@usine/gateway 0.0.0-stage → 0.1.0

package/dist/attachment/attachment.d.ts

@@ -0,0 +1,77 @@
+import { DateTime, Effect, Schema } from "effect";
+/**
+ * The ID of an attachment, unchanged by renewals. A new attach for the same Worker and
+ * repository gets a new ID, so an earlier caller token is never accepted again.
+ */
+export declare const AttachmentId: Schema.brand<Schema.String, "AttachmentId">;
+export type AttachmentId = typeof AttachmentId.Type;
+/** Returns a new attachment ID of 128 random bits from the platform's cryptographic generator. */
+export declare const newAttachmentId: Effect.Effect<string & import("effect/Brand").Brand<"AttachmentId">, never, never>;
+declare const InstallationCredential_base: Schema.Class<InstallationCredential, Schema.TaggedStruct<"InstallationCredential", {
+    readonly token: Schema.Redacted<Schema.NonEmptyString>;
+}>, {}>;
+/** A GitHub App installation token added to the Worker's requests for the repository. */
+export declare class InstallationCredential extends InstallationCredential_base {
+}
+declare const AnonymousCredential_base: Schema.Class<AnonymousCredential, Schema.TaggedStruct<"AnonymousCredential", {}>, {}>;
+/**
+ * No credential: requests are forwarded unchanged, so only anonymous GitHub access works, such
+ * as reading a public repository.
+ */
+export declare class AnonymousCredential extends AnonymousCredential_base {
+}
+/** The credential added to a Worker's GitHub requests for an attached repository. */
+export declare const AttachmentCredential: Schema.Union<readonly [typeof InstallationCredential, typeof AnonymousCredential]>;
+export type AttachmentCredential = typeof AttachmentCredential.Type;
+declare const Attachment_base: Schema.Class<Attachment, Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "AttachmentId">;
+    readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+    readonly credential: Schema.Union<readonly [typeof InstallationCredential, typeof AnonymousCredential]>;
+    readonly expiresAt: Schema.DateTimeUtc;
+}>, {}>;
+/**
+ * A grant to one Worker VM for one repository. Until `expiresAt`, the Gateway adds `credential`
+ * to the VM's requests for that repository and accepts the attachment's caller token.
+ * `expiresAt` is the token's expiry. A Worker and repository can have several attachments, one
+ * per Attempt.
+ */
+export declare class Attachment extends Attachment_base {
+    /** Returns whether the attachment grants access at `now`. */
+    isLiveAt(now: DateTime.Utc): boolean;
+}
+declare const LiveAttachment_base: Schema.Class<LiveAttachment, Schema.TaggedStruct<"LiveAttachment", {
+    readonly attachment: typeof Attachment;
+}>, {}>;
+/** A lookup result for an active attachment. */
+export declare class LiveAttachment extends LiveAttachment_base {
+}
+declare const ExpiredAttachment_base: Schema.Class<ExpiredAttachment, Schema.TaggedStruct<"ExpiredAttachment", {
+    readonly expiredAt: Schema.DateTimeUtc;
+}>, {}>;
+/** A lookup result for an attachment whose token expired without renewal. */
+export declare class ExpiredAttachment extends ExpiredAttachment_base {
+}
+declare const MissingAttachment_base: Schema.Class<MissingAttachment, Schema.TaggedStruct<"MissingAttachment", {}>, {}>;
+/** A lookup result for an ID that isn't in the store because it was detached or never attached on this Gateway. */
+export declare class MissingAttachment extends MissingAttachment_base {
+}
+export type AttachmentLookup = LiveAttachment | ExpiredAttachment | MissingAttachment;
+declare const AttachmentAlreadyExpired_base: Schema.Class<AttachmentAlreadyExpired, Schema.TaggedStruct<"AttachmentAlreadyExpired", {
+    readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+    readonly expiresAt: Schema.DateTimeUtc;
+}>, import("effect/Cause").YieldableError>;
+/** The error when an attach request has an expired token. */
+export declare class AttachmentAlreadyExpired extends AttachmentAlreadyExpired_base {
+}
+declare const AttachmentConflict_base: Schema.Class<AttachmentConflict, Schema.TaggedStruct<"AttachmentConflict", {
+    readonly id: Schema.brand<Schema.String, "AttachmentId">;
+    readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+}>, import("effect/Cause").YieldableError>;
+/** The error when a renewal uses an attachment ID that belongs to another Worker or repository. */
+export declare class AttachmentConflict extends AttachmentConflict_base {
+}
+export {};
+//# sourceMappingURL=attachment.d.ts.map

package/dist/attachment/attachment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment.d.ts","sourceRoot":"","sources":["../../src/attachment/attachment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAY,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,YAAY,6CAEW,CAAC;AACrC,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AAEpD,kGAAkG;AAClG,eAAO,MAAM,eAAe,oFAE3B,CAAC;;;;AAEF,yFAAyF;AACzF,qBAAa,sBAAuB,SAAQ,2BAG3C;CAAG;;AAEJ;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,wBAGxC;CAAG;AAEJ,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,oFAA8D,CAAC;AAChG,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAC;;;;;;;;AAEpE;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,eAM9B;IACA,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,CAEnC;CACF;;;;AAED,gDAAgD;AAChD,qBAAa,cAAe,SAAQ,mBAElC;CAAG;;;;AAEL,6EAA6E;AAC7E,qBAAa,iBAAkB,SAAQ,sBAGtC;CAAG;;AAEJ,mHAAmH;AACnH,qBAAa,iBAAkB,SAAQ,sBAGtC;CAAG;AAEJ,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;;;;;;AAEtF,6DAA6D;AAC7D,qBAAa,wBAAyB,SAAQ,6BAG7C;CAAG;;;;;;AAEJ,mGAAmG;AACnG,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG"}

