alasio 5.1.0 → 7.0.0

package/dist/neon/control/endpoints.js

@@ -0,0 +1,108 @@
+/**
+ * neon-control as the control plane of Neon's proxy (its `cplane-v1` backend:
+ * proxy/src/control_plane/client/cplane_proxy_v1.rs and messages.rs at Neon's
+ * release-9129), what is decided without I/O. Every client of alasio's Neon connects to
+ * the proxy, naming the compute it wants by `options=endpoint=<id>` (the compute's id,
+ * ./branches.ts's computeId), and the proxy asks:
+ *
+ * - `GET /get_endpoint_access_control?endpointish&role`: the role's SCRAM verifier, which
+ *   it authenticates the client against and then the compute with, so the compute must
+ *   store that verifier to the byte (./scram.ts). Main's roles' are the stack's, from its
+ *   secrets; a branch's, the verifiers its request gave. Anything else is no endpoint, or
+ *   no role, and refused.
+ * - `GET /wake_compute?endpointish`: the compute's address, once it accepts connections,
+ *   woken first if it sleeps (./service.ts).
+ *
+ * A compute sleeps when no client has had a session on it for its `suspendAfter`, which
+ * neon-control counts on the compute itself: so a session holding an advisory lock, idle,
+ * keeps it awake, as compute_ctl's own activity monitor would not, and so does one opened
+ * and closed between two counts, and a wake asked for since, which a connection, or
+ * alasio's command line, is about to use.
+ */
+import { COMPUTE_PORT } from "./branches.js";
+/** The annotation of a compute's Deployment saying how many seconds it may be idle before it sleeps (./computes.ts). */
+export const SUSPEND_AFTER = "alasio.dev/suspend-after-seconds";
+/** The query of a proxy's call, at `url`, or null when it names no endpoint. */
+export function proxyQuery(url) {
+    const { searchParams } = new URL(url, "http://neon-control");
+    const endpoint = searchParams.get("endpointish");
+    return endpoint ? { endpoint, role: searchParams.get("role") } : null;
+}
+/**
+ * The verifier `role` authenticates with on a branch's compute, given its `credentials`:
+ * of main's, which has none of its own, `mainVerifiers`' (the stack's); of any other, its
+ * own; null for a role neither has, as neon-control's own role, which no client connects
+ * as.
+ */
+export function roleSecret(credentials, role, mainVerifiers) {
+    const verifiers = credentials?.verifiers ?? mainVerifiers;
+    return Object.hasOwn(verifiers, role) ? verifiers[role] ?? null : null;
+}
+/**
+ * Neon's error, as the proxy reads one (ControlPlaneErrorMessage): `reason` decides
+ * whether it asks again, ENDPOINT_IDLE among those it does, after the given delay.
+ */
+export function controlPlaneError(reason, message, retryDelayMs = null) {
+    return {
+        error: message,
+        status: {
+            code: reason,
+            message,
+            details: {
+                error_info: { reason },
+                retry_info: retryDelayMs === null ? null : { retry_delay_ms: retryDelayMs },
+                user_facing_message: { message },
+            },
+        },
+    };
+}
+/** Where a compute is, as the proxy connects to it: its Service in `namespace`, which takes connections before the pod is ready. */
+export const computeAddress = (service, namespace) => `${service}.${namespace}.svc.cluster.local:${COMPUTE_PORT}`;
+/** What `wake_compute` answers: the compute of the branch `branch`'s address, and labels for the proxy's metrics. */
+export function woken(address, branch, endpoint, cold) {
+    return {
+        address,
+        aux: { endpoint_id: endpoint, project_id: "alasio", branch_id: branch, compute_id: endpoint, cold_start_info: cold ? "pool_miss" : "warm" },
+    };
+}
+/**
+ * A compute's idleness, given what it was (none before the first count), its `use`
+ * counted now, and the time: used while a session is open, or one was established, or a
+ * wake asked for, since the last count; idle from the first count that finds none of
+ * them.
+ */
+export function idleness(previous, use, now) {
+    const used = use.sessions > 0 || (previous !== undefined && (use.established !== previous.established || use.wokenAt !== previous.wokenAt));
+    return { since: used ? null : previous?.since ?? now, established: use.established, wokenAt: use.wokenAt };
+}
+/** Whether a compute idle as `idle` says has been idle for `suspendAfterMs` by `now`. */
+export const suspendDue = ({ since }, now, suspendAfterMs) => since !== null && now - since >= suspendAfterMs;
+/**
+ * Wakes a compute, as `steps` read it and act: records the wake asked for, and scales a
+ * compute that sleeps to one under its lock, once the pod put to sleep is gone, read
+ * again under it, as a sleep may have ended meanwhile; then waits until it takes
+ * connections. One found running needs no lock, but a sleep may then have scaled it
+ * down: one that counted it again before the wake was recorded, its scale to none
+ * landing after the compute was read. So while it takes none, the compute is read again,
+ * and one found asleep woken likewise. Whether it slept.
+ */
+export async function wakeCompute(steps) {
+    const first = await steps.deployment();
+    await steps.asked();
+    const scaled = () => steps.locked(async () => {
+        const now = await steps.deployment();
+        if (now.replicas > 0)
+            return false;
+        await steps.untilGone(now);
+        await steps.scaleUp();
+        return true;
+    });
+    let slept = first.replicas === 0 && await scaled();
+    while (!(await steps.accepts())) {
+        if ((await steps.deployment()).replicas === 0)
+            slept = (await scaled()) || slept;
+        await steps.pause();
+    }
+    return slept;
+}
+//# sourceMappingURL=endpoints.js.map

