@usine/config 0.3.0 → 0.4.0

package/README.md

@@ -41,10 +41,12 @@ repos:
 
 ## Settings and workers
 
-`settings.max_children` (default 4) limits the child sessions, sequential and concurrent, that one attempt can start. Without a `workers` key, the parser adds a local worker named `local` that runs one attempt at a time. A worker's `kind` (`local`, `exe.dev`, or `ssh`) selects its executor.
+`settings.max_children` (default 4) limits the child sessions, sequential and concurrent, that one attempt can start. Without a `workers` key, the parser adds a local worker named `local` that runs one attempt at a time. A worker's `kind` (`local`, `exe.dev`, or `ssh`) selects its executor. An SSH worker's `container` (`WorkerContainer`) sets the image and the `cpus`, `memory_mib`, and `pids` limits of each attempt container; each limit is optional, and the executor derives an unset one from the machine at preflight.
 
 Issue and pull request loops accept `max_cycles`, a positive integer (default 3): the number of runs each loop can open on an item between operator resets. The first admission past it blocks runs from every loop on the item. Schedule loops are exempt. See [Write review and fix loops](https://docs.usine.dev/guides/review-fix-loops/).
 
+A loop's optional `priority`, a positive integer (`LoopFile.priority`, `LoopPriority`), ranks its runs for a free worker slot before runs that lane order ranks, higher first. See [Loop files](https://docs.usine.dev/reference/configuration/loop-files/#priority).
+
 ## Load an instance
 
 `InstanceFolder.load` takes an `InstanceDirectory` (`@usine/core/instance`) and returns one atomic `LoadedInstance` snapshot:

package/dist/board.d.ts

@@ -3,11 +3,14 @@ export declare const LaneName: Schema.brand<Schema.String, "LaneName">;
 export type LaneName = typeof LaneName.Type;
 export declare const LaneItemState: Schema.Literals<readonly ["issue-open", "issue-closed", "pr-open", "pr-closed", "pr-merged"]>;
 export type LaneItemState = typeof LaneItemState.Type;
+/** The state of a closed issue or a closed or merged pull request. */
+export declare const SettledItemState: Schema.Literals<readonly ["issue-closed", "pr-closed", "pr-merged"]>;
+export type SettledItemState = typeof SettledItemState.Type;
 /**
  * Returns whether `state` is a closed issue or a closed or merged pull request, which the Board
  * places by state regardless of labels.
  */
-export declare const isSettledItemState: (state: LaneItemState) => boolean;
+export declare const isSettledItemState: (state: LaneItemState) => state is SettledItemState;
 declare const LabelLaneSource_base: Schema.Class<LabelLaneSource, Schema.Struct<{
     readonly label: Schema.brand<Schema.String, "GitHubLabelName">;
 }>, {}>;

package/dist/board.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"board.d.ts","sourceRoot":"","sources":["../src/board.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIhC,eAAO,MAAM,QAAQ,yCAEpB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C,eAAO,MAAM,aAAa,+FAMxB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAQtD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAAW,aAAa,KAAG,OAAyC,CAAC;;;;AAEpG,0FAA0F;AAC1F,qBAAa,eAAgB,SAAQ,oBAIpC;CAAG;;;;AAEJ,sFAAsF;AACtF,qBAAa,eAAgB,SAAQ,oBAIpC;CAAG;AAEJ,eAAO,MAAM,UAAU,yEAAmD,CAAC;AAE3E,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;;;;;AAEhD,wEAAwE;AACxE,qBAAa,IAAK,SAAQ,SAGxB;CAAG"}
+{"version":3,"file":"board.d.ts","sourceRoot":"","sources":["../src/board.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIhC,eAAO,MAAM,QAAQ,yCAEpB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C,eAAO,MAAM,aAAa,+FAMxB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAEtD,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,sEAA8D,CAAC;AAE5F,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAC;AAI5D;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAAW,aAAa,KAAG,KAAK,IAAI,gBACjD,CAAC;;;;AAEnB,0FAA0F;AAC1F,qBAAa,eAAgB,SAAQ,oBAIpC;CAAG;;;;AAEJ,sFAAsF;AACtF,qBAAa,eAAgB,SAAQ,oBAIpC;CAAG;AAEJ,eAAO,MAAM,UAAU,yEAAmD,CAAC;AAE3E,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;;;;;AAEhD,wEAAwE;AACxE,qBAAa,IAAK,SAAQ,SAGxB;CAAG"}

package/dist/board.js

@@ -9,16 +9,14 @@ export const LaneItemState = Schema.Literals([
     "pr-closed",
     "pr-merged",
 ]);
-const SETTLED_ITEM_STATES = new Set([
-    "issue-closed",
-    "pr-closed",
-    "pr-merged",
-]);
+/** The state of a closed issue or a closed or merged pull request. */
+export const SettledItemState = Schema.Literals(["issue-closed", "pr-closed", "pr-merged"]);
+const isSettled = Schema.is(SettledItemState);
 /**
  * Returns whether `state` is a closed issue or a closed or merged pull request, which the Board
  * places by state regardless of labels.
  */
-export const isSettledItemState = (state) => SETTLED_ITEM_STATES.has(state);
+export const isSettledItemState = (state) => isSettled(state);
 /** A lane source that matches Items with this GitHub label, which Board moves can set. */
 export class LabelLaneSource extends Schema.Class("@usine/config/LabelLaneSource")({
     label: GitHubLabelName,

package/dist/board.js.map

@@ -1 +1 @@
-{"version":3,"file":"board.js","sourceRoot":"","sources":["../src/board.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,CAAC,MAAM,QAAQ,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAC3E,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CACzB,CAAC;AAIF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3C,YAAY;IACZ,cAAc;IACd,SAAS;IACT,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAIH,MAAM,mBAAmB,GAA+B,IAAI,GAAG,CAAC;IAC9D,cAAc;IACd,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAoB,EAAW,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAEpG,0FAA0F;AAC1F,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,+BAA+B,CAAC,CACjG;IACE,KAAK,EAAE,eAAe;CACvB,CACF;CAAG;AAEJ,sFAAsF;AACtF,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,+BAA+B,CAAC,CACjG;IACE,KAAK,EAAE,aAAa;CACrB,CACF;CAAG;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;AAI3E,wEAAwE;AACxE,MAAM,OAAO,IAAK,SAAQ,MAAM,CAAC,KAAK,CAAO,oBAAoB,CAAC,CAAC;IACjE,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;CAC7D,CAAC;CAAG"}
+{"version":3,"file":"board.js","sourceRoot":"","sources":["../src/board.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,CAAC,MAAM,QAAQ,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAC3E,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CACzB,CAAC;AAIF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3C,YAAY;IACZ,cAAc;IACd,SAAS;IACT,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAIH,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAI5F,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAoB,EAA6B,EAAE,CACpF,SAAS,CAAC,KAAK,CAAC,CAAC;AAEnB,0FAA0F;AAC1F,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,+BAA+B,CAAC,CACjG;IACE,KAAK,EAAE,eAAe;CACvB,CACF;CAAG;AAEJ,sFAAsF;AACtF,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,+BAA+B,CAAC,CACjG;IACE,KAAK,EAAE,aAAa;CACrB,CACF;CAAG;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;AAI3E,wEAAwE;AACxE,MAAM,OAAO,IAAK,SAAQ,MAAM,CAAC,KAAK,CAAO,oBAAoB,CAAC,CAAC;IACjE,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;CAC7D,CAAC;CAAG"}

