hyperbrane 0.1.1 → 0.2.0

package/dist/portal-gateway/gatewayService.d.ts

@@ -1,38 +1,11 @@
-import { type DockerClient } from "../lib/docker.ts";
-import type { ManagedImage } from "../lib/image.ts";
-import { type Sandbox } from "../sandbox/api.ts";
-import { type Gateway, type GatewayCredential, type TrafficRule, type Upstream } from "./api.ts";
-import type { GatewayStorage } from "./gatewayStorage.ts";
-import type { PortalStorage } from "./portalStorage.ts";
+import type { Sandbox, SandboxDataEndpoint } from "../sandbox/api.ts";
+import { type GatewayClient } from "./api.ts";
+import { GATEWAY_STATE_PATH, gatewayCaCertificatePath, gatewayContainerName } from "./control.ts";
+export { GATEWAY_STATE_PATH, gatewayCaCertificatePath, gatewayContainerName };
 /** @sealed */
-export interface GatewayService {
-    createGateway(gateway: Gateway): Promise<Gateway>;
-    destroyGateway(gatewayName: string): Promise<void>;
-    listGateways(): Promise<Gateway[]>;
-    restartGateway(gatewayName: string): Promise<void>;
-    listCredentials(gatewayName: string): Promise<GatewayCredential[]>;
-    deleteCredential(gatewayName: string, credentialName: string): Promise<void>;
-    registerUpstream(gatewayName: string, upstream: Upstream): Promise<Upstream>;
-    listUpstreams(gatewayName: string): Promise<Upstream[]>;
-    removeUpstream(gatewayName: string, upstreamName: string): Promise<void>;
-    setApiKey(gatewayName: string, upstreamName: string, keyName: string, key: string): Promise<{
-        fake: string;
-    }>;
-    deleteApiKey(gatewayName: string, upstreamName: string, keyName: string): Promise<void>;
-    createTrafficRule(gatewayName: string, rule: TrafficRule): Promise<TrafficRule>;
-    updateTrafficRule(gatewayName: string, rule: TrafficRule): Promise<TrafficRule>;
-    deleteTrafficRule(gatewayName: string, ruleName: string): Promise<void>;
-    listTrafficRules(gatewayName: string): Promise<TrafficRule[]>;
-    trafficRuleRespond(gatewayName: string, ruleName: string, action: "ALLOW" | "DENY"): Promise<void>;
+export interface GatewayService extends GatewayClient {
 }
-/** Where the gateway's state directory is mounted in its container. */
-export declare const GATEWAY_STATE_PATH = "/state";
-export declare function gatewayContainerName(gatewayName: string): string;
-/** Host path of the CA that signs everything the gateway intercepts; dimensions behind it must trust it. */
-export declare function gatewayCaCertificatePath(stateDirectory: string): string;
 export declare function assertValidName(kind: string, name: string): void;
-/**
- * `host` is the machine the docker daemon runs on, rooted at "/" so the state directory (a
- * bind-mount source) resolves the same way docker resolves it.
- */
-export declare function createGatewayService(storage: GatewayStorage, portals: PortalStorage, docker: DockerClient, image: ManagedImage, host: Sandbox): GatewayService;
+export declare function createGatewayService(host: Sandbox & SandboxDataEndpoint, { dataDirectory }?: {
+    dataDirectory?: string;
+}): GatewayService;

package/dist/portal-gateway/gatewayService.js

@@ -1,24 +1,11 @@
 import { isIPv4 } from "node:net";
-import { DockerError } from "../lib/docker.js";
+import { createDockerClient } from "../lib/docker.js";
+import { createGatewayImage } from "./image.js";
 import { InvalidNameError, checkName } from "../lib/jsonDirectory.js";
-import { SandboxNotFoundError } from "../sandbox/api.js";
-import { sleep } from "../lib/sleep.js";
-import { HYPERBRANE_VERSION } from "../lib/version.js";
-import { GatewayConflictError, GatewayInvalidError, GatewayNotFoundError, } from "./api.js";
-import { issueKeyFake } from "./fakes.js";
+import { GatewayInvalidError, GatewayNotFoundError } from "./api.js";
+import { GATEWAY_STATE_PATH, gatewayCaCertificatePath, gatewayContainerName, gatewayControl } from "./control.js";
 import { BUILTIN_UPSTREAMS } from "../upstreams/index.js";
-/** Where the gateway's state directory is mounted in its container. */
-export const GATEWAY_STATE_PATH = "/state";
-const PROXY_PORT = 8080;
-const READY_TIMEOUT_MS = 60_000;
-// "hybgw-" can't collide with a dimension's "hyb-<name>": dimension names start with a letter or digit.
