alasio 4.1.4 → 4.2.0

package/dist/cli/src/main.js

@@ -9,7 +9,9 @@
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
 import { Cause, Console, Effect, Layer, Logger, Result } from "effect";
 import { CliError, Command } from "effect/cli";
-import { Machine, Sysctl } from "./cluster/host.js";
+import { NodeReleases, Systemd } from "./cluster/host.js";
+import { Machine, RootSystem } from "./cluster/machine.js";
+import { Root } from "./cluster/root.js";
 import { alasio } from "./commands.js";
 import { VERSION } from "./release.js";
 import { TelegramBotApi } from "./telegram.js";
@@ -27,5 +29,5 @@ const report = (cause) => {
     }
     return Console.error(Cause.pretty(cause));
 };
-Command.run(alasio, { version: VERSION }).pipe(Effect.tapCause(report), Effect.provide(Layer.mergeAll(TelegramBotApi.layer, Machine.layer, Sysctl.layer, Logger.layer([progress]))), Effect.provide(NodeServices.layer), NodeRuntime.runMain({ disableErrorReporting: true }));
+Command.run(alasio, { version: VERSION }).pipe(Effect.tapCause(report), Effect.provide(Layer.mergeAll(TelegramBotApi.layer, Root.layer, Systemd.layer, NodeReleases.layer, Logger.layer([progress])).pipe(Layer.provideMerge(Layer.mergeAll(Machine.layer, RootSystem.layer)))), Effect.provide(NodeServices.layer), NodeRuntime.runMain({ disableErrorReporting: true }));
 //# sourceMappingURL=main.js.map

package/dist/cli/src/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../../../src/main.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,oDAAoD;AACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC;AAEH,mIAAmI;AACnI,MAAM,MAAM,GAAG,CAAC,KAA2B,EAAuB,EAAE;IAClE,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvK,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC3G,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAClC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CACrD,CAAC"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../../src/main.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,oDAAoD;AACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC;AAEH,mIAAmI;AACnI,MAAM,MAAM,GAAG,CAAC,KAA2B,EAAuB,EAAE;IAClE,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvK,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EACvB,MAAM,CAAC,OAAO,CACZ,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAChH,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CACpE,CACF,EACD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAClC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CACrD,CAAC"}

package/dist/cli/src/release.js

@@ -3,13 +3,13 @@
  * version and the digests of the images it published here, with tooling/pin-release.ts,
  * before it builds the package; this module holds nothing else.
  */
-export const VERSION = "4.1.4";
+export const VERSION = "4.2.0";
 /** alasio's own images, tagged with the version and pinned by digest once released. */
 export const IMAGES = {
-    alasio: { repository: "ghcr.io/eaucoin/alasio", tag: VERSION, digest: "sha256:ff53068a47a995ae043580913ce2548ac39ebf6ba3e34fa0f3172f59cb2cbc96" },
-    agent: { repository: "ghcr.io/eaucoin/alasio-agent", tag: VERSION, digest: "sha256:ce88d4a231478f637787113b011d85cbce2dbc3b90988166c319e37aa374d4a2" },
-    lake: { repository: "ghcr.io/eaucoin/alasio-lake", tag: VERSION, digest: "sha256:d763265d2fc055c9e2a6f146714ef9e0ae5e2f14f66cce1f331f9acdfc2321c4" },
+    alasio: { repository: "ghcr.io/eaucoin/alasio", tag: VERSION, digest: "sha256:21d8eb93752e9de02554f056471b32f7898422fcc7d32be5dc5ff34bc3b870c6" },
+    agent: { repository: "ghcr.io/eaucoin/alasio-agent", tag: VERSION, digest: "sha256:477587274974df027da1937a2f6b8558527801e0269e77f5207800ab13ce7ee5" },
+    lake: { repository: "ghcr.io/eaucoin/alasio-lake", tag: VERSION, digest: "sha256:a9bb1894ea755fff84bacd1d5411d602359001e30e0e2ab2afcd2924d082d4a9" },
 };
-/** The local cluster's node image: k3s with gVisor (cluster/node), pinned like the others. */
-export const NODE_IMAGE = { repository: "ghcr.io/eaucoin/alasio-node", tag: VERSION, digest: "sha256:0fd2a244efaf919da93b4ae635999b087a4750f1f6b042a5ce190c3bf3f3b409" };
+/** The node image of the cluster in Docker: k3s with gVisor (cluster/node), pinned like the others. */
+export const NODE_IMAGE = { repository: "ghcr.io/eaucoin/alasio-node", tag: VERSION, digest: "sha256:39089951ebcea855d8c2d54de6978d128d8dbaa57784212e0480747fa9957a94" };
 //# sourceMappingURL=release.js.map

