alasio 4.0.0

package/dist/cli/src/manifests/common.js

@@ -0,0 +1,157 @@
+/**
+ * What the objects of an installation share: their names and labels, image references,
+ * security contexts, and the pieces of pod specs several components have alike.
+ *
+ * Every object is named after the installation, `alasio`, and labelled as Kubernetes
+ * recommends, managed by alasio. Names, and the labels that select pods, stay as they
+ * are from one version to the next, as a workload's selector cannot change.
+ */
+import { createHash } from "node:crypto";
+import { imageReference } from "../images.js";
+import { VERSION } from "../release.js";
+/** The namespace alasio runs in, which its objects are in unless they say another. */
+export const NAMESPACE = "alasio";
+/**
+ * The installation's name: alasio's own objects' name (its Deployment, ServiceAccount
+ * and volume), the start of every other's, and the instance every object is labelled
+ * with.
+ */
+export const RELEASE = "alasio";
+/** A component's name: `alasio-<component>`. */
+export function componentName(component) {
+    return `${RELEASE}-${component}`;
+}
+/** A Neon service's name: `alasio-neon-<component>`. */
+export function neonName(component) {
+    return componentName(`neon-${component}`);
+}
+/** The labels every object of a component carries. */
+export function labels(component) {
+    return {
+        "app.kubernetes.io/name": "alasio",
+        "app.kubernetes.io/instance": RELEASE,
+        "app.kubernetes.io/version": VERSION,
+        "app.kubernetes.io/managed-by": "alasio",
+        "app.kubernetes.io/part-of": "alasio",
+        "app.kubernetes.io/component": component,
+    };
+}
+/** The labels of a pod of the data stack (Neon, the object store, the lake), which its NetworkPolicy admits each other by. */
+export function stackLabels(component) {
+    return { ...labels(component), "alasio.dev/stack": "neon" };
+}
+/** The labels that select a component's pods. */
+export function selectorLabels(component) {
+    return { "app.kubernetes.io/name": "alasio", "app.kubernetes.io/instance": RELEASE, "app.kubernetes.io/component": component };
+}
+/** The pod security context of a workload that runs restricted, as `uid` and `gid`. */
+export function restrictedPod(uid, gid) {
+    return { runAsNonRoot: true, runAsUser: uid, runAsGroup: gid, fsGroup: gid, seccompProfile: { type: "RuntimeDefault" } };
+}
+/** The security context of a container that runs restricted. */
+export function restrictedContainer() {
+    return { allowPrivilegeEscalation: false, capabilities: { drop: ["ALL"] } };
+}
+/** The resources of a short-lived helper container: an init container's, say. */
+export function helperResources() {
+    return { resources: { requests: { cpu: "10m", memory: "16Mi" }, limits: { memory: "64Mi" } } };
+}
+/** `{ [key]: value }` when `value` holds anything, so an object says nothing of what was given empty. */
+export function given(key, value) {
+    return Object.keys(value).length > 0 ? { [key]: value } : {};
+}
+/** The variables of a record, in the order of their names, so an object lists them alike however they were given. */
+export function envOf(variables) {
+    return Object.keys(variables).sort().map((name) => ({ name, value: variables[name] ?? "" }));
+}
+/**
+ * OpenTelemetry's standard variables, which alasio, the lake and Neon's compute export
+ * with: none when no endpoint is set.
+ */
+export function otelEnv({ telemetry }) {
+    if (!telemetry.otlpEndpoint)
+        return [];
+    return [
+        { name: "OTEL_EXPORTER_OTLP_ENDPOINT", value: telemetry.otlpEndpoint },
+        { name: "OTEL_EXPORTER_OTLP_PROTOCOL", value: telemetry.otlpProtocol },
+        ...(telemetry.headersSecret
+            ? [{ name: "OTEL_EXPORTER_OTLP_HEADERS", valueFrom: { secretKeyRef: { name: telemetry.headersSecret, key: telemetry.headersKey } } }]
+            : []),
+        ...(telemetry.resourceAttributes ? [{ name: "OTEL_RESOURCE_ATTRIBUTES", value: telemetry.resourceAttributes }] : []),
+    ];
+}
+/** The pull secrets every pod is given. */
+export function imagePullSecrets(config) {
+    return given("imagePullSecrets", config.imagePullSecrets.map((name) => ({ name })));
+}
+/** The host profile's mounts, as volumes. */
+export function hostVolumes(config) {
+    return config.host.mounts.map((mount) => ({ name: mount.name, hostPath: { path: mount.hostPath, ...(mount.type ? { type: mount.type } : {}) } }));
+}
+/** The host profile's mounts, as volume mounts. */
+export function hostVolumeMounts(config) {
+    return config.host.mounts.map((mount) => ({ name: mount.name, mountPath: mount.mountPath, ...(mount.readOnly ? { readOnly: true } : {}) }));
+}
+/** The spec of a claim of `storage`. */
+export function claimSpec(storage) {
+    return {
+        accessModes: ["ReadWriteOnce"],
+        ...(storage.storageClassName ? { storageClassName: storage.storageClassName } : {}),
+        resources: { requests: { storage: storage.size } },
+    };
+}
+/** The Secret alasio reads its database URL and the lake role's password from. */
+export function databaseSecret(config) {
+    return config.neon.enabled ? `${RELEASE}-database` : config.neon.external.existingSecret;
+}
+/** The object store's S3 endpoint, as pods in alasio's namespace reach it. */
+export function s3Endpoint(config) {
+    return config.objectStore.bundled.enabled ? `http://${componentName("seaweedfs")}:8333` : config.objectStore.external.endpoint;
+}
+/** What every pod of the data stack has in its spec: pull secrets, Neon's user, and placement. */
+export function stackPodSpec(config) {
+    return {
+        ...imagePullSecrets(config),
+        securityContext: restrictedPod(config.neon.runAsUser, config.neon.runAsGroup),
+        ...given("nodeSelector", { ...config.neon.nodeSelector }),
+        ...given("tolerations", [...config.neon.tolerations]),
+    };
+}
+/** An init container that waits until `url` answers 2xx, with Neon's image's curl. */
+export function waitFor(config, name, url) {
+    return {
+        name: `wait-for-${name}`,
+        image: imageReference(config.neon.image),
+        imagePullPolicy: "IfNotPresent",
+        command: ["/bin/sh", "-c", 'until curl -fsS -o /dev/null --max-time 5 "$0"; do sleep 2; done', url],
+        securityContext: restrictedContainer(),
+        ...helperResources(),
+    };
+}
+/** Until the bundled object store's buckets exist, nothing that stores in them starts: the init container that waits, if it is bundled. */
+export function waitForObjectStore(config) {
+    return config.objectStore.bundled.enabled ? [waitFor(config, "object-store", `http://${componentName("seaweedfs")}:8333/healthz`)] : [];
+}
+/** A shell script of `lines`, one to a line. */
+export function script(...lines) {
+    return `${lines.join("\n")}\n`;
+}
+/** Object keys in order, at every depth, as Go's encoding/json writes a map's. */
+function sortedKeys(_key, value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? Object.fromEntries(Object.entries(value).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)))
+        : value;
+}
+/**
+ * `value` as JSON as Go's encoding/json writes it: keys sorted, so a value is always
+ * written alike, and its checksum with it; `<`, `>`, `&` and the line separators
+ * escaped; and, with `indent`, indented by it.
