAClB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,wBAAwB,EAAE,qBAAqB,CAAC,CAAC;IAC9E,SAAS,EAAE,MAAM,CAAC,WAAW;CAC9B,CAAC;IACA,MAAM,CAAC,cAAc,CAAC,UAAsB;QAC1C,OAAO,IAAI,iBAAiB,CAAC;YAC3B,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI;YACtC,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,KAAK,CAAW,yBAAyB,CAAC,CAAC;IAC9E,UAAU,EAAE,iBAAiB;IAC7B,WAAW,EAAE,WAAW;CACzB,CAAC;CAAG;AAEL,8EAA8E;AAC9E,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,KAAK,CAAW,yBAAyB,CAAC,CAAC;IAC9E,QAAQ,EAAE,MAAM,CAAC,OAAO;CACzB,CAAC;CAAG;AAEL,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,KAAK,CAAiB,+BAA+B,CAAC,CAAC;IAChG,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;CAC7C,CAAC;CAAG;AAEL,yGAAyG;AACzG,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,KAAK,CAClD,mCAAmC,CACpC,CAAC;IACA,QAAQ,EAAE,eAAe;IACzB,UAAU,EAAE,qBAAqB;CAClC,CAAC;CAAG;AAEL,0HAA0H;AAC1H,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAC/C,gCAAgC,CACjC,CAAC;IACA,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC;CAC5C,CAAC;IACA,MAAM,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,EAAgB;QACtD,MAAM,MAAM,GAAG,CACb,QAAyB,EACzB,UAA6D,EAC7D,EAAE,CACF,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,GAAG,CACR,UAAU,EACV,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CACjF,CACF,CAAC;QACJ,OAAO,IAAI,eAAe,CAAC;YACzB,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,iBAAiB,CAAC,OAAO,EAAsB,CACrF,mCAAmC,EACnC,EAAE,KAAK,EAAE,YAAY,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,EAAE,CACnF;CAAG;AAEJ,MAAM,MAAM,GAAG,EAAE,YAAY,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAW,CAAC;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAChE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC;KAC7B,GAAG,CACF,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE;IAChD,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,wBAAwB,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;CACjE,CAAC,EACF,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,EAAE;IAClD,MAAM,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE;IAC5B,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE;QACL,wBAAwB,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QACzD,kBAAkB,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;KACpD;CACF,CAAC,EACF,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,EAAE;IACtD,MAAM,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE;IAC5B,OAAO,EAAE,QAAQ;CAClB,CAAC,EACF,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAC5E;KACA,UAAU,CAAC,kBAAkB,CAAC,EACjC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;KACrB,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;KACpF,UAAU,CAAC,kBAAkB,CAAC,CAClC,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/admin/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EACL,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,GACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,cAAc,EAEd,eAAe,GAEhB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAExE,mGAAmG;AACnG,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,KAAK,CAAgB,8BAA8B,CAAC,CAAC;IAC7F,MAAM,EAAE,UAAU;IAClB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,MAAM,CAAC,WAAW;CAC9B,CAAC;CAAG;AAEL,uCAAuC;AACvC,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,KAAK,CACjD,kCAAkC,CACnC,CAAC;IACA,EAAE,EAAE,YAAY;IAChB,MAAM,EAAE,UAAU;IAClB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,wBAAwB,EAAE,qBAAqB,CAAC,CAAC;IAC9E,SAAS,EAAE,MAAM,CAAC,WAAW;CAC9B,CAAC;IACA,MAAM,CAAC,cAAc,CAAC,UAAsB;QAC1C,OAAO,IAAI,iBAAiB,CAAC;YAC3B,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI;YACtC,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,KAAK,CAAW,yBAAyB,CAAC,CAAC;IAC9E,UAAU,EAAE,iBAAiB;IAC7B,WAAW,EAAE,WAAW;CACzB,CAAC;CAAG;AAEL,8EAA8E;AAC9E,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,KAAK,CAAW,yBAAyB,CAAC,CAAC;IAC9E,QAAQ,EAAE,MAAM,CAAC,OAAO;CACzB,CAAC;CAAG;AAEL,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,KAAK,CAAiB,+BAA+B,CAAC,CAAC;IAChG,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;CAC7C,CAAC;CAAG;AAEL,yGAAyG;AACzG,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,KAAK,CAClD,mCAAmC,CACpC,CAAC;IACA,QAAQ,EAAE,eAAe;IACzB,UAAU,EAAE,qBAAqB;CAClC,CAAC;CAAG;AAEL,0HAA0H;AAC1H,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAC/C,gCAAgC,CACjC,CAAC;IACA,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC;CAC5C,CAAC;IACA,MAAM,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,EAAgB;QACtD,MAAM,MAAM,GAAG,CAAC,QAAyB,EAAE,UAAsC,EAAE,EAAE,CACnF,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,GAAG,CACR,UAAU,EACV,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CACjF,CACF,CAAC;QACJ,OAAO,IAAI,eAAe,CAAC;YACzB,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,iBAAiB,CAAC,OAAO,EAAsB,CACrF,mCAAmC,EACnC,EAAE,KAAK,EAAE,YAAY,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,EAAE,CACnF;CAAG;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAChE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC;KAC7B,GAAG,CACF,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE;IAChD,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,wBAAwB,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;CACjE,CAAC,EACF,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,EAAE;IAClD,MAAM,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE;IAC5B,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE;QACL,wBAAwB,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QACzD,kBAAkB,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;KACpD;CACF,CAAC,EACF,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,EAAE;IACtD,MAAM,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE;IAC5B,OAAO,EAAE,QAAQ;CAClB,CAAC,EACF,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAC5E;KACA,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;KACpE,UAAU,CAAC,kBAAkB,CAAC,EACjC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;KACrB,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;KACpF,UAAU,CAAC,kBAAkB,CAAC,CAClC,CAAC"}