package/dist/factory.d.ts

@@ -32,7 +32,7 @@ declare const WorkerGateway_base: Schema.Class<WorkerGateway, Schema.Struct<{
     readonly destination: Schema.brand<Schema.String, "SshDestination">;
     readonly adminPort: Schema.withDecodingDefaultKey<Schema.brand<Schema.Int, "GatewayAdminPort">, never>;
     readonly adminTokenEnv: Schema.brand<Schema.String, "EnvironmentVariableName">;
-    readonly llmProviders: Schema.withDecodingDefaultKey<Schema.$Array<Schema.Literals<readonly ["anthropic"]>>, never>;
+    readonly llmProviders: Schema.withDecodingDefaultKey<Schema.$Array<Schema.Literals<readonly ["anthropic", "openai"]>>, never>;
 }>, {}>;
 /**
  * The Gateway in front of an SSH Worker's machine on a private network (ADR 0027).
@@ -43,16 +43,111 @@ declare const WorkerGateway_base: Schema.Class<WorkerGateway, Schema.Struct<{
  *   Gateway's loopback interface.
  * - `adminTokenEnv`: the orchestrator environment variable with the admin token, read when
  *   `usine up` starts or a reload adds the Worker.
- * - `llmProviders`: the providers whose credential the Gateway injects. Harnesses for other
- *   providers, and Codex, use the operator's login on the Worker through the forward proxy.
+ * - `llmProviders`: the providers whose credential the Gateway injects: `anthropic` for Claude
+ *   Code, `openai` for Codex. Harnesses for other providers use the operator's login on the
+ *   Worker through the forward proxy.
  */
 export declare class WorkerGateway extends WorkerGateway_base {
 }
+declare const WorkerContainer_base: Schema.Class<WorkerContainer, Schema.Struct<{
+    readonly image: Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "ContainerImage">>;
+    readonly cpus: Schema.OptionFromOptionalKey<Schema.brand<Schema.Finite, "ContainerCpus">>;
+    readonly memoryMib: Schema.OptionFromOptionalKey<Schema.brand<Schema.Int, "ContainerMemoryMib">>;
+    readonly pids: Schema.OptionFromOptionalKey<Schema.brand<Schema.Int, "ContainerPids">>;
+}>, {}>;
+/**
+ * The container that each Attempt on an SSH Worker runs in, if the machine has Docker.
+ *
+ * - `image`: the image to run. If `None`, the executor's image for the harness versions of this
+ *   release.
+ * - `cpus`, `memoryMib`, and `pids`: the limits of each Attempt's container. If `None`, the
+ *   executor derives the limit from the machine at preflight: the machine's total less a reserve
+ *   for its own processes, divided by `maxConcurrentAttempts`.
+ */
+export declare class WorkerContainer extends WorkerContainer_base {
+}
+declare const ProviderApiKeys_base: Schema.Class<ProviderApiKeys, Schema.Struct<{
+    readonly anthropic: Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "EnvironmentVariableName">>;
+    readonly openai: Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "EnvironmentVariableName">>;
+}>, {}>;
+/**
+ * The orchestrator environment variables with the LLM provider API keys that each Attempt on a
+ * provisioned Worker gets in its environment, read when `usine up` starts or a reload adds the
+ * Worker. `anthropic` becomes `ANTHROPIC_API_KEY` for Claude Code, and `openai` becomes
+ * `OPENAI_API_KEY` for Codex.
+ */
+export declare class ProviderApiKeys extends ProviderApiKeys_base {
+}
+declare const HetznerProvisioner_base: Schema.Class<HetznerProvisioner, Schema.Struct<{
+    readonly provider: Schema.Literal<"hetzner">;
+    readonly tokenEnv: Schema.brand<Schema.String, "EnvironmentVariableName">;
+    readonly serverType: Schema.brand<Schema.String, "HetznerServerType">;
+    readonly location: Schema.brand<Schema.String, "HetznerLocation">;
+    readonly image: Schema.brand<Schema.String, "HetznerImage">;
+    readonly network: Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "HetznerResourceName">>;
+    readonly firewall: Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "HetznerResourceName">>;
+    readonly sshKey: Schema.brand<Schema.String, "HetznerResourceName">;
+    readonly sshUser: Schema.withDecodingDefaultKey<Schema.brand<Schema.String, "SshUser">, never>;
+    readonly labels: Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.String>, never>;
+    readonly apiKeys: Schema.withDecodingDefaultKey<typeof ProviderApiKeys, never>;
+}>, {}>;
+/**
+ * Creates one Hetzner Cloud server per Attempt from a snapshot, and deletes it after the
+ * Attempt (#550).
+ *
+ * - `tokenEnv`: the orchestrator environment variable with a Hetzner Cloud API token with read
+ *   and write access to the project.
+ * - `serverType` and `location`: each server's type and location.
+ * - `image`: the snapshot's ID or description, which `infra/hetzner/snapshot.sh` prints.
+ * - `network`: the private network to attach each server to. With a Gateway, it's the Gateway's
+ *   network and the server gets no public address.
+ * - `firewall`: the project's firewall to apply to each server, such as one that admits SSH only
+ *   from the orchestrator's address to a server with a public address.
+ * - `sshKey`: the name of the SSH key in the project that each server authorizes.
+ * - `sshUser`: the user the executor connects as.
+ * - `labels`: extra labels for each server.
+ * - `apiKeys`: provider API keys for each Attempt, for harnesses whose credential the Gateway
+ *   doesn't have.
+ */
+export declare class HetznerProvisioner extends HetznerProvisioner_base {
+}
+declare const BoatProvisioner_base: Schema.Class<BoatProvisioner, Schema.Struct<{
+    readonly provider: Schema.Literal<"boat">;
+    readonly tokenEnv: Schema.brand<Schema.String, "EnvironmentVariableName">;
+    readonly size: Schema.withDecodingDefaultKey<Schema.Literals<readonly ["small", "default", "large", "xlarge"]>, never>;
+    readonly apiKeys: Schema.withDecodingDefaultKey<typeof ProviderApiKeys, never>;
+}>, {}>;
+/**
+ * Creates one Boat sandbox per Attempt and deletes it after the Attempt (#550). Boat has no
+ * network rules, so a Boat Worker has no Gateway, and each Attempt's GitHub token is on its
+ * machine (ADR 0026). Boat documents no region choice; its machines are in Germany, Finland, and
+ * France.
+ *
+ * - `tokenEnv`: the orchestrator environment variable with a Boat API key.
+ * - `size`: each sandbox's Boat machine type.
+ * - `apiKeys`: provider API keys for each Attempt. A harness without one can't authenticate,
+ *   because a subscription login needs a Gateway.
+ */
+export declare class BoatProvisioner extends BoatProvisioner_base {
+}
+/** The provider that creates one machine per Attempt for an SSH Worker; `provider` selects it. */
+export declare const WorkerProvisioner: Schema.Union<readonly [typeof HetznerProvisioner, typeof BoatProvisioner]>;
+export type WorkerProvisioner = typeof WorkerProvisioner.Type;
 declare const SshWorker_base: Schema.Class<SshWorker, Schema.Struct<{
     readonly name: Schema.brand<Schema.String, "WorkerName">;
     readonly kind: Schema.Literal<"ssh">;
     readonly maxConcurrentAttempts: Schema.withDecodingDefaultKey<Schema.Int, never>;
-    readonly destination: Schema.brand<Schema.String, "SshDestination">;
+    readonly destination: Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "SshDestination">>;
+    readonly provisioner: Schema.OptionFromOptionalKey<Schema.Union<readonly [Schema.encodeKeys<typeof HetznerProvisioner, {
+        readonly tokenEnv: "token_env";
+        readonly serverType: "server_type";
+        readonly sshKey: "ssh_key";
+        readonly sshUser: "ssh_user";
+        readonly apiKeys: "api_keys";
+    }>, Schema.encodeKeys<typeof BoatProvisioner, {
+        readonly tokenEnv: "token_env";
+        readonly apiKeys: "api_keys";
+    }>]>>;
     readonly identityFile: Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "SshIdentityFile">>;
     readonly port: Schema.OptionFromOptionalKey<Schema.brand<Schema.Int, "SshPort">>;
     readonly root: Schema.brand<Schema.String, "WorkerRoot">;
