@cat-factory/contracts 0.283.0 → 0.284.0

package/dist/environments-kubernetes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments-kubernetes.d.ts","sourceRoot":"","sources":["../src/environments-kubernetes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AA0B5B,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,aAAa,CAAA;AAmBzD;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,mDAAmC,CAAA;AACxE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B;;IAGvC,8EAA8E;;;;;IAM9E,0CAA0C;;IAE1C,sEAAsE;;IAEtE,wDAAwD;;;0BAI1D,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,8BAA8B,CAAC,CAAA;AAE3F,yEAAyE;AACzE,eAAO,MAAM,yBAAyB;;IAGlC,8FAA8F;;;;;IAM9F,6FAA6F;;;;;IAM7F,0EAA0E;;;;;;IAO1E,+FAA+F;;;;;IAM/F,oGAAoG;;;0BAItG,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAE5F;AAMD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC;IAC3C,uEAAuE;;IAEvE,4FAA4F;;IAE5F,sFAAsF;;aAEtF,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAE/F,eAAO,MAAM,iCAAiC;IAT5C,uEAAuE;;IAEvE,4FAA4F;;IAE5F,sFAAsF;;IAOtF,wDAAwD;;IAExD;;;;OAIG;;IAEH,yFAAyF;;;QA1GvF,8EAA8E;;;;;QAM9E,0CAA0C;;QAE1C,sEAAsE;;QAEtE,wDAAwD;;;;IAkG1D,uDAAuD;;;QAvFrD,8FAA8F;;;;;QAM9F,6FAA6F;;;;;QAM7F,0EAA0E;;;;;;QAO1E,+FAA+F;;;;;QAM/F,oGAAoG;;;;IAgEtG;;;OAGG;;IAEH,kEAAkE;;IAElE;;;;OAIG;;IAEH,sEAAsE;;IAEtE,kDAAkD;;aAElD,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAYjG;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;IAEtC,gGAAgG;;IAEhG,6EAA6E;;IAE7E,kGAAkG;;IAElG,2DAA2D;;;;;;;;;;;;sFAc9D,CAAA;AACD,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEzF,gEAAgE;AAChE,eAAO,MAAM,uBAAuB;IAClC,4DAA4D;;IAE5D,oDAAoD;;aAEpD,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE7E;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;IACtC,oBAAoB;;IAEpB,8EAA8E;;IAE9E,sDAAsD;;IAEtD,mGAAmG;;IAEnG,gFAAgF;;IAEhF,mCAAmC;;IAEnC,mCAAmC;;QA1BnC,4DAA4D;;QAE5D,oDAAoD;;;IA0BpD,yFAAyF;;;;;;;;aAKzF,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF,6GAA6G;AAC7G,eAAO,MAAM,2BAA2B;IAEpC,+CAA+C;;IAE/C,oEAAoE;;;;IAEpE,gEAAgE;;;;;;;;0EAOnE,CAAA;AACD,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,+BAA+B;;IAGxC,2CAA2C;;IAE3C,wCAAwC;;;QAjCxC,+CAA+C;;QAE/C,oEAAoE;;;;QAEpE,gEAAgE;;;;;;;;;;;IAmChE;;;;OAIG;;;QA3CH,+CAA+C;;QAE/C,oEAAoE;;;;QAEpE,gEAAgE;;;;;;;;;0BA2ClE,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B;IAzL1C,uEAAuE;;IAEvE,4FAA4F;;IAE5F,sFAAsF;;IAOtF,wDAAwD;;IAExD;;;;OAIG;;IAEH,yFAAyF;;;QA1GvF,8EAA8E;;;;;QAM9E,0CAA0C;;QAE1C,sEAAsE;;QAEtE,wDAAwD;;;;IAkG1D,uDAAuD;;;QAvFrD,8FAA8F;;;;;QAM9F,6FAA6F;;;;;QAM7F,0EAA0E;;;;;;QAO1E,+FAA+F;;;;;QAM/F,oGAAoG;;;;IAgEtG;;;OAGG;;IAEH,kEAAkE;;IAElE;;;;OAIG;;IAEH,sEAAsE;;IAEtE,kDAAkD;;IAqJlD,iGAAiG;;QA9H/F,gGAAgG;;QAEhG,6EAA6E;;QAE7E,kGAAkG;;QAElG,2DAA2D;;;;;;;;;;;;;IA0H7D,qGAAqG;;QAzFrG,oBAAoB;;QAEpB,8EAA8E;;QAE9E,sDAAsD;;QAEtD,mGAAmG;;QAEnG,gFAAgF;;QAEhF,mCAAmC;;QAEnC,mCAAmC;;YA1BnC,4DAA4D;;YAE5D,oDAAoD;;;QA0BpD,yFAAyF;;;;;;;;;IA6EzF,uFAAuF;;;QAnCrF,2CAA2C;;QAE3C,wCAAwC;;;YAjCxC,+CAA+C;;YAE/C,oEAAoE;;;;YAEpE,gEAAgE;;;;;;;;;;;QAmChE;;;;WAIG;;;YA3CH,+CAA+C;;YAE/C,oEAAoE;;;;YAEpE,gEAAgE;;;;;;;;;;aAgElE,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;IA1MnC,uEAAuE;;IAEvE,4FAA4F;;IAE5F,sFAAsF;;IAOtF,wDAAwD;;IAExD;;;;OAIG;;IAEH,yFAAyF;;;QA1GvF,8EAA8E;;;;;QAM9E,0CAA0C;;QAE1C,sEAAsE;;QAEtE,wDAAwD;;;;IAkG1D,uDAAuD;;;QAvFrD,8FAA8F;;;;;QAM9F,6FAA6F;;;;;QAM7F,0EAA0E;;;;;;QAO1E,+FAA+F;;;;;QAM/F,oGAAoG;;;;IAgEtG;;;OAGG;;IAEH,kEAAkE;;IAElE;;;;OAIG;;IAEH,sEAAsE;;IAEtE,kDAAkD;;IAqJlD,iGAAiG;;QA9H/F,gGAAgG;;QAEhG,6EAA6E;;QAE7E,kGAAkG;;QAElG,2DAA2D;;;;;;;;;;;;;IA0H7D,qGAAqG;;QAzFrG,oBAAoB;;QAEpB,8EAA8E;;QAE9E,sDAAsD;;QAEtD,mGAAmG;;QAEnG,gFAAgF;;QAEhF,mCAAmC;;QAEnC,mCAAmC;;YA1BnC,4DAA4D;;YAE5D,oDAAoD;;;QA0BpD,yFAAyF;;;;;;;;;IA6EzF,uFAAuF;;;QAnCrF,2CAA2C;;QAE3C,wCAAwC;;;YAjCxC,+CAA+C;;YAE/C,oEAAoE;;;;YAEpE,gEAAgE;;;;;;;;;;;QAmChE;;;;WAIG;;;YA3CH,+CAA+C;;YAE/C,oEAAoE;;;;YAEpE,gEAAgE;;;;;;;;;;aA4ElE,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE/E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;;;;IArNpC,uEAAuE;;IAEvE,4FAA4F;;IAE5F,sFAAsF;;aAoNtF,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA"}

package/dist/environments-kubernetes.js

@@ -0,0 +1,306 @@
+import * as v from 'valibot';
+import { eksClusterFieldsSchema, environmentSecretRefSchema, nonEmpty, urlString, } from './primitives.js';
+// The native Kubernetes ephemeral-environment backend's wire contracts, plus the EKS superset
+// that reuses every one of them. Split out of `environments.ts`, which had grown past its size
+// budget: this is the one block in it that is about a SINGLE backend's config rather than about
+// the environment model every backend shares, and `environments.ts` re-exports nothing of it —
+// the package index exports both files, so an importer sees one surface either way.
+// ---------------------------------------------------------------------------
+// Kubernetes ephemeral-environment backend.
