@microagi/alchemy-gcp 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -4,6 +4,53 @@ All notable changes to `@microagi/alchemy-gcp`. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this package
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.7.0 — 2026-06-16
+
+### Added
+
+- **`GCP.KubernetesManifest`** — generic Alchemy resource for *any*
+  Kubernetes Kind/CRD, server-side-applied via
+  `Content-Type: application/apply-patch+yaml` with `fieldManager=alchemy`
+  and `force=true`. Kind → REST resource (plural + scope) resolved through
+  the apiserver's discovery endpoint, so built-ins and CRDs work without a
+  hard-coded kind→plural table. Adoption gated on the standard
+  `alchemy_app`/`alchemy_stage`/`alchemy_id` label triple.
+
+- **`clusterLayer` (`src/Kubernetes/connection.ts`)** — wires a GKE
+  cluster into the typed `@distilled.cloud/kubernetes` SDK: ADC bearer
+  token (`Credentials`) + an `HttpClient` whose `FetchHttpClient.Fetch` is
+  overridden with a `node:https` fetch that trusts the per-cluster CA.
+  The stock fetch can't verify the GKE cert (it's signed by the
+  cluster's own CA, not a public root), so the override is required.
+
+### Changed
+
+- **`GCP.KubernetesSecret` convergence** — moved off the hand-rolled
+  client onto typed `@distilled.cloud/kubernetes` core/v1 ops. Reconcile
+  is now **create + replace (PUT)** with the observed `resourceVersion`
+  for optimistic concurrency, bounded `Conflict` retry (recursive on the
+  whole observe→write flow, up to 3 re-attempts), and read-modify-write
+  metadata that preserves foreign annotations/owner references/finalizers
+  (a PUT replaces the whole object, so spreading `...observed.metadata`
+  first and overlaying only what we manage is essential — without it
+  every reconcile would strip an `ownerReference` and break garbage
+  collection). Validation scripts in `scripts/validate-k8s-{connection,
+  secret,manifest}.ts` cover live cluster runs against `research-cluster-a`.
+
+## 0.6.0 — 2026-06-14
+
+### Added
+
+- **`GCP.KubernetesSecret`** — first Kubernetes resource in the
+  provider. Opaque Secret in a GKE cluster, driven via a hand-rolled
+  REST client with ADC bearer auth + per-cluster CA trust. Adoptable via
+  the standard alchemy-internal label triple.
+
+### Changed
+
+- **`Auth/Credentials.fromAuthProvider`** — same fix as `0.5.1`,
+  re-asserted against the freshly bumped workspace pins.
+
 ## 0.5.1 — 2026-06-08
 
 ### Fixed

package/lib/Kubernetes/KubernetesManifest.d.ts

@@ -0,0 +1,100 @@
+import { Credentials } from "@distilled.cloud/gcp";
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * Apply an **arbitrary** Kubernetes object to a GKE cluster via server-side
+ * apply — the generic escape hatch for any Kind (built-ins and CRDs alike),
+ * complementing the typed {@link "./Secret.ts"} resource.
+ *
+ * Convergence is a single `application/apply-patch+yaml` PATCH with
+ * `fieldManager: alchemy`, `force: true`. SSA merges by field ownership: only
+ * the fields you declare are managed, fields owned by other managers/controllers
+ * are left intact, and dropping a previously-declared field prunes it. The REST
+ * path is resolved from the apiserver's discovery endpoint, so no per-Kind code
+ * is required. See {@link "./client.ts"} for the full create/replace-vs-SSA
+ * rationale and when to prefer each.
+ *
+ * Ownership for adoption is gated on alchemy-internal `metadata.labels` (same
+ * triple as labelled GCP resources), so an object created out of band reads
+ * back as {@link Unowned} until adopted.
+ *
+ * @section Applying a manifest
+ * @example A ConfigMap
+ * ```typescript
+ * yield* GCP.KubernetesManifest("AppConfig", {
+ *   endpoint: cluster.endpoint,
+ *   caCertificate: cluster.clusterCaCertificate,
+ *   apiVersion: "v1",
+ *   kind: "ConfigMap",
+ *   name: "app-config",
+ *   namespace: "admin",
+ *   body: { data: { LOG_LEVEL: "info" } },
+ * });
+ * ```
+ * @example A namespaced CRD instance
+ * ```typescript
+ * yield* GCP.KubernetesManifest("Tunnel", {
+ *   endpoint: cluster.endpoint,
+ *   caCertificate: cluster.clusterCaCertificate,
+ *   apiVersion: "networking.cfargotunnel.com/v1alpha1",
+ *   kind: "TunnelBinding",
+ *   name: "research-ui",
+ *   namespace: "admin",
+ *   body: { spec: { ... } },
+ * });
+ * ```
+ */
+export type KubernetesManifestProps = {
+    /**
+     * GKE control-plane endpoint (IP or hostname, no scheme) — typically
+     * `cluster.endpoint`. A change points at a different cluster → replace.
