@usine/executor 0.2.1 → 0.4.0

package/dist/ssh/provisioner/hetzner.d.ts

@@ -0,0 +1,32 @@
+import { type WorkerName } from "@usine/core/worker";
+import { Effect, Option } from "effect";
+import { MachineUnavailableError, WorkerCapabilityError } from "../../executor.ts";
+import type { HetznerProvisioner } from "../model.ts";
+import { type ListedMachine, type MachineTags, ProviderApiError } from "./model.ts";
+/** The Hetzner Cloud API. */
+export declare const HETZNER_API = "https://api.hetzner.cloud/v1";
+/**
+ * Returns the Hetzner Cloud driver for `worker`'s servers (#550). Each server is created from
+ * `settings.image` with the project's SSH key, and labeled with the instance, Worker, Run,
+ * creating process, and Attempt. With `privateOnly`, a server gets no public address and is
+ * reached at its address on `settings.network`, through the Gateway.
+ */
+export declare const hetznerDriverFor: (worker: WorkerName, settings: HetznerProvisioner, privateOnly: boolean, base?: string) => Effect.Effect<{
+    provider: "hetzner";
+    verify: (_worker: string & import("effect/Brand").Brand<"WorkerName">, maxConcurrentAttempts: number) => Effect.Effect<{
+        warnings: string[];
+    }, WorkerCapabilityError, never>;
+    create: (_name: string, _tags: MachineTags) => Effect.Effect<{
+        id: string & import("effect/Brand").Brand<"MachineId">;
+        hostKey: Option.Option<string>;
+    }, MachineUnavailableError, never>;
+    endpoint: (id: string & import("effect/Brand").Brand<"MachineId">, interval: Effect.Effect<void, never, never>) => Effect.Effect<{
+        destination: string & import("effect/Brand").Brand<"SshDestination">;
+        port: Option.Option<never>;
+        hostKey: Option.Option<never>;
+    }, MachineUnavailableError, never>;
+    tag: (id: string & import("effect/Brand").Brand<"MachineId">, tags: MachineTags) => Effect.Effect<void, ProviderApiError, never>;
+    remove: (id: string & import("effect/Brand").Brand<"MachineId">) => Effect.Effect<void, ProviderApiError, never>;
+    list: (instance: string, listed: string & import("effect/Brand").Brand<"WorkerName">) => Effect.Effect<ListedMachine[], ProviderApiError, never>;
+}, never, import("effect/http/HttpClient").HttpClient>;
+//# sourceMappingURL=hetzner.d.ts.map

package/dist/ssh/provisioner/hetzner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hetzner.d.ts","sourceRoot":"","sources":["../../../src/ssh/provisioner/hetzner.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAY,MAAM,EAAE,MAAM,EAAoB,MAAM,QAAQ,CAAC;AACpE,OAAO,EACL,uBAAuB,EAEvB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQtD,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,WAAW,EAChB,gBAAgB,EAEjB,MAAM,YAAY,CAAC;AAEpB,6BAA6B;AAC7B,eAAO,MAAM,WAAW,iCAAiC,CAAC;AAmG1D;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,WACnB,UAAU,YACR,kBAAkB,eACf,OAAO,SACd,MAAM;;;;;;;;;;;;;;;;;sDAqWV,CAAC"}