+//
+// A native backend that deploys an operator-authored set of k3s/Kubernetes
+// manifests into a per-PR namespace, reached over the kube-apiserver via HTTPS
+// (the same client the Kubernetes RUNNER backend uses). Unlike the manifest
+// HTTP provider, this is NOT a declarative HTTP template: the apiserver is driven
+// directly. The ServiceAccount bearer token lives in the encrypted secret bundle
+// (key `apiToken`, shared with the runner backend); everything non-secret is
+// config here.
+// ---------------------------------------------------------------------------
+/** The secret-bundle key the Kubernetes env backend reads the ServiceAccount token from. */
+export const KUBERNETES_ENV_TOKEN_SECRET_KEY = 'apiToken';
+/** A `{{var}}`-templated string rendered against the provision vars. */
+const templateString = v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(500));
+/**
+ * A PINNED helm chart version: an exact SemVer (optionally `v`-prefixed, with optional
+ * pre-release / build metadata). Floating tags (`latest`, `*`, `^1.0`, `1.x`, ranges) are
+ * rejected so provisioning is deterministic.
+ */
+const pinnedChartVersion = v.pipe(v.string(), v.trim(), v.regex(/^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/, 'version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.'));
+/**
+ * How the manifests at `path` are turned into apiserver-ready resources. `raw` (the
+ * default, and the only one the in-Worker native REST adapter handles) treats `path` as
+ * a single manifest file or a flat directory of already-valid YAML docs. `kustomize`
+ * treats `path` as an overlay directory (`kustomization.yaml` + `resources`/`components`/
+ * `bases`) that must be `kustomize build`-rendered before apply — which only the
+ * container-backed deploy adapter can do (it shells out to real `kustomize`/`helm`).
+ */
+export const kubernetesRendererSchema = v.picklist(['raw', 'kustomize']);
+/**
+ * Where the per-PR manifests are read from. `colocated` reads them from the block's
+ * own repo at the PR head branch; `separate` reads them from a different repo (the
+ * Kubernetes definition often lives outside the service repo). `renderer` (absent ⇒
+ * `raw`) selects how `path` is turned into resources; `kustomize` requires the
+ * container-backed deploy adapter.
+ */
+export const kubernetesManifestSourceSchema = v.variant('type', [
+    v.object({
+        type: v.literal('colocated'),
+        /** File or directory path within the PR repo (read at the PR head branch). */
+        path: v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(500)),
+        renderer: v.optional(kubernetesRendererSchema),
+    }),
+    v.object({
+        type: v.literal('separate'),
+        /** `owner/repo` of the manifests repo. */
+        repo: v.pipe(v.string(), v.trim(), v.regex(/^[^/\s]+\/[^/\s]+$/, 'must be "owner/repo"')),
+        /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+        ref: v.optional(v.pipe(v.string(), v.trim(), v.minLength(1))),
+        /** File or directory path within the manifests repo. */
+        path: v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(500)),
+        renderer: v.optional(kubernetesRendererSchema),
+    }),
+]);
+/** How the environment URL is derived once the manifests are applied. */
+export const kubernetesUrlSourceSchema = v.variant('source', [
+    v.object({
+        source: v.literal('ingressTemplate'),
+        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+        hostTemplate: v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(500)),
+        scheme: v.optional(v.picklist(['http', 'https'])),
+    }),
+    v.object({
+        source: v.literal('ingressStatus'),
+        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+        ingressName: v.optional(v.pipe(v.string(), v.trim(), v.minLength(1))),
+        scheme: v.optional(v.picklist(['http', 'https'])),
+    }),
+    v.object({
+        source: v.literal('serviceStatus'),
+        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+        serviceName: v.pipe(v.string(), v.trim(), v.minLength(1)),
+        port: v.optional(v.pipe(v.number(), v.integer(), v.minValue(1), v.maxValue(65535))),
+        scheme: v.optional(v.picklist(['http', 'https'])),
+    }),
+    v.object({
+        source: v.literal('gatewayStatus'),
+        /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+        gatewayName: v.optional(v.pipe(v.string(), v.trim(), v.minLength(1))),
+        scheme: v.optional(v.picklist(['http', 'https'])),
+    }),
+    v.object({
+        source: v.literal('httpRouteStatus'),
+        /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+        httpRouteName: v.optional(v.pipe(v.string(), v.trim(), v.minLength(1))),
+        scheme: v.optional(v.picklist(['http', 'https'])),
+    }),
+]);
+/**
+ * Whether a stored value is still a `source` this build knows how to derive a URL from —
+ * DERIVED from the variant's own members, so it cannot drift from them the way a second
+ * hand-written list would (the {@link isBinaryModality} treatment, for the same reason).
