@usine/gateway 0.0.0-stage → 0.2.0

package/dist/proxy/proxy.d.ts

@@ -0,0 +1,29 @@
+import { Context, Effect, Layer, Schema } from "effect";
+import { HttpClient, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { Attachments } from "../attachment/store.ts";
+import { CallerTokens } from "../caller/caller.ts";
+import { ChatGptLogins } from "../chatgpt/logins.ts";
+import { GatewaySettings, SettingsInForce } from "../settings.ts";
+/**
+ * The reason the Gateway refused a request. Each refusal is logged at warning level with the
+ * reason, host, and Worker (if known), and returned in `x-usine-gateway-refusal`.
+ */
+export declare const RefusalReason: Schema.Literals<readonly ["unknown-host", "unsupported-path", "missing-caller-token", "invalid-caller-token", "stale-caller-token", "attachment-expired", "repository-mismatch", "provider-not-configured", "provider-login-unavailable"]>;
+export type RefusalReason = typeof RefusalReason.Type;
+/** The response header that contains the refusal reason. */
+export declare const REFUSAL_HEADER = "x-usine-gateway-refusal";
+declare const GatewayProxy_base: Context.ServiceClass<GatewayProxy, "@usine/gateway/GatewayProxy", {
+    /** Forwards one Worker request with the attached credential, or refuses and logs it. */
+    readonly handle: Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest>;
+}>;
+/**
+ * The reverse proxy for Worker VMs on the private network. `git.<domain>` serves GitHub with
+ * the attached installation token, and `llm.<domain>` serves the LLM providers with the
+ * current credentials. Every request must have a caller token for an active attachment; other
+ * hosts are refused.
+ */
+export declare class GatewayProxy extends GatewayProxy_base {
+    static readonly layer: Layer.Layer<GatewayProxy, never, Attachments | CallerTokens | ChatGptLogins | GatewaySettings | HttpClient.HttpClient | SettingsInForce>;
+}
+export {};
+//# sourceMappingURL=proxy.d.ts.map

package/dist/proxy/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy/proxy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAyB,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrF,OAAO,EAEL,UAAU,EAEV,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAEL,YAAY,EAGb,MAAM,qBAAqB,CAAC;AAW7B,OAAO,EAAgC,aAAa,EAAE,MAAM,sBAAsB,CAAC;AASnF,OAAO,EAAE,eAAe,EAAgB,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGhF;;;GAGG;AACH,eAAO,MAAM,aAAa,4OAUxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAEtD,4DAA4D;AAC5D,eAAO,MAAM,cAAc,4BAA4B,CAAC;;IA4EpD,wFAAwF;qBACvE,MAAM,CAAC,MAAM,CAC5B,kBAAkB,CAAC,kBAAkB,EACrC,KAAK,EACL,iBAAiB,CAAC,iBAAiB,CACpC;;AAdL;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,iBAUA;IAChC,MAAM,CAAC,QAAQ,CAAC,KAAK,2IAiSnB;CACH"}