package/dist/admin/server.d.ts

@@ -6,5 +6,5 @@ import { GatewaySettings, SettingsInForce } from "../settings.ts";
  * The admin API routes for an `HttpRouter`. Bind them to a loopback or private address; the
  * executor connects through SSH.
  */
-export declare const adminRoutes: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | GatewaySettings | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | import("effect/unstable/http/HttpRouter").HttpRouter | import("effect/Path").Path | import("effect/unstable/http/HttpRouter").Request<"Requires", Attachments> | import("effect/unstable/http/HttpRouter").Request<"Requires", CallerTokens> | import("effect/unstable/http/HttpRouter").Request<"Requires", SettingsInForce>>;
+export declare const adminRoutes: Layer.Layer<never, never, import("effect/FileSystem").FileSystem | GatewaySettings | import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("effect/http/HttpRouter").HttpRouter | import("effect/Path").Path | import("effect/http/HttpRouter").Request<"Requires", Attachments> | import("effect/http/HttpRouter").Request<"Requires", CallerTokens> | import("effect/http/HttpRouter").Request<"Requires", SettingsInForce>>;
 //# sourceMappingURL=server.d.ts.map

package/dist/admin/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/admin/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAY,MAAM,QAAQ,CAAC;AAGjD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAgB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA8GlE;;;GAGG;AACH,eAAO,MAAM,WAAW,ggBAGvB,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/admin/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAY,MAAM,QAAQ,CAAC;AAGjD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAgB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA8GlE;;;GAGG;AACH,eAAO,MAAM,WAAW,0cAGvB,CAAC"}

package/dist/admin/server.js

@@ -1,5 +1,5 @@
 import { Effect, Layer, Redacted } from "effect";
-import { HttpApiBuilder, HttpApiError } from "effect/unstable/httpapi";
+import { HttpApiBuilder, HttpApiError } from "effect/http-api";
 import { Attachment, newAttachmentId } from "../attachment/attachment.js";
 import { Attachments } from "../attachment/store.js";
 import { CallerClaims, CallerTokens } from "../caller/caller.js";

