alasio 6.0.0 → 8.0.0

package/dist/neon/control/secrets.js

@@ -4,15 +4,57 @@
  * one, never rotated.
  */
 import { randomBytes, randomUUID } from "node:crypto";
-export const PAGESERVER_ID = 1;
+import { scramVerifier } from "./scram.js";
+/**
+ * The availability zone every pageserver is in: one, the tenant's home zone, as alasio's
+ * pageservers are no zones apart, so any of them may hold any shard attached.
+ */
+export const PAGESERVER_ZONE = "az-pageserver";
 export const DATABASE = "alasio";
+/** The roles of alasio's database: alasio's own, the one its spec gives every compute. */
 export const ROLE = "alasio";
+/** The analytics lake's (src/neon/lake.ts), which alasio makes. */
+export const LAKE_ROLE = "lake";
+/** The one the lake's query endpoint reads it as (src/neon/lake.ts), which alasio makes. */
+export const LAKE_READER_ROLE = "lake_reader";
+/** Grafana's (src/neon/grafana.ts), which alasio makes. */
+export const GRAFANA_ROLE = "grafana";
+/** neon-control's own (./computes.ts), which every compute's spec gives it, and no client connects as. */
+export const MONITOR_ROLE = "neon_control";
+/** The roles main's clients connect as, whose verifiers the stack keeps. */
+export const CLIENT_ROLES = [ROLE, LAKE_ROLE, LAKE_READER_ROLE, GRAFANA_ROLE];
+/**
+ * Main's environment's principals on the log, as cli/src/manifests/log.ts's
+ * environmentAccess("main") names them: its alasio's, which reads its Telegram updates and
+ * writes its wake topic, and its lake loader's, which reads that. A branch environment's
+ * are its own, which alasio's command line makes with it.
+ */
+export const MAIN_ENVIRONMENT_PRINCIPALS = ["alasio-main", "loader-main"];
+/**
+ * The log's principals besides its admin, each with a password of its own: the collector's
+ * gateway, which writes the stack's telemetry to it; the lake's intake, which reads that;
+ * KEDA, which reads how much the intake has yet to; the webhook intake, which writes each
+ * environment's Telegram updates to it; and main's environment's (MAIN_ENVIRONMENT_PRINCIPALS).
+ */
+export const LOG_PRINCIPALS = ["gateway", "intake", "scaler", "webhook", ...MAIN_ENVIRONMENT_PRINCIPALS];
 function hexId() {
     return randomUUID().replaceAll("-", "");
 }
 function secret() {
     return randomBytes(24).toString("base64url");
 }
+/**
+ * A KRaft cluster's id, as Kafka makes one (Uuid.randomUuid): 16 random bytes, in base64url,
+ * never beginning with "-", which kafka-storage's command line takes for an option, so that a
+ * node formatted with it fails to start.
+ */
+export function clusterId() {
+    for (;;) {
+        const id = randomBytes(16).toString("base64url");
+        if (!id.startsWith("-"))
+            return id;
+    }
+}
 /**
  * The stack's secrets, `existing` completed: made on first run and then only added to,
  * never rotated. Each secret has a maker, and any absent is filled in, so a deployment
@@ -30,6 +72,14 @@ export function completeSecrets(existing = {}) {
     };
     // A secret already held keeps its place; one made is added after them, in this order.
     const s3 = kept(stored.s3, () => ({}));
+    const verifiers = kept(stored.verifiers, () => ({}));
+    const passwords = {
+        alasioPassword: kept(stored.alasioPassword, () => secret()),
+        lakePassword: kept(stored.lakePassword, () => secret()),
+        lakeReaderPassword: kept(stored.lakeReaderPassword, () => secret()),
+        grafanaPassword: kept(stored.grafanaPassword, () => secret()),
+    };
+    const log = kept(stored.log, () => ({}));
     const secrets = {
         ...stored,
         tenantId: kept(stored.tenantId, () => hexId()),
@@ -38,24 +88,42 @@ export function completeSecrets(existing = {}) {
             ...s3,
             neon: kept(s3.neon, () => ({ accessKey: `neon${hexId().slice(0, 12)}`, secretKey: secret() })),
             admin: kept(s3.admin, () => ({ accessKey: `admin${hexId().slice(0, 12)}`, secretKey: secret() })),
+            backups: kept(s3.backups, () => ({ accessKey: `backups${hexId().slice(0, 12)}`, secretKey: secret() })),
             lake: kept(s3.lake, () => ({ accessKey: `lake${hexId().slice(0, 12)}`, secretKey: secret() })),
             lakeReader: kept(s3.lakeReader, () => ({ accessKey: `lakereader${hexId().slice(0, 12)}`, secretKey: secret() })),
             workspaces: kept(s3.workspaces, () => ({ accessKey: `workspaces${hexId().slice(0, 12)}`, secretKey: secret() })),
+            snapshots: kept(s3.snapshots, () => ({ accessKey: `snapshots${hexId().slice(0, 12)}`, secretKey: secret() })),
         },
         controllerDbPassword: kept(stored.controllerDbPassword, () => secret()),
-        alasioPassword: kept(stored.alasioPassword, () => secret()),
-        lakePassword: kept(stored.lakePassword, () => secret()),
+        alasioPassword: passwords.alasioPassword,
+        lakePassword: passwords.lakePassword,
         computeControlToken: kept(stored.computeControlToken, () => secret()),
         valkeyPassword: kept(stored.valkeyPassword, () => secret()),
-        lakeReaderPassword: kept(stored.lakeReaderPassword, () => secret()),
+        lakeReaderPassword: passwords.lakeReaderPassword,
         lakeQueryToken: kept(stored.lakeQueryToken, () => secret()),
-        grafanaPassword: kept(stored.grafanaPassword, () => secret()),
+        grafanaPassword: passwords.grafanaPassword,
         grafanaAdminPassword: kept(stored.grafanaAdminPassword, () => secret()),
         grafanaSecretKey: kept(stored.grafanaSecretKey, () => secret()),
         branchForkKey: kept(stored.branchForkKey, () => secret()),
         filerStoreFilerPassword: kept(stored.filerStoreFilerPassword, () => secret()),
         filerStoreCollectorPassword: kept(stored.filerStoreCollectorPassword, () => secret()),
         filerStoreBackupPassword: kept(stored.filerStoreBackupPassword, () => secret()),
+        monitorKey: kept(stored.monitorKey, () => secret()),
+        // Each of its password above, whether that was kept or made now.
+        verifiers: {
+            ...verifiers,
+            [ROLE]: kept(verifiers[ROLE], () => scramVerifier(passwords.alasioPassword)),
+            [LAKE_ROLE]: kept(verifiers[LAKE_ROLE], () => scramVerifier(passwords.lakePassword)),
+            [LAKE_READER_ROLE]: kept(verifiers[LAKE_READER_ROLE], () => scramVerifier(passwords.lakeReaderPassword)),
+            [GRAFANA_ROLE]: kept(verifiers[GRAFANA_ROLE], () => scramVerifier(passwords.grafanaPassword)),
+        },
+        nodeAgentToken: kept(stored.nodeAgentToken, () => secret()),
+        logClusterId: kept(stored.logClusterId, () => clusterId()),
+        log: {
+            ...log,
+            admin: kept(log.admin, () => secret()),
+            ...Object.fromEntries(LOG_PRINCIPALS.map((principal) => [principal, kept(log[principal], () => secret())])),
+        },
     };
     return { secrets, changed };
 }
@@ -67,22 +135,32 @@ export function remoteStorage(prefix, { endpoint, bucket, region = "us-east-1" }
     return `{ endpoint="${endpoint}", bucket_name="${bucket}", bucket_region="${region}", prefix_in_bucket="${prefix}" }`;
 }
 /**
- * SeaweedFS's S3 identities: Neon, the lake and, when it is on, workspace storage, each
- * on their own bucket of `buckets`; the lake's reader, which may only read the lake's;
- * and an admin, which makes the buckets and keeps the backups.
+ * SeaweedFS's S3 identities: Neon, the lake, workspace storage when it is on and the
+ * snapshots' when sandboxes are snapshotted, each on their own bucket of `buckets`; the
+ * lake's reader, which may only read the lake's; the backups', which writes the backups'
+ * bucket and reads the workspaces' metadata it backs up; and an admin of Neon's bucket
+ * alone, which gives it its lifecycle rules. The snapshots' identity is its bucket's admin,
+ * giving it its rules itself: what may write that bucket writes the images the node agents
+ * restore as root, so nothing else may.
  */
 export function s3Identities(secrets, buckets) {
     const on = (name) => [`Read:${name}`, `List:${name}`, `Tagging:${name}`, `Write:${name}`];
     return {
         identities: [
             { name: "neon", credentials: [secrets.s3.neon], actions: on(buckets.neon) },
-            { name: "admin", credentials: [secrets.s3.admin], actions: ["Admin", "Read", "List", "Tagging", "Write"] },
+            { name: "admin", credentials: [secrets.s3.admin], actions: [`Admin:${buckets.neon}`] },
+            {
+                name: "backups",
+                credentials: [secrets.s3.backups],
+                actions: [...on(buckets.backups), ...(buckets.workspaces === null ? [] : [`Read:${buckets.workspaces}`, `List:${buckets.workspaces}`])],
+            },
             // Branch environments' lakes are given it too: a branch's lake reads main's files where they are (DuckLake keeps
             // every file's path relative to one data path) and writes beside them, and SeaweedFS's Write, which writing
             // needs, deletes as well, so it cannot be narrowed to a branch's own files (cli/src/branches.ts).
             { name: "lake", credentials: [secrets.s3.lake], actions: on(buckets.lake) },
             { name: "lakeReader", credentials: [secrets.s3.lakeReader], actions: [`Read:${buckets.lake}`, `List:${buckets.lake}`] },
             ...(buckets.workspaces === null ? [] : [{ name: "workspaces", credentials: [secrets.s3.workspaces], actions: on(buckets.workspaces) }]),
+            ...(buckets.snapshots === null ? [] : [{ name: "snapshots", credentials: [secrets.s3.snapshots], actions: [...on(buckets.snapshots), `Admin:${buckets.snapshots}`] }]),
         ],
     };
 }
@@ -110,7 +188,7 @@ export function pageserverToml({ brokerUrl, controllerUrl, token, publicKeyPath,
         `pg_distrib_dir=${toml("/usr/local/")}`,
         `listen_pg_addr=${toml("0.0.0.0:6400")}`,
         `listen_http_addr=${toml("0.0.0.0:9898")}`,
-        `availability_zone=${toml("az-pageserver")}`,
+        `availability_zone=${toml(PAGESERVER_ZONE)}`,
         `control_plane_api=${toml(`${controllerUrl}/upcall/v1/`)}`,
         `control_plane_api_token=${toml(token)}`,
         `http_auth_type='NeonJWT'`,
@@ -121,8 +199,4 @@ export function pageserverToml({ brokerUrl, controllerUrl, token, publicKeyPath,
         "",
     ].join("\n");
 }
-/** How the storage controller and computes reach the pageserver at `host`; it registers itself with these. */
-export function pageserverMetadata(host) {
-    return JSON.stringify({ host, port: 6400, http_host: host, http_port: 9898, availability_zone_id: "az-pageserver" }) + "\n";
-}
 //# sourceMappingURL=secrets.js.map