package/dist/proxy/proxy.js

@@ -0,0 +1,297 @@
+import { canonicalRepositoryName } from "@usine/core/repository";
+import { Context, Data, Effect, Layer, Match, Option, Result, Schema } from "effect";
+import { Headers, HttpClient, HttpServerRequest, HttpServerResponse, } from "effect/http";
+import { Attachments } from "../attachment/store.js";
+import { CallerTokens, presentedToken, withoutCallerCredentials, } from "../caller/caller.js";
+import { absoluteUrl, GITHUB_HOSTS, gatewayLocation, githubRoute, withGitHubCredential, } from "../github/github.js";
+import { confirmRename, PERMANENT_REDIRECTS, redirectedName } from "../github/rename.js";
+import { ChatGptLogins } from "../chatgpt/logins.js";
+import { llmRoute, configuredProvider, llmTarget, withChatGptAccess, withStaticCredential, } from "../llm/llm.js";
+import { GatewaySettings, gatewayHosts, SettingsInForce } from "../settings.js";
+import { endToEndHeaders, forwardRequest } from "./forward.js";
+/**
+ * The reason the Gateway refused a request. Each refusal is logged at warning level with the
+ * reason, host, and Worker (if known), and returned in `x-usine-gateway-refusal`.
+ */
+export const RefusalReason = Schema.Literals([
+    "unknown-host",
+    "unsupported-path",
+    "missing-caller-token",
+    "invalid-caller-token",
+    "stale-caller-token",
+    "attachment-expired",
+    "repository-mismatch",
+    "provider-not-configured",
+    "provider-login-unavailable",
+]);
+/** The response header that contains the refusal reason. */
+export const REFUSAL_HEADER = "x-usine-gateway-refusal";
+const REFUSAL_STATUS = {
+    "unknown-host": 404,
+    "unsupported-path": 404,
+    "missing-caller-token": 401,
+    "invalid-caller-token": 401,
+    "stale-caller-token": 403,
+    "attachment-expired": 403,
+    "repository-mismatch": 403,
+    "provider-not-configured": 503,
+    "provider-login-unavailable": 503,
+};
+/** A refusal, with the caller's claims once its token is verified, and the response status. */
+class Refused extends Data.TaggedError("Refused") {
+}
+/** Returns a refusal for a request whose caller token isn't verified yet. */
+const refused = (reason, message) => new Refused({ reason, message, caller: Option.none(), status: REFUSAL_STATUS[reason] });
+/** Returns a refusal for a verified caller. */
+const refusedCaller = (claims, reason, message) => new Refused({ reason, message, caller: Option.some(claims), status: REFUSAL_STATUS[reason] });
+/**
+ * Returns the refusal for a ChatGPT login without a usable access token: 503 while a later
+ * refresh can succeed, which Codex retries, and 401 once the token endpoint has rejected the
+ * refresh token, which Codex doesn't.
+ */
+const loginUnavailable = (claims, error) => new Refused({
+    reason: "provider-login-unavailable",
+    message: error.message,
+    caller: Option.some(claims),
+    status: error.reason === "refresh-rejected" ? 401 : 503,
+});
+/** Returns the target from an origin-form request and its `Host`, or from an absolute-form URL. */
+const requestTarget = (request) => {
+    const parse = (base) => Result.getSuccess(Result.try(() => new URL(request.url, base)));
+    return parse().pipe(Option.orElse(() => Option.flatMap(Headers.get(request.headers, "host"), (host) => parse(`http://${host}`))), Option.map((url) => ({
+        host: url.hostname.toLowerCase(),
+        pathname: url.pathname,
+        search: url.search,
+    })));
+};
+/**
+ * The reverse proxy for Worker VMs on the private network. `git.<domain>` serves GitHub with
+ * the attached installation token, and `llm.<domain>` serves the LLM providers with the
+ * current credentials. Every request must have a caller token for an active attachment; other
+ * hosts are refused.
+ */
+export class GatewayProxy extends Context.Service()("@usine/gateway/GatewayProxy") {
+    static layer = Layer.effect(GatewayProxy, Effect.gen(function* () {
+        const settings = yield* GatewaySettings;
+        const inForce = yield* SettingsInForce;
+        const attachments = yield* Attachments;
+        const callers = yield* CallerTokens;
+        const logins = yield* ChatGptLogins;
+        const client = yield* HttpClient.HttpClient;
+        const hosts = gatewayHosts(settings.domain);
+        const authenticate = Effect.fn("GatewayProxy.authenticate")(function* (request) {
+            const presented = presentedToken(request.headers);
+            if (Option.isNone(presented))
+                return yield* refused("missing-caller-token", "The request has no gateway caller token.");
+            const claims = yield* callers
+                .verify(presented.value)
+                .pipe(Effect.mapError(({ reason }) => refused("invalid-caller-token", `The gateway didn't issue this caller token (${reason}).`)));
+            yield* Effect.annotateCurrentSpan({
+                attachment: claims.attachment,
+                worker: claims.worker,
+                repository: claims.repository,
+            });
+            const stale = refusedCaller(claims, "stale-caller-token", `The caller token belongs to attachment ${claims.attachment} of ${claims.repository} on worker "${claims.worker}", which is no longer attached.`);
+            const lookup = yield* attachments.find(claims.attachment);
+            return yield* Match.valueTags(lookup, {
+                LiveAttachment: (live) => live.attachment.worker === claims.worker &&
+                    canonicalRepositoryName(live.attachment.repository) ===
+                        canonicalRepositoryName(claims.repository)
+                    ? Effect.succeed({ claims, live })
+                    : Effect.fail(stale),
+                ExpiredAttachment: () => Effect.fail(refusedCaller(claims, "attachment-expired", `The attachment of ${claims.repository} to worker "${claims.worker}" has expired.`)),
+                MissingAttachment: () => Effect.fail(stale),
