alasio 4.0.0 → 4.1.0

package/dist/cli/src/manifests/index.js

@@ -4,9 +4,13 @@ import { lakeObjects } from "./lake.js";
 import { neonObjects } from "./neon.js";
 import { networkPolicyObjects } from "./network-policies.js";
 import { objectStoreObjects } from "./object-store.js";
+import { workspaceStorageObjects } from "./workspace-storage.js";
 export { decodeInstallConfig, InstallConfig, InstallConfigError } from "./config.js";
 export { NAMESPACE } from "./common.js";
-/** The objects of the installation `config` describes: agent-sandbox's, alasio's, Neon's, the object store's, the lake's, and the NetworkPolicies. */
+/**
+ * The objects of the installation `config` describes: agent-sandbox's, alasio's, Neon's,
+ * the object store's, the lake's, workspace storage's, and the NetworkPolicies.
+ */
 export function manifests(config) {
     return [
         ...agentSandboxObjects(config),
@@ -14,6 +18,7 @@ export function manifests(config) {
         ...neonObjects(config),
         ...objectStoreObjects(config),
         ...lakeObjects(config),
+        ...workspaceStorageObjects(config),
         ...networkPolicyObjects(config),
     ];
 }

package/dist/cli/src/manifests/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/manifests/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAA0B,MAAM,aAAa,CAAC;AAC7G,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,sJAAsJ;AACtJ,MAAM,UAAU,SAAS,CAAC,MAAqB;IAC7C,OAAO;QACL,GAAG,mBAAmB,CAAC,MAAM,CAAC;QAC9B,GAAG,aAAa,CAAC,MAAM,CAAC;QACxB,GAAG,WAAW,CAAC,MAAM,CAAC;QACtB,GAAG,kBAAkB,CAAC,MAAM,CAAC;QAC7B,GAAG,WAAW,CAAC,MAAM,CAAC;QACtB,GAAG,oBAAoB,CAAC,MAAM,CAAC;KAChC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/manifests/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAA0B,MAAM,aAAa,CAAC;AAC7G,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,MAAqB;IAC7C,OAAO;QACL,GAAG,mBAAmB,CAAC,MAAM,CAAC;QAC9B,GAAG,aAAa,CAAC,MAAM,CAAC;QACxB,GAAG,WAAW,CAAC,MAAM,CAAC;QACtB,GAAG,kBAAkB,CAAC,MAAM,CAAC;QAC7B,GAAG,WAAW,CAAC,MAAM,CAAC;QACtB,GAAG,uBAAuB,CAAC,MAAM,CAAC;QAClC,GAAG,oBAAoB,CAAC,MAAM,CAAC;KAChC,CAAC;AACJ,CAAC"}

package/dist/cli/src/manifests/juicefs-csi.js

@@ -0,0 +1,303 @@
+import { imageReference } from "../images.js";
+import { VOLUME_DRIVER_LABEL } from "../kube/apply.js";
+import { goJson } from "./common.js";
+/** The driver's name, which StorageClasses name as their provisioner. */
+export const CSI_DRIVER = "csi.juicefs.com";
+const VERSION = "v0.33.0";
+const CONTROLLER = "juicefs-csi-controller";
+const NODE = "juicefs-csi-node";
+const CONFIG = "juicefs-csi-driver-config";
+const CONTROLLER_ACCOUNT = "juicefs-csi-controller-sa";
+const NODE_ACCOUNT = "juicefs-csi-node-sa";
+/** The PriorityClass of mount pods. */
+const MOUNT_PRIORITY_CLASS = "alasio-juicefs-mount";
+/** The labels of the node service's mount pods. */
+export const MOUNT_POD_LABELS = { "app.kubernetes.io/name": "juicefs-mount" };
+/** The labels that select the controller's and the node service's pods, upstream's but for its version. */
+export const CONTROLLER_POD_LABELS = { app: CONTROLLER, "app.kubernetes.io/name": "juicefs-csi-driver", "app.kubernetes.io/instance": "juicefs-csi-driver" };
+export const NODE_POD_LABELS = { app: NODE, "app.kubernetes.io/name": "juicefs-csi-driver", "app.kubernetes.io/instance": "juicefs-csi-driver" };
+/** The selector of the controller's, the node service's and the mount pods' pods, by their name labels. */
+export const JUICEFS_PODS_SELECTOR = `app.kubernetes.io/name in (${MOUNT_POD_LABELS["app.kubernetes.io/name"]}, ${CONTROLLER_POD_LABELS["app.kubernetes.io/name"]})`;
+/** Where each of those pods serves its Prometheus metrics (administration/monitoring.md). */
+export const JUICEFS_METRICS_PORT = 9567;
+/** The label of what the driver needs to delete its volumes' data, which alasio keeps while they remain. */
+export const VOLUME_DRIVER = { [VOLUME_DRIVER_LABEL]: CSI_DRIVER };
+/** The labels of the driver's objects: upstream's, at its version, managed by alasio, and needed by its volumes. */
+const LABELS = {
+    "app.kubernetes.io/name": "juicefs-csi-driver",
+    "app.kubernetes.io/instance": "juicefs-csi-driver",
+    "app.kubernetes.io/version": VERSION,
+    "app.kubernetes.io/managed-by": "alasio",
+    ...VOLUME_DRIVER,
+};
+/** Where the controller and node service keep mount points and the client's configuration, on the node. */
+const MOUNT_PATH = "/var/lib/juicefs/volume";
+const CONFIG_PATH = "/var/lib/juicefs/config";
+/** The controller's socket, which its sidecars reach it by. */
+const CONTROLLER_SOCKET_DIR = "/var/lib/csi/sockets/pluginproxy/";
+/**
+ * The driver's configuration, its ConfigMap's config.yaml: one patch, for the mount pods
+ * of workspace storage's class. Mount options here take precedence over a volume's, and
+ * reach mount pods made after a change.
