agenticreplay 0.1.0 → 0.1.2

package/packages/proxy/src/der.ts

@@ -1,152 +0,0 @@
-/**
- * Just enough DER to build an X.509 certificate.
- *
- * `node:crypto` can generate keys, sign, hash and *parse* certificates, but it cannot mint one —
- * there is no API for it and there never has been. Every MITM proxy in the ecosystem reaches for
- * `node-forge` or `selfsigned` at this point. This project has near-zero runtime dependencies on
- * purpose, and pulling a general-purpose ASN.1 and crypto library into a debugger people install
- * to diagnose a broken machine is a poor trade for the two hundred lines below.
- *
- * The surface is deliberately tiny: the exact handful of ASN.1 types RFC 5280 needs for a
- * certificate we ourselves construct. It is an encoder, never a decoder — nothing here parses
- * untrusted bytes, so the usual ASN.1 attack surface does not exist. Verification is left to
- * OpenSSL, which is where it belongs.
- */
-
-/** ASN.1 universal tag numbers, plus the two class bits DER spends on context tags. */
-const TAG = {
-  boolean: 0x01,
-  integer: 0x02,
-  bitString: 0x03,
-  octetString: 0x04,
-  oid: 0x06,
-  utf8String: 0x0c,
-  sequence: 0x30,
-  set: 0x31,
-  utcTime: 0x17,
-  generalizedTime: 0x18,
-} as const;
-
-const CONTEXT = 0x80;
-const CONSTRUCTED = 0x20;
-
-/**
- * DER length: short form under 128, otherwise a byte count followed by big-endian length bytes.
- * BER's indefinite form is not legal in DER and is not produced here.
- */
-function encodeLength(n: number): Buffer {
-  if (n < 0x80) return Buffer.from([n]);
-  const bytes: number[] = [];
-  for (let v = n; v > 0; v = Math.floor(v / 256)) bytes.unshift(v % 256);
-  return Buffer.from([0x80 | bytes.length, ...bytes]);
-}
-
-/** Tag-length-value, the shape every other function here is built from. */
-export function derTlv(tag: number, body: Buffer): Buffer {
-  return Buffer.concat([Buffer.from([tag]), encodeLength(body.length), body]);
-}
-
-export function derSequence(...parts: Buffer[]): Buffer {
-  return derTlv(TAG.sequence, Buffer.concat(parts));
-}
-
-export function derSet(...parts: Buffer[]): Buffer {
-  return derTlv(TAG.set, Buffer.concat(parts));
-}
-
-/**
- * A non-negative INTEGER from raw big-endian bytes.
- *
- * Two DER rules, both of which produce certificates OpenSSL rejects if you get them wrong: leading
- * zero bytes are forbidden, and a value whose top bit is set needs a zero byte in front or it
- * would read as negative. Serial numbers are random, so roughly half of them hit the second rule.
- */
-export function derInteger(bytes: Buffer): Buffer {
-  let start = 0;
-  while (start < bytes.length - 1 && bytes[start] === 0 && (bytes[start + 1]! & 0x80) === 0) {
-    start += 1;
-  }
-  let body = bytes.subarray(start);
-  if (body.length === 0) body = Buffer.from([0]);
-  if ((body[0]! & 0x80) !== 0) body = Buffer.concat([Buffer.from([0]), body]);
-  return derTlv(TAG.integer, body);
-}
-
-export function derBoolean(value: boolean): Buffer {
-  // DER pins TRUE to all-ones; BER would accept any non-zero byte.
-  return derTlv(TAG.boolean, Buffer.from([value ? 0xff : 0x00]));
-}
-
-/** A BIT STRING whose content is a whole number of bytes, which is all a certificate needs. */
-export function derBitString(bits: Buffer): Buffer {
-  return derTlv(TAG.bitString, Buffer.concat([Buffer.from([0]), bits]));
-}
-
-export function derOctetString(bytes: Buffer): Buffer {
-  return derTlv(TAG.octetString, bytes);
-}
-
-export function derUtf8String(text: string): Buffer {
-  return derTlv(TAG.utf8String, Buffer.from(text, 'utf8'));
-}
-
-/**
- * An OBJECT IDENTIFIER from dotted decimal.
