@usine/gateway 0.0.0-stage → 0.2.0

package/dist/node/egress-proxy.js

@@ -0,0 +1,491 @@
+import { lookup } from "node:dns/promises";
+import { createServer, request as httpRequest, } from "node:http";
+import { BlockList, connect } from "node:net";
+import { Data, Effect, Fiber, Match, Option, Predicate, Schema } from "effect";
+import { Headers } from "effect/http";
+import { tokenFromAuthorization, CallerTokens } from "../caller/caller.js";
+import { ClientHelloReader, comparableHost } from "../egress/client-hello.js";
+import { EgressRefused } from "../egress/egress.js";
+import { endToEndHeaders } from "../proxy/forward.js";
+import { REFUSAL_HEADER } from "../proxy/proxy.js";
+import { GatewaySettings, gatewayHosts, SettingsInForce } from "../settings.js";
+/**
+ * Returns the ranges a public name must never resolve to: private, loopback, link-local,
+ * shared, multicast, and reserved. Node checks IPv4-mapped IPv6 addresses against the IPv4
+ * ranges, so there's no `::ffff:0:0/96` rule, which would match every IPv4 address.
+ */
+const privateAddresses = () => {
+    const list = new BlockList();
+    for (const [network, prefix] of [
+        ["0.0.0.0", 8],
+        ["10.0.0.0", 8],
+        ["100.64.0.0", 10],
+        ["127.0.0.0", 8],
+        ["169.254.0.0", 16],
+        ["172.16.0.0", 12],
+        ["192.0.0.0", 24],
+        ["192.168.0.0", 16],
+        ["198.18.0.0", 15],
+        ["224.0.0.0", 3],
+    ])
+        list.addSubnet(network, prefix, "ipv4");
+    for (const [network, prefix] of [
+        ["::", 127],
+        ["fc00::", 7],
+        ["fe80::", 10],
+        ["ff00::", 8],
+    ])
+        list.addSubnet(network, prefix, "ipv6");
+    return list;
+};
+/** The error when the DNS lookup of an allowed host fails or returns nothing. */
+class Unresolvable extends Schema.TaggedError()("Unresolvable", {
+    host: Schema.String,
+}) {
+}
+/** The error when the forward proxy can't listen on its address. */
+export class EgressProxyListenError extends Schema.TaggedError()("EgressProxyListenError", { host: Schema.String, port: Schema.Int, message: Schema.String }) {
+}
+/** The error when the upstream connection can't be opened or its response doesn't finish. */
+class Unreachable extends Schema.TaggedError()("Unreachable", {
+    host: Schema.String,
+    port: Schema.Int,
+    message: Schema.String,
+}) {
+}
+/**
+ * The error for a tunnel refused after `200 Connection Established`: the first bytes weren't a
+ * TLS ClientHello; the ClientHello had no server name, hid it with ECH, or had a different one
+ * than the CONNECT host; or the host resolved to a private address. `serverName` is the
+ * ClientHello's server name, if any.
+ */
+class TunnelRefused extends Data.TaggedError("TunnelRefused") {
+}
+/** The error when the client closes a tunnel before sending any bytes. */
+class TunnelAbandoned extends Data.TaggedError("TunnelAbandoned") {
+}
+/** A fatal TLS `unrecognized_name` alert (RFC 8446, section 6), sent so the client can report why the handshake ended. */
+const UNRECOGNIZED_NAME_ALERT = Buffer.from([0x15, 0x03, 0x03, 0x00, 0x02, 0x02, 0x70]);
+const CLIENT_HELLO_TIMEOUT = "5 seconds";
+const notTls = (detail) => new TunnelRefused({ reason: "not-tls", detail, serverName: Option.none() });
+/**
+ * Buffers a tunnel's first bytes, including `head`, until they contain a complete ClientHello
+ * (at most 16 KiB and five seconds), then pauses the client so nothing more is read before the
+ * upstream connection exists. Fails with `TunnelAbandoned` if the client closes before sending
+ * any bytes.
+ */
+const clientHello = (client, head) => Effect.callback((resume) => {
+    const reader = new ClientHelloReader();
+    const stop = () => {
+        client.off("data", onData);
+        client.off("end", onEnd);
+        client.off("close", onEnd);
+    };
+    function onData(chunk) {
+        const read = reader.push(chunk);
+        if (read._tag === "Incomplete")
+            return;
+        stop();
+        client.pause();
+        if (read._tag === "NotTls")
+            return resume(Effect.fail(notTls(read.detail)));
+        resume(Effect.succeed({
+            buffered: Buffer.from(reader.bytes),
+            serverName: read.serverName,
+            encryptedClientHello: read.encryptedClientHello,
+        }));
+    }
+    function onEnd() {
+        stop();
+        resume(Effect.fail(reader.bytes.length === 0
+            ? new TunnelAbandoned()
+            : notTls("the client closed the tunnel before its ClientHello was complete")));
+    }
+    client.on("data", onData);
+    client.once("end", onEnd);
+    client.once("close", onEnd);
+    if (head.length > 0)
+        onData(head);
+    return Effect.sync(stop);
+}).pipe(Effect.timeoutOrElse({
+    duration: CLIENT_HELLO_TIMEOUT,
+    orElse: () => Effect.fail(notTls("no ClientHello arrived within five seconds")),
+}));
+/**
+ * Checks that the ClientHello's server name is the CONNECT host, so a tunnel to a shared CDN
+ * address can't connect to another tenant of that address.