+            });
+        });
+        /**
+         * Teaches the attachment the new name in GitHub's permanent redirect of a request for the
+         * repository itself, once GitHub's API confirms it with the attachment's credential. GitHub
+         * answers a renamed or transferred repository's former name that way; a redirect of anything
+         * else can point at another repository without a rename.
+         */
+        const learnFromRedirect = Effect.fn("GatewayProxy.learnFromRedirect")(function* (live, requested, location) {
+            const { attachment } = live;
+            yield* Effect.annotateCurrentSpan({
+                attachment: attachment.id,
+                repository: attachment.repository,
+            });
+            const fields = {
+                attachment: attachment.id,
+                worker: attachment.worker,
+                repository: attachment.repository,
+            };
+            const newName = Option.flatMap(absoluteUrl(requested.upstream), (upstream) => redirectedName(settings.github, upstream, location));
+            if (Option.isNone(newName))
+                return yield* Effect.logDebug("Learned no name from a redirect that isn't a rename", {
+                    ...fields,
+                    path: location.pathname,
+                });
+            const renamed = { ...fields, newName: newName.value };
+            if (live.serves(newName.value))
+                return yield* Effect.logDebug("The attachment already serves the redirect's name", renamed);
+            yield* confirmRename(client, settings.github, attachment, newName.value).pipe(Effect.andThen(attachments.learnNewName(attachment.id, newName.value)), Effect.catchTag("RenameUnconfirmed", ({ reason, detail }) => Effect.logWarning("GitHub's API didn't confirm the new name of an attached repository", {
+                ...renamed,
+                reason,
+                detail,
+            })));
+        });
+        /** Points a `Location` at github.com or api.github.com to `git.<domain>`, and logs the rewrite. */
+        const throughGateway = Effect.fn("GatewayProxy.throughGateway")(function* (answer, live, requested) {
+            const { attachment } = live;
+            const from = Option.flatMap(Headers.get(answer.headers, "location"), absoluteUrl);
+            const to = Option.flatMap(from, (url) => gatewayLocation(settings.github, hosts.git, url));
+            if (Option.isNone(from) || Option.isNone(to))
+                return answer;
+            yield* Effect.logInfo("Rewrote a GitHub Location header to the gateway", {
+                worker: attachment.worker,
+                repository: attachment.repository,
+                status: answer.status,
+                from: from.value.host,
+                path: to.value.pathname,
+            });
+            if (PERMANENT_REDIRECTS.has(answer.status))
+                yield* learnFromRedirect(live, requested, from.value);
+            return HttpServerResponse.setHeader(answer, "location", to.value.href);
+        });
+        const github = Effect.fn("GatewayProxy.github")(function* (request, target, host) {
+            const { claims, live } = yield* authenticate(request);
+            const { attachment } = live;
+            const route = githubRoute(settings.github, host, target.pathname, target.search);
+            if (Option.isNone(route))
+                return yield* refusedCaller(claims, "unsupported-path", `The gateway serves Git smart HTTP, release downloads, and the GitHub API, not ${target.pathname}.`);
+            const named = route.value.repository;
+            if (Option.isSome(named) && !live.serves(named.value))
+                return yield* refusedCaller(claims, "repository-mismatch", `The caller token was issued for ${claims.repository}, not ${named.value}.`);
+            const headers = withGitHubCredential(route.value.protocol, attachment.credential, withoutCallerCredentials(endToEndHeaders(request.headers)));
+            const response = yield* throughGateway(yield* forwardRequest(client, request, route.value.upstream, headers), live, route.value);
+            yield* forwarded(route.value.protocol === "release"
+                ? "Served a GitHub release download"
+                : "Forwarded a GitHub request", request, target, attachment, response, { protocol: route.value.protocol, ...redirectTarget(response) });
+            return response;
+        });
+        const llm = Effect.fn("GatewayProxy.llm")(function* (request, target) {
+            const { claims, live: { attachment }, } = yield* authenticate(request);
+            const destination = llmTarget(target.pathname);
+            if (Option.isNone(destination))
+                return yield* refusedCaller(claims, "unsupported-path", `The gateway serves /anthropic and /openai on ${hosts.llm}, not ${target.pathname}.`);
+            const { providers } = yield* inForce.current;
+            const provider = configuredProvider(providers, destination.value.provider);
+            if (Option.isNone(provider))
+                return yield* refusedCaller(claims, "provider-not-configured", `The gateway has no credential for ${destination.value.provider}.`);
+            const path = llmRoute(provider.value, destination.value.rest);
+            if (Option.isNone(path))
+                return yield* refusedCaller(claims, "unsupported-path", `The gateway serves only the routes Claude Code and Codex call on ${hosts.llm}, such as /anthropic/v1/messages and /openai/v1/responses, not ${target.pathname}.`);
+            const incoming = withoutCallerCredentials(endToEndHeaders(request.headers));
+            const { credential } = provider.value;
+            const outgoing = credential._tag === "ChatGptLogin"
+                ? yield* chatGptRequest(claims, credential, incoming)