package/dist/neon/control/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../../../neon/control/endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAA2B,MAAM,eAAe,CAAC;AAEtE,wHAAwH;AACxH,MAAM,CAAC,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAQhE,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,WAAsC,EAAE,IAAY,EAAE,aAA+C;IAC9H,MAAM,SAAS,GAAqC,WAAW,EAAE,SAAS,IAAI,aAAa,CAAC;IAC5F,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAAe,EAAE,YAAY,GAAkB,IAAI;IACnG,OAAO;QACL,KAAK,EAAE,OAAO;QACd,MAAM,EAAE;YACN,IAAI,EAAE,MAAM;YACZ,OAAO;YACP,OAAO,EAAE;gBACP,UAAU,EAAE,EAAE,MAAM,EAAE;gBACtB,UAAU,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE;gBAC3E,mBAAmB,EAAE,EAAE,OAAO,EAAE;aACjC;SACF;KACF,CAAC;AACJ,CAAC;AAED,oIAAoI;AACpI,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,SAAiB,EAAU,EAAE,CAAC,GAAG,OAAO,IAAI,SAAS,sBAAsB,YAAY,EAAE,CAAC;AAE1I,qHAAqH;AACrH,MAAM,UAAU,KAAK,CAAC,OAAe,EAAE,MAAc,EAAE,QAAgB,EAAE,IAAa;IACpF,OAAO;QACL,OAAO;QACP,GAAG,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE;KAC5I,CAAC;AACJ,CAAC;AAsBD;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,QAA8B,EAAE,GAAQ,EAAE,GAAW;IAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5I,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,IAAI,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AAC7G,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,EAAE,KAAK,EAAY,EAAE,GAAW,EAAE,cAAsB,EAAW,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,IAAI,cAAc,CAAC;AAoBjJ;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAA0C,KAAgB;IACzF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;IACvC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACL,IAAI,KAAK,GAAG,KAAK,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,MAAM,EAAE,CAAC;IACnD,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;YAAE,KAAK,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,IAAI,KAAK,CAAC;QACjF,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/neon/control/scram.js

@@ -1,10 +1,22 @@
 /**
  * A Postgres SCRAM-SHA-256 password verifier (RFC 5802, 7677), in the form
  * Postgres stores and compute_ctl passes through as a role's
- * encrypted_password: the password itself never reaches the compute's spec.
+ * encrypted_password: the password itself never reaches the compute's spec. Each is
+ * salted at random, as Postgres salts one, and made once: whoever sets a role's
+ * password (a compute's spec, alasio) and whoever answers for it (neon-control, to
+ * Neon's proxy, which authenticates a client with the keys of the verifier it is
+ * answered) are given the one verifier, which the compute must store to the byte.
  */
 import { createHash, createHmac, pbkdf2Sync, randomBytes } from "node:crypto";
 const ITERATIONS = 4096;
+/**
+ * A verifier as Postgres stores one: its iterations, its salt, and the 32-byte StoredKey
+ * and ServerKey, each in base64. Nothing else, so one checked to be one may be written
+ * into a statement that sets a role's password.
+ */
+const VERIFIER = /^SCRAM-SHA-256\$[1-9][0-9]*:[A-Za-z0-9+/]+={0,2}\$[A-Za-z0-9+/]{43}=:[A-Za-z0-9+/]{43}=$/u;
+/** Whether `text` is a SCRAM-SHA-256 verifier, in the form scramVerifier makes and Postgres stores. */
+export const isScramVerifier = (text) => VERIFIER.test(text);
 export function scramVerifier(password, salt = randomBytes(16)) {
     const salted = pbkdf2Sync(Buffer.from(password, "utf8"), salt, ITERATIONS, 32, "sha256");
     const clientKey = createHmac("sha256", salted).update("Client Key").digest();

package/dist/neon/control/scram.js.map

@@ -1 +1 @@
-{"version":3,"file":"scram.js","sourceRoot":"","sources":["../../../../neon/control/scram.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE9E,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,IAAI,GAAW,WAAW,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IAClE,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7E,OAAO,iBAAiB,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClI,CAAC"}
+{"version":3,"file":"scram.js","sourceRoot":"","sources":["../../../../neon/control/scram.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE9E,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB;;;;GAIG;AACH,MAAM,QAAQ,GAAG,2FAA2F,CAAC;AAE7G,uGAAuG;AACvG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE9E,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,IAAI,GAAW,WAAW,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IAClE,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7E,OAAO,iBAAiB,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClI,CAAC"}