package/dist/attachment/attachment.js

@@ -0,0 +1,57 @@
+import { RepositoryName } from "@usine/core/repository";
+import { WorkerName } from "@usine/core/worker";
+import { DateTime, Effect, Encoding, Schema } from "effect";
+/**
+ * The ID of an attachment, unchanged by renewals. A new attach for the same Worker and
+ * repository gets a new ID, so an earlier caller token is never accepted again.
+ */
+export const AttachmentId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/u, { message: "Expected a 22-character attachment ID" })).pipe(Schema.brand("AttachmentId"));
+/** Returns a new attachment ID of 128 random bits from the platform's cryptographic generator. */
+export const newAttachmentId = Effect.sync(() => AttachmentId.make(Encoding.encodeBase64Url(crypto.getRandomValues(new Uint8Array(16)))));
+/** A GitHub App installation token added to the Worker's requests for the repository. */
+export class InstallationCredential extends Schema.TaggedClass()("InstallationCredential", { token: Schema.Redacted(Schema.NonEmptyString) }) {
+}
+/**
+ * No credential: requests are forwarded unchanged, so only anonymous GitHub access works, such
+ * as reading a public repository.
+ */
+export class AnonymousCredential extends Schema.TaggedClass()("AnonymousCredential", {}) {
+}
+/** The credential added to a Worker's GitHub requests for an attached repository. */
+export const AttachmentCredential = Schema.Union([InstallationCredential, AnonymousCredential]);
+/**
+ * A grant to one Worker VM for one repository. Until `expiresAt`, the Gateway adds `credential`
+ * to the VM's requests for that repository and accepts the attachment's caller token.
+ * `expiresAt` is the token's expiry. A Worker and repository can have several attachments, one
+ * per Attempt.
+ */
+export class Attachment extends Schema.Class("@usine/gateway/Attachment")({
+    id: AttachmentId,
+    worker: WorkerName,
+    repository: RepositoryName,
+    credential: AttachmentCredential,
+    expiresAt: Schema.DateTimeUtc,
+}) {
+    /** Returns whether the attachment grants access at `now`. */
+    isLiveAt(now) {
+        return DateTime.isLessThan(now, this.expiresAt);
+    }
+}
+/** A lookup result for an active attachment. */
+export class LiveAttachment extends Schema.TaggedClass()("LiveAttachment", {
+    attachment: Attachment,
+}) {
+}
+/** A lookup result for an attachment whose token expired without renewal. */
+export class ExpiredAttachment extends Schema.TaggedClass()("ExpiredAttachment", { expiredAt: Schema.DateTimeUtc }) {
+}
+/** A lookup result for an ID that isn't in the store because it was detached or never attached on this Gateway. */
+export class MissingAttachment extends Schema.TaggedClass()("MissingAttachment", {}) {
+}
+/** The error when an attach request has an expired token. */
+export class AttachmentAlreadyExpired extends Schema.TaggedError()("AttachmentAlreadyExpired", { worker: WorkerName, repository: RepositoryName, expiresAt: Schema.DateTimeUtc }) {
+}
+/** The error when a renewal uses an attachment ID that belongs to another Worker or repository. */
+export class AttachmentConflict extends Schema.TaggedError()("AttachmentConflict", { id: AttachmentId, worker: WorkerName, repository: RepositoryName }) {
+}
+//# sourceMappingURL=attachment.js.map

package/dist/attachment/attachment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment.js","sourceRoot":"","sources":["../../src/attachment/attachment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAC7C,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAC/F,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;AAGrC,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAC9C,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACxF,CAAC;AAEF,yFAAyF;AACzF,MAAM,OAAO,sBAAuB,SAAQ,MAAM,CAAC,WAAW,EAA0B,CACtF,wBAAwB,EACxB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAClD;CAAG;AAEJ;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,WAAW,EAAuB,CAChF,qBAAqB,EACrB,EAAE,CACH;CAAG;AAEJ,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAGhG;;;;;GAKG;AACH,MAAM,OAAO,UAAW,SAAQ,MAAM,CAAC,KAAK,CAAa,2BAA2B,CAAC,CAAC;IACpF,EAAE,EAAE,YAAY;IAChB,MAAM,EAAE,UAAU;IAClB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,oBAAoB;IAChC,SAAS,EAAE,MAAM,CAAC,WAAW;CAC9B,CAAC;IACA,6DAA6D;IAC7D,QAAQ,CAAC,GAAiB;QACxB,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;CACF;AAED,gDAAgD;AAChD,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,EAAkB,CAAC,gBAAgB,EAAE;IACzF,UAAU,EAAE,UAAU;CACvB,CAAC;CAAG;AAEL,6EAA6E;AAC7E,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAClC;CAAG;AAEJ,mHAAmH;AACnH,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB,EAAE,CACH;CAAG;AAIJ,6DAA6D;AAC7D,MAAM,OAAO,wBAAyB,SAAQ,MAAM,CAAC,WAAW,EAA4B,CAC1F,0BAA0B,EAC1B,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAClF;CAAG;AAEJ,mGAAmG;AACnG,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAC9E,oBAAoB,EACpB,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,CACrE;CAAG"}