+ *
+ * The discriminant is a closed vocabulary that is nonetheless PERSISTED, on every stored
+ * Kubernetes environment config. A reader that maps it through an exhaustive `switch` is
+ * therefore total against the TYPE and partial against the DATA: a config written by a
+ * deployment that knows a source this one does not falls off the end of every branch. Narrow
+ * with this before assigning a stored value anywhere the exhaustive switch will see it.
+ */
+export function isKubernetesUrlSource(value) {
+    return typeof value === 'string' && KUBERNETES_URL_SOURCES.has(value);
+}
+const KUBERNETES_URL_SOURCES = new Set(kubernetesUrlSourceSchema.options.map((option) => option.entries.source.literal));
+/**
+ * What it takes to REACH a cluster's apiserver, split out of the full config below.
+ *
+ * Standing an environment up needs the whole config; reclaiming one needs only this. That
+ * split is load-bearing rather than cosmetic: a stored config is re-parsed on the way out
+ * ({@link parseStoredProviderConfig}), so a `manifestSource` or `url` block that stopped
+ * matching the contract would otherwise refuse the teardown too, and an environment nobody
+ * can reclaim goes on costing money until a human notices. Teardown validates what it uses
+ * and nothing else, so drift in the provisioning half can never strand a live namespace.
+ *
+ * `apiServerUrl` is not in that forgiving set, deliberately: it stays REQUIRED because there is
+ * no safe default for "which cluster", and a DELETE aimed at a guessed one is worse than a
+ * refusal.
+ */
+export const kubernetesConnectionConfigSchema = v.object({
+    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+    apiServerUrl: urlString,
+    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+    caCertPem: v.optional(v.string()),
+    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+    insecureSkipTlsVerify: v.optional(v.boolean()),
+});
+export const kubernetesEnvironmentConfigSchema = v.object({
+    ...kubernetesConnectionConfigSchema.entries,
+    /** Human label for the connection (shown in the UI). */
+    label: v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(120)),
+    /**
+     * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+     * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+     * default derived from the PR number / block id.
+     */
+    namespaceTemplate: v.optional(v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(200))),
+    /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+    manifestSource: kubernetesManifestSourceSchema,
+    /** How the environment URL is derived once applied. */
+    url: kubernetesUrlSourceSchema,
+    /**
+     * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+     * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+     */
+    imageTemplate: v.optional(v.pipe(v.string(), v.trim(), v.maxLength(500))),
+    /** Fallback TTL (ms) after which the env is swept + torn down. */
+    defaultTtlMs: v.optional(v.pipe(v.number(), v.minValue(60000))),
+    /**
+     * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+     * before reporting the env still `provisioning` (the backend keeps polling). Only the
+     * container-backed render path honors it; absent ⇒ the harness default (180s).
+     */
+    rolloutTimeoutSeconds: v.optional(v.pipe(v.number(), v.integer(), v.minValue(1))),
+    /** Extra labels stamped on the namespace + every applied resource. */
+    labels: v.optional(v.record(v.string(), v.string())),
+    /** Extra annotations stamped on the namespace. */
+    annotations: v.optional(v.record(v.string(), v.string())),
+});
+// ---------------------------------------------------------------------------
+// Kustomize / Helm render inputs (container-backed deploy adapter only).
+//
+// These ride a service's provisioning (the "what/where") and are consumed by the
+// container deploy adapter, which runs real `kubectl`/`kustomize`/`helm`. The native
+// in-Worker REST adapter ignores them (raw manifests only). Values for any `secretRef`
+// resolve from the workspace encrypted bundle at provision time — the config carries
+// secret KEYS, never values (the same invariant the manifest-HTTP provider enforces).