package/dist/admin/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/admin/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAqB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,kBAAkB,EAElB,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,eAAe,EACf,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAC7C,CAAC;AAEJ,+DAA+D;AAC/D,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,KAAiB,EAAW,EAAE;IAClE,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE;QACtE,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAChC,kBAAkB,EAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC/C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;gBACrC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,kCAAkC,EAAE;oBAC3D,MAAM,EAAE,iBAAiB;oBACzB,QAAQ,EAAE,QAAQ,CAAC,UAAU;iBAC9B,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC;QAC3B,CAAC,CAAC;KACL,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEF,qEAAqE;AACrE,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAgB,EAAE,OAAsB;IAC/F,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChC,UAAU,EAAE,EAAE;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CACtC,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAC7F,CAAC;IACF,OAAO,IAAI,QAAQ,CAAC,EAAE,UAAU,EAAE,iBAAiB,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACzF,MAAM;KACH,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI;AAC9D,uDAAuD;AACvD,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,CAAC,CAClD,CACF;KACA,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;KACnE,MAAM,CACL,QAAQ,EACR,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;IACpD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACvC,OAAO,IAAI,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC,CACH;KACA,MAAM,CACL,MAAM,EACN,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC;IACtC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,IAAI,cAAc,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AAC5F,CAAC,CAAC,CACH,CACJ,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAC1E,MAAM,CAAC,MAAM,CACX,WAAW,EACX,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC;IAC3C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC;IAC9D,MAAM,IAAI,GAAG,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACtD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChC,SAAS,EAAE,IAAI,CAAC,SAAS;aACtB,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;aAC9D,IAAI,CAAC,GAAG,CAAC;KACb,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CACH,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CACnE,KAAK,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,EAChD,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAC7B,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/admin/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAqB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,kBAAkB,EAElB,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,eAAe,EACf,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAC7C,CAAC;AAEJ,+DAA+D;AAC/D,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,KAAiB,EAAW,EAAE;IAClE,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE;QACtE,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAChC,kBAAkB,EAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC/C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;gBACrC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,kCAAkC,EAAE;oBAC3D,MAAM,EAAE,iBAAiB;oBACzB,QAAQ,EAAE,QAAQ,CAAC,UAAU;iBAC9B,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC;QAC3B,CAAC,CAAC;KACL,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEF,qEAAqE;AACrE,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAgB,EAAE,OAAsB;IAC/F,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChC,UAAU,EAAE,EAAE;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CACtC,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAC7F,CAAC;IACF,OAAO,IAAI,QAAQ,CAAC,EAAE,UAAU,EAAE,iBAAiB,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACzF,MAAM;KACH,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI;AAC9D,uDAAuD;AACvD,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,CAAC,CAClD,CACF;KACA,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;KACnE,MAAM,CACL,QAAQ,EACR,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;IACpD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACvC,OAAO,IAAI,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC,CACH;KACA,MAAM,CACL,MAAM,EACN,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC;IACtC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,IAAI,cAAc,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AAC5F,CAAC,CAAC,CACH,CACJ,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAC1E,MAAM,CAAC,MAAM,CACX,WAAW,EACX,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC;IAC3C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC;IAC9D,MAAM,IAAI,GAAG,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACtD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChC,SAAS,EAAE,IAAI,CAAC,SAAS;aACtB,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;aAC9D,IAAI,CAAC,GAAG,CAAC;KACb,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CACH,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CACnE,KAAK,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,EAChD,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAC7B,CAAC"}

package/dist/attachment/attachment.d.ts

@@ -1,3 +1,4 @@
+import { RepositoryName } from "@usine/core/repository";
 import { DateTime, Effect, Schema } from "effect";
 /**
  * The ID of an attachment, unchanged by renewals. A new attach for the same Worker and
@@ -42,9 +43,15 @@ export declare class Attachment extends Attachment_base {
 }
 declare const LiveAttachment_base: Schema.Class<LiveAttachment, Schema.TaggedStruct<"LiveAttachment", {
     readonly attachment: typeof Attachment;
+    readonly newNames: Schema.$Array<Schema.brand<Schema.String, "RepositoryName">>;
 }>, {}>;
-/** A lookup result for an active attachment. */
+/**
+ * A lookup result for an active attachment. `newNames` are the names GitHub's permanent
+ * redirects gave the attached repository after a rename or transfer.
+ */
 export declare class LiveAttachment extends LiveAttachment_base {
+    /** Returns whether `repository` is the attached repository, by its attached name or a new name. */
+    serves(repository: RepositoryName): boolean;
 }
 declare const ExpiredAttachment_base: Schema.Class<ExpiredAttachment, Schema.TaggedStruct<"ExpiredAttachment", {
     readonly expiredAt: Schema.DateTimeUtc;