+     */
+    endpoint: string;
+    /**
+     * Base64-encoded cluster CA certificate (PEM) — typically
+     * `cluster.clusterCaCertificate`. Mutable (can rotate on the same cluster).
+     */
+    caCertificate: string;
+    /** Object `apiVersion`, e.g. `"v1"`, `"apps/v1"`. Immutable — replace. */
+    apiVersion: string;
+    /** Object `kind`, e.g. `"ConfigMap"`, `"Deployment"`. Immutable — replace. */
+    kind: string;
+    /** `metadata.name`. Immutable — replace. */
+    name: string;
+    /**
+     * `metadata.namespace`. Required for namespaced Kinds, omit for cluster-scoped
+     * ones. Immutable — replace.
+     */
+    namespace?: string;
+    /** Extra `metadata.labels` (alchemy ownership labels merge on top). Mutable. */
+    labels?: Record<string, string>;
+    /**
+     * The rest of the object — everything except `apiVersion`/`kind`/`metadata`
+     * (e.g. `spec`, `data`, `rules`). Mutable; may carry resolved Inputs from
+     * other resources. SSA prunes any key dropped from a later apply.
+     */
+    body?: Record<string, unknown>;
+};
+export type KubernetesManifestAttributes = {
+    /** Object apiVersion. */
+    apiVersion: string;
+    /** Object kind. */
+    kind: string;
+    /** metadata.name. */
+    name: string;
+    /** metadata.namespace (undefined for cluster-scoped objects). */
+    namespace: string | undefined;
+    /** Server-assigned uid. */
+    uid: string | undefined;
+    /** Server-assigned resourceVersion at last apply. */
+    resourceVersion: string | undefined;
+    /** Control-plane endpoint, threaded through for delete/read. */
+    endpoint: string;
+    /** Cluster CA certificate, threaded through for delete/read. */
+    caCertificate: string;
+};
+export type KubernetesManifest = Resource<"GCP.KubernetesManifest", KubernetesManifestProps, KubernetesManifestAttributes, never, GCP.Providers>;
+export declare const KubernetesManifest: import("alchemy").ResourceClass<KubernetesManifest>;
+export declare const KubernetesManifestProvider: () => import("effect/Layer").Layer<Provider.Provider<KubernetesManifest>, never, import("alchemy").Stack | import("alchemy").Stage | Credentials>;
+//# sourceMappingURL=KubernetesManifest.d.ts.map

package/lib/Kubernetes/KubernetesManifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KubernetesManifest.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/KubernetesManifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAW5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,qDAAqD;IACrD,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CACvC,wBAAwB,EACxB,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,kBAAkB,qDAE9B,CAAC;AAoDF,eAAO,MAAM,0BAA0B,mJA+HpC,CAAC"}

package/lib/Kubernetes/KubernetesManifest.js

@@ -0,0 +1,131 @@
+import { Credentials } from "@distilled.cloud/gcp";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved, somePropsAreDifferent } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.js";
+import { applyObject, deleteObject, getObject, KubernetesApiError, } from "./client.js";
+export const KubernetesManifest = Resource("GCP.KubernetesManifest");
+const toAttributes = (o, parent) => ({
+    apiVersion: o?.apiVersion ?? parent.apiVersion,
+    kind: o?.kind ?? parent.kind,
+    name: o?.metadata?.name ?? parent.name,
+    namespace: o?.metadata?.namespace ?? parent.namespace,
+    uid: o?.metadata?.uid,
+    resourceVersion: o?.metadata?.resourceVersion,
+    endpoint: parent.endpoint,
+    caCertificate: parent.caCertificate,
+});
+/** Mint a fresh GKE connection (plain bearer token) from props + ADC creds. */
+const connect = Effect.fn("k8sManifest.connect")(function* (props) {
+    const { accessToken } = yield* yield* Credentials;
+    return {
+        endpoint: props.endpoint,
+        caCertificate: props.caCertificate,
+        token: Redacted.value(accessToken),
+    };
+});
+/** GET the object, mapping a 404 to `undefined`. */
+const observe = (connection, apiVersion, kind, namespace, name) => getObject(connection, apiVersion, kind, namespace, name).pipe(Effect.catchIf((e) => e instanceof KubernetesApiError && e.statusCode === 404, () => Effect.succeed(undefined)));
+export const KubernetesManifestProvider = () => Provider.effect(KubernetesManifest, Effect.gen(function* () {
+    return {
+        // Identity (apiVersion/kind/name/namespace) and the server-assigned uid
+        // are unchanged by an in-place apply. endpoint is a replace trigger so
+        // it never changes on update; caCertificate is excluded (can rotate).