+ */
+export function goJson(value, indent) {
+    return JSON.stringify(value, sortedKeys, indent).replace(/[<>&\u2028\u2029]/gu, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/** The sha256 of `text`, in hex. */
+export function sha256(text) {
+    return createHash("sha256").update(text).digest("hex");
+}
+//# sourceMappingURL=common.js.map

package/dist/cli/src/manifests/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../src/manifests/common.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAczC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,sFAAsF;AACtF,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC;AAElC;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAEhC,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,QAAQ,CAAC,SAAiB;IACxC,OAAO,aAAa,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC;AAC5C,CAAC;AAID,sDAAsD;AACtD,MAAM,UAAU,MAAM,CAAC,SAAiB;IACtC,OAAO;QACL,wBAAwB,EAAE,QAAQ;QAClC,4BAA4B,EAAE,OAAO;QACrC,2BAA2B,EAAE,OAAO;QACpC,8BAA8B,EAAE,QAAQ;QACxC,2BAA2B,EAAE,QAAQ;QACrC,6BAA6B,EAAE,SAAS;KACzC,CAAC;AACJ,CAAC;AAED,8HAA8H;AAC9H,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,4BAA4B,EAAE,OAAO,EAAE,6BAA6B,EAAE,SAAS,EAAE,CAAC;AACjI,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW;IACpD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,CAAC;AAC3H,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,mBAAmB;IACjC,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe;IAC7B,OAAO,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACjG,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,KAAK,CAAqC,GAAM,EAAE,KAAQ;IACxE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,KAAK,CAAC,SAA2C;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,EAAE,SAAS,EAAiB;IAClD,IAAI,CAAC,SAAS,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO;QACL,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,EAAE;QACtE,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,EAAE;QACtE,GAAG,CAAC,SAAS,CAAC,aAAa;YACzB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,aAAa,EAAE,GAAG,EAAE,SAAS,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;YACrI,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrH,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACpJ,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9I,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,SAAS,CAAC,OAAuD;IAC/E,OAAO;QACL,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;AAC3F,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,MAAqB;IAC9C,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;AACjI,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,OAAO;QACL,GAAG,gBAAgB,CAAC,MAAM,CAAC;QAC3B,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAC7E,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACzD,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,OAAO,CAAC,MAAqB,EAAE,IAAY,EAAE,GAAW;IACtE,OAAO;QACL,IAAI,EAAE,YAAY,IAAI,EAAE;QACxB,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACxC,eAAe,EAAE,cAAc;QAC/B,OAAO,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,kEAAkE,EAAE,GAAG,CAAC;QACnG,eAAe,EAAE,mBAAmB,EAAE;QACtC,GAAG,eAAe,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,2IAA2I;AAC3I,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,aAAa,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1I,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,MAAM,CAAC,GAAG,KAAe;IACvC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,IAAY,EAAE,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,KAAc,EAAE,MAAe;IACpD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACtJ,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}

package/dist/cli/src/manifests/config.js

@@ -0,0 +1,283 @@
+/**
+ * How alasio is installed: the settings an operator chooses, which alasio's command line
+ * keeps in its config file as plain JSON, checked here: what is refused is said by its
+ * key, and why. Every key may be left out for its default, and alasio's own images
+ * default to this package's (../release.ts).
+ *
+ * A map of quantities given for resources adds to its defaults rather than replacing
+ * them, so `{ "limits": { "cpu": "2" } }` keeps the default memory limit.
