@alchemy.run/kubernetes 0.0.0 → 2.0.0-beta.85

package/lib/internal/registry.js

@@ -0,0 +1,72 @@
+import { makeContainerImageSource, } from "@alchemy.run/docker/ImageSource";
+import { createPhysicalName } from "alchemy/PhysicalName";
+/**
+ * Image publishing for connections that declare a
+ * {@link Connection.registry}: `main` programs and `context` Dockerfiles are
+ * built on the deploying machine and pushed to `<server>/<name>:<hash>`,
+ * where the cluster's nodes pull them. Used when the cluster's platform
+ * adapter has no managed registry of its own (EKS pushes to ECR instead).
+ */
+import * as Effect from "effect/Effect";
+/** Docker credentials for a registry, or `undefined` to use `docker login`. */
+const credentialsOf = (registry) => registry.username !== undefined && registry.password !== undefined
+    ? {
+        // Docker keys credentials by host; `server` may carry a namespace.
+        server: registry.server.split("/")[0],
+        username: registry.username,
+        password: registry.password,
+    }
+    : undefined;
+const trimServer = (server) => server.replace(/\/+$/, "");
+export const makeConnectionRegistry = Effect.gen(function* () {
+    const images = yield* makeContainerImageSource;
+    const resolve = Effect.fn(function* (options) {
+        const server = trimServer(options.registry.server);
+        // Keep the repository stable across updates; a changed `server` starts
+        // a new one.
+        const repository = options.state?.kind === "registry" &&
+            options.state.server === server &&
+            typeof options.state.repository === "string"
+            ? options.state.repository
+            : `${server}/${yield* createPhysicalName({
+                id: options.id,
+                maxLength: 96,
+                lowercase: true,
+            })}`;
+        const target = {
+            repositoryUri: Effect.succeed(repository),
+            // Generic registries have no cheap existence probe; resolve only runs
+            // when the workload changes, and the local build cache makes a
+            // rebuild of unchanged content fast.
+            hasTag: () => Effect.succeed(false),
+            credentials: Effect.succeed(credentialsOf(options.registry)),
+        };
+        const resolved = yield* images.resolve({
+            id: options.id,
+            source: options.source,
+            platform: options.platform,
+            port: options.port,
+            isExternal: options.isExternal,
+            bootstrap: options.bootstrap,
+            session: options.session,
+        }, target);
+        return {
+            imageUri: resolved.imageUri,
+            codeHash: resolved.codeHash,
+            state: {
+                kind: "registry",
+                server,
+                repository,
+            },
+        };
+    });
+    const hash = (options) => images.hash({
+        source: options.source,
+        platform: options.platform,
+        port: options.port,
+        isExternal: options.isExternal,
+        bootstrap: options.bootstrap,
+    });
+    return { resolve, hash };
+});
+//# sourceMappingURL=registry.js.map

package/lib/internal/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/internal/registry.ts"],"names":[],"mappings":"AACA,OAAO,EACL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D;;;;;;GAMG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,+EAA+E;AAC/E,MAAM,aAAa,GAAG,CAAC,QAA2B,EAAmC,EAAE,CACrF,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS;IAChE,CAAC,CAAC;QACE,mEAAmE;QACnE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE;QACtC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B;IACH,CAAC,CAAC,SAAS,CAAC;AAEhB,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAAC;IAE/C,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OAUpC;QACC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,uEAAuE;QACvE,aAAa;QACb,MAAM,UAAU,GACd,OAAO,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU;YAClC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM;YAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC1C,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU;YAC1B,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBACrC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,IAAI;aAChB,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,GAAwB;YAClC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YACzC,sEAAsE;YACtE,+DAA+D;YAC/D,qCAAqC;YACrC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;SAC7D,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACpC;YACE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,EACD,MAAM,CACP,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE;gBACL,IAAI,EAAE,UAAmB;gBACzB,MAAM;gBACN,UAAU;aACa;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,OAMb,EAAE,EAAE,CACH,MAAM,CAAC,IAAI,CAAC;QACV,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEL,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC,CAAC,CAAC"}

package/lib/internal/workload.d.ts

@@ -0,0 +1,127 @@
+import type { ResourceBinding } from "alchemy/Resource";
+/**
+ * Internal helpers shared by the Kubernetes workload platforms
+ * (`Kubernetes.Deployment`, `Kubernetes.Job`): image-source dispatch
+ * through the cluster adapter, binding-env collection, connection
+ * identity, and the platform-neutral generated container entries.