package/dist/neon/control/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../../neon/control/secrets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC;AA0E7B,SAAS,KAAK;IACZ,OAAO,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAkB,EAAE;IAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,CAAI,KAAoB,EAAE,IAAa,EAAK,EAAE;QACzD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,sFAAsF;IACtF,MAAM,EAAE,GAA+C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAiB;QAC5B,GAAG,MAAM;QACT,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QAC9C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QAClD,EAAE,EAAE;YACF,GAAG,EAAE;YACL,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9F,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9F,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAChH,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;SACjH;QACD,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvD,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACrE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACnE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC7D,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC/D,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACzD,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC7E,2BAA2B,EAAE,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACrF,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;KAChF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,EAAyB;IAC7G,OAAO,eAAe,QAAQ,mBAAmB,MAAM,qBAAqB,MAAM,wBAAwB,MAAM,KAAK,CAAC;AACxH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAqB,EAAE,OAAgB;IAClE,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,QAAQ,IAAI,EAAE,EAAE,WAAW,IAAI,EAAE,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAClG,OAAO;QACL,UAAU,EAAE;YACV,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;YAC1G,iHAAiH;YACjH,4GAA4G;YAC5G,kGAAkG;YAClG,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC3E,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE;YACvH,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;SACjJ;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AAEzE;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAoB;IAC1G,OAAO;QACL,mBAAmB,IAAI,CAAC,SAAS,CAAC,EAAE;QACpC,kBAAkB,IAAI,CAAC,aAAa,CAAC,EAAE;QACvC,kBAAkB,IAAI,CAAC,cAAc,CAAC,EAAE;QACxC,oBAAoB,IAAI,CAAC,cAAc,CAAC,EAAE;QAC1C,qBAAqB,IAAI,CAAC,eAAe,CAAC,EAAE;QAC5C,qBAAqB,IAAI,CAAC,GAAG,aAAa,aAAa,CAAC,EAAE;QAC1D,2BAA2B,IAAI,CAAC,KAAK,CAAC,EAAE;QACxC,0BAA0B;QAC1B,wBAAwB;QACxB,mCAAmC,IAAI,CAAC,aAAa,CAAC,EAAE;QACxD,kBAAkB,OAAO,EAAE;QAC3B,6CAA6C,cAAc,CAAC,WAAW,qBAAqB,cAAc,CAAC,aAAa,IAAI;QAC5H,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC;AAC9H,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../../neon/control/secrets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAC/C,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC;AAC7B,mEAAmE;AACnE,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAChC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAC9C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC;AACtC,0GAA0G;AAC1G,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,CAAU,CAAC;AAUvF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,aAAa,EAAE,aAAa,CAAU,CAAC;AAGnF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,2BAA2B,CAAU,CAAC;AAgGlH,SAAS,KAAK;IACZ,OAAO,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS;IACvB,SAAS,CAAC;QACR,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAkB,EAAE;IAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,CAAI,KAAoB,EAAE,IAAa,EAAK,EAAE;QACzD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,sFAAsF;IACtF,MAAM,EAAE,GAA+C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,SAAS,GAAwC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG;QAChB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACnE,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;KAC9D,CAAC;IACF,MAAM,GAAG,GAAiC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAiB;QAC5B,GAAG,MAAM;QACT,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QAC9C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QAClD,EAAE,EAAE;YACF,GAAG,EAAE;YACL,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9F,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACvG,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9F,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAChH,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAChH,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;SAC9G;QACD,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvE,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACrE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACvE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC/D,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACzD,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC7E,2BAA2B,EAAE,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACrF,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC/E,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QACnD,iEAAiE;QACjE,SAAS,EAAE;YACT,GAAG,SAAS;YACZ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YAC5E,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACpF,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACxG,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;SAC9F;QACD,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;QAC1D,GAAG,EAAE;YACH,GAAG,GAAG;YACN,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;YACtC,GAAG,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAiC;SAC5I;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,EAAyB;IAC7G,OAAO,eAAe,QAAQ,mBAAmB,MAAM,qBAAqB,MAAM,wBAAwB,MAAM,KAAK,CAAC;AACxH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAqB,EAAE,OAAgB;IAClE,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,QAAQ,IAAI,EAAE,EAAE,WAAW,IAAI,EAAE,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAClG,OAAO;QACL,UAAU,EAAE;YACV,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,SAAS,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE;YACtF;gBACE,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC;gBACjC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,UAAU,EAAE,EAAE,QAAQ,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;aACxI;YACD,iHAAiH;YACjH,4GAA4G;YAC5G,kGAAkG;YAClG,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC3E,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE;YACvH,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChJ,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;SAChL;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AAEzE;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAoB;IAC1G,OAAO;QACL,mBAAmB,IAAI,CAAC,SAAS,CAAC,EAAE;QACpC,kBAAkB,IAAI,CAAC,aAAa,CAAC,EAAE;QACvC,kBAAkB,IAAI,CAAC,cAAc,CAAC,EAAE;QACxC,oBAAoB,IAAI,CAAC,cAAc,CAAC,EAAE;QAC1C,qBAAqB,IAAI,CAAC,eAAe,CAAC,EAAE;QAC5C,qBAAqB,IAAI,CAAC,GAAG,aAAa,aAAa,CAAC,EAAE;QAC1D,2BAA2B,IAAI,CAAC,KAAK,CAAC,EAAE;QACxC,0BAA0B;QAC1B,wBAAwB;QACxB,mCAAmC,IAAI,CAAC,aAAa,CAAC,EAAE;QACxD,kBAAkB,OAAO,EAAE;QAC3B,6CAA6C,cAAc,CAAC,WAAW,qBAAqB,cAAc,CAAC,aAAa,IAAI;QAC5H,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/src/kube/config.js