-export function gatewayContainerName(gatewayName) {
-    return `hybgw-${gatewayName}`;
-}
-/** Host path of the CA that signs everything the gateway intercepts; dimensions behind it must trust it. */
-export function gatewayCaCertificatePath(stateDirectory) {
-    return `${stateDirectory}/mitmproxy/mitmproxy-ca-cert.pem`;
-}
+export { GATEWAY_STATE_PATH, gatewayCaCertificatePath, gatewayContainerName };
 export function assertValidName(kind, name) {
     try {
         checkName(name);
@@ -29,170 +16,51 @@ export function assertValidName(kind, name) {
         throw error;
     }
 }
-/**
- * `host` is the machine the docker daemon runs on, rooted at "/" so the state directory (a
- * bind-mount source) resolves the same way docker resolves it.
- */
-export function createGatewayService(storage, portals, docker, image, host) {
-    // Keeps no state between calls: the record is written first so a slow or crashed create stays
-    // visible, and every later step checks before it acts, so re-running converges.
+const FAKE_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function endpointName(gatewayName) {
+    return `gateway-${gatewayName}`;
+}
+export function createGatewayService(host, { dataDirectory } = {}) {
+    const control = gatewayControl(host, () => createGatewayImage(createDockerClient(host)).ensure(), { dataDirectory });
     async function createGateway(gateway) {
         assertValidName("gateway", gateway.name);
         const upstreams = (gateway.upstreams ?? BUILTIN_UPSTREAMS).map(validUpstream);
-        const name = gatewayContainerName(gateway.name);
-        const existing = await docker.inspectContainer(name);
-        if (existing)
-            assertOwnedContainer(existing, gateway.name);
-        const record = await storage.insertGateway({ name: gateway.name, state: "creating" });
-        const stateDirectory = await storage.ensureStateDirectory(gateway.name);
-        for (const upstream of upstreams)
-            await storage.saveUpstream(gateway.name, upstream);
-        const imageTag = await image.ensure();
-        await ensureContainer(gateway.name, stateDirectory, imageTag);
-        await docker.startContainer(name);
-        await awaitReady(gateway.name, stateDirectory);
-        if (record.state !== "ready")
-            await storage.saveGateway({ name: gateway.name, state: "ready" });
+        await control.createGateway(gateway.name, upstreams);
+        await control.startTransport(gateway.name, await host.openEndpoint(endpointName(gateway.name)), { restart: false });
         return { name: gateway.name };
     }
-    // A container from an older image is replaced: everything worth keeping (CA, credentials, rules)
-    // is in the mounted state directory. Its portals are re-wired by the portal watcher, or by the
-    // restore every command runs first.
-    async function ensureContainer(gatewayName, stateDirectory, imageTag) {
-        const name = gatewayContainerName(gatewayName);
-        const existing = await docker.inspectContainer(name);
-        if (existing) {
-            assertOwnedContainer(existing, gatewayName);
-            if (existing.Config?.Image === imageTag)
-                return;
-            await docker.removeContainer(name);
-        }
-        try {
-            await docker.createContainer(name, {
-                Image: imageTag,
-                Hostname: name,
-                Labels: {
-                    hyperbrane: "true",
-                    "hyperbrane.version": HYPERBRANE_VERSION,
-                    "hyperbrane.gateway": gatewayName,
-                },
-                HostConfig: {
-                    // A mount, not a copy: rules and credentials written by the service take effect on the next
-                    // request, and the CA survives the container being recreated.
