alasio 5.0.3 → 6.0.0

package/dist/cli/src/kube/object-store-scale.js

@@ -0,0 +1,116 @@
+/**
+ * What an installation may not do to the bundled object store's parts as it would to
+ * other workloads: change the masters' count, lowered, as their Raft, which keeps where
+ * every volume is, would lose its quorum, and with it that, or raised, as one master's
+ * state, made without peers, is no Raft's for more to join; or lower the volume servers'
+ * while one it would remove still holds volumes, which it would take with it. The first
+ * is refused; the second until those volume servers hold none, as their masters say, the
+ * way to which the refusal says. Nor start the parts at all while the store still keeps its
+ * data on the volume of the one pod it ran as before them. Before anything is applied.
+ */
+import { Writable } from "node:stream";
+import { Effect, Schema } from "effect";
+import { NAMESPACE } from "../manifests/common.js";
+import { MASTER, VOLUME_SERVER } from "../manifests/object-store.js";
+import { kind, KubeApi } from "./api.js";
+import { selectorOf } from "./rollout.js";
+/** A change of the object store's scale alasio does not make: why, and what to do instead. */
+export class ObjectStoreScaleRefused extends Schema.TaggedError()("ObjectStoreScaleRefused", {
+    message: Schema.String,
+}) {
+}
+/** The volume servers `status` says, by their address. */
+export function dataNodes(status) {
+    return (status.Topology?.DataCenters ?? []).flatMap(({ Racks = [] }) => Racks.flatMap(({ DataNodes = [] }) => DataNodes));
+}
+/** The replicas of the StatefulSet `name` among `objects`. */
+const rendered = (objects, name) => objects.find((object) => object.kind === "StatefulSet" && object.metadata?.name === name)?.spec?.replicas;
+/** What a running master's /dir/status says, read in its pod; null where no master runs, or it does not answer. */
+const dirStatus = Effect.gen(function* () {
+    const kube = yield* KubeApi;
+    const masters = yield* kube.list(kind("Pod"), { namespace: NAMESPACE, labelSelector: selectorOf((yield* kube.get({ ...kind("StatefulSet"), name: MASTER, namespace: NAMESPACE }))?.spec?.selector.matchLabels ?? {}) });
+    const running = masters.find(({ status }) => status?.phase === "Running")?.metadata?.name;
+    if (!running)
+        return null;
+    let printed = "";
+    const stdout = new Writable({
+        write: (chunk, _encoding, done) => {
+            printed += chunk.toString("utf8");
+            done();
+        },
+    });
+    const exitCode = yield* kube.exec({ namespace: NAMESPACE, pod: running, container: "master" }, ["wget", "-q", "-O", "-", "http://127.0.0.1:9333/dir/status"], {
+        stdin: null,
+        stdout,
+        stderr: new Writable({ write: (_chunk, _encoding, done) => done() }),
+        tty: false,
+    }).pipe(Effect.orElseSucceed(() => 1));
+    return exitCode === 0 ? parsed(printed) : null;
+});
+/** `text` as the masters' /dir/status, or null where it is not JSON. */
+function parsed(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Refuses `objects` where the cluster's object store still runs all in one, as alasio before
+ * its parts did, its data on that pod's volume, which the parts do not use: started, they
+ * would run the stack on a store that is empty. Its data is moved onto them by the cut-over
+ * that release's upgrade notes give, which deletes that volume's claim once it has.
+ */
+export const checkObjectStoreLayout = Effect.fnUntraced(function* (objects) {
+    if (rendered(objects, VOLUME_SERVER) === undefined)
+        return;
+    const kube = yield* KubeApi;
+    const claim = yield* kube.get({ ...kind("PersistentVolumeClaim"), name: ALL_IN_ONE_CLAIM, namespace: NAMESPACE });
+    if (claim === null)
+        return;
+    return yield* new ObjectStoreScaleRefused({
+        message: `the object store still keeps its data on the volume of its one pod, the claim ${ALL_IN_ONE_CLAIM}, which this release's parts do not use: ` +
+            "they would start the stack on an empty store, so alasio does not apply them; move the data onto them first with the release's cut-over, " +
+            `which deletes ${ALL_IN_ONE_CLAIM} once it has`,
+    });
+});
+/** The claim of the volume the object store kept its data on while it ran all in one. */
+const ALL_IN_ONE_CLAIM = "data-alasio-seaweedfs-0";
+/** Refuses `objects`' scale of the object store's masters and volume servers where the cluster's would be lowered as alasio does not. */
+export const checkObjectStoreScale = Effect.fnUntraced(function* (objects) {
+    const kube = yield* KubeApi;
+    const running = (name) => kube.get({ ...kind("StatefulSet"), name, namespace: NAMESPACE }).pipe(Effect.map((found) => found?.spec?.replicas));
+    const masters = { now: yield* running(MASTER), then: rendered(objects, MASTER) };
+    if (masters.now !== undefined && masters.then !== undefined && masters.then < masters.now) {
+        return yield* new ObjectStoreScaleRefused({
+            message: `the object store runs ${masters.now} masters, whose Raft keeps where every volume is: fewer would lose its quorum, and that with it, so alasio does not lower their count; objectStore.bundled.masters.scaling stays ${masters.now}`,
+        });
+    }
+    if (masters.now !== undefined && masters.then !== undefined && masters.now > 0 && masters.then > masters.now) {
+        return yield* new ObjectStoreScaleRefused({
+            message: `the object store runs ${masters.now} master, whose state, made without peers, is no Raft's that more masters could join, so alasio does not raise their count; ` +
+                `objectStore.bundled.masters.scaling stays ${masters.now}, as the count of masters is set as the store is made`,
+        });
+    }
+    const now = yield* running(VOLUME_SERVER);
+    const then = rendered(objects, VOLUME_SERVER);
+    if (now === undefined || then === undefined || then >= now)
+        return;
+    const removed = Array.from({ length: now - then }, (_, index) => `${VOLUME_SERVER}-${then + index}.`);
+    const status = yield* dirStatus;
+    const holding = status === null ? null : dataNodes(status).filter(({ Url, Volumes = 0, EcShards = 0 }) => removed.some((name) => Url.startsWith(name)) && Volumes + EcShards > 0);
+    if (holding === null) {
+        return yield* new ObjectStoreScaleRefused({
+            message: `objectStore.bundled.volumeServers.scaling would remove volume servers whose volumes no running master says: alasio lowers their count only once they hold none`,
+        });
+    }
+    if (holding.length > 0) {
+        const nodes = holding.map(({ Url }) => Url);
+        return yield* new ObjectStoreScaleRefused({
+            message: `objectStore.bundled.volumeServers.scaling would remove volume servers that still hold volumes, ${nodes.join(", ")}: move them to the others first, in weed shell in a gateway's buckets container, ` +
+                `with lock, then ${nodes.map((node) => `volume.server.evacuate -node ${node} -apply`).join(", ")}, then unlock; then lower their count`,
+        });
+    }
+});
+//# sourceMappingURL=object-store-scale.js.map