+        stables: [
+            "apiVersion",
+            "kind",
+            "name",
+            "namespace",
+            "uid",
+            "endpoint",
+        ],
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+            if (!isResolved(news))
+                return undefined;
+            const o = olds;
+            // apiVersion/kind/name/namespace are the object's identity, and
+            // endpoint points at a specific cluster — any change orphans the old
+            // object, so create new + delete old.
+            if (somePropsAreDifferent(o, news, [
+                "apiVersion",
+                "kind",
+                "name",
+                "namespace",
+                "endpoint",
+            ])) {
+                return { action: "replace" };
+            }
+            return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news }) {
+            const labels = {
+                ...(news.labels ?? {}),
+                ...(yield* gcpInternalLabels(id)),
+            };
+            const connection = yield* connect(news);
+            // Build the full object: identity + merged labels + the user body.
+            // SSA is declarative — we send exactly what we manage (no
+            // resourceVersion), and force ownership of any field we name.
+            const object = {
+                ...news.body,
+                apiVersion: news.apiVersion,
+                kind: news.kind,
+                metadata: {
+                    name: news.name,
+                    ...(news.namespace ? { namespace: news.namespace } : {}),
+                    labels,
+                },
+            };
+            const applied = yield* applyObject(connection, object);
+            // A 2xx apply normally echoes the object, but an empty-body success is
+            // possible — re-read so we always return real attributes (uid/
+            // resourceVersion). Use getObject (not observe): a missing object
+            // after a successful apply is a real failure, not "absent".
+            const final = applied?.metadata != null
+                ? applied
+                : yield* getObject(connection, news.apiVersion, news.kind, news.namespace, news.name);
+            return toAttributes(final, {
+                apiVersion: news.apiVersion,
+                kind: news.kind,
+                name: news.name,
+                namespace: news.namespace,
+                endpoint: news.endpoint,
+                caCertificate: news.caCertificate,
+            });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const connection = yield* connect(output);
+            yield* deleteObject(connection, output.apiVersion, output.kind, output.namespace, output.name);
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+            const endpoint = output?.endpoint ?? olds?.endpoint;
+            const caCertificate = output?.caCertificate ?? olds?.caCertificate;
+            const apiVersion = output?.apiVersion ?? olds?.apiVersion;
+            const kind = output?.kind ?? olds?.kind;
+            const name = output?.name ?? olds?.name;
+            const namespace = output?.namespace ?? olds?.namespace;
+            if (!endpoint || !caCertificate || !apiVersion || !kind || !name) {
+                return undefined;
+            }
+            const connection = yield* connect({ endpoint, caCertificate });
+            const observed = yield* observe(connection, apiVersion, kind, namespace, name);
+            if (!observed)
+                return undefined;
+            const attrs = toAttributes(observed, {
+                apiVersion,
+                kind,
+                name,
+                namespace,
+                endpoint,
+                caCertificate,
+            });
+            return (yield* hasAlchemyLabels(id, observed.metadata?.labels))
+                ? attrs
+                : Unowned(attrs);
+        }),
+    };
+}));
+//# sourceMappingURL=KubernetesManifest.js.map

package/lib/Kubernetes/KubernetesManifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KubernetesManifest.js","sourceRoot":"","sources":["../../src/Kubernetes/KubernetesManifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EACL,WAAW,EACX,YAAY,EACZ,SAAS,EACT,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AAuGrB,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CACxC,wBAAwB,CACzB,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,CAAyB,EACzB,MAOC,EAC6B,EAAE,CAAC,CAAC;IAClC,UAAU,EAAE,CAAC,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU;IAC9C,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;IAC5B,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;IACtC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,IAAI,MAAM,CAAC,SAAS;IACrD,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG;IACrB,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