- *
- * The first two arcs are packed into one byte as `40 * a + b`; the rest are base-128 with the
- * continuation bit set on every byte but the last.
- */
-export function derOid(dotted: string): Buffer {
-  const arcs = dotted.split('.').map((part) => {
-    const n = Number(part);
-    if (!Number.isInteger(n) || n < 0) throw new Error(`not an object identifier: ${dotted}`);
-    return n;
-  });
-  if (arcs.length < 2) throw new Error(`not an object identifier: ${dotted}`);
-  const bytes: number[] = [arcs[0]! * 40 + arcs[1]!];
-  for (const arc of arcs.slice(2)) {
-    const chunk: number[] = [];
-    let v = arc;
-    do {
-      chunk.unshift(v & 0x7f);
-      v >>>= 7;
-    } while (v > 0);
-    for (let i = 0; i < chunk.length - 1; i += 1) chunk[i]! |= 0x80;
-    bytes.push(...chunk);
-  }
-  return derTlv(TAG.oid, Buffer.from(bytes));
-}
-
-function pad2(n: number): string {
-  return String(n).padStart(2, '0');
-}
-
-/**
- * A certificate time.
- *
- * RFC 5280 requires UTCTime through 2049 and GeneralizedTime from 2050 — a certificate that uses
- * the wrong one for its year is malformed. Run CAs live for a day so they will always take the
- * first branch, but the rule is cheap to honour and expensive to remember later.
- */
-export function derTime(when: Date): Buffer {
-  const year = when.getUTCFullYear();
-  const tail =
-    `${pad2(when.getUTCMonth() + 1)}${pad2(when.getUTCDate())}` +
-    `${pad2(when.getUTCHours())}${pad2(when.getUTCMinutes())}${pad2(when.getUTCSeconds())}Z`;
-  return year < 2050
-    ? derTlv(TAG.utcTime, Buffer.from(`${pad2(year % 100)}${tail}`, 'ascii'))
-    : derTlv(TAG.generalizedTime, Buffer.from(`${year}${tail}`, 'ascii'));
-}
-
-/** A context-specific tag, `[n]`. Constructed wraps another DER value; primitive wraps raw bytes. */
-export function derContext(n: number, body: Buffer, constructed = true): Buffer {
-  return derTlv(CONTEXT | (constructed ? CONSTRUCTED : 0) | n, body);
-}
-
-/** DER bytes as a PEM block, wrapped at the 64 columns every tool expects. */
-export function toPem(label: string, der: Buffer): string {
-  const body = der.toString('base64');
-  const lines: string[] = [];
-  for (let i = 0; i < body.length; i += 64) lines.push(body.slice(i, i + 64));
-  return `-----BEGIN ${label}-----\n${lines.join('\n')}\n-----END ${label}-----\n`;
-}

package/packages/proxy/src/dialects.ts

@@ -1,413 +0,0 @@
-import type {
-  CanonicalContent,
-  CanonicalMessage,
-  CanonicalRequest,
-  CanonicalResponse,
-  CanonicalTool,
-  StopReason,
-} from '@agenticreplay/plugin-api';
-
-/**
- * A wire dialect the proxy can sit in front of.
- *
- * The proxy deliberately does not know which dialects exist — it is handed a list. That is what
- * lets a third party support a new model API without touching the interception core, and it keeps
- * all wire-format knowledge in @agenticreplay/providers where it belongs.
- */
-export interface Dialect {
-  id: string;
-  /** Does this dialect own the given request path? */
-  matches(path: string): boolean;
-  /** Upstream origin to forward to when no override is configured. */
-  defaultUpstream: string;
-  toCanonicalRequest(raw: unknown): CanonicalRequest;
-  toCanonicalResponse(raw: unknown): CanonicalResponse;
-  /** Parse a recorded SSE body into a response, for streamed exchanges. */
-  parseStream(body: string): CanonicalResponse;
-  /** Rewrite the model on a raw request body, for fork replay onto a different model. */
-  withModel(raw: unknown, model: string): unknown;
-  /** Request path this dialect posts to, for a request translated *into* it. */
-  requestPath: string;
-  /**
-   * Does this dialect serve the given model?
