alasio 4.0.0

package/dist/cli/src/manifests/agent-sandbox.js

@@ -0,0 +1,89 @@
+import { given, NAMESPACE, RELEASE } from "./common.js";
+import sandboxes from "./sandboxes.agents.x-k8s.io.json" with { type: "json" };
+/**
+ * The Sandbox CRD, agents.x-k8s.io's `sandboxes`, as the API server takes it, whose
+ * schema's keys (`x-kubernetes-*`, say) are not client-node's model's.
+ */
+export const SANDBOX_CRD = sandboxes;
+const NAME = `${RELEASE}-agent-sandbox-controller`;
+/** The labels of the controller's objects: the controller's name and version, the installation, and alasio as their manager. */
+const LABELS = {
+    "app.kubernetes.io/name": "agent-sandbox-controller",
+    "app.kubernetes.io/instance": RELEASE,
+    "app.kubernetes.io/version": "v1.0.5",
+    "app.kubernetes.io/managed-by": "alasio",
+};
+/** The controller: its identity, what it may do (Sandboxes and their pods, volumes and Services, cluster-wide; its leader lease, here), and its Deployment. */
+function controller(config) {
+    const { image, resources, nodeSelector, tolerations, affinity } = config.agentSandbox;
+    const serviceAccount = { apiVersion: "v1", kind: "ServiceAccount", metadata: { name: NAME, namespace: NAMESPACE, labels: LABELS } };
+    const clusterRole = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "ClusterRole",
+        metadata: { name: NAME, labels: LABELS },
+        rules: [
+            { apiGroups: [""], resources: ["persistentvolumeclaims", "pods", "services"], verbs: ["create", "delete", "get", "list", "patch", "update", "watch"] },
+            { apiGroups: ["", "events.k8s.io"], resources: ["events"], verbs: ["create", "patch"] },
+            { apiGroups: ["agents.x-k8s.io"], resources: ["sandboxes"], verbs: ["create", "delete", "get", "list", "patch", "update", "watch"] },
+            { apiGroups: ["agents.x-k8s.io"], resources: ["sandboxes/finalizers", "sandboxes/status"], verbs: ["get", "patch", "update"] },
+        ],
+    };
+    const subjects = [{ kind: "ServiceAccount", name: NAME, namespace: NAMESPACE }];
+    const clusterRoleBinding = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "ClusterRoleBinding",
+        metadata: { name: NAME, labels: LABELS },
+        subjects,
+        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "ClusterRole", name: NAME },
+    };
+    // Leader election's lease, in the controller's own namespace only.
+    const role = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "Role",
+        metadata: { name: NAME, namespace: NAMESPACE, labels: LABELS },
+        rules: [{ apiGroups: ["coordination.k8s.io"], resources: ["leases"], verbs: ["create", "get", "list", "patch", "update", "watch"] }],
+    };
+    const roleBinding = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "RoleBinding",
+        metadata: { name: NAME, namespace: NAMESPACE, labels: LABELS },
+        subjects,
+        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: NAME },
+    };
+    const deployment = {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { name: NAME, namespace: NAMESPACE, labels: LABELS },
+        spec: {
+            replicas: 1,
+            selector: { matchLabels: { "app.kubernetes.io/name": "agent-sandbox-controller", "app.kubernetes.io/instance": RELEASE } },
+            template: {
+                metadata: { labels: LABELS },
+                spec: {
+                    serviceAccountName: NAME,
+                    securityContext: { runAsNonRoot: true, seccompProfile: { type: "RuntimeDefault" } },
+                    containers: [{
+                            name: "controller",
+                            image: `${image.repository}:${image.tag}${image.digest ? `@${image.digest}` : ""}`,
+                            imagePullPolicy: image.pullPolicy,
+                            args: ["--leader-elect=true"],
+                            ports: [{ name: "metrics", containerPort: 8080 }, { name: "healthz", containerPort: 8081 }],
+                            livenessProbe: { httpGet: { path: "/healthz", port: "healthz" } },
+                            readinessProbe: { httpGet: { path: "/readyz", port: "healthz" } },
+                            securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, runAsNonRoot: true, capabilities: { drop: ["ALL"] } },
+                            resources,
+                        }],
+                    ...given("nodeSelector", { ...nodeSelector }),
+                    ...given("tolerations", [...tolerations]),
+                    ...given("affinity", affinity),
+                },
+            },
+        },
+    };
+    return [serviceAccount, clusterRole, clusterRoleBinding, role, roleBinding, deployment];
+}
+/** agent-sandbox's objects, unless the cluster already has it. */