,eAAe;IAC7C,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,aAAa,EAAE,MAAM,CAAC,aAAa;CACpC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAG3D;IACC,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;IAClD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;KACX,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEH,oDAAoD;AACpD,MAAM,OAAO,GAAG,CACd,UAAyB,EACzB,UAAkB,EAClB,IAAY,EACZ,SAA6B,EAC7B,IAAY,EACZ,EAAE,CACF,SAAS,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,EAA2B,EAAE,CAC7B,CAAC,YAAY,kBAAkB,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EACzD,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAmC,CAAC,CAC1D,CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,EAAE,CAC7C,QAAQ,CAAC,MAAM,CACb,kBAAkB,EAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,EAAE;YACP,YAAY;YACZ,MAAM;YACN,MAAM;YACN,WAAW;YACX,KAAK;YACL,UAAU;SACX;QACD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,CAAC,GAAG,IAA+B,CAAC;YAC1C,gEAAgE;YAChE,qEAAqE;YACrE,sCAAsC;YACtC,IACE,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE;gBAC7B,YAAY;gBACZ,MAAM;gBACN,MAAM;gBACN,WAAW;gBACX,UAAU;aACX,CAAC,EACF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;YAC1C,MAAM,MAAM,GAAG;gBACb,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;aAClC,CAAC;YACF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAExC,mEAAmE;YACnE,0DAA0D;YAC1D,8DAA8D;YAC9D,MAAM,MAAM,GAAe;gBACzB,GAAG,IAAI,CAAC,IAAI;gBACZ,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE;oBACR,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,MAAM;iBACP;aACF,CAAC;YAEF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAEvD,uEAAuE;YACvE,+DAA+D;YAC/D,kEAAkE;YAClE,4DAA4D;YAC5D,MAAM,KAAK,GACT,OAAO,EAAE,QAAQ,IAAI,IAAI;gBACvB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CACd,UAAU,EACV,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,IAAI,CACV,CAAC;YAER,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,KAAK,CAAC,CAAC,YAAY,CACjB,UAAU,EACV,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,IAAI,CACZ,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;YACpD,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,IAAI,EAAE,aAAa,CAAC;YACnE,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,CAAC;YACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAC7B,UAAU,EACV,UAAU,EACV,IAAI,EACJ,SAAS,EACT,IAAI,CACL,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE;gBACnC,UAAU;gBACV,IAAI;gBACJ,IAAI;gBACJ,SAAS;gBACT,QAAQ;gBACR,aAAa;aACd,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Kubernetes/Secret.d.ts

@@ -6,23 +6,31 @@ import type * as GCP from "../Providers.ts";
 /**
  * An Opaque Kubernetes Secret in a GKE cluster.
  *
- * Unlike the rest of the GCP provider (which calls typed
- * `@distilled.cloud/gcp` operations), this resource talks directly to a
- * GKE cluster's Kubernetes API server — alchemy's upstream Kubernetes
- * provider is EKS-only. The control-plane connection (`endpoint` +
- * `caCertificate`) comes from a {@link GCP.Cluster}'s attributes; the
- * bearer token is minted from the provider's ADC {@link Credentials}.
+ * Driven through the typed `@distilled.cloud/kubernetes` SDK (core/v1) rather
+ * than alchemy's upstream Kubernetes provider, which is EKS-only. The
+ * control-plane connection (`endpoint` + `caCertificate`) comes from a
+ * {@link GCP.Cluster}'s attributes; the bearer token is minted from the
+ * provider's ADC {@link Credentials} and threaded into the cluster via
+ * {@link clusterLayer} (which also trusts the per-cluster CA).
  *
- * Ownership for adoption is gated on alchemy-internal `metadata.labels`
- * (same triple as labelled GCP resources), so a Secret created out of
- * band reads back as {@link Unowned} until adopted.
+ * Convergence is a typed **create-or-replace upsert** (not server-side apply):
+ * `reconcile` reads the Secret, then `createCoreV1NamespacedSecret` if absent
+ * or `replaceCoreV1NamespacedSecret` (a full PUT, carrying the observed
+ * `resourceVersion` for optimistic concurrency) if present. A `PUT` is a full
+ * object replacement, so dropping a key from `data` removes it from the stored
+ * Secret — the same pruning SSA gave us, without needing the
+ * `application/apply-patch+yaml` content type the typed PATCH op can't express.
+ *
+ * Ownership for adoption is gated on alchemy-internal `metadata.labels` (same
+ * triple as labelled GCP resources), so a Secret created out of band reads back
+ * as {@link Unowned} until adopted.
  *
  * @section Creating a Secret
  * @example Wire a Cloudflare tunnel token into the cluster
  * ```typescript
  * // `tunnel.token` is a `Redacted<string>`; pass it straight through —
- * // the value is unwrapped only at the moment it's written to the API,
- * // and stays redacted in logs/plan output.
+ * // the value is unwrapped only at the moment it's written to the API, and
+ * // stays redacted in logs/plan output.