@@ -5,7 +5,8 @@
  *
  *     {
  *       "sessions": { "namespace", "port", "workspaceDir", "egressGate", "fullModeNameservers",
- *                     "mountPodNamespace", "podTemplate", "volumeClaimTemplates", "clone" },
+ *                     "mountPodNamespace", "podTemplate", "volumeClaimTemplates", "clone",
+ *                     "snapshots" },
  *       "host":     { "namespace", "port", "stateRoot", "podTemplate" }
  *     }
  *
@@ -53,6 +54,22 @@ const Clone = said(Schema.Struct({
 }), "must be an object");
 /** The variables a clone's Job is given, after its own, in this order (src/sandbox/index.ts). */
 export const CLONE_VARIABLES = ["SOURCE_NAMESPACE", "SOURCE_CLAIM", "DESTINATION_NAMESPACE", "DESTINATION_CLAIM"];
+const Count = said(Schema.Number.check(Schema.isInt({ message: "must be a whole number" }), Schema.isGreaterThan(0, { message: "must be positive" })), "must be a positive whole number");
+/**
+ * Session sandboxes' whole-sandbox snapshots (../sandbox/snapshots.ts): how long a session
+ * runs no exec and no turn before its Sandbox is snapshotted and released; how often one
+ * whose execs run is snapshotted live, running on; the gVisor
+ * releases a snapshot is restored under, each by its RuntimeClass, the current one first;
+ * and where the node agents that take and prepare the snapshots are, by their pods'
+ * namespace and labels, and the port they serve on.
+ */
+const Snapshots = said(Schema.Struct({
+    releaseAfterSeconds: Count,
+    liveEverySeconds: Count,
+    releases: said(Schema.Array(Schema.Struct({ release: said(Schema.NonEmptyString, "must be a release"), runtimeClassName: said(Schema.NonEmptyString, "must be a RuntimeClass's name") }))
+        .check(Schema.isMinLength(1, { message: "must name a release" })), "must be a list of releases"),
+    agents: said(Schema.Struct({ namespace: Namespace, selector: said(Schema.NonEmptyString, "must be a label selector"), port: Port }), "must be an object"),
+}), "must be an object");
 /** Whether `podTemplate`, as the installation gives it, runs a container named `bayma`. */
 function runsBayma(podTemplate) {
     const containers = Predicate.hasProperty(podTemplate, "spec") && Predicate.hasProperty(podTemplate.spec, "containers")
@@ -81,6 +98,8 @@ const SessionsProfile = said(Schema.Struct({
     volumeClaimTemplates: Schema.optional(VolumeClaimTemplates),
     /** How a session's volume is cloned, where its storage can; none where it cannot, and sessions are not forked. */
     clone: Schema.optional(Schema.NullOr(Clone)),
+    /** How sessions' Sandboxes are snapshotted as they are released, where they are; none where they are not. */
+    snapshots: Schema.optional(Schema.NullOr(Snapshots)),
 }), "must be an object").check(Schema.makeFilter((profile) => (runsBayma(profile.podTemplate) ? undefined : baymaIssue)));
 /** The template of folder workspaces' bayma (hostProfile in cli/src/manifests/alasio.ts). */
 const HostProfile = said(Schema.Struct({
@@ -90,8 +109,13 @@ const HostProfile = said(Schema.Struct({
 }), "must be an object").check(Schema.makeFilter((profile) => (runsBayma(profile.podTemplate) ? undefined : baymaIssue)));
 /** A profile the deployment may leave out, which is then null. */
 const optionalProfile = (schema) => said(Schema.NullOr(schema), "must be an object").pipe(Schema.withDecodingDefaultKey(Effect.succeed(null)));
-/** ALASIO_KUBE_TEMPLATES, checked: a profile the deployment does not render is null. */
-const KubeTemplates = said(Schema.Struct({ sessions: optionalProfile(SessionsProfile), host: optionalProfile(HostProfile) }), "must be an object");
+/**
+ * ALASIO_KUBE_TEMPLATES, checked: a profile the deployment does not render is null; and
+ * the sessions' profile before the current one, as `alasio up` carries it forward until
+ * their template changes again, which sessions' snapshots may restore onto
+ * (../sandbox/snapshots.ts), null where there is none.
+ */
+const KubeTemplates = said(Schema.Struct({ sessions: optionalProfile(SessionsProfile), previousSessions: optionalProfile(SessionsProfile), host: optionalProfile(HostProfile) }), "must be an object");
 const formatIssue = SchemaIssue.makeFormatterStandardSchemaV1();
 /** The first thing wrong with the templates, as alasio says it: the key's path, then what it must be. */
 function describe(issue) {