package/dist/ssh/provisioner/hetzner.js

@@ -0,0 +1,337 @@
+import { MachineId, SshDestination } from "@usine/core/worker";
+import { DateTime, Effect, Option, Redacted, Schema } from "effect";
+import { MachineUnavailableError, WorkerCapabilityError, } from "../../executor.js";
+import { generateHostKey } from "./host-key.js";
+import { failureText, providerApiFor, } from "./http.js";
+import { attemptTag, ProviderApiError, tagValue, } from "./model.js";
+/** The Hetzner Cloud API. */
+export const HETZNER_API = "https://api.hetzner.cloud/v1";
+const LABELS = {
+    instance: "usine-instance",
+    worker: "usine-worker",
+    run: "usine-run",
+    process: "usine-process",
+    attempt: "usine-attempt",
+};
+/**
+ * Returns the cloud-init user data that replaces the image's SSH host keys with `hostKey` at the
+ * server's first boot, so the executor knows the key before it connects. cloud-init runs it on a
+ * server created from a snapshot too, because the new server has a new instance ID.
+ */
+const hostKeyUserData = (hostKey) => [
+    "#cloud-config",
+    "ssh_deletekeys: true",
+    "ssh_genkeytypes: []",
+    "ssh_keys:",
+    "  ed25519_private: |",
+    ...Redacted.value(hostKey.privateKey)
+        .trimEnd()
+        .split("\n")
+        .map((line) => `    ${line}`),
+    `  ed25519_public: ${hostKey.publicKey}`,
+    "",
+].join("\n");
+const Pagination = Schema.Struct({
+    meta: Schema.optionalKey(Schema.Struct({
+        pagination: Schema.Struct({ next_page: Schema.NullOr(Schema.Int) }),
+    })),
+});
+const Named = Schema.Struct({ id: Schema.Int, name: Schema.NullOr(Schema.String) });
+const SshKeys = Schema.Struct({ ssh_keys: Schema.Array(Named) });
+const Networks = Schema.Struct({ networks: Schema.Array(Named) });
+const Firewalls = Schema.Struct({ firewalls: Schema.Array(Named) });
+const ServerTypes = Schema.Struct({
+    server_types: Schema.Array(Schema.Struct({
+        name: Schema.String,
+        locations: Schema.optionalKey(Schema.Array(Schema.Struct({
+            name: Schema.String,
+            available: Schema.optionalKey(Schema.Boolean),
+        }))),
+    })),
+});
+const Image = Schema.Struct({
+    id: Schema.Int,
+    type: Schema.String,
+    status: Schema.String,
+    description: Schema.optionalKey(Schema.NullOr(Schema.String)),
+    created: Schema.optionalKey(Schema.String),
+});
+const Images = Schema.Struct({ images: Schema.Array(Image) });
+const Server = Schema.Struct({
+    id: Schema.Int,
+    status: Schema.String,
+    created: Schema.String,
+    labels: Schema.Record(Schema.String, Schema.String),
+    public_net: Schema.optionalKey(Schema.Struct({
+        ipv4: Schema.optionalKey(Schema.NullOr(Schema.Struct({ ip: Schema.String }))),
+    })),
+    private_net: Schema.optionalKey(Schema.Array(Schema.Struct({ network: Schema.Int, ip: Schema.String }))),
+});
+const Created = Schema.Struct({ server: Server });
+const OneServer = Schema.Struct({ server: Server });
+const Servers = Schema.Struct({ servers: Schema.Array(Server) });
+/** Returns the reason a creation failure is retried, by Hetzner's documented error codes. */
+const creationReason = (failure) => {
+    if (failure._tag === "ProviderUnanswered")
+        return "unreachable";
+    const code = Option.getOrElse(failure.code, () => "");
+    if (code === "resource_unavailable" || code === "unavailable" || code === "placement_error")
+        return "capacity";
+    if (code === "resource_limit_exceeded")
+        return "quota";
+    if (failure.status === 401 || failure.status === 403 || failure.status === 422)
+        return "refused";
+    return "provider";
+};
+/**
+ * Returns the Hetzner Cloud driver for `worker`'s servers (#550). Each server is created from
+ * `settings.image` with the project's SSH key, and labeled with the instance, Worker, Run,
+ * creating process, and Attempt. With `privateOnly`, a server gets no public address and is
+ * reached at its address on `settings.network`, through the Gateway.
+ */
+export const hetznerDriverFor = (worker, settings, privateOnly, base = HETZNER_API) => Effect.gen(function* () {
+    const api = yield* providerApiFor("hetzner", base, settings.token);
+    const apiError = (operation) => (failure) => new ProviderApiError({
+        provider: "hetzner",
+        operation,
+        status: failure._tag === "ProviderRefused" ? Option.some(failure.status) : Option.none(),
+        message: `Hetzner Cloud couldn't ${operation}: ${failureText(failure)}`,
+    });
+    const providerGap = (message, cause) => new WorkerCapabilityError({ worker, capability: "provider", message, cause });
+    /** Returns every page of a listing at `path`. */
+    const listAll = (path, query, schema, operation) => Effect.gen(function* () {
+        const pages = [];
+        let page = 1;
+        while (page !== null) {
+            const response = yield* api.send("GET", path, {
+                query: { ...query, page: String(page), per_page: "50" },
+            });
+            pages.push(yield* api.decode(schema, operation)(response));
+            const meta = yield* api.decode(Pagination, operation)(response);
+            page = meta.meta?.pagination.next_page ?? null;
+        }
+        return pages;
+    });
+    /** Returns the ID of `settings.image`: a numeric ID, a system image name, or the newest snapshot with that description. */
+    const imageId = Effect.fn("HetznerDriver.imageId")(function* () {
+        const image = settings.image;
+        if (/^[0-9]+$/u.test(image)) {
+            const response = yield* api.send("GET", `/images/${image}`);
+            return (yield* api.decode(Schema.Struct({ image: Image }), "read the image")(response))
+                .image.id;
+        }
+        const named = yield* listAll("/images", { name: image }, Images, "list images");
+        const system = named.flatMap(({ images }) => images)[0];
+        if (system !== undefined)
+            return system.id;
+        const snapshots = (yield* listAll("/images", { type: "snapshot", status: "available" }, Images, "list snapshots"))
+            .flatMap(({ images }) => images)
+            .filter(({ description }) => description === image)
+            .sort((left, right) => (right.created ?? "").localeCompare(left.created ?? ""));
+        const newest = snapshots[0];
+        if (newest === undefined)
+            return yield* providerGap(`Hetzner Cloud has no snapshot or image "${image}" for worker "${worker}". Build one with infra/hetzner/snapshot.sh, or set provisioner.image to an existing one.`, new Error(`no image ${image}`));
+        return newest.id;
+    });
+    /** Returns the ID of the project's SSH key, network, or firewall named `name`. */
+    const named = Effect.fn("HetznerDriver.named")(function* (resource, name) {
+        const response = yield* api.send("GET", `/${resource}`, { query: { name } });
+        const operation = `list ${resource}`;
+        const listed = resource === "ssh_keys"
+            ? (yield* api.decode(SshKeys, operation)(response)).ssh_keys
+            : resource === "networks"
+                ? (yield* api.decode(Networks, operation)(response)).networks
+                : (yield* api.decode(Firewalls, operation)(response)).firewalls;
+        return Option.fromNullishOr(listed[0]?.id);
+    });
+    const labelsOf = (tags) => ({
+        ...settings.labels,
+        [LABELS.instance]: tagValue(tags.instance),
+        [LABELS.worker]: tagValue(tags.worker),
+        [LABELS.run]: tagValue(tags.run),
+        [LABELS.process]: tagValue(tags.process),
+        ...Option.match(tags.attempt, {
+            onNone: () => ({}),
+            onSome: (attempt) => ({ [LABELS.attempt]: attemptTag(attempt) }),
+        }),
+    });
+    const verify = Effect.fn("HetznerDriver.verify")(function* (_worker, maxConcurrentAttempts) {
+        yield* Effect.annotateCurrentSpan({ worker, maxConcurrentAttempts });
+        const types = yield* api
+            .send("GET", "/server_types", { query: { name: settings.serverType } })
+            .pipe(Effect.flatMap(api.decode(ServerTypes, "list server types")));
+        const serverType = types.server_types[0];
+        if (serverType === undefined)
+            return yield* providerGap(`Hetzner Cloud has no server type "${settings.serverType}" for worker "${worker}"`, new Error(`no server type ${settings.serverType}`));
+        const location = serverType.locations?.find(({ name }) => name === settings.location);
+        if (serverType.locations !== undefined && location === undefined)
+            return yield* providerGap(`Hetzner Cloud doesn't offer server type ${settings.serverType} in ${settings.location} for worker "${worker}"`, new Error(`no location ${settings.location} for ${settings.serverType}`));
+        const image = yield* imageId();
+        const key = yield* named("ssh_keys", settings.sshKey);