  * yield* GCP.KubernetesSecret("CloudflaredTunnelSecret", {
  *   endpoint: cluster.endpoint,
  *   caCertificate: cluster.clusterCaCertificate,
@@ -53,15 +61,14 @@ export type KubernetesSecretProps = {
     /** Secret `type`. Default `"Opaque"`. Mutable. */
     type?: string;
     /**
-     * String data (written under `stringData`; UTF-8 values). Mutable.
+     * String data (UTF-8 values, base64-encoded on the way to the API). Mutable.
      *
-     * Values may be `Redacted<string>` (e.g. a resource's secret output
-     * like `tunnel.token`) — they are unwrapped only when written to the
-     * Kubernetes API and stay opaque in logs/plan output. Plain strings
-     * are accepted too.
+     * Values may be `Redacted<string>` (e.g. a resource's secret output like
+     * `tunnel.token`) — they are unwrapped only when written to the Kubernetes
+     * API and stay opaque in logs/plan output. Plain strings are accepted too.
      *
-     * NOTE: the underlying values are persisted in alchemy stack state
-     * (the engine diffs on the real value) — protect the state backend.
+     * NOTE: the underlying values are persisted in alchemy stack state (the
+     * engine diffs on the real value) — protect the state backend.
      */
     stringData: Record<string, Redacted.Redacted<string> | string>;
     /** Extra metadata labels (alchemy ownership labels merge on top). Mutable. */

package/lib/Kubernetes/Secret.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Secret.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/Secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAInC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAW5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;IAC/D,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,qDAAqD;IACrD,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CACrC,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,gBAAgB,mDAE5B,CAAC;AA2CF,eAAO,MAAM,wBAAwB,iJAwHlC,CAAC"}
+{"version":3,"file":"Secret.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/Secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAOnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAInC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAI5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;IAC/D,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,qDAAqD;IACrD,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CACrC,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,gBAAgB,mDAE5B,CAAC;AAuEF,eAAO,MAAM,wBAAwB,iJAgKlC,CAAC"}

package/lib/Kubernetes/Secret.js

@@ -1,4 +1,5 @@
 import { Credentials } from "@distilled.cloud/gcp";
+import { createCoreV1NamespacedSecret, deleteCoreV1NamespacedSecret, readCoreV1NamespacedSecret, replaceCoreV1NamespacedSecret, } from "@distilled.cloud/kubernetes/core";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import { isResolved, somePropsAreDifferent } from "alchemy/Diff";
@@ -7,7 +8,7 @@ import * as Provider from "alchemy/Provider";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.js";
-import { applySecret, deleteSecret, getSecret, KubernetesApiError, } from "./client.js";
+import { clusterLayer } from "./connection.js";
 export const KubernetesSecret = Resource("GCP.KubernetesSecret");
 const toAttributes = (s, parent) => ({
     name: s?.metadata?.name ?? parent.name,
@@ -24,37 +25,46 @@ const connect = Effect.fn("k8sSecret.connect")(function* (props) {
     return {
         endpoint: props.endpoint,
         caCertificate: props.caCertificate,
-        token: Redacted.value(accessToken),
+        token: accessToken,
     };
 });
-const observe = (connection, namespace, name) => getSecret(connection, namespace, name).pipe(Effect.catchIf((e) => e instanceof KubernetesApiError && e.statusCode === 404, () => Effect.succeed(undefined)));
+/** GET a Secret, mapping a 404 (`NotFound`) to `undefined`. */
+const observe = (connection, namespace, name) => readCoreV1NamespacedSecret({ namespace, name }).pipe(Effect.provide(clusterLayer(connection)), Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+/** Base64-encode the (possibly redacted) string values for the `data` field. */
+const encodeData = (stringData) => {
+    const data = {};
+    for (const [k, v] of Object.entries(stringData)) {
+        const raw = Redacted.isRedacted(v) ? Redacted.value(v) : v;
+        data[k] = Buffer.from(raw, "utf8").toString("base64");
+    }
+    return data;
+};
 export const KubernetesSecretProvider = () => Provider.effect(KubernetesSecret, Effect.gen(function* () {
     return {
-        // Attributes unchanged by an in-place update (so dependents can
-        // resolve them at plan time): identity (name/namespace), the
-        // server-assigned uid, and endpoint — which is a replace trigger,
-        // so it never changes on update. caCertificate is intentionally
-        // excluded: it can rotate on the same cluster.