+export function agentSandboxObjects(config) {
+    return config.agentSandbox.enabled ? [SANDBOX_CRD, ...controller(config)] : [];
+}
+//# sourceMappingURL=agent-sandbox.js.map

package/dist/cli/src/manifests/agent-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-sandbox.js","sourceRoot":"","sources":["../../../../src/manifests/agent-sandbox.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,SAAS,MAAM,kCAAkC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAqB,SAAS,CAAC;AAEvD,MAAM,IAAI,GAAG,GAAG,OAAO,2BAA2B,CAAC;AAEnD,gIAAgI;AAChI,MAAM,MAAM,GAAG;IACb,wBAAwB,EAAE,0BAA0B;IACpD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,QAAQ;IACrC,8BAA8B,EAAE,QAAQ;CACzC,CAAC;AAEF,+JAA+J;AAC/J,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IACtF,MAAM,cAAc,GAAqB,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;IACtJ,MAAM,WAAW,GAAkB;QACjC,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,KAAK,EAAE;YACL,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,wBAAwB,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;YACtJ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE;YACvF,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpI,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;SAC/H;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAyB;QAC/C,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,QAAQ;QACR,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;KACpF,CAAC;IACF,mEAAmE;IACnE,MAAM,IAAI,GAAW;QACnB,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;KACrI,CAAC;IACF,MAAM,WAAW,GAAkB;QACjC,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,QAAQ;QACR,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;KAC7E,CAAC;IACF,MAAM,UAAU,GAAiB;QAC/B,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,IAAI,EAAE;YACJ,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,OAAO,EAAE,EAAE;YAC1H,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;gBAC5B,IAAI,EAAE;oBACJ,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE;oBACnF,UAAU,EAAE,CAAC;4BACX,IAAI,EAAE,YAAY;4BAClB,KAAK,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;4BAClF,eAAe,EAAE,KAAK,CAAC,UAAU;4BACjC,IAAI,EAAE,CAAC,qBAAqB,CAAC;4BAC7B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;4BAC3F,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;4BACjE,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;4BACjE,eAAe,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;4BACvI,SAAS;yBACV,CAAC;oBACF,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,GAAG,YAAY,EAAE,CAAC;oBAC7C,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;oBACzC,GAAG,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC;iBAC/B;aACF;SACF;KACF,CAAC;IACF,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC"}

package/dist/cli/src/manifests/alasio.js

@@ -0,0 +1,367 @@
+import { imageReference } from "../images.js";
+import { componentName, databaseSecret, envOf, given, goJson, helperResources, hostVolumeMounts, hostVolumes, imagePullSecrets, labels, NAMESPACE, otelEnv, RELEASE, restrictedContainer, restrictedPod, selectorLabels, sha256, } from "./common.js";
+/** The port every workspace's bayma serves MCP on. */
+const BAYMA_PORT = 7290;
+/** The namespaces whose Sandboxes alasio drives: the sessions', and the host profile's. */
+function workspaceNamespaces(config) {
+    return [...(config.sessions.enabled ? [config.sessions.namespace] : []), ...(config.host.enabled ? [config.host.namespace] : [])];
+}
+/**
+ * The template of session filesystems' Sandboxes: an empty, isolated workspace under
+ * the sessions' runtime, restricted. alasio adds what is per Sandbox: its name and
+ * labels, bayma's token, and its network mode.
+ */
+function sessionsProfile(config) {
+    const { sessions } = config;
+    const agent = imageReference(config.images.agent);
+    return {
+        namespace: sessions.namespace,
+        port: BAYMA_PORT,
+        workspaceDir: "/workspace",
+        egressGate: sessions.egressGate,
+        fullModeNameservers: [...sessions.fullModeNameservers],
+        podTemplate: {
+            metadata: { labels: { "app.kubernetes.io/part-of": "alasio", "app.kubernetes.io/instance": RELEASE, "app.kubernetes.io/component": "session" } },
+            spec: {
+                ...(sessions.runtimeClassName ? { runtimeClassName: sessions.runtimeClassName } : {}),
+                securityContext: restrictedPod(1000, 1000),
+                ...imagePullSecrets(config),
+                ...given("nodeSelector", { ...sessions.nodeSelector }),
+                ...given("tolerations", [...sessions.tolerations]),
+                initContainers: [
+                    // The workspace and home on the session's volume, and bayma's toolbelt, which the
+                    // image installs, linked into the home.