@@ -61,16 +156,58 @@ declare const SshWorker_base: Schema.Class<SshWorker, Schema.Struct<{
         readonly adminTokenEnv: "admin_token_env";
         readonly llmProviders: "llm_providers";
     }>>;
+    readonly container: Schema.withDecodingDefaultKey<Schema.encodeKeys<typeof WorkerContainer, {
+        readonly memoryMib: "memory_mib";
+    }>, never>;
 }>, {}>;
 /**
  * A Linux machine reached with `ssh`, with Worker state under `<root>/workers/<name>`. If
  * `gateway` is set, the machine stores no GitHub token; the executor sends each Attempt's token
- * to the Gateway.
+ * to the Gateway. A Worker sets either `destination`, for one long-lived machine, or
+ * `provisioner`, for one machine per Attempt; `maxConcurrentAttempts` then caps the machines in
+ * flight.
  */
 export declare class SshWorker extends SshWorker_base {
 }
+declare const CloudflareLlmProviderKey_base: Schema.Class<CloudflareLlmProviderKey, Schema.Struct<{
+    readonly provider: Schema.Literals<readonly ["anthropic", "openai"]>;
+    readonly apiKeyEnv: Schema.brand<Schema.String, "EnvironmentVariableName">;
+}>, {}>;
+/**
+ * An LLM provider whose API key the Cloudflare Worker's outbound handlers hold for each Attempt.
+ * `apiKeyEnv` is the orchestrator environment variable with the key, read when `usine up` starts.
+ */
+export declare class CloudflareLlmProviderKey extends CloudflareLlmProviderKey_base {
+}
+declare const CloudflareWorker_base: Schema.Class<CloudflareWorker, Schema.Struct<{
+    readonly name: Schema.brand<Schema.String, "WorkerName">;
+    readonly kind: Schema.Literal<"cloudflare">;
+    readonly maxConcurrentAttempts: Schema.withDecodingDefaultKey<Schema.Int, never>;
+    readonly workerUrl: Schema.URLFromString;
+    readonly accessClientIdEnv: Schema.brand<Schema.String, "EnvironmentVariableName">;
+    readonly accessClientSecretEnv: Schema.brand<Schema.String, "EnvironmentVariableName">;
+    readonly image: Schema.brand<Schema.String, "CloudflareImageName">;
+    readonly instanceType: Schema.withDecodingDefaultKey<Schema.Literals<readonly ["lite", "basic", "standard-1", "standard-2", "standard-3", "standard-4"]>, never>;
+    readonly llmProviders: Schema.withDecodingDefaultKey<Schema.$Array<Schema.encodeKeys<typeof CloudflareLlmProviderKey, {
+        readonly apiKeyEnv: "api_key_env";
+    }>>, never>;
+}>, {}>;
+/**
+ * A Worker that runs each Attempt in its own Cloudflare sandbox, through the Worker that the
+ * operator deploys from `@usine/cloudflare`.
+ *
+ * - `workerUrl`: the deployed Worker's origin.
+ * - `accessClientIdEnv` and `accessClientSecretEnv`: the orchestrator environment variables with
+ *   the Cloudflare Access service token that the Worker accepts, read when `usine up` starts.
+ * - `image`: the name of the image in the Worker's `containers[].images`.
+ * - `instanceType`: the container instance type of each sandbox.
+ * - `llmProviders`: the providers whose API key the Worker's outbound handlers inject. Claude Code
+ *   needs `anthropic` and Codex needs `openai`; a sandbox holds no harness login.
+ */
+export declare class CloudflareWorker extends CloudflareWorker_base {
+}
 /** A configured Worker; `kind` selects the adapter. */
-export declare const Worker: Schema.Union<readonly [typeof LocalWorker, typeof ExeDevWorker, typeof SshWorker]>;
+export declare const Worker: Schema.Union<readonly [typeof LocalWorker, typeof ExeDevWorker, typeof SshWorker, typeof CloudflareWorker]>;
 export type Worker = typeof Worker.Type;
 declare const Settings_base: Schema.Class<Settings, Schema.Struct<{
     /** The interval between GitHub polling cycles, in seconds. */
@@ -100,6 +237,18 @@ export declare const Webhooks: Schema.Union<readonly [Schema.Struct<{
     readonly publicUrl: "public_url";
 }>]>;
 export type Webhooks = typeof Webhooks.Type;
+declare const Tracing_base: Schema.Class<Tracing, Schema.Struct<{
+    /**
+     * The collector's OTLP/HTTP traces endpoint, used as given, such as
+     * `http://localhost:4318/v1/traces`. It has no credentials or query string.
+     */
+    readonly otlpUrl: Schema.URLFromString;
+    /** The `service.name` resource attribute of every exported span. */
+    readonly serviceName: Schema.withDecodingDefaultKey<Schema.String, never>;
+}>, {}>;
+/** Span export over OTLP/HTTP (ADR 0028). */
+export declare class Tracing extends Tracing_base {
+}
 declare const UsineConfig_base: Schema.Class<UsineConfig, Schema.Struct<{
     readonly version: Schema.Literal<1>;
     readonly labels: Schema.withDecodingDefaultKey<Schema.$Array<typeof DeclaredLabel>, never>;
@@ -116,9 +265,39 @@ declare const UsineConfig_base: Schema.Class<UsineConfig, Schema.Struct<{
         readonly maxConcurrentAttempts: "max_concurrent_attempts";
     }>, Schema.encodeKeys<typeof ExeDevWorker, {
         readonly maxConcurrentAttempts: "max_concurrent_attempts";
-    }>, Schema.encodeKeys<typeof SshWorker, {
+    }>, Schema.decodeTo<typeof SshWorker, Schema.Struct<{
+        readonly container: Schema.toEncoded<Schema.withDecodingDefaultKey<Schema.encodeKeys<typeof WorkerContainer, {
+            readonly memoryMib: "memory_mib";
+        }>, never>>;
+        readonly destination: Schema.toEncoded<Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "SshDestination">>>;
+        readonly gateway: Schema.toEncoded<Schema.OptionFromOptionalKey<Schema.encodeKeys<typeof WorkerGateway, {
+            readonly adminPort: "admin_port";
+            readonly adminTokenEnv: "admin_token_env";
+            readonly llmProviders: "llm_providers";
+        }>>>;
+        readonly identity_file: Schema.toEncoded<Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "SshIdentityFile">>>;
+        readonly kind: Schema.toEncoded<Schema.Literal<"ssh">>;
+        readonly max_concurrent_attempts: Schema.toEncoded<Schema.withDecodingDefaultKey<Schema.Int, never>>;
+        readonly name: Schema.toEncoded<Schema.brand<Schema.String, "WorkerName">>;
+        readonly port: Schema.toEncoded<Schema.OptionFromOptionalKey<Schema.brand<Schema.Int, "SshPort">>>;
+        readonly provisioner: Schema.toEncoded<Schema.OptionFromOptionalKey<Schema.Union<readonly [Schema.encodeKeys<typeof HetznerProvisioner, {
+            readonly tokenEnv: "token_env";
+            readonly serverType: "server_type";
+            readonly sshKey: "ssh_key";
+            readonly sshUser: "ssh_user";
+            readonly apiKeys: "api_keys";
+        }>, Schema.encodeKeys<typeof BoatProvisioner, {
+            readonly tokenEnv: "token_env";
+            readonly apiKeys: "api_keys";
+        }>]>>>;
+        readonly root: Schema.toEncoded<Schema.brand<Schema.String, "WorkerRoot">>;
+    }>, never, never>, Schema.encodeKeys<typeof CloudflareWorker, {
         readonly maxConcurrentAttempts: "max_concurrent_attempts";
-        readonly identityFile: "identity_file";
+        readonly workerUrl: "worker_url";
+        readonly accessClientIdEnv: "access_client_id_env";
+        readonly accessClientSecretEnv: "access_client_secret_env";
+        readonly instanceType: "instance_type";
+        readonly llmProviders: "llm_providers";
     }>]>>, never>;
     readonly webhooks: Schema.withDecodingDefaultKey<Schema.Union<readonly [Schema.Struct<{
         readonly mode: Schema.Literal<"off">;
@@ -131,6 +310,10 @@ declare const UsineConfig_base: Schema.Class<UsineConfig, Schema.Struct<{
         readonly publicUrl: "public_url";
     }>]>, never>;
     readonly operator: Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "OperatorLogin">>;
+    readonly tracing: Schema.OptionFromOptionalKey<Schema.encodeKeys<typeof Tracing, {
+        readonly otlpUrl: "otlp_url";
+        readonly serviceName: "service_name";
+    }>>;
 }>, {}>;
 /** The decoded `usine.yaml`. */
 export declare class UsineConfig extends UsineConfig_base {