+// ---------------------------------------------------------------------------
+/**
+ * A structured image override (the kustomize `images:` equivalent, generalizing the
+ * legacy `{{image}}` text substitution). Matches a container image by `name` and
+ * overrides its repo and/or tag/digest; the override values are templated over the
+ * provision vars (e.g. `newTagTemplate: '{{branch}}'`).
+ */
+export const kubernetesImageOverrideSchema = v.pipe(v.object({
+    /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+    name: nonEmpty,
+    /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+    newNameTemplate: v.optional(templateString),
+    /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+    newTagTemplate: v.optional(templateString),
+    /** Replacement digest, templated; alternative to a tag. */
+    digestTemplate: v.optional(templateString),
+}), v.check((o) => o.newNameTemplate !== undefined ||
+    o.newTagTemplate !== undefined ||
+    o.digestTemplate !== undefined, 'an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.'), v.check((o) => !(o.newTagTemplate !== undefined && o.digestTemplate !== undefined), 'newTagTemplate and digestTemplate are mutually exclusive on an image override.'));
+/** A single templated `--set path=value` for a helm release. */
+export const kubernetesHelmSetSchema = v.object({
+    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+    path: nonEmpty,
+    /** The value, templated over the provision vars. */
+    valueTemplate: v.pipe(v.string(), v.trim(), v.maxLength(2000)),
+});
+/**
+ * A helm release the deploy adapter installs/upgrades (`helm upgrade --install`).
+ * `scope: 'shared'` is a cluster singleton (installed once, never torn down per-PR —
+ * e.g. an ingress/gateway controller); `per-environment` (the default) re-installs in
+ * each per-PR namespace. The `version` pin is required so provisioning is deterministic.
+ */
+export const kubernetesHelmReleaseSchema = v.object({
+    /** Release name. */
+    name: nonEmpty,
+    /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+    chart: nonEmpty,
+    /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+    repo: v.optional(urlString),
+    /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+    version: pinnedChartVersion,
+    /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+    namespaceTemplate: v.optional(templateString),
+    /** Inline `--values` overrides. */
+    values: v.optional(v.record(v.string(), v.unknown())),
+    /** Templated `--set` overrides. */
+    set: v.optional(v.array(kubernetesHelmSetSchema)),
+    /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+    valuesSecretRefs: v.optional(v.array(v.object({ path: nonEmpty, secretRef: environmentSecretRefSchema }))),
+    scope: v.optional(v.picklist(['per-environment', 'shared'])),
+});
+/** One entry inside an injected Secret: a logical key mapped to a secret-bundle ref OR a templated value. */
+export const kubernetesSecretEntrySchema = v.pipe(v.object({
+    /** Key inside the rendered Secret / `.env`. */
+    key: v.pipe(v.string(), v.regex(/^[A-Za-z0-9_.-]+$/), v.minLength(1), v.maxLength(256)),
+    /** Resolve the value from the workspace encrypted bundle by key. */
+    secretRef: v.optional(environmentSecretRefSchema),
+    /** OR a non-secret value, templated over the provision vars. */
+    valueTemplate: v.optional(v.pipe(v.string(), v.maxLength(2000))),
+}), v.check((e) => (e.secretRef === undefined) !== (e.valueTemplate === undefined), 'a secret entry must set exactly one of secretRef or valueTemplate.'));
+/**
+ * How the deploy adapter feeds resolved secret values in before apply, discriminated by
+ * `mode`. The mapping of logical keys is in-repo intent; the values resolve from the
+ * encrypted bundle at provision time (the config carries secret KEYS, never values).
+ *
+ * - `secret`: materialize a `Secret` resource named `secretName` directly in the namespace.
+ * - `generatorEnvFile`: write the entries as a `KEY=value` `.env` file at `envFilePath`
+ *   (repo-relative, inside the overlay tree) BEFORE `kustomize build`, so the overlay's own
+ *   existing `secretGenerator` consumes it. This is the common ephemeral-environment shape
+ *   where a Component declares `secretGenerator: { envs: ['.env'] }`, the Secret is named by
+ *   the overlay, and the real `.env` is supplied at deploy time (e.g. from a secrets manager).