+                : {
+                    headers: withStaticCredential(credential, incoming),
+                    answered: () => Effect.void,
+                };
+            const upstream = `${provider.value.upstream}${path.value}${target.search}`;
+            const response = yield* forwardRequest(client, request, upstream, outgoing.headers);
+            yield* outgoing.answered(response.status);
+            yield* forwarded("Forwarded an LLM request", request, target, attachment, response, {
+                provider: destination.value.provider,
+                credential: credential._tag,
+            });
+            return response;
+        });
+        /**
+         * Returns the headers for a request with a ChatGPT login, and records a 401 answer so the
+         * next request refreshes the access token first.
+         */
+        const chatGptRequest = Effect.fn("GatewayProxy.chatGptRequest")(function* (claims, login, incoming) {
+            const access = yield* logins
+                .access(login)
+                .pipe(Effect.mapError((error) => loginUnavailable(claims, error)));
+            return {
+                headers: withChatGptAccess(access, incoming),
+                answered: (status) => status === 401 ? logins.refused(login, access) : Effect.void,
+            };
+        });
+        /**
+         * Refuses a host the reverse proxy doesn't serve. gh sends every request to the gateway,
+         * including a followed redirect to a GitHub download host, so for an allowlisted host the
+         * refusal says how to download from it with curl.
+         */
+        const unknownHost = Effect.fn("GatewayProxy.unknownHost")(function* (target) {
+            const { egress } = yield* inForce.current;
+            const served = `The gateway serves ${hosts.git} and ${hosts.llm}, not ${target.host}`;
+            return yield* refused("unknown-host", egress.decide(target.host, 443)._tag === "EgressPermitted"
+                ? `${served}, which the forward proxy serves. gh sends every request to the gateway, so it can't follow GitHub's redirect to ${target.host}. Download with curl -fL -u ":$GH_TOKEN" from ${hosts.git} instead, such as http://${hosts.git}/OWNER/REPO/releases/download/TAG/FILE, or http://${hosts.git}/api/v3/repos/OWNER/REPO/tarball/REF for an archive.`
+                : `${served}. Send requests for other hosts through the forward proxy.`);
+        });
+        const route = (request, target) => {
+            if (target.host === hosts.git)
+                return github(request, target, "gateway");
+            const githubHost = GITHUB_HOSTS.get(target.host);
+            if (githubHost !== undefined)
+                return github(request, target, githubHost);
+            if (target.host === hosts.llm)
+                return llm(request, target);
+            return unknownHost(target);
+        };
+        const handle = Effect.gen(function* () {
+            const request = yield* HttpServerRequest.HttpServerRequest;
+            const target = requestTarget(request);
+            if (Option.isNone(target)) {
+                const error = refused("unknown-host", "The request has no host.");
+                yield* Effect.logWarning("Gateway refused a request", {
+                    reason: error.reason,
+                    method: request.method,
+                    client: clientAddress(request),
+                });
+                return refusalResponse(error);
+            }
+            yield* Effect.annotateCurrentSpan({ host: target.value.host, method: request.method });
+            return yield* route(request, target.value).pipe(Effect.catchTags({
+                Refused: (error) => logRefusal(request, target.value, error).pipe(Effect.as(refusalResponse(error))),
+                HttpClientError: (error) => upstreamFailure(request, target.value, error),
+            }));
+        }).pipe(Effect.withSpan("GatewayProxy.handle"));
+        return { handle };
+    }));
+}
+const refusalResponse = (error) => HttpServerResponse.jsonUnsafe({ message: `usine gateway: ${error.message}`, reason: error.reason }, { status: error.status, headers: { [REFUSAL_HEADER]: error.reason } });
+/** Returns the host a response redirects to, without the `Location` path and query, which can hold a signature. */
+const redirectTarget = (response) => Option.match(Option.flatMap(Headers.get(response.headers, "location"), absoluteUrl), {
+    onNone: () => ({}),
+    onSome: (url) => ({ target: url.host }),
+});
+const clientAddress = (request) => Option.getOrElse(request.remoteAddress, () => "unknown");
+const logRefusal = (request, target, error) => {
+    const caller = Option.match(error.caller, {
+        onNone: () => ({ caller: "unverified" }),
+        onSome: ({ worker, repository }) => ({ worker, repository }),
+    });
+    return Effect.logWarning("Gateway refused a request", {
+        reason: error.reason,
+        host: target.host,
+        method: request.method,
+        path: target.pathname,
+        client: clientAddress(request),
+        ...caller,
+    });
+};
+const forwarded = (message, request, target, attachment, response, detail) => Effect.logInfo(message, {
+    ...detail,
+    worker: attachment.worker,
+    repository: attachment.repository,
+    host: target.host,
+    method: request.method,
+    path: target.pathname,
+    status: response.status,
+});
+const upstreamFailure = (request, target, error) => Effect.logError("The upstream of a Worker request could not be reached", {
+    host: target.host,
+    method: request.method,
+    path: target.pathname,
+    client: clientAddress(request),
+    error: error.reason._tag,
+}).pipe(Effect.as(HttpServerResponse.jsonUnsafe({
+    message: "usine gateway: the upstream is unreachable.",
+    reason: "upstream-unreachable",
+}, { status: 502 })));
+//# sourceMappingURL=proxy.js.map