package/dist/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAcA,OAAO,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAc,IAAI,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAsB,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,kDAAkD;AAClD,eAAO,MAAM,WAAW,4CAEvB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;;;;;;AA6BlD,qBAAa,WAAY,SAAQ,gBAM/B;CAAG;;;;;;AAIL,iEAAiE;AACjE,qBAAa,WAAY,SAAQ,gBAI/B;CAAG;;;;;;AAEL,qDAAqD;AACrD,qBAAa,YAAa,SAAQ,iBAIhC;CAAG;;;;;;;;AAQL;;;;;;;;;;;GAWG;AACH,qBAAa,aAAc,SAAQ,kBAQjC;CAAG;;;;;;;;;;;;;;;AAEL;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,cAiB7B;CAAG;AAEL,uDAAuD;AACvD,eAAO,MAAM,MAAM,oFAAuD,CAAC;AAC3E,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC;;IAGtC,8DAA8D;;IAE9D,oFAAoF;;IAEpF,4EAA4E;;IAE5E,gGAAgG;;IAEhG,gFAAgF;;IAEhF,iGAAiG;;;AAXnG,qBAAa,QAAS,SAAQ,aAa5B;CAAG;AAEL,uGAAuG;AACvG,eAAO,MAAM,QAAQ;;;;;;;;;IAMnB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8B5C,gCAAgC;AAChC,qBAAa,WAAY,SAAQ,gBAU/B;CAAG"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAkB,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAc,IAAI,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAsB,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,kDAAkD;AAClD,eAAO,MAAM,WAAW,4CAEvB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;;;;;;AA6BlD,qBAAa,WAAY,SAAQ,gBAM/B;CAAG;;;;;;AAIL,iEAAiE;AACjE,qBAAa,WAAY,SAAQ,gBAI/B;CAAG;;;;;;AAEL,qDAAqD;AACrD,qBAAa,YAAa,SAAQ,iBAIhC;CAAG;;;;;;;;AAQL;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAc,SAAQ,kBAQjC;CAAG;;;;;;;AAEL;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,oBAOpC;CAAG;;;;;AAEJ;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,oBAKpC;CAAG;;;;;;;;;;;;;;AAMJ;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,kBAAmB,SAAQ,uBActC;CAAG;;;;;;;AAEL;;;;;;;;;;GAUG;AACH,qBAAa,eAAgB,SAAQ,oBAOpC;CAAG;AAEJ,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,4EAAsD,CAAC;AACrF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAe9D;;;;;;GAMG;AACH,qBAAa,SAAU,SAAQ,cAsB7B;CAAG;;;;;AAuCL;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,6BAK5C;CAAG;;;;;;;;;;;;;;AAOL;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAiB,SAAQ,qBAkBpC;CAAG;AAEL,uDAAuD;AACvD,eAAO,MAAM,MAAM,6GAAyE,CAAC;AAC7F,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC;;IAGtC,8DAA8D;;IAE9D,oFAAoF;;IAEpF,4EAA4E;;IAE5E,gGAAgG;;IAEhG,gFAAgF;;IAEhF,iGAAiG;;;AAXnG,qBAAa,QAAS,SAAQ,aAa5B;CAAG;AAEL,uGAAuG;AACvG,eAAO,MAAM,QAAQ;;;;;;;;;IAMnB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;;IAc1C;;;OAGG;;IAEH,oEAAoE;;;AAPtE,6CAA6C;AAC7C,qBAAa,OAAQ,SAAQ,YAU3B;CAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCL,gCAAgC;AAChC,qBAAa,WAAY,SAAQ,gBAa/B;CAAG"}

