alasio 7.0.0 → 9.0.0

package/dist/src/telemetry/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/telemetry/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAU,CAAC;AAgB9D,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEzC,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;AAEjE,SAAS,OAAO,CAAC,GAAgC,EAAE,IAAY;IAC7D,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAgC,EAAE,MAAc,EAAE,QAAgB;IACxF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,sBAAsB,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAChF,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAClD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,MAAM,EAAE,CAAC;AACvD,CAAC;AAED,wDAAwD;AACxD,SAAS,cAAc,CAAC,GAAgC,EAAE,MAAc,EAAE,QAAiB;IACzF,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,WAAW,CAAC,IAAI,MAAM,CAAC;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,sBAAsB,KAAK,WAAW,CAAC;WAChE,OAAO,CAAC,GAAG,EAAE,6BAA6B,CAAC;WAC3C,gBAAgB,CAAC;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAG,GAAgC,OAAO,CAAC,GAAG;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;IAC7E,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAC/C,OAAO,EAAE,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC;QACjD,IAAI,EAAE,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgC,EAAE,MAAc,EAAE,IAAY;IAC1F,OAAO,OAAO,CAAC,GAAG,EAAE,sBAAsB,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,sBAAsB,IAAI,EAAE,CAAC,CAAC;AAC1H,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,GAAgC,EAAE,MAAc;IAC5E,OAAO,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,gBAAgB,CAAC,SAAoB;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,GAAgC;IAC/D,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAG,GAAgC,OAAO,CAAC,GAAG;IACrF,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SAC5D,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,cAAc,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,EAAE,cAAc,EAAuC,EACvD,GAAG,GAAgC,OAAO,CAAC,GAAG;IAE9C,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAA2B;QACvC,wBAAwB,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,EAAE,0BAA0B,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC;aACtH,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC;KACb,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACnC,QAAQ,CAAC,QAAQ,KAAK,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAChE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,QAAQ,CAAC,sBAAsB,KAAK,WAAW,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACrE,QAAQ,CAAC,sBAAsB,KAAK,WAAW,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACrE,IAAI,QAAQ,CAAC,OAAO;YAAE,QAAQ,CAAC,sBAAsB,KAAK,UAAU,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC3F,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAsB,EAAE;QAC7E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/src/telemetry/forward.js

@@ -0,0 +1,154 @@
+/**
+ * Exports OTLP requests that something else encoded, as they are, over OTLP/HTTP to
+ * where alasio exports its own signals: what the sandbox service's receiver relays from
+ * inside a session's sandbox (src/receiver/receiver.ts). Each signal goes to its endpoint with its headers,
+ * timeout, compression, and TLS files from the standard variables, as OpenTelemetry's
+ * own exporters send alasio's, and is retried as they retry: on 429, 502, 503, and 504
+ * and on a failed connection, after the server's Retry-After or a jittered backoff,
+ * within the signal's timeout. alasio's deployment has it export to the stack's
+ * collector over OTLP/HTTP, which bayma exports over too.
+ */
+import { readFileSync } from "node:fs";
+import { Agent as HttpAgent, request as httpRequest } from "node:http";
+import { Agent as HttpsAgent, request as httpsRequest } from "node:https";
+import { setTimeout as sleep } from "node:timers/promises";
+import { gzipSync } from "node:zlib";
+import { context } from "@opentelemetry/api";
+import { suppressTracing } from "@opentelemetry/core";
+import { parseKeyValueList, resolveTelemetry, SIGNALS, signalSetting } from "./config.js";
+const CONTENT_TYPES = { protobuf: "application/x-protobuf", json: "application/json" };
+const DEFAULT_TIMEOUT_MS = 10_000;
+const RETRYABLE_STATUS = new Set([429, 502, 503, 504]);
+const MAX_RETRIES = 5;
+const INITIAL_BACKOFF_MS = 1000;
+const MAX_BACKOFF_MS = 5000;
+const BACKOFF_MULTIPLIER = 1.5;
+const JITTER = 0.2;
+// A response body is never needed, only drained; one this large is not an OTLP server's.