+ */
+export function driverConfig({ workspaceStorage }) {
+    const { csi, storageClassName, cacheSizeMiB, backupInterval } = workspaceStorage;
+    return {
+        enableNodeSelector: false,
+        mountPodPatch: [{
+                pvcSelector: { matchStorageClassName: storageClassName },
+                ceMountImage: imageReference(csi.mountImage),
+                resources: csi.mountPod.resources,
+                mountOptions: [
+                    // The read cache, bounded, and keeping a fifth of the node's disk free.
+                    `cache-size=${cacheSizeMiB}`,
+                    "free-space-ratio=0.2",
+                    `backup-meta=${backupInterval}`,
+                ],
+                // Ready once the mount answers as FUSE's. A mount pod mounts its volume's directory
+                // alone (as `subdir`), so that is the mount's root, and nothing is under it by the
+                // volume's path; unmounted, the root is the node's own directory.
+                readinessProbe: { exec: { command: ["sh", "-c", 'test "$(stat --file-system --format=%T ${MOUNT_POINT})" = fuseblk'] }, initialDelaySeconds: 5, periodSeconds: 10, failureThreshold: 3 },
+            }],
+    };
+}
+/** What the controller and node service are told alike: where they are, where mount pods keep their mounts, and the pods' priority. */
+function pluginEnv({ workspaceStorage }) {
+    return [
+        { name: "NODE_NAME", valueFrom: { fieldRef: { fieldPath: "spec.nodeName" } } },
+        { name: "JUICEFS_MOUNT_NAMESPACE", valueFrom: { fieldRef: { fieldPath: "metadata.namespace" } } },
+        { name: "POD_NAME", valueFrom: { fieldRef: { fieldPath: "metadata.name" } } },
+        { name: "JUICEFS_MOUNT_PATH", value: MOUNT_PATH },
+        { name: "JUICEFS_CONFIG_PATH", value: CONFIG_PATH },
+        { name: "JUICEFS_MOUNT_PRIORITY_NAME", value: MOUNT_PRIORITY_CLASS },
+        { name: "JUICEFS_MOUNT_PREEMPTION_POLICY", value: "Never" },
+        ...(workspaceStorage.csi.shareMountPod ? [{ name: "FS_SHARE_MOUNT", value: "true" }] : []),
+    ];
+}
+/** The plugin's liveness, which its liveness-probe sidecar answers on the plugin's healthz port. */
+const PLUGIN_PROBE = { httpGet: { path: "/healthz", port: "healthz" }, initialDelaySeconds: 10, periodSeconds: 10, timeoutSeconds: 3, failureThreshold: 5 };
+/** The liveness-probe sidecar, for the plugin's socket in `socketVolume`. */
+function livenessProbe({ workspaceStorage }, socketVolume) {
+    return {
+        name: "liveness-probe",
+        image: imageReference(workspaceStorage.csi.livenessProbeImage),
+        args: ["--csi-address=/csi/csi.sock", "--health-port=9909"],
+        resources: { requests: { cpu: "5m", memory: "16Mi" }, limits: { memory: "64Mi" } },
+        volumeMounts: [{ name: socketVolume, mountPath: "/csi" }],
+    };
+}
+/** A rule granting `verbs` on `resources` of `apiGroups`. */
+function rule(apiGroups, resources, verbs) {
+    return { apiGroups, resources, verbs };
+}
+/** Who the controller and node service are, and what they may do, as upstream grants it. */
+function identities({ workspaceStorage }) {
+    const { namespace } = workspaceStorage.csi;
+    const account = (name) => ({ apiVersion: "v1", kind: "ServiceAccount", metadata: { name, namespace, labels: LABELS } });
+    const role = (name, rules) => ({
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "ClusterRole",
+        metadata: { name, labels: LABELS },
+        rules,
+    });
+    const binding = (name, roleName, accountName) => ({
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "ClusterRoleBinding",
+        metadata: { name, labels: LABELS },
+        subjects: [{ kind: "ServiceAccount", name: accountName, namespace }],
+        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "ClusterRole", name: roleName },
+    });
+    const provisioner = "juicefs-external-provisioner-role";
+    const nodeService = "juicefs-csi-external-node-service-role";
+    return [
+        account(CONTROLLER_ACCOUNT),
+        account(NODE_ACCOUNT),
+        role(provisioner, [
+            rule([""], ["persistentvolumes"], ["get", "list", "watch", "create", "delete", "patch"]),
+            rule([""], ["persistentvolumeclaims", "persistentvolumeclaims/status"], ["get", "list", "watch", "update", "patch"]),
+            rule(["storage.k8s.io"], ["storageclasses"], ["get", "list", "watch"]),
+            rule([""], ["events"], ["list", "watch", "create", "update", "patch"]),
+            rule(["storage.k8s.io"], ["csinodes"], ["get", "list", "watch"]),
+            rule([""], ["nodes"], ["get", "list", "watch"]),
+            rule([""], ["secrets"], ["get", "list", "watch", "create", "update", "patch", "delete"]),
+            rule([""], ["pods", "pods/log"], ["get", "list", "watch", "create", "update", "patch", "delete"]),
+            rule(["batch"], ["jobs"], ["get", "create", "update", "patch", "delete", "list", "watch"]),
+            rule([""], ["endpoints"], ["get", "list", "watch", "create", "update", "patch"]),
+            rule(["apps"], ["daemonsets"], ["get", "list"]),