+ *   Use this instead of `secret` when the manifests already declare a `secretGenerator`, so
+ *   the two don't collide.
+ */
+export const kubernetesSecretInjectionSchema = v.variant('mode', [
+    v.object({
+        mode: v.literal('secret'),
+        /** Target Secret name in the namespace. */
+        secretName: nonEmpty,
+        /** Secret `type`; absent ⇒ `Opaque`. */
+        secretType: v.optional(nonEmpty),
+        entries: v.array(kubernetesSecretEntrySchema),
+    }),
+    v.object({
+        mode: v.literal('generatorEnvFile'),
+        /**
+         * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+         * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+         * overlay names the Secret.
+         */
+        envFilePath: v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(500)),
+        entries: v.array(kubernetesSecretEntrySchema),
+    }),
+]);
+/**
+ * The full Kubernetes provision config the deploy adapter consumes: the combined cluster +
+ * URL + manifest-source config PLUS the kustomize/helm render inputs (image overrides, helm
+ * releases, secret injections). It is assembled at provision time by MERGING the workspace
+ * kube engine config (the "how": apiserver, sizing, shared helm releases) with the service's
+ * own provisioning (the "what/where": manifest source, per-environment helm releases, image
+ * overrides, secret injections) — so the provider reads everything it needs from one place.
+ * The native in-Worker REST adapter ignores the render fields (raw manifests only); the
+ * container-backed deploy adapter consumes them. Carries secret KEYS, never values.
+ */
+export const kubernetesProvisionConfigSchema = v.object({
+    ...kubernetesEnvironmentConfigSchema.entries,
+    /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+    images: v.optional(v.array(kubernetesImageOverrideSchema)),
+    /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+    helmReleases: v.optional(v.array(kubernetesHelmReleaseSchema)),
+    /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+    secretInjections: v.optional(v.array(kubernetesSecretInjectionSchema)),
+});
+/**
+ * The AWS EKS provision config: the full Kubernetes provision config (an EKS apiserver is a
+ * standard apiserver, so per-PR namespaces + manifest apply are identical) PLUS the AWS
+ * `region` + `clusterName` needed to mint the IAM apiserver token. The AWS credentials ride
+ * the secret bundle; the SigV4/STS minting lives in `@cat-factory/eks`.
+ */
+export const eksProvisionConfigSchema = v.object({
+    ...kubernetesProvisionConfigSchema.entries,
+    ...eksClusterFieldsSchema.entries,
+});
+/**
+ * The EKS counterpart of {@link kubernetesConnectionConfigSchema}: what it takes to reach the
+ * cluster, which on EKS includes the AWS coordinates the apiserver token is minted against.
+ * Same split, same reason — a reclaim validates the connection and not the provisioning recipe.