+const MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+/** The milliseconds a Retry-After header asks to wait, or null. */
+export function retryAfterMs(header, now = Date.now()) {
+    if (!header)
+        return null;
+    const seconds = Number(header);
+    if (Number.isFinite(seconds) && seconds >= 0)
+        return seconds * 1000;
+    const at = Date.parse(header);
+    return Number.isNaN(at) ? null : Math.max(0, at - now);
+}
+const TLS_FILES = [["ca", "CERTIFICATE"], ["cert", "CLIENT_CERTIFICATE"], ["key", "CLIENT_KEY"]];
+function tlsFiles(env, signal, warn) {
+    const files = {};
+    for (const [option, name] of TLS_FILES) {
+        const path = signalSetting(env, signal, name);
+        if (!path)
+            continue;
+        try {
+            files[option] = readFileSync(path);
+        }
+        catch (error) {
+            warn(`${signal}: cannot read OTEL_EXPORTER_OTLP_${name} ${path}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return files;
+}
+/** How each exported signal is sent, from the standard variables. */
+function signalTargets(env, warn) {
+    const telemetry = resolveTelemetry(env);
+    const targets = {};
+    for (const signal of SIGNALS) {
+        const exporter = telemetry[signal];
+        if (!exporter)
+            continue;
+        const url = new URL(exporter.endpoint);
+        const timeout = Number(signalSetting(env, signal, "TIMEOUT"));
+        const https = url.protocol === "https:";
+        targets[signal] = {
+            url,
+            protocol: exporter.protocol,
+            headers: parseKeyValueList(exporter.headers),
+            timeoutMs: Number.isFinite(timeout) && timeout > 0 ? timeout : DEFAULT_TIMEOUT_MS,
+            gzip: signalSetting(env, signal, "COMPRESSION") === "gzip",
+            request: https ? httpsRequest : httpRequest,
+            agent: https ? new HttpsAgent({ keepAlive: true, ...tlsFiles(env, signal, warn) }) : new HttpAgent({ keepAlive: true }),
+        };
+    }
+    return targets;
+}
+/** One POST: `{ status, retryAfter }`, or `{ error }` for a connection that failed. */
+function post(target, body, headers, timeoutMs, signal) {
+    return new Promise((resolve) => {
+        // alasio's own HTTP instrumentation would otherwise trace every export it relays.
+        context.with(suppressTracing(context.active()), () => {
+            const req = target.request(target.url, { method: "POST", agent: target.agent, headers, timeout: timeoutMs, ...(signal ? { signal } : {}) }, (res) => {
+                let received = 0;
+                res.on("data", (chunk) => {
+                    received += chunk.length;
+                    if (received > MAX_RESPONSE_BYTES)
+                        res.destroy();
+                });
+                res.on("error", () => { });
+                res.on("close", () => resolve({ status: res.statusCode, retryAfter: retryAfterMs(res.headers["retry-after"]) }));
+            });
+            req.on("timeout", () => req.destroy(new Error(`no response within ${timeoutMs}ms`)));
+            req.on("error", (error) => resolve({ error }));
+            req.end(body);
+        });
+    });
+}
+/**
+ * The forwarder for the signals `env` exports. `protocols` maps each signal it forwards
+ * to the protocol alasio exports it over (http/protobuf or http/json); a signal it does
+ * not forward is absent. `export(signal, encoding, body)` sends one request, encoded as
+ * `encoding` ("protobuf" or "json"), within the signal's timeout or `withinMs` where less,
+ * and resolves `{ ok: true }` once a server took it, or `{ ok: false, ... }` once it is given
+ * up on (ForwardResult), or `signal` aborts it, which ends the request it is sending.
+ * `close()` ends the connections it keeps open.
+ */
+export function createOtlpForwarder(env = process.env, { warn = () => { } } = {}) {
+    const targets = signalTargets(env, warn);
+    const protocols = {};
+    for (const signal of SIGNALS) {
+        const target = targets[signal];
+        if (target)
+            protocols[signal] = target.protocol;
+    }
+    return {
+        protocols,
+        async export(signal, encoding, body, { withinMs, signal: abort } = {}) {
+            const target = targets[signal];
+            if (!target)
+                return { ok: false, error: `${signal} are not forwarded`, retryable: false, retryAfterMs: null };
+            const headers = {
+                ...target.headers,
+                "content-type": CONTENT_TYPES[encoding],
+                ...(target.gzip ? { "content-encoding": "gzip" } : {}),
+            };
+            const payload = target.gzip ? gzipSync(body) : body;
+            const deadline = Date.now() + Math.min(target.timeoutMs, withinMs ?? Infinity);
+            let backoff = INITIAL_BACKOFF_MS;
+            for (let attempt = 0;; attempt += 1) {
+                const result = await post(target, payload, headers, Math.max(1, deadline - Date.now()), abort);
+                if (result.status !== undefined && result.status >= 200 && result.status < 300)
+                    return { ok: true };
+                const error = result.error?.message ?? `HTTP ${result.status}`;
+                const retryable = result.error || (result.status !== undefined && RETRYABLE_STATUS.has(result.status));
+                const failed = { ok: false, error, retryable: Boolean(retryable), retryAfterMs: result.retryAfter ?? null };
+                if (attempt === MAX_RETRIES || !retryable)
+                    return failed;
+                const wait = result.retryAfter ?? Math.min(backoff * (1 + (Math.random() * 2 - 1) * JITTER), MAX_BACKOFF_MS);
+                backoff *= BACKOFF_MULTIPLIER;
+                if (Date.now() + wait >= deadline || abort?.aborted)
+                    return failed;
+                const waited = await sleep(wait, true, abort ? { signal: abort } : {}).catch(() => false);
+                if (!waited)
+                    return failed;
+            }
+        },
+        close() {
+            for (const target of Object.values(targets))
+                target.agent.destroy();
+        },
+    };
+}
+//# sourceMappingURL=forward.js.map