package/dist/neon/control/secrets.js

@@ -4,9 +4,21 @@
  * one, never rotated.
  */
 import { randomBytes, randomUUID } from "node:crypto";
+import { scramVerifier } from "./scram.js";
 export const PAGESERVER_ID = 1;
 export const DATABASE = "alasio";
+/** The roles of alasio's database: alasio's own, the one its spec gives every compute. */
 export const ROLE = "alasio";
+/** The analytics lake's (src/neon/lake.ts), which alasio makes. */
+export const LAKE_ROLE = "lake";
+/** The one the lake's query endpoint reads it as (src/neon/lake.ts), which alasio makes. */
+export const LAKE_READER_ROLE = "lake_reader";
+/** Grafana's (src/neon/grafana.ts), which alasio makes. */
+export const GRAFANA_ROLE = "grafana";
+/** neon-control's own (./computes.ts), which every compute's spec gives it, and no client connects as. */
+export const MONITOR_ROLE = "neon_control";
+/** The roles main's clients connect as, whose verifiers the stack keeps. */
+export const CLIENT_ROLES = [ROLE, LAKE_ROLE, LAKE_READER_ROLE, GRAFANA_ROLE];
 function hexId() {
     return randomUUID().replaceAll("-", "");
 }
@@ -30,6 +42,13 @@ export function completeSecrets(existing = {}) {
     };
     // A secret already held keeps its place; one made is added after them, in this order.
     const s3 = kept(stored.s3, () => ({}));
+    const verifiers = kept(stored.verifiers, () => ({}));
+    const passwords = {
+        alasioPassword: kept(stored.alasioPassword, () => secret()),
+        lakePassword: kept(stored.lakePassword, () => secret()),
+        lakeReaderPassword: kept(stored.lakeReaderPassword, () => secret()),
+        grafanaPassword: kept(stored.grafanaPassword, () => secret()),
+    };
     const secrets = {
         ...stored,
         tenantId: kept(stored.tenantId, () => hexId()),
@@ -38,21 +57,36 @@ export function completeSecrets(existing = {}) {
             ...s3,
             neon: kept(s3.neon, () => ({ accessKey: `neon${hexId().slice(0, 12)}`, secretKey: secret() })),
             admin: kept(s3.admin, () => ({ accessKey: `admin${hexId().slice(0, 12)}`, secretKey: secret() })),
+            backups: kept(s3.backups, () => ({ accessKey: `backups${hexId().slice(0, 12)}`, secretKey: secret() })),
             lake: kept(s3.lake, () => ({ accessKey: `lake${hexId().slice(0, 12)}`, secretKey: secret() })),
             lakeReader: kept(s3.lakeReader, () => ({ accessKey: `lakereader${hexId().slice(0, 12)}`, secretKey: secret() })),
             workspaces: kept(s3.workspaces, () => ({ accessKey: `workspaces${hexId().slice(0, 12)}`, secretKey: secret() })),
+            snapshots: kept(s3.snapshots, () => ({ accessKey: `snapshots${hexId().slice(0, 12)}`, secretKey: secret() })),
         },
         controllerDbPassword: kept(stored.controllerDbPassword, () => secret()),
-        alasioPassword: kept(stored.alasioPassword, () => secret()),
-        lakePassword: kept(stored.lakePassword, () => secret()),
+        alasioPassword: passwords.alasioPassword,
+        lakePassword: passwords.lakePassword,
         computeControlToken: kept(stored.computeControlToken, () => secret()),
         valkeyPassword: kept(stored.valkeyPassword, () => secret()),
-        lakeReaderPassword: kept(stored.lakeReaderPassword, () => secret()),
+        lakeReaderPassword: passwords.lakeReaderPassword,
         lakeQueryToken: kept(stored.lakeQueryToken, () => secret()),
-        grafanaPassword: kept(stored.grafanaPassword, () => secret()),
+        grafanaPassword: passwords.grafanaPassword,
         grafanaAdminPassword: kept(stored.grafanaAdminPassword, () => secret()),
         grafanaSecretKey: kept(stored.grafanaSecretKey, () => secret()),
         branchForkKey: kept(stored.branchForkKey, () => secret()),
+        filerStoreFilerPassword: kept(stored.filerStoreFilerPassword, () => secret()),
+        filerStoreCollectorPassword: kept(stored.filerStoreCollectorPassword, () => secret()),
+        filerStoreBackupPassword: kept(stored.filerStoreBackupPassword, () => secret()),
+        monitorKey: kept(stored.monitorKey, () => secret()),
+        // Each of its password above, whether that was kept or made now.
+        verifiers: {
+            ...verifiers,
+            [ROLE]: kept(verifiers[ROLE], () => scramVerifier(passwords.alasioPassword)),
+            [LAKE_ROLE]: kept(verifiers[LAKE_ROLE], () => scramVerifier(passwords.lakePassword)),
+            [LAKE_READER_ROLE]: kept(verifiers[LAKE_READER_ROLE], () => scramVerifier(passwords.lakeReaderPassword)),
+            [GRAFANA_ROLE]: kept(verifiers[GRAFANA_ROLE], () => scramVerifier(passwords.grafanaPassword)),
+        },
+        nodeAgentToken: kept(stored.nodeAgentToken, () => secret()),
     };
     return { secrets, changed };
 }
@@ -64,22 +98,32 @@ export function remoteStorage(prefix, { endpoint, bucket, region = "us-east-1" }
     return `{ endpoint="${endpoint}", bucket_name="${bucket}", bucket_region="${region}", prefix_in_bucket="${prefix}" }`;
 }
 /**
- * SeaweedFS's S3 identities: Neon, the lake and, when it is on, workspace storage, each
- * on their own bucket of `buckets`; the lake's reader, which may only read the lake's;
- * and an admin, which makes the buckets and keeps the backups.
+ * SeaweedFS's S3 identities: Neon, the lake, workspace storage when it is on and the
+ * snapshots' when sandboxes are snapshotted, each on their own bucket of `buckets`; the
+ * lake's reader, which may only read the lake's; the backups', which writes the backups'
+ * bucket and reads the workspaces' metadata it backs up; and an admin of Neon's bucket
+ * alone, which gives it its lifecycle rules. The snapshots' identity is its bucket's admin,
+ * giving it its rules itself: what may write that bucket writes the images the node agents
+ * restore as root, so nothing else may.
  */
 export function s3Identities(secrets, buckets) {
     const on = (name) => [`Read:${name}`, `List:${name}`, `Tagging:${name}`, `Write:${name}`];
     return {
         identities: [
             { name: "neon", credentials: [secrets.s3.neon], actions: on(buckets.neon) },
-            { name: "admin", credentials: [secrets.s3.admin], actions: ["Admin", "Read", "List", "Tagging", "Write"] },
+            { name: "admin", credentials: [secrets.s3.admin], actions: [`Admin:${buckets.neon}`] },
+            {
+                name: "backups",
+                credentials: [secrets.s3.backups],
+                actions: [...on(buckets.backups), ...(buckets.workspaces === null ? [] : [`Read:${buckets.workspaces}`, `List:${buckets.workspaces}`])],
+            },
             // Branch environments' lakes are given it too: a branch's lake reads main's files where they are (DuckLake keeps
             // every file's path relative to one data path) and writes beside them, and SeaweedFS's Write, which writing
             // needs, deletes as well, so it cannot be narrowed to a branch's own files (cli/src/branches.ts).
             { name: "lake", credentials: [secrets.s3.lake], actions: on(buckets.lake) },
             { name: "lakeReader", credentials: [secrets.s3.lakeReader], actions: [`Read:${buckets.lake}`, `List:${buckets.lake}`] },
             ...(buckets.workspaces === null ? [] : [{ name: "workspaces", credentials: [secrets.s3.workspaces], actions: on(buckets.workspaces) }]),
+            ...(buckets.snapshots === null ? [] : [{ name: "snapshots", credentials: [secrets.s3.snapshots], actions: [...on(buckets.snapshots), `Admin:${buckets.snapshots}`] }]),
         ],
     };
 }

