pepr 0.19.0 → 20.0.0

package/README.md

@@ -27,7 +27,7 @@ Pepr is on a mission to save Kubernetes from the tyranny of YAML, intimidating g
 - Entire NPM ecosystem available for advanced operations
 - Realtime K8s debugging system for testing/reacting to cluster changes
 - Controller network isolation and tamper-resistent module execution
-- Automatic least-privilege RBAC generation [soon](https://github.com/defenseunicorns/pepr/issues/31)
+- Least-privilege [RBAC](https://github.com/defenseunicorns/pepr/blob/main/docs/rbac.md) generation
 - AMD64 and ARM64 support
 
 ## Example Pepr Action

package/dist/cli.js

@@ -244,11 +244,15 @@ function service(name2) {
     kind: "Service",
     metadata: {
       name: name2,
-      namespace: "pepr-system"
+      namespace: "pepr-system",
+      labels: {
+        "pepr.dev/controller": "admission"
+      }
     },
     spec: {
       selector: {
-        app: name2
+        app: name2,
+        "pepr.dev/controller": "admission"
       },
       ports: [
         {
@@ -265,11 +269,15 @@ function watcherService(name2) {
     kind: "Service",
     metadata: {
       name: `${name2}-watcher`,
-      namespace: "pepr-system"
+      namespace: "pepr-system",
+      labels: {
+        "pepr.dev/controller": "watcher"
+      }
     },
     spec: {
       selector: {
-        app: `${name2}-watcher`
+        app: `${name2}-watcher`,
+        "pepr.dev/controller": "watcher"
       },
       ports: [
         {
@@ -310,7 +318,8 @@ function watcher(assets, hash) {
       name: app,
       namespace: "pepr-system",
       labels: {
-        app
+        app,
+        "pepr.dev/controller": "watcher"
       }
     },
     spec: {
@@ -320,13 +329,15 @@ function watcher(assets, hash) {
       },
       selector: {
         matchLabels: {
-          app
+          app,
+          "pepr.dev/controller": "watcher"
         }
       },
       template: {
         metadata: {
           labels: {
-            app
+            app,
+            "pepr.dev/controller": "watcher"
           }
         },
         spec: {
@@ -378,11 +389,7 @@ function watcher(assets, hash) {
                   readOnly: true
                 }
               ],
-              env: [
-                { name: "PEPR_WATCH_MODE", value: "true" },
-                { name: "PEPR_PRETTY_LOG", value: "false" },
-                { name: "LOG_LEVEL", value: config.logLevel || "debug" }
-              ]
+              env: genEnv(config, true)
             }
           ],
           volumes: [
@@ -414,20 +421,23 @@ function deployment(assets, hash) {
       name: name2,
       namespace: "pepr-system",
       labels: {
-        app
+        app,
+        "pepr.dev/controller": "admission"
       }
     },
     spec: {
       replicas: 2,
       selector: {
         matchLabels: {
-          app
+          app,
+          "pepr.dev/controller": "admission"
         }
       },
       template: {
         metadata: {
           labels: {
-            app
+            app,
+            "pepr.dev/controller": "admission"
           }
         },
         spec: {
@@ -468,10 +478,7 @@ function deployment(assets, hash) {
                   cpu: "500m"
                 }
               },
-              env: [
-                { name: "PEPR_PRETTY_LOG", value: "false" },
-                { name: "LOG_LEVEL", value: config.logLevel || "debug" }
-              ],
+              env: genEnv(config),
               volumeMounts: [
                 {
                   name: "tls-certs",
@@ -532,6 +539,19 @@ function moduleSecret(name2, data, hash) {
     }
   };
 }
+function genEnv(config, watchMode = false) {
+  const env = [
+    { name: "PEPR_WATCH_MODE", value: watchMode ? "true" : "false" },
+    { name: "PEPR_PRETTY_LOG", value: "false" },
+    { name: "LOG_LEVEL", value: config.logLevel || "debug" }
+  ];
+  if (config.env) {
+    for (const [name2, value] of Object.entries(config.env)) {
+      env.push({ name: name2, value });
+    }
+  }
+  return env;
+}
 