package/dist/attachment/attachment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attachment.d.ts","sourceRoot":"","sources":["../../src/attachment/attachment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAY,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,YAAY,6CAEW,CAAC;AACrC,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AAEpD,kGAAkG;AAClG,eAAO,MAAM,eAAe,oFAE3B,CAAC;;;;AAEF,yFAAyF;AACzF,qBAAa,sBAAuB,SAAQ,2BAG3C;CAAG;;AAEJ;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,wBAGxC;CAAG;AAEJ,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,oFAA8D,CAAC;AAChG,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAC;;;;;;;;AAEpE;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,eAM9B;IACA,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,CAEnC;CACF;;;;AAED,gDAAgD;AAChD,qBAAa,cAAe,SAAQ,mBAElC;CAAG;;;;AAEL,6EAA6E;AAC7E,qBAAa,iBAAkB,SAAQ,sBAGtC;CAAG;;AAEJ,mHAAmH;AACnH,qBAAa,iBAAkB,SAAQ,sBAGtC;CAAG;AAEJ,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;;;;;;AAEtF,6DAA6D;AAC7D,qBAAa,wBAAyB,SAAQ,6BAG7C;CAAG;;;;;;AAEJ,mGAAmG;AACnG,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG"}
+{"version":3,"file":"attachment.d.ts","sourceRoot":"","sources":["../../src/attachment/attachment.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEjF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGlD;;;GAGG;AACH,eAAO,MAAM,YAAY,6CAEW,CAAC;AACrC,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AAEpD,kGAAkG;AAClG,eAAO,MAAM,eAAe,oFAE3B,CAAC;;;;AAEF,yFAAyF;AACzF,qBAAa,sBAAuB,SAAQ,2BAG3C;CAAG;;AAEJ;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,wBAGxC;CAAG;AAEJ,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,oFAA8D,CAAC;AAChG,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAC;;;;;;;;AAEpE;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,eAM9B;IACA,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,CAEnC;CACF;;;;;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,mBAGlC;IACA,mGAAmG;IACnG,MAAM,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAK1C;CACF;;;;AAED,6EAA6E;AAC7E,qBAAa,iBAAkB,SAAQ,sBAGtC;CAAG;;AAEJ,mHAAmH;AACnH,qBAAa,iBAAkB,SAAQ,sBAGtC;CAAG;AAEJ,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;;;;;;AAEtF,6DAA6D;AAC7D,qBAAa,wBAAyB,SAAQ,6BAG7C;CAAG;;;;;;AAEJ,mGAAmG;AACnG,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG"}