+ */
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
+import type { ClusterAdapterService, IdentityState, WorkloadBindingContract, WorkloadImageSource } from "../ClusterAdapter.ts";
+import type { ClusterLike, Connection } from "../Connection.ts";
+import type { ConnectionRegistry } from "./registry.ts";
+/**
+ * Structural deep merge: objects merge recursively; arrays and primitives
+ * from `override` replace the base value wholesale. Powers escape hatches
+ * like `Kubernetes.Deployment.podTemplate`.
+ */
+export declare const deepMerge: <T>(base: T, override: unknown) => T;
+/**
+ * The image build platform of a workload: its own `architecture`, else the
+ * connection's node architecture, else `linux/amd64`.
+ */
+export declare const imagePlatformOf: (architecture: "amd64" | "arm64" | undefined, connection?: Connection) => string;
+/**
+ * Best-effort {@link Connection} of a `cluster` prop value — `undefined`
+ * instead of throwing, for plan-time diffs where the referenced resource
+ * may resolve to stables-only (or `{}`).
+ */
+export declare const tryConnectionOf: (cluster: ClusterLike | undefined) => Connection | undefined;
+/**
+ * A stable identity string for a connection's *target cluster* — the auth
+ * descriptor (which names the cluster for managed clouds and the
+ * kubeconfig context otherwise). Changing it means the workload moves
+ * clusters, which is a replacement. Deliberately excludes `endpoint` /
+ * CA: managed clusters can rotate those in place.
+ */
+export declare const connectionIdentity: (connection: Connection | undefined) => string | undefined;
+/**
+ * The persisted connection of a workload's attributes, tolerating legacy
+ * pre-rename rows (`AWS.EKS.*` attributes carried a flat `clusterName`
+ * instead of a `connection`) by synthesizing an `aws-eks` connection —
+ * the only platform those legacy types could target.
+ */
+export declare const connectionOfOutput: (output: Record<string, unknown>) => Connection | undefined;
+/**
+ * Collect environment variables from a host's active bindings and report
+ * which cloud-grant channels (any binding-data key besides `env`, e.g.
+ * AWS `policyStatements`) are in play — the caller fails when grants
+ * exist but the cluster has no identity adapter to materialize them.
+ */
+export declare const collectBindingEnv: (bindings: ResourceBinding<WorkloadBindingContract>[]) => {
+    env: Record<string, any>;
+    grantKeys: string[];
+};
+/**
+ * Kubernetes env values are strings. A {@link Redacted} string stays wrapped
+ * so the request serializer unwraps it. Any other value that holds a secret
+ * is JSON, still wrapped, so a failed apply can scrub the inner strings.
+ */
+export declare const containerEnvValue: (value: unknown) => string | Redacted.Redacted<string>;
+export type ImageSourceKind = "main" | "context" | "image";
+/** Which image source a props bag declares (`main` always wins). */
+export declare const imageSourceKind: (source: WorkloadImageSource) => ImageSourceKind | undefined;
+/**
+ * Content hash for image sources whose identity is computable without a
+ * bundler: `image` (the ref + platform) and `context` (the build-context
+ * directory + Dockerfile content + platform). `main` returns `undefined`
+ * — its hash comes from the bundle output inside the registry adapter.