+ */
+export const eksConnectionConfigSchema = v.object({
+    ...kubernetesConnectionConfigSchema.entries,
+    ...eksClusterFieldsSchema.entries,
+});
+//# sourceMappingURL=environments-kubernetes.js.map

package/dist/environments-kubernetes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments-kubernetes.js","sourceRoot":"","sources":["../src/environments-kubernetes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,QAAQ,EACR,SAAS,GACV,MAAM,iBAAiB,CAAA;AAExB,8FAA8F;AAC9F,+FAA+F;AAC/F,gGAAgG;AAChG,+FAA+F;AAC/F,oFAAoF;AAEpF,8EAA8E;AAC9E,4CAA4C;AAC5C,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,kFAAkF;AAClF,iFAAiF;AACjF,6EAA6E;AAC7E,eAAe;AACf,8EAA8E;AAE9E,4FAA4F;AAC5F,MAAM,CAAC,MAAM,+BAA+B,GAAG,UAAU,CAAA;AAEzD,wEAAwE;AACxE,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;AAErF;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,KAAK,CACL,4DAA4D,EAC5D,uFAAuF,CACxF,CACF,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAA;AAGxE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE;IAC9D,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,8EAA8E;QAC9E,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KAC/C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3B,0CAA0C;QAC1C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;QACzF,sEAAsE;QACtE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,wDAAwD;QACxD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KAC/C,CAAC;CACH,CAAC,CAAA;AAGF,yEAAyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;IAC3D,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,8FAA8F;QAC9F,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5E,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAClD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QAClC,6FAA6F;QAC7F,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAClD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QAClC,0EAA0E;QAC1E,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAClD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QAClC,+FAA+F;QAC/F,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAClD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,oGAAoG;QACpG,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAClD,CAAC;CACH,CAAC,CAAA;AAGF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CACzD,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CACjF,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,uEAAuE;IACvE,YAAY,EAAE,SAAS;IACvB,4FAA4F;IAC5F,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,sFAAsF;IACtF,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAC/C,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,GAAG,gCAAgC,CAAC,OAAO;IAC3C,wDAAwD;IACxD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrE;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,yFAAyF;IACzF,cAAc,EAAE,8BAA8B;IAC9C,uDAAuD;IACvD,GAAG,EAAE,yBAAyB;IAC9B;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,kEAAkE;IAClE,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D;;;;OAIG;IACH,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,sEAAsE;IACtE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,kDAAkD;IAClD,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;CAC1D,CAAC,CAAA;AAGF,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,iFAAiF;AACjF,qFAAqF;AACrF,uFAAuF;AACvF,qFAAqF;AACrF,sFAAsF;AACtF,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CACjD,CAAC,CAAC,MAAM,CAAC;IACP,gGAAgG;IAChG,IAAI,EAAE,QAAQ;IACd,6EAA6E;IAC7E,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;IAC3C,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;IAC1C,2DAA2D;IAC3D,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;CAC3C,CAAC,EACF,CAAC,CAAC,KAAK,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,eAAe,KAAK,SAAS;IAC/B,CAAC,CAAC,cAAc,KAAK,SAAS;IAC9B,CAAC,CAAC,cAAc,KAAK,SAAS,EAChC,gGAAgG,CACjG,EACD,CAAC,CAAC,KAAK,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EAC1E,gFAAgF,CACjF,CACF,CAAA;AAGD,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4DAA4D;IAC5D,IAAI,EAAE,QAAQ;IACd,oDAAoD;IACpD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;CAC/D,CAAC,CAAA;AAGF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,oBAAoB;IACpB,IAAI,EAAE,QAAQ;IACd,8EAA8E;IAC9E,KAAK,EAAE,QAAQ;IACf,sDAAsD;IACtD,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC3B,mGAAmG;IACnG,OAAO,EAAE,kBAAkB;IAC3B,gFAAgF;IAChF,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;IAC7C,mCAAmC;IACnC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACrD,mCAAmC;IACnC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACjD,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAC1B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAC7E;IACD,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC;CAC7D,CAAC,CAAA;AAGF,6GAA6G;AAC7G,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAC/C,CAAC,CAAC,MAAM,CAAC;IACP,+CAA+C;IAC/C,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvF,oEAAoE;IACpE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IACjD,gEAAgE;IAChE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;CACjE,CAAC,EACF,CAAC,CAAC,KAAK,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,EACtE,oEAAoE,CACrE,CACF,CAAA;AAGD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE;IAC/D,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,2CAA2C;QAC3C,UAAU,EAAE,QAAQ;QACpB,wCAAwC;QACxC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;KAC9C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACnC;;;;WAIG;QACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;KAC9C,CAAC;CACH,CAAC,CAAA;AAGF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,GAAG,iCAAiC,CAAC,OAAO;IAC5C,iGAAiG;IACjG,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,qGAAqG;IACrG,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9D,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;CACvE,CAAC,CAAA;AAGF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,+BAA+B,CAAC,OAAO;IAC1C,GAAG,sBAAsB,CAAC,OAAO;CAClC,CAAC,CAAA;AAGF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,gCAAgC,CAAC,OAAO;IAC3C,GAAG,sBAAsB,CAAC,OAAO;CAClC,CAAC,CAAA"}