package/dist/proxy/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/proxy/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrF,OAAO,EACL,OAAO,EACP,UAAU,EAEV,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAEL,YAAY,EACZ,cAAc,EACd,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,YAAY,EAGZ,eAAe,EACf,WAAW,EACX,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAgC,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAEL,QAAQ,EACR,kBAAkB,EAClB,SAAS,EACT,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE/D;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3C,cAAc;IACd,kBAAkB;IAClB,sBAAsB;IACtB,sBAAsB;IACtB,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,yBAAyB;IACzB,4BAA4B;CAC7B,CAAC,CAAC;AAGH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAG,yBAAyB,CAAC;AAExD,MAAM,cAAc,GAAG;IACrB,cAAc,EAAE,GAAG;IACnB,kBAAkB,EAAE,GAAG;IACvB,sBAAsB,EAAE,GAAG;IAC3B,sBAAsB,EAAE,GAAG;IAC3B,oBAAoB,EAAE,GAAG;IACzB,oBAAoB,EAAE,GAAG;IACzB,qBAAqB,EAAE,GAAG;IAC1B,yBAAyB,EAAE,GAAG;IAC9B,4BAA4B,EAAE,GAAG;CACe,CAAC;AAEnD,+FAA+F;AAC/F,MAAM,OAAQ,SAAQ,IAAI,CAAC,WAAW,CAAC,SAAS,CAK9C;CAAG;AAEL,6EAA6E;AAC7E,MAAM,OAAO,GAAG,CAAC,MAAqB,EAAE,OAAe,EAAE,EAAE,CACzD,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE1F,+CAA+C;AAC/C,MAAM,aAAa,GAAG,CAAC,MAAoB,EAAE,MAAqB,EAAE,OAAe,EAAE,EAAE,CACrF,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEhG;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,MAAoB,EAAE,KAA8B,EAAE,EAAE,CAChF,IAAI,OAAO,CAAC;IACV,MAAM,EAAE,4BAA4B;IACpC,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;CACxD,CAAC,CAAC;AASL,mGAAmG;AACnG,MAAM,aAAa,GAAG,CACpB,OAA4C,EACd,EAAE;IAChC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,KAAK,EAAE,CAAC,IAAI,CACjB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CACjB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CACxF,EACD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,OAAO,EAU9C,CAAC,6BAA6B,CAAC;IAChC,MAAM,CAAU,KAAK,GAAG,KAAK,CAAC,MAAM,CAClC,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QACvC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EACnE,OAA4C;YAE5C,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC1B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,0CAA0C,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO;iBAC1B,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;iBACvB,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAC7B,OAAO,CACL,sBAAsB,EACtB,+CAA+C,MAAM,IAAI,CAC1D,CACF,CACF,CAAC;YACJ,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAChC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,aAAa,CACzB,MAAM,EACN,oBAAoB,EACpB,0CAA0C,MAAM,CAAC,UAAU,OAAO,MAAM,CAAC,UAAU,eAAe,MAAM,CAAC,MAAM,iCAAiC,CACjJ,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE;gBACpC,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CACvB,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;oBACxC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;wBACjD,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC;oBAC1C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;oBAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBACxB,iBAAiB,EAAE,GAAG,EAAE,CACtB,MAAM,CAAC,IAAI,CACT,aAAa,CACX,MAAM,EACN,oBAAoB,EACpB,qBAAqB,MAAM,CAAC,UAAU,eAAe,MAAM,CAAC,MAAM,gBAAgB,CACnF,CACF;gBACH,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH;;;;;WAKG;QACH,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAAC,EAC7E,IAAoB,EACpB,SAAsB,EACtB,QAAa;YAEb,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;YAC5B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAChC,UAAU,EAAE,UAAU,CAAC,EAAE;gBACzB,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG;gBACb,UAAU,EAAE,UAAU,CAAC,EAAE;gBACzB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC3E,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CACpD,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,qDAAqD,EAAE;oBACnF,GAAG,MAAM;oBACT,IAAI,EAAE,QAAQ,CAAC,QAAQ;iBACxB,CAAC,CAAC;YACL,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAC3B,mDAAmD,EACnD,OAAO,CACR,CAAC;YACJ,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAC3E,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EACtE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAC1D,MAAM,CAAC,UAAU,CACf,oEAAoE,EACpE;gBACE,GAAG,OAAO;gBACV,MAAM;gBACN,MAAM;aACP,CACF,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,mGAAmG;QACnG,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EACvE,MAA6C,EAC7C,IAAoB,EACpB,SAAsB;YAEtB,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;YAClF,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3F,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAE,OAAO,MAAM,CAAC;YAC5D,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,iDAAiD,EAAE;gBACvE,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;gBACrB,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;gBACxC,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACxD,OAAO,kBAAkB,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EACvD,OAA4C,EAC5C,MAAqB,EACrB,IAAgB;YAEhB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;YAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBACtB,OAAO,KAAK,CAAC,CAAC,aAAa,CACzB,MAAM,EACN,kBAAkB,EAClB,iFAAiF,MAAM,CAAC,QAAQ,GAAG,CACpG,CAAC;YACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACrC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;gBACnD,OAAO,KAAK,CAAC,CAAC,aAAa,CACzB,MAAM,EACN,qBAAqB,EACrB,mCAAmC,MAAM,CAAC,UAAU,SAAS,KAAK,CAAC,KAAK,GAAG,CAC5E,CAAC;YACJ,MAAM,OAAO,GAAG,oBAAoB,CAClC,KAAK,CAAC,KAAK,CAAC,QAAQ,EACpB,UAAU,CAAC,UAAU,EACrB,wBAAwB,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAC3D,CAAC;YACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