+ */
+export declare const computeStaticWorkloadImageHash: (source: WorkloadImageSource, platform: string) => Effect.Effect<string | undefined, import("effect/PlatformError").PlatformError, FileSystem.FileSystem | Path.Path>;
+export interface ResolveWorkloadImageOptions {
+    adapter: ClusterAdapterService;
+    /** The target connection — its `registry`, if any, receives builds. */
+    connection: Connection;
+    /** Publisher for connection-level registries. */
+    connectionRegistry: ConnectionRegistry;
+    id: string;
+    source: WorkloadImageSource;
+    platform: string;
+    port?: number | undefined;
+    isExternal?: boolean | undefined;
+    bootstrap: (importPath: string) => string;
+    tags: Record<string, string>;
+    /** Persisted registry state hints (legacy-shape tolerant). */
+    state: Record<string, unknown> | undefined;
+    session: {
+        note: (message: string) => Effect.Effect<void>;
+    };
+}
+/**
+ * Resolve the container image for a workload: through the cluster
+ * adapter's managed registry when it has one (build/mirror + push). Other
+ * clusters run a pre-built `image` reference verbatim and build `main` /
+ * `context` sources into the connection's `registry`, which those sources
+ * require.
+ */
+export declare const resolveWorkloadImage: (options: ResolveWorkloadImageOptions) => Effect.Effect<import("../ClusterAdapter.ts").ImageRegistryResult, any, FileSystem.FileSystem | Path.Path | import("../ClusterAdapter.ts").AdapterLifecycleServices>;
+/** Plan-time content hash for `diff` — adapter-aware. */
+export declare const workloadImageHash: (options: {
+    adapter: ClusterAdapterService;
+    connection: Connection;
+    connectionRegistry: ConnectionRegistry;
+    source: WorkloadImageSource;
+    platform: string;
+    port?: number | undefined;
+    isExternal?: boolean | undefined;
+    bootstrap: (importPath: string) => string;
+}) => Effect.Effect<string | undefined, any, FileSystem.FileSystem | Path.Path | import("../ClusterAdapter.ts").AdapterLifecycleServices>;
+/** The identity-adapter state persisted on workload attributes. */
+export type PersistedIdentityState = IdentityState | undefined;
+/**
+ * Platform-neutral generated container entry for an Effect-native server
+ * workload: resolves the program's registered runners and serves the
+ * returned `{ fetch }` handler on `PORT`. Cloud adapters override this
+ * through {@link ClusterAdapterService.bootstrap} to wire their runtime
+ * credential chains (e.g. EKS Pod Identity).
+ */
+export declare const makeServerBootstrap: (handler: string) => (importPath: string) => string;
+/**
+ * Platform-neutral generated container entry for an Effect-native one-shot
+ * Job: resolves the program's `run` effect, executes it to completion, and
+ * exits.
+ */
+export declare const makeJobBootstrap: (handler: string) => (importPath: string) => string;
+//# sourceMappingURL=workload.d.ts.map

package/lib/internal/workload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload.d.ts","sourceRoot":"","sources":["../../src/internal/workload.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKxD;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EACV,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAkB,MAAM,kBAAkB,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,QAAQ,CAAC,YAAY,OAAO,KAAG,CAoBzD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,iBACZ,OAAO,GAAG,OAAO,GAAG,SAAS,eAC9B,UAAU,KACtB,MACqF,CAAC;AAEzF;;;;GAIG;AACH,eAAO,MAAM,eAAe,YAAa,WAAW,GAAG,SAAS,KAAG,UAAU,GAAG,SAO/E,CAAC;AAaF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,eAAgB,UAAU,GAAG,SAAS,KAAG,MAAM,GAAG,SACK,CAAC;AAEvF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,UAAU,GAAG,SASjF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,aAClB,eAAe,CAAC,uBAAuB,CAAC,EAAE,KACnD;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAqBjD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAAW,OAAO,KAAG,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAQnF,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3D,oEAAoE;AACpE,eAAO,MAAM,eAAe,WAAY,mBAAmB,KAAG,eAAe,GAAG,SAO7D,CAAC;AAEpB;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