+            rule(["coordination.k8s.io"], ["leases"], ["get", "watch", "list", "delete", "update", "create"]),
+            rule([""], ["configmaps"], ["get", "watch", "list", "delete", "update", "create"]),
+        ]),
+        role(nodeService, [
+            rule([""], ["pods"], ["get", "list", "create", "update", "delete", "patch", "watch"]),
+            rule([""], ["pods/log"], ["get"]),
+            rule([""], ["secrets"], ["get", "create", "update", "delete", "patch"]),
+            rule(["batch"], ["jobs"], ["get", "create", "update", "delete", "patch"]),
+            rule([""], ["nodes"], ["get", "list"]),
+            rule([""], ["nodes/proxy"], ["*"]),
+            rule([""], ["persistentvolumes", "persistentvolumeclaims"], ["get", "list"]),
+            rule([""], ["pods/exec"], ["create"]),
+            rule([""], ["events"], ["create", "get"]),
+            rule(["storage.k8s.io"], ["storageclasses"], ["get", "watch"]),
+            rule([""], ["configmaps"], ["get", "update"]),
+        ]),
+        binding("juicefs-csi-provisioner-binding", provisioner, CONTROLLER_ACCOUNT),
+        binding("juicefs-csi-node-service-binding", nodeService, NODE_ACCOUNT),
+    ];
+}
+/** The controller: the plugin, provisioning, and the resizer, which grows a volume's quota as its claim grows. */
+function controller(config) {
+    const { csi } = config.workspaceStorage;
+    return {
+        apiVersion: "apps/v1",
+        kind: "StatefulSet",
+        metadata: { name: CONTROLLER, namespace: csi.namespace, labels: { ...LABELS, "app.kubernetes.io/component": "controller" } },
+        spec: {
+            serviceName: CONTROLLER,
+            replicas: 1,
+            selector: { matchLabels: CONTROLLER_POD_LABELS },
+            template: {
+                metadata: { labels: { ...LABELS, ...CONTROLLER_POD_LABELS } },
+                spec: {
+                    serviceAccountName: CONTROLLER_ACCOUNT,
+                    priorityClassName: "system-cluster-critical",
+                    tolerations: [{ key: "CriticalAddonsOnly", operator: "Exists" }],
+                    containers: [
+                        {
+                            name: "juicefs-plugin",
+                            image: imageReference(csi.image),
+                            args: ["--endpoint=$(CSI_ENDPOINT)", "--logtostderr", "--nodeid=$(NODE_NAME)", "--leader-election", "--provisioner=true", "--config=/etc/config/config.yaml"],
+                            env: [{ name: "CSI_ENDPOINT", value: `unix://${CONTROLLER_SOCKET_DIR}csi.sock` }, ...pluginEnv(config)],
+                            ports: [{ name: "healthz", containerPort: 9909, protocol: "TCP" }],
+                            livenessProbe: PLUGIN_PROBE,
+                            // It mounts the file system itself, to make and remove volumes' directories.
+                            securityContext: { privileged: true, capabilities: { add: ["SYS_ADMIN"] } },
+                            resources: csi.controller.resources,
+                            volumeMounts: [
+                                { name: "socket-dir", mountPath: CONTROLLER_SOCKET_DIR },
+                                { name: "jfs-dir", mountPath: "/jfs", mountPropagation: "Bidirectional" },
+                                { name: "jfs-root-dir", mountPath: "/root/.juicefs", mountPropagation: "Bidirectional" },
+                                { name: "juicefs-config", mountPath: "/etc/config" },
+                            ],
+                        },
+                        {
+                            name: "csi-resizer",
+                            image: imageReference(csi.resizerImage),
+                            args: ["--csi-address=$(ADDRESS)", "--timeout=20s", "--leader-election", "--v=2"],
+                            env: [{ name: "ADDRESS", value: `${CONTROLLER_SOCKET_DIR}csi.sock` }],
+                            resources: { requests: { cpu: "5m", memory: "24Mi" }, limits: { memory: "128Mi" } },
+                            volumeMounts: [{ name: "socket-dir", mountPath: CONTROLLER_SOCKET_DIR }],
+                        },
+                        livenessProbe(config, "socket-dir"),
+                    ],
+                    volumes: [
+                        { name: "socket-dir", emptyDir: {} },
+                        { name: "jfs-dir", hostPath: { path: MOUNT_PATH, type: "DirectoryOrCreate" } },
+                        { name: "jfs-root-dir", hostPath: { path: CONFIG_PATH, type: "DirectoryOrCreate" } },
+                        { name: "juicefs-config", configMap: { name: CONFIG } },
+                    ],
+                },
+            },
+        },
+    };
+}
+/** The node service: the plugin, which makes mount pods and binds their mounts into pods, and the registrar, which names it to kubelet. */
+function nodeService(config) {
+    const { csi } = config.workspaceStorage;
+    const pluginDir = `/var/lib/kubelet/csi-plugins/${CSI_DRIVER}/`;
+    return {
+        apiVersion: "apps/v1",
+        kind: "DaemonSet",
+        metadata: { name: NODE, namespace: csi.namespace, labels: { ...LABELS, "app.kubernetes.io/component": "node" } },
+        spec: {