package/dist/cli/src/release.js.map

@@ -1 +1 @@
-{"version":3,"file":"release.js","sourceRoot":"","sources":["../../../src/release.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,uFAAuF;AACvF,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,MAAM,EAAE,EAAE,UAAU,EAAE,wBAAwB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,yEAAyE,EAAE;IACjJ,KAAK,EAAE,EAAE,UAAU,EAAE,8BAA8B,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,yEAAyE,EAAE;IACtJ,IAAI,EAAE,EAAE,UAAU,EAAE,6BAA6B,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,yEAAyE,EAAE;CACrJ,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,UAAU,EAAE,6BAA6B,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,yEAAyE,EAAE,CAAC"}
+{"version":3,"file":"release.js","sourceRoot":"","sources":["../../../src/release.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,uFAAuF;AACvF,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,MAAM,EAAE,EAAE,UAAU,EAAE,wBAAwB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,yEAAyE,EAAE;IACjJ,KAAK,EAAE,EAAE,UAAU,EAAE,8BAA8B,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,yEAAyE,EAAE;IACtJ,IAAI,EAAE,EAAE,UAAU,EAAE,6BAA6B,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,yEAAyE,EAAE;CACrJ,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,UAAU,EAAE,6BAA6B,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,yEAAyE,EAAE,CAAC"}

package/dist/cli/src/target.js

@@ -1,53 +1,69 @@
 /**
- * The cluster the operator's config targets (./config.ts): the one alasio makes on this
- * machine, whose kubeconfig it writes beside the config file, or one a kubeconfig
- * reaches; and the services that reach it.
+ * The cluster the operator's config targets (./config.ts): one alasio makes on this
+ * machine, k3s on the machine itself or in Docker, whose kubeconfig it writes beside the
+ * config file, or one a kubeconfig reaches; and the services that reach it.
  *
- * The local cluster's nodes mount the host profile's paths at their own, as folder
- * workspaces mount them from the node, but for those the target's own mounts already
- * put there (as a node path of /host/tmp mounts the machine's /tmp).
+ * The nodes in Docker mount the host profile's paths at their own, as folder workspaces
+ * mount them from the node, but for those the target's own mounts already put there (as
+ * a node path of /host/tmp mounts the machine's /tmp). k3s on the machine itself has
+ * them where they are.
  */
 import { Config, Effect, FileSystem, Layer, Option, Result } from "effect";
-import { DockerEngine } from "./cluster/docker.js";
-import { LocalCluster } from "./cluster/local.js";
-import { defaultStoragePath, installConfigOf, localKubeconfigPath, OperatorConfigError } from "./config.js";
+import { DockerEngine } from "./cluster/docker-engine.js";
+import { DockerCluster } from "./cluster/docker.js";
+import { clusterKubeconfigPath, defaultStoragePath, installConfigOf, OperatorConfigError } from "./config.js";
 import { KubeApi } from "./kube/api.js";
 /** The cluster `config` targets. */
 export const resolveTarget = Effect.fnUntraced(function* (config) {
     const { target } = config;
     if ("kubeconfig" in target)
         return { _tag: "Kubeconfig", kubeconfig: target.kubeconfig };
-    const { local } = target;
+    const kubeconfig = { path: clusterKubeconfigPath(config) };
+    if ("host" in target) {
+        const { host } = target;
+        return {
+            _tag: "Host",
+            cluster: {
+                storagePath: host.storagePath ?? (yield* defaultStoragePath),
+                hostAliases: host.hostAliases,
+                ...(host.registries ? { registries: host.registries } : {}),
+            },
+            kubeconfig,
+        };
+    }
+    const { docker } = target;
     const install = installConfigOf(config.install, { claude: false });
     if (Result.isFailure(install))
         return yield* new OperatorConfigError({ path: config.path, reason: install.failure });
-    const { host } = install.success;
-    const hostPaths = host.enabled ? host.mounts.map(({ hostPath, readOnly }) => ({ source: hostPath, target: hostPath, readOnly })) : [];
+    const hostProfile = install.success.host;
+    const hostPaths = hostProfile.enabled ? hostProfile.mounts.map(({ hostPath, readOnly }) => ({ source: hostPath, target: hostPath, readOnly })) : [];
     return {
-        _tag: "Local",
+        _tag: "Docker",
         cluster: {
-            name: local.name,
-            apiPort: local.apiPort,
-            storagePath: local.storagePath ?? (yield* defaultStoragePath),
-            ...(local.subnet ? { subnet: local.subnet } : {}),
-            ...(local.image ? { image: local.image } : {}),
-            hostAliases: local.hostAliases,
-            mounts: [...local.mounts, ...hostPaths.filter(({ target }) => !local.mounts.some((mount) => mount.target === target))],
-            agents: local.agents,
-            ...(local.registries ? { registries: local.registries } : {}),
+            name: docker.name,
+            apiPort: docker.apiPort,
+            storagePath: docker.storagePath ?? (yield* defaultStoragePath),
+            ...(docker.subnet ? { subnet: docker.subnet } : {}),
+            ...(docker.image ? { image: docker.image } : {}),
+            hostAliases: docker.hostAliases,
+            mounts: [...docker.mounts, ...hostPaths.filter(({ target }) => !docker.mounts.some((mount) => mount.target === target))],
+            agents: docker.agents,
+            ...(docker.registries ? { registries: docker.registries } : {}),
         },
-        kubeconfig: { path: localKubeconfigPath(config) },
+        kubeconfig,
     };
 });
 /** Docker, as DOCKER_HOST names it. */
-const docker = Layer.unwrap(Effect.map(Config.option(Config.String("DOCKER_HOST")), (host) => DockerEngine.layer(Option.match(host, { onNone: () => ({}), onSome: (DOCKER_HOST) => ({ DOCKER_HOST }) }))));
-/** The local cluster made with `options`. */
-export const localCluster = (options) => LocalCluster.layer(options).pipe(Layer.provide(docker));
+const dockerEngine = Layer.unwrap(Effect.map(Config.option(Config.String("DOCKER_HOST")), (host) => DockerEngine.layer(Option.match(host, { onNone: () => ({}), onSome: (DOCKER_HOST) => ({ DOCKER_HOST }) }))));
+/** The cluster in Docker made with `options`. */
+export const dockerCluster = (options) => DockerCluster.layer(options).pipe(Layer.provide(dockerEngine));
 /** The API of the cluster `target` is. */
 export const kubeApi = (target) => KubeApi.layer(target.kubeconfig);
 /** Where the cluster `target` is, as people read it. */
 export function describeTarget(target) {
-    if (target._tag === "Local")
+    if (target._tag === "Host")
+        return "k3s on this machine";
+    if (target._tag === "Docker")
         return `the cluster ${target.cluster.name} on this machine`;
     const { path, context } = target.kubeconfig;
     return `the cluster ${context ? `of context ${context}` : "of the current context"} of ${path ?? "the default kubeconfig"}`;