-                    Binds: [`${stateDirectory}:${GATEWAY_STATE_PATH}`],
-                    CapAdd: ["NET_ADMIN"],
-                    NetworkMode: "bridge",
-                    Init: true,
-                    RestartPolicy: { Name: "unless-stopped" },
-                },
-            });
-        }
-        catch (error) {
-            // Lost a race with another creator: fine as long as the winner is ours.
-            if (!(error instanceof DockerError && error.status === 409))
-                throw error;
-            assertOwnedContainer(await awaitContainer(name, error), gatewayName);
-        }
-    }
-    // Docker reserves the name before the winner's container becomes inspectable, so give it a moment.
-    async function awaitContainer(name, conflict) {
-        for (let attempt = 0; attempt < 50; attempt++) {
-            const container = await docker.inspectContainer(name);
-            if (container)
-                return container;
-            await sleep(100);
-        }
-        throw conflict;
-    }
-    // Ready = the proxy is listening (so the redirect rules are in) and the CA exists (so portals can
-    // install it into dimensions).
-    async function awaitReady(gatewayName, stateDirectory) {
-        const name = gatewayContainerName(gatewayName);
-        const deadline = Date.now() + READY_TIMEOUT_MS;
-        while (Date.now() < deadline) {
-            if ((await proxyListening(name)) && (await exists(gatewayCaCertificatePath(stateDirectory))))
-                return;
-            await sleep(250);
-        }
-        const state = (await docker.inspectContainer(name))?.State;
-        throw new Error(`gateway ${gatewayName} did not become ready: container ${state?.Status ?? "missing"}, exit code ${state?.ExitCode ?? "-"}`);
-    }
-    async function proxyListening(name) {
-        try {
-            const result = await docker.exec(name, { cmd: ["ss", "-Hltn", `sport = :${PROXY_PORT}`], user: "root" });
-            return result.exitCode === 0 && result.stdout.trim() !== "";
-        }
-        catch (error) {
-            // Not running (yet, or restarting after a failed start).
-            if (error instanceof DockerError && error.status === 409)
-                return false;
-            throw error;
-        }
-    }
-    async function exists(path) {
-        try {
-            await host.stat(path);
-            return true;
-        }
-        catch (error) {
-            if (error instanceof SandboxNotFoundError)
-                return false;
-            throw error;
-        }
-    }
-    // Container first: if this crashes before the record is removed, the gateway still shows up and
-    // the destroy can be retried. Its state (credentials included) goes with the record.
     async function destroyGateway(gatewayName) {
         assertValidName("gateway", gatewayName);
-        const attached = (await portals.listPortals()).filter((portal) => portal.gatewayName === gatewayName);
-        if (attached.length > 0) {
-            throw new GatewayConflictError(`gateway ${gatewayName} still has portals: ${attached.map((portal) => portal.name).join(", ")}`);
-        }
-        const name = gatewayContainerName(gatewayName);
-        const existing = await docker.inspectContainer(name);
-        if (existing) {
-            assertOwnedContainer(existing, gatewayName);
-            await docker.removeContainer(name);
-        }
-        await storage.removeGateway(gatewayName);
+        await control.destroyGateway(gatewayName);
+        await host.closeEndpoint(endpointName(gatewayName));
     }
     async function restartGateway(gatewayName) {
-        const record = await requireGateway(gatewayName);
-        const name = gatewayContainerName(gatewayName);
-        const container = await docker.inspectContainer(name);
-        if (!container)
-            throw new GatewayNotFoundError(`gateway ${gatewayName} has no container; create it again`);
-        assertOwnedContainer(container, gatewayName);
-        await docker.restartContainer(name);
-        await awaitReady(gatewayName, await storage.ensureStateDirectory(record.name));
+        assertValidName("gateway", gatewayName);
+        await control.restartGateway(gatewayName);
+        await control.startTransport(gatewayName, await host.openEndpoint(endpointName(gatewayName)), { restart: true });
     }
-    async function listGateways() {
-        return (await storage.listGateways()).map(({ name }) => ({ name }));
+    async function endpoint(gatewayName, options) {
+        assertValidName("gateway", gatewayName);
+        const name = endpointName(gatewayName);
+        const found = (await host.listEndpoints()).find((candidate) => candidate.name === name);
+        if (!found)
+            throw new GatewayNotFoundError(`gateway ${gatewayName} has no data endpoint; create it again`);
+        return { url: found.url, credentials: await host.credentials(name, options) };
     }
     async function listCredentials(gatewayName) {
-        await requireGateway(gatewayName);
-        // All of them at once: a read per upstream adds up on a remote machine.