+ */
+import { isIPv4 } from "node:net";
+import { Effect, Predicate, Result, Schema, SchemaGetter, SchemaIssue } from "effect";
+import { IMAGES } from "../release.js";
+/** The install configuration is not what alasio installs from; the message says which key and why. */
+export class InstallConfigError extends Schema.TaggedError()("InstallConfigError", {
+    message: Schema.String,
+}) {
+}
+/** `schema`, which is `value` (as the config file would hold it) when its key is left out. */
+export const defaulted = (schema, value) => schema.pipe(Schema.withDecodingDefaultKey(Effect.succeed(value)));
+/** A string that matches `pattern`, which `message` says it must otherwise. */
+export const matching = (pattern, message) => Schema.String.check(Schema.isPattern(pattern, { message }));
+const NAME = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/u;
+const Namespace = matching(NAME, "must be a namespace name");
+const SecretName = matching(/^[a-z0-9]([-a-z0-9.]{0,251}[a-z0-9])?$/u, "must be a Secret's name");
+/** A Secret's name, or empty for none. */
+const OptionalSecretName = matching(/^(|[a-z0-9]([-a-z0-9.]{0,251}[a-z0-9])?)$/u, "must be a Secret's name, or empty");
+export const NonEmpty = Schema.String.check(Schema.isMinLength(1, { message: "must not be empty" }));
+export const AbsolutePath = matching(/^\//u, "must be an absolute path");
+/** An http(s) URL, or empty for none. */
+export const OptionalUrl = matching(/^(|https?:\/\/.+)$/u, "must be an http(s) URL, or empty");
+const Id = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0, { message: "must be a user or group id" }));
+const Bucket = matching(/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/u, "must be a bucket's name");
+const Size = matching(/^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|Pi|k|M|G|T|P)?$/u, "must be a storage size, such as 20Gi");
+const PullPolicy = Schema.Literals(["Always", "IfNotPresent", "Never"]);
+/** An image's digest, or empty for an image not pinned. */
+const Digest = matching(/^(|sha256:[0-9a-f]{64})$/u, "must be a sha256 digest, or empty");
+/** A JSON object, which the API server checks as the object it is (a toleration, say) when alasio is applied. */
+const object = () => Schema.declare((value) => Predicate.isObject(value), { message: "must be an object" });
+/** An image: its repository, its tag (this package's version when empty), and its digest, if pinned. */
+const Image = (image) => defaulted(Schema.Struct({
+    repository: defaulted(NonEmpty, image.repository),
+    tag: defaulted(Schema.String, image.tag),
+    digest: defaulted(Digest, image.digest),
+}), {});
+/** A resource quantity; one given as a number (`2` CPUs) is that number's quantity. */
+const Quantity = Schema.Union([Schema.String, Schema.Finite.pipe(Schema.decodeTo(Schema.String, { decode: SchemaGetter.String(), encode: SchemaGetter.Number() }))]);
+const Quantities = Schema.Record(Schema.String, Quantity);
+/** Quantities that add to `defaults`, or replace theirs. */
+const quantities = (defaults) => defaulted(Quantities.pipe(Schema.decodeTo(Schema.Record(Schema.String, Schema.String), {
+    decode: SchemaGetter.transform((given) => ({ ...defaults, ...given })),
+    encode: SchemaGetter.passthrough(),
+})), {});
+/** A container's resources, its requests and limits over `defaults`. */
+const Resources = (defaults) => defaulted(Schema.Struct({ requests: quantities(defaults.requests), limits: quantities(defaults.limits) }), {});
+/** A volume: its size, and its StorageClass, the cluster's default when empty. */
+const Storage = (size) => defaulted(Schema.Struct({ size: defaulted(Size, size), storageClassName: defaulted(Schema.String, "") }), {});
+const Env = defaulted(Schema.Record(Schema.String, Schema.String), {});
+const NodeSelector = defaulted(Schema.Record(Schema.String, Schema.String), {});
+const Tolerations = defaulted(Schema.Array(object()), []);
+const Affinity = defaulted(object(), {});
+const Ids = defaulted(Schema.Array(Id), []);
+/** A path of the machine the host profile mounts into alasio and each folder's bayma. */
+const HostMount = Schema.Struct({
+    name: matching(NAME, "must be a volume name"),
+    hostPath: AbsolutePath,
+    mountPath: AbsolutePath,
+    readOnly: defaulted(Schema.Boolean, false),
+    /** What must be at hostPath; empty checks nothing. */
+    type: defaulted(Schema.Literals(["", "Directory", "DirectoryOrCreate", "File", "FileOrCreate", "Socket", "CharDevice", "BlockDevice"]), ""),
+});
+const Alasio = Schema.Struct({
+    /** The bot's token and who may use it: a Secret with keys `token` and `allowedUserIds`. */
+    telegram: Schema.Struct({ existingSecret: SecretName.annotateKey({ messageMissingKey: "is required: the Secret of the bot's token and allowed users" }) })
+        .annotateKey({ messageMissingKey: "is required, with existingSecret" }),
+    /** The harness a new conversation uses; empty leaves alasio's default. */
+    defaultHarness: defaulted(Schema.Literals(["", "claude", "codex"]), ""),
+    /** Claude Code's login: a Secret whose `key` holds a token from `claude setup-token`; none finds it in alasio's home. */
+    claude: defaulted(Schema.Struct({ existingSecret: defaulted(OptionalSecretName, ""), key: defaulted(NonEmpty, "token") }), {}),
+    /** alasio's home and state: a volume of its own, or an existing claim. */
+    persistence: defaulted(Schema.Struct({ size: defaulted(Size, "20Gi"), storageClassName: defaulted(Schema.String, ""), existingClaim: defaulted(Schema.String, "") }), {}),
+    env: Env,
+    envFrom: defaulted(Schema.Array(object()), []),
+    resources: Resources({ requests: { cpu: "500m", memory: "1Gi" }, limits: { memory: "8Gi" } }),
+    /** Whom alasio runs as, unless the host profile says. */
+    runAsUser: defaulted(Id, 1000),
+    runAsGroup: defaulted(Id, 1000),
+    supplementalGroups: Ids,
+    nodeSelector: NodeSelector,
+    tolerations: Tolerations,