package/dist/cli/src/target.js.map

@@ -1 +1 @@
-{"version":3,"file":"target.js","sourceRoot":"","sources":["../../../src/target.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE3E,OAAO,EAAE,YAAY,EAA8B,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAA4B,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,mBAAmB,EAAuB,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjI,OAAO,EAAE,OAAO,EAA+C,MAAM,eAAe,CAAC;AAOrF,oCAAoC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAC,MAAsB;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,IAAI,YAAY,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACzF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrH,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtI,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;YACtH,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D;QACD,UAAU,EAAE,EAAE,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE;KAClD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,uCAAuC;AACvC,MAAM,MAAM,GAA0E,KAAK,CAAC,MAAM,CAChG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAC9K,CAAC;AAEF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAA4B,EAAgG,EAAE,CACzJ,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAE1D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAsB,EAA4C,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAE9H,wDAAwD;AACxD,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,eAAe,MAAM,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC;IACzF,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;IAC5C,OAAO,eAAe,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,wBAAwB,OAAO,IAAI,IAAI,wBAAwB,EAAE,CAAC;AAC9H,CAAC"}
+{"version":3,"file":"target.js","sourceRoot":"","sources":["../../../src/target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE3E,OAAO,EAAE,YAAY,EAA8B,MAAM,4BAA4B,CAAC;AACtF,OAAO,EAAE,aAAa,EAA6B,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,eAAe,EAAuB,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACnI,OAAO,EAAE,OAAO,EAA+C,MAAM,eAAe,CAAC;AAQrF,oCAAoC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAC,MAAsB;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,IAAI,YAAY,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACzF,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE;gBACP,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBAC5D,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D;YACD,UAAU;SACX,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrH,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpJ,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;YACxH,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE;QACD,UAAU;KACX,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,uCAAuC;AACvC,MAAM,YAAY,GAA0E,KAAK,CAAC,MAAM,CACtG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAC9K,CAAC;AAEF,iDAAiD;AACjD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA6B,EAAiG,EAAE,CAC5J,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;AAEjE,0CAA0C;AAC1C,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAsB,EAA4C,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAE9H,wDAAwD;AACxD,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,qBAAqB,CAAC;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,eAAe,MAAM,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC;IAC1F,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;IAC5C,OAAO,eAAe,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,wBAAwB,OAAO,IAAI,IAAI,wBAAwB,EAAE,CAAC;AAC9H,CAAC"}

package/dist/cluster/node/config-v3.toml.tmpl

@@ -0,0 +1,12 @@
+{{ template "base" . }}
+
+[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runsc]
+  runtime_type = "io.containerd.runsc.v1"
+{{- if .SystemdCgroup }}
+
+# Where systemd runs the machine, kubelet's cgroups are systemd's, and runsc places its
+# sandboxes' through systemd too, as runsc.toml beside this file says.
+[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runsc.options]
+  TypeUrl = "io.containerd.runsc.v1.options"
+  ConfigPath = "/var/lib/rancher/k3s/agent/etc/containerd/runsc.toml"
+{{- end }}