,uKAkCzC,CAAC;AAEH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,qBAAqB,CAAC;IAC/B,uEAAuE;IACvE,UAAU,EAAE,UAAU,CAAC;IACvB,iDAAiD;IACjD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC3C,OAAO,EAAE;QAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;CAC7D;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,+MA+C/B,CAAC;AAEH,yDAAyD;AACzD,eAAO,MAAM,iBAAiB;aACnB,qBAAqB;gBAClB,UAAU;wBACF,kBAAkB;YAC9B,mBAAmB;cACjB,MAAM;WACT,MAAM,GAAG,SAAS;iBACZ,OAAO,GAAG,SAAS;eACrB,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM;yIAqBzC,CAAC;AAEH,mEAAmE;AAEnE,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,SAAS,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,YACpB,MAAM,kBACH,MAAM,KAAG,MAkFvB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YACjB,MAAM,kBACH,MAAM,KAAG,MA8EvB,CAAC"}

package/lib/internal/workload.js

@@ -0,0 +1,411 @@
+import { isInlineDockerfile } from "@alchemy.run/docker/Dockerfile";
+import { hashDirectory } from "alchemy/Command/Memo";
+import { Self } from "alchemy/Self";
+import { unwrapRedacted } from "alchemy/Util/data";
+import { collectRedactedSecrets } from "alchemy/Util/Redaction";
+import { sha256Object } from "alchemy/Util/sha256";
+/**
+ * Internal helpers shared by the Kubernetes workload platforms
+ * (`Kubernetes.Deployment`, `Kubernetes.Job`): image-source dispatch
+ * through the cluster adapter, binding-env collection, connection
+ * identity, and the platform-neutral generated container entries.
+ */
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
+/**
+ * Structural deep merge: objects merge recursively; arrays and primitives
+ * from `override` replace the base value wholesale. Powers escape hatches
+ * like `Kubernetes.Deployment.podTemplate`.
+ */
+export const deepMerge = (base, override) => {
+    if (override === undefined)
+        return base;
+    if (base === null ||
+        override === null ||
+        typeof base !== "object" ||
+        typeof override !== "object" ||
+        Array.isArray(base) ||
+        Array.isArray(override)) {
+        return override;
+    }
+    const out = { ...base };
+    for (const [key, value] of Object.entries(override)) {
+        out[key] =
+            key in base
+                ? deepMerge(base[key], value)
+                : value;
+    }
+    return out;
+};
+/**
+ * The image build platform of a workload: its own `architecture`, else the
+ * connection's node architecture, else `linux/amd64`.
+ */
+export const imagePlatformOf = (architecture, connection) => (architecture ?? connection?.architecture) === "arm64" ? "linux/arm64" : "linux/amd64";
+/**
+ * Best-effort {@link Connection} of a `cluster` prop value — `undefined`
+ * instead of throwing, for plan-time diffs where the referenced resource
+ * may resolve to stables-only (or `{}`).
+ */
+export const tryConnectionOf = (cluster) => {
+    if (cluster === undefined)
+        return undefined;
+    if ("auth" in cluster && cluster.auth !== undefined)
+        return cluster;
+    if ("connection" in cluster && cluster.connection !== undefined) {
+        return cluster.connection;
+    }
+    return undefined;
+};
+const sortKeysDeep = (value) => {
+    if (Array.isArray(value))
+        return value.map(sortKeysDeep);
+    if (value === null || typeof value !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, entry]) => [key, sortKeysDeep(entry)]));
+};
+/**
+ * A stable identity string for a connection's *target cluster* — the auth
+ * descriptor (which names the cluster for managed clouds and the
+ * kubeconfig context otherwise). Changing it means the workload moves
+ * clusters, which is a replacement. Deliberately excludes `endpoint` /
+ * CA: managed clusters can rotate those in place.
+ */
+export const connectionIdentity = (connection) => connection === undefined ? undefined : JSON.stringify(sortKeysDeep(connection.auth));
+/**
+ * The persisted connection of a workload's attributes, tolerating legacy
+ * pre-rename rows (`AWS.EKS.*` attributes carried a flat `clusterName`
+ * instead of a `connection`) by synthesizing an `aws-eks` connection —
+ * the only platform those legacy types could target.