package/dist/attachment/store.d.ts

@@ -0,0 +1,27 @@
+import { Context, Effect, Layer } from "effect";
+import { type Attachment, AttachmentAlreadyExpired, AttachmentConflict, type AttachmentId, type AttachmentLookup } from "./attachment.ts";
+declare const Attachments_base: Context.ServiceClass<Attachments, "@usine/gateway/Attachments", {
+    /**
+     * Stores an attachment, or replaces the credential and expiry of the one with the same ID.
+     * Fails with `AttachmentConflict` if the ID belongs to another Worker or repository.
+     */
+    readonly attach: (attachment: Attachment) => Effect.Effect<void, AttachmentAlreadyExpired | AttachmentConflict>;
+    /** Removes the attachment. Returns `false` if it didn't exist. */
+    readonly detach: (id: AttachmentId) => Effect.Effect<boolean>;
+    /** Returns the active attachments, earliest expiry first. */
+    readonly list: () => Effect.Effect<ReadonlyArray<Attachment>>;
+    /** Returns whether the attachment is active, expired, or missing. */
+    readonly find: (id: AttachmentId) => Effect.Effect<AttachmentLookup>;
+    /** Removes expired attachments and returns the number removed. */
+    readonly sweep: () => Effect.Effect<number>;
+}>;
+/**
+ * The in-memory attachment store, keyed by attachment ID. A Gateway restart clears it; the
+ * executor re-attaches with the same IDs when it renews or restarts.
+ */
+export declare class Attachments extends Attachments_base {
+    /** An empty store that removes expired attachments every minute while the layer is in scope. */
+    static readonly layer: Layer.Layer<Attachments, never, never>;
+}
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/attachment/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/attachment/store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAY,MAAM,EAAE,KAAK,EAAO,MAAM,QAAQ,CAAC;AAC/D,OAAO,EACL,KAAK,UAAU,EACf,wBAAwB,EACxB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAItB,MAAM,iBAAiB,CAAC;;IAerB;;;OAGG;qBACc,CACf,UAAU,EAAE,UAAU,KACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAG,kBAAkB,CAAC;IACvE,kEAAkE;qBACjD,CAAC,EAAE,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAC7D,6DAA6D;mBAC9C,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7D,qEAAqE;mBACtD,CAAC,EAAE,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACpE,kEAAkE;oBAClD,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;;AArB/C;;;GAGG;AACH,qBAAa,WAAY,SAAQ,gBAmBA;IAC/B,gGAAgG;IAChG,MAAM,CAAC,QAAQ,CAAC,KAAK,yCAoGnB;CACH"}