+        if (Option.isNone(key))
+            return yield* providerGap(`The Hetzner Cloud project of worker "${worker}" has no SSH key named "${settings.sshKey}". Add the public key of identity_file with hcloud ssh-key create.`, new Error(`no SSH key ${settings.sshKey}`));
+        if (Option.isSome(settings.network)) {
+            const network = yield* named("networks", settings.network.value);
+            if (Option.isNone(network))
+                return yield* providerGap(`The Hetzner Cloud project of worker "${worker}" has no network named "${settings.network.value}"`, new Error(`no network ${settings.network.value}`));
+        }
+        if (Option.isSome(settings.firewall)) {
+            const firewall = yield* named("firewalls", settings.firewall.value);
+            if (Option.isNone(firewall))
+                return yield* providerGap(`The Hetzner Cloud project of worker "${worker}" has no firewall named "${settings.firewall.value}"`, new Error(`no firewall ${settings.firewall.value}`));
+        }
+        const warnings = location?.available === false
+            ? [
+                `Hetzner Cloud has no ${settings.serverType} available in ${settings.location} now, so machines can't be created until it has. Each attempt waits and tries again.`,
+            ]
+            : [];
+        yield* Effect.logInfo("Hetzner Cloud provisioner verified", {
+            worker,
+            serverType: settings.serverType,
+            location: settings.location,
+            available: location?.available ?? "not reported",
+            image,
+            network: Option.getOrElse(settings.network, () => "none"),
+            // The API documents no endpoint for the project's server limit.
+            limits: "not documented",
+        });
+        return { warnings };
+    }, (effect) => effect.pipe(Effect.catchTags({
+        ProviderUnanswered: (failure) => Effect.fail(providerGap(`Can't reach the Hetzner Cloud API for worker "${worker}": ${failure.detail}`, failure)),
+        ProviderRefused: (failure) => Effect.fail(providerGap(failure.status === 401
+            ? `Hetzner Cloud refused the token of worker "${worker}". Create a read and write API token for the project, and set it in provisioner.token_env.`
+            : `Hetzner Cloud refused a preflight request of worker "${worker}": ${failureText(failure)}`, failure)),
+    })));
+    const create = Effect.fn("HetznerDriver.create")(function* (name, tags) {
+        yield* Effect.annotateCurrentSpan({ worker, name, run: tags.run });
+        const image = yield* imageId().pipe(Effect.catchTag("WorkerCapabilityError", (gap) => Effect.fail(new MachineUnavailableError({
+            worker,
+            provider: "hetzner",
+            reason: "refused",
+            message: gap.message,
+        }))));
+        const key = yield* named("ssh_keys", settings.sshKey);
+        const network = Option.isSome(settings.network)
+            ? yield* named("networks", settings.network.value)
+            : Option.none();
+        const firewall = Option.isSome(settings.firewall)
+            ? yield* named("firewalls", settings.firewall.value)
+            : Option.none();
+        const hostKey = yield* generateHostKey;
+        const response = yield* api.send("POST", "/servers", {
+            body: {
+                name,
+                server_type: settings.serverType,
+                location: settings.location,
+                image: String(image),
+                ssh_keys: Option.match(key, {
+                    onNone: () => [settings.sshKey],
+                    onSome: (id) => [String(id)],
+                }),
+                networks: Option.match(network, { onNone: () => [], onSome: (id) => [id] }),
+                firewalls: Option.match(firewall, {
+                    onNone: () => [],
+                    onSome: (id) => [{ firewall: id }],
+                }),
+                public_net: { enable_ipv4: !privateOnly, enable_ipv6: false },
+                labels: labelsOf(tags),
+                user_data: hostKeyUserData(hostKey),
+                start_after_create: true,
+            },
+        });
+        const created = yield* api.decode(Created, "create a server")(response);
+        return {
+            id: MachineId.make(String(created.server.id)),
+            hostKey: Option.some(hostKey.publicKey),
+        };
+    }, (effect, _name, _tags) => effect.pipe(Effect.catchTags({
+        ProviderUnanswered: (failure) => Effect.fail(new MachineUnavailableError({
+            worker,
+            provider: "hetzner",
+            reason: "unreachable",
+            message: `Can't reach the Hetzner Cloud API to create a server: ${failure.detail}`,
+        })),
+        ProviderRefused: (failure) => Effect.fail(new MachineUnavailableError({
+            worker,
+            provider: "hetzner",
+            reason: creationReason(failure),
+            message: `Hetzner Cloud didn't create a ${settings.serverType} server in ${settings.location}: ${failureText(failure)}`,
+        })),
+    })));
+    /** Returns the address to connect to: the private one behind a Gateway, else the public IPv4. */
+    const addressOf = (server) => Option.fromNullishOr(privateOnly ? server.private_net?.[0]?.ip : server.public_net?.ipv4?.ip);
+    const endpoint = Effect.fn("HetznerDriver.endpoint")(function* (id, interval) {
+        yield* Effect.annotateCurrentSpan({ worker, machine: id });
+        while (true) {
+            const server = (yield* api
+                .send("GET", `/servers/${id}`)
+                .pipe(Effect.flatMap(api.decode(OneServer, "read the server")))).server;
+            const address = addressOf(server);
+            if (server.status === "running" && Option.isSome(address))
+                return {
+                    destination: SshDestination.make(`${settings.sshUser}@${address.value}`),
+                    port: Option.none(),
+                    hostKey: Option.none(),
+                };
+            yield* Effect.logDebug("Waiting for the Hetzner Cloud server to run", {
+                worker,
+                machine: id,
+                status: server.status,
+            });
+            yield* interval;
+        }
+    }, (effect) => effect.pipe(Effect.catchTags({
+        ProviderUnanswered: (failure) => Effect.fail(new MachineUnavailableError({
+            worker,
+            provider: "hetzner",
+            reason: "unreachable",
+            message: `Can't reach the Hetzner Cloud API to read a new server: ${failure.detail}`,
+        })),
+        ProviderRefused: (failure) => Effect.fail(new MachineUnavailableError({
+            worker,
+            provider: "hetzner",
+            reason: failure.status === 404 ? "capacity" : creationReason(failure),
+            message: failure.status === 404
+                ? "Hetzner Cloud removed the new server before it ran"
+                : `Hetzner Cloud couldn't read the new server: ${failureText(failure)}`,
+        })),
+    })));
+    const tag = Effect.fn("HetznerDriver.tag")(function* (id, tags) {
+        yield* Effect.annotateCurrentSpan({ worker, machine: id });
+        yield* api
+            .send("PUT", `/servers/${id}`, { body: { labels: labelsOf(tags) } })
+            .pipe(Effect.mapError(apiError("label the server")));
+    });
+    const remove = Effect.fn("HetznerDriver.remove")(function* (id) {
+        yield* Effect.annotateCurrentSpan({ worker, machine: id });
+        yield* api.send("DELETE", `/servers/${id}`).pipe(Effect.asVoid, Effect.catchIf((failure) => failure._tag === "ProviderRefused" && failure.status === 404, () => Effect.void), Effect.mapError(apiError("delete the server")));
+    });
+    const list = Effect.fn("HetznerDriver.list")(function* (instance, listed) {
+        yield* Effect.annotateCurrentSpan({ worker: listed });
+        const pages = yield* listAll("/servers", {
+            label_selector: `${LABELS.instance}=${tagValue(instance)},${LABELS.worker}=${tagValue(listed)}`,
+        }, Servers, "list servers").pipe(Effect.mapError(apiError("list the servers")));
+        return pages
+            .flatMap(({ servers }) => servers)
+            .map((server) => ({
+            id: MachineId.make(String(server.id)),
+            tags: {
+                worker: server.labels[LABELS.worker] ?? "",
+                run: server.labels[LABELS.run] ?? "",
+                process: server.labels[LABELS.process] ?? "",
+                attempt: Option.fromNullishOr(server.labels[LABELS.attempt]),
+            },
+            createdAt: Option.getOrElse(DateTime.make(server.created), () => DateTime.makeUnsafe(0)),
+        }));
+    });
+    return {
+        provider: "hetzner",
+        verify,
+        create,
+        endpoint,
+        tag,
+        remove,
+        list,
+    };
+});
+//# sourceMappingURL=hetzner.js.map