+                    {
+                        name: "prepare",
+                        image: agent,
+                        imagePullPolicy: config.images.pullPolicy,
+                        command: [
+                            "/bin/sh",
+                            "-c",
+                            "mkdir -p /data/workspace /data/home/.local/share/bayma && ln -sfn /opt/bayma-data/bayma/toolbelt /data/home/.local/share/bayma/toolbelt",
+                        ],
+                        securityContext: restrictedContainer(),
+                        ...helperResources(),
+                        volumeMounts: [{ name: "data", mountPath: "/data" }],
+                    },
+                ],
+                containers: [{
+                        name: "bayma",
+                        image: agent,
+                        imagePullPolicy: config.images.pullPolicy,
+                        command: ["/usr/bin/tini", "-s", "--", "node", "/opt/bayma/bayma.js"],
+                        args: ["mcp-http", "--host", "0.0.0.0", "--port", String(BAYMA_PORT), "--state-dir", "/home/agent/.bayma"],
+                        workingDir: "/workspace",
+                        env: [
+                            { name: "HOME", value: "/home/agent" },
+                            { name: "USER", value: "agent" },
+                            { name: "BAYMA_PAYLOAD_DIR", value: "/opt/bayma/payload" },
+                        ],
+                        ports: [{ name: "mcp", containerPort: BAYMA_PORT }],
+                        securityContext: restrictedContainer(),
+                        resources: sessions.resources,
+                        volumeMounts: [
+                            { name: "data", mountPath: "/workspace", subPath: "workspace" },
+                            { name: "data", mountPath: "/home/agent", subPath: "home" },
+                            { name: "tmp", mountPath: "/tmp" },
+                        ],
+                    }],
+                volumes: [{ name: "tmp", emptyDir: { sizeLimit: "2Gi" } }],
+            },
+        },
+        volumeClaimTemplates: [{
+                metadata: { name: "data" },
+                spec: {
+                    accessModes: ["ReadWriteOnce"],
+                    ...(sessions.storage.storageClassName ? { storageClassName: sessions.storage.storageClassName } : {}),
+                    resources: { requests: { storage: sessions.storage.size } },
+                },
+            }],
+    };
+}
+/** The template of folder workspaces' bayma: bayma itself, as the operator, with the machine's mounts. */
+function hostProfile(config) {
+    const { host } = config;
+    return {
+        namespace: host.namespace,
+        port: BAYMA_PORT,
+        stateRoot: host.stateRoot,
+        podTemplate: {
+            metadata: { labels: { "app.kubernetes.io/part-of": "alasio", "app.kubernetes.io/instance": RELEASE, "app.kubernetes.io/component": "folder-bayma" } },
+            spec: {
+                // May restart alasio, by rolling out its Deployment, as an agent restarts it.
+                serviceAccountName: componentName("host-agent"),
+                securityContext: {
+                    runAsUser: host.uid,
+                    runAsGroup: host.gid,
+                    // The group the bayma token's Secret volume is given, which the operator's user
+                    // reads it as; the node's own paths the mounts give are left as they are.
+                    fsGroup: host.gid,
+                    ...given("supplementalGroups", [...host.supplementalGroups]),
+                },
+                ...imagePullSecrets(config),
+                containers: [{
+                        name: "bayma",
+                        image: imageReference(host.baymaImage),
+                        imagePullPolicy: "IfNotPresent",
+                        args: ["mcp-http", "--host", "0.0.0.0", "--port", String(BAYMA_PORT), "--default-durability", "checkpointed"],
+                        workingDir: host.home,
+                        env: [{ name: "HOME", value: host.home }, ...envOf(host.env)],
+                        ports: [{ name: "mcp", containerPort: BAYMA_PORT }],
+                        securityContext: {
+                            // What bayma needs to snapshot its REPL sessions' processes as it stops and
+                            // restore them whole as it starts again.