package/dist/attachment/store.js

@@ -0,0 +1,101 @@
+import { canonicalRepositoryName } from "@usine/core/repository";
+import { Context, DateTime, Effect, Layer, Ref } from "effect";
+import { AttachmentAlreadyExpired, AttachmentConflict, ExpiredAttachment, LiveAttachment, MissingAttachment, } from "./attachment.js";
+const SWEEP_INTERVAL = "1 minute";
+const samePair = (left, right) => left.worker === right.worker &&
+    canonicalRepositoryName(left.repository) === canonicalRepositoryName(right.repository);
+/**
+ * The in-memory attachment store, keyed by attachment ID. A Gateway restart clears it; the
+ * executor re-attaches with the same IDs when it renews or restarts.
+ */
+export class Attachments extends Context.Service()("@usine/gateway/Attachments") {
+    /** An empty store that removes expired attachments every minute while the layer is in scope. */
+    static layer = Layer.effect(Attachments, Effect.gen(function* () {
+        const entries = yield* Ref.make(new Map());
+        const attach = Effect.fn("Attachments.attach")(function* (attachment) {
+            const { id, worker, repository, expiresAt } = attachment;
+            yield* Effect.annotateCurrentSpan({ attachment: id, worker, repository });
+            const now = yield* DateTime.now;
+            if (!attachment.isLiveAt(now))
+                return yield* new AttachmentAlreadyExpired({ worker, repository, expiresAt });
+            const outcome = yield* Ref.modify(entries, (current) => {
+                const previous = current.get(id);
+                if (previous !== undefined && !samePair(previous, attachment))
+                    return ["conflict", current];
+                return [
+                    previous === undefined ? "attached" : "renewed",
+                    new Map(current).set(id, attachment),
+                ];
+            });
+            if (outcome === "conflict")
+                return yield* new AttachmentConflict({ id, worker, repository });
+            yield* Effect.logInfo(outcome === "attached" ? "Attached a GitHub credential" : "Renewed a GitHub credential", {
+                attachment: id,
+                worker,
+                repository,
+                credential: attachment.credential._tag,
+                expiresAt: DateTime.formatIso(expiresAt),
+            });
+        });
+        const detach = Effect.fn("Attachments.detach")(function* (id) {
+            yield* Effect.annotateCurrentSpan({ attachment: id });
+            const removed = yield* Ref.modify(entries, (current) => {
+                const attachment = current.get(id);
+                if (attachment === undefined)
+                    return [attachment, current];
+                const next = new Map(current);
+                next.delete(id);
+                return [attachment, next];
+            });
+            if (removed === undefined) {
+                yield* Effect.logInfo("Nothing to detach", { attachment: id });
+                return false;
+            }
+            yield* Effect.logInfo("Detached a GitHub credential", {
+                attachment: id,
+                worker: removed.worker,
+                repository: removed.repository,
+            });
+            return true;
+        });
+        const list = Effect.fn("Attachments.list")(function* () {
+            const now = yield* DateTime.now;
+            const current = yield* Ref.get(entries);
+            return [...current.values()]
+                .filter((attachment) => attachment.isLiveAt(now))
+                .sort((left, right) => DateTime.toEpochMillis(left.expiresAt) - DateTime.toEpochMillis(right.expiresAt));
+        });
+        const find = Effect.fn("Attachments.find")(function* (id) {
+            const now = yield* DateTime.now;
+            const attachment = (yield* Ref.get(entries)).get(id);
+            if (attachment === undefined)
+                return new MissingAttachment();
+            return attachment.isLiveAt(now)
+                ? new LiveAttachment({ attachment })
+                : new ExpiredAttachment({ expiredAt: attachment.expiresAt });
+        });
+        const sweep = Effect.fn("Attachments.sweep")(function* () {
+            const now = yield* DateTime.now;
+            const expired = yield* Ref.modify(entries, (current) => {
+                const gone = [...current.values()].filter((attachment) => !attachment.isLiveAt(now));
+                if (gone.length === 0)
+                    return [gone, current];
+                const next = new Map(current);
+                for (const { id } of gone)
+                    next.delete(id);
+                return [gone, next];
+            });
+            for (const { id, worker, repository, expiresAt } of expired)
+                yield* Effect.logInfo("Forgot an expired GitHub credential", {
+                    attachment: id,
+                    worker,
+                    repository,
+                    expiredAt: DateTime.formatIso(expiresAt),
+                });
+            return expired.length;
+        });
+        yield* Effect.forever(Effect.sleep(SWEEP_INTERVAL).pipe(Effect.andThen(sweep()))).pipe(Effect.forkScoped);
+        return { attach, detach, list, find, sweep };
+    }));
+}
+//# sourceMappingURL=store.js.map

package/dist/attachment/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/attachment/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAC/D,OAAO,EAEL,wBAAwB,EACxB,kBAAkB,EAGlB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC,MAAM,QAAQ,GAAG,CAAC,IAAgB,EAAE,KAAiB,EAAW,EAAE,CAChE,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;IAC5B,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAEzF;;;GAGG;AACH,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAmB7C,CAAC,4BAA4B,CAAC;IAC/B,gGAAgG;IAChG,MAAM,CAAU,KAAK,GAAG,KAAK,CAAC,MAAM,CAClC,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAwC,IAAI,GAAG,EAAE,CAAC,CAAC;QAElF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAE,UAAsB;YAC9E,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;YACzD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;YAChF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;oBAC3D,OAAO,CAAC,UAAmB,EAAE,OAAO,CAAC,CAAC;gBACxC,OAAO;oBACL,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAE,UAAoB,CAAC,CAAC,CAAE,SAAmB;oBACrE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC;iBACrC,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,KAAK,UAAU;gBACxB,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACnE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,6BAA6B,EACvF;gBACE,UAAU,EAAE,EAAE;gBACd,MAAM;gBACN,UAAU;gBACV,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI;gBACtC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;aACzC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAgB;YACxE,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;gBACrD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnC,IAAI,UAAU,KAAK,SAAS;oBAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC/D,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE;gBACpD,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC;YAClD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;iBACzB,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;iBAChD,IAAI,CACH,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CACnF,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAgB;YACpE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrD,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,IAAI,iBAAiB,EAAE,CAAC;YAC7D,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC;gBACpC,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC;YACpD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;gBACrD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBACrF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9B,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI;oBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3C,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,OAAO;gBACzD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,qCAAqC,EAAE;oBAC3D,UAAU,EAAE,EAAE;oBACd,MAAM;oBACN,UAAU;oBACV,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;iBACzC,CAAC,CAAC;YACL,OAAO,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CACpF,MAAM,CAAC,UAAU,CAClB,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC,CAAC,CACH,CAAC;CACH"}