package/dist/src/telemetry/forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../../../../src/telemetry/forward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,KAAK,IAAI,SAAS,EAA4B,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAe,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAsDvG,MAAM,aAAa,GAA2C,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;AAC/H,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACvD,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,MAAM,GAAG,GAAG,CAAC;AACnB,yFAAyF;AACzF,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,MAA0B,EAAE,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;IAC/E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,OAAO,GAAG,IAAI,CAAC;IACpE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,CAAU,CAAC;AAE1G,SAAS,QAAQ,CAAC,GAAgC,EAAE,MAAc,EAAE,IAAU;IAC5E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,MAAM,oCAAoC,IAAI,IAAI,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,SAAS,aAAa,CAAC,GAAgC,EAAE,IAAU;IACjE,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACxC,OAAO,CAAC,MAAM,CAAC,GAAG;YAChB,GAAG;YACH,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC5C,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB;YACjF,IAAI,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,MAAM;YAC1D,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW;YAC3C,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SACxH,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uFAAuF;AACvF,SAAS,IAAI,CAAC,MAAoB,EAAE,IAAY,EAAE,OAA4B,EAAE,SAAiB,EAAE,MAA+B;IAChI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,kFAAkF;QAClF,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE;YACnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBAClJ,IAAI,QAAQ,GAAG,CAAC,CAAC;gBACjB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;oBACzB,IAAI,QAAQ,GAAG,kBAAkB;wBAAE,GAAG,CAAC,OAAO,EAAE,CAAC;gBACnD,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC1B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnH,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,sBAAsB,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC;YACrF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC/C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAG,GAAgC,OAAO,CAAC,GAAG,EAC9C,EAAE,IAAI,GAAG,GAAG,EAAE,GAAE,CAAC,EAAE,GAA6B,EAAE;IAElD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,MAAM;YAAE,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClD,CAAC;IACD,OAAO;QACL,SAAS;QAET,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAmB,EAAE;YACnF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC9G,MAAM,OAAO,GAAwB;gBACnC,GAAG,MAAM,CAAC,OAAO;gBACjB,cAAc,EAAE,aAAa,CAAC,QAAQ,CAAC;gBACvC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,IAAI,QAAQ,CAAC,CAAC;YAC/E,IAAI,OAAO,GAAG,kBAAkB,CAAC;YACjC,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC/F,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;oBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACpG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBACvG,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,EAAW,CAAC;gBACrH,IAAI,OAAO,KAAK,WAAW,IAAI,CAAC,SAAS;oBAAE,OAAO,MAAM,CAAC;gBACzD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC;gBAC7G,OAAO,IAAI,kBAAkB,CAAC;gBAC9B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,QAAQ,IAAI,KAAK,EAAE,OAAO;oBAAE,OAAO,MAAM,CAAC;gBACnE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;gBAC1F,IAAI,CAAC,MAAM;oBAAE,OAAO,MAAM,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,KAAK;YACH,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alasio",
-  "version": "7.0.0",
+  "version": "9.0.0",
   "description": "alasio: coding agents you talk to from Telegram, installed and run with npx alasio",
   "type": "module",
   "license": "MIT",

package/dist/cli/src/manifests/agent-sandbox.js

@@ -1,92 +0,0 @@
-import { given, NAMESPACE, ONE, RELEASE, replicasOf } from "./common.js";
-import { priority } from "./priorities.js";
-import { verticalPodAutoscaler } from "./sizing.js";
-import sandboxes from "./sandboxes.agents.x-k8s.io.json" with { type: "json" };
-/**
- * The Sandbox CRD, agents.x-k8s.io's `sandboxes`, as the API server takes it, whose
- * schema's keys (`x-kubernetes-*`, say) are not client-node's model's.
- */
-export const SANDBOX_CRD = sandboxes;
-const NAME = `${RELEASE}-agent-sandbox-controller`;
-/** The labels of the controller's objects: the controller's name and version, the installation, and alasio as their manager. */
-const LABELS = {
-    "app.kubernetes.io/name": "agent-sandbox-controller",
-    "app.kubernetes.io/instance": RELEASE,
-    "app.kubernetes.io/version": "v1.0.5",
-    "app.kubernetes.io/managed-by": "alasio",
-};
-/** The controller: its identity, what it may do (Sandboxes and their pods, volumes and Services, cluster-wide; its leader lease, here), and its Deployment. */
-function controller(config) {
-    const { image, resources, nodeSelector, tolerations, affinity } = config.agentSandbox;
-    const serviceAccount = { apiVersion: "v1", kind: "ServiceAccount", metadata: { name: NAME, namespace: NAMESPACE, labels: LABELS } };
-    const clusterRole = {
-        apiVersion: "rbac.authorization.k8s.io/v1",
-        kind: "ClusterRole",
-        metadata: { name: NAME, labels: LABELS },
-        rules: [
-            { apiGroups: [""], resources: ["persistentvolumeclaims", "pods", "services"], verbs: ["create", "delete", "get", "list", "patch", "update", "watch"] },
-            { apiGroups: ["", "events.k8s.io"], resources: ["events"], verbs: ["create", "patch"] },
-            { apiGroups: ["agents.x-k8s.io"], resources: ["sandboxes"], verbs: ["create", "delete", "get", "list", "patch", "update", "watch"] },
-            { apiGroups: ["agents.x-k8s.io"], resources: ["sandboxes/finalizers", "sandboxes/status"], verbs: ["get", "patch", "update"] },
-        ],
-    };
-    const subjects = [{ kind: "ServiceAccount", name: NAME, namespace: NAMESPACE }];
-    const clusterRoleBinding = {
-        apiVersion: "rbac.authorization.k8s.io/v1",
-        kind: "ClusterRoleBinding",
-        metadata: { name: NAME, labels: LABELS },
-        subjects,
-        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "ClusterRole", name: NAME },
-    };
-    // Leader election's lease, in the controller's own namespace only.