+ */
+const pinnedServerName = (host, hello) => {
+    if (hello.encryptedClientHello)
+        return Effect.fail(new TunnelRefused({
+            reason: "server-name-missing",
+            detail: "the ClientHello encrypts its server name (ECH), so it cannot be checked",
+            serverName: hello.serverName,
+        }));
+    if (Option.isNone(hello.serverName))
+        return Effect.fail(new TunnelRefused({
+            reason: "server-name-missing",
+            detail: "the ClientHello names no server",
+            serverName: Option.none(),
+        }));
+    const serverName = hello.serverName.value;
+    return comparableHost(serverName) === comparableHost(host)
+        ? Effect.succeed({ buffered: hello.buffered, serverName })
+        : Effect.fail(new TunnelRefused({
+            reason: "server-name-mismatch",
+            detail: `the ClientHello asks for ${serverName}, not the CONNECT host`,
+            serverName: hello.serverName,
+        }));
+};
+const RelayEnd = Data.taggedEnum();
+const AUTHORITY = /^(?:\[([0-9a-fA-F:.]+)\]|([^:[\]]+)):(\d{1,5})$/u;
+const parseAuthority = (authority) => {
+    const match = AUTHORITY.exec(authority);
+    const host = match?.[1] ?? match?.[2];
+    if (match === null || host === undefined)
+        return Option.none();
+    return Option.some({ host, port: Number(match[3]) });
+};
+const statusLine = (status, reason, body, refusal) => [
+    `HTTP/1.1 ${status} ${reason}`,
+    "Content-Type: text/plain; charset=utf-8",
+    `Content-Length: ${Buffer.byteLength(body)}`,
+    ...Option.match(refusal, {
+        onNone: () => [],
+        onSome: (value) => [`${REFUSAL_HEADER}: ${value}`],
+    }),
+    "Connection: close",
+    "",
+    body,
+].join("\r\n");
+/**
+ * Serves the forward proxy that Workers use for package registries and other allowlisted
+ * hosts: `CONNECT host:443` for HTTPS, and absolute-form requests (`GET http://host/...`) for
+ * plain HTTP mirrors such as apt.
+ *
+ * - A tunnel opens only after the ClientHello's server name matches the CONNECT host.
+ * - The proxy resolves names itself and refuses one that resolves to a private address.
+ * - Requests for `git.<domain>` and `llm.<domain>` on port 80 go to the reverse proxy at
+ *   `gateway`, so a client that proxies everything (Claude Code with `HTTPS_PROXY`) still
+ *   connects to them.
+ * - A caller token in `Proxy-Authorization` is optional and only identifies the Worker in logs.
+ * - Each refusal is logged with the host, reason, and client address.
+ * - Each request is checked against the allowlist current at arrival, so an open tunnel stays
+ *   open after a reload removes its host.
+ */
+export const serveEgressProxy = Effect.fn("EgressProxy.serve")(function* (listener, gateway) {
+    const settings = yield* GatewaySettings;
+    const ownHosts = new Set(Object.values(gatewayHosts(settings.domain)));
+    const inForce = yield* SettingsInForce;
+    const callers = yield* CallerTokens;
+    const blocked = privateAddresses();
+    const scope = yield* Effect.scope;
+    const context = yield* Effect.context();
+    /** Returns the log fields for a request's caller: the Worker from a valid caller token, if any. */
+    const caller = (value) => Option.fromNullishOr(value).pipe(Option.flatMap(tokenFromAuthorization), Option.match({
+        onNone: () => Effect.succeed({ caller: "none" }),
+        onSome: (token) => callers.verify(token).pipe(Effect.map(({ worker }) => ({ worker })), Effect.orElseSucceed(() => ({ caller: "invalid-token" }))),
+    }));
+    const logRefusal = (refusal, client, who) => Effect.logWarning("Gateway refused a request", {
+        reason: refusal.reason,
+        host: refusal.host,
+        port: refusal.port,
+        client,
+        ...who,
+    });
+    /** Resolves an allowed host and returns its first address. Fails if any address is private. */
+    const resolve = Effect.fn("EgressProxy.resolve")(function* (permitted) {
+        const addresses = yield* Effect.tryPromise({
+            try: () => lookup(permitted.host, { all: true, verbatim: true }),
+            catch: () => new Unresolvable({ host: permitted.host }),
+        });
+        const first = addresses[0];
+        if (first === undefined)
+            return yield* new Unresolvable({ host: permitted.host });
+        if (addresses.some(({ address, family }) => blocked.check(address, family === 6 ? "ipv6" : "ipv4")))
+            return yield* Effect.fail(new EgressRefused({
+                host: permitted.host,
+                port: permitted.port,
+                reason: "private-address",
+            }));