+    affinity: Affinity,
+});
+const Telemetry = Schema.Struct({
+    /** Where alasio, its harnesses, bayma, the lake and Neon's collector export to; empty exports nothing. */
+    otlpEndpoint: defaulted(OptionalUrl, ""),
+    otlpProtocol: defaulted(Schema.Literals(["http/protobuf", "http/json", "grpc"]), "http/protobuf"),
+    /** A Secret whose `headersKey` holds OTEL_EXPORTER_OTLP_HEADERS. */
+    headersSecret: defaulted(OptionalSecretName, ""),
+    headersKey: defaulted(NonEmpty, "headers"),
+    resourceAttributes: defaulted(Schema.String, ""),
+    /** The port alasio receives session sandboxes' telemetry on. */
+    receiverPort: defaulted(Schema.Int.check(Schema.isBetween({ minimum: 1024, maximum: 65535 }, { message: "must be a port from 1024 to 65535" })), 4318),
+});
+const Sessions = Schema.Struct({
+    enabled: defaulted(Schema.Boolean, true),
+    namespace: defaulted(Namespace, "alasio-sessions"),
+    createNamespace: defaulted(Schema.Boolean, true),
+    /** The RuntimeClass sessions run under; empty runs them under the cluster's default runtime. */
+    runtimeClassName: defaulted(Schema.String, "gvisor"),
+    storage: Storage("10Gi"),
+    resources: Resources({ requests: { cpu: "250m", memory: "512Mi" }, limits: { cpu: "2", memory: "2Gi" } }),
+    /** Whether a session's pod waits until NetworkPolicy confines it. */
+    egressGate: defaulted(Schema.Boolean, true),
+    /** The resolvers sessions with internet access use. */
+    fullModeNameservers: defaulted(Schema.Array(Schema.String.check(Schema.makeFilter((address) => isIPv4(address) || "must be an IPv4 address"))).check(Schema.isMinLength(1, { message: "must list from one to three resolvers" }), Schema.isMaxLength(3, { message: "must list from one to three resolvers" })), ["1.1.1.1", "8.8.8.8"]),
+    /** What sessions with internet access may not reach. */
+    blockedCidrs: defaulted(Schema.Array(matching(/^[0-9.]+\/[0-9]{1,2}$/u, "must be an IPv4 CIDR")), ["0.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.168.0.0/16", "224.0.0.0/4", "240.0.0.0/4"]),
+    nodeSelector: NodeSelector,
+    tolerations: Tolerations,
+});
+const Host = Schema.Struct({
+    /** The host profile: folder workspaces on the machine's own files. Privileged, for a single-node cluster the operator owns. */
+    enabled: defaulted(Schema.Boolean, false),
+    namespace: defaulted(Namespace, "alasio-host"),
+    createNamespace: defaulted(Schema.Boolean, true),
+    baymaImage: Image({
+        repository: "ghcr.io/eaucoin/bayma",
+        tag: "0.11.0",
+        digest: "sha256:91f78d334302fced5c5aecb5bdb1cb99757a8b05d0c9fda5d3b9855ebc6d1236",
+    }),
+    /** The operator's user and home, which alasio and each folder's bayma run as and in. */
+    uid: defaulted(Id, 1000),
+    gid: defaulted(Id, 1000),
+    supplementalGroups: Ids,
+    home: defaulted(AbsolutePath, "/home/operator"),
+    /** Where folder workspaces' bayma keeps its state, under a mount. */
+    stateRoot: defaulted(AbsolutePath, "/home/operator/.alasio/bayma"),
+    mounts: defaulted(Schema.Array(HostMount), []),
+    /** The directory folder workspaces are created under, a path of the mounts; empty leaves alasio's default. */
+    workspaceRoot: defaulted(matching(/^(|\/.*)$/u, "must be an absolute path, or empty"), ""),
+    /** Whether alasio's home is the operator's rather than its volume. */
+    alasioHome: defaulted(Schema.Boolean, true),
+    env: Env,
+    resources: Resources({ requests: { cpu: "100m", memory: "256Mi" }, limits: { memory: "8Gi" } }),
+});
+/** A service of Neon's with a volume. */
+const NeonStored = (size, resources) => defaulted(Schema.Struct({ storage: Storage(size), resources: Resources(resources) }), {});
+/** A service of Neon's without one. */
+const NeonService = (resources) => defaulted(Schema.Struct({ resources: Resources(resources) }), {});
+const Neon = Schema.Struct({
+    enabled: defaulted(Schema.Boolean, true),
+    /** Without Neon, alasio's database: a Secret with `url` and `lake-password`. */
+    external: defaulted(Schema.Struct({ existingSecret: defaulted(OptionalSecretName, "") }), {}),
+    image: Image({
+        repository: "neondatabase/neon",
+        tag: "release-9129",
+        digest: "sha256:166022a72bf9983eba96d061d794f4740edbd4c3301e66202c1180acce9a323c",
+    }),
+    computeImage: Image({
+        repository: "neondatabase/compute-node-v17",
+        tag: "release-compute-9073",
+        digest: "sha256:ed6a613231d7026b4df8b00563444b9f33745370a3b3f0a2183e723f460ba974",
+    }),
+    controllerDbImage: Image({
+        repository: "postgres",
+        tag: "17-bookworm",
+        digest: "sha256:639ab7ceb90e13123085b741fb31ef493fba25463002f6da665352e7b534b652",
+    }),
+    /** Whom Neon's services run as, owning their volumes. */
+    runAsUser: defaulted(Id, 1000),
+    runAsGroup: defaulted(Id, 1000),
+    safekeepers: defaulted(Schema.Struct({
+        /** How many safekeepers hold each timeline's WAL. */
+        replicas: defaulted(Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 7 }, { message: "must be from 1 to 7" })), 3),
+        storage: Storage("20Gi"),
+        resources: Resources({ requests: { cpu: "100m", memory: "256Mi" }, limits: { memory: "1Gi" } }),
+    }), {}),
+    pageserver: NeonStored("50Gi", { requests: { cpu: "250m", memory: "512Mi" }, limits: { memory: "4Gi" } }),
+    storageController: NeonService({ requests: { cpu: "50m", memory: "128Mi" }, limits: { memory: "512Mi" } }),
+    storageBroker: NeonService({ requests: { cpu: "50m", memory: "64Mi" }, limits: { memory: "256Mi" } }),
+    controllerDb: NeonStored("2Gi", { requests: { cpu: "50m", memory: "128Mi" }, limits: { memory: "512Mi" } }),
+    control: NeonStored("100Mi", { requests: { cpu: "20m", memory: "64Mi" }, limits: { memory: "256Mi" } }),
+    compute: NeonService({ requests: { cpu: "500m", memory: "1Gi" }, limits: { memory: "4Gi" } }),