package/dist/factory.js

@@ -2,8 +2,8 @@ import { Effort, ModelId } from "@usine/core/agent/brain";
 import { ChildSessionBudget } from "@usine/core/agent/session";
 import { OperatorLogin } from "@usine/core/operator";
 import { RepositoryName } from "@usine/core/repository";
-import { GatewayAdminPort, GatewayDomain, GatewayLlmProvider, SshDestination, SshIdentityFile, SshPort, WorkerName, WorkerRoot, } from "@usine/core/worker";
-import { Effect, Schema } from "effect";
+import { BoatSize, CloudflareImageName, CloudflareInstanceType, CloudflareLlmProvider, ContainerCpus, ContainerImage, ContainerMemoryMib, ContainerPids, GatewayAdminPort, GatewayDomain, GatewayLlmProvider, HetznerImage, HetznerLabels, HetznerLocation, HetznerResourceName, HetznerServerType, SshDestination, SshIdentityFile, SshPort, SshUser, WorkerName, WorkerRoot, } from "@usine/core/worker";
+import { Effect, Option, Schema } from "effect";
 import { nonBlankString, uniqueRepositoryNames } from "./checks.js";
 import { LaneSource, Lane } from "./board.js";
 import { canonicalLabelName, DeclaredLabel } from "./label.js";
@@ -54,8 +54,9 @@ const EnvironmentVariableName = Schema.String.check(Schema.isPattern(/^[A-Za-z_]
  *   Gateway's loopback interface.
  * - `adminTokenEnv`: the orchestrator environment variable with the admin token, read when
  *   `usine up` starts or a reload adds the Worker.
- * - `llmProviders`: the providers whose credential the Gateway injects. Harnesses for other
- *   providers, and Codex, use the operator's login on the Worker through the forward proxy.
+ * - `llmProviders`: the providers whose credential the Gateway injects: `anthropic` for Claude
+ *   Code, `openai` for Codex. Harnesses for other providers use the operator's login on the
+ *   Worker through the forward proxy.
  */
 export class WorkerGateway extends Schema.Class("@usine/config/WorkerGateway")({
     domain: GatewayDomain,
@@ -67,16 +68,109 @@ export class WorkerGateway extends Schema.Class("@usine/config/WorkerGateway")({
         .pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
 }) {
 }
+/**
+ * The container that each Attempt on an SSH Worker runs in, if the machine has Docker.
+ *
+ * - `image`: the image to run. If `None`, the executor's image for the harness versions of this
+ *   release.
+ * - `cpus`, `memoryMib`, and `pids`: the limits of each Attempt's container. If `None`, the
+ *   executor derives the limit from the machine at preflight: the machine's total less a reserve
+ *   for its own processes, divided by `maxConcurrentAttempts`.
+ */
+export class WorkerContainer extends Schema.Class("@usine/config/WorkerContainer")({
+    image: Schema.OptionFromOptionalKey(ContainerImage),
+    cpus: Schema.OptionFromOptionalKey(ContainerCpus),
+    memoryMib: Schema.OptionFromOptionalKey(ContainerMemoryMib),
+    pids: Schema.OptionFromOptionalKey(ContainerPids),
+}) {
+}
+/**
+ * The orchestrator environment variables with the LLM provider API keys that each Attempt on a
+ * provisioned Worker gets in its environment, read when `usine up` starts or a reload adds the
+ * Worker. `anthropic` becomes `ANTHROPIC_API_KEY` for Claude Code, and `openai` becomes
+ * `OPENAI_API_KEY` for Codex.
+ */
+export class ProviderApiKeys extends Schema.Class("@usine/config/ProviderApiKeys")({
+    anthropic: Schema.OptionFromOptionalKey(EnvironmentVariableName),
+    openai: Schema.OptionFromOptionalKey(EnvironmentVariableName),
+}) {
+}
+const ProviderApiKeysFromYaml = ProviderApiKeys.pipe(Schema.withDecodingDefaultKey(Effect.succeed({})));
+/**
+ * Creates one Hetzner Cloud server per Attempt from a snapshot, and deletes it after the
+ * Attempt (#550).
+ *
+ * - `tokenEnv`: the orchestrator environment variable with a Hetzner Cloud API token with read
+ *   and write access to the project.
+ * - `serverType` and `location`: each server's type and location.
+ * - `image`: the snapshot's ID or description, which `infra/hetzner/snapshot.sh` prints.
+ * - `network`: the private network to attach each server to. With a Gateway, it's the Gateway's
+ *   network and the server gets no public address.
+ * - `firewall`: the project's firewall to apply to each server, such as one that admits SSH only
+ *   from the orchestrator's address to a server with a public address.
+ * - `sshKey`: the name of the SSH key in the project that each server authorizes.
+ * - `sshUser`: the user the executor connects as.
+ * - `labels`: extra labels for each server.
+ * - `apiKeys`: provider API keys for each Attempt, for harnesses whose credential the Gateway
+ *   doesn't have.
+ */
+export class HetznerProvisioner extends Schema.Class("@usine/config/HetznerProvisioner")({
+    provider: Schema.Literal("hetzner"),
+    tokenEnv: EnvironmentVariableName,
+    serverType: HetznerServerType,
+    location: HetznerLocation,
+    image: HetznerImage,
+    network: Schema.OptionFromOptionalKey(HetznerResourceName),
+    firewall: Schema.OptionFromOptionalKey(HetznerResourceName),
+    sshKey: HetznerResourceName,
+    sshUser: SshUser.pipe(Schema.withDecodingDefaultKey(Effect.succeed("usine"))),
+    labels: HetznerLabels.pipe(Schema.withDecodingDefaultKey(Effect.succeed({}))),
+    apiKeys: ProviderApiKeysFromYaml,
+}) {
+}
+/**
+ * Creates one Boat sandbox per Attempt and deletes it after the Attempt (#550). Boat has no
+ * network rules, so a Boat Worker has no Gateway, and each Attempt's GitHub token is on its
+ * machine (ADR 0026). Boat documents no region choice; its machines are in Germany, Finland, and
+ * France.
+ *
+ * - `tokenEnv`: the orchestrator environment variable with a Boat API key.
+ * - `size`: each sandbox's Boat machine type.
+ * - `apiKeys`: provider API keys for each Attempt. A harness without one can't authenticate,
+ *   because a subscription login needs a Gateway.
+ */
+export class BoatProvisioner extends Schema.Class("@usine/config/BoatProvisioner")({
+    provider: Schema.Literal("boat"),
+    tokenEnv: EnvironmentVariableName,
+    size: BoatSize.pipe(Schema.withDecodingDefaultKey(Effect.succeed("default"))),
+    apiKeys: ProviderApiKeysFromYaml,
+}) {
+}
+/** The provider that creates one machine per Attempt for an SSH Worker; `provider` selects it. */
+export const WorkerProvisioner = Schema.Union([HetznerProvisioner, BoatProvisioner]);
+const WorkerProvisionerFromYaml = Schema.Union([
+    HetznerProvisioner.pipe(Schema.encodeKeys({
+        tokenEnv: "token_env",
+        serverType: "server_type",
+        sshKey: "ssh_key",
+        sshUser: "ssh_user",
+        apiKeys: "api_keys",
+    })),
+    BoatProvisioner.pipe(Schema.encodeKeys({ tokenEnv: "token_env", apiKeys: "api_keys" })),
+]);
 /**
  * A Linux machine reached with `ssh`, with Worker state under `<root>/workers/<name>`. If
  * `gateway` is set, the machine stores no GitHub token; the executor sends each Attempt's token
- * to the Gateway.
+ * to the Gateway. A Worker sets either `destination`, for one long-lived machine, or
+ * `provisioner`, for one machine per Attempt; `maxConcurrentAttempts` then caps the machines in
+ * flight.
  */
 export class SshWorker extends Schema.Class("@usine/config/SshWorker")({
     name: WorkerName,
     kind: Schema.Literal("ssh"),
     maxConcurrentAttempts: MaxConcurrentAttempts,
-    destination: SshDestination,
+    destination: Schema.OptionFromOptionalKey(SshDestination),
+    provisioner: Schema.OptionFromOptionalKey(WorkerProvisionerFromYaml),