+ */
+export const connectionOfOutput = (output) => {
+    const connection = output.connection;
+    if (connection?.auth !== undefined)
+        return connection;
+    if (typeof output.clusterName === "string") {
+        return {
+            auth: { kind: "aws-eks", clusterName: output.clusterName },
+        };
+    }
+    return undefined;
+};
+/**
+ * Collect environment variables from a host's active bindings and report
+ * which cloud-grant channels (any binding-data key besides `env`, e.g.
+ * AWS `policyStatements`) are in play — the caller fails when grants
+ * exist but the cluster has no identity adapter to materialize them.
+ */
+export const collectBindingEnv = (bindings) => {
+    const activeBindings = bindings.filter((binding) => binding.action !== "delete");
+    const env = activeBindings
+        .map((binding) => binding?.data?.env)
+        .reduce((acc, value) => ({ ...acc, ...value }), {});
+    const grantKeys = [
+        ...new Set(activeBindings.flatMap((binding) => Object.keys(binding?.data ?? {}).filter((key) => key !== "env" && binding.data[key] !== undefined))),
+    ];
+    return { env, grantKeys };
+};
+/**
+ * Kubernetes env values are strings. A {@link Redacted} string stays wrapped
+ * so the request serializer unwraps it. Any other value that holds a secret
+ * is JSON, still wrapped, so a failed apply can scrub the inner strings.
+ */
+export const containerEnvValue = (value) => {
+    if (typeof value === "string")
+        return value;
+    if (Redacted.isRedacted(value)) {
+        const inner = Redacted.value(value);
+        if (typeof inner === "string")
+            return Redacted.make(inner);
+    }
+    const json = JSON.stringify(unwrapRedacted(value));
+    return collectRedactedSecrets(value).length > 0 ? Redacted.make(json) : json;
+};
+/** Which image source a props bag declares (`main` always wins). */
+export const imageSourceKind = (source) => source.main !== undefined
+    ? "main"
+    : source.image !== undefined
+        ? "image"
+        : source.context !== undefined || source.dockerfile !== undefined
+            ? "context"
+            : undefined;
+/**
+ * Content hash for image sources whose identity is computable without a
+ * bundler: `image` (the ref + platform) and `context` (the build-context
+ * directory + Dockerfile content + platform). `main` returns `undefined`
+ * — its hash comes from the bundle output inside the registry adapter.
+ */
+export const computeStaticWorkloadImageHash = Effect.fn(function* (source, platform) {
+    const kind = imageSourceKind(source);
+    if (kind === "image") {
+        return (yield* sha256Object({ image: source.image, platform })).slice(0, 16);
+    }
+    if (kind === "context") {
+        if (source.dockerfile !== undefined && isInlineDockerfile(source.dockerfile)) {
+            if (typeof source.dockerfile.content !== "string")
+                return undefined;
+            return (yield* sha256Object({ dockerfile: source.dockerfile.content, platform })).slice(0, 16);
+        }
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const context = path.resolve(source.context ?? ".");
+        const dockerfile = typeof source.dockerfile === "string"
+            ? path.resolve(source.dockerfile)
+            : path.join(context, "Dockerfile");
+        if (!(yield* fs.exists(context)) || !(yield* fs.exists(dockerfile))) {
+            return undefined;
+        }
+        const contextHash = yield* hashDirectory({ cwd: context });
+        const dockerfileContent = yield* fs.readFileString(dockerfile);
+        return (yield* sha256Object({ contextHash, dockerfile: dockerfileContent, platform })).slice(0, 16);
+    }
+    return undefined;
+});
+/**
+ * Resolve the container image for a workload: through the cluster
+ * adapter's managed registry when it has one (build/mirror + push). Other
+ * clusters run a pre-built `image` reference verbatim and build `main` /
+ * `context` sources into the connection's `registry`, which those sources
+ * require.