package/dist/ssh/provisioner/hetzner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hetzner.js","sourceRoot":"","sources":["../../../src/ssh/provisioner/hetzner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAmB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpE,OAAO,EACL,uBAAuB,EAEvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,eAAe,EAAoB,MAAM,eAAe,CAAC;AAClE,OAAO,EACL,WAAW,EAGX,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,UAAU,EAIV,gBAAgB,EAChB,QAAQ,GACT,MAAM,YAAY,CAAC;AAEpB,6BAA6B;AAC7B,MAAM,CAAC,MAAM,WAAW,GAAG,8BAA8B,CAAC;AAE1D,MAAM,MAAM,GAAG;IACb,QAAQ,EAAE,gBAAgB;IAC1B,MAAM,EAAE,cAAc;IACtB,GAAG,EAAE,WAAW;IAChB,OAAO,EAAE,eAAe;IACxB,OAAO,EAAE,eAAe;CAChB,CAAC;AAEX;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,OAAoB,EAAU,EAAE,CACvD;IACE,eAAe;IACf,sBAAsB;IACtB,qBAAqB;IACrB,WAAW;IACX,sBAAsB;IACtB,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;SAClC,OAAO,EAAE;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/B,qBAAqB,OAAO,CAAC,SAAS,EAAE;IACxC,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEf,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC,WAAW,CACtB,MAAM,CAAC,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;KACpE,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACpF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAClE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAEpE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC,KAAK,CACxB,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,SAAS,EAAE,MAAM,CAAC,WAAW,CAC3B,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC,MAAM;YACnB,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;SAC9C,CAAC,CACH,CACF;KACF,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1B,EAAE,EAAE,MAAM,CAAC,GAAG;IACd,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE9D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC,GAAG;IACd,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC,WAAW,CAC5B,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;KAC9E,CAAC,CACH;IACD,WAAW,EAAE,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CACxE;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACpD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,cAAc,GAAG,CAAC,OAAwB,EAA4B,EAAE;IAC5E,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,aAAa,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,iBAAiB;QACzF,OAAO,UAAU,CAAC;IACpB,IAAI,IAAI,KAAK,yBAAyB;QAAE,OAAO,OAAO,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IACjG,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAkB,EAClB,QAA4B,EAC5B,WAAoB,EACpB,IAAI,GAAW,WAAW,EAC1B,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAC,OAAwB,EAAE,EAAE,CACnE,IAAI,gBAAgB,CAAC;QACnB,QAAQ,EAAE,SAAS;QACnB,SAAS;QACT,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACxF,OAAO,EAAE,0BAA0B,SAAS,KAAK,WAAW,CAAC,OAAO,CAAC,EAAE;KACxE,CAAC,CAAC;IAEL,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,KAAc,EAAE,EAAE,CACtD,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhF,iDAAiD;IACjD,MAAM,OAAO,GAAG,CACd,IAAY,EACZ,KAAuC,EACvC,MAAS,EACT,SAAiB,EACjB,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,KAAK,GAAqB,EAAE,CAAC;QACnC,IAAI,IAAI,GAAkB,CAAC,CAAC;QAC5B,OAAO,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAqB,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC9D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;aACxD,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3D,MAAM,IAAI,GAA2B,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC;YACxF,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,IAAI,IAAI,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEL,2HAA2H;IAC3H,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC;QAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC7B,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC;iBACpF,KAAK,CAAC,EAAE,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAC/B,SAAS,EACT,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,EACzC,MAAM,EACN,gBAAgB,CACjB,CAAC;aACC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;aAC/B,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC;aAClD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS;YACtB,OAAO,KAAK,CAAC,CAAC,WAAW,CACvB,2CAA2C,KAAK,iBAAiB,MAAM,2FAA2F,EAClK,IAAI,KAAK,CAAC,YAAY,KAAK,EAAE,CAAC,CAC/B,CAAC;QACJ,OAAO,MAAM,CAAC,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,kFAAkF;IAClF,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EACtD,QAA+C,EAC/C,IAAY;QAEZ,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,QAAQ,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GACV,QAAQ,KAAK,UAAU;YACrB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC5D,CAAC,CAAC,QAAQ,KAAK,UAAU;gBACvB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBAC7D,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,IAAiB,EAAE,EAAE,CAAC,CAAC;QACvC,GAAG,QAAQ,CAAC,MAAM;QAClB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1C,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QACtC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;YAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;SACjE,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAC9C,QAAQ,CAAC,EAAE,OAAmB,EAAE,qBAA6B;QAC3D,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG;aACrB,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC;aACtE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,UAAU,KAAK,SAAS;YAC1B,OAAO,KAAK,CAAC,CAAC,WAAW,CACvB,qCAAqC,QAAQ,CAAC,UAAU,iBAAiB,MAAM,GAAG,EAClF,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,UAAU,EAAE,CAAC,CACnD,CAAC;QACJ,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtF,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAC9D,OAAO,KAAK,CAAC,CAAC,WAAW,CACvB,2CAA2C,QAAQ,CAAC,UAAU,OAAO,QAAQ,CAAC,QAAQ,gBAAgB,MAAM,GAAG,EAC/G,IAAI,KAAK,CAAC,eAAe,QAAQ,CAAC,QAAQ,QAAQ,QAAQ,CAAC,UAAU,EAAE,CAAC,CACzE,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YACpB,OAAO,KAAK,CAAC,CAAC,WAAW,CACvB,wCAAwC,MAAM,2BAA2B,QAAQ,CAAC,MAAM,oEAAoE,EAC5J,IAAI,KAAK,CAAC,cAAc,QAAQ,CAAC,MAAM,EAAE,CAAC,CAC3C,CAAC;QACJ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBACxB,OAAO,KAAK,CAAC,CAAC,WAAW,CACvB,wCAAwC,MAAM,2BAA2B,QAAQ,CAAC,OAAO,CAAC,KAAK,GAAG,EAClG,IAAI,KAAK,CAAC,cAAc,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAClD,CAAC;QACN,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACzB,OAAO,KAAK,CAAC,CAAC,WAAW,CACvB,wCAAwC,MAAM,4BAA4B,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,EACpG,IAAI,KAAK,CAAC,eAAe,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CACpD,CAAC;QACN,CAAC;QACD,MAAM,QAAQ,GACZ,QAAQ,EAAE,SAAS,KAAK,KAAK;YAC3B,CAAC,CAAC;gBACE,wBAAwB,QAAQ,CAAC,UAAU,iBAAiB,QAAQ,CAAC,QAAQ,sFAAsF;aACpK;YACH,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,oCAAoC,EAAE;YAC1D,MAAM;YACN,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,cAAc;YAChD,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;YACzD,gEAAgE;YAChE,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC,EACD,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,SAAS,CAAC;QACf,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9B,MAAM,CAAC,IAAI,CACT,WAAW,CACT,iDAAiD,MAAM,MAAM,OAAO,CAAC,MAAM,EAAE,EAC7E,OAAO,CACR,CACF;QACH,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3B,MAAM,CAAC,IAAI,CACT,WAAW,CACT,OAAO,CAAC,MAAM,KAAK,GAAG;YACpB,CAAC,CAAC,8CAA8C,MAAM,4FAA4F;YAClJ,CAAC,CAAC,wDAAwD,MAAM,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAC9F,OAAO,CACR,CACF;KACJ,CAAC,CACH,CACJ,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAC9C,QAAQ,CAAC,EAAE,IAAY,EAAE,IAAiB;QACxC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CACjC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,EAAE,CAC/C,MAAM,CAAC,IAAI,CACT,IAAI,uBAAuB,CAAC;YAC1B,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CACH,CACF,CACF,CAAC;QACF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC,MAAM,CAAC,IAAI,EAAU,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,IAAI,EAAU,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE;YACnD,IAAI,EAAE;gBACJ,IAAI;gBACJ,WAAW,EAAE,QAAQ,CAAC,UAAU;gBAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;gBACpB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC1B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC/B,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;iBAC7B,CAAC;gBACF,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3E,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;oBAChC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;oBAChB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;iBACnC,CAAC;gBACF,UAAU,EAAE,EAAE,WAAW,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE;gBAC7D,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACtB,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC;gBACnC,kBAAkB,EAAE,IAAI;aACzB;SACF,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxE,OAAO;YACL,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;SACxC,CAAC;IACJ,CAAC,EACD,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACvB,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,SAAS,CAAC;QACf,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9B,MAAM,CAAC,IAAI,CACT,IAAI,uBAAuB,CAAC;YAC1B,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,yDAAyD,OAAO,CAAC,MAAM,EAAE;SACnF,CAAC,CACH;QACH,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3B,MAAM,CAAC,IAAI,CACT,IAAI,uBAAuB,CAAC;YAC1B,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC;YAC/B,OAAO,EAAE,iCAAiC,QAAQ,CAAC,UAAU,cAAc,QAAQ,CAAC,QAAQ,KAAK,WAAW,CAAC,OAAO,CAAC,EAAE;SACxH,CAAC,CACH;KACJ,CAAC,CACH,CACJ,CAAC;IAEF,iGAAiG;IACjG,MAAM,SAAS,GAAG,CAAC,MAA0B,EAAyB,EAAE,CACtE,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAEhG,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAClD,QAAQ,CAAC,EAAE,EAAa,EAAE,QAA6B;QACrD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG;iBACvB,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;iBAC7B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1E,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBACvD,OAAO;oBACL,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBACxE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;oBACnB,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;iBACvB,CAAC;YACJ,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,6CAA6C,EAAE;gBACpE,MAAM;gBACN,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,KAAK,CAAC,CAAC,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC,EACD,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,SAAS,CAAC;QACf,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9B,MAAM,CAAC,IAAI,CACT,IAAI,uBAAuB,CAAC;YAC1B,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,2DAA2D,OAAO,CAAC,MAAM,EAAE;SACrF,CAAC,CACH;QACH,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3B,MAAM,CAAC,IAAI,CACT,IAAI,uBAAuB,CAAC;YAC1B,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC;YACrE,OAAO,EACL,OAAO,CAAC,MAAM,KAAK,GAAG;gBACpB,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,+CAA+C,WAAW,CAAC,OAAO,CAAC,EAAE;SAC5E,CAAC,CACH;KACJ,CAAC,CACH,CACJ,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAa,EAAE,IAAiB;QACpF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,KAAK,CAAC,CAAC,GAAG;aACP,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;aACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAa;QACvE,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,CACZ,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EACzE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAClB,EACD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAgB,EAAE,MAAkB;QAC1F,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAC1B,UAAU,EACV;YACE,cAAc,EAAE,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE;SAChG,EACD,OAAO,EACP,cAAc,CACf,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,KAAK;aACT,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC;aACjC,GAAG,CAAC,CAAC,MAAM,EAAiB,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE;gBACJ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC1C,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE;gBACpC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC5C,OAAO,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;aAC7D;YACD,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;SACzF,CAAC,CAAC,CAAC;IACR,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,MAAM;QACN,MAAM;QACN,QAAQ;QACR,GAAG;QACH,MAAM;QACN,IAAI;KACmB,CAAC;AAC5B,CAAC,CAAC,CAAC"}