package/dist/attachment/attachment.js

@@ -1,13 +1,14 @@
-import { RepositoryName } from "@usine/core/repository";
+import { canonicalRepositoryName, RepositoryName } from "@usine/core/repository";
 import { WorkerName } from "@usine/core/worker";
-import { DateTime, Effect, Encoding, Schema } from "effect";
+import { DateTime, Effect, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
 /**
  * The ID of an attachment, unchanged by renewals. A new attach for the same Worker and
  * repository gets a new ID, so an earlier caller token is never accepted again.
  */
 export const AttachmentId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/u, { message: "Expected a 22-character attachment ID" })).pipe(Schema.brand("AttachmentId"));
 /** Returns a new attachment ID of 128 random bits from the platform's cryptographic generator. */
-export const newAttachmentId = Effect.sync(() => AttachmentId.make(Encoding.encodeBase64Url(crypto.getRandomValues(new Uint8Array(16)))));
+export const newAttachmentId = Effect.sync(() => AttachmentId.make(Base64Url.encode(crypto.getRandomValues(new Uint8Array(16)))));
 /** A GitHub App installation token added to the Worker's requests for the repository. */
 export class InstallationCredential extends Schema.TaggedClass()("InstallationCredential", { token: Schema.Redacted(Schema.NonEmptyString) }) {
 }
@@ -37,10 +38,19 @@ export class Attachment extends Schema.Class("@usine/gateway/Attachment")({
         return DateTime.isLessThan(now, this.expiresAt);
     }
 }
-/** A lookup result for an active attachment. */
+/**
+ * A lookup result for an active attachment. `newNames` are the names GitHub's permanent
+ * redirects gave the attached repository after a rename or transfer.
+ */
 export class LiveAttachment extends Schema.TaggedClass()("LiveAttachment", {
     attachment: Attachment,
+    newNames: Schema.Array(RepositoryName),
 }) {
+    /** Returns whether `repository` is the attached repository, by its attached name or a new name. */
+    serves(repository) {
+        const wanted = canonicalRepositoryName(repository);
+        return [this.attachment.repository, ...this.newNames].some((name) => canonicalRepositoryName(name) === wanted);
+    }
 }
 /** A lookup result for an attachment whose token expired without renewal. */
 export class ExpiredAttachment extends Schema.TaggedClass()("ExpiredAttachment", { expiredAt: Schema.DateTimeUtc }) {

package/dist/attachment/attachment.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment.js","sourceRoot":"","sources":["../../src/attachment/attachment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAC7C,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAC/F,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;AAGrC,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAC9C,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACxF,CAAC;AAEF,yFAAyF;AACzF,MAAM,OAAO,sBAAuB,SAAQ,MAAM,CAAC,WAAW,EAA0B,CACtF,wBAAwB,EACxB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAClD;CAAG;AAEJ;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,WAAW,EAAuB,CAChF,qBAAqB,EACrB,EAAE,CACH;CAAG;AAEJ,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAGhG;;;;;GAKG;AACH,MAAM,OAAO,UAAW,SAAQ,MAAM,CAAC,KAAK,CAAa,2BAA2B,CAAC,CAAC;IACpF,EAAE,EAAE,YAAY;IAChB,MAAM,EAAE,UAAU;IAClB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,MAAM,CAAC,WAAW;CAC9B,CAAC;IACA,6DAA6D;IAC7D,QAAQ,CAAC,GAAiB;QACxB,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;CACF;AAED,gDAAgD;AAChD,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,EAAkB,CAAC,gBAAgB,EAAE;IACzF,UAAU,EAAE,UAAU;CACvB,CAAC;CAAG;AAEL,6EAA6E;AAC7E,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAClC;CAAG;AAEJ,mHAAmH;AACnH,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB,EAAE,CACH;CAAG;AAIJ,6DAA6D;AAC7D,MAAM,OAAO,wBAAyB,SAAQ,MAAM,CAAC,WAAW,EAA4B,CAC1F,0BAA0B,EAC1B,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAClF;CAAG;AAEJ,mGAAmG;AACnG,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAC9E,oBAAoB,EACpB,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,CACrE;CAAG"}
+{"version":3,"file":"attachment.js","sourceRoot":"","sources":["../../src/attachment/attachment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAC7C,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAC/F,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;AAGrC,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAC9C,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAChF,CAAC;AAEF,yFAAyF;AACzF,MAAM,OAAO,sBAAuB,SAAQ,MAAM,CAAC,WAAW,EAA0B,CACtF,wBAAwB,EACxB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAClD;CAAG;AAEJ;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,WAAW,EAAuB,CAChF,qBAAqB,EACrB,EAAE,CACH;CAAG;AAEJ,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAGhG;;;;;GAKG;AACH,MAAM,OAAO,UAAW,SAAQ,MAAM,CAAC,KAAK,CAAa,2BAA2B,CAAC,CAAC;IACpF,EAAE,EAAE,YAAY;IAChB,MAAM,EAAE,UAAU;IAClB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,MAAM,CAAC,WAAW;CAC9B,CAAC;IACA,6DAA6D;IAC7D,QAAQ,CAAC,GAAiB;QACxB,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,EAAkB,CAAC,gBAAgB,EAAE;IACzF,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;CACvC,CAAC;IACA,mGAAmG;IACnG,MAAM,CAAC,UAA0B;QAC/B,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACxD,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,MAAM,CACnD,CAAC;IACJ,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAClC;CAAG;AAEJ,mHAAmH;AACnH,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB,EAAE,CACH;CAAG;AAIJ,6DAA6D;AAC7D,MAAM,OAAO,wBAAyB,SAAQ,MAAM,CAAC,WAAW,EAA4B,CAC1F,0BAA0B,EAC1B,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAClF;CAAG;AAEJ,mGAAmG;AACnG,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAC9E,oBAAoB,EACpB,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,CACrE;CAAG"}