+            selector: { matchLabels: NODE_POD_LABELS },
+            template: {
+                metadata: { labels: { ...LABELS, ...NODE_POD_LABELS } },
+                spec: {
+                    serviceAccountName: NODE_ACCOUNT,
+                    priorityClassName: "system-node-critical",
+                    dnsPolicy: "ClusterFirstWithHostNet",
+                    tolerations: [{ key: "CriticalAddonsOnly", operator: "Exists" }],
+                    containers: [
+                        {
+                            name: "juicefs-plugin",
+                            image: imageReference(csi.image),
+                            args: ["--endpoint=$(CSI_ENDPOINT)", "--logtostderr", "--nodeid=$(NODE_NAME)", "--enable-manager=true", "--config=/etc/config/config.yaml"],
+                            env: [
+                                { name: "CSI_ENDPOINT", value: "unix:/csi/csi.sock" },
+                                { name: "HOST_IP", valueFrom: { fieldRef: { fieldPath: "status.hostIP" } } },
+                                { name: "KUBELET_PORT", value: "10250" },
+                                ...pluginEnv(config),
+                            ],
+                            ports: [{ name: "healthz", containerPort: 9909, protocol: "TCP" }],
+                            livenessProbe: PLUGIN_PROBE,
+                            securityContext: { privileged: true },
+                            resources: csi.node.resources,
+                            volumeMounts: [
+                                { name: "kubelet-dir", mountPath: "/var/lib/kubelet", mountPropagation: "Bidirectional" },
+                                { name: "plugin-dir", mountPath: "/csi" },
+                                { name: "device-dir", mountPath: "/dev" },
+                                { name: "jfs-dir", mountPath: "/jfs", mountPropagation: "Bidirectional" },
+                                { name: "jfs-root-dir", mountPath: "/root/.juicefs", mountPropagation: "Bidirectional" },
+                                { name: "juicefs-config", mountPath: "/etc/config" },
+                                // Where it keeps each mount's FUSE descriptor, by which a mount pod that
+                                // crashes comes back under the same mount (guide/configurations.md
+                                // "Automatic mount point recovery").
+                                { name: "jfs-fuse-fd", mountPath: "/tmp" },
+                            ],
+                        },
+                        {
+                            name: "node-driver-registrar",
+                            image: imageReference(csi.registrarImage),
+                            args: ["--csi-address=$(ADDRESS)", "--kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)", "--v=5"],
+                            env: [{ name: "ADDRESS", value: "/csi/csi.sock" }, { name: "DRIVER_REG_SOCK_PATH", value: `${pluginDir}csi.sock` }],
+                            resources: { requests: { cpu: "5m", memory: "16Mi" }, limits: { memory: "64Mi" } },
+                            volumeMounts: [{ name: "plugin-dir", mountPath: "/csi" }, { name: "registration-dir", mountPath: "/registration" }],
+                        },
+                        livenessProbe(config, "plugin-dir"),
+                    ],
+                    volumes: [
+                        { name: "kubelet-dir", hostPath: { path: "/var/lib/kubelet", type: "Directory" } },
+                        { name: "plugin-dir", hostPath: { path: pluginDir, type: "DirectoryOrCreate" } },
+                        { name: "registration-dir", hostPath: { path: "/var/lib/kubelet/plugins_registry/", type: "Directory" } },
+                        { name: "device-dir", hostPath: { path: "/dev", type: "Directory" } },
+                        { name: "jfs-dir", hostPath: { path: MOUNT_PATH, type: "DirectoryOrCreate" } },
+                        { name: "jfs-root-dir", hostPath: { path: CONFIG_PATH, type: "DirectoryOrCreate" } },
+                        { name: "juicefs-config", configMap: { name: CONFIG } },
+                        { name: "jfs-fuse-fd", hostPath: { path: "/var/run/juicefs-csi", type: "DirectoryOrCreate" } },
+                    ],
+                },
+            },
+        },
+    };
+}
+/** The driver's objects, unless the cluster already has the driver: the CSIDriver and the mount pods' PriorityClass among them, which are the cluster's. */
+export function juicefsCsiObjects(config) {
+    const { csi } = config.workspaceStorage;
+    if (!csi.enabled)
+        return [];
+    const csiDriver = {
+        apiVersion: "storage.k8s.io/v1",
+        kind: "CSIDriver",
+        metadata: { name: CSI_DRIVER, labels: LABELS },
+        spec: { attachRequired: false, podInfoOnMount: true },
+    };
+    const priorityClass = {
+        apiVersion: "scheduling.k8s.io/v1",
+        kind: "PriorityClass",
+        metadata: { name: MOUNT_PRIORITY_CLASS, labels: LABELS },
+        // As high as a pod's may be, so mount pods outlast the workspaces they serve, and
+        // never preempting, so a new one evicts nothing.