package/dist/src/kube/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/kube/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,0GAA0G;AAC1G,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAAC,oBAAoB,EAAE;IACrG,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,MAAM,SAAS,GAAG,uCAAuC,CAAC;AAE1D;;;GAGG;AACH,MAAM,IAAI,GAAG,CAAuB,MAAS,EAAE,OAAe,EAAgB,EAAE,CAC9E,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;AAE3E,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,CACpB,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;KAChJ,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC,EAC9E,0BAA0B,CAC3B,CAAC;AAEF,MAAM,IAAI,GAAG,IAAI,CACf,MAAM,CAAC,MAAM,CAAC,KAAK,CACjB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAClD,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CACvF,EACD,uBAAuB,CACxB,CAAC;AAEF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAA8B,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAClI,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAClD,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAoC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EACpG,0CAA0C,CAC3C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,IAAI,CAChB,MAAM,CAAC,MAAM,CAAC;IACZ,sFAAsF;IACtF,aAAa,EAAE,IAAI,CACjB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,yBAAyB,kBAAkB,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,EACrH,2DAA2D,kBAAkB,aAAa,CAC3F;IACD,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAkB,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC;CACrG,CAAC,EACF,mBAAmB,CACpB,CAAC;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,kBAAkB,EAAE,cAAc,EAAE,uBAAuB,EAAE,mBAAmB,CAAU,CAAC;AAE3H,2FAA2F;AAC3F,SAAS,SAAS,CAAC,WAAoB;IACrC,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC;QACpH,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU;QAC7B,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAkB,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AACtJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AAEtF,+DAA+D;AAC/D,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;AAE5G,uGAAuG;AACvG,MAAM,eAAe,GAAG,IAAI,CAC1B,MAAM,CAAC,MAAM,CAAC;IACZ,GAAG,cAAc;IACjB,6DAA6D;IAC7D,YAAY,EAAE,IAAI;IAClB,uGAAuG;IACvG,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACzF,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IACrH;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAC3D,kHAAkH;IAClH,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;CAC7C,CAAC,EACF,mBAAmB,CACpB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAEnG,6FAA6F;AAC7F,MAAM,WAAW,GAAG,IAAI,CACtB,MAAM,CAAC,MAAM,CAAC;IACZ,GAAG,cAAc;IACjB,uFAAuF;IACvF,SAAS,EAAE,IAAI;CAChB,CAAC,EACF,mBAAmB,CACpB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAEnG,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAuB,MAAS,EAAE,EAAE,CAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE7G,wFAAwF;AACxF,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAMnJ,MAAM,WAAW,GAAG,WAAW,CAAC,6BAA6B,EAAE,CAAC;AAEhE,yGAAyG;AACzG,SAAS,QAAQ,CAAC,KAAwB;IACxC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAClI,OAAO,CAAC,uBAAuB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,4BAA4B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,IAAY,EAAoD,EAAE,CAClH,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAY,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACpC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,yBAAyB,IAAI,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;CACvK,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAC1I,CACF,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1H,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjG,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC,CAAC;IAC1I,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QACrC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,yBAAyB,IAAI,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;KACvK,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/kube/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,0GAA0G;AAC1G,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAAC,oBAAoB,EAAE;IACrG,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,MAAM,SAAS,GAAG,uCAAuC,CAAC;AAE1D;;;GAGG;AACH,MAAM,IAAI,GAAG,CAAuB,MAAS,EAAE,OAAe,EAAgB,EAAE,CAC9E,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;AAE3E,8EAA8E;AAC9E,MAAM,SAAS,GAAG,IAAI,CACpB,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;KAChJ,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC,EAC9E,0BAA0B,CAC3B,CAAC;AAEF,MAAM,IAAI,GAAG,IAAI,CACf,MAAM,CAAC,MAAM,CAAC,KAAK,CACjB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAClD,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CACvF,EACD,uBAAuB,CACxB,CAAC;AAEF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAA8B,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAClI,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAClD,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAoC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EACpG,0CAA0C,CAC3C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,IAAI,CAChB,MAAM,CAAC,MAAM,CAAC;IACZ,sFAAsF;IACtF,aAAa,EAAE,IAAI,CACjB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,yBAAyB,kBAAkB,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,EACrH,2DAA2D,kBAAkB,aAAa,CAC3F;IACD,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAkB,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC;CACrG,CAAC,EACF,mBAAmB,CACpB,CAAC;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,kBAAkB,EAAE,cAAc,EAAE,uBAAuB,EAAE,mBAAmB,CAAU,CAAC;AAE3H,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;AAE1L;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,CACpB,MAAM,CAAC,MAAM,CAAC;IACZ,mBAAmB,EAAE,KAAK;IAC1B,gBAAgB,EAAE,KAAK;IACvB,QAAQ,EAAE,IAAI,CACZ,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,+BAA+B,CAAC,EAAE,CAAC,CAAC;SACvK,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC,EACnE,4BAA4B,CAC7B;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,mBAAmB,CAAC;CAC1J,CAAC,EACF,mBAAmB,CACpB,CAAC;AAEF,2FAA2F;AAC3F,SAAS,SAAS,CAAC,WAAoB;IACrC,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC;QACpH,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU;QAC7B,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAkB,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AACtJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AAEtF,+DAA+D;AAC/D,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;AAE5G,uGAAuG;AACvG,MAAM,eAAe,GAAG,IAAI,CAC1B,MAAM,CAAC,MAAM,CAAC;IACZ,GAAG,cAAc;IACjB,6DAA6D;IAC7D,YAAY,EAAE,IAAI;IAClB,uGAAuG;IACvG,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACzF,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IACrH;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAC3D,kHAAkH;IAClH,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,6GAA6G;IAC7G,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;CACrD,CAAC,EACF,mBAAmB,CACpB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAEnG,6FAA6F;AAC7F,MAAM,WAAW,GAAG,IAAI,CACtB,MAAM,CAAC,MAAM,CAAC;IACZ,GAAG,cAAc;IACjB,uFAAuF;IACvF,SAAS,EAAE,IAAI;CAChB,CAAC,EACF,mBAAmB,CACpB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAEnG,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAuB,MAAS,EAAE,EAAE,CAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE7G;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,eAAe,CAAC,EAAE,gBAAgB,EAAE,eAAe,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,EACrJ,mBAAmB,CACpB,CAAC;AAMF,MAAM,WAAW,GAAG,WAAW,CAAC,6BAA6B,EAAE,CAAC;AAEhE,yGAAyG;AACzG,SAAS,QAAQ,CAAC,KAAwB;IACxC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAClI,OAAO,CAAC,uBAAuB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,4BAA4B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,IAAY,EAAoD,EAAE,CAClH,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAY,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACpC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,yBAAyB,IAAI,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;CACvK,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAC1I,CACF,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1H,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjG,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC,CAAC;IAC1I,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QACrC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,yBAAyB,IAAI,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;KACvK,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC"}