+                            capabilities: { add: ["CHECKPOINT_RESTORE", "SYS_PTRACE"] },
+                            seccompProfile: { type: "Unconfined" },
+                            appArmorProfile: { type: "Unconfined" },
+                        },
+                        resources: host.resources,
+                        ...given("volumeMounts", hostVolumeMounts(config)),
+                    }],
+                ...given("volumes", hostVolumes(config)),
+            },
+        },
+    };
+}
+/** The ConfigMap of the templates, and their checksum, which alasio's pod carries so it is replaced when they change. */
+function sandboxTemplates(config) {
+    const name = componentName("sandbox-templates");
+    const templates = goJson({ ...(config.sessions.enabled ? { sessions: sessionsProfile(config) } : {}), ...(config.host.enabled ? { host: hostProfile(config) } : {}) }, "  ");
+    return {
+        configMap: { apiVersion: "v1", kind: "ConfigMap", metadata: { name, namespace: NAMESPACE, labels: labels("alasio") }, data: { "templates.json": templates } },
+        checksum: sha256(templates),
+    };
+}
+/** alasio's environment: where its templates, state, database and receiver are, and what the configuration adds. */
+function alasioEnv(config, home) {
+    const { alasio, host } = config;
+    return [
+        { name: "ALASIO_KUBE_TEMPLATES", value: "/etc/alasio/templates.json" },
+        { name: "ALASIO_STATE_DIR", value: "/var/lib/alasio/state" },
+        { name: "HOME", value: home },
+        { name: "ALASIO_DEPLOYMENT", value: RELEASE },
+        { name: "ALASIO_NAMESPACE", valueFrom: { fieldRef: { fieldPath: "metadata.namespace" } } },
+        { name: "TELEGRAM_BOT_TOKEN", valueFrom: { secretKeyRef: { name: alasio.telegram.existingSecret, key: "token" } } },
+        { name: "TELEGRAM_ALLOWED_USER_IDS", valueFrom: { secretKeyRef: { name: alasio.telegram.existingSecret, key: "allowedUserIds" } } },
+        { name: "ALASIO_DATABASE_URL_FILE", value: "/run/alasio/database/url" },
+        { name: "ALASIO_LAKE_PASSWORD_FILE", value: "/run/alasio/database/lake-password" },
+        { name: "ALASIO_LAKE_ENABLED", value: config.lake.enabled && config.neon.enabled ? "1" : "0" },
+        { name: "ALASIO_TELEMETRY_RECEIVER_SERVICE", value: `${componentName("telemetry")}.${NAMESPACE}.svc` },
+        { name: "ALASIO_TELEMETRY_RECEIVER_PORT", value: String(config.telemetry.receiverPort) },
+        ...(alasio.defaultHarness ? [{ name: "ALASIO_DEFAULT_HARNESS", value: alasio.defaultHarness }] : []),
+        ...(host.enabled && host.workspaceRoot ? [{ name: "ALASIO_WORKSPACE_ROOT", value: host.workspaceRoot }] : []),
+        ...(alasio.claude.existingSecret
+            ? [{ name: "CLAUDE_CODE_OAUTH_TOKEN", valueFrom: { secretKeyRef: { name: alasio.claude.existingSecret, key: alasio.claude.key } } }]
+            : []),
+        ...otelEnv(config),
+        ...envOf(alasio.env),
+    ];
+}
+/**
+ * alasio's Deployment: one replica, as one Telegram poller and one SQLite writer, so an
+ * update stops the old pod before the new one starts. Under the host profile it runs as
+ * the operator, in their home, with the machine's mounts.
+ */
+function deployment(config, templatesChecksum) {
+    const { alasio, host } = config;
+    const home = host.enabled && host.alasioHome ? host.home : "/var/lib/alasio/home";
+    const uid = host.enabled ? host.uid : alasio.runAsUser;
+    const gid = host.enabled ? host.gid : alasio.runAsGroup;
+    const groups = [...new Set([...alasio.supplementalGroups, ...(host.enabled ? host.supplementalGroups : [])])];
+    const image = imageReference(config.images.alasio);
+    return {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { name: RELEASE, namespace: NAMESPACE, labels: labels("alasio") },
+        spec: {
+            replicas: 1,
+            strategy: { type: "Recreate" },
+            selector: { matchLabels: selectorLabels("alasio") },
+            template: {
+                metadata: { labels: labels("alasio"), annotations: { "checksum/sandbox-templates": templatesChecksum } },
+                spec: {
+                    serviceAccountName: RELEASE,
+                    // alasio finishes its turns' bookkeeping and records what it interrupts as it stops.