+    /** A daily logical dump of alasio's database to the object store, the last `keep` kept. */
+    backup: defaulted(Schema.Struct({
+        enabled: defaulted(Schema.Boolean, true),
+        schedule: defaulted(Schema.String.check(Schema.isMinLength(9, { message: "must be a cron schedule" })), "17 3 * * *"),
+        keep: defaulted(Schema.Int.check(Schema.isGreaterThanOrEqualTo(1, { message: "must be at least 1" })), 14),
+    }), {}),
+    /** The stack's own metrics, scraped and sent where telemetry goes. */
+    collector: defaulted(Schema.Struct({
+        enabled: defaulted(Schema.Boolean, true),
+        image: Image({
+            repository: "otel/opentelemetry-collector-contrib",
+            tag: "0.161.0",
+            digest: "sha256:fd328de2552466ad78385e1b1289c3f2402b1c45f265b252aab1955b42845ac1",
+        }),
+        /** Where the collector sends to, when not telemetry.otlpEndpoint. */
+        otlpEndpoint: defaulted(OptionalUrl, ""),
+        resources: Resources({ requests: { cpu: "50m", memory: "128Mi" }, limits: { memory: "512Mi" } }),
+    }), {}),
+    nodeSelector: NodeSelector,
+    tolerations: Tolerations,
+});
+const ObjectStore = Schema.Struct({
+    /** SeaweedFS, run beside Neon. */
+    bundled: defaulted(Schema.Struct({
+        enabled: defaulted(Schema.Boolean, true),
+        image: Image({
+            repository: "chrislusf/seaweedfs",
+            tag: "4.47",
+            digest: "sha256:ce9e796f1fe6f06968f4c04bdaf8f678dad9c8acdfef3d244133d71bfa6bf882",
+        }),
+        storage: Storage("100Gi"),
+        /** The most volumes it keeps, each up to 1GiB. */
+        volumes: defaulted(Schema.Int.check(Schema.isGreaterThanOrEqualTo(30, { message: "must be at least 30" })), 100),
+        /** The disk it leaves free. */
+        minFreeSpace: defaulted(matching(/^[0-9]+(KiB|MiB|GiB|TiB)$/u, "must be a size in KiB, MiB, GiB or TiB"), "5GiB"),
+        resources: Resources({ requests: { cpu: "100m", memory: "256Mi" }, limits: { memory: "2Gi" } }),
+    }), {}),
+    /** Or an S3-compatible store of the operator's: its endpoint, region, and a Secret with `accessKey` and `secretKey`. */
+    external: defaulted(Schema.Struct({
+        endpoint: defaulted(OptionalUrl, ""),
+        region: defaulted(NonEmpty, "us-east-1"),
+        existingSecret: defaulted(OptionalSecretName, ""),
+    }), {}),
+    buckets: defaulted(Schema.Struct({ neon: defaulted(Bucket, "neon"), lake: defaulted(Bucket, "lake"), backups: defaulted(Bucket, "backups") }), {}),
+});
+/** agent-sandbox's controller, installed once per cluster; off where the cluster already has it. */
+const AgentSandbox = Schema.Struct({
+    enabled: defaulted(Schema.Boolean, true),
+    image: defaulted(Schema.Struct({
+        repository: defaulted(NonEmpty, "registry.k8s.io/agent-sandbox/agent-sandbox-controller"),
+        tag: defaulted(Schema.String, "v1.0.5"),
+        digest: defaulted(Digest, "sha256:28a9cbdbfd6ac0a4e5c7e9261ace1aa30ee2da681cb640dccdfed98e8dd9d98b"),
+        pullPolicy: defaulted(PullPolicy, "IfNotPresent"),
+    }), {}),
+    resources: Resources({ requests: { cpu: "50m", memory: "64Mi" }, limits: { memory: "256Mi" } }),
+    nodeSelector: NodeSelector,
+    tolerations: Tolerations,
+    affinity: Affinity,
+});
+/** What a configuration must also hold, given what it turns off: the issue of the first it lacks. */
+function completeness(config) {
+    if (!config.neon.enabled && !config.neon.external.existingSecret) {
+        return { path: ["neon", "external", "existingSecret"], issue: "is required when neon.enabled is false" };
+    }
+    if (config.neon.enabled && !config.objectStore.bundled.enabled) {
+        if (!config.objectStore.external.endpoint)
+            return { path: ["objectStore", "external", "endpoint"], issue: "is required when objectStore.bundled.enabled is false" };
+        if (!config.objectStore.external.existingSecret)
+            return { path: ["objectStore", "external", "existingSecret"], issue: "is required with an external object store" };
+    }
+    return undefined;
+}
+const InstallStruct = Schema.Struct({
+    images: defaulted(Schema.Struct({ alasio: Image(IMAGES.alasio), agent: Image(IMAGES.agent), lake: Image(IMAGES.lake), pullPolicy: defaulted(PullPolicy, "IfNotPresent") }), {}),
+    /** Pull Secrets for private registries, in alasio's namespace and the sessions and host ones. */
+    imagePullSecrets: defaulted(Schema.Array(SecretName), []),
+    /** alasio itself; its telegram.existingSecret has no default, so every configuration says it. */
+    alasio: Alasio.annotateKey({ messageMissingKey: "is required, with telegram.existingSecret" }),
+    telemetry: defaulted(Telemetry, {}),
+    sessions: defaulted(Sessions, {}),
+    host: defaulted(Host, {}),
+    neon: defaulted(Neon, {}),
+    objectStore: defaulted(ObjectStore, {}),
+    /** The analytics lake, loaded from Neon into DuckLake. */
+    lake: defaulted(Schema.Struct({ enabled: defaulted(Schema.Boolean, true), resources: Resources({ requests: { cpu: "100m", memory: "512Mi" }, limits: { memory: "1536Mi" } }) }), {}),
+    /** NetworkPolicies confining sessions, folder workspaces' bayma and Neon. */
+    networkPolicies: defaulted(Schema.Struct({ enabled: defaulted(Schema.Boolean, true) }), {}),
+    agentSandbox: defaulted(AgentSandbox, {}),
+});
+/** The install configuration: what the config file holds, every key left out its default. */
+export const InstallConfig = InstallStruct.check(Schema.makeFilter(completeness));
+const formatIssue = SchemaIssue.makeFormatterStandardSchemaV1();
+/** The first thing wrong with a configuration: the key's path, then what it must be. */
+export function describeIssue(issue) {
+    const [first] = formatIssue(issue).issues;
+    const path = first?.path?.map((segment) => String(Predicate.hasProperty(segment, "key") ? segment.key : segment)).join(".") ?? "";