package/dist/cli/src/kube/object-store-scale.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-store-scale.js","sourceRoot":"","sources":["../../../../src/kube/object-store-scale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAqB,MAAM,UAAU,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,8FAA8F;AAC9F,MAAM,OAAO,uBAAwB,SAAQ,MAAM,CAAC,WAAW,EAA2B,CAAC,yBAAyB,EAAE;IACpH,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAcL,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,MAAiB;IACzC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5H,CAAC;AAED,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,CAAC,OAAoC,EAAE,IAAY,EAAsB,EAAE,CACzF,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,CAA+B,EAAE,IAAI,EAAE,QAAQ,CAAC;AAE3I,mHAAmH;AACnH,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAgB,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9O,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC;IAC1F,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;QAC1B,KAAK,EAAE,CAAC,KAAa,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YACxC,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,EAAE,CAAC;QACT,CAAC;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,kCAAkC,CAAC,EAAE;QAC5J,KAAK,EAAE,IAAI;QACX,MAAM;QACN,MAAM,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACpE,GAAG,EAAE,KAAK;KACX,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,wEAAwE;AACxE,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAC,OAAoC;IACpG,IAAI,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,SAAS;QAAE,OAAO;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAClH,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAC3B,OAAO,KAAK,CAAC,CAAC,IAAI,uBAAuB,CAAC;QACxC,OAAO,EAAE,iFAAiF,gBAAgB,2CAA2C;YACnJ,0IAA0I;YAC1I,iBAAiB,gBAAgB,cAAc;KAClD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD,yIAAyI;AACzI,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAC,OAAoC;IACnG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAgB,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrK,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;IACjF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1F,OAAO,KAAK,CAAC,CAAC,IAAI,uBAAuB,CAAC;YACxC,OAAO,EAAE,yBAAyB,OAAO,CAAC,GAAG,oLAAoL,OAAO,CAAC,GAAG,EAAE;SAC/O,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7G,OAAO,KAAK,CAAC,CAAC,IAAI,uBAAuB,CAAC;YACxC,OAAO,EAAE,yBAAyB,OAAO,CAAC,GAAG,6HAA6H;gBACxK,6CAA6C,OAAO,CAAC,GAAG,uDAAuD;SAClH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO;IACnE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,aAAa,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC;IAClL,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC,CAAC,IAAI,uBAAuB,CAAC;YACxC,OAAO,EAAE,gKAAgK;SAC1K,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC,CAAC,IAAI,uBAAuB,CAAC;YACxC,OAAO,EAAE,kGAAkG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mFAAmF;gBAC5M,mBAAmB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC;SAC1I,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/cli/src/kube/rollout.js

@@ -189,6 +189,8 @@ const current = (ref) => Effect.flatMap(KubeApi, (kube) => kube.get(ref));
 export const awaitReady = (refs, options) => awaitAll(refs, (ref) => Effect.map(current(ref), (object) => (object ? readiness(object) : waiting("not found"))), diagnose, options);
 /** Waits until every ref is gone, its deletion done. */
 export const awaitGone = (refs, options) => awaitAll(refs, (ref) => Effect.map(current(ref), (object) => (object ? waiting("being deleted") : READY)), (ref) => Effect.map(current(ref), (object) => (object?.metadata?.finalizers?.length ? [`waits on its finalizers: ${object.metadata.finalizers.join(", ")}`] : [])), options);
+/** Waits until every Job ref has ended, complete or failed, or is gone. */
+export const awaitEnded = (refs, options) => awaitAll(refs, (ref) => Effect.map(current(ref), (job) => (job === null || readiness(job)._tag !== "Waiting" ? READY : waiting("running"))), diagnose, options);
 /** Waits until every volume ref, its claim deleted, is let go of (reclamation). */
 export const awaitReclaimed = (refs, options) => awaitAll(refs, (ref) => Effect.flatMap(KubeApi, (kube) => Effect.map(kube.get(ref), (volume) => (volume ? reclamation(volume) : READY))), diagnose, options);
 //# sourceMappingURL=rollout.js.map

package/dist/cli/src/kube/rollout.js.map

@@ -1 +1 @@
-{"version":3,"file":"rollout.js","sourceRoot":"","sources":["../../../../src/kube/rollout.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE5D,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAqC,MAAM,UAAU,CAAC;AAQzF,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3C,MAAM,OAAO,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAmB7E,6HAA6H;AAC7H,MAAM,UAAU,SAAS,CAAC,MAAwB;IAChD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAqC,CAAC;IACzE,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,kBAAkB,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC;IACrC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,0BAA0B;YAC7B,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACvE,KAAK,KAAK,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YACzH,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,YAAY,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,EAAE,eAAe,IAAI,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,MAAM,EAAE,iBAAiB,IAAI,CAAC,CAAC;YACjD,IAAI,MAAM;gBAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACjD,IAAI,OAAO,GAAG,QAAQ;gBAAE,OAAO,OAAO,CAAC,GAAG,OAAO,OAAO,QAAQ,UAAU,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,OAAO;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,OAAO,oBAAoB,CAAC,CAAC;YAChH,OAAO,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,SAAS,OAAO,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACzF,CAAC;QACD,KAAK,aAAa,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,MAAM,EAAE,eAAe,IAAI,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC;YACzC,IAAI,MAAM;gBAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACjD,IAAI,OAAO,GAAG,QAAQ;gBAAE,OAAO,OAAO,CAAC,GAAG,OAAO,OAAO,QAAQ,UAAU,CAAC,CAAC;YAC5E,OAAO,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7E,CAAC;QACD,KAAK,WAAW,EAAE,CAAC;YACjB,6DAA6D;YAC7D,MAAM,OAAO,GAAG,MAAM,EAAE,sBAAsB,IAAI,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,EAAE,sBAAsB,IAAI,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC;YACvC,IAAI,MAAM;gBAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACjD,IAAI,OAAO,GAAG,OAAO;gBAAE,OAAO,OAAO,CAAC,GAAG,OAAO,OAAO,OAAO,gBAAgB,CAAC,CAAC;YAChF,OAAO,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjF,CAAC;QACD;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAA0B;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC;IAChD,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,2BAA2B,EAAE,CAAC;IACjH,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,6BAA6B,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAC/I,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;IACpC,OAAO,OAAO,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,gGAAgG;AAChG,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAA8B,EAAU,EAAE,CAC/E,CAAC,KAAK,MAAM,KAAK,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE7E,4EAA4E;AAC5E,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,EAAkB,CAAC,gBAAgB,EAAE;IACzF,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;CACtC,CAAC;IACA,IAAa,OAAO;QAClB,OAAO,oBAAoB,IAAI,CAAC,MAAM,0BAA0B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1G,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,WAAW,EAAiB,CAAC,eAAe,EAAE;IACtF,MAAM,EAAE,cAAc;CACvB,CAAC;IACA,IAAa,OAAO;QAClB,OAAO,YAAY,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7C,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,OAAQ,SAAQ,MAAM,CAAC,WAAW,EAAW,CAAC,SAAS,EAAE,EAAE,CAAC;CAAG;AAQrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;AAE5B,oCAAoC;AACpC,MAAM,UAAU,UAAU,CAAC,MAAwC;IACjE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,yDAAyD;AACzD,SAAS,gBAAgB,CAAC,GAAW,EAAE,SAA4B;IACjE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG,aAAa,SAAS,CAAC,IAAI,WAAW,GAAG,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,SAAS,EAAE,UAAU,IAAI,YAAY,GAAG,CAAC;QACxD,CAAC,CAAC,eAAe,YAAY,6BAA6B,SAAS,CAAC,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAClK,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,EAAE,OAAO;QAAE,OAAO,GAAG,KAAK,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IACzI,IAAI,KAAK