CACpC,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EACrE,IAAI,EACJ,KAAK,CAAC,KAAK,CACZ,CAAC;YACF,KAAK,CAAC,CAAC,SAAS,CACd,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAChC,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,4BAA4B,EAChC,OAAO,EACP,MAAM,EACN,UAAU,EACV,QAAQ,EACR,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAChE,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,EACjD,OAA4C,EAC5C,MAAqB;YAErB,MAAM,EACJ,MAAM,EACN,IAAI,EAAE,EAAE,UAAU,EAAE,GACrB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,aAAa,CACzB,MAAM,EACN,kBAAkB,EAClB,gDAAgD,KAAK,CAAC,GAAG,SAAS,MAAM,CAAC,QAAQ,GAAG,CACrF,CAAC;YACJ,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC3E,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACzB,OAAO,KAAK,CAAC,CAAC,aAAa,CACzB,MAAM,EACN,yBAAyB,EACzB,qCAAqC,WAAW,CAAC,KAAK,CAAC,QAAQ,GAAG,CACnE,CAAC;YACJ,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACrB,OAAO,KAAK,CAAC,CAAC,aAAa,CACzB,MAAM,EACN,kBAAkB,EAClB,oEAAoE,KAAK,CAAC,GAAG,kEAAkE,MAAM,CAAC,QAAQ,GAAG,CAClK,CAAC;YACJ,MAAM,QAAQ,GAAG,wBAAwB,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5E,MAAM,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;YACtC,MAAM,QAAQ,GACZ,UAAU,CAAC,IAAI,KAAK,cAAc;gBAChC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC;gBACrD,CAAC,CAAC;oBACE,OAAO,EAAE,oBAAoB,CAAC,UAAU,EAAE,QAAQ,CAAC;oBACnD,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;iBAC5B,CAAC;YACR,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpF,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1C,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;gBAClF,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ;gBACpC,UAAU,EAAE,UAAU,CAAC,IAAI;aAC5B,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH;;;WAGG;QACH,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EACvE,MAAoB,EACpB,KAAmB,EACnB,QAAyB;YAEzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM;iBACzB,MAAM,CAAC,KAAK,CAAC;iBACb,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACrE,OAAO;gBACL,OAAO,EAAE,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAC5C,QAAQ,EAAE,CAAC,MAAc,EAAE,EAAE,CAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;aAC/D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH;;;;WAIG;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAqB;YACxF,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC1C,MAAM,MAAM,GAAG,sBAAsB,KAAK,CAAC,GAAG,QAAQ,KAAK,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC;YACtF,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,cAAc,EACd,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,iBAAiB;gBACxD,CAAC,CAAC,GAAG,MAAM,oHAAoH,MAAM,CAAC,IAAI,iDAAiD,KAAK,CAAC,GAAG,4BAA4B,KAAK,CAAC,GAAG,qDAAqD,KAAK,CAAC,GAAG,sDAAsD;gBAC7V,CAAC,CAAC,GAAG,MAAM,4DAA4D,CAC1E,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,CAAC,OAA4C,EAAE,MAAqB,EAAE,EAAE;YACpF,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG;gBAAE,OAAO,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACzE,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG;gBAAE,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACjC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;YAC3D,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAClE,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,2BAA2B,EAAE;oBACpD,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;iBAC/B,CAAC,CAAC;gBACH,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvF,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,SAAS,CAAC;gBACf,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClF,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;aAC1E,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAEhD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,CAAC,CACH,CAAC;CACH;AAED,MAAM,eAAe,GAAG,CAAC,KAAc,EAAyC,EAAE,CAChF,kBAAkB,CAAC,UAAU,CAC3B,EAAE,OAAO,EAAE,kBAAkB,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EACpE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CACtE,CAAC;AAEJ,mHAAmH;AACnH,MAAM,cAAc,GAAG,CAAC,QAA+C,EAAE,EAAE,CACzE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE;IACnF,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAClB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;CACxC,CAAC,CAAC;AAEL,MAAM,aAAa,GAAG,CAAC,OAA4C,EAAU,EAAE,CAC7E,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAE3D,MAAM,UAAU,GAAG,CACjB,OAA4C,EAC5C,MAAqB,EACrB,KAAc,EACd,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE;QACxC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;KAC7D,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,UAAU,CAAC,2BAA2B,EAAE;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;QAC9B,GAAG,MAAM;KACV,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,OAAe,EACf,OAA4C,EAC5C,MAAqB,EACrB,UAAsB,EACtB,QAA+C,EAC/C,MAAwC,EACxC,EAAE,CACF,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;IACtB,GAAG,MAAM;IACT,MAAM,EAAE,UAAU,CAAC,MAAM;IACzB,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,MAAM,EAAE,OAAO,CAAC,MAAM;IACtB,IAAI,EAAE,MAAM,CAAC,QAAQ;IACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;CACxB,CAAC,CAAC;AAEL,MAAM,eAAe,GAAG,CACtB,OAA4C,EAC5C,MAAqB,EACrB,KAAsC,EACtC,EAAE,CACF,MAAM,CAAC,QAAQ,CAAC,uDAAuD,EAAE;IACvE,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,MAAM,EAAE,OAAO,CAAC,MAAM;IACtB,IAAI,EAAE,MAAM,CAAC,QAAQ;IACrB,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;IAC9B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;CACzB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,EAAE,CACP,kBAAkB,CAAC,UAAU,CAC3B;IACE,OAAO,EAAE,6CAA6C;IACtD,MAAM,EAAE,sBAAsB;CAC/B,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CACF,CACF,CAAC"}