-    const role = {
-        apiVersion: "rbac.authorization.k8s.io/v1",
-        kind: "Role",
-        metadata: { name: NAME, namespace: NAMESPACE, labels: LABELS },
-        rules: [{ apiGroups: ["coordination.k8s.io"], resources: ["leases"], verbs: ["create", "get", "list", "patch", "update", "watch"] }],
-    };
-    const roleBinding = {
-        apiVersion: "rbac.authorization.k8s.io/v1",
-        kind: "RoleBinding",
-        metadata: { name: NAME, namespace: NAMESPACE, labels: LABELS },
-        subjects,
-        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: NAME },
-    };
-    const deployment = {
-        apiVersion: "apps/v1",
-        kind: "Deployment",
-        metadata: { name: NAME, namespace: NAMESPACE, labels: LABELS },
-        spec: {
-            ...replicasOf(ONE),
-            selector: { matchLabels: { "app.kubernetes.io/name": "agent-sandbox-controller", "app.kubernetes.io/instance": RELEASE } },
-            template: {
-                metadata: { labels: LABELS },
-                spec: {
-                    serviceAccountName: NAME,
-                    ...priority("floor"),
-                    securityContext: { runAsNonRoot: true, seccompProfile: { type: "RuntimeDefault" } },
-                    containers: [{
-                            name: "controller",
-                            image: `${image.repository}:${image.tag}${image.digest ? `@${image.digest}` : ""}`,
-                            imagePullPolicy: image.pullPolicy,
-                            args: ["--leader-elect=true"],
-                            ports: [{ name: "metrics", containerPort: 8080 }, { name: "healthz", containerPort: 8081 }],
-                            livenessProbe: { httpGet: { path: "/healthz", port: "healthz" } },
-                            readinessProbe: { httpGet: { path: "/readyz", port: "healthz" } },
-                            securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, runAsNonRoot: true, capabilities: { drop: ["ALL"] } },
-                            resources,
-                        }],
-                    ...given("nodeSelector", { ...nodeSelector }),
-                    ...given("tolerations", [...tolerations]),
-                    ...given("affinity", affinity),
-                },
-            },
-        },
-    };
-    return [serviceAccount, clusterRole, clusterRoleBinding, role, roleBinding, deployment, verticalPodAutoscaler(deployment, "InPlace")];
-}
-/** agent-sandbox's objects, unless the cluster already has it. */
-export function agentSandboxObjects(config) {
-    return config.agentSandbox.enabled ? [SANDBOX_CRD, ...controller(config)] : [];
-}
-//# sourceMappingURL=agent-sandbox.js.map

package/dist/cli/src/manifests/agent-sandbox.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-sandbox.js","sourceRoot":"","sources":["../../../../src/manifests/agent-sandbox.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,SAAS,MAAM,kCAAkC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAqB,SAAS,CAAC;AAEvD,MAAM,IAAI,GAAG,GAAG,OAAO,2BAA2B,CAAC;AAEnD,gIAAgI;AAChI,MAAM,MAAM,GAAG;IACb,wBAAwB,EAAE,0BAA0B;IACpD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,QAAQ;IACrC,8BAA8B,EAAE,QAAQ;CACzC,CAAC;AAEF,+JAA+J;AAC/J,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IACtF,MAAM,cAAc,GAAqB,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;IACtJ,MAAM,WAAW,GAAkB;QACjC,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,KAAK,EAAE;YACL,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,wBAAwB,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;YACtJ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE;YACvF,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpI,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;SAC/H;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAyB;QAC/C,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,QAAQ;QACR,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;KACpF,CAAC;IACF,mEAAmE;IACnE,MAAM,IAAI,GAAW;QACnB,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;KACrI,CAAC;IACF,MAAM,WAAW,GAAkB;QACjC,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,QAAQ;QACR,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;KAC7E,CAAC;IACF,MAAM,UAAU,GAAiB;QAC/B,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC9D,IAAI,EAAE;YACJ,GAAG,UAAU,CAAC,GAAG,CAAC;YAClB,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,OAAO,EAAE,EAAE;YAC1H,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;gBAC5B,IAAI,EAAE;oBACJ,kBAAkB,EAAE,IAAI;oBACxB,GAAG,QAAQ,CAAC,OAAO,CAAC;oBACpB,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE;oBACnF,UAAU,EAAE,CAAC;4BACX,IAAI,EAAE,YAAY;4BAClB,KAAK,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;4BAClF,eAAe,EAAE,KAAK,CAAC,UAAU;4BACjC,IAAI,EAAE,CAAC,qBAAqB,CAAC;4BAC7B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;4BAC3F,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;4BACjE,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;4BACjE,eAAe,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;4BACvI,SAAS;yBACV,CAAC;oBACF,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,GAAG,YAAY,EAAE,CAAC;oBAC7C,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;oBACzC,GAAG,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC;iBAC/B;aACF;SACF;KACF,CAAC;IACF,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,qBAAqB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AACxI,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC"}