-   *
-   * Kept on the dialect rather than in a table in the proxy, for the same reason everything else
-   * here is: the proxy is handed a list of dialects and knows nothing about which exist, so a
-   * third party can add one without the routing needing to learn about it.
-   */
-  ownsModel(model: string): boolean;
-  /** Build a wire request from the canonical form — the inbound half of a cross-provider fork. */
-  fromCanonicalRequest(req: CanonicalRequest): unknown;
-  /** Build a wire response the agent will accept — the outbound half. */
-  fromCanonicalResponse(res: CanonicalResponse, streamed: boolean): string;
-}
-
-export function anthropicDialect(translators: {
-  toCanonicalRequest: (raw: unknown) => CanonicalRequest;
-  toCanonicalResponse: (raw: unknown) => CanonicalResponse;
-  parseSse: (body: string) => CanonicalResponse;
-  fromCanonicalRequest: (req: CanonicalRequest) => Record<string, unknown>;
-  fromCanonicalResponse: (res: CanonicalResponse) => Record<string, unknown>;
-  toSse: (res: CanonicalResponse) => string;
-}): Dialect {
-  return {
-    id: 'anthropic',
-    defaultUpstream: 'https://api.anthropic.com',
-    requestPath: '/v1/messages',
-    // OpenCode catalog providers mount Anthropic under /anthropic/v1, /coding/v1, etc.
-    // Keep the version segment: an arbitrary /messages route may belong to another API.
-    matches: (p) => p.startsWith('/v1/messages') || p.endsWith('/v1/messages'),
-    // Claude is the only family Anthropic serves, so the test is the name rather than a list that
-    // would need editing every time a model ships.
-    ownsModel: (m) => /^(?:.*\/)?claude[-.]/i.test(m.trim()),
-    toCanonicalRequest: translators.toCanonicalRequest,
-    toCanonicalResponse: translators.toCanonicalResponse,
-    parseStream: translators.parseSse,
-    withModel: (raw, model) => ({ ...(raw as Record<string, unknown>), model }),
-    fromCanonicalRequest: translators.fromCanonicalRequest,
-    fromCanonicalResponse: (res, streamed) =>
-      streamed ? translators.toSse(res) : JSON.stringify(translators.fromCanonicalResponse(res)),
-  };
-}
-
-export function openaiDialect(translators: {
-  toCanonicalRequest: (raw: unknown) => CanonicalRequest;
-  toCanonicalResponse: (raw: unknown) => CanonicalResponse;
-  parseSse: (body: string) => CanonicalResponse;
-  fromCanonicalRequest: (req: CanonicalRequest) => Record<string, unknown>;
-  fromCanonicalResponse: (res: CanonicalResponse) => Record<string, unknown>;
-  toSse: (res: CanonicalResponse) => string;
-}): Dialect {
-  return {
-    id: 'openai',
-    defaultUpstream: 'https://api.openai.com',
-    requestPath: '/v1/chat/completions',
-    // Agents reach chat completions through both /v1/chat/completions and /chat/completions
-    // depending on how their SDK joins the base URL. Accept either rather than making the user
-    // discover which one their harness picked.
-    matches: (p) => p.endsWith('/chat/completions') || p.endsWith('/completions'),
-    // Everything that is not Claude. The chat-completions shape is what GLM, Qwen, DeepSeek and
-    // every gateway speak, so it is the right default rather than a list of known vendors — an
-    // unknown model reaches an OpenAI-compatible endpoint, which is where an unknown model lives.