,EAAE,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,GAAG,KAAK,gBAAgB,KAAK,CAAC,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAChM,CAAC;IACD,IAAI,KAAK,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK;QAAE,OAAO,GAAG,KAAK,mBAAmB,QAAQ,EAAE,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,GAAU;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,cAAc,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC;IACtH,IAAI,WAAW;QAAE,OAAO,CAAC,OAAO,IAAI,sBAAsB,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC,CAAC;IAC7H,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC;SACtG,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;SACrD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC;IACjH,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,iBAAiB,EAAE,CAAC,CAAC;AAChH,CAAC;AAED,kCAAkC;AAClC,MAAM,QAAQ,GAAG,CAAC,KAAkB,EAAU,EAAE,CAC9C,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AAEtG;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAC,GAAc;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAwF,GAAG,CAAC,CAAC;IAC3H,MAAM,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC;IACxD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAQ,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnI,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAc,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;IAChI,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAE,EAAE,CACzC,QAAQ;SACL,MAAM,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,KAAK,IAAI,IAAI,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;SACjI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SAChG,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC;SAC7D,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC1C,IAA0B,EAC1B,IAAyE,EACzE,GAAuE,EACvE,EAAE,OAAO,EAAE,IAAI,EAAe;IAE9B,wEAAwE;IACxE,IAAI,OAAO,GAAgD,EAAE,CAAC;IAC9D,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAU,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACjI,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrJ,CAAC;QACD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,GAAG,MAAM,CAAC;YACd,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe;QAChD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;KAC1E,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAC9B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAClI,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAC1H,CAAC,CACL,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,oDAAoD;AACpD,MAAM,OAAO,GAAG,CAAC,GAAc,EAAiE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAEpJ,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAA0B,EAAE,OAAoB,EAA+E,EAAE,CAC1J,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAExI,wDAAwD;AACxD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAA0B,EAAE,OAAoB,EAA+E,EAAE,CACzJ,QAAQ,CACN,IAAI,EACJ,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAC1F,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,4BAA4B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAClK,OAAO,CACR,CAAC;AAEJ,mFAAmF;AACnF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAA0B,EAAE,OAAoB,EAA+E,EAAE,CAC9J,QAAQ,CACN,IAAI,EACJ,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAqB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAC7I,QAAQ,EACR,OAAO,CACR,CAAC"}
+{"version":3,"file":"rollout.js","sourceRoot":"","sources":["../../../../src/kube/rollout.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE5D,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAqC,MAAM,UAAU,CAAC;AAQzF,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3C,MAAM,OAAO,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAmB7E,6HAA6H;AAC7H,MAAM,UAAU,SAAS,CAAC,MAAwB;IAChD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAqC,CAAC;IACzE,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,kBAAkB,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC;IACrC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,0BAA0B;YAC7B,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACvE,KAAK,KAAK,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YACzH,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,YAAY,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,EAAE,eAAe,IAAI,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,MAAM,EAAE,iBAAiB,IAAI,CAAC,CAAC;YACjD,IAAI,MAAM;gBAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACjD,IAAI,OAAO,GAAG,QAAQ;gBAAE,OAAO,OAAO,CAAC,GAAG,OAAO,OAAO,QAAQ,UAAU,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,OAAO;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,OAAO,oBAAoB,CAAC,CAAC;YAChH,OAAO,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,SAAS,OAAO,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACzF,CAAC;QACD,KAAK,aAAa,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,MAAM,EAAE,eAAe,IAAI,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC;YACzC,IAAI,MAAM;gBAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACjD,IAAI,OAAO,GAAG,QAAQ;gBAAE,OAAO,OAAO,CAAC,GAAG,OAAO,OAAO,QAAQ,UAAU,CAAC,CAAC;YAC5E,OAAO,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7E,CAAC;QACD,KAAK,WAAW,EAAE,CAAC;YACjB,6DAA6D;YAC7D,MAAM,OAAO,GAAG,MAAM,EAAE,sBAAsB,IAAI,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,EAAE,sBAAsB,IAAI,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC;YACvC,IAAI,MAAM;gBAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACjD,IAAI,OAAO,GAAG,OAAO;gBAAE,OAAO,OAAO,CAAC,GAAG,OAAO,OAAO,OAAO,gBAAgB,CAAC,CAAC;YAChF,OAAO,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjF,CAAC;QACD;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAA0B;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC;IAChD,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,2BAA2B,EAAE,CAAC;IACjH,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,6BAA6B,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAC/I,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;IACpC,OAAO,OAAO,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,gGAAgG;AAChG,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAA8B,EAAU,EAAE,CAC/E,CAAC,KAAK,MAAM,KAAK,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE7E,4EAA4E;AAC5E,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,EAAkB,CAAC,gBAAgB,EAAE;IACzF,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;CACtC,CAAC;IACA,IAAa,OAAO;QAClB,OAAO,oBAAoB,IAAI,CAAC,MAAM,0BAA0B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1G,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,WAAW,EAAiB,CAAC,eAAe,EAAE;IACtF,MAAM,EAAE,cAAc;CACvB,CAAC;IACA,IAAa,OAAO;QAClB,OAAO,YAAY,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7C,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,OAAQ,SAAQ,MAAM,CAAC,WAAW,EAAW,CAAC,SAAS,EAAE,EAAE,CAAC;CAAG;AAQrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;AAE5B,oCAAoC;AACpC,MAAM,UAAU,UAAU,CAAC,MAAwC;IACjE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,yDAAyD;AACzD,SAAS,gBAAgB,CAAC,GAAW,EAAE,SAA4B;IACjE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG,aAAa,SAAS,CAAC,IAAI,WAAW,GAAG,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,SAAS,EAAE,UAAU,IAAI,YAAY,GAAG,CAAC;QACxD,CAAC,CAAC,eAAe,YAAY,6BAA6B,SAAS,CAAC,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAClK,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,EAAE,OAAO;QAAE,OAAO,GAAG,KAAK,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IACzI,IAAI,KAAK,EAAE,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,GAAG,KAAK,gBAAgB,KAAK,CAAC,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAChM,CAAC;IACD,IAAI,KAAK,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK;QAAE,OAAO,GAAG,KAAK,mBAAmB,QAAQ,EAAE,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,GAAU;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,cAAc,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC;IACtH,IAAI,WAAW;QAAE,OAAO,CAAC,OAAO,IAAI,sBAAsB,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC,CAAC;IAC7H,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC;SACtG,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;SACrD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC;IACjH,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,iBAAiB,EAAE,CAAC,CAAC;AAChH,CAAC;AAED,kCAAkC;AAClC,MAAM,QAAQ,GAAG,CAAC,KAAkB,EAAU,EAAE,CAC9C,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AAEtG;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAC,GAAc;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAwF,GAAG,CAAC,CAAC;IAC3H,MAAM,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC;IACxD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAQ,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnI,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAc,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;IAChI,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAE,EAAE,CACzC,QAAQ;SACL,MAAM,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,KAAK,IAAI,IAAI,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;SACjI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SAChG,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC;SAC7D,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC1C,IAA0B,EAC1B,IAAyE,EACzE,GAAuE,EACvE,EAAE,OAAO,EAAE,IAAI,EAAe;IAE9B,wEAAwE;IACxE,IAAI,OAAO,GAAgD,EAAE,CAAC;IAC9D,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAU,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACjI,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrJ,CAAC;QACD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,GAAG,MAAM,CAAC;YACd,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe;QAChD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;KAC1E,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAC9B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAClI,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAC1H,CAAC,CACL,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,oDAAoD;AACpD,MAAM,OAAO,GAAG,CAAC,GAAc,EAAiE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAEpJ,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAA0B,EAAE,OAAoB,EAA+E,EAAE,CAC1J,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAExI,wDAAwD;AACxD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAA0B,EAAE,OAAoB,EAA+E,EAAE,CACzJ,QAAQ,CACN,IAAI,EACJ,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAC1F,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,4BAA4B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAClK,OAAO,CACR,CAAC;AAEJ,2EAA2E;AAC3E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAA0B,EAAE,OAAoB,EAA+E,EAAE,CAC1J,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAElK,mFAAmF;AACnF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAA0B,EAAE,OAAoB,EAA+E,EAAE,CAC9J,QAAQ,CACN,IAAI,EACJ,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAqB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAC7I,QAAQ,EACR,OAAO,CACR,CAAC"}

package/dist/cli/src/manifests/admission.js

@@ -0,0 +1,296 @@
+/**
+ * What alasio may do beyond what RBAC can say: ValidatingAdmissionPolicies of the
+ * cluster's, each matching what alasio's ServiceAccount asks (main's, or a branch
+ * environment's), and holding it to what alasio up renders:
+ *
+ * - a Job alasio makes is the clone of a session's volume, as rendered, but for the
+ *   claims it is told: RBAC lets it make any Job in its namespace, as another
+ *   ServiceAccount there, a controller's whose rights reach the cluster, or of another
+ *   image or command, privileged as the clone is;
+ * - a Sandbox alasio makes, or moves onto another pod template, is made from the template
+ *   of its namespace's workspaces, but for what alasio adds to each (src/kube/
+ *   sandbox-shape.ts): RBAC lets it make Sandboxes of any pod, as any ServiceAccount, under
+ *   any runtime;
+ * - a Secret alasio makes is a Sandbox's token: RBAC lets it make Secrets of any type, a
+ *   ServiceAccount's token among them;
+ * - a pod alasio patches changes its busy label and annotations alone (src/kube/busy.ts),
+ *   and in alasio's own namespace is alasio's own: RBAC lets it patch its namespaces'
+ *   pods whole, their images among it.
+ *
+ * Where a policy holds an object to a rendered one, `pinned` makes the CEL that says so:
+ * the object's fields are the rendered ones', key for key and item for item, but for what
+ * a Check allows, and what the API server defaults where the rendered one has nothing.
+ */
+import { posix } from "node:path";
+import { branchNamespace } from "../../../src/branch/names.js";
+import { BUSY_ANNOTATIONS, BUSY_LABEL } from "../../../src/kube/busy-label.js";
+import { CLONE_VARIABLES } from "../../../src/kube/config.js";
+import { BAYMA_CONTAINER, DEFAULT_FULL_MODE_NAMESERVERS, EGRESS_GATE, EGRESS_GATE_SCRIPT, HARNESS_LABEL, MANAGED_BY, NET_MODE_LABEL, SANDBOX_LABEL, STATE_DIR_ARG, TOKEN_DIR, TOKEN_ENV, TOKEN_FILE_ARGS, TOKEN_KEY, TOKEN_MODE, TOKEN_VOLUME, tokenSecretName, WORKLOAD_LABEL, } from "../../../src/kube/sandbox-shape.js";
+import { componentName, labels, NAMESPACE, RELEASE } from "./common.js";
+/** A field's test, beyond its being a rendered value: given the field's CEL expression and how deep it is, the CEL that holds where it passes. */
+class Check {
+    cel;
+    constructor(cel) {
+        this.cel = cel;
+    }
+}
+/** Anything. */
+const ANY = new Check(() => "true");
+/** Any string. */
+const ANY_STRING = new Check((expression) => `type(${expression}) == string`);
+/** A map with nothing in it, as the API server defaults one. */
+const EMPTY = new Check((expression) => `size(${expression}) == 0`);
+/** A string all of which `pattern` matches. */
+const matching = (pattern) => new Check((expression) => `type(${expression}) == string && ${expression}.matches(${JSON.stringify(`^(${pattern})$`)})`);
+/** What the CEL `value` is, of the object asked about. */
+const sameAs = (value) => new Check((expression) => `${expression} == ${value}`);
+/** Any of `alternatives`. */
+const oneOf = (...alternatives) => new Check((expression, depth) => `(${alternatives.map((each) => pinned(expression, each, depth)).join(" || ")})`);
+/** A list of `first`, then any number of items each `rest`. */
+const startingWith = (first, rest) => new Check((expression, depth) => {
+    const item = `item${depth}`;
+    return [
+        `size(${expression}) >= ${first.length}`,
+        ...first.map((each, index) => pinned(`${expression}[${index}]`, each, depth + 1)),
+        `${expression}.all(${item}, ${[...first, rest].map((each) => pinned(item, each, depth + 1)).join(" || ")})`,
+    ].join(" && ");
+});
+/** Of a map's key: that it may be absent; where present, `value`. */
+class Optional extends Check {
+    value;
+    constructor(value) {
+        super((expression, depth) => pinned(expression, value, depth));
+        this.value = value;
+    }
+}
+const optional = (value) => new Optional(value);
+/** The map `value`, but that each key `defaults` names may be there where `value` has not got it, as `defaults` says: as the API server defaults it. */
+const defaulted = (value, defaults) => new Check((expression, depth) => pinnedMap(expression, value, defaults, depth));
+/**
+ * A DNS label: a namespace's name, and a claim's as alasio names a session's, of a claim
+ * template's name and a volume id, each short enough for it (src/sandbox/names.ts). The
+ * API server would take a claim's of a DNS subdomain; alasio's are held to a label.
+ */
+const DNS_LABEL = "[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?";
+/**
+ * A CEL expression that holds where `expression` is `expected`: of a map, no key but its,
+ * and each as it is; of a list, its items alone, in order; of a Check, what it says.