+    return [path, first?.message ?? "is not what alasio installs from"].filter(Boolean).join(" ");
+}
+/** The configuration in `input`, parsed JSON, checked, with its defaults: a key alasio does not know is refused. */
+export const decodeInstallConfig = (input) => Result.mapError(Schema.decodeUnknownResult(InstallConfig)(input, { onExcessProperty: "error" }), (error) => new InstallConfigError({ message: describeIssue(error.issue) }));
+//# sourceMappingURL=config.js.map

package/dist/cli/src/manifests/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/manifests/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAGlC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAEtF,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,sGAAsG;AACtG,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAAC,oBAAoB,EAAE;IACrG,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,8FAA8F;AAC9F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAuB,MAAS,EAAE,KAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAErJ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAE1H,MAAM,IAAI,GAAG,uCAAuC,CAAC;AAErD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;AAC7D,MAAM,UAAU,GAAG,QAAQ,CAAC,yCAAyC,EAAE,yBAAyB,CAAC,CAAC;AAClG,0CAA0C;AAC1C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,4CAA4C,EAAE,mCAAmC,CAAC,CAAC;AACvH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;AACzE,yCAAyC;AACzC,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC,CAAC;AAC/F,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC;AACzG,MAAM,MAAM,GAAG,QAAQ,CAAC,qCAAqC,EAAE,yBAAyB,CAAC,CAAC;AAC1F,MAAM,IAAI,GAAG,QAAQ,CAAC,iDAAiD,EAAE,sCAAsC,CAAC,CAAC;AACjH,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;AACxE,2DAA2D;AAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,2BAA2B,EAAE,mCAAmC,CAAC,CAAC;AAE1F,iHAAiH;AACjH,MAAM,MAAM,GAAG,GAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAc,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAE3H,wGAAwG;AACxG,MAAM,KAAK,GAAG,CAAC,KAAqF,EAAE,EAAE,CACtG,SAAS,CACP,MAAM,CAAC,MAAM,CAAC;IACZ,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;IACjD,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC;IACxC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;CACxC,CAAC,EACF,EAAE,CACH,CAAC;AAEJ,uFAAuF;AACvF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACrK,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAG1D,4DAA4D;AAC5D,MAAM,UAAU,GAAG,CAAC,QAAoB,EAAE,EAAE,CAC1C,SAAS,CACP,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;IAC3D,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,YAAY,CAAC,WAAW,EAAE;CACnC,CAAC,CACH,EACD,EAAE,CACH,CAAC;AAEJ,wEAAwE;AACxE,MAAM,SAAS,GAAG,CAAC,QAAwE,EAAE,EAAE,CAC7F,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAEjH,kFAAkF;AAClF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAEhJ,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;AAChF,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAc,EAAE,EAAE,CAAC,CAAC;AACrD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAE5C,yFAAyF;AACzF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;IAC1C,sDAAsD;IACtD,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC;CAC5I,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,8DAA8D,EAAE,CAAC,EAAE,CAAC;SACvJ,WAAW,CAAC,EAAE,iBAAiB,EAAE,kCAAkC,EAAE,CAAC;IACzE,0EAA0E;IAC1E,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;IACvE,yHAAyH;IACzH,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IAC9H,0EAA0E;IAC1E,WAAW,EAAE,SAAS,CACpB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAC7I,EAAE,CACH;IACD,GAAG,EAAE,GAAG;IACR,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAmB,CAAC,EAAE,EAAE,CAAC;IAC/D,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;IAC7F,yDAAyD;IACzD,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC;IAC9B,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC;IAC/B,kBAAkB,EAAE,GAAG;IACvB,YAAY,EAAE,YAAY;IAC1B,WAAW,EAAE,WAAW;IACxB,QAAQ,EAAE,QAAQ;CACnB,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9B,0GAA0G;IAC1G,YAAY,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;IACxC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,EAAE,eAAe,CAAC;IACjG,oEAAoE;IACpE,aAAa,EAAE,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC;IAChD,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC1C,kBAAkB,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAChD,gEAAgE;IAChE,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC;CACvJ,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;IACxC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;IAClD,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;IAChD,gGAAgG;IAChG,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;IACpD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;IACzG,qEAAqE;IACrE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;IAC3C,uDAAuD;IACvD,mBAAmB,EAAE,SAAS,CAC5B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CACnH,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,EAC3E,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAC5E,EACD,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB;IACD,wDAAwD;IACxD,YAAY,EAAE,SAAS,CACrB,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAC,EACxE,CAAC,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,CAAC,CAC/I;IACD,YAAY,EAAE,YAAY;IAC1B,WAAW,EAAE,WAAW;CACzB,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,+HAA+H;IAC/H,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;IACzC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;IAC9C,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;IAChD,UAAU,EAAE,KAAK,CAAC;QAChB,UAAU,EAAE,uBAAuB;QACnC,GAAG,EAAE,QAAQ;QACb,MAAM,EAAE,yEAAyE;KAClF,CAAC;IACF,wFAAwF;IACxF,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC;IACxB,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC;IACxB,kBAAkB,EAAE,GAAG;IACvB,IAAI,EAAE,SAAS,CAAC,YAAY,EAAE,gBAAgB,CAAC;IAC/C,qEAAqE;IACrE,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,8BAA8B,CAAC;IAClE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;IAC9C,8GAA8G;IAC9G,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,oCAAoC,CAAC,EAAE,EAAE,CAAC;IAC1F,sEAAsE;IACtE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;IAC3C,GAAG,EAAE,GAAG;IACR,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;CAChG,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,SAA0C,EAAE,EAAE,CAC9E,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAE5F,uCAAuC;AACvC,MAAM,WAAW,GAAG,CAAC,SAA0C,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAEtI,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;IACxC,gFAAgF;IAChF,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IAC7F,KAAK,EAAE,KAAK,CAAC;QACX,UAAU,EAAE,mBAAmB;QAC/B,GAAG,EAAE,cAAc;QACnB,MAAM,EAAE,yEAAyE;KAClF,CAAC;IACF,YAAY,EAAE,KAAK,CAAC;QAClB,UAAU,EAAE,+BAA+B;QAC3C,GAAG,EAAE,sBAAsB;QAC3B,MAAM,EAAE,yEAAyE;KAClF,CAAC;IACF,iBAAiB,EAAE,KAAK,CAAC;QACvB,UAAU,EAAE,UAAU;QACtB,GAAG,EAAE,aAAa;QAClB,MAAM,EAAE,yEAAyE;KAClF,CAAC;IACF,yDAAyD;IACzD,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC;IAC9B,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC;IAC/B,WAAW,EAAE,SAAS,CACpB,MAAM,CAAC,MAAM,CAAC;QACZ,qDAAqD;QACrD,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1H,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;QACxB,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;KAChG,CAAC,EACF,EAAE,CACH;IACD,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;IACzG,iBAAiB,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;IAC1G,aAAa,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;IACrG,YAAY,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;IAC3G,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;IACvG,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;IAC7F,2FAA2F;IAC3F,MAAM,EAAE,SAAS,CACf,MAAM,CAAC,MAAM,CAAC;QACZ,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;QACxC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC,EAAE,YAAY,CAAC;QACrH,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;KAC3G,CAAC,EACF,EAAE,CACH;IACD,sEAAsE;IACtE,SAAS,EAAE,SAAS,CAClB,MAAM,CAAC,MAAM,CAAC;QACZ,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;QACxC,KAAK,EAAE,KAAK,CAAC;YACX,UAAU,EAAE,sCAAsC;YAClD,GAAG,EAAE,SAAS;YACd,MAAM,EAAE,yEAAyE;SAClF,CAAC;QACF,qEAAqE;QACrE,YAAY,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;KACjG,CAAC,EACF,EAAE,CACH;IACD,YAAY,EAAE,YAAY;IAC1B,WAAW,EAAE,WAAW;CACzB,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IAChC,kCAAkC;IAClC,OAAO,EAAE,SAAS,CAChB,MAAM,CAAC,MAAM,CAAC;QACZ,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;QACxC,KAAK,EAAE,KAAK,CAAC;YACX,UAAU,EAAE,qBAAqB;YACjC,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,yEAAyE;SAClF,CAAC;QACF,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;QACzB,kDAAkD;QAClD,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;QAChH,+BAA+B;QAC/B,YAAY,EAAE,SAAS,CAAC,QAAQ,CAAC,4BAA4B,EAAE,wCAAwC,CAAC,EAAE,MAAM,CAAC;QACjH,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;KAChG,CAAC,EACF,EAAE,CACH;IACD,wHAAwH;IACxH,QAAQ,EAAE,SAAS,CACjB,MAAM,CAAC,MAAM,CAAC;QACZ,QAAQ,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;QACxC,cAAc,EAAE,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC;KAClD,CAAC,EACF,EAAE,CACH;IACD,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;CACnJ,CAAC,CAAC;AAEH,oGAAoG;AACpG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;IACxC,KAAK,EAAE,SAAS,CACd,MAAM,CAAC,MAAM,CAAC;QACZ,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,wDAAwD,CAAC;QACzF,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;QACvC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,yEAAyE,CAAC;QACpG,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,cAAc,CAAC;KAClD,CAAC,EACF,EAAE,CACH;IACD,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;IAC/F,YAAY,EAAE,YAAY;IAC1B,WAAW,EAAE,WAAW;IACxB,QAAQ,EAAE,QAAQ;CACnB,CAAC,CAAC;AAEH,qGAAqG;AACrG,SAAS,YAAY,CAAC,MAAiC;IACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC;QACpK,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IACtK,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,SAAS,CACf,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC,EACxJ,EAAE,CACH;IACD,iGAAiG;IACjG,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;IACzD,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,2CAA2C,EAAE,CAAC;IAC9F,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;IACnC,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;IACjC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;IACzB,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;IACzB,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;IACvC,0DAA0D;IAC1D,IAAI,EAAE,SAAS,CACb,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,EAC/J,EAAE,CACH;IACD,6EAA6E;IAC7E,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IAC3F,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;CAC1C,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AAQlF,MAAM,WAAW,GAAG,WAAW,CAAC,6BAA6B,EAAE,CAAC;AAEhE,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,KAAwB;IACpD,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAClI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,kCAAkC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChG,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAoD,EAAE,CACtG,MAAM,CAAC,QAAQ,CACb,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,EAC/E,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAC3E,CAAC"}

package/dist/cli/src/manifests/index.js

@@ -0,0 +1,20 @@
+import { agentSandboxObjects } from "./agent-sandbox.js";
+import { alasioObjects } from "./alasio.js";
+import { lakeObjects } from "./lake.js";
+import { neonObjects } from "./neon.js";
+import { networkPolicyObjects } from "./network-policies.js";
+import { objectStoreObjects } from "./object-store.js";
+export { decodeInstallConfig, InstallConfig, InstallConfigError } from "./config.js";
+export { NAMESPACE } from "./common.js";
+/** The objects of the installation `config` describes: agent-sandbox's, alasio's, Neon's, the object store's, the lake's, and the NetworkPolicies. */