+        value: 1_000_000_000,
+        preemptionPolicy: "Never",
+        globalDefault: false,
+        description: "JuiceFS's mount pods, which serve alasio's workspaces",
+    };
+    const configMap = {
+        apiVersion: "v1",
+        kind: "ConfigMap",
+        metadata: { name: CONFIG, namespace: csi.namespace, labels: LABELS },
+        data: { "config.yaml": goJson(driverConfig(config), "  ") },
+    };
+    return [csiDriver, priorityClass, ...identities(config), configMap, controller(config), nodeService(config)];
+}
+//# sourceMappingURL=juicefs-csi.js.map

package/dist/cli/src/manifests/juicefs-csi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"juicefs-csi.js","sourceRoot":"","sources":["../../../../src/manifests/juicefs-csi.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAe,MAAM,aAAa,CAAC;AAGlD,yEAAyE;AACzE,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAC5C,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,IAAI,GAAG,kBAAkB,CAAC;AAChC,MAAM,MAAM,GAAG,2BAA2B,CAAC;AAC3C,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AACvD,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,uCAAuC;AACvC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD,mDAAmD;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAW,EAAE,wBAAwB,EAAE,eAAe,EAAE,CAAC;AACtF,2GAA2G;AAC3G,MAAM,CAAC,MAAM,qBAAqB,GAAW,EAAE,GAAG,EAAE,UAAU,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,CAAC;AACrK,MAAM,CAAC,MAAM,eAAe,GAAW,EAAE,GAAG,EAAE,IAAI,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,CAAC;AAEzJ,2GAA2G;AAC3G,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAA8B,gBAAgB,CAAC,wBAAwB,CAAC,KAAK,qBAAqB,CAAC,wBAAwB,CAAC,GAAG,CAAC;AACrK,6FAA6F;AAC7F,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC,4GAA4G;AAC5G,MAAM,CAAC,MAAM,aAAa,GAAW,EAAE,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC;AAE3E,oHAAoH;AACpH,MAAM,MAAM,GAAW;IACrB,wBAAwB,EAAE,oBAAoB;IAC9C,4BAA4B,EAAE,oBAAoB;IAClD,2BAA2B,EAAE,OAAO;IACpC,8BAA8B,EAAE,QAAQ;IACxC,GAAG,aAAa;CACjB,CAAC;AAEF,2GAA2G;AAC3G,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,+DAA+D;AAC/D,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAElE;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,EAAE,gBAAgB,EAAiB;IAC9D,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC;IACjF,OAAO;QACL,kBAAkB,EAAE,KAAK;QACzB,aAAa,EAAE,CAAC;gBACd,WAAW,EAAE,EAAE,qBAAqB,EAAE,gBAAgB,EAAE;gBACxD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;gBAC5C,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;gBACjC,YAAY,EAAE;oBACZ,wEAAwE;oBACxE,cAAc,YAAY,EAAE;oBAC5B,sBAAsB;oBACtB,eAAe,cAAc,EAAE;iBAChC;gBACD,oFAAoF;gBACpF,mFAAmF;gBACnF,kEAAkE;gBAClE,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,mEAAmE,CAAC,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;aACzL,CAAC;KACH,CAAC;AACJ,CAAC;AAED,uIAAuI;AACvI,SAAS,SAAS,CAAC,EAAE,gBAAgB,EAAiB;IACpD,OAAO;QACL,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE;QAC9E,EAAE,IAAI,EAAE,yBAAyB,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACjG,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE;QAC7E,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,EAAE;QACjD,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,WAAW,EAAE;QACnD,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,oBAAoB,EAAE;QACpE,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE;QAC3D,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,YAAY,GAAY,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;AAErK,6EAA6E;AAC7E,SAAS,aAAa,CAAC,EAAE,gBAAgB,EAAiB,EAAE,YAAoB;IAC9E,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC9D,IAAI,EAAE,CAAC,6BAA6B,EAAE,oBAAoB,CAAC;QAC3D,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAClF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,IAAI,CAAC,SAAmB,EAAE,SAAmB,EAAE,KAAe;IACrE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,4FAA4F;AAC5F,SAAS,UAAU,CAAC,EAAE,gBAAgB,EAAiB;IACrD,MAAM,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC;IAC3C,MAAM,OAAO,GAAG,CAAC,IAAY,EAAoB,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAClJ,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAAqB,EAAiB,EAAE,CAAC,CAAC;QACpE,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QAClC,KAAK;KACN,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,WAAmB,EAAwB,EAAE,CAAC,CAAC;QAC9F,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QAClC,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxF,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,mCAAmC,CAAC;IACxD,MAAM,WAAW,GAAG,wCAAwC,CAAC;IAC7D,OAAO;QACL,OAAO,CAAC,kBAAkB,CAAC;QAC3B,OAAO,CAAC,YAAY,CAAC;QACrB,IAAI,CAAC,WAAW,EAAE;YAChB,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxF,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,wBAAwB,EAAE,+BAA+B,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACpH,IAAI,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACtE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtE,IAAI,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACxF,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACjG,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1F,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChF,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjG,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACnF,CAAC;QACF,IAAI,CAAC,WAAW,EAAE;YAChB,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACrF,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvE,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5E,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;SAC9C,CAAC;QACF,OAAO,CAAC,iCAAiC,EAAE,WAAW,EAAE,kBAAkB,CAAC;QAC3E,OAAO,CAAC,kCAAkC,EAAE,WAAW,EAAE,YAAY,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,kHAAkH;AAClH,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACxC,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,6BAA6B,EAAE,YAAY,EAAE,EAAE;QAC5H,IAAI,EAAE;YACJ,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE;YAChD,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,qBAAqB,EAAE,EAAE;gBAC7D,IAAI,EAAE;oBACJ,kBAAkB,EAAE,kBAAkB;oBACtC,iBAAiB,EAAE,yBAAyB;oBAC5C,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBAChE,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,gBAAgB;4BACtB,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC;4BAChC,IAAI,EAAE,