     identityFile: Schema.OptionFromOptionalKey(SshIdentityFile),
     port: Schema.OptionFromOptionalKey(SshPort),
     root: WorkerRoot,
@@ -85,10 +179,76 @@ export class SshWorker extends Schema.Class("@usine/config/SshWorker")({
         adminTokenEnv: "admin_token_env",
         llmProviders: "llm_providers",
     }))),
+    container: WorkerContainer.pipe(Schema.encodeKeys({ memoryMib: "memory_mib" }), Schema.withDecodingDefaultKey(Effect.succeed({}))),
+}) {
+}
+/** Returns the reason an SSH Worker's machine settings conflict, or `undefined` if they don't. */
+const sshMachineConflict = (worker) => {
+    const provisioner = Option.getOrUndefined(worker.provisioner);
+    if (provisioner === undefined)
+        return Option.isNone(worker.destination)
+            ? `SSH worker "${worker.name}" needs a destination or a provisioner`
+            : undefined;
+    if (Option.isSome(worker.destination))
+        return `SSH worker "${worker.name}" sets both destination and provisioner; a provisioned worker creates its machines, so remove destination`;
+    if (Option.isSome(worker.port))
+        return `SSH worker "${worker.name}" sets port, which a provisioned worker takes from its provider`;
+    switch (provisioner.provider) {
+        case "hetzner":
+            return Option.isSome(worker.gateway) && Option.isNone(provisioner.network)
+                ? `SSH worker "${worker.name}" has a gateway, so its provisioner needs the gateway's private network in network`
+                : undefined;
+        case "boat":
+            if (Option.isSome(worker.gateway))
+                return `SSH worker "${worker.name}" has a Boat provisioner and a gateway; Boat has no network rules, so no gateway can be its machines' only way out. Remove gateway.`;
+            return Option.isNone(worker.identityFile)
+                ? `SSH worker "${worker.name}" has a Boat provisioner and needs identity_file, whose .pub file usine adds to each sandbox`
+                : undefined;
+    }
+};
+const HttpsUrl = Schema.URLFromString.check(Schema.makeFilter((url) => url.protocol === "https:", { message: "Expected an https URL" }), Schema.makeFilter((url) => url.username === "" &&
+    url.password === "" &&
+    url.search === "" &&
+    url.hash === "" &&
+    url.pathname === "/", { message: "Expected the Worker's origin, without a path, credentials, or query string" }));
+/**
+ * An LLM provider whose API key the Cloudflare Worker's outbound handlers hold for each Attempt.
+ * `apiKeyEnv` is the orchestrator environment variable with the key, read when `usine up` starts.
+ */
+export class CloudflareLlmProviderKey extends Schema.Class("@usine/config/CloudflareLlmProviderKey")({
+    provider: CloudflareLlmProvider,
+    apiKeyEnv: EnvironmentVariableName,
+}) {
+}
+const uniqueProviders = Schema.makeFilter((values) => new Set(values.map(({ provider }) => provider)).size === values.length, { message: "Expected each provider once" });
+/**
+ * A Worker that runs each Attempt in its own Cloudflare sandbox, through the Worker that the
+ * operator deploys from `@usine/cloudflare`.
+ *
+ * - `workerUrl`: the deployed Worker's origin.
+ * - `accessClientIdEnv` and `accessClientSecretEnv`: the orchestrator environment variables with
+ *   the Cloudflare Access service token that the Worker accepts, read when `usine up` starts.
+ * - `image`: the name of the image in the Worker's `containers[].images`.
+ * - `instanceType`: the container instance type of each sandbox.
+ * - `llmProviders`: the providers whose API key the Worker's outbound handlers inject. Claude Code
+ *   needs `anthropic` and Codex needs `openai`; a sandbox holds no harness login.
+ */
+export class CloudflareWorker extends Schema.Class("@usine/config/CloudflareWorker")({
+    name: WorkerName,
+    kind: Schema.Literal("cloudflare"),
+    maxConcurrentAttempts: MaxConcurrentAttempts,
+    workerUrl: HttpsUrl,
+    accessClientIdEnv: EnvironmentVariableName,
+    accessClientSecretEnv: EnvironmentVariableName,
+    image: CloudflareImageName,
+    instanceType: CloudflareInstanceType.pipe(Schema.withDecodingDefaultKey(Effect.succeed("standard-4"))),
+    llmProviders: Schema.Array(CloudflareLlmProviderKey.pipe(Schema.encodeKeys({ apiKeyEnv: "api_key_env" })))
+        .check(uniqueProviders)
+        .pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
 }) {
 }
 /** A configured Worker; `kind` selects the adapter. */
-export const Worker = Schema.Union([LocalWorker, ExeDevWorker, SshWorker]);
+export const Worker = Schema.Union([LocalWorker, ExeDevWorker, SshWorker, CloudflareWorker]);
 export class Settings extends Schema.Class("@usine/config/Settings")({
     /** The interval between GitHub polling cycles, in seconds. */
     pollInterval: PositiveInt.pipe(Schema.withDecodingDefaultKey(Effect.succeed(60))),
@@ -110,6 +270,22 @@ export const Webhooks = Schema.Union([
     Schema.Struct({ mode: Schema.Literal("deliveries") }),
     Schema.Struct({ mode: Schema.Literal("endpoint"), publicUrl: Schema.URLFromString }).pipe(Schema.encodeKeys({ publicUrl: "public_url" })),
 ]);
+const OtlpUrl = Schema.URLFromString.check(Schema.makeFilter((url) => url.protocol === "http:" || url.protocol === "https:", {
+    message: "Expected an http or https URL",
+}), Schema.makeFilter((url) => url.username === "" && url.password === "" && url.search === "", {
+    message: "Expected a URL without a username, password, or query string; authenticate in a collector next to usine up",
+}));
+/** Span export over OTLP/HTTP (ADR 0028). */
+export class Tracing extends Schema.Class("@usine/config/Tracing")({
+    /**
+     * The collector's OTLP/HTTP traces endpoint, used as given, such as
+     * `http://localhost:4318/v1/traces`. It has no credentials or query string.
+     */
+    otlpUrl: OtlpUrl,
+    /** The `service.name` resource attribute of every exported span. */
+    serviceName: nonBlankString("Expected a non-blank service name").pipe(Schema.withDecodingDefaultKey(Effect.succeed("usine"))),
+}) {
+}
 const SettingsFromYaml = Settings.pipe(Schema.encodeKeys({
     pollInterval: "poll_interval",
     maxChildren: "max_children",
@@ -124,6 +300,14 @@ const WorkerFromYaml = Schema.Union([
     SshWorker.pipe(Schema.encodeKeys({
         maxConcurrentAttempts: "max_concurrent_attempts",
         identityFile: "identity_file",
+    })).check(Schema.makeFilter((worker) => sshMachineConflict(worker) ?? true)),
+    CloudflareWorker.pipe(Schema.encodeKeys({
+        maxConcurrentAttempts: "max_concurrent_attempts",
+        workerUrl: "worker_url",
+        accessClientIdEnv: "access_client_id_env",
+        accessClientSecretEnv: "access_client_secret_env",
+        instanceType: "instance_type",
+        llmProviders: "llm_providers",
     })),
 ]);
 const ManagedRepos = Schema.Array(ManagedRepo).check(uniqueRepositoryNames((repo) => repo.name));
@@ -137,6 +321,7 @@ export class UsineConfig extends Schema.Class("@usine/config/UsineConfig")({
     workers: Workers.pipe(Schema.withDecodingDefaultKey(Effect.succeed([{ name: "local", kind: "local" }]))),
     webhooks: Webhooks.pipe(Schema.withDecodingDefaultKey(Effect.succeed({ mode: "off" }))),
     operator: Schema.OptionFromOptionalKey(OperatorLogin),
+    tracing: Schema.OptionFromOptionalKey(Tracing.pipe(Schema.encodeKeys({ otlpUrl: "otlp_url", serviceName: "service_name" }))),
 }) {
 }
 //# sourceMappingURL=factory.js.map