package/dist/cluster/node/pins.json

@@ -0,0 +1,15 @@
+{
+    "k3s": {
+        "version": "v1.37.1+k3s1",
+        "image": "rancher/k3s:v1.37.1-k3s1@sha256:ca7f37d993d82ef0dcdcfecb2e0e2618ea541dbaffc620c8cedebe01a82acd0d",
+        "sha256": "92b94582eb7b34a8cf532e6006842b9ed215a6783cf56a3dd6271fd35243b2c0",
+        "installScript": {
+            "commit": "356c025475bbefaa09cf0d7e48e8e2adbbde57db",
+            "sha256": "ed01f89fd977bf20ac1516bbebf8370bf3ddbaa55dac8aba610956a4c78cc00b"
+        }
+    },
+    "gvisor": {
+        "release": "20260921.0",
+        "sha512": "66a5b17354690ec2e4037b54080eeabde55a1503779ceb823d73856283a6836953e105493d7e38fb2dcf85e5c86e0f48c66a9abb0244a78bd612df938702475c"
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alasio",
-  "version": "4.1.4",
+  "version": "4.2.0",
   "description": "alasio: coding agents you talk to from Telegram, installed and run with npx alasio",
   "type": "module",
   "license": "MIT",
@@ -14,7 +14,7 @@
     "node": ">=24"
   },
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && cp ../cluster/node/config-v3.toml.tmpl dist/cluster/node/",
     "start": "node ./src/main.ts"
   },
   "dependencies": {