+export function manifests(config) {
+    return [
+        ...agentSandboxObjects(config),
+        ...alasioObjects(config),
+        ...neonObjects(config),
+        ...objectStoreObjects(config),
+        ...lakeObjects(config),
+        ...networkPolicyObjects(config),
+    ];
+}
+//# sourceMappingURL=index.js.map

package/dist/cli/src/manifests/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/manifests/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAA0B,MAAM,aAAa,CAAC;AAC7G,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,sJAAsJ;AACtJ,MAAM,UAAU,SAAS,CAAC,MAAqB;IAC7C,OAAO;QACL,GAAG,mBAAmB,CAAC,MAAM,CAAC;QAC9B,GAAG,aAAa,CAAC,MAAM,CAAC;QACxB,GAAG,WAAW,CAAC,MAAM,CAAC;QACtB,GAAG,kBAAkB,CAAC,MAAM,CAAC;QAC7B,GAAG,WAAW,CAAC,MAAM,CAAC;QACtB,GAAG,oBAAoB,CAAC,MAAM,CAAC;KAChC,CAAC;AACJ,CAAC"}

package/dist/cli/src/manifests/lake.js

@@ -0,0 +1,56 @@
+import { imageReference } from "../images.js";
+import { componentName, NAMESPACE, neonName, restrictedContainer, s3Endpoint, selectorLabels, stackLabels, stackPodSpec } from "./common.js";
+/** The lake's objects, when it runs, which is beside Neon. */
+export function lakeObjects(config) {
+    if (!config.lake.enabled || !config.neon.enabled)
+        return [];
+    const name = componentName("lake");
+    const service = {
+        apiVersion: "v1",
+        kind: "Service",
+        metadata: { name, namespace: NAMESPACE, labels: stackLabels("lake") },
+        spec: { selector: selectorLabels("lake"), ports: [{ name: "metrics", port: 9464 }] },
+    };
+    // Live while its loads are not failing for long; ready once one has made the lake.
+    const probe = (path) => ({ httpGet: { path, port: "metrics" } });
+    const deployment = {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { name, namespace: NAMESPACE, labels: stackLabels("lake") },
+        spec: {
+            replicas: 1,
+            // One loader: two would race each other's loads.
+            strategy: { type: "Recreate" },
+            selector: { matchLabels: selectorLabels("lake") },
+            template: {
+                metadata: { labels: stackLabels("lake") },
+                spec: {
+                    ...stackPodSpec(config),
+                    terminationGracePeriodSeconds: 60,
+                    containers: [{
+                            name: "lake",
+                            image: imageReference(config.images.lake),
+                            imagePullPolicy: config.images.pullPolicy,
+                            env: [
+                                { name: "LAKE_DATABASE_HOST", value: neonName("compute") },
+                                { name: "LAKE_DATABASE_PORT", value: "55433" },
+                                { name: "LAKE_DATA_PATH", value: `s3://${config.objectStore.buckets.lake}/` },
+                                { name: "LAKE_S3_ENDPOINT", value: s3Endpoint(config) },
+                                { name: "HOME", value: "/tmp" },
+                            ],
+                            envFrom: [{ secretRef: { name } }],
+                            ports: [{ name: "metrics", containerPort: 9464 }],
+                            readinessProbe: { ...probe("/readyz"), periodSeconds: 10 },
+                            livenessProbe: { ...probe("/healthz"), initialDelaySeconds: 60, periodSeconds: 30, failureThreshold: 3 },
+                            securityContext: { ...restrictedContainer(), readOnlyRootFilesystem: true },
+                            resources: config.lake.resources,
+                            volumeMounts: [{ name: "tmp", mountPath: "/tmp" }],
+                        }],
+                    volumes: [{ name: "tmp", emptyDir: { sizeLimit: "4Gi" } }],
+                },
+            },
+        },
+    };
+    return [service, deployment];
+}
+//# sourceMappingURL=lake.js.map

package/dist/cli/src/manifests/lake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lake.js","sourceRoot":"","sources":["../../../../src/manifests/lake.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG7I,8DAA8D;AAC9D,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,OAAO,GAAc;QACzB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE;QACrE,IAAI,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE;KACrF,CAAC;IACF,mFAAmF;IACnF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,UAAU,GAAiB;QAC/B,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE;QACrE,IAAI,EAAE;YACJ,QAAQ,EAAE,CAAC;YACX,iDAAiD;YACjD,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;YAC9B,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE;YACjD,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE;gBACzC,IAAI,EAAE;oBACJ,GAAG,YAAY,CAAC,MAAM,CAAC;oBACvB,6BAA6B,EAAE,EAAE;oBACjC,UAAU,EAAE,CAAC;4BACX,IAAI,EAAE,MAAM;4BACZ,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;4BACzC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;4BACzC,GAAG,EAAE;gCACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;gCAC1D,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE;gCAC9C,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE;gCAC7E,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE;gCACvD,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;6BAChC;4BACD,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;4BAClC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;4BACjD,cAAc,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;4BAC1D,aAAa,EAAE,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,mBAAmB,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;4BACxG,eAAe,EAAE,EAAE,GAAG,mBAAmB,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;4BAC3E,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;4BAChC,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;yBACnD,CAAC;oBACF,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;iBAC3D;aACF;SACF;KACF,CAAC;IACF,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC/B,CAAC"}