+        // Attributes unchanged by an in-place update (so dependents can resolve
+        // them at plan time): identity (name/namespace), the server-assigned
+        // uid, and endpoint — which is a replace trigger, so it never changes
+        // on update. caCertificate is intentionally excluded: it can rotate on
+        // the same cluster.
         stables: ["name", "namespace", "endpoint", "uid"],
         diff: Effect.fn(function* ({ id, news, olds = {} }) {
             if (!isResolved(news))
                 return undefined;
             const o = olds;
-            // Compare the RESOLVED name and type (with their defaults
-            // applied), not the raw props — otherwise omitting `name` on one
-            // side and setting it to the generated physical name on the
-            // other (or the same for `type`/"Opaque") triggers a spurious
-            // replace.
+            // Compare the RESOLVED name and type (with their defaults applied),
+            // not the raw props — otherwise omitting `name` on one side and
+            // setting it to the generated physical name on the other (or the
+            // same for `type`/"Opaque") triggers a spurious replace.
             const defaultName = (yield* createPhysicalName({ id, maxLength: 63 })).toLowerCase();
             const sameName = (o.name ?? defaultName) === (news.name ?? defaultName);
             const sameType = (o.type ?? "Opaque") === (news.type ?? "Opaque");
-            // Replace (create new + delete old) rather than in-place SSA on:
-            // - `endpoint`: points at a different cluster (would orphan the
-            //   old Secret). caCertificate is excluded — it can rotate on
-            //   the same cluster and should just re-apply.
+            // Replace (create new + delete old) rather than in-place upsert on:
+            // - `endpoint`: points at a different cluster (would orphan the old
+            //   Secret). caCertificate is excluded — it can rotate on the same
+            //   cluster and should just re-apply.
             // - `namespace`/`name`: the object's identity.
-            // - `type`: immutable on a Kubernetes Secret; an in-place apply
-            //   with a new type is rejected by the API.
+            // - `type`: immutable on a Kubernetes Secret; a PUT with a new type
+            //   is rejected by the API.
             if (!sameName ||
                 !sameType ||
                 somePropsAreDifferent(o, news, ["namespace", "endpoint"])) {
@@ -71,33 +81,52 @@ export const KubernetesSecretProvider = () => Provider.effect(KubernetesSecret,
                 ...(yield* gcpInternalLabels(id)),
             };
             const connection = yield* connect(news);
-            // Unwrap any Redacted values at the last moment — Redacted is
-            // kept opaque through Output resolution, so it arrives here as
-            // a Redacted object that would JSON-serialize to "<redacted>"
-            // if passed through verbatim — then base64-encode for `data`.
-            const data = {};
-            for (const [k, v] of Object.entries(news.stringData)) {
-                const raw = Redacted.isRedacted(v) ? Redacted.value(v) : v;
-                data[k] = Buffer.from(raw, "utf8").toString("base64");
-            }
-            // Server-side apply is an idempotent upsert — it both creates
-            // the Secret if missing and converges its data/labels if it
-            // exists, taking field-manager ownership (force=true).
-            const applied = yield* applySecret(connection, {
-                metadata: { name: desiredName, namespace: news.namespace, labels },
+            const layer = clusterLayer(connection);
+            const data = encodeData(news.stringData);
+            // Full-object PUT for an existing Secret — carries the observed
+            // resourceVersion (the API requires it for updates and uses it for
+            // optimistic concurrency).
+            const replaceFrom = (observed) => replaceCoreV1NamespacedSecret({
+                namespace: news.namespace,
+                name: desiredName,
+                fieldManager: "alchemy",
+                // Read-modify-write: a PUT replaces the WHOLE object, so preserve
+                // the observed metadata (annotations, ownerReferences, finalizers,
+                // …) and overlay only what we manage — otherwise every reconcile
+                // strips fields other managers set (e.g. an ownerReference, which
+                // would break garbage collection). `observed.metadata` carries the
+                // full server object at runtime (the local type is a subset).
+                // Labels merge (ours win) so foreign labels survive too. (The SSA
+                // path — GCP.KubernetesManifest — does field-level pruning instead;
+                // the typed PUT path deliberately preserves rather than prunes.)
+                metadata: {
+                    ...observed.metadata,
+                    name: desiredName,
+                    labels: { ...observed.metadata?.labels, ...labels },
+                    resourceVersion: observed.metadata?.resourceVersion,
+                },
                 type: desiredType,
                 data,
-            });
-            // A 2xx apply normally echoes the object, but a successful
-            // empty-body response is possible — re-read so we always return
-            // real attributes (uid/resourceVersion) rather than crash. Use
-            // getSecret (NOT observe): if the Secret is somehow absent after
-            // a successful apply, propagate the 404 and fail the reconcile
-            // instead of recording an empty success.
-            const final = applied?.metadata
-                ? applied
-                : yield* getSecret(connection, news.namespace, desiredName);
-            return toAttributes(final, {
+            }).pipe(Effect.provide(layer));
+            // Observe → ensure: create if absent, else read-modify-write replace.