package/dist/cli/src/cluster/local.js

@@ -1,392 +0,0 @@
-/**
- * The local cluster: k3s in Docker, made through Docker's Engine API (./docker.ts) from
- * alasio's node image (cluster/node), which is k3s with gVisor registered as containerd's
- * `runsc` runtime and an entrypoint that readies its container for k3s.
- *
- * A cluster NAME is a bridge network NAME, a server container NAME-server-0 and agent
- * containers NAME-agent-I, each with named volumes for what k3s, kubelet and the CNI
- * keep (NAME-server-0-k3s and so on), so a node made anew, as when its image or settings
- * change, keeps its state. All of it is labelled as the cluster's, and nothing that is
- * not is changed. The nodes have fixed addresses in the network's subnet: the server the
- * second, after the gateway, and the agents those after it. Docker gives fixed addresses
- * only in a subnet chosen for the network, so one is chosen when none is given: the first
- * 172.30.N.0/24 no other network overlaps.
- *
- * The registries the nodes pull from are k3s's registries.yaml, which the node image's
- * entrypoint writes from the variable each node is made with, so a node is made anew when
- * they change, as when its other settings do.
- *
- * The API server is published on the loopback only. What is done in the cluster itself,
- * waiting for it and configuring it, is done with the kubectl k3s carries in the server
- * node, so this machine needs none of Kubernetes' tools.
- */
-import { createHash, randomUUID } from "node:crypto";
-import { dirname } from "node:path";
-import { KubeConfig } from "@kubernetes/client-node";
-import { Context, Duration, Effect, FileSystem, Layer, Schedule, Schema } from "effect";
-import { imageReference } from "../images.js";
-import { NODE_IMAGE } from "../release.js";
-import { DockerEngine } from "./docker.js";
-/** The cluster cannot be made as asked: something of its name is not its own, or its settings cannot hold. */
-export class ClusterUnusable extends Schema.TaggedError()("ClusterUnusable", {
-    cluster: Schema.String,
-    reason: Schema.String,
-}) {
-    get message() {
-        return `cluster ${this.cluster} cannot be made: ${this.reason}`;
-    }
-}
-/** The cluster did not come up in time: what it was waited for, and why it last was not. */
-export class ClusterNotReady extends Schema.TaggedError()("ClusterNotReady", {
-    cluster: Schema.String,
-    waitingFor: Schema.String,
-    /** How long it was given, in seconds. */
-    within: Schema.Number,
-    reason: Schema.String,
-}) {
-    get message() {
-        return `cluster ${this.cluster} was not ready within ${this.within}s, waiting for ${this.waitingFor}: ${this.reason}`;
-    }
-}
-/** What a wait for the cluster has not seen yet; the wait's ClusterNotReady says it when it gives up. */
-class NotYet extends Schema.TaggedError()("NotYet", {
-    message: Schema.String,
-}) {
-}
-/** A command run in a node exited with another code than 0. */
-export class NodeCommandFailed extends Schema.TaggedError()("NodeCommandFailed", {
-    node: Schema.String,
-    command: Schema.String,
-    exitCode: Schema.Number,
-    stderr: Schema.String,
-}) {
-    get message() {
-        return `${this.command} in ${this.node} exited with ${this.exitCode}${this.stderr.trim() ? `: ${this.stderr.trim()}` : ""}`;
-    }
-}
-/** The local cluster of the options its layer was given. */
-export class LocalCluster extends Context.Service()("alasio/cluster/LocalCluster") {
-    static layer = (options) => Layer.effect(LocalCluster, makeLocalCluster(options));
-}
-const CLUSTER_LABEL = "alasio.cluster";
-const ROLE_LABEL = "alasio.role";
-/** The label of a node's container that says what it was made from: specHash's. */
-const SPEC_LABEL = "alasio.spec";
-/** What a node keeps, each in a volume of its own: the volume's suffix, and where it is mounted. */
-const NODE_VOLUMES = [
-    ["k3s", "/var/lib/rancher/k3s"],
-    ["kubelet", "/var/lib/kubelet"],
-    ["cni", "/var/lib/cni"],
-    ["log", "/var/log"],
-];
-/** The API server's port in the server node. */
-const K3S_PORT = 6443;
-const API_PORT = `${K3S_PORT}/tcp`;
-const K3S_KUBECONFIG = "/etc/rancher/k3s/k3s.yaml";
-/** The token the server made on its first start, which agents join with. */
-const K3S_TOKEN = "/var/lib/rancher/k3s/server/token";
-/** The variable the node image's entrypoint writes k3s's registries.yaml from, before k3s starts. */
-const REGISTRIES_ENV = "ALASIO_REGISTRIES";
-/**
- * kubelet's thresholds for a machine whose disk the cluster shares with everything else
- * on it: it evicts only when the disk is nearly full, and collects unused images only then,
- * so images in use are not evicted.
- */
-const KUBELET_ARGS = [
-    "--kubelet-arg=eviction-hard=imagefs.available<5%,nodefs.available<5%",
-    "--kubelet-arg=eviction-minimum-reclaim=imagefs.available=1%,nodefs.available=1%",
-    "--kubelet-arg=image-gc-high-threshold=98",
-    "--kubelet-arg=image-gc-low-threshold=95",
-];
-/** gVisor, as the node image registers it with containerd. */
-const GVISOR_RUNTIME_CLASS = { apiVersion: "node.k8s.io/v1", kind: "RuntimeClass", metadata: { name: "gvisor" }, handler: "runsc" };
-// A first start pulls k3s's own images, so it is given minutes.
-const READY_TIMEOUT = "5 minutes";
-const POLL = "1 second";
-/** The `index`th address of the IPv4 subnet `cidr` (a.b.c.d/n), its network address the 0th; null when it has no such host address. */
-export function subnetAddress(cidr, index) {
-    const match = /^(\d+)\.(\d+)\.(\d+)\.(\d+)\/(\d+)$/u.exec(cidr);
-    if (!match)
-        return null;
-    const octets = match.slice(1, 5).map(Number);
-    const prefix = Number(match[5]);