package/dist/cli/src/manifests/juicefs-csi.js

@@ -1,319 +0,0 @@
-import { imageReference } from "../images.js";
-import { VOLUME_DRIVER_LABEL } from "../kube/apply.js";
-import { goJson, ONE, replicasOf } from "./common.js";
-import { verticalPodAutoscaler } from "./sizing.js";
-/** The driver's name, which StorageClasses name as their provisioner. */
-export const CSI_DRIVER = "csi.juicefs.com";
-const VERSION = "v0.33.0";
-const CONTROLLER = "juicefs-csi-controller";
-const NODE = "juicefs-csi-node";
-const CONFIG = "juicefs-csi-driver-config";
-const CONTROLLER_ACCOUNT = "juicefs-csi-controller-sa";
-const NODE_ACCOUNT = "juicefs-csi-node-sa";
-/** The PriorityClass of mount pods. */
-const MOUNT_PRIORITY_CLASS = "alasio-juicefs-mount";
-/** The name label of the node service's mount pods, the clients. */
-export const MOUNT_POD_NAME = "juicefs-mount";
-/** The name label of the controller's and the node service's pods, the driver. */
-export const DRIVER_POD_NAME = "juicefs-csi-driver";
-/** The labels of the node service's mount pods. */
-export const MOUNT_POD_LABELS = { "app.kubernetes.io/name": MOUNT_POD_NAME };
-/** The labels that select the controller's and the node service's pods, upstream's but for its version. */
-export const CONTROLLER_POD_LABELS = { app: CONTROLLER, "app.kubernetes.io/name": DRIVER_POD_NAME, "app.kubernetes.io/instance": DRIVER_POD_NAME };
-export const NODE_POD_LABELS = { app: NODE, "app.kubernetes.io/name": DRIVER_POD_NAME, "app.kubernetes.io/instance": DRIVER_POD_NAME };
-/**
- * What selects the pods of the Jobs the controller runs to delete a volume's directory
- * once its claim is gone: upstream labels such a Job but not its pod template
- * (pkg/juicefs/mount/builder/job.go), so its pod carries only what Kubernetes gives a
- * Job's pods, the name of its Job.
- */
-export const JOB_POD_SELECTOR = { matchExpressions: [{ key: "batch.kubernetes.io/job-name", operator: "Exists" }] };
-/** The selector of the controller's, the node service's and the mount pods' pods, by their name labels. */
-export const JUICEFS_PODS_SELECTOR = `app.kubernetes.io/name in (${MOUNT_POD_NAME}, ${DRIVER_POD_NAME})`;
-/** Where mount pods serve their Prometheus metrics, the client's (administration/monitoring.md). */
-export const JUICEFS_METRICS_PORT = 9567;
-/** Where the controller's and the node service's pods serve theirs, the driver's own: its provisioning and volume errors among them. */
-export const DRIVER_METRICS_PORT = 8080;
-/** The label of what the driver needs to delete its volumes' data, which alasio keeps while they remain. */
-export const VOLUME_DRIVER = { [VOLUME_DRIVER_LABEL]: CSI_DRIVER };
-/** The labels of the driver's objects: upstream's, at its version, managed by alasio, and needed by its volumes. */
-const LABELS = {
-    "app.kubernetes.io/name": "juicefs-csi-driver",
-    "app.kubernetes.io/instance": "juicefs-csi-driver",
-    "app.kubernetes.io/version": VERSION,
-    "app.kubernetes.io/managed-by": "alasio",
-    ...VOLUME_DRIVER,
-};
-/** Where the controller and node service keep mount points and the client's configuration, on the node. */
-const MOUNT_PATH = "/var/lib/juicefs/volume";
-const CONFIG_PATH = "/var/lib/juicefs/config";
-/** The controller's socket, which its sidecars reach it by. */
-const CONTROLLER_SOCKET_DIR = "/var/lib/csi/sockets/pluginproxy/";
-/**
- * The driver's configuration, its ConfigMap's config.yaml: one patch, for the mount pods
- * of workspace storage's class. Mount options here take precedence over a volume's, and
- * reach mount pods made after a change.
- */
-export function driverConfig({ workspaceStorage }) {
-    const { csi, storageClassName, cacheSizeMiB, backupInterval } = workspaceStorage;
-    return {
-        enableNodeSelector: false,
-        mountPodPatch: [{
-                pvcSelector: { matchStorageClassName: storageClassName },
-                ceMountImage: imageReference(csi.mountImage),
-                resources: csi.mountPod.resources,
-                mountOptions: [
-                    // The read cache, bounded, and keeping a fifth of the node's disk free.
-                    `cache-size=${cacheSizeMiB}`,
-                    "free-space-ratio=0.2",
-                    `backup-meta=${backupInterval}`,
-                ],
-                // Ready once the mount answers as FUSE's. A mount pod mounts its volume's directory
-                // alone (as `subdir`), so that is the mount's root, and nothing is under it by the
-                // volume's path; unmounted, the root is the node's own directory.