package/dist/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,OAAO,EACP,UAAU,EACV,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,kDAAkD;AAClD,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC,mCAAmC,CAAC,CAAC,IAAI,CACjF,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAC5B,CAAC;AAIF,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEvE,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CACnC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAC1E,EAAE,OAAO,EAAE,uBAAuB,EAAE,CACrC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,MAAkB,EAAU,EAAE,CACnD,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,KAAK,EAAE,CAAC;AAE5F,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,CACzC,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC;AAC5C,CAAC,EACD,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAC1D,CAAC;AAEF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAEvE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CACxC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAC9F,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAClD,CAAC;AAEF,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE3E,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,KAAK,CAAc,2BAA2B,CAAC,CAAC;IACtF,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;SAC5B,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;SACxB,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;CACrE,CAAC;CAAG;AAEL,MAAM,qBAAqB,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjG,iEAAiE;AACjE,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,KAAK,CAAc,2BAA2B,CAAC,CAAC;IACtF,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IAC7B,qBAAqB,EAAE,qBAAqB;CAC7C,CAAC;CAAG;AAEL,qDAAqD;AACrD,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,KAAK,CAAe,4BAA4B,CAAC,CAAC;IACzF,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;IAC/B,qBAAqB,EAAE,qBAAqB;CAC7C,CAAC;CAAG;AAEL,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CACjD,MAAM,CAAC,SAAS,CAAC,2BAA2B,EAAE;IAC5C,OAAO,EAAE,uCAAuC;CACjD,CAAC,CACH,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,KAAK,CAAgB,6BAA6B,CAAC,CAAC;IAC5F,MAAM,EAAE,aAAa;IACrB,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,aAAa,EAAE,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC;SAC3C,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;SACxB,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;CAC3D,CAAC;CAAG;AAEL;;;;GAIG;AACH,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,KAAK,CAAY,yBAAyB,CAAC,CAAC;IAChF,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3B,qBAAqB,EAAE,qBAAqB;IAC5C,WAAW,EAAE,cAAc;IAC3B,YAAY,EAAE,MAAM,CAAC,qBAAqB,CAAC,eAAe,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC;IAC3C,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,MAAM,CAAC,qBAAqB,CACnC,aAAa,CAAC,IAAI,CAChB,MAAM,CAAC,UAAU,CAAC;QAChB,SAAS,EAAE,YAAY;QACvB,aAAa,EAAE,iBAAiB;QAChC,YAAY,EAAE,eAAe;KAC9B,CAAC,CACH,CACF;CACF,CAAC;CAAG;AAEL,uDAAuD;AACvD,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;AAG3E,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,KAAK,CAAW,wBAAwB,CAAC,CAAC;IAC7E,8DAA8D;IAC9D,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,oFAAoF;IACpF,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,4EAA4E;IAC5E,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC;IAC5D,gGAAgG;IAChG,gBAAgB,EAAE,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC;IAC3D,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC;IAClD,iGAAiG;IACjG,YAAY,EAAE,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC;CACnD,CAAC;CAAG;AAEL,uGAAuG;AACvG,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9C,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;IACrD,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CACvF,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAC/C;CACF,CAAC,CAAC;AAIH,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CACpC,MAAM,CAAC,UAAU,CAAC;IAChB,YAAY,EAAE,eAAe;IAC7B,WAAW,EAAE,cAAc;IAC3B,iBAAiB,EAAE,qBAAqB;IACxC,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,cAAc;IAC3B,YAAY,EAAE,eAAe;CAC9B,CAAC,CACH,CAAC;AAEF,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC;IAClC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACzF,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC1F,SAAS,CAAC,IAAI,CACZ,MAAM,CAAC,UAAU,CAAC;QAChB,qBAAqB,EAAE,yBAAyB;QAChD,YAAY,EAAE,eAAe;KAC9B,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAClD,qBAAqB,CAAC,CAAC,IAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CACxD,CAAC;AAEF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;AAErF,gCAAgC;AAChC,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,KAAK,CAAc,2BAA2B,CAAC,CAAC;IACtF,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAClF,OAAO,EAAE,OAAO,CAAC,IAAI,CACnB,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAClF;IACD,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACvF,QAAQ,EAAE,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAAC;CACtD,CAAC;CAAG"}
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,kDAAkD;AAClD,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC,mCAAmC,CAAC,CAAC,IAAI,CACjF,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAC5B,CAAC;AAIF,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEvE,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CACnC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAC1E,EAAE,OAAO,EAAE,uBAAuB,EAAE,CACrC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,MAAkB,EAAU,EAAE,CACnD,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,KAAK,EAAE,CAAC;AAE5F,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,CACzC,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC;AAC5C,CAAC,EACD,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAC1D,CAAC;AAEF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAEvE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CACxC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAC9F,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAClD,CAAC;AAEF,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE3E,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,KAAK,CAAc,2BAA2B,CAAC,CAAC;IACtF,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;SAC5B,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;SACxB,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;CACrE,CAAC;CAAG;AAEL,MAAM,qBAAqB,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjG,iEAAiE;AACjE,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,KAAK,CAAc,2BAA2B,CAAC,CAAC;IACtF,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IAC7B,qBAAqB,EAAE,qBAAqB;CAC7C,CAAC;CAAG;AAEL,qDAAqD;AACrD,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,KAAK,CAAe,4BAA4B,CAAC,CAAC;IACzF,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;IAC/B,qBAAqB,EAAE,qBAAqB;CAC7C,CAAC;CAAG;AAEL,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CACjD,MAAM,CAAC,SAAS,CAAC,2BAA2B,EAAE;IAC5C,OAAO,EAAE,uCAAuC;CACjD,CAAC,CACH,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,KAAK,CAAgB,6BAA6B,CAAC,CAAC;IAC5F,MAAM,EAAE,aAAa;IACrB,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,aAAa,EAAE,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC;SAC3C,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;SACxB,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;CAC3D,CAAC;CAAG;AAEL;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,+BAA+B,CAAC,CACjG;IACE,KAAK,EAAE,MAAM,CAAC,qBAAqB,CAAC,cAAc,CAAC;IACnD,IAAI,EAAE,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAAC;IACjD,SAAS,EAAE,MAAM,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAAC;CAClD,CACF;CAAG;AAEJ;;;;;GAKG;AACH,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,+BAA+B,CAAC,CACjG;IACE,SAAS,EAAE,MAAM,CAAC,qBAAqB,CAAC,uBAAuB,CAAC;IAChE,MAAM,EAAE,MAAM,CAAC,qBAAqB,CAAC,uBAAuB,CAAC;CAC9D,CACF;CAAG;AAEJ,MAAM,uBAAuB,GAAG,eAAe,CAAC,IAAI,CAClD,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAClD,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,KAAK,CAClD,kCAAkC,CACnC,CAAC;IACA,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;IACnC,QAAQ,EAAE,uBAAuB;IACjC,UAAU,EAAE,iBAAiB;IAC7B,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,YAAY;IACnB,OAAO,EAAE,MAAM,CAAC,qBAAqB,CAAC,mBAAmB,CAAC;IAC1D,QAAQ,EAAE,MAAM,CAAC,qBAAqB,CAAC,mBAAmB,CAAC;IAC3D,MAAM,EAAE,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,EAAE,uBAAuB;CACjC,CAAC;CAAG;AAEL;;;;;;;;;;GAUG;AACH,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,+BAA+B,CAAC,CACjG;IACE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,QAAQ,EAAE,uBAAuB;IACjC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7E,OAAO,EAAE,uBAAuB;CACjC,CACF;CAAG;AAEJ,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC,CAAC;AAGrF,MAAM,yBAAyB,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7C,kBAAkB,CAAC,IAAI,CACrB,MAAM,CAAC,UAAU,CAAC;QAChB,QAAQ,EAAE,WAAW;QACrB,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,UAAU;KACpB,CAAC,CACH;IACD,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;CACxF,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,KAAK,CAAY,yBAAyB,CAAC,CAAC;IAChF,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3B,qBAAqB,EAAE,qBAAqB;IAC5C,WAAW,EAAE,MAAM,CAAC,qBAAqB,CAAC,cAAc,CAAC;IACzD,WAAW,EAAE,MAAM,CAAC,qBAAqB,CAAC,yBAAyB,CAAC;IACpE,YAAY,EAAE,MAAM,CAAC,qBAAqB,CAAC,eAAe,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC;IAC3C,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,MAAM,CAAC,qBAAqB,CACnC,aAAa,CAAC,IAAI,CAChB,MAAM,CAAC,UAAU,CAAC;QAChB,SAAS,EAAE,YAAY;QACvB,aAAa,EAAE,iBAAiB;QAChC,YAAY,EAAE,eAAe;KAC9B,CAAC,CACH,CACF;IACD,SAAS,EAAE,eAAe,CAAC,IAAI,CAC7B,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,EAC9C,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAClD;CACF,CAAC;CAAG;AAEL,kGAAkG;AAClG,MAAM,kBAAkB,GAAG,CAAC,MAAiB,EAAsB,EAAE;IACnE,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,SAAS;QAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;YACtC,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,wCAAwC;YACpE,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QACnC,OAAO,eAAe,MAAM,CAAC,IAAI,2GAA2G,CAAC;IAC/I,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,OAAO,eAAe,MAAM,CAAC,IAAI,iEAAiE,CAAC;IACrG,QAAQ,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC7B,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;gBACxE,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,oFAAoF;gBAChH,CAAC,CAAC,SAAS,CAAC;QAChB,KAAK,MAAM;YACT,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC/B,OAAO,eAAe,MAAM,CAAC,IAAI,qIAAqI,CAAC;YACzK,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gBACvC,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,8FAA8F;gBAC1H,CAAC,CAAC,SAAS,CAAC;IAClB,CAAC;AACH,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CACzC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAChG,MAAM,CAAC,UAAU,CACf,CAAC,GAAQ,EAAE,EAAE,CACX,GAAG,CAAC,QAAQ,KAAK,EAAE;IACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;IACnB,GAAG,CAAC,MAAM,KAAK,EAAE;IACjB,GAAG,CAAC,IAAI,KAAK,EAAE;IACf,GAAG,CAAC,QAAQ,KAAK,GAAG,EACtB,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAC1F,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,MAAM,CAAC,KAAK,CACxD,wCAAwC,CACzC,CAAC;IACA,QAAQ,EAAE,qBAAqB;IAC/B,SAAS,EAAE,uBAAuB;CACnC,CAAC;CAAG;AAEL,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,CACvC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAClF,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAC3C,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,KAAK,CAChD,gCAAgC,CACjC,CAAC;IACA,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IAClC,qBAAqB,EAAE,qBAAqB;IAC5C,SAAS,EAAE,QAAQ;IACnB,iBAAiB,EAAE,uBAAuB;IAC1C,qBAAqB,EAAE,uBAAuB;IAC9C,KAAK,EAAE,mBAAmB;IAC1B,YAAY,EAAE,sBAAsB,CAAC,IAAI,CACvC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAC5D;IACD,YAAY,EAAE,MAAM,CAAC,KAAK,CACxB,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAC/E;SACE,KAAK,CAAC,eAAe,CAAC;SACtB,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;CAC3D,CAAC;CAAG;AAEL,uDAAuD;AACvD,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAG7F,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,KAAK,CAAW,wBAAwB,CAAC,CAAC;IAC7E,8DAA8D;IAC9D,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,oFAAoF;IACpF,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,4EAA4E;IAC5E,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC;IAC5D,gGAAgG;IAChG,gBAAgB,EAAE,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC;IAC3D,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC;IAClD,iGAAiG;IACjG,YAAY,EAAE,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC;CACnD,CAAC;CAAG;AAEL,uGAAuG;AACvG,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9C,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;IACrD,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CACvF,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAC/C;CACF,CAAC,CAAC;AAIH,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CACxC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE;IACrF,OAAO,EAAE,+BAA+B;CACzC,CAAC,EACF,MAAM,CAAC,UAAU,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE;IAC/F,OAAO,EACL,4GAA4G;CAC/G,CAAC,CACH,CAAC;AAEF,6CAA6C;AAC7C,MAAM,OAAO,OAAQ,SAAQ,MAAM,CAAC,KAAK,CAAU,uBAAuB,CAAC,CAAC;IAC1E;;;OAGG;IACH,OAAO,EAAE,OAAO;IAChB,oEAAoE;IACpE,WAAW,EAAE,cAAc,CAAC,mCAAmC,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CACvD;CACF,CAAC;CAAG;AAEL,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CACpC,MAAM,CAAC,UAAU,CAAC;IAChB,YAAY,EAAE,eAAe;IAC7B,WAAW,EAAE,cAAc;IAC3B,iBAAiB,EAAE,qBAAqB;IACxC,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,cAAc;IAC3B,YAAY,EAAE,eAAe;CAC9B,CAAC,CACH,CAAC;AAEF,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC;IAClC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACzF,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC1F,SAAS,CAAC,IAAI,CACZ,MAAM,CAAC,UAAU,CAAC;QAChB,qBAAqB,EAAE,yBAAyB;QAChD,YAAY,EAAE,eAAe;KAC9B,CAAC,CACH,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAiB,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IACrF,gBAAgB,CAAC,IAAI,CACnB,MAAM,CAAC,UAAU,CAAC;QAChB,qBAAqB,EAAE,yBAAyB;QAChD,SAAS,EAAE,YAAY;QACvB,iBAAiB,EAAE,sBAAsB;QACzC,qBAAqB,EAAE,0BAA0B;QACjD,YAAY,EAAE,eAAe;QAC7B,YAAY,EAAE,eAAe;KAC9B,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAClD,qBAAqB,CAAC,CAAC,IAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CACxD,CAAC;AAEF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;AAErF,gCAAgC;AAChC,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,KAAK,CAAc,2BAA2B,CAAC,CAAC;IACtF,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAClF,OAAO,EAAE,OAAO,CAAC,IAAI,CACnB,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAClF;IACD,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACvF,QAAQ,EAAE,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC,qBAAqB,CACnC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC,CACtF;CACF,CAAC;CAAG"}