+        return first.address;
+    });
+    const decide = (host, port) => Effect.flatMap(inForce.current, ({ egress }) => {
+        const decision = egress.decide(host, port);
+        return decision._tag === "EgressRefused" ? Effect.fail(decision) : Effect.succeed(decision);
+    });
+    /** Returns the target for `host` on `port`: the reverse proxy for the Gateway's own names, otherwise the resolved allowed host. */
+    const destination = (host, port) => ownHosts.has(host.toLowerCase()) && port === 80
+        ? Effect.succeed({ address: gateway.host, port: gateway.port, kind: "gateway" })
+        : decide(host, port).pipe(Effect.flatMap(resolve), Effect.map((address) => ({ address, port, kind: "egress" })));
+    const openTunnel = (address, port, host) => Effect.callback((resume) => {
+        const socket = connect({ host: address, port });
+        const onError = (error) => resume(Effect.fail(new Unreachable({ host, port, message: error.message })));
+        socket.once("error", onError);
+        socket.once("connect", () => {
+            socket.off("error", onError);
+            resume(Effect.succeed(socket));
+        });
+        return Effect.sync(() => socket.destroy());
+    });
+    /** Copies bytes both ways until either side closes, then closes both. */
+    const splice = (client, upstream) => Effect.callback((resume) => {
+        const close = () => {
+            client.destroy();
+            upstream.destroy();
+            resume(Effect.void);
+        };
+        client.on("error", close).on("close", close);
+        upstream.on("error", close).on("close", close);
+        client.pipe(upstream);
+        upstream.pipe(client);
+        return Effect.sync(close);
+    });
+    /** Closes a tunnel refused after its `200 Connection Established`. */
+    const closeRefused = (client, refusal) => {
+        if (refusal.reason === "not-tls")
+            client.destroy();
+        else
+            client.end(UNRECOGNIZED_NAME_ALERT);
+    };
+    const tunnel = Effect.fn("EgressProxy.tunnel")(function* (request, client, head) {
+        const from = request.socket.remoteAddress ?? "unknown";
+        const who = yield* caller(request.headers["proxy-authorization"]);
+        const authority = parseAuthority(request.url ?? "");
+        if (Option.isNone(authority)) {
+            client.end(statusLine(400, "Bad Request", "Expected CONNECT host:port\n", Option.none()));
+            return yield* Effect.logWarning("Gateway refused a request", {
+                reason: "malformed-connect",
+                client: from,
+                ...who,
+            });
+        }
+        const { host, port } = authority.value;
+        yield* Effect.annotateCurrentSpan({ host, port });
+        if (ownHosts.has(comparableHost(host)) && port === 80) {
+            const opened = yield* openTunnel(gateway.host, gateway.port, host).pipe(Effect.result);
+            if (opened._tag === "Failure") {
+                client.end(statusLine(502, "Bad Gateway", "usine gateway: the reverse proxy is unreachable.\n", Option.none()));
+                return yield* Effect.logError("The gateway's reverse proxy could not be reached", {
+                    host,
+                    port,
+                    client: from,
+                    ...who,
+                    error: opened.failure._tag,
+                });
+            }
+            client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+            if (head.length > 0)
+                opened.success.write(head);
+            yield* Effect.logInfo("Opened an egress tunnel", {
+                host,
+                port,
+                destination: "gateway",
+                client: from,
+                ...who,
+            });
+            return yield* splice(client, opened.success);
+        }
+        const decision = (yield* inForce.current).egress.decide(host, port);
+        // Only port 443 tunnels are allowed; plain HTTP goes through the absolute-form relay, which checks the host.
+        if (decision._tag === "EgressRefused" || port !== 443) {
+            const refused = decision._tag === "EgressRefused"
+                ? decision
+                : new EgressRefused({ host, port, reason: "port-not-allowed" });
+            client.end(statusLine(403, "Forbidden", `usine gateway: ${host}:${port} is refused (${refused.reason}).\n`, Option.some(refused.reason)));
+            return yield* logRefusal(refused, from, who);
+        }
+        // The client sends its ClientHello after this line; no upstream connection is opened until its server name is checked.