package/dist/src/kube/sandbox-shape.js

@@ -14,8 +14,12 @@ export const TOKEN_KEY = "token";
 export const TOKEN_VOLUME = "alasio-bayma-token";
 /** The token volume's files' mode: readable by the pod's group, which is how a non-root bayma reads it. */
 export const TOKEN_MODE = 0o440;
+/** The file bayma reads its token from, which a restored Sandbox's new token replaces. */
+export const TOKEN_FILE = `${TOKEN_DIR}/${TOKEN_KEY}`;
 /** The arguments bayma is given after its template's: where its token is. */
-export const TOKEN_FILE_ARGS = ["--token-file", `${TOKEN_DIR}/${TOKEN_KEY}`];
+export const TOKEN_FILE_ARGS = ["--token-file", TOKEN_FILE];
+/** The arguments a session's bayma is given after those when it exports telemetry: the token it exports with, read from the same file for each export. */
+export const TELEMETRY_TOKEN_FILE_ARGS = ["--telemetry-token-file", TOKEN_FILE];
 /** The name of a Sandbox's token Secret. */
 export function tokenSecretName(name) {
     return `${name}-bayma-token`;
@@ -29,16 +33,58 @@ export const WORKLOAD_LABEL = "alasio.dev/workload";
 export const NET_MODE_LABEL = "alasio.dev/net-mode";
 /** The harness a folder's bayma serves, as a path segment. */
 export const HARNESS_LABEL = "alasio.dev/harness";
-/** The token's environment variable in a session's bayma container, which its OTLP headers expand. */
-export const TOKEN_ENV = "ALASIO_SANDBOX_TOKEN";
 /** The resolvers a session with internet uses unless its template names others. */
 export const DEFAULT_FULL_MODE_NAMESERVERS = ["1.1.1.1", "8.8.8.8"];
 /** The argument a folder's bayma is given its state directory by, under its template's state root. */
 export const STATE_DIR_ARG = "--state-dir";
+/**
+ * The argument a session's bayma is given how long it holds a stop by, for alasio to
+ * snapshot it first (bayma's mcp-http help): a bayma run without it holds none.
+ */
+export const STOP_WAIT_ARG = "--stop-wait-ms";
+/** How long a session's bayma takes to stop once it holds its stop no more: it persists its sessions. */
+export const BAYMA_STOP_SECONDS = 30;
 /** A path segment from `value`: never empty, nor starting with a dot. */
 export function sanitizePathToken(value) {
     return String(value).replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/^[-.]+|-+$/g, "") || "default";
 }
+/**
+ * What a session's pod template carries of its whole-sandbox snapshots
+ * (../sandbox/snapshots.ts): the hash of the template it was made from, which its
+ * snapshots record; the CPU features its sandbox is held to; and, of a pod restored from
+ * a snapshot, the image it is restored from, on its node under the snapshot cache, left
+ * paused until its node's agent resumes it, which its readiness gate waits for.
+ */
+export const SESSION_TEMPLATE_ANNOTATION = "alasio.dev/session-template";
+/** gVisor's annotation that holds a sandbox to the CPU features it names, of those its node has. */
+export const CPU_FEATURES_ANNOTATION = "dev.gvisor.internal.cpufeatures";
+/** The annotation alasio's fork of gVisor restores a pod's sandbox from, naming the image on the node. */
+export const RESTORE_ANNOTATION = "dev.gvisor.internal.restore.host-image-path";
+/** The fork's annotation that leaves a restored sandbox paused, running nothing, until it is resumed. */
+export const RESTORE_PAUSED_ANNOTATION = "dev.gvisor.internal.restore.paused";
+/** The condition of a restored pod's readiness gate, which alasio sets once its sandbox is resumed. */
+export const RESUMED_CONDITION = "alasio.dev/resumed";
+/**
+ * The annotation of a suspended Sandbox naming the snapshot its pod was saved into, which
+ * alone it may be restored from: set as it is suspended, removed as it is next resumed,
+ * from that snapshot or not, so a snapshot outlives no resume of its Sandbox's.
+ */
+export const SNAPSHOT_ANNOTATION = "alasio.dev/snapshot";
+/**
+ * The annotation naming the gVisor release that took the snapshot SNAPSHOT_ANNOTATION
+ * names, beside it, the only one that restores it: `alasio up` keeps every release one
+ * names (cli/src/kept-releases.ts).
+ */
+export const SNAPSHOT_RELEASE_ANNOTATION = "alasio.dev/snapshot-release";
+/** Where a node agent keeps the snapshots it prepares, as `<environment>/<workspace>/<snapshot>` (../node-agent/cache.ts). */
+export const SNAPSHOT_CACHE_DIR = "/var/lib/alasio/snapshots";
+/**
+ * A snapshot's id, as a node agent names it: when it was taken, to the millisecond, so a
+ * workspace's ids sort as its snapshots were taken, then 32 random bits.
+ */
+export const SNAPSHOT_ID = "[0-9]{8}T[0-9]{9}Z-[0-9a-f]{8}";
+/** A DNS label: an environment's name (its sessions' namespace) and a workspace's (its Sandbox's), as the snapshot cache's directories are named. */
+export const NAME = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/u;
 /** The init container that holds a session's pod until its egress is confined: its name, and its resources. */
 export const EGRESS_GATE = { name: "egress-gate", resources: { requests: { cpu: "10m", memory: "32Mi" }, limits: { memory: "64Mi" } } };
 /**