+ */
+export function pinned(expression, expected, depth = 0) {
+    if (expected instanceof Check)
+        return expected.cel(expression, depth);
+    if (typeof expected !== "object")
+        return `${expression} == ${JSON.stringify(expected)}`;
+    if (Array.isArray(expected)) {
+        return [`size(${expression}) == ${expected.length}`, ...expected.map((item, index) => pinned(`${expression}[${index}]`, item, depth))].join(" && ");
+    }
+    return pinnedMap(expression, expected, {}, depth);
+}
+/** pinned of the map `expected`, and of the keys `defaults` names that it has not got (defaulted). */
+function pinnedMap(expression, expected, defaults, depth) {
+    const keys = Object.keys(expected).filter((key) => expected[key] !== undefined);
+    const extra = Object.keys(defaults).filter((key) => !keys.includes(key));
+    const at = (key) => `${expression}[${JSON.stringify(key)}]`;
+    return [
+        `${expression}.all(key, key in ${JSON.stringify([...keys, ...extra])})`,
+        ...keys.map((key) => {
+            const value = expected[key];
+            if (value instanceof Optional)
+                return `(!(${JSON.stringify(key)} in ${expression}) || ${pinned(at(key), value.value, depth)})`;
+            return `${JSON.stringify(key)} in ${expression} && ${pinned(at(key), value, depth)}`;
+        }),
+        ...extra.map((key) => `(!(${JSON.stringify(key)} in ${expression}) || ${pinned(at(key), defaults[key], depth)})`),
+    ].join(" && ");
+}
+/** The name the ServiceAccount of the alasio of the namespace `namespace` asks as. */
+export const alasioAccount = (namespace) => `system:serviceaccount:${namespace}:${RELEASE}`;
+/** Whether the request is by main's alasio or a branch environment's, as CEL. */
+const BY_ANY_ALASIO = `request.userInfo.username.matches('^system:serviceaccount:(${NAMESPACE}|${branchNamespace("")}[a-z0-9-]+):${RELEASE}$')`;
+/** A ValidatingAdmissionPolicy `name` of alasio's, on `rules`, of what `by` asks, refusing what `validations` do not hold for, and its binding. */
+function admissionPolicy(name, rules, by, validations, variables) {
+    const metadata = { name, labels: labels("alasio") };
+    const policy = {
+        apiVersion: "admissionregistration.k8s.io/v1",
+        kind: "ValidatingAdmissionPolicy",
+        metadata,
+        spec: {
+            failurePolicy: "Fail",
+            matchConstraints: { resourceRules: rules.map((rule) => ({ ...rule, apiVersions: ["*"] })) },
+            matchConditions: [{ name: "by-alasio", expression: by }],
+            ...(variables ? { variables } : {}),
+            validations,
+        },
+    };
+    const binding = { apiVersion: "admissionregistration.k8s.io/v1", kind: "ValidatingAdmissionPolicyBinding", metadata, spec: { policyName: name, validationActions: ["Deny"] } };
+    return [policy, binding];
+}
+/**
+ * What alasio may change of a pod: its busy label and the annotations that go with it
+ * (src/kube/busy.ts), and nothing else; and in its own namespace, of its own pod alone,
+ * not the floor's beside it. Main's alasio's and each branch environment's.
+ */
+export function busyLabelPolicy() {
+    const unchanged = (field, keys) => `variables.new${field}.all(key, key in ${JSON.stringify(keys)} || (key in variables.old${field} && variables.old${field}[key] == variables.new${field}[key])) && ` +
+        `variables.old${field}.all(key, key in ${JSON.stringify(keys)} || key in variables.new${field})`;
+    const component = "app.kubernetes.io/component";
+    return admissionPolicy(componentName("busy-label"), [{ apiGroups: [""], resources: ["pods"], operations: ["UPDATE"] }], BY_ANY_ALASIO, [
+        { expression: "object.spec == oldObject.spec", message: "alasio changes no pod's spec" },
+        {
+            expression: "object.metadata.?finalizers.orValue([]) == oldObject.metadata.?finalizers.orValue([]) && " +
+                "object.metadata.?ownerReferences.orValue([]) == oldObject.metadata.?ownerReferences.orValue([])",
+            message: "alasio changes no pod's finalizers or owners",
+        },
+        {
+            expression: `request.userInfo.username != "system:serviceaccount:" + request.namespace + ":${RELEASE}" || ` +
+                `("${component}" in variables.oldLabels && variables.oldLabels["${component}"] == "alasio")`,
+            message: "alasio labels no pod of its own namespace but its own",
+        },
+        { expression: unchanged("Labels", [BUSY_LABEL]), message: `alasio changes no label of a pod's but ${BUSY_LABEL}` },
+        { expression: unchanged("Annotations", Object.keys(BUSY_ANNOTATIONS)), message: `alasio changes no annotation of a pod's but ${Object.keys(BUSY_ANNOTATIONS).join(" and ")}` },
+    ], [
+        { name: "oldLabels", expression: "oldObject.metadata.?labels.orValue({})" },
+        { name: "newLabels", expression: "object.metadata.?labels.orValue({})" },
+        { name: "oldAnnotations", expression: "oldObject.metadata.?annotations.orValue({})" },
+        { name: "newAnnotations", expression: "object.metadata.?annotations.orValue({})" },
+    ]);
+}
+/**
+ * What the API server gives a Job, its template, and the template's pod and containers,
+ * when its maker does not: a pinned Job may have them so. Its selector and its template's
+ * labels of its own are the Job's; a pod's scheduling and termination are no matter of
+ * its rights; and a pod's security context, defaulted, is empty.
+ */
+const JOB_DEFAULTS = {
+    spec: { completions: 1, parallelism: 1, completionMode: "NonIndexed", suspend: false, manualSelector: false, podReplacementPolicy: ANY_STRING, selector: ANY },
+    metadata: { creationTimestamp: ANY },
+    labels: {
+        "batch.kubernetes.io/controller-uid": ANY_STRING,
+        "controller-uid": ANY_STRING,
+        "batch.kubernetes.io/job-name": sameAs("object.metadata.name"),
+        "job-name": sameAs("object.metadata.name"),
+    },
+    pod: { dnsPolicy: ANY, schedulerName: ANY, terminationGracePeriodSeconds: ANY, securityContext: EMPTY },
+    container: { terminationMessagePath: ANY, terminationMessagePolicy: ANY },
+};
+/**
+ * What alasio may run as a Job: the clone of a session's volume (src/sandbox/index.ts),
+ * `job`, its spec and its pod's as rendered, but for the claims each of its containers is
+ * told, as alasio adds them (cloneJobManifest), each a DNS label (DNS_LABEL). Main's
+ * alasio's, the one that clones.
+ */
+export function cloneJobPolicy(job) {
+    const spec = job.spec ?? {};
+    const pod = spec.template?.spec;
+    const claims = CLONE_VARIABLES.map((variable) => ({ name: variable, value: matching(DNS_LABEL) }));
+    const template = spec.template;
+    const containers = (pod?.containers ?? []).map((container) => defaulted({ ...container, env: [...(container.env ?? []), ...claims] }, JOB_DEFAULTS.container));
+    const expected = defaulted({
+        ...spec,
+        template: {
+            metadata: defaulted({ ...template?.metadata, labels: defaulted(template?.metadata?.labels ?? {}, JOB_DEFAULTS.labels) }, JOB_DEFAULTS.metadata),
+            spec: defaulted({ ...pod, containers }, JOB_DEFAULTS.pod),
+        },
+    }, JOB_DEFAULTS.spec);
+    return admissionPolicy(componentName("clone-job"), [{ apiGroups: ["batch"], resources: ["jobs"], operations: ["CREATE", "UPDATE"] }], `request.userInfo.username == "${alasioAccount(NAMESPACE)}"`, [{
+            expression: pinned("object.spec", expected),
+            message: "alasio runs no Job but its clone of a session's volume, as alasio up renders it",
+        }]);
+}
+/** A container of a Sandbox's pod template as its CRD stores it: its ports' protocol defaulted. */
+const stored = (container) => {
+    const ports = container["ports"];
+    return Array.isArray(ports) ? { ...container, ports: ports.map((port) => defaulted(port, { protocol: "TCP" })) } : container;
+};
+/** The token Secret of the Sandbox asked about, as CEL. */
+const OWN_TOKEN = sameAs(`object.metadata.name + ${JSON.stringify(tokenSecretName(""))}`);
+/** A path segment as sanitizePathToken makes one. */
+const PATH_TOKEN = "[A-Za-z0-9_][A-Za-z0-9_.-]*";
+/** `text`, as a pattern that matches it alone. */
+const literally = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+/** A variable of the environment, set to a string. */
+const SET = { name: ANY_STRING, value: ANY_STRING };
+/**
+ * The Sandbox of a workspace alasio makes from `template`: a session's (`session`, with
+ * the session's profile) or a folder's bayma's (`folder`, with its state root), as
+ * sandboxManifest and sessionSandboxManifest or hostBaymaManifest make it.