+        client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        const opened = yield* clientHello(client, head).pipe(Effect.flatMap((hello) => pinnedServerName(host, hello)), Effect.flatMap(({ buffered, serverName }) => resolve(decision).pipe(Effect.catchTag("EgressRefused", (refused) => Effect.fail(new TunnelRefused({
+            reason: "private-address",
+            detail: `${refused.host} resolves to a private address`,
+            serverName: Option.some(serverName),
+        }))), Effect.flatMap((address) => openTunnel(address, port, decision.host)), Effect.map((upstream) => ({ upstream, buffered, serverName })))), Effect.result);
+        if (opened._tag === "Failure") {
+            const failure = opened.failure;
+            if (failure._tag === "TunnelAbandoned") {
+                client.destroy();
+                return yield* Effect.logInfo("The client abandoned a tunnel before sending anything", {
+                    host,
+                    port,
+                    client: from,
+                    ...who,
+                });
+            }
+            if (failure._tag === "TunnelRefused") {
+                closeRefused(client, failure);
+                return yield* Effect.logWarning("Gateway refused a request", {
+                    reason: failure.reason,
+                    host,
+                    port,
+                    serverName: Option.getOrElse(failure.serverName, () => "none"),
+                    detail: failure.detail,
+                    client: from,
+                    ...who,
+                });
+            }
+            client.destroy();
+            return yield* Effect.logError("An allowed egress host could not be reached", {
+                host,
+                port,
+                client: from,
+                ...who,
+                error: failure._tag,
+            });
+        }
+        const { upstream, buffered, serverName } = opened.success;
+        upstream.write(buffered);
+        yield* Effect.logInfo("Opened an egress tunnel", {
+            host,
+            port,
+            serverName,
+            destination: "egress",
+            client: from,
+            ...who,
+        });
+        yield* splice(client, upstream);
+    });
+    const relay = Effect.fn("EgressProxy.relay")(function* (request, response) {
+        const from = request.socket.remoteAddress ?? "unknown";
+        const who = yield* caller(request.headers["proxy-authorization"]);
+        const url = Option.liftThrowable(() => new URL(request.url ?? ""))().pipe(Option.filter((parsed) => parsed.protocol === "http:"));
+        if (Option.isNone(url)) {
+            response.writeHead(400, { "content-type": "text/plain; charset=utf-8" });
+            response.end("usine gateway: the forward proxy accepts only CONNECT or an absolute http:// URL.\n");
+            return yield* Effect.logWarning("Gateway refused a request", {
+                reason: "not-a-proxy-request",
+                client: from,
+                ...who,
+            });
+        }
+        const port = url.value.port === "" ? 80 : Number(url.value.port);
+        const host = url.value.hostname.replace(/^\[(.*)\]$/u, "$1");
+        yield* Effect.annotateCurrentSpan({ host, port });
+        const forwarded = endToEndHeaders(Headers.fromInput(request.headers));
+        /**
+         * Sends the request to `target` and copies the response back until it ends or the client
+         * disconnects. If the client disconnects mid-transfer, destroys the upstream connection
+         * immediately. Fails with `Unreachable` if the upstream connection fails or ends early, after
+         * the client's response is destroyed or set to 502.
+         */
+        const copy = (target, headers) => Effect.callback((resume) => {
+            let settled = false;
+            const settle = (end) => {
+                settled = true;
+                resume(end);
+            };
+            const fail = (error) => {
+                if (settled)
+                    return;
+                if (response.headersSent)
+                    response.destroy();
+                else {
+                    response.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+                    response.end();
+                }
+                settle(Effect.fail(new Unreachable({ host, port, message: error.message })));
+            };
+            const outgoing = httpRequest({
+                host: target.address,
+                port: target.port,
+                method: request.method,
+                path: `${url.value.pathname}${url.value.search}`,
+                headers: { ...headers, host: url.value.host },
+                setHost: false,
+            }, (incoming) => {
+                const status = incoming.statusCode ?? 502;
+                response.writeHead(status, {
+                    ...endToEndHeaders(Headers.fromInput(incoming.headers)),
+                });
+                incoming.once("error", fail);
+                incoming.once("close", () => {
+                    if (!incoming.complete)
+                        fail(new Error("The upstream response ended prematurely"));
+                });
+                incoming.once("end", () => settle(Effect.succeed(RelayEnd.Relayed({ status }))));
+                incoming.pipe(response);
+            });
+            // `close` also fires after a finished response, which already completed the relay; before that, it means the client disconnected.
+            response.once("close", () => {
+                if (settled)
+                    return;
+                outgoing.destroy();
+                settle(Effect.succeed(RelayEnd.Abandoned({
+                    status: response.headersSent ? Option.some(response.statusCode) : Option.none(),
+                })));
+            });
+            outgoing.once("error", fail);
+            request.pipe(outgoing);
+            return Effect.sync(() => outgoing.destroy());
+        });
+        const relayed = yield* destination(host, port).pipe(Effect.flatMap((target) => 
+        // Only the reverse proxy receives the caller token; hosts outside the Gateway must never receive it.
+        (target.kind === "gateway"
+            ? Effect.succeed(forwarded)
+            : callers.withoutCallerTokens(forwarded)).pipe(Effect.map((headers) => ({ target, headers })))), Effect.flatMap(({ target, headers }) => copy(target, headers).pipe(Effect.map((end) => ({ end, kind: target.kind })))), Effect.result);
+        if (relayed._tag === "Success") {
+            const fields = {
+                host,
+                port,
+                destination: relayed.success.kind,
+                method: request.method ?? "GET",
+                client: from,
+                ...who,
+            };
+            return yield* Match.valueTags(relayed.success.end, {
+                Relayed: ({ status }) => Effect.logInfo("Relayed a plain HTTP request", { ...fields, status }),
+                Abandoned: ({ status }) => Effect.logInfo("The client abandoned a relayed request", {
+                    ...fields,
+                    status: Option.getOrElse(status, () => "none"),
+                }),
+            });
+        }
+        const failure = relayed.failure;
+        if (failure._tag === "EgressRefused") {
+            response.writeHead(403, {
+                "content-type": "text/plain; charset=utf-8",
+                [REFUSAL_HEADER]: failure.reason,
+            });
+            response.end(`usine gateway: ${host}:${port} is refused (${failure.reason}).\n`);
+            return yield* logRefusal(failure, from, who);
+        }
+        if (!response.headersSent) {
+            response.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+            response.end(`usine gateway: ${host} is unreachable.\n`);
+        }
+        yield* Effect.logError("An allowed egress host could not be reached", {
+            host,
+            port,
+            client: from,
+            ...who,
+            error: failure._tag,
+        });
+    });
+    const server = createServer({ requestTimeout: 0 });
+    const run = (effect) => Fiber.runIn(Effect.runForkWith(context)(effect), scope);
+    server.on("connect", (request, client, head) => {
+        client.on("error", () => client.destroy());
+        // The server's sockets are half-open, so `server.close` waits for an interrupted tunnel until its client socket is destroyed.