+ */
+export const resolveWorkloadImage = Effect.fn(function* (options) {
+    const { adapter, source } = options;
+    if (adapter.registry !== undefined) {
+        return yield* adapter.registry.resolve({
+            id: options.id,
+            source,
+            platform: options.platform,
+            port: options.port,
+            isExternal: options.isExternal,
+            bootstrap: options.bootstrap,
+            tags: options.tags,
+            state: options.state,
+            session: options.session,
+        });
+    }
+    const kind = imageSourceKind(source);
+    if (kind === "image") {
+        const codeHash = (yield* computeStaticWorkloadImageHash(source, options.platform));
+        return { imageUri: source.image, codeHash, state: undefined };
+    }
+    const registry = options.connection.registry;
+    if (registry !== undefined) {
+        return yield* options.connectionRegistry.resolve({
+            id: options.id,
+            registry,
+            source,
+            platform: options.platform,
+            port: options.port,
+            isExternal: options.isExternal,
+            bootstrap: options.bootstrap,
+            state: options.state,
+            session: options.session,
+        });
+    }
+    return yield* Effect.die(new Error(`'${options.id}': 'main' and 'context' image sources are built and ` +
+        "pushed to a container registry, and this cluster connection has " +
+        "none. Add a `registry` to the connection (e.g. " +
+        '`Kubernetes.KubeConfig({ context, registry: { server: "ghcr.io/acme" } })`), ' +
+        "use `Kubernetes.LocalCluster`, which includes one, or run a " +
+        "pre-built `image` reference the cluster can pull."));
+});
+/** Plan-time content hash for `diff` — adapter-aware. */
+export const workloadImageHash = Effect.fn(function* (options) {
+    if (options.adapter.registry !== undefined) {
+        return yield* options.adapter.registry.hash({
+            source: options.source,
+            platform: options.platform,
+            port: options.port,
+            isExternal: options.isExternal,
+            bootstrap: options.bootstrap,
+        });
+    }
+    if (options.connection.registry !== undefined && imageSourceKind(options.source) === "main") {
+        return yield* options.connectionRegistry.hash({
+            source: options.source,
+            platform: options.platform,
+            port: options.port,
+            isExternal: options.isExternal,
+            bootstrap: options.bootstrap,
+        });
+    }
+    return yield* computeStaticWorkloadImageHash(options.source, options.platform);
+});
+/**
+ * Platform-neutral generated container entry for an Effect-native server
+ * workload: resolves the program's registered runners and serves the
+ * returned `{ fetch }` handler on `PORT`. Cloud adapters override this
+ * through {@link ClusterAdapterService.bootstrap} to wire their runtime
+ * credential chains (e.g. EKS Pod Identity).
+ */
+export const makeServerBootstrap = (handler) => (importPath) => `
+import { BunServices } from "@effect/platform-bun";
+import { BunHttpServer } from "alchemy/Http";
+import { Stack } from "alchemy/Stack";
+import { Stage } from "alchemy/Stage";
+import { makeEntrypointLayer, reifyBoundConfigProvider } from "alchemy/Runtime";
+import { provideProcessTelemetry } from "alchemy/Telemetry";
+import * as Context from "effect/Context";
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+
+import { ${handler} as entrypoint } from ${JSON.stringify(importPath)};
+
+// Normalize the entrypoint export: an inline-effect class default export is
+// an Effect resolving the platform instance, while the tagged form
+// (X.make(props, impl)) exports a Layer providing the Self tag. Both fold
+// into a Layer via makeEntrypointLayer (same pattern as the ECS/Lambda/
+// Cloudflare Container bridges).
+const tag = Context.Service("${Self.key}");
+const layer = makeEntrypointLayer(tag, entrypoint);
+
+const platform = Layer.mergeAll(
+  BunServices.layer,
+  FetchHttpClient.layer,
+  Logger.layer([Logger.consolePretty()]),
+);
+
+// Resolve the bundled program (the runners registered via host.run / serve)
+// and run it with a Bun HTTP server bound to PORT, so a returned { fetch }
+// handler is served and host.run loops stay alive.
+const program = tag.pipe(
+  // Process-lifetime telemetry: built once into the root scope; exporters
+  // batch on their intervals and flush when the scope closes on graceful
+  // shutdown.