+            // Adoption (output defined, olds undefined) traverses the same flow.
+            const writeOnce = observe(connection, news.namespace, desiredName).pipe(Effect.flatMap((observed) => observed
+                ? replaceFrom(observed)
+                : createCoreV1NamespacedSecret({
+                    namespace: news.namespace,
+                    fieldManager: "alchemy",
+                    metadata: { name: desiredName, labels },
+                    type: desiredType,
+                    data,
+                }).pipe(Effect.provide(layer))));
+            // Retry the WHOLE observe→write flow on Conflict — a stale
+            // resourceVersion (replace) or a create/delete race re-observes fresh
+            // state and writes again, so a second conflict is handled too. Bounded
+            // so a persistently-contended object fails (and the engine
+            // re-reconciles) rather than spinning forever.
+            const upsert = (attempt) => writeOnce.pipe(Effect.catchTag("Conflict", (e) => attempt < 3 ? upsert(attempt + 1) : Effect.fail(e)));
+            const result = yield* upsert(0);
+            return toAttributes(result, {
                 name: desiredName,
                 namespace: news.namespace,
                 endpoint: news.endpoint,
@@ -107,7 +136,12 @@ export const KubernetesSecretProvider = () => Provider.effect(KubernetesSecret,
         }),
         delete: Effect.fn(function* ({ output }) {
             const connection = yield* connect(output);
-            yield* deleteSecret(connection, output.namespace, output.name);
+            yield* deleteCoreV1NamespacedSecret({
+                namespace: output.namespace,
+                name: output.name,
+            }).pipe(Effect.provide(clusterLayer(connection)), 
+            // 404 is success (idempotent teardown).
+            Effect.catchTag("NotFound", () => Effect.void));
         }),
         read: Effect.fn(function* ({ id, output, olds }) {
             const endpoint = output?.endpoint ?? olds?.endpoint;

package/lib/Kubernetes/Secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"Secret.js","sourceRoot":"","sources":["../../src/Kubernetes/Secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EACL,WAAW,EACX,YAAY,EACZ,SAAS,EACT,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AA2FrB,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CACtC,sBAAsB,CACvB,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,CAA2B,EAC3B,MAMC,EAC2B,EAAE,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;IACtC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,IAAI,MAAM,CAAC,SAAS;IACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;IAC5B,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG;IACrB,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,eAAe;CAC9C,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAGzD;IACC,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;IAClD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;KACX,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,UAAyB,EAAE,SAAiB,EAAE,IAAY,EAAE,EAAE,CAC7E,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CACzC,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,EAA2B,EAAE,CAC7B,CAAC,YAAY,kBAAkB,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EACzD,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAqC,CAAC,CAC5D,CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,EAAE,CAC3C,QAAQ,CAAC,MAAM,CACb,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,gEAAgE;QAChE,6DAA6D;QAC7D,kEAAkE;QAClE,gEAAgE;QAChE,+CAA+C;QAC/C,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC;QACjD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,CAAC,GAAG,IAA6B,CAAC;YACxC,0DAA0D;YAC1D,iEAAiE;YACjE,4DAA4D;YAC5D,8DAA8D;YAC9D,WAAW;YACX,MAAM,WAAW,GAAG,CAClB,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CACjD,CAAC,WAAW,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC;YACxE,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;YAClE,iEAAiE;YACjE,gEAAgE;YAChE,8DAA8D;YAC9D,+CAA+C;YAC/C,+CAA+C;YAC/C,gEAAgE;YAChE,4CAA4C;YAC5C,IACE,CAAC,QAAQ;gBACT,CAAC,QAAQ;gBACT,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,EACzD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;YAC1C,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;YAC1C,MAAM,MAAM,GAAG;gBACb,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;aAClC,CAAC;YACF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAExC,8DAA8D;YAC9D,+DAA+D;YAC/D,8DAA8D;YAC9D,8DAA8D;YAC9D,MAAM,IAAI,GAA2B,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxD,CAAC;YAED,8DAA8D;YAC9D,4DAA4D;YAC5D,uDAAuD;YACvD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE;gBAC7C,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE;gBAClE,IAAI,EAAE,WAAW;gBACjB,IAAI;aACL,CAAC,CAAC;YAEH,2DAA2D;YAC3D,gEAAgE;YAChE,+DAA+D;YAC/D,iEAAiE;YACjE,+DAA+D;YAC/D,yCAAyC;YACzC,MAAM,KAAK,GAAG,OAAO,EAAE,QAAQ;gBAC7B,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAE9D,OAAO,YAAY,CAAC,KAAK,EAAE;gBACzB,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,KAAK,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;YACpD,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,IAAI,EAAE,aAAa,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,CAAC;YACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC;YAEpD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC7D,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE;gBACnC,IAAI;gBACJ,SAAS;gBACT,QAAQ;gBACR,aAAa;gBACb,IAAI;aACL,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}