+        run(tunnel(request, client, head).pipe(Effect.onInterrupt(() => Effect.sync(() => client.destroy()))));
+    });
+    server.on("request", (request, response) => run(relay(request, response)));
+    yield* Effect.acquireRelease(Effect.callback((resume) => {
+        server.once("error", (error) => resume(Effect.fail(new EgressProxyListenError({
+            host: listener.host,
+            port: listener.port,
+            message: error.message,
+        }))));
+        server.listen(listener.port, listener.host, () => resume(Effect.void));
+    }), () => Effect.callback((resume) => {
+        server.close(() => resume(Effect.void));
+        server.closeAllConnections();
+    }));
+    const address = server.address();
+    const bound = address === null || Predicate.isString(address)
+        ? listener
+        : { host: address.address, port: address.port };
+    yield* Effect.logInfo("The egress proxy is listening", bound);
+    return bound;
+});
+//# sourceMappingURL=egress-proxy.js.map

package/dist/node/egress-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-proxy.js","sourceRoot":"","sources":["../../src/node/egress-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EACL,YAAY,EAEZ,OAAO,IAAI,WAAW,GAEvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAe,MAAM,UAAU,CAAC;AAG3D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAwB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGhF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,GAAc,EAAE;IACvC,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;QAC9B,CAAC,SAAS,EAAE,CAAC,CAAC;QACd,CAAC,UAAU,EAAE,CAAC,CAAC;QACf,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,WAAW,EAAE,CAAC,CAAC;QAChB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,WAAW,EAAE,EAAE,CAAC;QACjB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,WAAW,EAAE,CAAC,CAAC;KACR;QACR,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;QAC9B,CAAC,IAAI,EAAE,GAAG,CAAC;QACX,CAAC,QAAQ,EAAE,CAAC,CAAC;QACb,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,CAAC,CAAC;KACL;QACR,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,iFAAiF;AACjF,MAAM,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,cAAc,EAAE;IAC5E,IAAI,EAAE,MAAM,CAAC,MAAM;CACpB,CAAC;CAAG;AAEL,oEAAoE;AACpE,MAAM,OAAO,sBAAuB,SAAQ,MAAM,CAAC,WAAW,EAA0B,CACtF,wBAAwB,EACxB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAClE;CAAG;AAEJ,6FAA6F;AAC7F,MAAM,WAAY,SAAQ,MAAM,CAAC,WAAW,EAAe,CAAC,aAAa,EAAE;IACzE,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,IAAI,EAAE,MAAM,CAAC,GAAG;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL;;;;;GAKG;AACH,MAAM,aAAc,SAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,CAI1D;CAAG;AAEL,0EAA0E;AAC1E,MAAM,eAAgB,SAAQ,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC;CAAG;AAEpE,0HAA0H;AAC1H,MAAM,uBAAuB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAExF,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAEzC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE,CACnD,MAAM,CAAC,QAAQ,CAOb,CAAC,MAAM,EAAE,EAAE;IACX,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,SAAS,MAAM,CAAC,KAAa;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO;QACvC,IAAI,EAAE,CAAC;QACP,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,CACJ,MAAM,CAAC,OAAO,CAAC;YACb,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,SAAS,KAAK;QACZ,IAAI,EAAE,CAAC;QACP,MAAM,CACJ,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACvB,CAAC,CAAC,IAAI,eAAe,EAAE;YACvB,CAAC,CAAC,MAAM,CAAC,kEAAkE,CAAC,CAC/E,CACF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,aAAa,CAAC;IACnB,QAAQ,EAAE,oBAAoB;IAC9B,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC;CAChF,CAAC,CACH,CAAC;AAEJ;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CACvB,IAAY,EACZ,KAIC,EACyF,EAAE;IAC5F,IAAI,KAAK,CAAC,oBAAoB;QAC5B,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,aAAa,CAAC;YAChB,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,yEAAyE;YACjF,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CACH,CAAC;IACJ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QACjC,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,aAAa,CAAC;YAChB,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,iCAAiC;YACzC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE;SAC1B,CAAC,CACH,CAAC;IACJ,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;IAC1C,OAAO,cAAc,CAAC,UAAU,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC;QACxD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;QAC1D,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,aAAa,CAAC;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,4BAA4B,UAAU,wBAAwB;YACtE,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CACH,CAAC;AACR,CAAC,CAAC;AAoBF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAY,CAAC;AAE7C,MAAM,SAAS,GAAG,kDAAkD,CAAC;AAErE,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAiD,EAAE;IAC1F,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,IAAY,EAAE,OAA8B,EAAE,EAAE,CAClG;IACE,YAAY,MAAM,IAAI,MAAM,EAAE;IAC9B,yCAAyC;IACzC,mBAAmB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;IAC5C,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;QACvB,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;QAChB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,cAAc,KAAK,KAAK,EAAE,CAAC;KACnD,CAAC;IACF,mBAAmB;IACnB,EAAE;IACF,IAAI;CACL,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAEjB;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EACtE,QAAkB,EAClB,OAAiB;IAEjB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACxC,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;IACpC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;IAE/C,mGAAmG;IACnG,MAAM,MAAM,GAAG,CAAC,KAAyB,EAA+B,EAAE,CACxE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAC9B,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EACtC,MAAM,CAAC,KAAK,CAAC;QACX,