+ */
+function sandboxOf(template, workspace) {
+    const podTemplate = template.podTemplate;
+    const spec = podTemplate.spec ?? { containers: [] };
+    const session = "session" in workspace ? workspace.session : null;
+    const bayma = spec.containers.find(({ name }) => name === BAYMA_CONTAINER);
+    const tokenMount = { name: TOKEN_VOLUME, mountPath: TOKEN_DIR, readOnly: true };
+    const variables = session
+        ? oneOf(SET, { name: TOKEN_ENV, valueFrom: { secretKeyRef: { name: OWN_TOKEN, key: TOKEN_KEY } } })
+        : SET;
+    // Under the state root as hostBaymaStateDir joins it: normalized, its one slash after it.
+    const stateDir = "folder" in workspace ? [STATE_DIR_ARG, matching(`${literally(posix.join(workspace.folder.stateRoot, "/"))}${PATH_TOKEN}/${PATH_TOKEN}`)] : [];
+    const container = (each) => stored((each.name !== BAYMA_CONTAINER ? each : {
+        ...each,
+        args: [...(each.args ?? []), ...TOKEN_FILE_ARGS, ...stateDir],
+        volumeMounts: [...(each.volumeMounts ?? []), tokenMount],
+        env: optional(startingWith((each.env ?? []), variables)),
+    }));
+    const gate = session && session.egressGate !== false
+        ? [{
+                name: EGRESS_GATE.name,
+                ...(bayma?.image === undefined ? {} : { image: bayma.image }),
+                command: ["node", "-e", EGRESS_GATE_SCRIPT],
+                ...(bayma?.securityContext === undefined ? {} : { securityContext: bayma.securityContext }),
+                resources: EGRESS_GATE.resources,
+            }]
+        : [];
+    const initContainers = [...gate, ...(spec.initContainers ?? [])].map(stored);
+    const volumes = [...(spec.volumes ?? []), { name: TOKEN_VOLUME, secret: { secretName: OWN_TOKEN, defaultMode: TOKEN_MODE } }];
+    const own = {
+        ...MANAGED_BY,
+        [SANDBOX_LABEL]: sameAs("object.metadata.name"),
+        ...(session ? { [WORKLOAD_LABEL]: "session", [NET_MODE_LABEL]: oneOf("none", "full") } : { [WORKLOAD_LABEL]: "folder", [HARNESS_LABEL]: matching(PATH_TOKEN) }),
+    };
+    const nameservers = session ? [...(session.fullModeNameservers ?? DEFAULT_FULL_MODE_NAMESERVERS)] : [];
+    const podSpec = {
+        ...spec,
+        containers: spec.containers.map(container),
+        ...(initContainers.length > 0 ? { initContainers } : {}),
+        volumes,
+        // A session's pod speaks to the cluster as no one, and resolves names as its internet says.
+        ...(session
+            ? { automountServiceAccountToken: false, enableServiceLinks: false, dnsPolicy: "None", dnsConfig: { nameservers: oneOf(nameservers, ["127.0.0.1"]) } }
+            : {}),
+    };
+    // Its CRD defaults what is done with it at its shutdown time, which alasio gives none.
+    return defaulted({
+        operatingMode: oneOf("Running", "Suspended"),
+        service: true,
+        podTemplate: { ...podTemplate, metadata: { ...podTemplate.metadata, labels: { ...podTemplate.metadata?.labels, ...own } }, spec: podSpec },
+        ...(session?.volumeClaimTemplates?.length ? { volumeClaimTemplates: session.volumeClaimTemplates } : {}),
+    }, { shutdownPolicy: "Retain" });
+}
+/** The name of the Sandbox policy of the alasio of the namespace `namespace`. */
+export const sandboxPolicyName = (namespace) => `${namespace}-sandboxes`;
+/**
+ * What alasio may make as a Sandbox, by `account`, the ServiceAccount of the alasio of
+ * `name`: a session's from `sessions`, in any namespace but `host`'s, and a folder's bayma's
+ * from `host`, in its namespace. A Sandbox moved onto no other pod template, as alasio
+ * suspends and resumes it, is left as it was made.
+ */
+export function sandboxPolicy(name, account, templates) {
+    const { sessions, host } = templates;
+    const ofSessions = sessions ? pinned("object.spec", sandboxOf(sessions, { session: sessions })) : "false";
+    const made = host ? `(request.namespace == ${JSON.stringify(host.namespace)} ? ${pinned("object.spec", sandboxOf(host, { folder: host }))} : ${ofSessions})` : ofSessions;
+    const unmoved = "request.operation == \"UPDATE\" && object.spec.podTemplate == oldObject.spec.podTemplate && " +
+        "object.spec.?volumeClaimTemplates.orValue([]) == oldObject.spec.?volumeClaimTemplates.orValue([])";
+    return admissionPolicy(name, [{ apiGroups: ["agents.x-k8s.io"], resources: ["sandboxes"], operations: ["CREATE", "UPDATE"] }], `request.userInfo.username == "${account}"`, [{
+            expression: `${unmoved} || ${made}`,
+            message: "alasio makes no Sandbox but from its workspaces' templates, as alasio up renders them",
+        }]);
+}
+/** What alasio may make as a Secret: a Sandbox's token, of its one key, as tokenSecretManifest makes it. Main's alasio's and each branch environment's. */
+export function secretPolicy() {
+    return admissionPolicy(componentName("secrets"), [{ apiGroups: [""], resources: ["secrets"], operations: ["CREATE", "UPDATE"] }], BY_ANY_ALASIO, [{
+            expression: `object.?type.orValue("Opaque") == "Opaque" && object.metadata.name.endsWith(${JSON.stringify(tokenSecretName(""))}) && ` +
+                `object.?data.orValue({}).all(key, key == ${JSON.stringify(TOKEN_KEY)})`,
+            message: "alasio makes no Secret but a Sandbox's token",
+        }]);
+}
+//# sourceMappingURL=admission.js.map

package/dist/cli/src/manifests/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../../../../src/manifests/admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,eAAe,EAA0C,MAAM,6BAA6B,CAAC;AACtG,OAAO,EACL,eAAe,EACf,6BAA6B,EAC7B,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,SAAS,EACT,SAAS,EACT,eAAe,EACf,SAAS,EACT,UAAU,EACV,YAAY,EACZ,eAAe,EACf,cAAc,GACf,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAExE,kJAAkJ;AAClJ,MAAM,KAAK;IACA,GAAG,CAAgD;IAC5D,YAAY,GAAkD;QAC5D,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;CACF;AAKD,gBAAgB;AAChB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;AACpC,kBAAkB;AAClB,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,UAAU,aAAa,CAAC,CAAC;AAC9E,gEAAgE;AAChE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,UAAU,QAAQ,CAAC,CAAC;AACpE,+CAA+C;AAC/C,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,UAAU,kBAAkB,UAAU,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/J,0DAA0D;AAC1D,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,UAAU,OAAO,KAAK,EAAE,CAAC,CAAC;AACzF,6BAA6B;AAC7B,MAAM,KAAK,GAAG,CAAC,GAAG,YAAsB,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC/J,+DAA+D;AAC/D,MAAM,YAAY,GAAG,CAAC,KAAwB,EAAE,IAAY,EAAE,EAAE,CAC9D,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;IAC9B,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,CAAC;IAC5B,OAAO;QACL,QAAQ,UAAU,QAAQ,KAAK,CAAC,MAAM,EAAE;QACxC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,KAAK,GAAG,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjF,GAAG,UAAU,QAAQ,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;KAC5G,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC;AACL,qEAAqE;AACrE,MAAM,QAAS,SAAQ,KAAK;IACjB,KAAK,CAAS;IACvB,YAAY,KAAa;QACvB,KAAK,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AACD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAY,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;AAKlE,wJAAwJ;AACxJ,MAAM,SAAS,GAAG,CAAC,KAAgB,EAAE,QAA0C,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAEpK;;;;GAIG;AACH,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