+  Effect.flatMap((host) =>
+    host.RuntimeContext.exports.pipe(
+      Effect.flatMap((exports) => exports.program),
+      provideProcessTelemetry(host.RuntimeContext),
+    ),
+  ),
+  Effect.provide(
+    layer.pipe(Layer.provideMerge(Layer.mergeAll(
+      Layer.effect(
+        Stack,
+        Effect.all([
+          Config.String("ALCHEMY_STACK_NAME"),
+          Config.String("ALCHEMY_STAGE")
+        ]).pipe(
+          Effect.map(([name, stage]) => ({
+            name,
+            stage,
+            bindings: {},
+            resources: {}
+          }))
+        )
+      ),
+      // Module-scope declarations shared with the Stack may read the stage.
+      Layer.effect(Stage, Config.String("ALCHEMY_STAGE")),
+    )),
+      Layer.provideMerge(BunHttpServer()),
+      Layer.provideMerge(platform),
+      Layer.provideMerge(
+        Layer.succeed(
+          ConfigProvider.ConfigProvider,
+          reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env)
+        )
+      ),
+    )
+  ),
+  Effect.scoped
+);
+
+console.log(\`Kubernetes Deployment bootstrap starting on port \${process.env.PORT ?? 3000}...\`);
+await Effect.runPromise(program).catch((err) => {
+  console.error("Kubernetes Deployment bootstrap failed:", err);
+  process.exit(1);
+});
+`;
+/**
+ * Platform-neutral generated container entry for an Effect-native one-shot
+ * Job: resolves the program's `run` effect, executes it to completion, and
+ * exits.
+ */
+export const makeJobBootstrap = (handler) => (importPath) => `
+import { BunServices } from "@effect/platform-bun";
+import { Stack } from "alchemy/Stack";
+import { Stage } from "alchemy/Stage";
+import { makeEntrypointLayer, reifyBoundConfigProvider } from "alchemy/Runtime";
+import { provideProcessTelemetry } from "alchemy/Telemetry";
+import * as Context from "effect/Context";
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+
+import { ${handler} as entrypoint } from ${JSON.stringify(importPath)};
+
+// Normalize the entrypoint export (see the server bootstrap).
+const tag = Context.Service("${Self.key}");
+const layer = makeEntrypointLayer(tag, entrypoint);
+
+const platform = Layer.mergeAll(
+  BunServices.layer,
+  FetchHttpClient.layer,
+  Logger.layer([Logger.consolePretty()]),
+);
+
+// Resolve the bundled program's registered one-shot runners (the shape's
+// \`run\` effect and any host.run work) and execute them to completion.
+const program = tag.pipe(
+  // Process-lifetime telemetry: built once into the root scope; exporters
+  // batch on their intervals and flush when the scope closes as the
+  // one-shot program completes.
+  Effect.flatMap((host) =>
+    host.RuntimeContext.exports.pipe(
+      Effect.flatMap((exports) => exports.program),
+      provideProcessTelemetry(host.RuntimeContext),
+    ),
+  ),
+  Effect.provide(
+    layer.pipe(Layer.provideMerge(Layer.mergeAll(
+      Layer.effect(
+        Stack,
+        Effect.all([
+          Config.String("ALCHEMY_STACK_NAME"),
+          Config.String("ALCHEMY_STAGE")
+        ]).pipe(
+          Effect.map(([name, stage]) => ({
+            name,
+            stage,
+            bindings: {},
+            resources: {}
+          }))
+        )
+      ),
+      // Module-scope declarations shared with the Stack may read the stage.
+      Layer.effect(Stage, Config.String("ALCHEMY_STAGE")),
+    )),
+      Layer.provideMerge(platform),
+      Layer.provideMerge(
+        Layer.succeed(
+          ConfigProvider.ConfigProvider,
+          reifyBoundConfigProvider(ConfigProvider.fromEnv(), process.env)
+        )
+      ),
+    )
+  ),
+  Effect.scoped
+);
+
+console.log("Kubernetes Job bootstrap starting...");
+await Effect.runPromise(program).catch((err) => {
+  console.error("Kubernetes Job bootstrap failed:", err);
+  process.exit(1);
+});
+// Run-to-completion semantics: exit 0 explicitly so lingering handles
+// (sockets, timers) never keep the pod alive after the work is done.