package/dist/settings.d.ts

@@ -0,0 +1,52 @@
+import type { GatewayDomain } from "@usine/core/worker";
+import { Context, Effect, Layer, Schema } from "effect";
+import type { EgressAllowlist } from "./egress/egress.ts";
+import type { GitHubOrigins } from "./github/github.ts";
+import type { LlmProviders } from "./llm/llm.ts";
+/** The HMAC key that signs caller tokens, at least 32 characters, known only to the Gateway. */
+export declare const CallerKey: Schema.RedactedFromValue<Schema.String>;
+export type CallerKey = typeof CallerKey.Type;
+/** The bearer token the executor sends to the admin API, at least 32 characters. */
+export declare const AdminToken: Schema.RedactedFromValue<Schema.String>;
+export type AdminToken = typeof AdminToken.Type;
+declare const GatewaySettings_base: Context.ServiceClass<GatewaySettings, "@usine/gateway/GatewaySettings", {
+    readonly domain: GatewayDomain;
+    readonly github: GitHubOrigins;
+    readonly providers: LlmProviders;
+    readonly egress: EgressAllowlist;
+    readonly adminToken: AdminToken;
+    readonly callerKey: CallerKey;
+}>;
+/**
+ * The Gateway's configuration as read at startup. Secrets stay `Redacted` until sent or used to
+ * sign. `egress` and `providers` keep their startup values; reloaded values are in
+ * `SettingsInForce`. Other settings change only with a restart.
+ */
+export declare class GatewaySettings extends GatewaySettings_base {
+}
+/** The settings a reload replaces: the egress allowlist and LLM providers. */
+export interface ReloadableSettings {
+    readonly egress: EgressAllowlist;
+    readonly providers: LlmProviders;
+}
+declare const SettingsInForce_base: Context.ServiceClass<SettingsInForce, "@usine/gateway/SettingsInForce", {
+    /** Returns the current allowlist and providers. */
+    readonly current: Effect.Effect<ReloadableSettings>;
+    /** Replaces them for all later requests. */
+    readonly replace: (next: ReloadableSettings) => Effect.Effect<void>;
+}>;
+/**
+ * The current egress allowlist and LLM providers, initially from `GatewaySettings` and
+ * replaced by each reload. A request reads them once, so a tunnel opened under the previous
+ * allowlist stays open.
+ */
+export declare class SettingsInForce extends SettingsInForce_base {
+    static readonly layer: Layer.Layer<SettingsInForce, never, GatewaySettings>;
+}
+/** Returns the host names the Gateway serves under `domain`. */
+export declare const gatewayHosts: (domain: GatewayDomain) => {
+    readonly git: `git.${string & import("effect/Brand").Brand<"GatewayDomain">}`;
+    readonly llm: `llm.${string & import("effect/Brand").Brand<"GatewayDomain">}`;
+};
+export {};
+//# sourceMappingURL=settings.d.ts.map

package/dist/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAO,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,gGAAgG;AAChG,eAAO,MAAM,SAAS,yCAIrB,CAAC;AACF,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAC;AAE9C,oFAAoF;AACpF,eAAO,MAAM,UAAU,yCAItB,CAAC;AACF,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;;qBAU3B,aAAa;qBACb,aAAa;wBACV,YAAY;qBACf,eAAe;yBACX,UAAU;wBACX,SAAS;;AAbjC;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,oBAUA;CAAG;AAExC,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;CAClC;;IAUG,mDAAmD;sBACjC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;IACnD,4CAA4C;sBAC1B,CAAC,IAAI,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;;AAXvE;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,oBAQA;IACnC,MAAM,CAAC,QAAQ,CAAC,KAAK,uDAOnB;CACH;AAED,gEAAgE;AAChE,eAAO,MAAM,YAAY,WAAY,aAAa;aAC7C,GAAG;aAAmB,GAAG;CAA6B,CAAC"}