-                readinessProbe: { exec: { command: ["sh", "-c", 'test "$(stat --file-system --format=%T ${MOUNT_POINT})" = fuseblk'] }, initialDelaySeconds: 5, periodSeconds: 10, failureThreshold: 3 },
-            }],
-    };
-}
-/** What the controller and node service are told alike: where they are, where mount pods keep their mounts, and the pods' priority. */
-function pluginEnv({ workspaceStorage }) {
-    return [
-        { name: "NODE_NAME", valueFrom: { fieldRef: { fieldPath: "spec.nodeName" } } },
-        { name: "JUICEFS_MOUNT_NAMESPACE", valueFrom: { fieldRef: { fieldPath: "metadata.namespace" } } },
-        { name: "POD_NAME", valueFrom: { fieldRef: { fieldPath: "metadata.name" } } },
-        { name: "JUICEFS_MOUNT_PATH", value: MOUNT_PATH },
-        { name: "JUICEFS_CONFIG_PATH", value: CONFIG_PATH },
-        { name: "JUICEFS_MOUNT_PRIORITY_NAME", value: MOUNT_PRIORITY_CLASS },
-        { name: "JUICEFS_MOUNT_PREEMPTION_POLICY", value: "Never" },
-        ...(workspaceStorage.csi.shareMountPod ? [{ name: "FS_SHARE_MOUNT", value: "true" }] : []),
-    ];
-}
-/** The plugin's liveness, which its liveness-probe sidecar answers on the plugin's healthz port. */
-const PLUGIN_PROBE = { httpGet: { path: "/healthz", port: "healthz" }, initialDelaySeconds: 10, periodSeconds: 10, timeoutSeconds: 3, failureThreshold: 5 };
-/** The liveness-probe sidecar, for the plugin's socket in `socketVolume`. */
-function livenessProbe({ workspaceStorage }, socketVolume) {
-    return {
-        name: "liveness-probe",
-        image: imageReference(workspaceStorage.csi.livenessProbeImage),
-        args: ["--csi-address=/csi/csi.sock", "--health-port=9909"],
-        resources: { requests: { cpu: "5m", memory: "16Mi" }, limits: { memory: "64Mi" } },
-        volumeMounts: [{ name: socketVolume, mountPath: "/csi" }],
-    };
-}
-/** A rule granting `verbs` on `resources` of `apiGroups`. */
-function rule(apiGroups, resources, verbs) {
-    return { apiGroups, resources, verbs };
-}
-/** Who the controller and node service are, and what they may do, as upstream grants it. */
-function identities({ workspaceStorage }) {
-    const { namespace } = workspaceStorage.csi;
-    const account = (name) => ({ apiVersion: "v1", kind: "ServiceAccount", metadata: { name, namespace, labels: LABELS } });
-    const role = (name, rules) => ({
-        apiVersion: "rbac.authorization.k8s.io/v1",
-        kind: "ClusterRole",
-        metadata: { name, labels: LABELS },
-        rules,
-    });
-    const binding = (name, roleName, accountName) => ({
-        apiVersion: "rbac.authorization.k8s.io/v1",
-        kind: "ClusterRoleBinding",
-        metadata: { name, labels: LABELS },
-        subjects: [{ kind: "ServiceAccount", name: accountName, namespace }],
-        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "ClusterRole", name: roleName },
-    });
-    const provisioner = "juicefs-external-provisioner-role";
-    const nodeService = "juicefs-csi-external-node-service-role";
-    return [
-        account(CONTROLLER_ACCOUNT),
-        account(NODE_ACCOUNT),
-        role(provisioner, [
-            rule([""], ["persistentvolumes"], ["get", "list", "watch", "create", "delete", "patch"]),
-            rule([""], ["persistentvolumeclaims", "persistentvolumeclaims/status"], ["get", "list", "watch", "update", "patch"]),
-            rule(["storage.k8s.io"], ["storageclasses"], ["get", "list", "watch"]),
-            rule([""], ["events"], ["list", "watch", "create", "update", "patch"]),
-            rule(["storage.k8s.io"], ["csinodes"], ["get", "list", "watch"]),
-            rule([""], ["nodes"], ["get", "list", "watch"]),
-            rule([""], ["secrets"], ["get", "list", "watch", "create", "update", "patch", "delete"]),
-            rule([""], ["pods", "pods/log"], ["get", "list", "watch", "create", "update", "patch", "delete"]),
-            rule(["batch"], ["jobs"], ["get", "create", "update", "patch", "delete", "list", "watch"]),
-            rule([""], ["endpoints"], ["get", "list", "watch", "create", "update", "patch"]),
-            rule(["apps"], ["daemonsets"], ["get", "list"]),
-            rule([""], ["configmaps"], ["get", "watch", "list", "delete", "update", "create"]),
-        ]),
-        role(nodeService, [
-            rule([""], ["pods"], ["get", "list", "create", "update", "delete", "patch", "watch"]),
-            rule([""], ["pods/log"], ["get"]),
-            rule([""], ["secrets"], ["get", "create", "update", "delete", "patch"]),
-            rule(["batch"], ["jobs"], ["get", "create", "update", "delete", "patch"]),
-            rule([""], ["nodes"], ["get", "list"]),
-            rule([""], ["nodes/proxy"], ["*"]),
-            rule([""], ["persistentvolumes", "persistentvolumeclaims"], ["get", "list"]),
-            rule([""], ["pods/exec"], ["create"]),
-            rule([""], ["events"], ["create", "get"]),
-            rule(["storage.k8s.io"], ["storageclasses"], ["get", "watch"]),
-            rule([""], ["configmaps"], ["get", "update"]),
-        ]),
-        binding("juicefs-csi-provisioner-binding", provisioner, CONTROLLER_ACCOUNT),
-        binding("juicefs-csi-node-service-binding", nodeService, NODE_ACCOUNT),
-    ];
-}
-/** The controller: the plugin, provisioning, and the resizer, which grows a volume's quota as its claim grows. */
-function controller(config) {
-    const { csi } = config.workspaceStorage;
-    return {
-        apiVersion: "apps/v1",
-        kind: "StatefulSet",
-        metadata: { name: CONTROLLER, namespace: csi.namespace, labels: { ...LABELS, "app.kubernetes.io/component": "controller" } },
-        spec: {
-            serviceName: CONTROLLER,
-            // One, and never more: without an election, two would provision alike.