package/dist/ssh/provisioner/host-key.d.ts

@@ -0,0 +1,11 @@
+import { Effect, Redacted } from "effect";
+/** A machine's SSH host key pair, which the executor generates before it creates the machine. */
+export interface HostKeyPair {
+    /** The public key as `known_hosts` writes it: `ssh-ed25519 <base64>`. */
+    readonly publicKey: string;
+    /** The private key as an unencrypted OpenSSH key file, which sshd reads. */
+    readonly privateKey: Redacted.Redacted<string>;
+}
+/** Generates an Ed25519 host key pair for a new machine. */
+export declare const generateHostKey: Effect.Effect<HostKeyPair>;
+//# sourceMappingURL=host-key.d.ts.map

package/dist/ssh/provisioner/host-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-key.d.ts","sourceRoot":"","sources":["../../../src/ssh/provisioner/host-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAG1C,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAChD;AAoED,4DAA4D;AAC5D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAqBrD,CAAC"}

package/dist/ssh/provisioner/host-key.js

@@ -0,0 +1,57 @@
+import { Effect, Redacted } from "effect";
+import { Base64 } from "effect/encoding";
+const KEY_TYPE = "ssh-ed25519";
+/** The length of the PKCS #8 header of an Ed25519 private key, which the 32-byte seed follows. */
+const PKCS8_HEADER_LENGTH = 16;
+const encoder = new TextEncoder();
+const concat = (...parts) => {
+    const joined = new Uint8Array(parts.reduce((length, part) => length + part.length, 0));
+    let offset = 0;
+    for (const part of parts) {
+        joined.set(part, offset);
+        offset += part.length;
+    }
+    return joined;
+};
+const uint32 = (value) => {
+    const bytes = new Uint8Array(4);
+    new DataView(bytes.buffer).setUint32(0, value);
+    return bytes;
+};
+/** The SSH wire format's `string`: a 32-bit length, then the bytes. */
+const sshBytes = (bytes) => concat(uint32(bytes.length), bytes);
+/** The SSH wire format's `string` of `text`'s UTF-8 bytes. */
+const sshText = (text) => sshBytes(encoder.encode(text));
+/** The magic that starts an OpenSSH private key: `openssh-key-v1` and a zero byte. */
+const MAGIC = concat(encoder.encode("openssh-key-v1"), new Uint8Array(1));
+/**
+ * Returns the unencrypted OpenSSH key file of an Ed25519 key, in the format of `PROTOCOL.key`
+ * in OpenSSH's sources. `check` is the random 32-bit value that the format writes twice.
+ */
+const openSshKeyFile = (seed, publicKey, check) => {
+    const unpadded = concat(check, check, sshText(KEY_TYPE), sshBytes(publicKey), sshBytes(concat(seed, publicKey)), sshText(""));
+    const padding = Uint8Array.from({ length: (8 - (unpadded.length % 8)) % 8 }, (_, index) => index + 1);
+    const body = concat(MAGIC, sshText("none"), sshText("none"), sshText(""), uint32(1), sshBytes(concat(sshText(KEY_TYPE), sshBytes(publicKey))), sshBytes(concat(unpadded, padding)));
+    return [
+        "-----BEGIN OPENSSH PRIVATE KEY-----",
+        ...(Base64.encode(body).match(/.{1,70}/gu) ?? []),
+        "-----END OPENSSH PRIVATE KEY-----",
+        "",
+    ].join("\n");
+};
+/** Generates an Ed25519 host key pair for a new machine. */
+export const generateHostKey = Effect.gen(function* () {
+    const pair = yield* Effect.promise(() => crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]));
+    if (!("privateKey" in pair))
+        return yield* Effect.die(new Error("WebCrypto returned one Ed25519 key, not a pair"));
+    const publicKey = new Uint8Array(yield* Effect.promise(() => crypto.subtle.exportKey("raw", pair.publicKey)));
+    const pkcs8 = new Uint8Array(yield* Effect.promise(() => crypto.subtle.exportKey("pkcs8", pair.privateKey)));
+    const seed = pkcs8.slice(PKCS8_HEADER_LENGTH);
+    if (publicKey.length !== 32 || seed.length !== 32)
+        return yield* Effect.die(new Error("WebCrypto exported an Ed25519 key of an unexpected size"));
+    return {
+        publicKey: `${KEY_TYPE} ${Base64.encode(concat(sshText(KEY_TYPE), sshBytes(publicKey)))}`,
+        privateKey: Redacted.make(openSshKeyFile(seed, publicKey, crypto.getRandomValues(new Uint8Array(4)))),
+    };
+});
+//# sourceMappingURL=host-key.js.map