-    if (octets.some((octet) => octet > 255) || prefix > 30)
-        return null;
-    // The last address is the subnet's broadcast address.
-    if (index < 1 || index >= 2 ** (32 - prefix) - 1)
-        return null;
-    const network = octets.reduce((value, octet) => value * 256 + octet, 0);
-    const address = network - (network % 2 ** (32 - prefix)) + index;
-    return [24, 16, 8, 0].map((shift) => Math.floor(address / 2 ** shift) % 256).join(".");
-}
-/** The first and last addresses of the IPv4 subnet `cidr`, as numbers; null when it is none. */
-function subnetRange(cidr) {
-    const match = /^(\d+)\.(\d+)\.(\d+)\.(\d+)\/(\d+)$/u.exec(cidr);
-    if (!match)
-        return null;
-    const octets = match.slice(1, 5).map(Number);
-    const prefix = Number(match[5]);
-    if (octets.some((octet) => octet > 255) || prefix > 32)
-        return null;
-    const size = 2 ** (32 - prefix);
-    const first = octets.reduce((value, octet) => value * 256 + octet, 0);
-    return [first - (first % size), first - (first % size) + size - 1];
-}
-/** The first 172.30.N.0/24 that overlaps none of the `taken` subnets (others than IPv4 are not in the way), or null when all do. Pure, for tests. */
-export function freeSubnet(taken) {
-    const ranges = taken.flatMap((cidr) => {
-        const range = subnetRange(cidr);
-        return range ? [range] : [];
-    });
-    for (let third = 0; third < 256; third++) {
-        const candidate = `172.30.${third}.0/24`;
-        // A /24 written as such always has a range.
-        const [first, last] = subnetRange(candidate);
-        if (!ranges.some(([start, end]) => start <= last && first <= end))
-            return candidate;
-    }
-    return null;
-}
-/**
- * CoreDNS's NodeHosts, a hosts file, with `aliases`: k3s keeps a line for each node in
- * it, which stays, and every other line is the cluster's aliases, which are replaced.
- * Pure, for tests.
- */
-export function nodeHostsWith(nodeHosts, nodes, aliases) {
-    const kept = nodeHosts.split("\n").filter((line) => line.trim().split(/\s+/u).slice(1).some((host) => nodes.includes(host)));
-    return [...kept, ...aliases.map(({ ip, hostnames }) => `${ip} ${hostnames.join(" ")}`)].join("\n");
-}
-/**
- * The kubeconfig k3s wrote in the server node (`k3sYaml`), named after the cluster and
- * pointed at the API server's port on the loopback; null when it is not a kubeconfig with
- * a cluster and a user, as while k3s writes it.
- */
-export function localKubeconfig(k3sYaml, cluster, apiPort) {
-    const written = new KubeConfig();
-    try {
-        written.loadFromString(k3sYaml);
-    }
-    catch {
-        return null;
-    }
-    const server = written.getCurrentCluster();
-    const user = written.getCurrentUser();
-    if (!server || !user)
-        return null;
-    const local = new KubeConfig();
-    local.loadFromOptions({
-        clusters: [{ ...server, name: cluster, server: `https://127.0.0.1:${apiPort}` }],
-        users: [{ ...user, name: cluster }],
-        contexts: [{ name: cluster, cluster, user: cluster }],
-        currentContext: cluster,
-    });
-    return local.exportConfig();
-}
-/** k3s's registries.yaml of `registries`, written as JSON, which YAML reads as it is. Pure, for tests. */
-export function registriesYaml({ mirrors = {}, configs = {} }) {
-    return JSON.stringify({
-        mirrors,
-        configs: Object.fromEntries(Object.entries(configs).map(([host, { tls }]) => [
-            host,
-            { tls: { ca_file: tls.caFile, cert_file: tls.certFile, key_file: tls.keyFile, insecure_skip_verify: tls.insecureSkipVerify } },
-        ])),
-    });
-}
-/** A digest of `spec` that two specs share only when they are the same. */
-const specHash = (spec) => createHash("sha256").update(JSON.stringify(spec)).digest("hex");
-const makeLocalCluster = Effect.fnUntraced(function* ({ name: cluster, apiPort, storagePath, image = imageReference(NODE_IMAGE), subnet, hostAliases = [], mounts = [], agents = 0, registries, readyTimeout = READY_TIMEOUT, poll = POLL, }) {
-    const docker = yield* DockerEngine;
-    const fs = yield* FileSystem.FileSystem;
-    const labels = { [CLUSTER_LABEL]: cluster };
-    const server = `${cluster}-server-0`;
-    const nodes = [server, ...Array.from({ length: agents }, (_, index) => `${cluster}-agent-${index}`)];
-    const unusable = (reason) => new ClusterUnusable({ cluster, reason });
-    /**
-     * The container of `node`, with what every node has: privileged, as k3s in Docker needs,
-     * its volumes, the storage directory and the host mounts, and the registries.
-     */
-    const nodeContainer = (node, role, address, command, env) => ({
-        Image: image,
-        Hostname: node,
-        Cmd: command,
-        Env: [...env, ...(registries ? [`${REGISTRIES_ENV}=${registriesYaml(registries)}`] : [])],
-        Labels: { ...labels, [ROLE_LABEL]: role },
-        ...(role === "server" ? { ExposedPorts: { [API_PORT]: {} } } : {}),
-        HostConfig: {
-            Privileged: true,
-            Init: true,
-            CgroupnsMode: "private",
-            RestartPolicy: { Name: "unless-stopped" },
-            SecurityOpt: ["label=disable"],
-            Tmpfs: { "/run": "", "/var/run": "" },
-            Mounts: [
-                ...NODE_VOLUMES.map(([suffix, target]) => ({ Type: "volume", Source: `${node}-${suffix}`, Target: target })),
-                { Type: "bind", Source: storagePath, Target: storagePath },
-                ...mounts.map(({ source, target, readOnly = false }) => ({ Type: "bind", Source: source, Target: target, ReadOnly: readOnly })),
-            ],
-            ExtraHosts: hostAliases.flatMap(({ ip, hostnames }) => hostnames.map((hostname) => `${hostname}:${ip}`)),