+                    terminationGracePeriodSeconds: 60,
+                    securityContext: { ...restrictedPod(uid, gid), ...given("supplementalGroups", groups) },
+                    ...imagePullSecrets(config),
+                    initContainers: [
+                        // alasio's state directory and, unless it is the operator's, its home, on its volume.
+                        {
+                            name: "prepare",
+                            image,
+                            imagePullPolicy: config.images.pullPolicy,
+                            command: ["mkdir", "-p", "/var/lib/alasio/state", "/var/lib/alasio/home"],
+                            securityContext: restrictedContainer(),
+                            ...helperResources(),
+                            volumeMounts: [{ name: "state", mountPath: "/var/lib/alasio" }],
+                        },
+                    ],
+                    containers: [{
+                            name: "alasio",
+                            image,
+                            imagePullPolicy: config.images.pullPolicy,
+                            workingDir: home,
+                            env: alasioEnv(config, home),
+                            ...given("envFrom", [...alasio.envFrom]),
+                            ports: [{ name: "telemetry", containerPort: config.telemetry.receiverPort }],
+                            securityContext: restrictedContainer(),
+                            resources: alasio.resources,
+                            volumeMounts: [
+                                { name: "state", mountPath: "/var/lib/alasio" },
+                                { name: "templates", mountPath: "/etc/alasio", readOnly: true },
+                                { name: "database", mountPath: "/run/alasio/database", readOnly: true },
+                                ...(host.enabled ? hostVolumeMounts(config) : []),
+                            ],
+                        }],
+                    volumes: [
+                        { name: "state", persistentVolumeClaim: { claimName: alasio.persistence.existingClaim || RELEASE } },
+                        { name: "templates", configMap: { name: componentName("sandbox-templates") } },
+                        {
+                            name: "database",
+                            secret: { secretName: databaseSecret(config), items: [{ key: "url", path: "url" }, { key: "lake-password", path: "lake-password" }] },
+                        },
+                        ...(host.enabled ? hostVolumes(config) : []),
+                    ],
+                    ...given("nodeSelector", { ...alasio.nodeSelector }),
+                    ...given("tolerations", [...alasio.tolerations]),
+                    ...given("affinity", alasio.affinity),
+                },
+            },
+        },
+    };
+}
+/** alasio's volume, unless the configuration names an existing claim. */
+function volume(config) {
+    const { persistence } = config.alasio;
+    if (persistence.existingClaim)
+        return [];
+    return [{
+            apiVersion: "v1",
+            kind: "PersistentVolumeClaim",
+            metadata: { name: RELEASE, namespace: NAMESPACE, labels: labels("alasio") },
+            spec: {
+                accessModes: ["ReadWriteOnce"],
+                ...(persistence.storageClassName ? { storageClassName: persistence.storageClassName } : {}),
+                resources: { requests: { storage: persistence.size } },
+            },
+        }];
+}
+/** Where session sandboxes export their telemetry: alasio's receiver. */
+function telemetryService(config) {
+    return {
+        apiVersion: "v1",
+        kind: "Service",
+        metadata: { name: componentName("telemetry"), namespace: NAMESPACE, labels: labels("alasio") },
+        spec: { selector: selectorLabels("alasio"), ports: [{ name: "otlp-http", port: config.telemetry.receiverPort, targetPort: "telemetry" }] },
+    };
+}
+/**
+ * The namespaces workspaces run in, which alasio makes unless told not to. Sessions'
+ * enforces Pod Security "restricted": nothing privileged, no host paths, no added
+ * capabilities. The host profile's is "privileged", as its pods mount the machine.
+ */
+function namespaces(config) {
+    const { sessions, host } = config;
+    return [
+        ...(sessions.enabled && sessions.createNamespace
+            ? [{
+                    apiVersion: "v1",
+                    kind: "Namespace",
+                    metadata: {
+                        name: sessions.namespace,
+                        labels: {
+                            ...labels("session"),
+                            "pod-security.kubernetes.io/enforce": "restricted",
+                            "pod-security.kubernetes.io/enforce-version": "latest",
+                            "pod-security.kubernetes.io/warn": "restricted",
+                        },
+                    },
+                }]
+            : []),
+        ...(host.enabled && host.createNamespace
+            ? [{
+                    apiVersion: "v1",
+                    kind: "Namespace",
+                    metadata: { name: host.namespace, labels: { ...labels("folder-bayma"), "pod-security.kubernetes.io/enforce": "privileged" } },
+                }]
+            : []),
+    ];
+}
+/**
+ * alasio's identity: it drives its workspaces' Sandboxes, their token Secrets, and reads
+ * files from sessions through exec, in the namespaces it owns, and nothing else.