package/dist/attachment/store.d.ts

@@ -1,3 +1,4 @@
+import { type RepositoryName } from "@usine/core/repository";
 import { Context, Effect, Layer } from "effect";
 import { type Attachment, AttachmentAlreadyExpired, AttachmentConflict, type AttachmentId, type AttachmentLookup } from "./attachment.ts";
 declare const Attachments_base: Context.ServiceClass<Attachments, "@usine/gateway/Attachments", {
@@ -12,6 +13,12 @@ declare const Attachments_base: Context.ServiceClass<Attachments, "@usine/gatewa
     readonly list: () => Effect.Effect<ReadonlyArray<Attachment>>;
     /** Returns whether the attachment is active, expired, or missing. */
     readonly find: (id: AttachmentId) => Effect.Effect<AttachmentLookup>;
+    /**
+     * Records `name` as the attached repository's new name, from GitHub's permanent redirect of a
+     * request for it, so the attachment serves paths that name it until detach or expiry. Does
+     * nothing if the attachment isn't live or already serves `name`.
+     */
+    readonly learnNewName: (id: AttachmentId, name: RepositoryName) => Effect.Effect<void>;
     /** Removes expired attachments and returns the number removed. */
     readonly sweep: () => Effect.Effect<number>;
 }>;

package/dist/attachment/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/attachment/store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAY,MAAM,EAAE,KAAK,EAAO,MAAM,QAAQ,CAAC;AAC/D,OAAO,EACL,KAAK,UAAU,EACf,wBAAwB,EACxB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAItB,MAAM,iBAAiB,CAAC;;IAerB;;;OAGG;qBACc,CACf,UAAU,EAAE,UAAU,KACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAG,kBAAkB,CAAC;IACvE,kEAAkE;qBACjD,CAAC,EAAE,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAC7D,6DAA6D;mBAC9C,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7D,qEAAqE;mBACtD,CAAC,EAAE,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACpE,kEAAkE;oBAClD,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;;AArB/C;;;GAGG;AACH,qBAAa,WAAY,SAAQ,gBAmBA;IAC/B,gGAAgG;IAChG,MAAM,CAAC,QAAQ,CAAC,KAAK,yCAoGnB;CACH"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/attachment/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,OAAO,EAAkB,MAAM,EAAE,KAAK,EAAc,MAAM,QAAQ,CAAC;AAC5E,OAAO,EACL,KAAK,UAAU,EACf,wBAAwB,EACxB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAItB,MAAM,iBAAiB,CAAC;;IA4BrB;;;OAGG;qBACc,CACf,UAAU,EAAE,UAAU,KACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAG,kBAAkB,CAAC;IACvE,kEAAkE;qBACjD,CAAC,EAAE,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAC7D,6DAA6D;mBAC9C,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7D,qEAAqE;mBACtD,CAAC,EAAE,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACpE;;;;OAIG;2BACoB,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IACtF,kEAAkE;oBAClD,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;;AA3B/C;;;GAGG;AACH,qBAAa,WAAY,SAAQ,gBAyBA;IAC/B,gGAAgG;IAChG,MAAM,CAAC,QAAQ,CAAC,KAAK,yCA4InB;CACH"}