package/dist/caller/caller.d.ts

@@ -0,0 +1,60 @@
+import { Context, Effect, Layer, Option, Schema } from "effect";
+import { Headers } from "effect/unstable/http";
+import { GatewaySettings } from "../settings.ts";
+declare const CallerClaims_base: Schema.Class<CallerClaims, Schema.Struct<{
+    readonly attachment: Schema.brand<Schema.String, "AttachmentId">;
+    readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+}>, {}>;
+/**
+ * The claims in a caller token: its attachment ID, Worker, and repository. Because the
+ * attachment ID is included, a token from an earlier attachment is rejected after a new attach.
+ */
+export declare class CallerClaims extends CallerClaims_base {
+}
+/**
+ * The token a Worker VM sends instead of a real credential. It's issued with each attachment
+ * and accepted only while that attachment is active.
+ */
+export declare const CallerToken: Schema.Redacted<Schema.NonEmptyString>;
+export type CallerToken = typeof CallerToken.Type;
+declare const CallerTokenRejected_base: Schema.Class<CallerTokenRejected, Schema.TaggedStruct<"CallerTokenRejected", {
+    readonly reason: Schema.Literals<readonly ["malformed", "bad-signature"]>;
+}>, import("effect/Cause").YieldableError>;
+/** The error for a caller token the Gateway didn't issue: `malformed` if the format is wrong, `bad-signature` if it wasn't signed with the Gateway's key. */
+export declare class CallerTokenRejected extends CallerTokenRejected_base {
+}
+/** The header for tools that can add one, such as git with `http.extraHeader`. */
+export declare const GATEWAY_TOKEN_HEADER = "x-usine-gateway-token";
+declare const CallerTokens_base: Context.ServiceClass<CallerTokens, "@usine/gateway/CallerTokens", {
+    readonly issue: (claims: CallerClaims) => Effect.Effect<CallerToken>;
+    readonly verify: (token: CallerToken) => Effect.Effect<CallerClaims, CallerTokenRejected>;
+    /**
+     * Removes caller tokens from headers for a host outside the Gateway: always the Gateway
+     * header, and `Authorization` or `x-api-key` only if the value verifies as a caller token.
+     */
+    readonly withoutCallerTokens: (headers: Headers.Headers) => Effect.Effect<Headers.Headers>;
+}>;
+/**
+ * Issues and verifies caller tokens of the form `ugw1.<claims>.<HMAC-SHA256>` under the
+ * Gateway's caller key. The same attachment always yields the same token, so no token table
+ * is kept.
+ */
+export declare class CallerTokens extends CallerTokens_base {
+    static readonly layer: Layer.Layer<CallerTokens, never, GatewaySettings>;
+}
+/**
+ * Returns the credential in an `Authorization` or `Proxy-Authorization` value: the `Bearer` or
+ * `token` parameter, or the `Basic` password (the user name if the password is empty).
+ */
+export declare const tokenFromAuthorization: (value: string) => Option.Option<CallerToken>;
+/**
+ * Returns the caller token from the request headers, checking the Gateway header, then
+ * `Authorization` (gh, Codex, git, and Claude Code with `ANTHROPIC_AUTH_TOKEN` or
+ * `CLAUDE_CODE_OAUTH_TOKEN`), then `x-api-key` (Claude Code with `ANTHROPIC_API_KEY`).
+ */
+export declare const presentedToken: (headers: Headers.Headers) => Option.Option<CallerToken>;
+/** Returns `headers` without any header that can contain a caller credential. */
+export declare const withoutCallerCredentials: (headers: Headers.Headers) => Headers.Headers;
+export {};
+//# sourceMappingURL=caller.d.ts.map

package/dist/caller/caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.d.ts","sourceRoot":"","sources":["../../src/caller/caller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAY,KAAK,EAAE,MAAM,EAAoB,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC5F,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;;;;;;AAEjD;;;GAGG;AACH,qBAAa,YAAa,SAAQ,iBAIhC;CAAG;AAEL;;;GAGG;AACH,eAAO,MAAM,WAAW,wCAAyC,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;;;;AAElD,6JAA6J;AAC7J,qBAAa,mBAAoB,SAAQ,wBAGxC;CAAG;AAEJ,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;;oBAgCxC,CAAC,MAAM,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;qBACnD,CAAC,KAAK,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,mBAAmB,CAAC;IACzF;;;OAGG;kCAC2B,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;;AAd9F;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,iBAWA;IAChC,MAAM,CAAC,QAAQ,CAAC,KAAK,oDAsFnB;CACH;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,UAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAgB/E,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,YAAa,OAAO,CAAC,OAAO,KAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAahF,CAAC;AAEJ,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,YAAa,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,OACqB,CAAC"}