CAAC,4BAA4B,EAAE,eAAe,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,kCAAkC,CAAC;4BAC7J,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,qBAAqB,UAAU,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;4BACvG,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;4BAClE,aAAa,EAAE,YAAY;4BAC3B,6EAA6E;4BAC7E,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE;4BAC3E,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,SAAS;4BACnC,YAAY,EAAE;gCACZ,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,qBAAqB,EAAE;gCACxD,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,eAAe,EAAE;gCACzE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE;gCACxF,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE;6BACrD;yBACF;wBACD;4BACE,IAAI,EAAE,aAAa;4BACnB,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;4BACvC,IAAI,EAAE,CAAC,0BAA0B,EAAE,eAAe,EAAE,mBAAmB,EAAE,OAAO,CAAC;4BACjF,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,qBAAqB,UAAU,EAAE,CAAC;4BACrE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;4BACnF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;yBACzE;wBACD,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;qBACpC;oBACD,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE;wBACpC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;wBAC9E,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;wBACpF,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;qBACxD;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,2IAA2I;AAC3I,SAAS,WAAW,CAAC,MAAqB;IACxC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACxC,MAAM,SAAS,GAAG,gCAAgC,UAAU,GAAG,CAAC;IAChE,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,6BAA6B,EAAE,MAAM,EAAE,EAAE;QAChH,IAAI,EAAE;YACJ,QAAQ,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE;YAC1C,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,eAAe,EAAE,EAAE;gBACvD,IAAI,EAAE;oBACJ,kBAAkB,EAAE,YAAY;oBAChC,iBAAiB,EAAE,sBAAsB;oBACzC,SAAS,EAAE,yBAAyB;oBACpC,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBAChE,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,gBAAgB;4BACtB,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC;4BAChC,IAAI,EAAE,CAAC,4BAA4B,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,kCAAkC,CAAC;4BAC3I,GAAG,EAAE;gCACH,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE;gCACrD,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE;gCAC5E,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE;gCACxC,GAAG,SAAS,CAAC,MAAM,CAAC;6BACrB;4BACD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;4BAClE,aAAa,EAAE,YAAY;4BAC3B,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;4BACrC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;4BAC7B,YAAY,EAAE;gCACZ,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE;gCACzF,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE;gCACzC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE;gCACzC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,eAAe,EAAE;gCACzE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE;gCACxF,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE;gCACpD,yEAAyE;gCACzE,mEAAmE;gCACnE,qCAAqC;gCACrC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE;6BAC3C;yBACF;wBACD;4BACE,IAAI,EAAE,uBAAuB;4BAC7B,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC;4BACzC,IAAI,EAAE,CAAC,0BAA0B,EAAE,qDAAqD,EAAE,OAAO,CAAC;4BAClG,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,GAAG,SAAS,UAAU,EAAE,CAAC;4BACnH,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;4BAClF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;yBACpH;wBACD,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;qBACpC;oBACD,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;wBAClF,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;wBAChF,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,oCAAoC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;wBACzG,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;wBACrE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;wBAC9E,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;wBACpF,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;wBACvD,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;qBAC/F;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,4JAA4J;AAC5J,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAgB;QAC7B,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9C,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KACtD,CAAC;IACF,MAAM,aAAa,GAAoB;QACrC,UAAU,EAAE,sBAAsB;QAClC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE;QACxD,kFAAkF;QAClF,iDAAiD;QACjD,KAAK,EAAE,aAAa;QACpB,gBAAgB,EAAE,OAAO;QACzB,aAAa,EAAE,KAAK;QACpB,WAAW,EAAE,uDAAuD;KACrE,CAAC;IACF,MAAM,SAAS,GAAgB;QAC7B,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QACpE,IAAI,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE;KAC5D,CAAC;IACF,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/G,CAAC"}

package/dist/cli/src/manifests/neon.js

@@ -1,5 +1,8 @@
 import { imageReference } from "../images.js";
 import { claimSpec, componentName, databaseSecret, given, goJson, helperResources, imagePullSecrets, NAMESPACE, neonName, otelEnv, RELEASE, restrictedContainer, s3Endpoint, script, selectorLabels, sha256, stackLabels, stackPodSpec, waitFor, waitForObjectStore, } from "./common.js";
+import { JUICEFS_METRICS_PORT, JUICEFS_PODS_SELECTOR, VOLUME_DRIVER } from "./juicefs-csi.js";
+import { VALKEY, VALKEY_PORT } from "./valkey.js";
+import { VALKEY_ADDRESS, workspacesBucketUrl } from "./workspace-storage.js";
 /** A Service of the stack's: its name and component, selecting the component's pods, on `ports`. */
 function service(name, component, ports) {
     return {
@@ -14,13 +17,13 @@ function secretVariable(secret, key) {
     return { name: key, valueFrom: { secretKeyRef: { name: secret, key } } };
 }
 /**
- * The stack's secrets, made once and kept, and each service's rendered from them, by
- * neon/control/kube-setup.ts: a Job, which applying alasio runs to completion before
+ * The stack's secrets, made once and kept, and each service's rendered from them, workspace
+ * storage's among them when it is on, by neon/control/kube-setup.ts: a Job, which applying alasio runs to completion before
  * anything else of alasio starts (../kube/apply.ts).