package/dist/settings.js

@@ -0,0 +1,27 @@
+import { Context, Effect, Layer, Ref, Schema } from "effect";
+/** The HMAC key that signs caller tokens, at least 32 characters, known only to the Gateway. */
+export const CallerKey = Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(32, { message: "Expected a caller key of at least 32 characters" })));
+/** The bearer token the executor sends to the admin API, at least 32 characters. */
+export const AdminToken = Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(32, { message: "Expected an admin token of at least 32 characters" })));
+/**
+ * The Gateway's configuration as read at startup. Secrets stay `Redacted` until sent or used to
+ * sign. `egress` and `providers` keep their startup values; reloaded values are in
+ * `SettingsInForce`. Other settings change only with a restart.
+ */
+export class GatewaySettings extends Context.Service()("@usine/gateway/GatewaySettings") {
+}
+/**
+ * The current egress allowlist and LLM providers, initially from `GatewaySettings` and
+ * replaced by each reload. A request reads them once, so a tunnel opened under the previous
+ * allowlist stays open.
+ */
+export class SettingsInForce extends Context.Service()("@usine/gateway/SettingsInForce") {
+    static layer = Layer.effect(SettingsInForce, Effect.gen(function* () {
+        const { egress, providers } = yield* GatewaySettings;
+        const inForce = yield* Ref.make({ egress, providers });
+        return { current: Ref.get(inForce), replace: (next) => Ref.set(inForce, next) };
+    }));
+}
+/** Returns the host names the Gateway serves under `domain`. */
+export const gatewayHosts = (domain) => ({ git: `git.${domain}`, llm: `llm.${domain}` });
+//# sourceMappingURL=settings.js.map

package/dist/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAK7D,gGAAgG;AAChG,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,CACjB,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CACvF,CACF,CAAC;AAGF,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAChD,MAAM,CAAC,MAAM,CAAC,KAAK,CACjB,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CACzF,CACF,CAAC;AAGF;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAUjD,CAAC,gCAAgC,CAAC;CAAG;AAQxC;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAQjD,CAAC,gCAAgC,CAAC;IACnC,MAAM,CAAU,KAAK,GAAG,KAAK,CAAC,MAAM,CAClC,eAAe,EACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAqB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;IAClF,CAAC,CAAC,CACH,CAAC;CACH;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAqB,EAAE,EAAE,CACpD,CAAC,EAAE,GAAG,EAAE,OAAO,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,MAAM,EAAE,EAAE,CAAU,CAAC"}

package/dist/upstream.d.ts

@@ -0,0 +1,5 @@
+import { Schema } from "effect";
+/** The base URL of an upstream API: scheme, host, and an optional path prefix, with no query, fragment, or trailing slash. */
+export declare const UpstreamBase: Schema.brand<Schema.String, "UpstreamBase">;
+export type UpstreamBase = typeof UpstreamBase.Type;
+//# sourceMappingURL=upstream.d.ts.map

package/dist/upstream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.d.ts","sourceRoot":"","sources":["../src/upstream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,8HAA8H;AAC9H,eAAO,MAAM,YAAY,6CAIW,CAAC;AACrC,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC"}

package/dist/upstream.js

@@ -0,0 +1,6 @@
+import { Schema } from "effect";
+/** The base URL of an upstream API: scheme, host, and an optional path prefix, with no query, fragment, or trailing slash. */
+export const UpstreamBase = Schema.String.check(Schema.isPattern(/^https?:\/\/[^/?#\s]+(?:\/[^?#\s]*[^/?#\s])?$/u, {
+    message: "Expected an http(s) base URL without a query or a trailing slash",
+})).pipe(Schema.brand("UpstreamBase"));
+//# sourceMappingURL=upstream.js.map

package/dist/upstream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.js","sourceRoot":"","sources":["../src/upstream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,8HAA8H;AAC9H,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAC7C,MAAM,CAAC,SAAS,CAAC,gDAAgD,EAAE;IACjE,OAAO,EAAE,kEAAkE;CAC5E,CAAC,CACH,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,61 @@
 {
   "name": "@usine/gateway",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "The usine gateway: a credential-injecting proxy for GitHub and LLM providers, and an egress allowlist, in front of Worker VMs.",
+  "license": "AGPL-3.0-only",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/basaltbytes/usine.git",
+    "directory": "packages/gateway"
+  },
+  "bin": {
+    "usine-gateway": "./dist/node/main.js"
+  },
+  "files": [
+    "dist",
+    "!dist/tsconfig.tsbuildinfo"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/gateway.d.ts",
+      "default": "./dist/gateway.js"
+    },
+    "./admin": {
+      "types": "./dist/admin/api.d.ts",
+      "default": "./dist/admin/api.js"
+    },
+    "./node": {
+      "types": "./dist/node/node.d.ts",
+      "default": "./dist/node/node.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@effect/platform-node": "4.0.6",
+    "@effect/platform-node-shared": "4.0.6",
+    "@usine/core": "0.5.0"
+  },
+  "devDependencies": {
+    "@effect/vitest": "4.0.6",
+    "effect": "4.0.6",
+    "typescript": "7.0.2",
+    "vitest": "5.0.5",
+    "@usine/tsconfig": "0.0.0"
+  },
+  "peerDependencies": {
+    "effect": "4.0.6"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "check": "tsc -p tsconfig.check.json",
+    "test": "vitest run --exclude 'test/placeholder-swap/**'",
+    "test:placeholder-swap": "vitest run test/placeholder-swap"
+  }
 }