-            ...replicasOf(ONE),
-            selector: { matchLabels: CONTROLLER_POD_LABELS },
-            template: {
-                metadata: { labels: { ...LABELS, ...CONTROLLER_POD_LABELS } },
-                spec: {
-                    serviceAccountName: CONTROLLER_ACCOUNT,
-                    priorityClassName: "system-cluster-critical",
-                    tolerations: [{ key: "CriticalAddonsOnly", operator: "Exists" }],
-                    containers: [
-                        {
-                            name: "juicefs-plugin",
-                            image: imageReference(csi.image),
-                            args: ["--endpoint=$(CSI_ENDPOINT)", "--logtostderr", "--nodeid=$(NODE_NAME)", "--provisioner=true", "--config=/etc/config/config.yaml"],
-                            env: [{ name: "CSI_ENDPOINT", value: `unix://${CONTROLLER_SOCKET_DIR}csi.sock` }, ...pluginEnv(config)],
-                            ports: [{ name: "healthz", containerPort: 9909, protocol: "TCP" }],
-                            livenessProbe: PLUGIN_PROBE,
-                            // It mounts the file system itself, to make and remove volumes' directories.
-                            securityContext: { privileged: true, capabilities: { add: ["SYS_ADMIN"] } },
-                            resources: csi.controller.resources,
-                            volumeMounts: [
-                                { name: "socket-dir", mountPath: CONTROLLER_SOCKET_DIR },
-                                { name: "jfs-dir", mountPath: "/jfs", mountPropagation: "Bidirectional" },
-                                { name: "jfs-root-dir", mountPath: "/root/.juicefs", mountPropagation: "Bidirectional" },
-                                { name: "juicefs-config", mountPath: "/etc/config" },
-                            ],
-                        },
-                        {
-                            name: "csi-resizer",
-                            image: imageReference(csi.resizerImage),
-                            args: ["--csi-address=$(ADDRESS)", "--timeout=20s", "--v=2"],
-                            env: [{ name: "ADDRESS", value: `${CONTROLLER_SOCKET_DIR}csi.sock` }],
-                            resources: { requests: { cpu: "5m", memory: "24Mi" }, limits: { memory: "128Mi" } },
-                            volumeMounts: [{ name: "socket-dir", mountPath: CONTROLLER_SOCKET_DIR }],
-                        },
-                        livenessProbe(config, "socket-dir"),
-                    ],
-                    volumes: [
-                        { name: "socket-dir", emptyDir: {} },
-                        { name: "jfs-dir", hostPath: { path: MOUNT_PATH, type: "DirectoryOrCreate" } },
-                        { name: "jfs-root-dir", hostPath: { path: CONFIG_PATH, type: "DirectoryOrCreate" } },
-                        { name: "juicefs-config", configMap: { name: CONFIG } },
-                    ],
-                },
-            },
-        },
-    };
-}
-/** The node service: the plugin, which makes mount pods and binds their mounts into pods, and the registrar, which names it to kubelet. */
-function nodeService(config) {
-    const { csi } = config.workspaceStorage;
-    const pluginDir = `/var/lib/kubelet/csi-plugins/${CSI_DRIVER}/`;
-    return {
-        apiVersion: "apps/v1",
-        kind: "DaemonSet",
-        metadata: { name: NODE, namespace: csi.namespace, labels: { ...LABELS, "app.kubernetes.io/component": "node" } },
-        spec: {
-            selector: { matchLabels: NODE_POD_LABELS },
-            template: {
-                metadata: { labels: { ...LABELS, ...NODE_POD_LABELS } },
-                spec: {
-                    serviceAccountName: NODE_ACCOUNT,
-                    priorityClassName: "system-node-critical",
-                    dnsPolicy: "ClusterFirstWithHostNet",
-                    tolerations: [{ key: "CriticalAddonsOnly", operator: "Exists" }],
-                    containers: [
-                        {
-                            name: "juicefs-plugin",
-                            image: imageReference(csi.image),
-                            args: ["--endpoint=$(CSI_ENDPOINT)", "--logtostderr", "--nodeid=$(NODE_NAME)", "--enable-manager=true", "--config=/etc/config/config.yaml"],
-                            env: [
-                                { name: "CSI_ENDPOINT", value: "unix:/csi/csi.sock" },
-                                { name: "HOST_IP", valueFrom: { fieldRef: { fieldPath: "status.hostIP" } } },
-                                { name: "KUBELET_PORT", value: "10250" },
-                                ...pluginEnv(config),
-                            ],