  */
 function setup(config) {
     const name = neonName("setup");
-    const { objectStore } = config;
+    const { objectStore, workspaceStorage } = config;
     const metadata = { name, namespace: NAMESPACE, labels: stackLabels("neon-setup") };
     const serviceAccount = { apiVersion: "v1", kind: "ServiceAccount", metadata };
     const role = {
@@ -66,6 +69,16 @@ function setup(config) {
                                 { name: "S3_REGION", value: objectStore.external.region },
                                 { name: "S3_BUCKET_NEON", value: objectStore.buckets.neon },
                                 { name: "S3_BUCKET_LAKE", value: objectStore.buckets.lake },
+                                ...(workspaceStorage.enabled
+                                    ? [
+                                        { name: "WORKSPACES_NAME", value: workspaceStorage.name },
+                                        { name: "WORKSPACES_BUCKET", value: objectStore.buckets.workspaces },
+                                        { name: "WORKSPACES_BUCKET_URL", value: workspacesBucketUrl(config) },
+                                        { name: "WORKSPACES_TRASH_DAYS", value: String(workspaceStorage.trashDays) },
+                                        { name: "VALKEY_ADDRESS", value: VALKEY_ADDRESS },
+                                        { name: "WORKSPACES_SECRET_LABELS", value: JSON.stringify(VOLUME_DRIVER) },
+                                    ]
+                                    : []),
                                 ...(objectStore.bundled.enabled ? [] : [
                                     { name: "S3_EXTERNAL", value: "1" },
                                     { name: "S3_ACCESS_KEY", valueFrom: { secretKeyRef: { name: objectStore.external.existingSecret, key: "accessKey" } } },
@@ -486,10 +499,13 @@ function compute(config) {
 }
 /**
  * A logical dump of alasio's database, restorable into any Postgres whatever becomes of
- * the stack, to the object store's backups bucket, of which the last `keep` are kept.
+ * the stack, to the object store's backups bucket, and beside it, with workspace storage,
+ * the newest dump JuiceFS has made of its file system's metadata, which it makes in the
+ * workspaces bucket's `<name>/meta/`; of each, the last `keep` are kept.
  */
 function backup(config) {
     const component = "neon-backup";
+    const { objectStore, workspaceStorage } = config;
     const dump = {
         name: "dump",
         image: imageReference(config.neon.computeImage),
@@ -514,13 +530,26 @@ function backup(config) {
         command: [
             "/bin/sh",
             "-c",
-            script("set -eu", 's3() { aws s3 --endpoint-url "$S3_ENDPOINT" "$@"; }', "stamp=$(date -u +%Y%m%dT%H%M%SZ)", 's3 cp /backup/alasio.dump "s3://$BUCKET/alasio-$stamp.dump"', "s3 ls \"s3://$BUCKET/\" | awk '{print $4}' | grep '^alasio-.*\\.dump$' | sort -r | tail -n +$((KEEP + 1)) \\", '  | while read -r old; do s3 rm "s3://$BUCKET/$old"; done'),
+            script("set -eu", 's3() { aws s3 --endpoint-url "$S3_ENDPOINT" "$@"; }', 
+            // Deletes all but the newest KEEP of the backups whose names match $1, which sort by when they were made.
+            "prune() { s3 ls \"s3://$BUCKET/\" | awk '{print $4}' | grep \"$1\" | sort -r | tail -n +$((KEEP + 1)) \\", '  | while read -r old; do s3 rm "s3://$BUCKET/$old"; done; }', "stamp=$(date -u +%Y%m%dT%H%M%SZ)", 's3 cp /backup/alasio.dump "s3://$BUCKET/alasio-$stamp.dump"', "prune '^alasio-.*\\.dump$'", ...(workspaceStorage.enabled
+                ? [
+                    'meta="s3://$WORKSPACES_BUCKET/$WORKSPACES_NAME/meta/"',
+                    "dump=$(s3 ls \"$meta\" | awk '{print $4}' | grep '^dump-.*\\.json\\.gz$' | sort -r | head -n 1)",
+                    // None until a workspace's volume has been mounted for a while.
+                    'if [ -n "$dump" ]; then s3 cp "$meta$dump" "s3://$BUCKET/$WORKSPACES_NAME-$dump"; else echo "JuiceFS has dumped no metadata of $WORKSPACES_NAME yet"; fi',
+                    'prune "^$WORKSPACES_NAME-dump-.*\\.json\\.gz$"',
+                ]
+                : [])),
         ],
         env: [
             { name: "S3_ENDPOINT", value: s3Endpoint(config) },
-            { name: "BUCKET", value: config.objectStore.buckets.backups },
+            { name: "BUCKET", value: objectStore.buckets.backups },
             { name: "KEEP", value: String(config.neon.backup.keep) },
-            { name: "AWS_DEFAULT_REGION", value: config.objectStore.external.region },
+            ...(workspaceStorage.enabled
+                ? [{ name: "WORKSPACES_BUCKET", value: objectStore.buckets.workspaces }, { name: "WORKSPACES_NAME", value: workspaceStorage.name }]
+                : []),
+            { name: "AWS_DEFAULT_REGION", value: objectStore.external.region },
             { name: "HOME", value: "/tmp" },
         ],
         envFrom: [{ secretRef: { name: neonName("s3-admin") } }],
@@ -558,14 +587,16 @@ function backup(config) {
 }
 /**
  * The stack's telemetry: every Neon service's, SeaweedFS's and the lake's Prometheus
- * metrics, scraped and sent on as OTLP where alasio's telemetry goes, when it goes
- * anywhere. Its pod carries its configuration's checksum, so it is replaced when that
- * changes.