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAChD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CACxB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAgB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EACtD,MAAM,CAAC,aAAa,CAAC,GAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CACxE;KACJ,CAAC,CACH,CAAC;IAEJ,MAAM,UAAU,GAAG,CAAC,OAAsB,EAAE,MAAc,EAAE,GAAiB,EAAE,EAAE,CAC/E,MAAM,CAAC,UAAU,CAAC,2BAA2B,EAAE;QAC7C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;QACN,GAAG,GAAG;KACP,CAAC,CAAC;IAEL,+FAA+F;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EAAE,SAA0B;QACpF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;YACzC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAChE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,IACE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CACrC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CACvD;YAED,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,aAAa,CAAC;gBAChB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,MAAM,EAAE,iBAAiB;aAC1B,CAAC,CACH,CAAC;QACJ,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAiD,EAAE,CAC3F,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEL,mIAAmI;IACnI,MAAM,WAAW,GAAG,CAClB,IAAY,EACZ,IAAY,EAC8C,EAAE,CAC5D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,KAAK,EAAE;QAC7C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAChF,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CACrB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EACvB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAC7D,CAAC;IAER,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE,CACjE,MAAM,CAAC,QAAQ,CAAsB,CAAC,MAAM,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE,CAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEL,yEAAyE;IACzE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE,CAClD,MAAM,CAAC,QAAQ,CAAO,CAAC,MAAM,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,sEAAsE;IACtE,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,OAAsB,EAAE,EAAE;QAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;;YAC9C,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EACtD,OAAwB,EACxB,MAAc,EACd,IAAY;QAEZ,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,8BAA8B,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1F,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,2BAA2B,EAAE;gBAC3D,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,IAAI;gBACZ,GAAG,GAAG;aACP,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;QACvC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAElD,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,CACR,UAAU,CACR,GAAG,EACH,aAAa,EACb,oDAAoD,EACpD,MAAM,CAAC,IAAI,EAAE,CACd,CACF,CAAC;gBACF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,kDAAkD,EAAE;oBAChF,IAAI;oBACJ,IAAI;oBACJ,MAAM,EAAE,IAAI;oBACZ,GAAG,GAAG;oBACN,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE;gBAC/C,IAAI;gBACJ,IAAI;gBACJ,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,IAAI;gBACZ,GAAG,GAAG;aACP,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpE,6GAA6G;QAC7G,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtD,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,KAAK,eAAe;gBAC/B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpE,MAAM,CAAC,GAAG,CACR,UAAU,CACR,GAAG,EACH,WAAW,EACX,kBAAkB,IAAI,IAAI,IAAI,gBAAgB,OAAO,CAAC,MAAM,MAAM,EAClE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAC5B,CACF,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,uHAAuH;QACvH,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EACxD,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,CAC1C,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpB,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3C,MAAM,CAAC,IAAI,CACT,IAAI,aAAa,CAAC;YAChB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,gCAAgC;YACvD,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;SACpC,CAAC,CACH,CACF,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,EACrE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAC/D,CACF,EACD,MAAM,CAAC,MAAM,CACd,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACvC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,uDAAuD,EAAE;oBACpF,IAAI;oBACJ,IAAI;oBACJ,MAAM,EAAE,IAAI;oBACZ,GAAG,GAAG;iBACP,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACrC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,2BAA2B,EAAE;oBAC3D,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI;oBACJ,IAAI;oBACJ,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;oBAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,IAAI;oBACZ,GAAG,GAAG;iBACP,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,6CAA6C,EAAE;gBAC3E,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,IAAI;gBACZ,GAAG,GAAG;gBACN,KAAK,EAAE,OAAO,CAAC,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;QAC1D,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzB,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE;YAC/C,IAAI;YACJ,IAAI;YACJ,UAAU;YACV,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,IAAI;YACZ,GAAG,GAAG;SACP,CAAC,CAAC;QACH,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EACpD,OAAwB,EACxB,QAAwB;QAExB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CACvE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CACvD,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACzE,QAAQ,CAAC,GAAG,CACV,qFAAqF,CACtF,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,2BAA2B,EAAE;gBAC3D,MAAM,EAAE,qBAAqB;gBAC7B,MAAM,EAAE,IAAI;gBACZ,GAAG,GAAG;aACP,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC7D,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAEtE;;;;;WAKG;QACH,MAAM,IAAI,GAAG,CAAC,MAAmB,EAAE,OAAwB,EAAE,EAAE,CAC7D,MAAM,CAAC,QAAQ,CAAwB,CAAC,MAAM,EAAE,EAAE;YAChD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,GAAyC,EAAE,EAAE;gBAC3D,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC;YACF,MAAM,IAAI,GAAG,CAAC,KAAY,EAAE,EAAE;gBAC5B,IAAI,OAAO;oBAAE,OAAO;gBACpB,IAAI,QAAQ,CAAC,WAAW;oBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;qBACxC,CAAC;oBACJ,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;oBACzE,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/E,CAAC,CAAC;YACF,MAAM,QAAQ,GAAG,WAAW,CAC1B;gBACE,IAAI,EAAE,MAAM,CAAC,OAAO;gBACpB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE;gBAChD,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBAC7C,OAAO,EAAE,KAAK;aACf,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;gBAC1C,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;oBACzB,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBACxD,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBAC1B,IAAI,CAAC,QAAQ,CAAC,QAAQ;wBAAE,IAAI,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;gBACrF,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjF,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC,CACF,CAAC;YACF,kIAAkI;YAClI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC1B,IAAI,OAAO;oBAAE,OAAO;gBACpB,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CACJ,MAAM,CAAC,OAAO,CACZ,QAAQ,CAAC,SAAS,CAAC;oBACjB,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;iBAChF,CAAC,CACH,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEL,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACxB,qGAAqG;QACrG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;YACxB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3B,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CACzC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CACvD,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CACrC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC9E,EACD,MAAM,CAAC,MAAM,CACd,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG;gBACb,IAAI;gBACJ,IAAI;gBACJ,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;gBACjC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;gBAC/B,MAAM,EAAE,IAAI;gBACZ,GAAG,GAAG;aACP,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;gBACjD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACtB,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;gBACvE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,wCAAwC,EAAE;oBACvD,GAAG,MAAM;oBACT,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;iBAC/C,CAAC;aACL,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACrC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;gBACtB,cAAc,EAAE,2BAA2B;gBAC3C,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM;aACjC,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,IAAI,gBAAgB,OAAO,CAAC,MAAM,MAAM,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACzE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,IAAI,oBAAoB,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,6CAA6C,EAAE;YACpE,IAAI;YACJ,IAAI;YACJ,MAAM,EAAE,IAAI;YACZ,GAAG,GAAG;YACN,KAAK,EAAE,OAAO,CAAC,IAAI;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,MAA2B,EAAE,EAAE,CAC1C,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAwB,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE;QAC9E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,8HAA8H;QAC9H,GAAG,CACD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAChC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAC9D,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE3E,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAC1B,MAAM,CAAC,QAAQ,CAA+B,CAAC,MAAM,EAAE,EAAE;QACvD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7B,MAAM,CACJ,MAAM,CAAC,IAAI,CACT,IAAI,sBAAsB,CAAC;YACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CACH,CACF,CACF,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,EACF,GAAG,EAAE,CACH,MAAM,CAAC,QAAQ,CAAO,CAAC,MAAM,EAAE,EAAE;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC,CAAC,CACL,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GACT,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACpD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC"}

package/dist/node/environment.d.ts

@@ -0,0 +1,113 @@
+import { GatewayDomain } from "@usine/core/worker";
+import { Config, ConfigProvider, Effect, FileSystem, Layer, Option, Schema } from "effect";
+import { AnthropicProvider, OpenAiProvider } from "../llm/llm.ts";
+import { AdminToken, CallerKey, GatewaySettings } from "../settings.ts";
+/** The allowlist path if `USINE_GATEWAY_EGRESS_ALLOWLIST` isn't set. */
+export declare const DEFAULT_EGRESS_ALLOWLIST_PATH = "/etc/usine-gateway/egress-allowlist";
+declare const ConflictingProviderCredentials_base: Schema.Class<ConflictingProviderCredentials, Schema.TaggedStruct<"ConflictingProviderCredentials", {
+    readonly provider: Schema.Literals<readonly ["anthropic", "openai"]>;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The error when two credentials are set for one provider, such as an API key and a subscription token. */
+export declare class ConflictingProviderCredentials extends ConflictingProviderCredentials_base {
+}
+declare const EnvironmentFileError_base: Schema.Class<EnvironmentFileError, Schema.TaggedStruct<"EnvironmentFileError", {
+    readonly path: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The error when a file listed in `USINE_GATEWAY_ENVIRONMENT_FILES` can't be read. */
+export declare class EnvironmentFileError extends EnvironmentFileError_base {
+}
+/** The Gateway's settings source: its environment files layered over the process environment. */
+export interface SettingsSource {
+    /** The environment files in read order; empty if none is listed. */
+    readonly files: ReadonlyArray<string>;
+    readonly provider: ConfigProvider.ConfigProvider;
+}
+/**
+ * Reads the `:`-separated environment files listed in `USINE_GATEWAY_ENVIRONMENT_FILES` in
+ * `base`, one `KEY=value` per line, and layers them over `base`. Later files override earlier
+ * ones, as with systemd's `EnvironmentFile=`. Without that variable, returns `base` alone.