+ */
+function identity(config) {
+    const serviceAccount = { apiVersion: "v1", kind: "ServiceAccount", metadata: { name: RELEASE, namespace: NAMESPACE, labels: labels("alasio") } };
+    return [
+        serviceAccount,
+        ...workspaceNamespaces(config).flatMap((namespace) => {
+            const metadata = { name: RELEASE, namespace, labels: labels("alasio") };
+            const role = {
+                apiVersion: "rbac.authorization.k8s.io/v1",
+                kind: "Role",
+                metadata,
+                rules: [
+                    { apiGroups: ["agents.x-k8s.io"], resources: ["sandboxes"], verbs: ["get", "list", "watch", "create", "patch", "delete"] },
+                    { apiGroups: [""], resources: ["secrets"], verbs: ["get", "create"] },
+                    { apiGroups: [""], resources: ["pods"], verbs: ["get"] },
+                    { apiGroups: [""], resources: ["pods/exec"], verbs: ["create", "get"] },
+                ],
+            };
+            const binding = {
+                apiVersion: "rbac.authorization.k8s.io/v1",
+                kind: "RoleBinding",
+                metadata,
+                subjects: [{ kind: "ServiceAccount", name: RELEASE, namespace: NAMESPACE }],
+                roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: RELEASE },
+            };
+            return [role, binding];
+        }),
+        ...(config.host.enabled ? hostAgentIdentity(config) : []),
+    ];
+}
+/**
+ * Folder workspaces' bayma: the operator's agents, which may restart alasio as they
+ * would restart it on the machine, by rolling out its Deployment, and do nothing else
+ * with the cluster.
+ */
+function hostAgentIdentity(config) {
+    const agent = componentName("host-agent");
+    const restart = componentName("restart");
+    const serviceAccount = {
+        apiVersion: "v1",
+        kind: "ServiceAccount",
+        metadata: { name: agent, namespace: config.host.namespace, labels: labels("folder-bayma") },
+    };
+    const role = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "Role",
+        metadata: { name: restart, namespace: NAMESPACE, labels: labels("folder-bayma") },
+        rules: [
+            { apiGroups: ["apps"], resources: ["deployments"], resourceNames: [RELEASE], verbs: ["get", "patch"] },
+            { apiGroups: ["apps"], resources: ["replicasets"], verbs: ["get", "list", "watch"] },
+        ],
+    };
+    const binding = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "RoleBinding",
+        metadata: { name: restart, namespace: NAMESPACE, labels: labels("folder-bayma") },
+        subjects: [{ kind: "ServiceAccount", name: agent, namespace: config.host.namespace }],
+        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: restart },
+    };
+    return [serviceAccount, role, binding];
+}
+/** alasio's objects. */
+export function alasioObjects(config) {
+    const templates = sandboxTemplates(config);
+    return [
+        ...namespaces(config),
+        ...identity(config),
+        templates.configMap,
+        ...volume(config),
+        deployment(config, templates.checksum),
+        telemetryService(config),
+    ];
+}
+//# sourceMappingURL=alasio.js.map

package/dist/cli/src/manifests/alasio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alasio.js","sourceRoot":"","sources":["../../../../src/manifests/alasio.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,cAAc,EACd,KAAK,EACL,KAAK,EACL,MAAM,EACN,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,SAAS,EACT,OAAO,EACP,OAAO,EACP,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,MAAM,GACP,MAAM,aAAa,CAAC;AAGrB,sDAAsD;AACtD,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,2FAA2F;AAC3F,SAAS,mBAAmB,CAAC,MAAqB;IAChD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACpI,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAqB;IAC5C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,YAAY;QAC1B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,mBAAmB,EAAE,CAAC,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACtD,WAAW,EAAE;YACX,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,2BAA2B,EAAE,QAAQ,EAAE,4BAA4B,EAAE,OAAO,EAAE,6BAA6B,EAAE,SAAS,EAAE,EAAE;YAChJ,IAAI,EAAE;gBACJ,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,eAAe,EAAE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;gBAC1C,GAAG,gBAAgB,CAAC,MAAM,CAAC;gBAC3B,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACtD,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAClD,cAAc,EAAE;oBACd,kFAAkF;oBAClF,wCAAwC;oBACxC;wBACE,IAAI,EAAE,SAAS;wBACf,KAAK,EAAE,KAAK;wBACZ,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;wBACzC,OAAO,EAAE;4BACP