+ * metrics, and with workspace storage JuiceFS's and Valkey's, scraped and sent on as OTLP
+ * where alasio's telemetry goes, when it goes anywhere. JuiceFS's are its driver's and
+ * mount pods', found among the pods of the driver's namespace, which the collector may
+ * list; Valkey's are read with its password. Its pod carries its configuration's
+ * checksum, so it is replaced when that changes.
  */
 function collector(config, endpoint) {
     const name = neonName("collector");
     const component = "neon-collector";
-    const { telemetry } = config;
+    const { telemetry, workspaceStorage } = config;
     const safekeeper = neonName("safekeeper");
     const targets = {
         pageserver: [`${neonName("pageserver")}:9898`],
@@ -576,19 +607,51 @@ function collector(config, endpoint) {
         ...(config.objectStore.bundled.enabled ? { seaweedfs: [`${componentName("seaweedfs")}:9327`] } : {}),
         ...(config.lake.enabled ? { lake: [`${componentName("lake")}:9464`] } : {}),
     };
+    // Each running pod at its address, on the metrics port, named by its pod. The
+    // collector reads `$` as the start of a variable, and `$$` as a `$`.
+    const juicefs = {
+        job_name: "juicefs",
+        scrape_interval: "30s",
+        kubernetes_sd_configs: [{
+                role: "pod",
+                namespaces: { names: [workspaceStorage.csi.namespace] },
+                selectors: [{ role: "pod", label: JUICEFS_PODS_SELECTOR }],
+            }],
+        relabel_configs: [
+            { source_labels: ["__meta_kubernetes_pod_phase"], regex: "Running", action: "keep" },
+            { source_labels: ["__meta_kubernetes_pod_ip"], target_label: "__address__", replacement: `$$1:${JUICEFS_METRICS_PORT}` },
+            { source_labels: ["__meta_kubernetes_pod_name"], target_label: "pod" },
+        ],
+    };
     const collectorConfig = {
         receivers: {
             prometheus: {
                 config: {
-                    scrape_configs: Object.keys(targets).sort().map((job) => ({ job_name: job, scrape_interval: "30s", static_configs: [{ targets: targets[job] }] })),
+                    scrape_configs: [
+                        ...Object.keys(targets).sort().map((job) => ({ job_name: job, scrape_interval: "30s", static_configs: [{ targets: targets[job] }] })),
+                        ...(workspaceStorage.enabled ? [juicefs] : []),
+                    ],
                 },
             },
+            ...(workspaceStorage.enabled
+                ? {
+                    redis: {
+                        endpoint: `${VALKEY}:${VALKEY_PORT}`,
+                        password: "${env:VALKEY_PASSWORD}",
+                        collection_interval: "30s",
+                        // How near it is to refusing writes: used memory against this.
+                        metrics: { "redis.maxmemory": { enabled: true } },
+                    },
+                }
+                : {}),
         },
         processors: { resource: { attributes: [{ key: "service.namespace", value: "alasio-neon", action: "upsert" }] }, batch: {} },
         exporters: { otlphttp: { endpoint, ...(telemetry.headersSecret ? { headers: "${file:/etc/otelcol/headers/headers.yaml}" } : {}) } },
         service: {
             telemetry: { metrics: { level: "none" } },
-            pipelines: { metrics: { receivers: ["prometheus"], processors: ["resource", "batch"], exporters: ["otlphttp"] } },
+            pipelines: {
+                metrics: { receivers: ["prometheus", ...(workspaceStorage.enabled ? ["redis"] : [])], processors: ["resource", "batch"], exporters: ["otlphttp"] },
+            },
         },
     };
     const configMap = {
@@ -607,12 +670,14 @@ function collector(config, endpoint) {
             template: {
                 metadata: { labels: stackLabels(component), annotations: { "checksum/config": sha256(goJson(collectorConfig)) } },
                 spec: {
+                    ...(workspaceStorage.enabled ? { serviceAccountName: name } : {}),
                     ...stackPodSpec(config),
                     containers: [{
                             name: "collector",
                             image: imageReference(config.neon.collector.image),
                             imagePullPolicy: "IfNotPresent",
                             args: ["--config=/etc/otelcol/config.yaml"],
+                            ...(workspaceStorage.enabled ? { env: [{ name: "VALKEY_PASSWORD", valueFrom: { secretKeyRef: { name: VALKEY, key: "password" } } }] } : {}),
                             securityContext: { ...restrictedContainer(), readOnlyRootFilesystem: true },
                             resources: config.neon.collector.resources,
                             volumeMounts: [
@@ -632,7 +697,25 @@ function collector(config, endpoint) {
             },
         },
     };
-    return [configMap, deployment];
+    if (!workspaceStorage.enabled)
+        return [configMap, deployment];
+    // Who the collector is, and that it may find JuiceFS's pods in the driver's namespace.
+    const serviceAccount = { apiVersion: "v1", kind: "ServiceAccount", metadata: { name, namespace: NAMESPACE, labels: stackLabels(component) } };
+    const metadata = { name, namespace: workspaceStorage.csi.namespace, labels: stackLabels(component) };
+    const role = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "Role",
+        metadata,
+        rules: [{ apiGroups: [""], resources: ["pods"], verbs: ["get", "list", "watch"] }],
+    };
+    const binding = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "RoleBinding",
+        metadata,
+        subjects: [{ kind: "ServiceAccount", name, namespace: NAMESPACE }],
+        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name },
+    };
+    return [serviceAccount, role, binding, configMap, deployment];
 }
 /** Neon's objects, when it runs. */
 export function neonObjects(config) {