-    ownsModel: (m) => !/^(?:.*\/)?claude[-.]/i.test(m.trim()),
-    toCanonicalRequest: translators.toCanonicalRequest,
-    toCanonicalResponse: translators.toCanonicalResponse,
-    parseStream: translators.parseSse,
-    withModel: (raw, model) => ({ ...(raw as Record<string, unknown>), model }),
-    fromCanonicalRequest: translators.fromCanonicalRequest,
-    fromCanonicalResponse: (res, streamed) =>
-      streamed ? translators.toSse(res) : JSON.stringify(translators.fromCanonicalResponse(res)),
-  };
-}
-
-/**
- * The Codex CLI's subscription transport is an OpenAI Responses-shaped endpoint, but it is not
- * the public `/v1/responses` API: it lives at `/backend-api/codex/responses`, sends zstd-compressed
- * JSON and returns a Responses SSE stream. Keeping this dialect here lets the proxy replay the
- * bytes exactly while still using the normal canonical matcher and trace timeline.
- */
-export function codexDialect(): Dialect {
-  return {
-    id: 'codex',
-    defaultUpstream: 'https://chatgpt.com',
-    requestPath: '/backend-api/codex/responses',
-    matches: (p) => p === '/backend-api/codex/responses',
-    // Only Codex subscription model ids belong here. Generic GPT names must continue to route to
-    // the public OpenAI dialect when a fork changes an ordinary provider request.
-    ownsModel: (model) => /^gpt-5\.6-(?:sol|terra|luna)$/i.test(model.trim()),
-    toCanonicalRequest: codexToCanonicalRequest,
-    toCanonicalResponse: codexToCanonicalResponse,
-    parseStream: parseCodexSse,
-    withModel: (raw, model) => ({ ...(raw as Record<string, unknown>), model }),
-    fromCanonicalRequest: canonicalToCodexRequest,
-    fromCanonicalResponse: (res, streamed) =>
-      streamed ? canonicalToCodexSse(res) : JSON.stringify(canonicalToCodexResponse(res)),
-  };
-}
-
-function codexToCanonicalRequest(raw: unknown): CanonicalRequest {
-  const src = asRecord(raw);
-  const systemParts: string[] = [];
-  const messages: CanonicalMessage[] = [];
-  const input = src['input'];
-  const items = Array.isArray(input) ? input : input === undefined ? [] : [input];
-  for (const item of items) {
-    const value = asRecord(item);
-    const type = asString(value['type']);
-    if (type === 'function_call_output') {
-      messages.push({
-        role: 'user',
-        content: [
-          {
-            type: 'tool_result',
-            tool_use_id: asString(value['call_id']) ?? '',
-            content: stringifyText(value['output']),
-          },
-        ],
-      });
-      continue;
-    }
-    if (type === 'function_call') {
-      messages.push({
-        role: 'assistant',
-        content: [
-          {
-            type: 'tool_use',
-            id: asString(value['call_id']) ?? '',
-            name: asString(value['name']) ?? '',
-            input: parseJson(asString(value['arguments']) ?? '{}'),
-          },
-        ],
-      });
-      continue;
-    }
-    const role = asString(value['role']) ?? 'user';
-    const content = codexContent(value['content'] ?? value['text']);
-    if (role === 'system' || role === 'developer') {
-      const text = content
-        .filter(
-          (block): block is Extract<CanonicalContent, { type: 'text' }> => block.type === 'text',
-        )
-        .map((block) => block.text)
-        .join('\n');
-      if (text) systemParts.push(text);
-    } else {
-      messages.push({ role: role === 'assistant' ? 'assistant' : 'user', content });
-    }
-  }
-  if (typeof input === 'string')
-    messages.push({ role: 'user', content: [{ type: 'text', text: input }] });
-
-  const tools = codexTools(src['tools']);
-  return omitUndefined({
-    model: asString(src['model']) ?? '',
-    system:
-      asString(src['instructions']) ?? (systemParts.length ? systemParts.join('\n\n') : undefined),
-    messages,
-    tools: tools.length ? tools : undefined,