package/dist/src/kube/sandbox-shape.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-shape.js","sourceRoot":"","sources":["../../../../src/kube/sandbox-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,iGAAiG;AACjG,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAC7C,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,cAAc,EAAE,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;AAEhG,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,GAAG,IAAI,cAAc,CAAC;AAC/B,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,8BAA8B,EAAE,QAAQ,EAAW,CAAC;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,sGAAsG;AACtG,MAAM,CAAC,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEhD,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEvF,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AACjG,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAW,CAAC;AAEjJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,kCAAkC;IAClC,uGAAuG;IACvG,wDAAwD;IACxD,qBAAqB;IACrB,8DAA8D;IAC9D,sFAAsF;IACtF,wCAAwC;IACxC,0IAA0I;IAC1I,gCAAgC;IAChC,gIAAgI;IAChI,OAAO;CACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"sandbox-shape.js","sourceRoot":"","sources":["../../../../src/kube/sandbox-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,iGAAiG;AACjG,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAC7C,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AAChC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;AAEtD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAC/E,0JAA0J;AAC1J,MAAM,CAAC,MAAM,yBAAyB,GAAsB,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC;AAEnG,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,GAAG,IAAI,cAAc,CAAC;AAC/B,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,8BAA8B,EAAE,QAAQ,EAAW,CAAC;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEvF,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE9C,yGAAyG;AACzG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AACzE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAChF,yGAAyG;AACzG,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAC9E,uGAAuG;AACvG,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AACzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,8HAA8H;AAC9H,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,gCAAgC,CAAC;AAC5D,qJAAqJ;AACrJ,MAAM,CAAC,MAAM,IAAI,GAAG,uCAAuC,CAAC;AAE5D,+GAA+G;AAC/G,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAW,CAAC;AAEjJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,kCAAkC;IAClC,uGAAuG;IACvG,wDAAwD;IACxD,qBAAqB;IACrB,8DAA8D;IAC9D,sFAAsF;IACtF,wCAAwC;IACxC,0IAA0I;IAC1I,gCAAgC;IAChC,gIAAgI;IAChI,OAAO;CACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}