,UAAkB,EAAE,QAAgB,EAAE,KAAK,GAAG,CAAC;IACpE,IAAI,QAAQ,YAAY,KAAK;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,UAAU,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxF,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,QAAQ,UAAU,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,KAAK,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9J,CAAC;IACD,OAAO,SAAS,CAAC,UAAU,EAAE,QAAqB,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,sGAAsG;AACtG,SAAS,SAAS,CAAC,UAAkB,EAAE,QAAmB,EAAE,QAA0C,EAAE,KAAa;IACnH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;IACpE,OAAO;QACL,GAAG,UAAU,oBAAoB,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG;QACvE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,KAAK,YAAY,QAAQ;gBAAE,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;YAC/H,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,UAAU,OAAO,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAe,EAAE,KAAK,CAAC,EAAE,CAAC;QACjG,CAAC,CAAC;QACF,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,UAAU,QAAQ,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAW,EAAE,KAAK,CAAC,GAAG,CAAC;KAC5H,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjB,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,yBAAyB,SAAS,IAAI,OAAO,EAAE,CAAC;AAEpG,iFAAiF;AACjF,MAAM,aAAa,GAAG,8DAA8D,SAAS,IAAI,eAAe,CAAC,EAAE,CAAC,eAAe,OAAO,KAAK,CAAC;AAEhJ,mJAAmJ;AACnJ,SAAS,eAAe,CACtB,IAAY,EACZ,KAA+G,EAC/G,EAAU,EACV,WAAiF,EACjF,SAA6E;IAE7E,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,iCAAiC;QAC7C,IAAI,EAAE,2BAA2B;QACjC,QAAQ;QACR,IAAI,EAAE;YACJ,aAAa,EAAE,MAAM;YACrB,gBAAgB,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE;YAC3F,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YACxD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,WAAW;SACZ;KACF,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,UAAU,EAAE,iCAAiC,EAAE,IAAI,EAAE,kCAAkC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IAC/K,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,IAAuB,EAAE,EAAE,CAC3D,gBAAgB,KAAK,oBAAoB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,KAAK,oBAAoB,KAAK,yBAAyB,KAAK,aAAa;QAClK,gBAAgB,KAAK,oBAAoB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2BAA2B,KAAK,GAAG,CAAC;IACnG,MAAM,SAAS,GAAG,6BAA6B,CAAC;IAChD,OAAO,eAAe,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE;QACrI,EAAE,UAAU,EAAE,+BAA+B,EAAE,OAAO,EAAE,8BAA8B,EAAE;QACxF;YACE,UAAU,EAAE,2FAA2F;gBACrG,iGAAiG;YACnG,OAAO,EAAE,8CAA8C;SACxD;QACD;YACE,UAAU,EAAE,iFAAiF,OAAO,OAAO;gBACzG,KAAK,SAAS,oDAAoD,SAAS,iBAAiB;YAC9F,OAAO,EAAE,uDAAuD;SACjE;QACD,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,0CAA0C,UAAU,EAAE,EAAE;QAClH,EAAE,UAAU,EAAE,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,EAAE,+CAA+C,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE;KAC/K,EAAE;QACD,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,wCAAwC,EAAE;QAC3E,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,qCAAqC,EAAE;QACxE,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,6CAA6C,EAAE;QACrF,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,0CAA0C,EAAE;KACnF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE;IAC9J,QAAQ,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE;IACpC,MAAM,EAAE;QACN,oCAAoC,EAAE,UAAU;QAChD,gBAAgB,EAAE,UAAU;QAC5B,8BAA8B,EAAE,MAAM,CAAC,sBAAsB,CAAC;QAC9D,UAAU,EAAE,MAAM,CAAC,sBAAsB,CAAC;KAC3C;IACD,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,6BAA6B,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE;IACvG,SAAS,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE;CACzB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAiG;IAC9H,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA2F,CAAC;IAClH,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3D,SAAS,CAAC,EAAE,GAAI,SAAkC,EAAE,GAAG,EAAE,CAAC,GAAI,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAyB,EAAE,GAAG,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,CACnJ,CAAC;IACF,MAAM,QAAQ,GAAG,SAAS,CAAC;QACzB,GAAI,IAA6B;QACjC,QAAQ,EAAE;YACR,QAAQ,EAAE,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,QAAQ,CAAC;YAC/I,IAAI,EAAE,SAAS,CAAC,EAAE,GAAI,GAA4B,EAAE,UAAU,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC;SACpF;KACF,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,eAAe,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,iCAAiC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YACnM,UAAU,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC;YAC3C,OAAO,EAAE,iFAAiF;SAC3F,CAAC,CAAC,CAAC;AACN,CAAC;AAED,mGAAmG;AACnG,MAAM,MAAM,GAAG,CAAC,SAAoB,EAAa,EAAE;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAe,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1I,CAAC,CAAC;AAEF,2DAA2D;AAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AAE1F,qDAAqD;AACrD,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAEjD,kDAAkD;AAClD,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;AAEjF,sDAAsD;AACtD,MAAM,GAAG,GAAW,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAE5D;;;;GAIG;AACH,SAAS,SAAS,CAAC,QAAuC,EAAE,SAAmF;IAC7I,MAAM,WAAW,GAAsB,QAAQ,CAAC,WAAgC,CAAC;IACjF,MAAM,IAAI,GAAc,WAAW,CAAC,IAAI,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChF,MAAM,SAAS,GAAW,OAAO;QAC/B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACnG,CAAC,CAAC,GAAG,CAAC;IACR,0FAA0F;IAC1F,MAAM,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,UAAU,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChK,MAAM,SAAS,GAAG,CAAC,IAAiB,EAAU,EAAE,CAC9C,MAAM,CACJ,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,GAAG,IAAI;QACP,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,eAAe,EAAE,GAAG,QAAQ,CAAC;QAC7D,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC;QACxD,GAAG,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAwB,EAAE,SAAS,CAAC,CAAC;KAChF,CAAyB,CAC3B,CAAC;IACJ,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK;QAClD,CAAC,CAAC,CAAC;gBACD,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC7D,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC;gBAC3C,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC3F,SAAS,EAAE,WAAW,CAAC,SAAS;aACjC,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,cAAc,GAAI,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAA4B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzG,MAAM,OAAO,GAAa,CAAC,GAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAuC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/K,MAAM,GAAG,GAAG;QACV,GAAG,UAAU;QACb,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,sBAAsB,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;KAChK,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,MAAM,OAAO,GAAG;QACd,GAAG,IAAI;QACP,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QAC1C,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO;QACP,4FAA4F;QAC5F,GAAG,CAAC,OAAO;YACT,CAAC,CAAC,EAAE,4BAA4B,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE;YACtJ,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,uFAAuF;IACvF,OAAO,SAAS,CAAC;QACf,aAAa,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;QAC5C,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QAC1I,GAAG,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,GAAG,SAAS,YAAY,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,OAAe,EACf,SAA2F;IAE3F,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;IACrC,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1G,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1K,MAAM,OAAO,GAAG,8FAA8F;QAC5G,mGAAmG,CAAC;IACtG,OAAO,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,iCAAiC,OAAO,GAAG,EAAE,CAAC;YAC3K,UAAU,EAAE,GAAG,OAAO,OAAO,IAAI,EAAE;YACnC,OAAO,EAAE,uFAAuF;SACjG,CAAC,CAAC,CAAC;AACN,CAAC;AAED,2JAA2J;AAC3J,MAAM,UAAU,YAAY;IAC1B,OAAO,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC;YAChJ,UAAU,EAAE,+EAA+E,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,OAAO;gBACnI,4CAA4C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG;YAC1E,OAAO,EAAE,8CAA8C;SACxD,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/cli/src/manifests/agent-sandbox.js