-    max_tokens: asNumber(src['max_output_tokens']),
-    temperature: asNumber(src['temperature']),
-    top_p: asNumber(src['top_p']),
-    stream: src['stream'] === true,
-  });
-}
-
-function codexToCanonicalResponse(raw: unknown): CanonicalResponse {
-  return codexResponse(asRecord(asRecord(raw)['response'] ?? raw), []);
-}
-
-function parseCodexSse(body: string): CanonicalResponse {
-  let response: Record<string, unknown> = {};
-  const deltas: string[] = [];
-  const output: unknown[] = [];
-  for (const frame of body.split(/\r?\n\r?\n/)) {
-    const data = frame
-      .split(/\r?\n/)
-      .filter((line) => line.startsWith('data:'))
-      .map((line) => line.slice(5).trimStart())
-      .join('\n');
-    if (!data || data === '[DONE]') continue;
-    const event = asRecord(parseJson(data));
-    const type = asString(event['type']);
-    if (
-      type === 'response.created' ||
-      type === 'response.completed' ||
-      type === 'response.in_progress'
-    ) {
-      response = asRecord(event['response']);
-    } else if (type === 'response.output_text.delta') {
-      const delta = asString(event['delta']);
-      if (delta) deltas.push(delta);
-    } else if (type === 'response.output_item.done') {
-      output.push(asRecord(event['item']));
-    }
-  }
-  return codexResponse(response, deltas, output);
-}
-
-function codexResponse(
-  response: Record<string, unknown>,
-  deltas: string[],
-  streamedOutput: unknown[] = [],
-): CanonicalResponse {
-  const content: CanonicalContent[] = [];
-  const output = streamedOutput.length
-    ? streamedOutput
-    : Array.isArray(response['output'])
-      ? response['output']
-      : [];
-  for (const raw of output) {
-    const item = asRecord(raw);
-    const type = asString(item['type']);
-    if (type === 'function_call') {
-      content.push({
-        type: 'tool_use',
-        id: asString(item['call_id']) ?? '',
-        name: asString(item['name']) ?? '',
-        input: parseJson(asString(item['arguments']) ?? '{}'),
-      });
-    } else if (type === 'message') {
-      content.push(...codexContent(item['content']));
-    }
-  }
-  if (deltas.length) content.unshift({ type: 'text', text: deltas.join('') });
-  const usage = asRecord(response['usage']);
-  const status = asString(response['status']);
-  const stop_reason: StopReason =
-    status === 'incomplete' ? 'max_tokens' : status === 'failed' ? 'error' : 'end_turn';
-  return {
-    id: asString(response['id']) ?? 'codex-response',
-    model: asString(response['model']) ?? '',
-    stop_reason,
-    content,
-    usage: {
-      input_tokens: asNumber(usage['input_tokens']) ?? 0,
-      output_tokens: asNumber(usage['output_tokens']) ?? 0,
-    },
-  };
-}
-
-function codexContent(raw: unknown): CanonicalContent[] {
-  if (typeof raw === 'string') return raw ? [{ type: 'text', text: raw }] : [];
-  const out: CanonicalContent[] = [];
-  for (const part of Array.isArray(raw) ? raw : []) {
-    const value = asRecord(part);
-    const type = asString(value['type']);
-    if (type === 'input_text' || type === 'output_text' || type === 'text') {
-      out.push({ type: 'text', text: asString(value['text']) ?? '' });
-    } else if (type === 'reasoning') {
-      out.push({ type: 'thinking', text: asString(value['summary']) ?? '' });
-    }
-  }
-  return out;
-}
-
-function codexTools(raw: unknown): CanonicalTool[] {
-  const out: CanonicalTool[] = [];
-  for (const item of Array.isArray(raw) ? raw : []) {
-    const value = asRecord(item);
-    if (asString(value['type']) !== 'function') continue;
-    const parameters = asRecord(value['parameters'] ?? value['input_schema']);
-    const name = asString(value['name']);
-    if (name)
-      out.push({ name, description: asString(value['description']), input_schema: parameters });
-  }
-  return out;
-}
-
-function canonicalToCodexRequest(req: CanonicalRequest): Record<string, unknown> {