package/dist/ssh/provisioner/host-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-key.js","sourceRoot":"","sources":["../../../src/ssh/provisioner/host-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAUzC,MAAM,QAAQ,GAAG,aAAa,CAAC;AAE/B,kGAAkG;AAClG,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,MAAM,GAAG,CAAC,GAAG,KAAgC,EAAc,EAAE;IACjE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAc,EAAE;IAC3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAc,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AAExF,8DAA8D;AAC9D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7E,sFAAsF;AACtF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1E;;;GAGG;AACH,MAAM,cAAc,GAAG,CAAC,IAAgB,EAAE,SAAqB,EAAE,KAAiB,EAAU,EAAE;IAC5F,MAAM,QAAQ,GAAG,MAAM,CACrB,KAAK,EACL,KAAK,EACL,OAAO,CAAC,QAAQ,CAAC,EACjB,QAAQ,CAAC,SAAS,CAAC,EACnB,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EACjC,OAAO,CAAC,EAAE,CAAC,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAC7B,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAC3C,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CACxB,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CACjB,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,EACf,OAAO,CAAC,MAAM,CAAC,EACf,OAAO,CAAC,EAAE,CAAC,EACX,MAAM,CAAC,CAAC,CAAC,EACT,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EACxD,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CACpC,CAAC;IACF,OAAO;QACL,qCAAqC;QACrC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACjD,mCAAmC;QACnC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAA+B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CACtC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CACzE,CAAC;IACF,IAAI,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAI,UAAU,CAC9B,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAC5E,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,UAAU,CAC1B,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAC/E,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAC/C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC,CAAC;IACjG,OAAO;QACL,SAAS,EAAE,GAAG,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QACzF,UAAU,EAAE,QAAQ,CAAC,IAAI,CACvB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3E;KACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/ssh/provisioner/http.d.ts

@@ -0,0 +1,45 @@
+import type { MachineProvider } from "@usine/core/worker";
+import { Effect, Option, type Redacted, Schema } from "effect";
+import { HttpClient } from "effect/http";
+declare const ProviderUnanswered_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ProviderUnanswered";
+} & Readonly<A>;
+/** A provider API request that got no response or an unreadable one. */
+export declare class ProviderUnanswered extends ProviderUnanswered_base<{
+    readonly detail: string;
+}> {
+}
+declare const ProviderRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ProviderRefused";
+} & Readonly<A>;
+/** A provider API response with an error status, with the provider's error code and message. */
+declare class ProviderRefused extends ProviderRefused_base<{
+    readonly status: number;
+    readonly code: Option.Option<string>;
+    readonly message: string;
+}> {
+}
+export type ProviderFailure = ProviderUnanswered | ProviderRefused;
+/** A decoded provider API response. */
+export interface ProviderResponse {
+    readonly status: number;
+    /** The JSON body, or `null` if the response has none. */
+    readonly body: Schema.Json;
+}
+/**
+ * Returns a client for a provider's JSON API at `base` with `token` as its bearer token. Each
+ * request has a timeout, and an error status fails with the provider's code and message. The
+ * token and request body never appear in a failure.
+ */
+export declare const providerApiFor: (provider: MachineProvider, base: string, token: Redacted.Redacted<string>) => Effect.Effect<{
+    readonly send: (method: "DELETE" | "GET" | "PATCH" | "POST" | "PUT", path: string, options?: {
+        readonly body?: unknown;
+        readonly headers?: Readonly<Record<string, string>>;
+        readonly query?: Readonly<Record<string, string>>;
+    } | undefined) => Effect.Effect<ProviderResponse, ProviderRefused | ProviderUnanswered, never>;
+    readonly decode: <S extends Schema.Constraint>(schema: S, operation: string) => (response: ProviderResponse) => Effect.Effect<S["Type"], ProviderUnanswered, S["DecodingServices"]>;
+}, never, HttpClient.HttpClient>;
+/** Returns a failure as an operator-facing clause. */
+export declare const failureText: (failure: ProviderFailure) => string;
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/ssh/provisioner/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/ssh/provisioner/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAQ,MAAM,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,UAAU,EAAsC,MAAM,aAAa,CAAC;;;;AAK7E,wEAAwE;AACxE,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;CAAG;;;;AAEL,gGAAgG;AAChG,cAAM,eAAgB,SAAQ,qBAAoC;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG,eAAe,CAAC;AAEnE,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;CAC5B;AAmCD;;;;GAIG;AACH,eAAO,MAAM,cAAc,aACf,eAAe,QACnB,MAAM,SACL,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;;wBAQV,OAAO;2BACJ,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;yBAClC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;;sBAiDlD,CAAC,SAAS,MAAM,CAAC,UAAU,UAAU,CAAC,aAAa,MAAM,gBAE9C,gBAAgB,KACzB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC;gCAWxE,CAAC;AAEL,sDAAsD;AACtD,eAAO,MAAM,WAAW,YAAa,eAAe,KAAG,MAMzB,CAAC"}