package/dist/src/node-agent/names.js

@@ -0,0 +1,140 @@
+/**
+ * Where a node keeps its gVisor releases, containerd's runtimes of them and its
+ * snapshots, where its node agent serves, and the memory the agent needs: as the agent
+ * reads them, the clusters alasio makes lay them out (cli/src/cluster/), and the
+ * installation's manifests give them to the agent (cli/src/manifests/node-agent.ts). Free
+ * of any import but sandbox-shape's, itself free of any, so the command line takes it
+ * without the agent.
+ */
+/** The port a node agent serves its API on, on its pod's address. */
+export const NODE_AGENT_PORT = 8484;
+/**
+ * The port a node agent serves the snapshots bucket on, to its node's restores, on its
+ * pod's address (../node-agent/store-proxy.ts): no network policy admits it, so the node
+ * alone reaches it, as a node reaches the pods it runs.
+ */
+export const STORE_PROXY_PORT = 8485;
+/** The variable that gives a node agent its pod's address, which it serves the bucket to its node on. */
+export const POD_IP_VARIABLE = "POD_IP";
+/**
+ * Where a node keeps the gVisor releases alasio keeps, each in a directory of its own
+ * named after it, as its release archive has them: runsc, its shim, and gvisor-bin/, the
+ * binaries runsc runs beside it.
+ */
+export const GVISOR_RELEASES = "/usr/local/lib/alasio/gvisor";
+/** The directory of gVisor's `release` on a node. */
+export const gvisorDirectory = (release) => `${GVISOR_RELEASES}/${release}`;
+/**
+ * Whether gVisor's `release` restores a sandbox straight from the bucket, its images read
+ * through the checkpoint gofer as the restore goes: one of the fork's at or past `since`,
+ * the first release that does, as cluster/node/pins.json says it (restoresFromBucketSince)
+ * and the installation gives the node agent it (RESTORES_FROM_BUCKET_SINCE_VARIABLE), by
+ * its base's date and patch, then its own number. One before it, as the fork's
+ * 20260921.0-eaucoin.6, which ends the sandbox as it tries (`urpc method
+ * "containerManager.Restore" failed: EOF`), is fetched into the node's cache first and
+ * restored from there; so is one that names no release of the fork's, and every release
+ * where `since` names none.
+ */
+export function restoresFromBucket(release, since) {
+    const parts = (named) => {
+        const matched = /^(\d{8})\.(\d+)-eaucoin\.(\d+)$/u.exec(named);
+        return matched ? matched.slice(1).map(Number) : null;
+    };
+    const [of, first] = [parts(release), parts(since)];
+    if (of === null || first === null)
+        return false;
+    const differs = of.findIndex((part, index) => part !== first[index]);
+    return differs === -1 || (of[differs] ?? 0) > (first[differs] ?? 0);
+}
+/** The variable that gives the node agent the first gVisor release that restores straight from the bucket (restoresFromBucket). */
+export const RESTORES_FROM_BUCKET_SINCE_VARIABLE = "ALASIO_GVISOR_RESTORES_FROM_BUCKET_SINCE";
+/** Where k3s's containerd reads its template, and runsc its options. */
+export const CONTAINERD = "/var/lib/rancher/k3s/agent/etc/containerd";
+/** gVisor's `release` as a DNS label, which containerd's runtimes and Kubernetes' RuntimeClasses are named with: its dots made dashes. */
+export const gvisorLabel = (release) => release.replaceAll(".", "-");
+/**
+ * The containerd runtime of gVisor's `release`, which a RuntimeClass names as its
+ * handler, and whose runsc options are `<CONTAINERD>/<runtime>.toml`.
+ */
+export const gvisorHandler = (release) => `runsc-${gvisorLabel(release)}`;
+/** The RuntimeClass of gVisor's `release` alone, which a sandbox snapshotted under it is restored with. */
+export const gvisorRuntimeClass = (release) => `gvisor-${gvisorLabel(release)}`;
+/** The version runsc of gVisor's `release` reports, and saves its images with: its release's tag. */
+export const runscVersion = (release) => `release-${release}`;
+/** The root the gVisor shims run runsc with for Kubernetes' containers, under the node's /run. */
+export const RUNSC_ROOT = "/run/containerd/runsc/k8s.io";
+/** The node's snapshot cache, where its sandboxes are restored from, as the admission policy holds a restore to. */
+export { SNAPSHOT_CACHE_DIR } from "../kube/sandbox-shape.js";
+/**
+ * The node agent's container that says, as its pod starts, the CPU features its node has
+ * under the current gVisor release (./cpu-features.ts), as its termination message, which
+ * Kubernetes keeps up to 4 KiB of: a CpuFeaturesReport, as JSON.
+ */
+export const CPU_FEATURES_CONTAINER = "cpu-features";
+/** A part of a snapshot file the node agent puts or gets (./s3.ts): 32 MiB, as large as S3's 10000 parts make an object of 312 GiB. */
+export const SNAPSHOT_PART_BYTES = 32 * 1024 ** 2;
+/** How many parts of a snapshot file the node agent puts or gets at a time, and how many gets, of every snapshot it gets. */
+export const SNAPSHOT_PARTS_AT_ONCE = 4;
+/** What a get of the node agent's writes to its file between syncs to the disk: 8 MiB. */
+export const SNAPSHOT_SYNC_BYTES = 8 * 1024 ** 2;
+/**
+ * The node agent's memory budget for what it gets: what it holds written and not yet on
+ * the disk, at most, of every get at a time together (./s3.ts). The kernel counts it in the
+ * agent's memory and cannot reclaim it before it is written, so the agent's memory limit
+ * leaves room for it beside the agent's own; what it reads through the page cache, the
+ * kernel reclaims.
+ */
+export const UNSYNCED_DOWNLOAD_BYTES = SNAPSHOT_PARTS_AT_ONCE * SNAPSHOT_SYNC_BYTES;
+/**
+ * The node agent's own memory: what it was measured to hold restoring a 1 GiB session's
+ * snapshot from the bucket on a node of its own (test/e2e, 125 to 145 MiB anonymous),
+ * rounded up.
+ */
+export const NODE_AGENT_OWN_BYTES = 160 * 1024 ** 2;
+/** The least memory limit a node agent runs under: its own, and a download's budget beside it. */
+export const NODE_AGENT_MEMORY_FLOOR = NODE_AGENT_OWN_BYTES + UNSYNCED_DOWNLOAD_BYTES;
+/** The variable holding the token alasio presents to a node agent. */
+export const NODE_AGENT_TOKEN_VARIABLE = "ALASIO_NODE_AGENT_TOKEN";
+/** The variable holding the most bytes the node's snapshot cache keeps. */
+export const SNAPSHOT_CACHE_BYTES_VARIABLE = "ALASIO_SNAPSHOT_CACHE_BYTES";
+/**
+ * How long a checkpoint, a prepare or a copy may take: a sandbox's memory, through the store,
+ * both ways, or within it. alasio waits for one so long, and an agent that stops lets the
+ * ones it runs end within it (./operations.ts), after its restores' reads (nodeAgentStopSeconds).
+ */
+export const OPERATION_LIMIT_SECONDS = 15 * 60;
+/**
+ * How long a restore from the bucket may take from its prepare to its resume, which its token
+ * lasts unless resumed before (./store-proxy.ts): the longest it takes, alasio waiting 3
+ * minutes for its pod to run (POD_RUNNING_TIMEOUT in src/sandbox/snapshots.ts), then for the
+ * agent's resume, and a margin.
+ */
+export const RESTORE_PREPARED_FOR_SECONDS = 5 * 60;
+/** The variable holding how long, in seconds, a resumed restore from the bucket may read it through the node agent (backgroundReadSeconds). */
+export const BACKGROUND_READ_SECONDS_VARIABLE = "ALASIO_BACKGROUND_READ_SECONDS";
+/**
+ * The slowest a resumed restore is taken to read the rest of its sandbox through the node
+ * agent, in the background: half of what gate 4 measured on a runner's bundled SeaweedFS,
+ * 8.7 MB/s through the agent's proxy from the restore's start to its last read
+ * (program/progress/live-lazy.md).
+ */
+export const BACKGROUND_READ_BYTES_PER_SECOND = 4 * 1024 ** 2;
+/**
+ * How long a resumed restore of a sandbox of at most `memoryBytes` may read the rest of it
+ * through the node agent, at the slowest (BACKGROUND_READ_BYTES_PER_SECOND), in seconds: a
+ * minute at least.
+ */
+export function backgroundReadSeconds(memoryBytes) {
+    return Math.max(60, Math.ceil(memoryBytes / BACKGROUND_READ_BYTES_PER_SECOND));
+}
+/**
+ * How long a node agent that stops may take, its sandboxes of at most `memoryBytes`: the
+ * restores that read the bucket through it done first, the last within its token's time (one
+ * prepared just before the stop taking as long as a restore takes to its resume, then as long
+ * as it takes to read its sandbox whole), then the checkpoints, prepares and copies it runs
+ * (OPERATION_LIMIT_SECONDS).
+ */
+export function nodeAgentStopSeconds(memoryBytes) {
+    return RESTORE_PREPARED_FOR_SECONDS + backgroundReadSeconds(memoryBytes) + OPERATION_LIMIT_SECONDS;
+}
+//# sourceMappingURL=names.js.map