package/dist/caller/caller.js

@@ -0,0 +1,130 @@
+import { RepositoryName } from "@usine/core/repository";
+import { WorkerName } from "@usine/core/worker";
+import { Context, Effect, Encoding, Layer, Option, Redacted, Result, Schema } from "effect";
+import { Headers } from "effect/unstable/http";
+import { AttachmentId } from "../attachment/attachment.js";
+import { GatewaySettings } from "../settings.js";
+/**
+ * The claims in a caller token: its attachment ID, Worker, and repository. Because the
+ * attachment ID is included, a token from an earlier attachment is rejected after a new attach.
+ */
+export class CallerClaims extends Schema.Class("@usine/gateway/CallerClaims")({
+    attachment: AttachmentId,
+    worker: WorkerName,
+    repository: RepositoryName,
+}) {
+}
+/**
+ * The token a Worker VM sends instead of a real credential. It's issued with each attachment
+ * and accepted only while that attachment is active.
+ */
+export const CallerToken = Schema.Redacted(Schema.NonEmptyString);
+/** The error for a caller token the Gateway didn't issue: `malformed` if the format is wrong, `bad-signature` if it wasn't signed with the Gateway's key. */
+export class CallerTokenRejected extends Schema.TaggedError()("CallerTokenRejected", { reason: Schema.Literals(["malformed", "bad-signature"]) }) {
+}
+/** The header for tools that can add one, such as git with `http.extraHeader`. */
+export const GATEWAY_TOKEN_HEADER = "x-usine-gateway-token";
+/** The headers that can contain a caller credential; all are removed before forwarding. */
+const CALLER_CREDENTIAL_HEADERS = [
+    GATEWAY_TOKEN_HEADER,
+    "authorization",
+    "x-api-key",
+    "proxy-authorization",
+];
+const TOKEN_FORMAT = /^ugw1\.([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/u;
+const encoder = new TextEncoder();
+const toArrayBuffer = (value) => {
+    const buffer = new ArrayBuffer(value.byteLength);
+    new Uint8Array(buffer).set(value);
+    return buffer;
+};
+const ClaimsJson = Schema.fromJsonString(CallerClaims);
+const encodeClaims = Schema.encodeSync(ClaimsJson);
+const decodeClaims = Schema.decodeUnknownOption(ClaimsJson);
+/**
+ * Issues and verifies caller tokens of the form `ugw1.<claims>.<HMAC-SHA256>` under the
+ * Gateway's caller key. The same attachment always yields the same token, so no token table
+ * is kept.
+ */
+export class CallerTokens extends Context.Service()("@usine/gateway/CallerTokens") {
+    static layer = Layer.effect(CallerTokens, Effect.gen(function* () {
+        const { callerKey } = yield* GatewaySettings;
+        const key = yield* Effect.promise(() => crypto.subtle.importKey("raw", toArrayBuffer(encoder.encode(Redacted.value(callerKey))), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]));
+        const issue = Effect.fn("CallerTokens.issue")(function* (claims) {
+            yield* Effect.annotateCurrentSpan({
+                attachment: claims.attachment,
+                worker: claims.worker,
+                repository: claims.repository,
+            });
+            const signed = `ugw1.${Encoding.encodeBase64Url(encodeClaims(claims))}`;
+            const mac = yield* Effect.promise(() => crypto.subtle.sign("HMAC", key, toArrayBuffer(encoder.encode(signed))));
+            return Redacted.make(`${signed}.${Encoding.encodeBase64Url(new Uint8Array(mac))}`);
+        });
+        const verify = Effect.fn("CallerTokens.verify")(function* (token) {
+            const match = TOKEN_FORMAT.exec(Redacted.value(token));
+            const payload = match?.[1];
+            const mac = Option.fromNullishOr(match?.[2]).pipe(Option.flatMap((value) => Result.getSuccess(Encoding.decodeBase64Url(value))));
+            if (payload === undefined || Option.isNone(mac))
+                return yield* new CallerTokenRejected({ reason: "malformed" });
+            const authentic = yield* Effect.promise(() => crypto.subtle.verify("HMAC", key, toArrayBuffer(mac.value), toArrayBuffer(encoder.encode(`ugw1.${payload}`))));
+            if (!authentic)
+                return yield* new CallerTokenRejected({ reason: "bad-signature" });
+            const claims = Result.getSuccess(Encoding.decodeBase64UrlString(payload)).pipe(Option.flatMap(decodeClaims));
+            if (Option.isNone(claims))
+                return yield* new CallerTokenRejected({ reason: "malformed" });
+            yield* Effect.annotateCurrentSpan({
+                attachment: claims.value.attachment,
+                worker: claims.value.worker,
+                repository: claims.value.repository,
+            });
+            return claims.value;
+        });
+        const isCallerToken = (token) => Option.match(token, {
+            onNone: () => Effect.succeed(false),
+            onSome: (candidate) => verify(candidate).pipe(Effect.as(true), Effect.orElseSucceed(() => false)),
+        });
+        const withoutCallerTokens = Effect.fn("CallerTokens.withoutCallerTokens")(function* (headers) {
+            const remaining = Headers.remove(headers, GATEWAY_TOKEN_HEADER);
+            const authorization = Headers.get(remaining, "authorization").pipe(Option.flatMap(tokenFromAuthorization));
+            const apiKey = Headers.get(remaining, "x-api-key").pipe(Option.map((value) => Redacted.make(value.trim())));
+            const withoutAuthorization = (yield* isCallerToken(authorization))
+                ? Headers.remove(remaining, "authorization")
+                : remaining;
+            return (yield* isCallerToken(apiKey))
+                ? Headers.remove(withoutAuthorization, "x-api-key")
+                : withoutAuthorization;
+        });
+        return { issue, verify, withoutCallerTokens };
+    }));
+}
+/**
+ * Returns the credential in an `Authorization` or `Proxy-Authorization` value: the `Bearer` or
+ * `token` parameter, or the `Basic` password (the user name if the password is empty).
+ */
+export const tokenFromAuthorization = (value) => {
+    const match = /^(\S+)\s+(\S+)\s*$/u.exec(value.trim());
+    const scheme = match?.[1]?.toLowerCase();
+    const parameter = match?.[2];
+    if (scheme === undefined || parameter === undefined)
+        return Option.none();
+    if (scheme === "bearer" || scheme === "token")
+        return Option.some(Redacted.make(parameter));
+    if (scheme !== "basic")
+        return Option.none();
+    return Result.getSuccess(Encoding.decodeBase64String(parameter)).pipe(Option.flatMap((pair) => {
+        const separator = pair.indexOf(":");
+        const user = separator === -1 ? pair : pair.slice(0, separator);
+        const password = separator === -1 ? "" : pair.slice(separator + 1);
+        const secret = password === "" ? user : password;
+        return secret === "" ? Option.none() : Option.some(Redacted.make(secret));
+    }));
+};
+/**
+ * Returns the caller token from the request headers, checking the Gateway header, then
+ * `Authorization` (gh, Codex, git, and Claude Code with `ANTHROPIC_AUTH_TOKEN` or
+ * `CLAUDE_CODE_OAUTH_TOKEN`), then `x-api-key` (Claude Code with `ANTHROPIC_API_KEY`).
+ */
+export const presentedToken = (headers) => Headers.get(headers, GATEWAY_TOKEN_HEADER).pipe(Option.filter((value) => value.trim() !== ""), Option.map((value) => Redacted.make(value.trim())), Option.orElse(() => Headers.get(headers, "authorization").pipe(Option.flatMap(tokenFromAuthorization))), Option.orElse(() => Headers.get(headers, "x-api-key").pipe(Option.filter((value) => value.trim() !== ""), Option.map((value) => Redacted.make(value.trim())))));
+/** Returns `headers` without any header that can contain a caller credential. */
+export const withoutCallerCredentials = (headers) => CALLER_CREDENTIAL_HEADERS.reduce((remaining, name) => Headers.remove(remaining, name), headers);
+//# sourceMappingURL=caller.js.map