+ */
+export declare const readSettingsSource: (base: ConfigProvider.ConfigProvider) => Effect.Effect<{
+    files: string[] | readonly string[];
+    provider: ConfigProvider.ConfigProvider;
+}, Config.ConfigError | EnvironmentFileError, FileSystem.FileSystem>;
+/**
+ * The LLM providers and credentials from the settings. A ChatGPT login's auth file is read and
+ * parsed, and its directory checked for writing, so an unusable file fails here, before the
+ * Gateway listens or a reload applies it.
+ */
+export declare const llmProviders: Effect.Effect<{
+    anthropic: Option.Option<AnthropicProvider>;
+    openai: Option.Option<OpenAiProvider>;
+}, import("../chatgpt/auth-file.ts").ChatGptAuthFileError | Config.ConfigError | ConflictingProviderCredentials, FileSystem.FileSystem>;
+export declare const egressAllowlistPath: Config.Config<string>;
+/** Reads and parses the allowlist file at `path`. */
+export declare const readEgressAllowlist: (path: string) => Effect.Effect<import("../egress/egress.ts").EgressAllowlist, import("../egress/egress.ts").EgressAllowlistError | import("effect/PlatformError").PlatformError, FileSystem.FileSystem>;
+export interface Listener {
+    readonly host: string;
+    readonly port: number;
+}
+/** The listeners for the reverse proxy (GitHub and LLMs), the forward proxy (allowlisted hosts), and the admin API (executor). */
+export interface GatewayListeners {
+    readonly proxy: Listener;
+    readonly egress: Listener;
+    readonly admin: Listener;
+}
+/**
+ * Listeners from the environment. The proxies default to loopback, so an unconfigured Gateway
+ * is unreachable; the VM's unit sets its private address.
+ */
+export declare const listenersFromEnvironment: Config.Config<{
+    proxy: {
+        host: string;
+        port: number;
+    };
+    egress: {
+        host: string;
+        port: number;
+    };
+    admin: {
+        host: string;
+        port: number;
+    };
+}>;
+/** The settings that only a restart changes: the domain, the listeners, the admin token, and the caller key that signs all caller tokens. */
+export interface RestartSettings {
+    readonly domain: GatewayDomain;
+    readonly adminToken: AdminToken;
+    readonly callerKey: CallerKey;
+    readonly listeners: GatewayListeners;
+}
+export declare const restartSettings: Config.Config<RestartSettings>;
+export interface StartupSettings {
+    readonly settings: GatewaySettings["Service"];
+    readonly listeners: GatewayListeners;
+}
+/**
+ * Reads the Gateway's settings from `source`. Fails on a missing secret, an invalid value, an
+ * unreadable allowlist, or an unusable ChatGPT auth file, so the Gateway stops before it listens.
+ */
+export declare const readStartupSettings: (source: SettingsSource) => Effect.Effect<{
+    settings: {
+        domain: string & import("effect/Brand").Brand<"GatewayDomain">;
+        github: import("../github/github.ts").GitHubOrigins;
+        providers: {
+            anthropic: Option.Option<AnthropicProvider>;
+            openai: Option.Option<OpenAiProvider>;
+        };
+        egress: import("../egress/egress.ts").EgressAllowlist;
+        adminToken: import("effect/Redacted").Redacted<string>;
+        callerKey: import("effect/Redacted").Redacted<string>;
+    };
+    listeners: GatewayListeners;
+}, import("../chatgpt/auth-file.ts").ChatGptAuthFileError | Config.ConfigError | ConflictingProviderCredentials | import("../egress/egress.ts").EgressAllowlistError | import("effect/PlatformError").PlatformError, FileSystem.FileSystem>;
+/**
+ * The Gateway's settings, read once at startup from the files in
+ * `USINE_GATEWAY_ENVIRONMENT_FILES` over the process environment, plus the egress allowlist
+ * file. Fails on a missing secret, an invalid value, or an unreadable or unusable file.
+ */
+export declare const settingsFromEnvironment: Layer.Layer<GatewaySettings, import("../chatgpt/auth-file.ts").ChatGptAuthFileError | Config.ConfigError | ConflictingProviderCredentials | import("../egress/egress.ts").EgressAllowlistError | EnvironmentFileError | import("effect/PlatformError").PlatformError, FileSystem.FileSystem>;
+export {};
+//# sourceMappingURL=environment.d.ts.map

package/dist/node/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../src/node/environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAK3F,OAAO,EAEL,iBAAiB,EAOjB,cAAc,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGxE,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,wCAAwC,CAAC;;;;;AAOnF,4GAA4G;AAC5G,qBAAa,8BAA+B,SAAQ,mCAGnD;CAAG;;;;;AAEJ,uFAAuF;AACvF,qBAAa,oBAAqB,SAAQ,yBAGzC;CAAG;AAEJ,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,cAAc,CAAC;CAClD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;oEAmB7B,CAAC;AAiBH;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;uIAwDvB,CAAC;AAWH,eAAO,MAAM,mBAAmB,uBAE/B,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,mBAAmB,0MAM9B,CAAC;AAEH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,kIAAkI;AAClI,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAQD;;;GAGG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;EAInC,CAAC;AAEH,6IAA6I;AAC7I,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;CACtC;AAED,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAKzD,CAAC;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;CACtC;AAaD;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;2OAO9B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,8RAOnC,CAAC"}