-        const [upstreams, held] = await Promise.all([storage.listUpstreams(gatewayName), storage.listCredentials(gatewayName)]);
-        const credentials = [];
-        for (const upstream of upstreams) {
-            if (held.get(`${upstream.name}.oauth`))
-                credentials.push({ name: `${upstream.name}.oauth`, gatewayName, type: "oauth" });
-            const apiKeys = held.get(`${upstream.name}.api-keys`);
-            for (const [keyName, { fake }] of Object.entries(apiKeys?.keys ?? {})) {
-                credentials.push({ name: `${upstream.name}.key.${keyName}`, gatewayName, type: "apiKey", fake });
-            }
-        }
-        return credentials;
+        assertValidName("gateway", gatewayName);
+        return (await control.listCredentials(gatewayName)).flatMap(({ upstream, oauth, apiKeys }) => [
+            ...(oauth ? [{ name: `${upstream}.oauth`, gatewayName, type: "oauth" }] : []),
+            ...Object.entries(apiKeys?.keys ?? {}).map(([keyName, { fake }]) => ({ name: `${upstream}.key.${keyName}`, gatewayName, type: "apiKey", fake })),
+        ]);
     }
-    // Storage holds the only copy of a secret, and the gateway re-reads credentials per request. Without
-    // its OAuth credential, the upstream's next sign-in goes to the upstream again (switching accounts).
     async function deleteCredential(gatewayName, credentialName) {
         assertValidName("gateway", gatewayName);
         const keyAt = credentialName.indexOf(".key.");
         if (credentialName.endsWith(".oauth")) {
             const upstreamName = credentialName.slice(0, -".oauth".length);
             assertValidName("upstream", upstreamName);
-            await storage.removeOAuthCredential(gatewayName, upstreamName);
+            await control.removeOAuthCredential(gatewayName, upstreamName);
         }
         else if (keyAt > 0) {
             await deleteApiKey(gatewayName, credentialName.slice(0, keyAt), credentialName.slice(keyAt + ".key.".length));
@@ -202,134 +70,99 @@ export function createGatewayService(storage, portals, docker, image, host) {
         }
     }
     async function registerUpstream(gatewayName, upstream) {
-        await requireGateway(gatewayName);
+        assertValidName("gateway", gatewayName);
         const definition = validUpstream(upstream);
-        await storage.saveUpstream(gatewayName, definition);
+        await control.registerUpstream(gatewayName, definition);
         return definition;
     }
     async function listUpstreams(gatewayName) {
-        await requireGateway(gatewayName);
-        return (await storage.listUpstreams(gatewayName)).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+        assertValidName("gateway", gatewayName);
+        return (await control.listUpstreams(gatewayName)).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
     }
     async function removeUpstream(gatewayName, upstreamName) {
         assertValidName("gateway", gatewayName);
         assertValidName("upstream", upstreamName);
-        await storage.removeUpstream(gatewayName, upstreamName);
+        await control.removeUpstream(gatewayName, upstreamName);
     }
-    // A key keeps its fake when replaced, so dimensions already holding it keep working.