-                            ports: [{ name: "healthz", containerPort: 9909, protocol: "TCP" }],
-                            livenessProbe: PLUGIN_PROBE,
-                            securityContext: { privileged: true },
-                            resources: csi.node.resources,
-                            volumeMounts: [
-                                { name: "kubelet-dir", mountPath: "/var/lib/kubelet", mountPropagation: "Bidirectional" },
-                                { name: "plugin-dir", mountPath: "/csi" },
-                                { name: "device-dir", mountPath: "/dev" },
-                                { name: "jfs-dir", mountPath: "/jfs", mountPropagation: "Bidirectional" },
-                                { name: "jfs-root-dir", mountPath: "/root/.juicefs", mountPropagation: "Bidirectional" },
-                                { name: "juicefs-config", mountPath: "/etc/config" },
-                                // Where it keeps each mount's FUSE descriptor, by which a mount pod that
-                                // crashes comes back under the same mount (guide/configurations.md
-                                // "Automatic mount point recovery").
-                                { name: "jfs-fuse-fd", mountPath: "/tmp" },
-                            ],
-                        },
-                        {
-                            name: "node-driver-registrar",
-                            image: imageReference(csi.registrarImage),
-                            args: ["--csi-address=$(ADDRESS)", "--kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)", "--v=5"],
-                            env: [{ name: "ADDRESS", value: "/csi/csi.sock" }, { name: "DRIVER_REG_SOCK_PATH", value: `${pluginDir}csi.sock` }],
-                            resources: { requests: { cpu: "5m", memory: "16Mi" }, limits: { memory: "64Mi" } },
-                            volumeMounts: [{ name: "plugin-dir", mountPath: "/csi" }, { name: "registration-dir", mountPath: "/registration" }],
-                        },
-                        livenessProbe(config, "plugin-dir"),
-                    ],
-                    volumes: [
-                        { name: "kubelet-dir", hostPath: { path: "/var/lib/kubelet", type: "Directory" } },
-                        { name: "plugin-dir", hostPath: { path: pluginDir, type: "DirectoryOrCreate" } },
-                        { name: "registration-dir", hostPath: { path: "/var/lib/kubelet/plugins_registry/", type: "Directory" } },
-                        { name: "device-dir", hostPath: { path: "/dev", type: "Directory" } },
-                        { name: "jfs-dir", hostPath: { path: MOUNT_PATH, type: "DirectoryOrCreate" } },
-                        { name: "jfs-root-dir", hostPath: { path: CONFIG_PATH, type: "DirectoryOrCreate" } },
-                        { name: "juicefs-config", configMap: { name: CONFIG } },
-                        { name: "jfs-fuse-fd", hostPath: { path: "/var/run/juicefs-csi", type: "DirectoryOrCreate" } },
-                    ],
-                },
-            },
-        },
-    };
-}
-/** The driver's objects, unless the cluster already has the driver: the CSIDriver and the mount pods' PriorityClass among them, which are the cluster's. */
-export function juicefsCsiObjects(config) {
-    const { csi } = config.workspaceStorage;
-    if (!csi.enabled)
-        return [];
-    const csiDriver = {
-        apiVersion: "storage.k8s.io/v1",
-        kind: "CSIDriver",
-        metadata: { name: CSI_DRIVER, labels: LABELS },
-        spec: { attachRequired: false, podInfoOnMount: true },
-    };
-    const priorityClass = {
-        apiVersion: "scheduling.k8s.io/v1",
-        kind: "PriorityClass",
-        metadata: { name: MOUNT_PRIORITY_CLASS, labels: LABELS },
-        // As high as a pod's may be, so mount pods outlast the workspaces they serve, and
-        // never preempting, so a new one evicts nothing.
-        value: 1_000_000_000,
-        preemptionPolicy: "Never",
-        globalDefault: false,
-        description: "JuiceFS's mount pods, which serve alasio's workspaces",
-    };
-    const configMap = {
-        apiVersion: "v1",
-        kind: "ConfigMap",
-        metadata: { name: CONFIG, namespace: csi.namespace, labels: LABELS },
-        data: { "config.yaml": goJson(driverConfig(config), "  ") },
-    };
-    // Each serves workspaces' mounts, which its recreation would interrupt.
-    const workloads = [controller(config), nodeService(config)];
-    return [csiDriver, priorityClass, ...identities(config), configMap, ...workloads.flatMap((workload) => [workload, verticalPodAutoscaler(workload, "Recommended")])];
-}
-//# sourceMappingURL=juicefs-csi.js.map