package/dist/ssh/provisioner/http.js

@@ -0,0 +1,72 @@
+import { Data, Effect, Option, Schema } from "effect";
+import { HttpClient, HttpClientError, HttpClientRequest } from "effect/http";
+/** The timeout for one provider API request. */
+const REQUEST_TIMEOUT = "30 seconds";
+/** A provider API request that got no response or an unreadable one. */
+export class ProviderUnanswered extends Data.TaggedError("ProviderUnanswered") {
+}
+/** A provider API response with an error status, with the provider's error code and message. */
+class ProviderRefused extends Data.TaggedError("ProviderRefused") {
+}
+const ErrorFields = Schema.Struct({
+    code: Schema.optionalKey(Schema.String),
+    message: Schema.optionalKey(Schema.String),
+});
+/** Hetzner's error body, `{ error: { code, message } }`. */
+const NestedErrorBody = Schema.Struct({ error: ErrorFields });
+const decodeNestedError = Schema.decodeUnknownOption(NestedErrorBody);
+const decodeFlatError = Schema.decodeUnknownOption(ErrorFields);
+const decodeJson = Schema.decodeEffect(Schema.fromJsonString(Schema.Json));
+/** Returns the code and message of Hetzner's or Boat's error body (Boat's are top-level). */
+const errorOf = (response) => {
+    const fields = Option.orElse(Option.map(decodeNestedError(response.body), ({ error }) => error), () => decodeFlatError(response.body));
+    return {
+        code: Option.flatMap(fields, ({ code }) => Option.fromNullishOr(code)),
+        message: Option.getOrElse(Option.flatMap(fields, ({ message }) => Option.fromNullishOr(message)), () => "no message"),
+    };
+};
+/**
+ * Returns a client for a provider's JSON API at `base` with `token` as its bearer token. Each
+ * request has a timeout, and an error status fails with the provider's code and message. The
+ * token and request body never appear in a failure.
+ */
+export const providerApiFor = (provider, base, token) => Effect.gen(function* () {
+    const http = yield* HttpClient.HttpClient;
+    const send = Effect.fn("ProviderApi.send")(function* (method, path, options = {}) {
+        yield* Effect.annotateCurrentSpan({ provider, method, path });
+        const url = new URL(`${base}${path}`);
+        for (const [key, value] of Object.entries(options.query ?? {}))
+            url.searchParams.set(key, value);
+        const request = HttpClientRequest.make(method)(url).pipe(HttpClientRequest.bearerToken(token), HttpClientRequest.acceptJson, HttpClientRequest.setHeaders(options.headers ?? {}), options.body === undefined
+            ? (unchanged) => unchanged
+            : HttpClientRequest.bodyJsonUnsafe(options.body));
+        const response = yield* http.execute(request).pipe(Effect.timeout(REQUEST_TIMEOUT), Effect.mapError((cause) => HttpClientError.isHttpClientError(cause)
+            ? new ProviderUnanswered({ detail: `no response (${cause.reason._tag})` })
+            : new ProviderUnanswered({ detail: `no response within ${REQUEST_TIMEOUT}` })));
+        const text = yield* response.text.pipe(Effect.mapError(() => new ProviderUnanswered({ detail: "the response body can't be read" })));
+        const body = text === ""
+            ? null
+            : yield* decodeJson(text).pipe(Effect.mapError(() => new ProviderUnanswered({
+                detail: `the response with status ${String(response.status)} isn't JSON`,
+            })));
+        const answer = { status: response.status, body };
+        if (response.status >= 400) {
+            const { code, message } = errorOf(answer);
+            return yield* new ProviderRefused({ status: response.status, code, message });
+        }
+        return answer;
+    });
+    /** Decodes a response body with `schema`; an unexpected shape counts as unanswered. */
+    const decode = (schema, operation) => (response) => Schema.decodeUnknownEffect(schema)(response.body).pipe(Effect.mapError(() => new ProviderUnanswered({
+        detail: `the response to ${operation} doesn't have the documented shape`,
+    })));
+    return { send, decode };
+});
+/** Returns a failure as an operator-facing clause. */
+export const failureText = (failure) => failure._tag === "ProviderUnanswered"
+    ? failure.detail
+    : `status ${String(failure.status)}${Option.match(failure.code, {
+        onNone: () => "",
+        onSome: (code) => ` ${code}`,
+    })}: ${failure.message}`;
+//# sourceMappingURL=http.js.map

package/dist/ssh/provisioner/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/ssh/provisioner/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAiB,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE7E,gDAAgD;AAChD,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,wEAAwE;AACxE,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAE3E;CAAG;AAEL,gGAAgG;AAChG,MAAM,eAAgB,SAAQ,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAI9D;CAAG;AAiBL,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;CAC3C,CAAC,CAAC;AAEH,4DAA4D;AAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AAE9D,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;AACtE,MAAM,eAAe,GAAG,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;AAChE,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAE3E,6FAA6F;AAC7F,MAAM,OAAO,GAAG,CAAC,QAA0B,EAAiB,EAAE;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAClE,GAAG,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,CAAC,SAAS,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EACtE,GAAG,EAAE,CAAC,YAAY,CACnB;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,QAAyB,EACzB,IAAY,EACZ,KAAgC,EAChC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,EAClD,MAAmD,EACnD,IAAY,EACZ,OAAO,GAIH,EAAE;QAEN,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CACtD,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,EACpC,iBAAiB,CAAC,UAAU,EAC5B,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EACnD,OAAO,CAAC,IAAI,KAAK,SAAS;YACxB,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS;YAC1B,CAAC,CAAC,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CACnD,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAC/B,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,eAAe,CAAC,iBAAiB,CAAC,KAAK,CAAC;YACtC,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,gBAAgB,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YAC1E,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,sBAAsB,eAAe,EAAE,EAAE,CAAC,CAChF,CACF,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CACpC,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAC5E,CACF,CAAC;QACF,MAAM,IAAI,GACR,IAAI,KAAK,EAAE;YACT,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAC1B,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CACH,IAAI,kBAAkB,CAAC;gBACrB,MAAM,EAAE,4BAA4B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa;aACzE,CAAC,CACL,CACF,CAAC;QACR,MAAM,MAAM,GAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACnE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,uFAAuF;IACvF,MAAM,MAAM,GACV,CAA8B,MAAS,EAAE,SAAiB,EAAE,EAAE,CAC9D,CACE,QAA0B,EAC2C,EAAE,CACvE,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,QAAQ,CACb,GAAG,EAAE,CACH,IAAI,kBAAkB,CAAC;QACrB,MAAM,EAAE,mBAAmB,SAAS,oCAAoC;KACzE,CAAC,CACL,CACF,CAAC;IAEN,OAAO,EAAE,IAAI,EAAE,MAAM,EAAW,CAAC;AACnC,CAAC,CAAC,CAAC;AAEL,sDAAsD;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAwB,EAAU,EAAE,CAC9D,OAAO,CAAC,IAAI,KAAK,oBAAoB;IACnC,CAAC,CAAC,OAAO,CAAC,MAAM;IAChB,CAAC,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QAC5D,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;QAChB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE;KAC7B,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC"}