     async function setApiKey(gatewayName, upstreamName, keyName, key) {
-        const mode = (await requireUpstream(gatewayName, upstreamName)).modes.apiKey;
-        if (!mode)
-            throw new GatewayInvalidError(`upstream ${upstreamName} has no API key mode`);
+        assertValidName("gateway", gatewayName);
+        assertValidName("upstream", upstreamName);
         assertValidName("API key", keyName);
         if (typeof key !== "string" || key === "")
             throw new GatewayInvalidError("the API key is empty");
-        const stored = (await storage.readApiKeys(gatewayName, upstreamName)) ?? { keys: {} };
-        const fake = stored.keys[keyName]?.fake ?? issueKeyFake(mode.fake, key);
-        await storage.saveApiKeys(gatewayName, upstreamName, { keys: { ...stored.keys, [keyName]: { key, fake } } });
-        return { fake };
+        const bytes = crypto.getRandomValues(new Uint8Array(key.length + 16));
+        const characters = Array.from(bytes, (byte) => FAKE_ALPHABET[byte % FAKE_ALPHABET.length]).join("");
+        return { fake: await control.setApiKey(gatewayName, upstreamName, keyName, key, characters) };
     }
     async function deleteApiKey(gatewayName, upstreamName, keyName) {
-        await requireUpstream(gatewayName, upstreamName);
+        assertValidName("gateway", gatewayName);
+        assertValidName("upstream", upstreamName);
         assertValidName("API key", keyName);
-        const stored = await storage.readApiKeys(gatewayName, upstreamName);
-        if (!stored?.keys[keyName])
-            return;
-        const { [keyName]: _removed, ...keys } = stored.keys;
-        if (Object.keys(keys).length === 0)
-            await storage.removeApiKeys(gatewayName, upstreamName);
-        else
-            await storage.saveApiKeys(gatewayName, upstreamName, { keys });
+        await control.deleteApiKey(gatewayName, upstreamName, keyName);
     }
     async function createTrafficRule(gatewayName, rule) {
-        await requireGateway(gatewayName);
+        assertValidName("gateway", gatewayName);
         const requested = validTrafficRule(rule);
-        const stored = await storage.insertTrafficRule(gatewayName, requested);
-        if (!sameTrafficRule(stored, requested)) {
-            throw new GatewayConflictError(`traffic rule ${rule.name} already exists with a different spec`);
-        }
+        await control.createTrafficRule(gatewayName, requested);
         return requested;
     }
     async function updateTrafficRule(gatewayName, rule) {
-        await requireGateway(gatewayName);
+        assertValidName("gateway", gatewayName);
         const requested = validTrafficRule(rule);
-        await requireTrafficRule(gatewayName, rule.name);
-        await storage.saveTrafficRule(gatewayName, requested);
+        await control.updateTrafficRule(gatewayName, requested);
         return requested;
     }
-    // Requests an ASK rule is holding carry on once it's gone.
     async function deleteTrafficRule(gatewayName, ruleName) {
         assertValidName("gateway", gatewayName);
         assertValidName("traffic rule", ruleName);
-        await storage.removeTrafficRule(gatewayName, ruleName);
+        await control.deleteTrafficRule(gatewayName, ruleName);
     }
     async function listTrafficRules(gatewayName) {
-        await requireGateway(gatewayName);
-        const rules = await storage.listTrafficRules(gatewayName);
-        return rules.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+        assertValidName("gateway", gatewayName);
+        return (await control.listTrafficRules(gatewayName)).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
     }
-    // Answers every request the rule is holding right now; later requests wait for a later answer.