package/dist/caller/caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.js","sourceRoot":"","sources":["../../src/caller/caller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC5F,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,KAAK,CAAe,6BAA6B,CAAC,CAAC;IAC1F,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,UAAU;IAClB,UAAU,EAAE,cAAc;CAC3B,CAAC;CAAG;AAEL;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AAGlE,6JAA6J;AAC7J,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,WAAW,EAAuB,CAChF,qBAAqB,EACrB,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,EAAE,CAC5D;CAAG;AAEJ,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,2FAA2F;AAC3F,MAAM,yBAAyB,GAAG;IAChC,oBAAoB;IACpB,eAAe;IACf,WAAW;IACX,qBAAqB;CACb,CAAC;AAEX,MAAM,YAAY,GAAG,6CAA6C,CAAC;AAEnE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,aAAa,GAAG,CAAC,KAAiB,EAAe,EAAE;IACvD,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;AACvD,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,OAAO,EAW9C,CAAC,6BAA6B,CAAC;IAChC,MAAM,CAAU,KAAK,GAAG,KAAK,CAAC,MAAM,CAClC,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CACrB,KAAK,EACL,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EACxD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CACF,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAoB;YAC3E,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAChC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CACvE,CAAC;YACF,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAkB;YAC3E,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAC9E,CAAC;YACF,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC7C,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAClB,MAAM,EACN,GAAG,EACH,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EACxB,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,CACjD,CACF,CAAC;YACF,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC5E,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAC7B,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YAC1F,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAChC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;gBACnC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC3B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;aACpC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,CAAC,KAAiC,EAAE,EAAE,CAC1D,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;YAClB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CACpB,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CACpB,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EACf,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAClC;SACJ,CAAC,CAAC;QAEL,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,EACjF,OAAwB;YAExB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAChE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CACvC,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CACnD,CAAC;YACF,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;gBAChE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,WAAW,CAAC;gBACnD,CAAC,CAAC,oBAAoB,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAChD,CAAC,CAAC,CACH,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAa,EAA8B,EAAE;IAClF,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1E,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5F,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjD,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAwB,EAA8B,EAAE,CACrF,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAClD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CACjB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CACnF,EACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CACjB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CACnD,CACF,CACF,CAAC;AAEJ,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAwB,EAAmB,EAAE,CACpF,yBAAyB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC"}