package/dist/neon/control/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../../neon/control/secrets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC;AAsE7B,SAAS,KAAK;IACZ,OAAO,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAkB,EAAE;IAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,CAAI,KAAoB,EAAE,IAAa,EAAK,EAAE;QACzD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,sFAAsF;IACtF,MAAM,EAAE,GAA+C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAiB;QAC5B,GAAG,MAAM;QACT,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QAC9C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QAClD,EAAE,EAAE;YACF,GAAG,EAAE;YACL,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9F,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9F,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAChH,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;SACjH;QACD,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvD,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACrE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACnE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC7D,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC/D,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;KAC1D,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,EAAyB;IAC7G,OAAO,eAAe,QAAQ,mBAAmB,MAAM,qBAAqB,MAAM,wBAAwB,MAAM,KAAK,CAAC;AACxH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAqB,EAAE,OAAgB;IAClE,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,QAAQ,IAAI,EAAE,EAAE,WAAW,IAAI,EAAE,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAClG,OAAO;QACL,UAAU,EAAE;YACV,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;YAC1G,iHAAiH;YACjH,4GAA4G;YAC5G,kGAAkG;YAClG,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC3E,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE;YACvH,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;SACjJ;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AAEzE;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAoB;IAC1G,OAAO;QACL,mBAAmB,IAAI,CAAC,SAAS,CAAC,EAAE;QACpC,kBAAkB,IAAI,CAAC,aAAa,CAAC,EAAE;QACvC,kBAAkB,IAAI,CAAC,cAAc,CAAC,EAAE;QACxC,oBAAoB,IAAI,CAAC,cAAc,CAAC,EAAE;QAC1C,qBAAqB,IAAI,CAAC,eAAe,CAAC,EAAE;QAC5C,qBAAqB,IAAI,CAAC,GAAG,aAAa,aAAa,CAAC,EAAE;QAC1D,2BAA2B,IAAI,CAAC,KAAK,CAAC,EAAE;QACxC,0BAA0B;QAC1B,wBAAwB;QACxB,mCAAmC,IAAI,CAAC,aAAa,CAAC,EAAE;QACxD,kBAAkB,OAAO,EAAE;QAC3B,6CAA6C,cAAc,CAAC,WAAW,qBAAqB,cAAc,CAAC,aAAa,IAAI;QAC5H,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC;AAC9H,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../../neon/control/secrets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC;AAC7B,mEAAmE;AACnE,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAChC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAC9C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC;AACtC,0GAA0G;AAC1G,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,CAAU,CAAC;AAmGvF,SAAS,KAAK;IACZ,OAAO,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAkB,EAAE;IAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,CAAI,KAAoB,EAAE,IAAa,EAAK,EAAE;QACzD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,sFAAsF;IACtF,MAAM,EAAE,GAA+C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,SAAS,GAAwC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG;QAChB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACnE,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;KAC9D,CAAC;IACF,MAAM,OAAO,GAAiB;QAC5B,GAAG,MAAM;QACT,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QAC9C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QAClD,EAAE,EAAE;YACF,GAAG,EAAE;YACL,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9F,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACvG,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9F,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAChH,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAChH,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;SAC9G;QACD,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvE,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACrE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC/D,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACzD,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC7E,2BAA2B,EAAE,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACrF,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC/E,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACnD,iEAAiE;QACjE,SAAS,EAAE;YACT,GAAG,SAAS;YACZ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YAC5E,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACpF,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACxG,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;SAC9F;QACD,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;KAC5D,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,EAAyB;IAC7G,OAAO,eAAe,QAAQ,mBAAmB,MAAM,qBAAqB,MAAM,wBAAwB,MAAM,KAAK,CAAC;AACxH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAqB,EAAE,OAAgB;IAClE,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,QAAQ,IAAI,EAAE,EAAE,WAAW,IAAI,EAAE,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAClG,OAAO;QACL,UAAU,EAAE;YACV,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,SAAS,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE;YACtF;gBACE,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC;gBACjC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,UAAU,EAAE,EAAE,QAAQ,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;aACxI;YACD,iHAAiH;YACjH,4GAA4G;YAC5G,kGAAkG;YAClG,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC3E,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE;YACvH,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChJ,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;SAChL;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AAEzE;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAoB;IAC1G,OAAO;QACL,mBAAmB,IAAI,CAAC,SAAS,CAAC,EAAE;QACpC,kBAAkB,IAAI,CAAC,aAAa,CAAC,EAAE;QACvC,kBAAkB,IAAI,CAAC,cAAc,CAAC,EAAE;QACxC,oBAAoB,IAAI,CAAC,cAAc,CAAC,EAAE;QAC1C,qBAAqB,IAAI,CAAC,eAAe,CAAC,EAAE;QAC5C,qBAAqB,IAAI,CAAC,GAAG,aAAa,aAAa,CAAC,EAAE;QAC1D,2BAA2B,IAAI,CAAC,KAAK,CAAC,EAAE;QACxC,0BAA0B;QAC1B,wBAAwB;QACxB,mCAAmC,IAAI,CAAC,aAAa,CAAC,EAAE;QACxD,kBAAkB,OAAO,EAAE;QAC3B,6CAA6C,cAAc,CAAC,WAAW,qBAAqB,cAAc,CAAC,aAAa,IAAI;QAC5H,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC;AAC9H,CAAC"}

package/dist/src/kube/busy-label.js

@@ -0,0 +1,13 @@
+/**
+ * What marks a pod busy, running a turn: the label alasio sets on it while it does
+ * (./busy.ts), which its installation's PodDisruptionBudgets select
+ * (cli/src/manifests/disruption.ts), and the annotations that go with it.
+ */
+/** The label of a pod running a turn, "true" while it does. */
+export const BUSY_LABEL = "alasio.dev/busy";
+/** What cluster-autoscaler and Karpenter read as "do not remove this pod's node now". */
+export const BUSY_ANNOTATIONS = {
+    "cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
+    "karpenter.sh/do-not-disrupt": "true",
+};
+//# sourceMappingURL=busy-label.js.map

package/dist/src/kube/busy-label.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"busy-label.js","sourceRoot":"","sources":["../../../../src/kube/busy-label.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAE5C,yFAAyF;AACzF,MAAM,CAAC,MAAM,gBAAgB,GAAqC;IAChE,gDAAgD,EAAE,OAAO;IACzD,6BAA6B,EAAE,MAAM;CACtC,CAAC"}