-  const input: Record<string, unknown>[] = [];
-  for (const message of req.messages) {
-    const blocks = message.content.filter((block) => block.type === 'text');
-    if (blocks.length) {
-      input.push({
-        type: 'message',
-        role: message.role,
-        content: blocks.map((block) => ({
-          type: 'input_text',
-          text: block.type === 'text' ? block.text : '',
-        })),
-      });
-    }
-  }
-  return {
-    model: req.model,
-    ...(req.system === undefined ? {} : { instructions: req.system }),
-    input,
-    ...(req.tools === undefined
-      ? {}
-      : { tools: req.tools.map((tool) => ({ type: 'function', ...tool })) }),
-    ...(req.max_tokens === undefined ? {} : { max_output_tokens: req.max_tokens }),
-    ...(req.temperature === undefined ? {} : { temperature: req.temperature }),
-    ...(req.top_p === undefined ? {} : { top_p: req.top_p }),
-    ...(req.stream === undefined ? {} : { stream: req.stream }),
-  };
-}
-
-function canonicalToCodexResponse(res: CanonicalResponse): Record<string, unknown> {
-  return {
-    id: res.id,
-    object: 'response',
-    model: res.model,
-    status: 'completed',
-    output: res.content,
-  };
-}
-
-function canonicalToCodexSse(res: CanonicalResponse): string {
-  return `event: response.completed\ndata: ${JSON.stringify({ type: 'response.completed', response: canonicalToCodexResponse(res) })}\n\n`;
-}
-
-function asRecord(raw: unknown): Record<string, unknown> {
-  return raw !== null && typeof raw === 'object' && !Array.isArray(raw)
-    ? (raw as Record<string, unknown>)
-    : {};
-}
-
-function asString(raw: unknown): string | undefined {
-  return typeof raw === 'string' ? raw : undefined;
-}
-
-function asNumber(raw: unknown): number | undefined {
-  return typeof raw === 'number' && Number.isFinite(raw) ? raw : undefined;
-}
-
-function parseJson(raw: string): unknown {
-  try {
-    return JSON.parse(raw) as unknown;
-  } catch {
-    return raw;
-  }
-}
-
-function stringifyText(raw: unknown): string {
-  return typeof raw === 'string' ? raw : JSON.stringify(raw ?? '');
-}
-
-function omitUndefined<T extends Record<string, unknown>>(value: T): T {
-  for (const [key, item] of Object.entries(value)) if (item === undefined) delete value[key];
-  return value;
-}
-
-/**
- * The OpenAI Responses API.
- *
- * Kept apart from `openaiDialect` rather than folded into it, because the two share a provider and
- * almost nothing else: the system prompt is a top-level string, tool traffic is a list of
- * top-level items, and the stream is typed events rather than choice deltas. One dialect trying to
- * be both would have to sniff the body shape on every request, and guess wrong on the empty ones.
- *
- * It is registered *after* `openaiDialect` for a reason that only shows up on forks: `ownsModel`
- * cannot distinguish them — both serve everything that is not Claude — so the later position means
- * an ordinary chat-completions run forking to another OpenAI model still goes to chat completions.
- * A Responses run stays on Responses through the recorded-dialect preference in `goLive`.
- */
-export function responsesDialect(translators: {
-  toCanonicalRequest: (raw: unknown) => CanonicalRequest;
-  toCanonicalResponse: (raw: unknown) => CanonicalResponse;
-  parseSse: (body: string) => CanonicalResponse;
-  fromCanonicalRequest: (req: CanonicalRequest) => Record<string, unknown>;
-  fromCanonicalResponse: (res: CanonicalResponse) => Record<string, unknown>;
-  toSse: (res: CanonicalResponse) => string;
-}): Dialect {
-  return {
-    id: 'openai-responses',
-    defaultUpstream: 'https://api.openai.com',
-    requestPath: '/v1/responses',
-    // Agents reach it as `/v1/responses` or `/responses` depending on whether their SDK considers
-    // the version segment part of the base url, and a gateway may mount it under a prefix.