,SAAS;4BACT,IAAI;4BACJ,yIAAyI;yBAC1I;wBACD,eAAe,EAAE,mBAAmB,EAAE;wBACtC,GAAG,eAAe,EAAE;wBACpB,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;qBACrD;iBACF;gBACD,UAAU,EAAE,CAAC;wBACX,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,KAAK;wBACZ,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;wBACzC,OAAO,EAAE,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC;wBACrE,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,oBAAoB,CAAC;wBAC1G,UAAU,EAAE,YAAY;wBACxB,GAAG,EAAE;4BACH,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE;4BACtC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;4BAChC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,oBAAoB,EAAE;yBAC3D;wBACD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;wBACnD,eAAe,EAAE,mBAAmB,EAAE;wBACtC,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,YAAY,EAAE;4BACZ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE;4BAC/D,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE;4BAC3D,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE;yBACnC;qBACF,CAAC;gBACF,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;aAC3D;SACF;QACD,oBAAoB,EAAE,CAAC;gBACrB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;gBAC1B,IAAI,EAAE;oBACJ,WAAW,EAAE,CAAC,eAAe,CAAC;oBAC9B,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrG,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;iBAC5D;aACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,0GAA0G;AAC1G,SAAS,WAAW,CAAC,MAAqB;IACxC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE;YACX,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,2BAA2B,EAAE,QAAQ,EAAE,4BAA4B,EAAE,OAAO,EAAE,6BAA6B,EAAE,cAAc,EAAE,EAAE;YACrJ,IAAI,EAAE;gBACJ,8EAA8E;gBAC9E,kBAAkB,EAAE,aAAa,CAAC,YAAY,CAAC;gBAC/C,eAAe,EAAE;oBACf,SAAS,EAAE,IAAI,CAAC,GAAG;oBACnB,UAAU,EAAE,IAAI,CAAC,GAAG;oBACpB,gFAAgF;oBAChF,0EAA0E;oBAC1E,OAAO,EAAE,IAAI,CAAC,GAAG;oBACjB,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;iBAC7D;gBACD,GAAG,gBAAgB,CAAC,MAAM,CAAC;gBAC3B,UAAU,EAAE,CAAC;wBACX,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;wBACtC,eAAe,EAAE,cAAc;wBAC/B,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,sBAAsB,EAAE,cAAc,CAAC;wBAC7G,UAAU,EAAE,IAAI,CAAC,IAAI;wBACrB,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAC7D,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;wBACnD,eAAe,EAAE;4BACf,4EAA4E;4BAC5E,yCAAyC;4BACzC,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE;4BAC3D,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;4BACtC,eAAe,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;yBACxC;wBACD,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,GAAG,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;qBACnD,CAAC;gBACF,GAAG,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;aACzC;SACF;KACF,CAAC;AACJ,CAAC;AAED,yHAAyH;AACzH,SAAS,gBAAgB,CAAC,MAAqB;IAC7C,MAAM,IAAI,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,CACtB,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC5I,IAAI,CACL,CAAC;IACF,OAAO;QACL,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE;QAC7J,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,oHAAoH;AACpH,SAAS,SAAS,CAAC,MAAqB,EAAE,IAAY;IACpD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAChC,OAAO;QACL,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,4BAA4B,EAAE;QACtE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,uBAAuB,EAAE;QAC5D,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;QAC7B,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE;QAC7C,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,EAAE;QAC1F,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;QACnH,EAAE,IAAI,EAAE,2BAA2B,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE;QACnI,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,0BAA0B,EAAE;QACvE,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,oCAAoC,EAAE;QAClF,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;QAC9F,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,SAAS,MAAM,EAAE;QACtG,EAAE,IAAI,EAAE,gCAAgC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;QACxF,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc;YAC9B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;YACpI,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,OAAO,CAAC,MAAM,CAAC;QAClB,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;KACrB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAqB,EAAE,iBAAyB;IAClE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAClF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC3E,IAAI,EAAE;YACJ,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;YAC9B,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,EAAE,4BAA4B,EAAE,iBAAiB,EAAE,EAAE;gBACxG,IAAI,EAAE;oBACJ,kBAAkB,EAAE,OAAO;oBAC3B,qFAAqF;oBACrF,6BAA6B,EAAE,EAAE;oBACjC,eAAe,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE;oBACvF,GAAG,gBAAgB,CAAC,MAAM,CAAC;oBAC3B,cAAc,EAAE;wBACd,sFAAsF;wBACtF;4BACE,IAAI,EAAE,SAAS;4BACf,KAAK;4BACL,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;4BACzC,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,sBAAsB,CAAC;4BACzE,eAAe,EAAE,mBAAmB,EAAE;4BACtC,GAAG,eAAe,EAAE;4BACpB,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;yBAChE;qBACF;oBACD,UAAU,EAAE,CAAC;4BACX,IAAI,EAAE,QAAQ;4BACd,KAAK;4BACL,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;4BACzC,UAAU,EAAE,IAAI;4BAChB,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC;4BAC5B,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;4BACxC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;4BAC5E,eAAe,EAAE,mBAAmB,EAAE;4BACtC,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,YAAY,EAAE;gCACZ,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE;gCAC/C,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;gCAC/D,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE;gCACvE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;6BAClD;yBACF,CAAC;oBACF,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa,IAAI,OAAO,EAAE,EAAE;wBACpG,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,mBAAmB,CAAC,EAAE,EAAE;wBAC9E;4BACE,IAAI,EAAE,UAAU;4BAChB,MAAM,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;yBACtI;wBACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC7C;oBACD,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;oBACpD,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;oBAChD,GAAG,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;iBACtC;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,MAAM,CAAC,MAAqB;IACnC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,IAAI,WAAW,CAAC,aAAa;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,CAAC;YACN,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;YAC3E,IAAI,EAAE;gBACJ,WAAW,EAAE,CAAC,eAAe,CAAC;gBAC9B,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE;aACvD;SACF,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,MAAqB;IAC7C,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC9F,IAAI,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,EAAE;KAC3I,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAClC,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,eAAe;YAC9C,CAAC,CAAC,CAAC;oBACD,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ,CAAC,SAAS;wBACxB,MAAM,EAAE;4BACN,GAAG,MAAM,CAAC,SAAS,CAAC;4BACpB,oCAAoC,EAAE,YAAY;4BAClD,4CAA4C,EAAE,QAAQ;4BACtD,iCAAiC,EAAE,YAAY;yBAChD;qBACF;iBACF,CAAC;YACF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,eAAe;YACtC,CAAC,CAAC,CAAC;oBACD,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,oCAAoC,EAAE,YAAY,EAAE,EAAE;iBAC9H,CAAC;YACF,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,MAAqB;IACrC,MAAM,cAAc,GAAqB,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;IACnK,OAAO;QACL,cAAc;QACd,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAsB,EAAE;YACvE,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,GAAW;gBACnB,UAAU,EAAE,8BAA8B;gBAC1C,IAAI,EAAE,MAAM;gBACZ,QAAQ;gBACR,KAAK,EAAE;oBACL,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;oBAC1H,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE;oBACrE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;oBACxD,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE;iBACxE;aACF,CAAC;YACF,MAAM,OAAO,GAAkB;gBAC7B,UAAU,EAAE,8BAA8B;gBAC1C,IAAI,EAAE,aAAa;gBACnB,QAAQ;gBACR,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;gBAC3E,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;aAChF,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzB,CAAC,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAAqB;IAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,cAAc,GAAqB;QACvC,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE;KAC5F,CAAC;IACF,MAAM,IAAI,GAAW;QACnB,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE;QACjF,KAAK,EAAE;YACL,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;YACtG,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;SACrF;KACF,CAAC;IACF,MAAM,OAAO,GAAkB;QAC7B,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE;QACjF,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrF,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;KAChF,CAAC;IACF,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,wBAAwB;AACxB,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO;QACL,GAAG,UAAU,CAAC,MAAM,CAAC;QACrB,GAAG,QAAQ,CAAC,MAAM,CAAC;QACnB,SAAS,CAAC,SAAS;QACnB,GAAG,MAAM,CAAC,MAAM,CAAC;QACjB,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC;QACtC,gBAAgB,CAAC,MAAM,CAAC;KACzB,CAAC;AACJ,CAAC"}