     async function trafficRuleRespond(gatewayName, ruleName, action) {
-        await requireGateway(gatewayName);
-        if (action !== "ALLOW" && action !== "DENY")
-            throw new GatewayInvalidError(`invalid response: ${action}`);
-        const rule = await requireTrafficRule(gatewayName, ruleName);
-        if (rule.action !== "ASK")
-            throw new GatewayInvalidError(`traffic rule ${ruleName} is not an ASK rule`);
-        await storage.saveTrafficRuleResponse(gatewayName, { name: ruleName, action, at: Date.now() });
-    }
-    async function requireGateway(gatewayName) {
         assertValidName("gateway", gatewayName);
-        const record = await storage.readGateway(gatewayName);
-        if (!record)
-            throw new GatewayNotFoundError(`gateway ${gatewayName} does not exist`);
-        return record;
-    }
-    async function requireUpstream(gatewayName, upstreamName) {
-        await requireGateway(gatewayName);
-        assertValidName("upstream", upstreamName);
-        const upstream = await storage.readUpstream(gatewayName, upstreamName);
-        if (!upstream)
-            throw new GatewayNotFoundError(`upstream ${upstreamName} does not exist on gateway ${gatewayName}`);
-        return upstream;
-    }
-    async function requireTrafficRule(gatewayName, ruleName) {
         assertValidName("traffic rule", ruleName);
-        const rule = await storage.readTrafficRule(gatewayName, ruleName);
-        if (!rule)
-            throw new GatewayNotFoundError(`traffic rule ${ruleName} does not exist on gateway ${gatewayName}`);
-        return rule;
+        if (action !== "ALLOW" && action !== "DENY")
+            throw new GatewayInvalidError(`invalid response: ${action}`);
+        await control.trafficRuleRespond(gatewayName, ruleName, action);
     }
     return {
-        createGateway,
-        destroyGateway,
-        listGateways,
-        restartGateway,
+        createGateway: (gateway) => createGateway(gateway),
+        destroyGateway: (gatewayName) => destroyGateway(gatewayName),
+        listGateways: () => control.listGateways(),
+        restartGateway: (gatewayName) => restartGateway(gatewayName),
+        endpoint,
         listCredentials,
-        deleteCredential,
-        registerUpstream,
+        deleteCredential: (gatewayName, credentialName) => deleteCredential(gatewayName, credentialName),
+        registerUpstream: (gatewayName, upstream) => registerUpstream(gatewayName, upstream),
         listUpstreams,
-        removeUpstream,
-        setApiKey,
-        deleteApiKey,
-        createTrafficRule,
-        updateTrafficRule,
-        deleteTrafficRule,
+        removeUpstream: (gatewayName, upstreamName) => removeUpstream(gatewayName, upstreamName),
+        setApiKey: (gatewayName, upstreamName, keyName, key) => setApiKey(gatewayName, upstreamName, keyName, key),
+        deleteApiKey: (gatewayName, upstreamName, keyName) => deleteApiKey(gatewayName, upstreamName, keyName),
+        createTrafficRule: (gatewayName, rule) => createTrafficRule(gatewayName, rule),
+        updateTrafficRule: (gatewayName, rule) => updateTrafficRule(gatewayName, rule),
+        deleteTrafficRule: (gatewayName, ruleName) => deleteTrafficRule(gatewayName, ruleName),
         listTrafficRules,
-        trafficRuleRespond,
+        trafficRuleRespond: (gatewayName, ruleName, action) => trafficRuleRespond(gatewayName, ruleName, action),
     };
 }
-/** The checks the gateway relies on; the rest of the shape is the SDK client's (see upstream.ts). */
 function validUpstream(upstream) {
     assertValidName("upstream", upstream.name);
-    const { oauth, apiKey } = upstream.modes ?? {};