-    matches: (p) => p.endsWith('/responses'),
-    ownsModel: (m) => !/^(?:.*\/)?claude[-.]/i.test(m.trim()),
-    toCanonicalRequest: translators.toCanonicalRequest,
-    toCanonicalResponse: translators.toCanonicalResponse,
-    parseStream: translators.parseSse,
-    withModel: (raw, model) => ({ ...(raw as Record<string, unknown>), model }),
-    fromCanonicalRequest: translators.fromCanonicalRequest,
-    fromCanonicalResponse: (res, streamed) =>
-      streamed ? translators.toSse(res) : JSON.stringify(translators.fromCanonicalResponse(res)),
-  };
-}
-
-export function selectDialect(dialects: Dialect[], path: string): Dialect | undefined {
-  return dialects.find((d) => d.matches(path));
-}

package/packages/proxy/src/forward.ts

@@ -1,64 +0,0 @@
-/**
- * The origin-prefixed path an adapter can hand a client whose base URL agenticreplay rewrites.
- *
- * Base-URL variables cover the harnesses that read one, and `--tls-intercept` covers the ones
- * that read none. Between them sits a third shape: a harness that resolves each *provider's*
- * origin itself — OpenCode picks a base URL per model out of its catalog — so no single
- * environment variable can name where the traffic was headed. The adapter rewrites that base URL
- * to `<proxy>/forward/<encoded base>`, and the request arrives carrying its own destination.
- *
- * Encoding is `encodeURIComponent` of the whole base URL, so a base with a path in it
- * (`https://opencode.ai/zen/go/v1`) survives as one opaque first segment and the path the SDK
- * appends (`/chat/completions`) stays readable after it.
- */
-export interface ForwardPath {
-  /** The base URL the request was actually addressed to, without a trailing slash. */
-  base: string;
-  /** What follows the prefix: the path the client appended to the base it was given. */
-  path: string;
-}
-
-export const FORWARD_PREFIX = '/forward/';
-
-/**
- * Decode a `/forward/` path, or undefined when it is not one.
- *
- * Every failure decodes to `undefined` rather than throwing, because the prefix sits in a
- * namespace any client can write to: a POST to `/forward/plain` from a harness that happens to
- * use that path must fall through to the ordinary handling — passthrough or dialect — and not
- * become a 500 from a bad `new URL`. The bar for "is one of ours" is deliberately high: the
- * segment must percent-decode to an absolute http(s) origin-or-base with no credentials, query
- * or fragment, which no ordinary API path collides with.
- */
-export function decodeForwardPath(path: string): ForwardPath | undefined {
-  if (!path.startsWith(FORWARD_PREFIX)) return undefined;
-  const rest = path.slice(FORWARD_PREFIX.length);
-  const separator = rest.indexOf('/');
-  const encoded = separator === -1 ? rest : rest.slice(0, separator);
-  const tail = separator === -1 ? '' : rest.slice(separator);
-
-  let decoded: string;
-  try {
-    decoded = decodeURIComponent(encoded);
-  } catch {
-    return undefined;
-  }
-
-  let url: URL;
-  try {
-    url = new URL(decoded);
-  } catch {
-    return undefined;
-  }
-  if (url.protocol !== 'https:' && url.protocol !== 'http:') return undefined;
-  if (url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '') {
-    return undefined;
-  }
-
-  return { base: decoded.replace(/\/+$/, ''), path: tail === '' ? '/' : tail };
-}
-
-/** The path an adapter writes into a rewritten base URL: `<proxy>/forward/<encoded base>`. */
-export function forwardBasePath(base: string): string {
-  return `${FORWARD_PREFIX}${encodeURIComponent(base.replace(/\/+$/, ''))}`;
-}

package/packages/proxy/src/index.ts

@@ -1,8 +0,0 @@
-export * from './matching.js';
-export * from './forward.js';
-export * from './retrieval.js';
-export * from './dialects.js';
-export * from './ca.js';
-export * from './intercept.js';
-export * from './tls-hosts.js';
-export * from './server.js';