package/dist/src/kube/config.js

@@ -5,7 +5,8 @@
  *
  *     {
  *       "sessions": { "namespace", "port", "workspaceDir", "egressGate", "fullModeNameservers",
- *                     "mountPodNamespace", "podTemplate", "volumeClaimTemplates", "clone" },
+ *                     "mountPodNamespace", "podTemplate", "volumeClaimTemplates", "clone",
+ *                     "snapshots" },
  *       "host":     { "namespace", "port", "stateRoot", "podTemplate" }
  *     }
  *
@@ -15,6 +16,7 @@
  */
 import { readFileSync } from "node:fs";
 import { Config, Effect, Predicate, Result, Schema, SchemaGetter, SchemaIssue } from "effect";
+import { CLAIM_TEMPLATE_MAX } from "../sandbox/names.js";
 /** The deployment's templates could not be read, or are not what alasio needs; the message says which. */
 export class KubeTemplatesError extends Schema.TaggedError()("KubeTemplatesError", {
     message: Schema.String,
@@ -46,9 +48,26 @@ const VolumeClaimTemplates = said(Schema.Array(Schema.declare((value) => Predica
  * installation gives, which the API server checks as each is made.
  */
 const Clone = said(Schema.Struct({
-    claimTemplate: said(Schema.NonEmptyString, "must be a claim template's name"),
+    // Short enough that each claim of it, named `<template>-<volume id>`, is a DNS label.
+    claimTemplate: said(Schema.String.check(Schema.isPattern(new RegExp(`^[a-z0-9]([-a-z0-9]{0,${CLAIM_TEMPLATE_MAX - 2}}[a-z0-9])?$`, "u"))), `must be a claim template's name, a DNS label of at most ${CLAIM_TEMPLATE_MAX} characters`),
     job: said(Schema.declare((value) => Predicate.isObject(value)), "must be an object"),
 }), "must be an object");
+/** The variables a clone's Job is given, after its own, in this order (src/sandbox/index.ts). */
+export const CLONE_VARIABLES = ["SOURCE_NAMESPACE", "SOURCE_CLAIM", "DESTINATION_NAMESPACE", "DESTINATION_CLAIM"];
+const Count = said(Schema.Number.check(Schema.isInt({ message: "must be a whole number" }), Schema.isGreaterThan(0, { message: "must be positive" })), "must be a positive whole number");
+/**
+ * Session sandboxes' whole-sandbox snapshots (../sandbox/snapshots.ts): how long a session
+ * runs no exec and no turn before its Sandbox is snapshotted and released; the gVisor
+ * releases a snapshot is restored under, each by its RuntimeClass, the current one first;
+ * and where the node agents that take and prepare the snapshots are, by their pods'
+ * namespace and labels, and the port they serve on.
+ */
+const Snapshots = said(Schema.Struct({
+    releaseAfterSeconds: Count,
+    releases: said(Schema.Array(Schema.Struct({ release: said(Schema.NonEmptyString, "must be a release"), runtimeClassName: said(Schema.NonEmptyString, "must be a RuntimeClass's name") }))
+        .check(Schema.isMinLength(1, { message: "must name a release" })), "must be a list of releases"),
+    agents: said(Schema.Struct({ namespace: Namespace, selector: said(Schema.NonEmptyString, "must be a label selector"), port: Port }), "must be an object"),
+}), "must be an object");
 /** Whether `podTemplate`, as the installation gives it, runs a container named `bayma`. */
 function runsBayma(podTemplate) {
     const containers = Predicate.hasProperty(podTemplate, "spec") && Predicate.hasProperty(podTemplate.spec, "containers")
@@ -77,6 +96,8 @@ const SessionsProfile = said(Schema.Struct({
     volumeClaimTemplates: Schema.optional(VolumeClaimTemplates),
     /** How a session's volume is cloned, where its storage can; none where it cannot, and sessions are not forked. */
     clone: Schema.optional(Schema.NullOr(Clone)),
+    /** How sessions' Sandboxes are snapshotted as they are released, where they are; none where they are not. */
+    snapshots: Schema.optional(Schema.NullOr(Snapshots)),
 }), "must be an object").check(Schema.makeFilter((profile) => (runsBayma(profile.podTemplate) ? undefined : baymaIssue)));
 /** The template of folder workspaces' bayma (hostProfile in cli/src/manifests/alasio.ts). */
 const HostProfile = said(Schema.Struct({
@@ -86,8 +107,13 @@ const HostProfile = said(Schema.Struct({
 }), "must be an object").check(Schema.makeFilter((profile) => (runsBayma(profile.podTemplate) ? undefined : baymaIssue)));
 /** A profile the deployment may leave out, which is then null. */
 const optionalProfile = (schema) => said(Schema.NullOr(schema), "must be an object").pipe(Schema.withDecodingDefaultKey(Effect.succeed(null)));
-/** ALASIO_KUBE_TEMPLATES, checked: a profile the deployment does not render is null. */
-const KubeTemplates = said(Schema.Struct({ sessions: optionalProfile(SessionsProfile), host: optionalProfile(HostProfile) }), "must be an object");
+/**
+ * ALASIO_KUBE_TEMPLATES, checked: a profile the deployment does not render is null; and
+ * the sessions' profile before the current one, as `alasio up` carries it forward until
+ * their template changes again, which sessions' snapshots may restore onto
+ * (../sandbox/snapshots.ts), null where there is none.
+ */
+const KubeTemplates = said(Schema.Struct({ sessions: optionalProfile(SessionsProfile), previousSessions: optionalProfile(SessionsProfile), host: optionalProfile(HostProfile) }), "must be an object");
 const formatIssue = SchemaIssue.makeFormatterStandardSchemaV1();
 /** The first thing wrong with the templates, as alasio says it: the key's path, then what it must be. */
 function describe(issue) {