-            ...(role === "server" ? { PortBindings: { [API_PORT]: [{ HostIp: "127.0.0.1", HostPort: String(apiPort) }] } } : {}),
-        },
-        NetworkingConfig: { EndpointsConfig: { [cluster]: { IPAMConfig: { IPv4Address: address } } } },
-    });
-    /** The cluster's network, made unless it exists; its subnet, which must be `subnet` when that is given. */
-    const ensureNetwork = Effect.fnUntraced(function* () {
-        const existing = yield* docker.inspectNetwork(cluster);
-        if (existing && existing.Labels?.[CLUSTER_LABEL] !== cluster)
-            return yield* unusable(`a network named ${cluster} is not its own`);
-        let network = existing;
-        if (!network) {
-            const chosen = subnet ?? freeSubnet((yield* docker.listNetworks).flatMap(({ IPAM }) => (IPAM.Config ?? []).flatMap(({ Subnet }) => Subnet ?? [])));
-            if (!chosen)
-                return yield* unusable("every 172.30.N.0/24 is another network's: give the cluster a subnet");
-            yield* Effect.logInfo(`making network ${cluster} (${chosen})`);
-            yield* docker.createNetwork({ Name: cluster, Driver: "bridge", IPAM: { Config: [{ Subnet: chosen }] }, Labels: labels });
-            network = yield* docker.inspectNetwork(cluster);
-        }
-        const actual = network?.IPAM.Config?.[0]?.Subnet;
-        if (!actual)
-            return yield* unusable(`network ${cluster} has no subnet`);
-        if (subnet && actual !== subnet)
-            return yield* unusable(`network ${cluster} has the subnet ${actual}, not ${subnet}`);
-        return actual;
-    });
-    /** The `index`th node's address in `networkSubnet`. */
-    const nodeAddress = (networkSubnet, index) => {
-        const address = subnetAddress(networkSubnet, 2 + index);
-        return address ? Effect.succeed(address) : Effect.fail(unusable(`its subnet ${networkSubnet} has no room for ${nodes.length} nodes`));
-    };
-    /** `node`'s container made as `spec` says, anew when it was made otherwise, and running. */
-    const ensureNode = Effect.fnUntraced(function* (node, spec) {
-        const hash = specHash(spec);
-        const existing = yield* docker.inspectContainer(node);
-        if (existing && existing.Config.Labels?.[CLUSTER_LABEL] !== cluster)
-            return yield* unusable(`a container named ${node} is not one of its nodes`);
-        const current = existing !== null && existing.Config.Labels?.[SPEC_LABEL] === hash;
-        if (existing && !current) {
-            yield* Effect.logInfo(`making node ${node} anew, from its current image and settings`);
-            yield* docker.stopContainer(node);
-            yield* docker.removeContainer(node);
-        }
-        if (!current) {
-            yield* Effect.logInfo(`making node ${node}`);
-            yield* Effect.forEach(NODE_VOLUMES, ([suffix]) => docker.createVolume({ Name: `${node}-${suffix}`, Labels: labels }), { discard: true });
-            yield* docker.createContainer(node, { ...spec, Labels: { ...spec.Labels, [SPEC_LABEL]: hash } });
-        }
-        if (!current || !existing.State.Running) {
-            yield* Effect.logInfo(`starting node ${node}`);
-            yield* docker.startContainer(node);
-        }
-    });
-    /** The output of `command` in `node`, which fails unless it exits with 0. */
-    const inNode = (node, command, options) => docker.exec(node, command, options).pipe(Effect.flatMap(({ exitCode, stdout, stderr }) => exitCode === 0 ? Effect.succeed(stdout) : Effect.fail(new NodeCommandFailed({ node, command: command.join(" "), exitCode, stderr }))));
-    const kubectl = (args, options) => inNode(server, ["kubectl", ...args], options);
-    /** `check` once it succeeds, tried every `poll` for `readyTimeout`; why it last failed, when it never does. */
-    const awaitReady = (waitingFor, check) => Effect.logInfo(`waiting for ${waitingFor}`).pipe(Effect.andThen(check.pipe(Effect.mapError((error) => new ClusterNotReady({ cluster, waitingFor, within: Duration.toSeconds(readyTimeout), reason: error.message })), Effect.retry(Schedule.max([Schedule.spaced(poll), Schedule.during(readyTimeout)])))));
-    /** When each node's container last started, in milliseconds since the epoch. */
-    const startTimes = Effect.forEach(nodes, (node) => Effect.map(docker.inspectContainer(node), (container) => [node, Date.parse(container?.State.StartedAt ?? "")])).pipe(Effect.map((entries) => new Map(entries)));
-    /**
-     * Every node ready, by a Ready condition its kubelet reported since its container
-     * started: one from before, which a node stopped while ready keeps until its kubelet
-     * reports again, is not yet the node's. The condition's heartbeat is to the second.
-     */
-    const nodesReady = (started) => kubectl(["get", "nodes", "--output=json"]).pipe(Effect.flatMap((stdout) => {
-        const { items } = JSON.parse(stdout.toString("utf8"));
-        const ready = new Set(items
-            .filter((node) => node.status?.conditions?.some(({ type, status, lastHeartbeatTime }) => type === "Ready" && status === "True" && lastHeartbeatTime !== undefined
-            && new Date(lastHeartbeatTime).getTime() >= Math.floor((started.get(node.metadata?.name ?? "") ?? Infinity) / 1000) * 1000))
-            .map((node) => node.metadata?.name));
-        const waiting = nodes.filter((node) => !ready.has(node));
-        return waiting.length === 0 ? Effect.void : Effect.fail(new NotYet({ message: `not reported ready since started: ${waiting.join(", ")}` }));
-    }));
-    /** CoreDNS's NodeHosts with the host aliases, patched only when they differ, and only over the version read. */
-    const applyHostAliases = Effect.gen(function* () {