package/dist/egress/client-hello.d.ts

@@ -0,0 +1,120 @@
+import { Data, Option } from "effect";
+/** The maximum bytes the forward proxy buffers while waiting for a complete ClientHello. */
+export declare const CLIENT_HELLO_LIMIT: number;
+/**
+ * The result of reading a tunnel's first bytes: incomplete with the byte count needed, not a
+ * TLS ClientHello, or a ClientHello with its server name and whether it uses ECH.
+ */
+export type ClientHelloRead = Data.TaggedEnum<{
+    Incomplete: {
+        readonly needed: number;
+    };
+    NotTls: {
+        readonly detail: string;
+    };
+    ClientHello: {
+        readonly serverName: Option.Option<string>;
+        readonly encryptedClientHello: boolean;
+    };
+}>;
+export declare const ClientHelloRead: {
+    readonly $is: <Tag extends "ClientHello" | "Incomplete" | "NotTls">(tag: Tag) => (u: unknown) => u is Extract<{
+        readonly _tag: "ClientHello";
+        readonly serverName: Option.Option<string>;
+        readonly encryptedClientHello: boolean;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "Incomplete";
+        readonly needed: number;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "NotTls";
+        readonly detail: string;
+    }, {
+        readonly _tag: Tag;
+    }>;
+    readonly $match: {
+        <Cases extends { readonly [Tag in "ClientHello" | "Incomplete" | "NotTls"]: (args: Extract<{
+            readonly _tag: "ClientHello";
+            readonly serverName: Option.Option<string>;
+            readonly encryptedClientHello: boolean;
+        } | {
+            readonly _tag: "Incomplete";
+            readonly needed: number;
+        } | {
+            readonly _tag: "NotTls";
+            readonly detail: string;
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(cases: Cases): (value: {
+            readonly _tag: "ClientHello";
+            readonly serverName: Option.Option<string>;
+            readonly encryptedClientHello: boolean;
+        } | {
+            readonly _tag: "Incomplete";
+            readonly needed: number;
+        } | {
+            readonly _tag: "NotTls";
+            readonly detail: string;
+        }) => import("effect/Unify").Unify<ReturnType<Cases["ClientHello" | "Incomplete" | "NotTls"]>>;
+        <Cases extends { readonly [Tag in "ClientHello" | "Incomplete" | "NotTls"]: (args: Extract<{
+            readonly _tag: "ClientHello";
+            readonly serverName: Option.Option<string>;
+            readonly encryptedClientHello: boolean;
+        } | {
+            readonly _tag: "Incomplete";
+            readonly needed: number;
+        } | {
+            readonly _tag: "NotTls";
+            readonly detail: string;
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(value: {
+            readonly _tag: "ClientHello";
+            readonly serverName: Option.Option<string>;
+            readonly encryptedClientHello: boolean;
+        } | {
+            readonly _tag: "Incomplete";
+            readonly needed: number;
+        } | {
+            readonly _tag: "NotTls";
+            readonly detail: string;
+        }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["ClientHello" | "Incomplete" | "NotTls"]>>;
+    };
+    readonly ClientHello: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "ClientHello";
+        readonly serverName: Option.Option<string>;
+        readonly encryptedClientHello: boolean;
+    }, "_tag">;
+    readonly Incomplete: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "Incomplete";
+        readonly needed: number;
+    }, "_tag">;
+    readonly NotTls: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "NotTls";
+        readonly detail: string;
+    }, "_tag">;
+};
+/**
+ * Reads the TLS ClientHello at the start of `bytes`, joining handshake records if the client
+ * split it. For `Incomplete`, `needed` is the smallest byte count that can change the result.
+ */
+export declare const readClientHello: (bytes: Uint8Array) => ClientHelloRead;
+/**
+ * A buffer for a tunnel's first bytes that parses only when the byte count the last parse
+ * needed is reached. A ClientHello longer than 16 KiB is read as `NotTls`.
+ */
+export declare class ClientHelloReader {
+    #private;
+    /** Adds bytes from the client and returns the current read result. */
+    push(chunk: Uint8Array): ClientHelloRead;
+    /** All bytes collected so far, in order; the proxy writes them upstream once the tunnel opens. */
+    get bytes(): Uint8Array;
+    /** The number of parses so far. */
+    get parses(): number;
+}
+/** Returns `host` lowercased and without a trailing dot, for comparing TLS and CONNECT host names. */
+export declare const comparableHost: (host: string) => string;
+//# sourceMappingURL=client-hello.d.ts.map

package/dist/egress/client-hello.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-hello.d.ts","sourceRoot":"","sources":["../../src/egress/client-hello.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEtC,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,QAAY,CAAC;AAS5C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC;IAC5C,UAAU,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,WAAW,EAAE;QACX,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;KACxC,CAAC;CACH,CAAC,CAAC;AACH,eAAO,MAAM,eAAe;;;6BAJH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;uCACX,OAAO;;;;;yBAJT,MAAM;;;;;yBACV,MAAM;;;;;;;iCAEV,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;2CACX,OAAO;;;6BAJT,MAAM;;;6BACV,MAAM;;;;;;;;;;;;;;;;iCAEV,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;2CACX,OAAO;;;6BAJT,MAAM;;;6BACV,MAAM;;;;;;;;;;;;;;;;;6BAEV,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;uCACX,OAAO;;;;yBAJT,MAAM;;;;yBACV,MAAM;;CAM8B,CAAC;AAsDlE;;;GAGG;AACH,eAAO,MAAM,eAAe,UAAW,UAAU,KAAG,eA+BnD,CAAC;AAEF;;;GAGG;AACH,qBAAa,iBAAiB;;IAM5B,sEAAsE;IACtE,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,eAAe,CAUvC;IAED,kGAAkG;IAClG,IAAI,KAAK,IAAI,UAAU,CAWtB;IAED,mCAAmC;IACnC,IAAI,MAAM,IAAI,MAAM,CAEnB;CACF;AAED,sGAAsG;AACtG,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,MAAgD,CAAC"}