+{"version":3,"file":"Secret.js","sourceRoot":"","sources":["../../src/Kubernetes/Secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,YAAY,EAA0B,MAAM,iBAAiB,CAAC;AAkGvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CACtC,sBAAsB,CACvB,CAAC;AAcF,MAAM,YAAY,GAAG,CACnB,CAA2B,EAC3B,MAMC,EAC2B,EAAE,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;IACtC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,IAAI,MAAM,CAAC,SAAS;IACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;IAC5B,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG;IACrB,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,eAAe;CAC9C,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAGzD;IACC,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;IAClD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,WAAW;KACS,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,OAAO,GAAG,CACd,UAA6B,EAC7B,SAAiB,EACjB,IAAY,EACZ,EAAE,CACF,0BAA0B,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EACxC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAqC,CAAC,CACtD,CACF,CAAC;AAEJ,gFAAgF;AAChF,MAAM,UAAU,GAAG,CACjB,UAA8D,EACtC,EAAE;IAC1B,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,EAAE,CAC3C,QAAQ,CAAC,MAAM,CACb,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO;QACL,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,oBAAoB;QACpB,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC;QACjD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;YAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,CAAC,GAAG,IAA6B,CAAC;YACxC,oEAAoE;YACpE,gEAAgE;YAChE,iEAAiE;YACjE,yDAAyD;YACzD,MAAM,WAAW,GAAG,CAClB,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CACjD,CAAC,WAAW,EAAE,CAAC;YAChB,MAAM,QAAQ,GACZ,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,sCAAsC;YACtC,+CAA+C;YAC/C,oEAAoE;YACpE,4BAA4B;YAC5B,IACE,CAAC,QAAQ;gBACT,CAAC,QAAQ;gBACT,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,EACzD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;YAC1C,MAAM,WAAW,GACf,IAAI,CAAC,IAAI;gBACT,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;YAC1C,MAAM,MAAM,GAAG;gBACb,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;aAClC,CAAC;YACF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAEzC,gEAAgE;YAChE,mEAAmE;YACnE,2BAA2B;YAC3B,MAAM,WAAW,GAAG,CAAC,QAAsB,EAAE,EAAE,CAC7C,6BAA6B,CAAC;gBAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,WAAW;gBACjB,YAAY,EAAE,SAAS;gBACvB,kEAAkE;gBAClE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,mEAAmE;gBACnE,8DAA8D;gBAC9D,kEAAkE;gBAClE,oEAAoE;gBACpE,iEAAiE;gBACjE,QAAQ,EAAE;oBACR,GAAG,QAAQ,CAAC,QAAQ;oBACpB,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;oBACnD,eAAe,EAAE,QAAQ,CAAC,QAAQ,EAAE,eAAe;iBACpD;gBACD,IAAI,EAAE,WAAW;gBACjB,IAAI;aACL,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAEjC,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,SAAS,GAAG,OAAO,CACvB,UAAU,EACV,IAAI,CAAC,SAAS,EACd,WAAW,CACZ,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;gBACN,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC;gBACvB,CAAC,CAAC,4BAA4B,CAAC;oBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,YAAY,EAAE,SAAS;oBACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE;oBACvC,IAAI,EAAE,WAAW;oBACjB,IAAI;iBACL,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACnC,CACF,CAAC;YAEF,2DAA2D;YAC3D,sEAAsE;YACtE,uEAAuE;YACvE,2DAA2D;YAC3D,+CAA+C;YAC/C,MAAM,MAAM,GAAG,CAAC,OAAe,EAAoB,EAAE,CACnD,SAAS,CAAC,IAAI,CACZ,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAChC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CACnD,CACF,CAAC;YACJ,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAEhC,OAAO,YAAY,CAAC,MAAM,EAAE;gBAC1B,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,KAAK,CAAC,CAAC,4BAA4B,CAAC;gBAClC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YACxC,wCAAwC;YACxC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/C,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;YACpD,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,IAAI,EAAE,aAAa,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,CAAC;YACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,IAAI,GACR,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC;YAEpD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC7D,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE;gBACnC,IAAI;gBACJ,SAAS;gBACT,QAAQ;gBACR,aAAa;gBACb,IAAI;aACL,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}