package/dist/src/kube/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/kube/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE9F,0GAA0G;AAC1G,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAAC,oBAAoB,EAAE;IACrG,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,MAAM,SAAS,GAAG,uCAAuC,CAAC;AAE1D;;;GAGG;AACH,MAAM,IAAI,GAAG,CAAuB,MAAS,EAAE,OAAe,EAAgB,EAAE,CAC9E,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;AAE3E,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,CACpB,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;KAChJ,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC,EAC9E,0BAA0B,CAC3B,CAAC;AAEF,MAAM,IAAI,GAAG,IAAI,CACf,MAAM,CAAC,MAAM,CAAC,KAAK,CACjB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAClD,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CACvF,EACD,uBAAuB,CACxB,CAAC;AAEF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAA8B,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAClI,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAClD,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAoC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EACpG,0CAA0C,CAC3C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,IAAI,CAChB,MAAM,CAAC,MAAM,CAAC;IACZ,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,iCAAiC,CAAC;IAC7E,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAkB,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC;CACrG,CAAC,EACF,mBAAmB,CACpB,CAAC;AAEF,2FAA2F;AAC3F,SAAS,SAAS,CAAC,WAAoB;IACrC,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC;QACpH,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU;QAC7B,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAkB,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AACtJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AAEtF,+DAA+D;AAC/D,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;AAE5G,uGAAuG;AACvG,MAAM,eAAe,GAAG,IAAI,CAC1B,MAAM,CAAC,MAAM,CAAC;IACZ,GAAG,cAAc;IACjB,6DAA6D;IAC7D,YAAY,EAAE,IAAI;IAClB,uGAAuG;IACvG,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACzF,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IACrH;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAC3D,kHAAkH;IAClH,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;CAC7C,CAAC,EACF,mBAAmB,CACpB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAEnG,6FAA6F;AAC7F,MAAM,WAAW,GAAG,IAAI,CACtB,MAAM,CAAC,MAAM,CAAC;IACZ,GAAG,cAAc;IACjB,uFAAuF;IACvF,SAAS,EAAE,IAAI;CAChB,CAAC,EACF,mBAAmB,CACpB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAEnG,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAuB,MAAS,EAAE,EAAE,CAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE7G,wFAAwF;AACxF,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAMnJ,MAAM,WAAW,GAAG,WAAW,CAAC,6BAA6B,EAAE,CAAC;AAEhE,yGAAyG;AACzG,SAAS,QAAQ,CAAC,KAAwB;IACxC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAClI,OAAO,CAAC,uBAAuB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,4BAA4B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,IAAY,EAAoD,EAAE,CAClH,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAY,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACpC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,yBAAyB,IAAI,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;CACvK,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAC1I,CACF,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1H,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjG,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC,CAAC;IAC1I,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QACrC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,yBAAyB,IAAI,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;KACvK,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/kube/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,0GAA0G;AAC1G,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAAC,oBAAoB,EAAE;IACrG,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,MAAM,SAAS,GAAG,uCAAuC,CAAC;AAE1D;;;GAGG;AACH,MAAM,IAAI,GAAG,CAAuB,MAAS,EAAE,OAAe,EAAgB,EAAE,CAC9E,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;AAE3E,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,CACpB,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;KAChJ,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC,EAC9E,0BAA0B,CAC3B,CAAC;AAEF,MAAM,IAAI,GAAG,IAAI,CACf,MAAM,CAAC,MAAM,CAAC,KAAK,CACjB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAClD,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CACvF,EACD,uBAAuB,CACxB,CAAC;AAEF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAA8B,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAClI,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAClD,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAoC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EACpG,0CAA0C,CAC3C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,IAAI,CAChB,MAAM,CAAC,MAAM,CAAC;IACZ,sFAAsF;IACtF,aAAa,EAAE,IAAI,CACjB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,yBAAyB,kBAAkB,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,EACrH,2DAA2D,kBAAkB,aAAa,CAC3F;IACD,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAkB,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC;CACrG,CAAC,EACF,mBAAmB,CACpB,CAAC;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,kBAAkB,EAAE,cAAc,EAAE,uBAAuB,EAAE,mBAAmB,CAAU,CAAC;AAE3H,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;AAE1L;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,IAAI,CACpB,MAAM,CAAC,MAAM,CAAC;IACZ,mBAAmB,EAAE,KAAK;IAC1B,QAAQ,EAAE,IAAI,CACZ,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,+BAA+B,CAAC,EAAE,CAAC,CAAC;SACvK,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC,EACnE,4BAA4B,CAC7B;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,mBAAmB,CAAC;CAC1J,CAAC,EACF,mBAAmB,CACpB,CAAC;AAEF,2FAA2F;AAC3F,SAAS,SAAS,CAAC,WAAoB;IACrC,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC;QACpH,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU;QAC7B,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAkB,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AACtJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AAEtF,+DAA+D;AAC/D,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;AAE5G,uGAAuG;AACvG,MAAM,eAAe,GAAG,IAAI,CAC1B,MAAM,CAAC,MAAM,CAAC;IACZ,GAAG,cAAc;IACjB,6DAA6D;IAC7D,YAAY,EAAE,IAAI;IAClB,uGAAuG;IACvG,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACzF,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IACrH;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAC3D,kHAAkH;IAClH,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,6GAA6G;IAC7G,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;CACrD,CAAC,EACF,mBAAmB,CACpB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAEnG,6FAA6F;AAC7F,MAAM,WAAW,GAAG,IAAI,CACtB,MAAM,CAAC,MAAM,CAAC;IACZ,GAAG,cAAc;IACjB,uFAAuF;IACvF,SAAS,EAAE,IAAI;CAChB,CAAC,EACF,mBAAmB,CACpB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAEnG,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAuB,MAAS,EAAE,EAAE,CAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE7G;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,eAAe,CAAC,EAAE,gBAAgB,EAAE,eAAe,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,EACrJ,mBAAmB,CACpB,CAAC;AAMF,MAAM,WAAW,GAAG,WAAW,CAAC,6BAA6B,EAAE,CAAC;AAEhE,yGAAyG;AACzG,SAAS,QAAQ,CAAC,KAAwB;IACxC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAClI,OAAO,CAAC,uBAAuB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,4BAA4B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,IAAY,EAAoD,EAAE,CAClH,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAY,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACpC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,yBAAyB,IAAI,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;CACvK,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAC1I,CACF,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1H,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjG,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC,CAAC;IAC1I,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QACrC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,yBAAyB,IAAI,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;KACvK,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC"}