-        const coredns = JSON.parse((yield* kubectl(["--namespace=kube-system", "get", "configmap", "coredns", "--output=json"])).toString("utf8"));
-        const nodeHosts = coredns.data?.["NodeHosts"] ?? "";
-        const desired = nodeHostsWith(nodeHosts, nodes, hostAliases);
-        if (desired === nodeHosts)
-            return;
-        const patch = { metadata: { resourceVersion: coredns.metadata?.resourceVersion }, data: { NodeHosts: desired } };
-        yield* kubectl(["--namespace=kube-system", "patch", "configmap", "coredns", "--type=merge", `--patch=${JSON.stringify(patch)}`]);
-    });
-    const writeKubeconfig = Effect.fnUntraced(function* (path) {
-        const content = yield* awaitReady("its kubeconfig", docker.readFile(server, K3S_KUBECONFIG).pipe(Effect.flatMap((written) => {
-            const local = localKubeconfig(written.toString("utf8"), cluster, apiPort);
-            return local ? Effect.succeed(local) : Effect.fail(new NotYet({ message: `${K3S_KUBECONFIG} is not yet a kubeconfig with a cluster and a user` }));
-        })));
-        // Written whole beside it, readable only by its owner, and moved over it.
-        yield* fs.makeDirectory(dirname(path), { recursive: true, mode: 0o700 });
-        const written = `${path}.${randomUUID()}`;
-        yield* fs.writeFileString(written, content, { flag: "wx", mode: 0o600 });
-        yield* fs.rename(written, path);
-        yield* Effect.logInfo(`wrote the kubeconfig of cluster ${cluster} to ${path}`);
-    });
-    const up = Effect.fnUntraced(function* (kubeconfig) {
-        if (!(yield* docker.inspectImage(image))) {
-            yield* Effect.logInfo(`pulling ${image}`);
-            yield* docker.pullImage(image);
-        }
-        const networkSubnet = yield* ensureNetwork();
-        yield* fs.makeDirectory(storagePath, { recursive: true });
-        yield* ensureNode(server, nodeContainer(server, "server", yield* nodeAddress(networkSubnet, 0), [
-            "server",
-            "--disable=traefik",
-            // Where the kubeconfig reaches it.
-            "--tls-san=127.0.0.1",
-            `--default-local-storage-path=${storagePath}`,
-            ...KUBELET_ARGS,
-        ], []));
-        yield* awaitReady("its API server", kubectl(["get", "--raw=/readyz"]));
-        if (agents > 0) {
-            const token = (yield* awaitReady("its token", docker.readFile(server, K3S_TOKEN))).toString("utf8").trim();
-            for (const [index, agent] of nodes.slice(1).entries()) {
-                yield* ensureNode(agent, nodeContainer(agent, "agent", yield* nodeAddress(networkSubnet, 1 + index), ["agent", ...KUBELET_ARGS], [
-                    `K3S_URL=https://${server}:${K3S_PORT}`,
-                    `K3S_TOKEN=${token}`,
-                ]));
-            }
-        }
-        yield* awaitReady("its nodes", Effect.flatMap(startTimes, nodesReady));
-        yield* awaitReady("CoreDNS's NodeHosts", applyHostAliases);
-        yield* awaitReady("the gvisor RuntimeClass", kubectl(["apply", "--filename=-"], { stdin: JSON.stringify(GVISOR_RUNTIME_CLASS) }));
-        yield* writeKubeconfig(kubeconfig);
-        yield* Effect.logInfo(`cluster ${cluster} is up`);
-    });
-    /** The cluster's nodes, the server first. */
-    const existingNodes = docker.listContainers(labels).pipe(Effect.map((found) => found
-        .map((container) => ({
-        name: container.Names[0]?.replace(/^\//u, "") ?? "",
-        role: container.Labels[ROLE_LABEL] === "server" ? "server" : "agent",
-        state: container.State,
-    }))
-        .sort((a, b) => (a.role === b.role ? a.name.localeCompare(b.name) : a.role === "server" ? -1 : 1))));
-    return LocalCluster.of({
-        up,
-        // The agents first, so none is left without its server.
-        down: existingNodes.pipe(Effect.flatMap((found) => Effect.forEach(found.toReversed(), ({ name }) => docker.stopContainer(name), { discard: true })), Effect.andThen(Effect.logInfo(`stopped cluster ${cluster}`))),
-        remove: ({ volumes = false, storage = false } = {}) => Effect.gen(function* () {
-            const found = yield* existingNodes;
-            if (storage && found.some(({ name }) => name === server)) {
-                yield* docker.startContainer(server);
-                yield* inNode(server, ["find", storagePath, "-mindepth", "1", "-delete"]);
-            }
-            yield* Effect.forEach(found, ({ name }) => docker.removeContainer(name), { discard: true });
-            const network = yield* docker.inspectNetwork(cluster);
-            if (network?.Labels?.[CLUSTER_LABEL] === cluster) {
-                // Docker removes no network a container is on: others' (a collector given an
-                // address on it, say) are taken off it, and keep running.
-                yield* Effect.forEach(Object.values(network.Containers ?? {}), ({ Name }) => docker.disconnectNetwork(cluster, Name).pipe(Effect.andThen(Effect.logInfo(`took ${Name} off network ${cluster}`))), { discard: true });
-                yield* docker.removeNetwork(cluster);
-            }
-            if (volumes)
-                yield* Effect.forEach(yield* docker.listVolumes(labels), ({ Name }) => docker.removeVolume(Name), { discard: true });
-            if (storage)
-                yield* fs.remove(storagePath, { recursive: true, force: true });
-            yield* Effect.logInfo(`removed cluster ${cluster}${volumes ? " and its volumes" : ""}${storage ? `, and ${storagePath}` : ""}`);
-        }),
-        status: Effect.all({
-            docker: Effect.map(docker.version, ({ Version }) => Version),
-            nodes: existingNodes,
-        }),
-    });
-});
-//# sourceMappingURL=local.js.map