package/dist/src/node-agent/names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/node-agent/names.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAE9D,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,eAAe,IAAI,OAAO,EAAE,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,mIAAmI;AACnI,MAAM,CAAC,MAAM,mCAAmC,GAAG,0CAA0C,CAAC;AAE9F,wEAAwE;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAEtE,0IAA0I;AAC1I,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,SAAS,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAE1F,2GAA2G;AAC3G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAEhG,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,WAAW,OAAO,EAAE,CAAC;AAE9E,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAEzD,oHAAoH;AACpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAQrD,uIAAuI;AACvI,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;AAElD,6HAA6H;AAC7H,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,GAAG,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAEpD,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AAEtF,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,6BAA6B,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,CAAC;AAEnD,+IAA+I;AAC/I,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,gCAAgC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,4BAA4B,GAAG,qBAAqB,CAAC,WAAW,CAAC,GAAG,uBAAuB,CAAC;AACrG,CAAC"}

package/dist/src/telegram/deliveries.js

@@ -0,0 +1,40 @@
+/**
+ * How Telegram's deliveries of a bot's updates to the webhook intake fare, as the bot's
+ * getWebhookInfo says, which is where alone Telegram says a delivery failed: alike for
+ * alasio, which watches its own bot's (./delivery-watch.ts), and for alasio status, which
+ * says each environment's. Free of anything but the language's own, so the command line
+ * takes it without the server.
+ */
+/** How long a failed delivery is a failure now, as Telegram keeps its last error after it delivers again. */
+const LATELY_SECONDS = 600;
+/**
+ * Telegram's errors that say it could not connect to the intake at all, as where the
+ * networks it delivers from are not among install.webhook.sources, which the intake's
+ * NetworkPolicy and a LoadBalancer admit alone: the connection is dropped, and times out,
+ * or refused.
+ */
+const UNREACHABLE = /^(Connection timed out|Connection refused|No route to host|Network is unreachable)\b/u;
+/** Telegram's error that says the name it is told to deliver to resolves to no address. */
+const UNRESOLVED = /^Failed to resolve host\b/u;
+/** The fix Telegram's error `error` points to, null where it points to none. */
+function fixOf(error) {
+    if (UNREACHABLE.test(error)) {
+        return "Telegram cannot connect to it, as where its networks have changed from those install.webhook.sources lists: list Telegram's (core.telegram.org/bots/webhooks) there, and alasio up admits them";
+    }
+    if (UNRESOLVED.test(error))
+        return "Telegram cannot resolve install.webhook.publicAddress: give the name an address, or set the address itself, and alasio up registers each bot with it";
+    return null;
+}
+/**
+ * Whether `deliveries` fail at `now` (milliseconds): updates wait, and Telegram's last
+ * delivery failed lately; null where they do not, as where nothing waits, every update
+ * delivered since.
+ */
+export function failingDeliveries(deliveries, now) {
+    const { pending_update_count: pending, last_error_date: date, last_error_message: error = "no reason given" } = deliveries;
+    if (pending === 0 || date === undefined || now / 1000 - date >= LATELY_SECONDS)
+        return null;
+    const at = new Date(date * 1000).toISOString().replace(/\.\d{3}Z$/u, "Z");
+    return { description: `${pending} update${pending === 1 ? "" : "s"} waiting; Telegram's last delivery failed at ${at}: ${error}`, fix: fixOf(error) };
+}
+//# sourceMappingURL=deliveries.js.map

package/dist/src/telegram/deliveries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliveries.js","sourceRoot":"","sources":["../../../../src/telegram/deliveries.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,6GAA6G;AAC7G,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,WAAW,GAAG,uFAAuF,CAAC;AAE5G,2FAA2F;AAC3F,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAEhD,gFAAgF;AAChF,SAAS,KAAK,CAAC,KAAa;IAC1B,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,gMAAgM,CAAC;IAC1M,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,sJAAsJ,CAAC;IAC1L,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAsB,EAAE,GAAW;IACnE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,GAAG,iBAAiB,EAAE,GAAG,UAAU,CAAC;IAC3H,IAAI,OAAO,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,IAAI,cAAc;QAAE,OAAO,IAAI,CAAC;IAC5F,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC1E,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,gDAAgD,EAAE,KAAK,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AACxJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alasio",
-  "version": "6.0.0",
+  "version": "8.0.0",
   "description": "alasio: coding agents you talk to from Telegram, installed and run with npx alasio",
   "type": "module",
   "license": "MIT",
@@ -14,7 +14,7 @@
     "node": ">=24"
   },
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json && cp ../cluster/node/config-v3.toml.tmpl dist/cluster/node/",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
     "start": "node ./src/main.ts"
   },
   "dependencies": {

package/dist/cluster/node/config-v3.toml.tmpl

@@ -1,12 +0,0 @@
-{{ template "base" . }}
-
-[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runsc]
-  runtime_type = "io.containerd.runsc.v1"
-{{- if .SystemdCgroup }}
-
-# Where systemd runs the machine, kubelet's cgroups are systemd's, and runsc places its
-# sandboxes' through systemd too, as runsc.toml beside this file says.
-[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runsc.options]
-  TypeUrl = "io.containerd.runsc.v1.options"
-  ConfigPath = "/var/lib/rancher/k3s/agent/etc/containerd/runsc.toml"
-{{- end }}