package/dist/src/kube/sandbox-shape.js

@@ -0,0 +1,98 @@
+/**
+ * What alasio adds to a workspace's Sandbox over the template its installation gives it
+ * (../kube/config.ts): bayma's token, mounted from a Secret of the Sandbox's, and passed
+ * as a file; the labels that name the Sandbox and say what it is; and, of a session's,
+ * its internet's gate and DNS (../sandbox/index.ts), and of a folder's bayma, its state
+ * directory (../mcp/bayma.ts). In one place, with no dependency, so the admission policy
+ * that holds alasio to its templates (cli/src/manifests/admission.ts) knows it as they do.
+ */
+/** The container in every Sandbox's pod that runs bayma. */
+export const BAYMA_CONTAINER = "bayma";
+/** Where a Sandbox's token Secret is mounted in its bayma container, its key, and its volume. */
+export const TOKEN_DIR = "/run/alasio/bayma";
+export const TOKEN_KEY = "token";
+export const TOKEN_VOLUME = "alasio-bayma-token";
+/** The token volume's files' mode: readable by the pod's group, which is how a non-root bayma reads it. */
+export const TOKEN_MODE = 0o440;
+/** The file bayma reads its token from, which a restored Sandbox's new token replaces. */
+export const TOKEN_FILE = `${TOKEN_DIR}/${TOKEN_KEY}`;
+/** The arguments bayma is given after its template's: where its token is. */
+export const TOKEN_FILE_ARGS = ["--token-file", TOKEN_FILE];
+/** The arguments a session's bayma is given after those when it exports telemetry: the token it exports with, read from the same file for each export. */
+export const TELEMETRY_TOKEN_FILE_ARGS = ["--telemetry-token-file", TOKEN_FILE];
+/** The name of a Sandbox's token Secret. */
+export function tokenSecretName(name) {
+    return `${name}-bayma-token`;
+}
+/** The label every object alasio makes carries, and the one that names its Sandbox. */
+export const MANAGED_BY = { "app.kubernetes.io/managed-by": "alasio" };
+export const SANDBOX_LABEL = "alasio.dev/sandbox";
+/** What a Sandbox's pod is to alasio: a session's, or a folder's bayma's. */
+export const WORKLOAD_LABEL = "alasio.dev/workload";
+/** A session's internet, `none` or `full`, which its NetworkPolicies follow. */
+export const NET_MODE_LABEL = "alasio.dev/net-mode";
+/** The harness a folder's bayma serves, as a path segment. */
+export const HARNESS_LABEL = "alasio.dev/harness";
+/** The resolvers a session with internet uses unless its template names others. */
+export const DEFAULT_FULL_MODE_NAMESERVERS = ["1.1.1.1", "8.8.8.8"];
+/** The argument a folder's bayma is given its state directory by, under its template's state root. */
+export const STATE_DIR_ARG = "--state-dir";
+/** A path segment from `value`: never empty, nor starting with a dot. */
+export function sanitizePathToken(value) {
+    return String(value).replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/^[-.]+|-+$/g, "") || "default";
+}
+/**
+ * What a session's pod template carries of its whole-sandbox snapshots
+ * (../sandbox/snapshots.ts): the hash of the template it was made from, which its
+ * snapshots record; the CPU features its sandbox is held to; and, of a pod restored from
+ * a snapshot, the image it is restored from, on its node under the snapshot cache, left
+ * paused until its node's agent resumes it, which its readiness gate waits for.
+ */
+export const SESSION_TEMPLATE_ANNOTATION = "alasio.dev/session-template";
+/** gVisor's annotation that holds a sandbox to the CPU features it names, of those its node has. */
+export const CPU_FEATURES_ANNOTATION = "dev.gvisor.internal.cpufeatures";
+/** The annotation alasio's fork of gVisor restores a pod's sandbox from, naming the image on the node. */
+export const RESTORE_ANNOTATION = "dev.gvisor.internal.restore.host-image-path";
+/** The fork's annotation that leaves a restored sandbox paused, running nothing, until it is resumed. */
+export const RESTORE_PAUSED_ANNOTATION = "dev.gvisor.internal.restore.paused";
+/** The condition of a restored pod's readiness gate, which alasio sets once its sandbox is resumed. */
+export const RESUMED_CONDITION = "alasio.dev/resumed";
+/**
+ * The annotation of a suspended Sandbox naming the snapshot its pod was saved into, which
+ * alone it may be restored from: set as it is suspended, removed as it is next resumed,
+ * from that snapshot or not, so a snapshot outlives no resume of its Sandbox's.
+ */
+export const SNAPSHOT_ANNOTATION = "alasio.dev/snapshot";
+/**
+ * The annotation naming the gVisor release that took the snapshot SNAPSHOT_ANNOTATION
+ * names, beside it, the only one that restores it: `alasio up` keeps every release one
+ * names (cli/src/kept-releases.ts).
+ */
+export const SNAPSHOT_RELEASE_ANNOTATION = "alasio.dev/snapshot-release";
+/** Where a node agent keeps the snapshots it prepares, as `<environment>/<workspace>/<snapshot>` (../node-agent/cache.ts). */
+export const SNAPSHOT_CACHE_DIR = "/var/lib/alasio/snapshots";
+/** A snapshot's id, as a node agent names it: when it was taken, then 32 random bits. */
+export const SNAPSHOT_ID = "[0-9]{8}T[0-9]{6}Z-[0-9a-f]{8}";
+/** A DNS label: an environment's name (its sessions' namespace) and a workspace's (its Sandbox's), as the snapshot cache's directories are named. */
+export const NAME = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/u;
+/** The init container that holds a session's pod until its egress is confined: its name, and its resources. */
+export const EGRESS_GATE = { name: "egress-gate", resources: { requests: { cpu: "10m", memory: "32Mi" }, limits: { memory: "64Mi" } } };
+/**
+ * The egress gate's program: exits once three connections in a row to the API server
+ * fail, and fails the pod if they still succeed after two minutes. Runs on the agent
+ * image's Node.
+ */
+export const EGRESS_GATE_SCRIPT = [
+    "const net = require('node:net');",
+    "const host = process.env.KUBERNETES_SERVICE_HOST, port = Number(process.env.KUBERNETES_SERVICE_PORT);",
+    "const deadline = Date.now() + 120000; let refused = 0;",
+    "(function probe() {",
+    "  const socket = net.connect({ host, port, timeout: 1000 });",
+    "  const next = (blocked) => { socket.destroy(); refused = blocked ? refused + 1 : 0;",
+    "    if (refused >= 3) process.exit(0);",
+    "    if (Date.now() > deadline) { console.error('egress is not confined: is NetworkPolicy enforced in this cluster?'); process.exit(1); }",
+    "    setTimeout(probe, 250); };",
+    "  socket.once('connect', () => next(false)); socket.once('timeout', () => next(true)); socket.once('error', () => next(true));",
+    "})();",
+].join("\n");
+//# sourceMappingURL=sandbox-shape.js.map

package/dist/src/kube/sandbox-shape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-shape.js","sourceRoot":"","sources":["../../../../src/kube/sandbox-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,iGAAiG;AACjG,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAC7C,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AAChC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;AAEtD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAC/E,0JAA0J;AAC1J,MAAM,CAAC,MAAM,yBAAyB,GAAsB,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC;AAEnG,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,GAAG,IAAI,cAAc,CAAC;AAC/B,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,8BAA8B,EAAE,QAAQ,EAAW,CAAC;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEvF,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AACzE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAChF,yGAAyG;AACzG,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAC9E,uGAAuG;AACvG,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AACzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,8HAA8H;AAC9H,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAC9D,yFAAyF;AACzF,MAAM,CAAC,MAAM,WAAW,GAAG,gCAAgC,CAAC;AAC5D,qJAAqJ;AACrJ,MAAM,CAAC,MAAM,IAAI,GAAG,uCAAuC,CAAC;AAE5D,+GAA+G;AAC/G,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAW,CAAC;AAEjJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,kCAAkC;IAClC,uGAAuG;IACvG,wDAAwD;IACxD,qBAAqB;IACrB,8DAA8D;IAC9D,sFAAsF;IACtF,wCAAwC;IACxC,0IAA0I;IAC1I,gCAAgC;IAChC,gIAAgI;IAChI,OAAO;CACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}