+process.exit(0);
+`;
+//# sourceMappingURL=workload.js.map

package/lib/internal/workload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload.js","sourceRoot":"","sources":["../../src/internal/workload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAU5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAI,IAAO,EAAE,QAAiB,EAAK,EAAE;IAC5D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IACE,IAAI,KAAK,IAAI;QACb,QAAQ,KAAK,IAAI;QACjB,OAAO,IAAI,KAAK,QAAQ;QACxB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACnB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,CAAC;QACD,OAAO,QAAa,CAAC;IACvB,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,GAAI,IAAgC,EAAE,CAAC;IAC9E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC;YACN,GAAG,IAAK,IAAgC;gBACtC,CAAC,CAAC,SAAS,CAAE,IAAgC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;gBAC1D,CAAC,CAAC,KAAK,CAAC;IACd,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,YAA2C,EAC3C,UAAuB,EACf,EAAE,CACV,CAAC,YAAY,IAAI,UAAU,EAAE,YAAY,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;AAEzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAgC,EAA0B,EAAE;IAC1F,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,MAAM,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACpE,IAAI,YAAY,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,OAAO,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAc,EAAW,EAAE;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAAkC,EAAsB,EAAE,CAC3F,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA+B,EAA0B,EAAE;IAC5F,MAAM,UAAU,GAAG,MAAM,CAAC,UAAoC,CAAC;IAC/D,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IACtD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO;YACL,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAA+B;SACxF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,QAAoD,EACD,EAAE;IACrD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CACpC,CAAC,OAAuE,EAAE,EAAE,CAC1E,OAAO,CAAC,MAAM,KAAK,QAAQ,CAC9B,CAAC;IAEF,MAAM,GAAG,GAAG,cAAc;SACvB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;SACpC,MAAM,CAAsB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG;QAChB,GAAG,IAAI,GAAG,CACR,cAAc,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACjC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CACrC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,IAAK,OAAO,CAAC,IAAgC,CAAC,GAAG,CAAC,KAAK,SAAS,CACvF,CACF,CACF;KACF,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5B,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAsC,EAAE;IACtF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC,CAAC;AAIF,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAA2B,EAA+B,EAAE,CAC1F,MAAM,CAAC,IAAI,KAAK,SAAS;IACvB,CAAC,CAAC,MAAM;IACR,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;QAC1B,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAC/D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC;AAEpB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC/D,MAA2B,EAC3B,QAAgB;IAEhB,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7E,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACpE,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CACrF,CAAC,EACD,EAAE,CACH,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;QACpD,MAAM,UAAU,GACd,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACnC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC/D,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAC1F,CAAC,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC,CAAC;AAoBH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAoC;IAC3F,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YACrC,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,8BAA8B,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAE,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC;YAC/C,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,QAAQ;YACR,MAAM;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,KAAK,CACP,IAAI,OAAO,CAAC,EAAE,sDAAsD;QAClE,kEAAkE;QAClE,iDAAiD;QACjD,+EAA+E;QAC/E,8DAA8D;QAC9D,mDAAmD,CACtD,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OASrD;IACC,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5F,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,8BAA8B,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC;AAMH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,CAAC,OAAe,EAAE,EAAE,CACpB,CAAC,UAAkB,EAAU,EAAE,CAC7B;;;;;;;;;;;;;;;WAeO,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;;;;;;;+BAOtC,IAAI,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DtC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,CAAC,OAAe,EAAE,EAAE,CACpB,CAAC,UAAkB,EAAU,EAAE,CAC7B;;;;;;;;;;;;;;WAcO,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;;;+BAGtC,IAAI,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4DtC,CAAC"}