@@ -1,4 +1,6 @@
-import { given, NAMESPACE, RELEASE } from "./common.js";
+import { given, NAMESPACE, ONE, RELEASE, replicasOf } from "./common.js";
+import { priority } from "./priorities.js";
+import { verticalPodAutoscaler } from "./sizing.js";
 import sandboxes from "./sandboxes.agents.x-k8s.io.json" with { type: "json" };
 /**
  * The Sandbox CRD, agents.x-k8s.io's `sandboxes`, as the API server takes it, whose
@@ -55,12 +57,13 @@ function controller(config) {
         kind: "Deployment",
         metadata: { name: NAME, namespace: NAMESPACE, labels: LABELS },
         spec: {
-            replicas: 1,
+            ...replicasOf(ONE),
             selector: { matchLabels: { "app.kubernetes.io/name": "agent-sandbox-controller", "app.kubernetes.io/instance": RELEASE } },
             template: {
                 metadata: { labels: LABELS },
                 spec: {
                     serviceAccountName: NAME,
+                    ...priority("floor"),
                     securityContext: { runAsNonRoot: true, seccompProfile: { type: "RuntimeDefault" } },
                     containers: [{
                             name: "controller",
@@ -80,7 +83,7 @@ function controller(config) {
             },
         },
     };
-    return [serviceAccount, clusterRole, clusterRoleBinding, role, roleBinding, deployment];
+    return [serviceAccount, clusterRole, clusterRoleBinding, role, roleBinding, deployment, verticalPodAutoscaler(deployment, "InPlace")];
 }
 /** agent-sandbox's objects, unless the cluster already has it. */
 export function agentSandboxObjects(config) {

package/dist/cli/src/manifests/agent-sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-sandbox.js","sourceRoot":"","sources":["../../../../src/manifests/agent-sandbox.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,SAAS,MAAM,kCAAkC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAqB,SAAS,CAAC;AAEvD,MAAM,IAAI,GAAG,GAAG,OAAO,2BAA2B,CAAC;AAEnD,gIAAgI;AAChI,MAAM,MAAM,GAAG;IACb,wBAAwB,EAAE,0BAA0B;IACpD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,QAAQ;IACrC,8BAA8B,EAAE,QAAQ;CACzC,CAAC;AAEF,+JAA+J;AAC/J,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IACtF,MAAM,cAAc,GAAqB,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;IACtJ,MAAM,WAAW,GAAkB;QACjC,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,KAAK,EAAE;YACL,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,wBAAwB,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;YACtJ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE;YACvF,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpI,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;SAC/H;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAyB;QAC/C,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,QAAQ;QACR,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;KACpF,CAAC;IACF,mEAAmE;IACnE,MAAM,IAAI,GAAW;QACnB,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;KACrI,CAAC;IACF,MAAM,WAAW,GAAkB;QACjC,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,QAAQ;QACR,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;KAC7E,CAAC;IACF,MAAM,UAAU,GAAiB;QAC/B,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,IAAI,EAAE;YACJ,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,OAAO,EAAE,EAAE;YAC1H,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;gBAC5B,IAAI,EAAE;oBACJ,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE;oBACnF,UAAU,EAAE,CAAC;4BACX,IAAI,EAAE,YAAY;4BAClB,KAAK,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;4BAClF,eAAe,EAAE,KAAK,CAAC,UAAU;4BACjC,IAAI,EAAE,CAAC,qBAAqB,CAAC;4BAC7B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;4BAC3F,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;4BACjE,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;4BACjE,eAAe,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;4BACvI,SAAS;yBACV,CAAC;oBACF,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,GAAG,YAAY,EAAE,CAAC;oBAC7C,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;oBACzC,GAAG,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC;iBAC/B;aACF;SACF;KACF,CAAC;IACF,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC"}
+{"version":3,"file":"agent-sandbox.js","sourceRoot":"","sources":["../../../../src/manifests/agent-sandbox.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,SAAS,MAAM,kCAAkC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAqB,SAAS,CAAC;AAEvD,MAAM,IAAI,GAAG,GAAG,OAAO,2BAA2B,CAAC;AAEnD,gIAAgI;AAChI,MAAM,MAAM,GAAG;IACb,wBAAwB,EAAE,0BAA0B;IACpD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,QAAQ;IACrC,8BAA8B,EAAE,QAAQ;CACzC,CAAC;AAEF,+JAA+J;AAC/J,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IACtF,MAAM,cAAc,GAAqB,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;IACtJ,MAAM,WAAW,GAAkB;QACjC,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,KAAK,EAAE;YACL,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,wBAAwB,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;YACtJ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE;YACvF,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpI,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;SAC/H;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAyB;QAC/C,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,QAAQ;QACR,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;KACpF,CAAC;IACF,mEAAmE;IACnE,MAAM,IAAI,GAAW;QACnB,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;KACrI,CAAC;IACF,MAAM,WAAW,GAAkB;QACjC,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,QAAQ;QACR,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;KAC7E,CAAC;IACF,MAAM,UAAU,GAAiB;QAC/B,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,IAAI,EAAE;YACJ,GAAG,UAAU,CAAC,GAAG,CAAC;YAClB,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,OAAO,EAAE,EAAE;YAC1H,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;gBAC5B,IAAI,EAAE;oBACJ,kBAAkB,EAAE,IAAI;oBACxB,GAAG,QAAQ,CAAC,OAAO,CAAC;oBACpB,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE;oBACnF,UAAU,EAAE,CAAC;4BACX,IAAI,EAAE,YAAY;4BAClB,KAAK,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;4BAClF,eAAe,EAAE,KAAK,CAAC,UAAU;4BACjC,IAAI,EAAE,CAAC,qBAAqB,CAAC;4BAC7B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;4BAC3F,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;4BACjE,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;4BACjE,eAAe,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;4BACvI,SAAS;yBACV,CAAC;oBACF,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,GAAG,YAAY,EAAE,CAAC;oBAC7C,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;oBACzC,GAAG,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC;iBAC/B;aACF;SACF;KACF,CAAC;IACF,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,qBAAqB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AACxI,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC"}