package/dist/src/node-agent/names.js

@@ -0,0 +1,74 @@
+/**
+ * Where a node keeps its gVisor releases, containerd's runtimes of them and its
+ * snapshots, where its node agent serves, and the memory the agent needs: as the agent
+ * reads them, the clusters alasio makes lay them out (cli/src/cluster/), and the
+ * installation's manifests give them to the agent (cli/src/manifests/node-agent.ts). Free
+ * of any import but sandbox-shape's, itself free of any, so the command line takes it
+ * without the agent.
+ */
+/** The port a node agent serves its API on, on its pod's address. */
+export const NODE_AGENT_PORT = 8484;
+/**
+ * Where a node keeps the gVisor releases alasio keeps, each in a directory of its own
+ * named after it, as its release archive has them: runsc, its shim, and gvisor-bin/, the
+ * binaries runsc runs beside it.
+ */
+export const GVISOR_RELEASES = "/usr/local/lib/alasio/gvisor";
+/** The directory of gVisor's `release` on a node. */
+export const gvisorDirectory = (release) => `${GVISOR_RELEASES}/${release}`;
+/** Where k3s's containerd reads its template, and runsc its options. */
+export const CONTAINERD = "/var/lib/rancher/k3s/agent/etc/containerd";
+/** gVisor's `release` as a DNS label, which containerd's runtimes and Kubernetes' RuntimeClasses are named with: its dots made dashes. */
+export const gvisorLabel = (release) => release.replaceAll(".", "-");
+/**
+ * The containerd runtime of gVisor's `release`, which a RuntimeClass names as its
+ * handler, and whose runsc options are `<CONTAINERD>/<runtime>.toml`.
+ */
+export const gvisorHandler = (release) => `runsc-${gvisorLabel(release)}`;
+/** The RuntimeClass of gVisor's `release` alone, which a sandbox snapshotted under it is restored with. */
+export const gvisorRuntimeClass = (release) => `gvisor-${gvisorLabel(release)}`;
+/** The version runsc of gVisor's `release` reports, and saves its images with: its release's tag. */
+export const runscVersion = (release) => `release-${release}`;
+/** The root the gVisor shims run runsc with for Kubernetes' containers, under the node's /run. */
+export const RUNSC_ROOT = "/run/containerd/runsc/k8s.io";
+/** The node's snapshot cache, where its sandboxes are restored from, as the admission policy holds a restore to. */
+export { SNAPSHOT_CACHE_DIR } from "../kube/sandbox-shape.js";
+/**
+ * The node agent's container that says, as its pod starts, the CPU features its node has
+ * under the current gVisor release (./cpu-features.ts), as its termination message, which
+ * Kubernetes keeps up to 4 KiB of: a CpuFeaturesReport, as JSON.
+ */
+export const CPU_FEATURES_CONTAINER = "cpu-features";
+/** A part of a snapshot file the node agent puts or gets (./s3.ts): 32 MiB, as large as S3's 10000 parts make an object of 312 GiB. */
+export const SNAPSHOT_PART_BYTES = 32 * 1024 ** 2;
+/** How many parts of a snapshot file the node agent puts or gets at a time, and how many gets, of every snapshot it gets. */
+export const SNAPSHOT_PARTS_AT_ONCE = 4;
+/** What a get of the node agent's writes to its file between syncs to the disk: 8 MiB. */
+export const SNAPSHOT_SYNC_BYTES = 8 * 1024 ** 2;
+/**
+ * The node agent's memory budget for what it gets: what it holds written and not yet on
+ * the disk, at most, of every get at a time together (./s3.ts). The kernel counts it in the
+ * agent's memory and cannot reclaim it before it is written, so the agent's memory limit
+ * leaves room for it beside the agent's own; what it reads through the page cache, the
+ * kernel reclaims.
+ */
+export const UNSYNCED_DOWNLOAD_BYTES = SNAPSHOT_PARTS_AT_ONCE * SNAPSHOT_SYNC_BYTES;
+/**
+ * The node agent's own memory: what it was measured to hold restoring a 1 GiB session's
+ * snapshot from the bucket on a node of its own (test/e2e, 125 to 145 MiB anonymous),
+ * rounded up.
+ */
+export const NODE_AGENT_OWN_BYTES = 160 * 1024 ** 2;
+/** The least memory limit a node agent runs under: its own, and a download's budget beside it. */
+export const NODE_AGENT_MEMORY_FLOOR = NODE_AGENT_OWN_BYTES + UNSYNCED_DOWNLOAD_BYTES;
+/** The variable holding the token alasio presents to a node agent. */
+export const NODE_AGENT_TOKEN_VARIABLE = "ALASIO_NODE_AGENT_TOKEN";
+/** The variable holding the most bytes the node's snapshot cache keeps. */
+export const SNAPSHOT_CACHE_BYTES_VARIABLE = "ALASIO_SNAPSHOT_CACHE_BYTES";
+/**
+ * How long a checkpoint, a prepare or a copy may take: a sandbox's memory, through the store,
+ * both ways, or within it. alasio waits for one so long, and an agent that stops lets the
+ * ones it runs end within it (./operations.ts).
+ */
+export const OPERATION_LIMIT_SECONDS = 15 * 60;
+//# sourceMappingURL=names.js.map

package/dist/src/node-agent/names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/node-agent/names.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAE9D,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,eAAe,IAAI,OAAO,EAAE,CAAC;AAE5F,wEAAwE;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAEtE,0IAA0I;AAC1I,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAE1F,2GAA2G;AAC3G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAEhG,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,WAAW,OAAO,EAAE,CAAC;AAE9E,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAEzD,oHAAoH;AACpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAQrD,uIAAuI;AACvI,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;AAElD,6HAA6H;AAC7H,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,GAAG,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAEpD,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AAEtF,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,6BAA6B,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC"}