-    if (!oauth && !apiKey)
-        throw new GatewayInvalidError(`upstream ${upstream.name} needs an oauth or apiKey mode`);
+    const { oauth, apiKey, forced } = upstream.modes ?? {};
+    if (!oauth && !apiKey && !forced)
+        throw new GatewayInvalidError(`upstream ${upstream.name} needs an oauth, apiKey or forced mode`);
+    for (const mode of [oauth, apiKey, forced]) {
+        if (mode && (!Array.isArray(mode.hosts) || mode.hosts.length === 0))
+            throw new GatewayInvalidError(`upstream ${upstream.name}: every mode needs hosts`);
+    }
     for (const mode of [oauth, apiKey]) {
-        if (mode && (!Array.isArray(mode.hosts) || mode.hosts.length === 0 || !mode.present)) {
-            throw new GatewayInvalidError(`upstream ${upstream.name}: every mode needs hosts and present`);
-        }
+        if (mode && !mode.present)
+            throw new GatewayInvalidError(`upstream ${upstream.name}: oauth and apiKey modes need present`);
     }
+    if (forced && !forced.force)
+        throw new GatewayInvalidError(`upstream ${upstream.name}: a forced mode needs force`);
     if (oauth && (!oauth.tokenUrl || !oauth.fakes?.access)) {
         throw new GatewayInvalidError(`upstream ${upstream.name}: oauth needs tokenUrl and fakes.access`);
     }
@@ -337,7 +170,6 @@ function validUpstream(upstream) {
         throw new GatewayInvalidError(`upstream ${upstream.name}: apiKey needs a fake shape`);
     return upstream;
 }
-/** Returns just the rule's fields, so nothing unknown ends up in storage. */
 function validTrafficRule(rule) {
     assertValidName("traffic rule", rule.name);
     if (typeof rule.urlMask !== "string" || rule.urlMask === "") {
@@ -356,7 +188,6 @@ function validTrafficRule(rule) {
     return { name: rule.name, urlMask: rule.urlMask, action: rule.action, delayMs: rule.delayMs };
 }
 const TCP_SCHEME = "tcp://";
-/** "tcp://<address>:<port>": address is "*", an IPv4 address or a CIDR; port is "*" or a number. */
 function assertValidTcpMask(ruleName, urlMask) {
     const target = urlMask.slice(TCP_SCHEME.length);
     const separator = target.lastIndexOf(":");
@@ -373,8 +204,3 @@ function assertValidTcpMask(ruleName, urlMask) {
 function sameTrafficRule(a, b) {
     return a.urlMask === b.urlMask && a.action === b.action && a.delayMs === b.delayMs;
 }
-function assertOwnedContainer(container, gatewayName) {
-    if (container.Config?.Labels?.["hyperbrane.gateway"] !== gatewayName) {
-        throw new GatewayConflictError(`container ${gatewayContainerName(gatewayName)} exists but is not managed by hyperbrane`);
-    }
-}

package/dist/portal-gateway/image.d.ts

@@ -1,6 +1,5 @@
 import type { DockerClient } from "../lib/docker.ts";
 import { type ManagedImage } from "../lib/image.ts";
-/** Bump whenever anything under ./image changes (and run `bun run embed:images`). */
-export declare const GATEWAY_IMAGE_VERSION = "v16";
+export declare const GATEWAY_IMAGE_VERSION = "v17";
 export declare const GATEWAY_IMAGE_REPOSITORY = "hyperbrane-gateway";
 export declare function createGatewayImage(docker: DockerClient): ManagedImage;

package/dist/portal-gateway/image.js

@@ -1,8 +1,6 @@
 import { createManagedImage } from "../lib/image.js";
-// The files under ./image, as strings (see dimension/image.ts).
 import { IMAGE_FILES } from "./imageFiles.generated.js";
-/** Bump whenever anything under ./image changes (and run `bun run embed:images`). */
-export const GATEWAY_IMAGE_VERSION = "v16";
+export const GATEWAY_IMAGE_VERSION = "v17";
 export const GATEWAY_IMAGE_REPOSITORY = "hyperbrane-gateway";
 export function createGatewayImage(docker) {
     return createManagedImage(docker, {