 // src/lib/helpers.ts
 var import_fs2 = require("fs");
@@ -840,7 +860,7 @@ async function webhookConfig(assets, mutateOrValidate, timeoutSeconds = 10) {
         name: `${name2}.pepr.dev`,
         admissionReviewVersions: ["v1", "v1beta1"],
         clientConfig,
-        failurePolicy: "Ignore",
+        failurePolicy: config.onError === "reject" ? "Fail" : "Ignore",
         matchPolicy: "Equivalent",
         timeoutSeconds,
         namespaceSelector: {
@@ -1266,7 +1286,7 @@ var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\nd
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
 var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://api.chucknorris.io/jokes/random?category=dev");\n * const joke = await fetch("https://api.chucknorris.io/jokes/random?category=dev") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://api.chucknorris.io/jokes/random?category=dev")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  icon_url: string;\n  id: string;\n  url: string;\n  value: string;\n}\n\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithLabel("chuck-norris")\n  .Mutate(async change => {\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(\n      "https://api.chucknorris.io/jokes/random?category=dev",\n    );\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      // Add the Chuck Norris joke to the configmap\n      change.Raw.data["chuck-says"] = response.data.value;\n      return;\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.19.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.29.9", express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.9.0", pino: "8.16.2", "pino-pretty": "10.2.3", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "18.4.3", "@commitlint/config-conventional": "18.4.3", "@jest/globals": "29.7.0", "@types/eslint": "8.44.8", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.10", "@types/prompts": "2.4.9", "@types/uuid": "9.0.7", jest: "29.7.0", nock: "13.4.0", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "20.0.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.29.9", express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.9.0", pino: "8.17.1", "pino-pretty": "10.3.0", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "18.4.3", "@commitlint/config-conventional": "18.4.3", "@jest/globals": "29.7.0", "@types/eslint": "8.44.9", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.10", "@types/prompts": "2.4.9", "@types/uuid": "9.0.7", jest: "29.7.0", nock: "13.4.0", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
 
 // src/templates/pepr.code-snippets.json
 var pepr_code_snippets_default = {
@@ -1355,6 +1375,10 @@ function genPkgJSON(opts, pgkVerOverride) {
   const uuid = (0, import_uuid.v5)(opts.name, (0, import_uuid.v4)());
   const name2 = sanitizeName(opts.name);
   const { typescript } = peerDependencies;
+  const testEnv = {
+    MY_CUSTOM_VAR: "example-value",
+    ZARF_VAR: "###ZARF_VAR_THING###"
+  };
   const data = {
     name: name2,
     version: "0.0.1",
@@ -1371,7 +1395,8 @@ function genPkgJSON(opts, pgkVerOverride) {
         namespaces: [],
         labels: []
       },
-      includedFiles: []
+      includedFiles: [],
+      env: pgkVerOverride ? testEnv : {}
     },
     scripts: {
       "k3d-setup": scripts["test:journey:k3d"]

package/dist/controller.js

@@ -48,7 +48,7 @@ if (process.env.LOG_LEVEL) {
 var logger_default = Log;
 
 // src/templates/data.json
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.19.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.29.9", express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.9.0", pino: "8.16.2", "pino-pretty": "10.2.3", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "18.4.3", "@commitlint/config-conventional": "18.4.3", "@jest/globals": "29.7.0", "@types/eslint": "8.44.8", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.10", "@types/prompts": "2.4.9", "@types/uuid": "9.0.7", jest: "29.7.0", nock: "13.4.0", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "20.0.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.29.9", express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.9.0", pino: "8.17.1", "pino-pretty": "10.3.0", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "18.4.3", "@commitlint/config-conventional": "18.4.3", "@jest/globals": "29.7.0", "@types/eslint": "8.44.9", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.10", "@types/prompts": "2.4.9", "@types/uuid": "9.0.7", jest: "29.7.0", nock: "13.4.0", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
 
 // src/runtime/controller.ts
 var { version } = packageJSON;

package/dist/lib/assets/networking.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"networking.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/networking.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAa1E;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAchE;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAoBlD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAoBzD"}
+{"version":3,"file":"networking.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/networking.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAa1E;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAchE;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAwBlD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAwBzD"}

package/dist/lib/assets/pods.d.ts

@@ -1,4 +1,5 @@
 /// <reference types="node" />
+import { V1EnvVar } from "@kubernetes/client-node";
 import { kind } from "kubernetes-fluent-client";
 import { Assets } from ".";
 /** Generate the pepr-system namespace */
@@ -11,6 +12,7 @@ export declare function watcher(assets: Assets, hash: string): {
         namespace: string;
         labels: {
             app: string;
+            "pepr.dev/controller": string;
         };
     };
     spec: {
@@ -21,12 +23,14 @@ export declare function watcher(assets: Assets, hash: string): {
         selector: {
             matchLabels: {
                 app: string;
+                "pepr.dev/controller": string;
             };
         };
         template: {
             metadata: {
                 labels: {
                     app: string;
+                    "pepr.dev/controller": string;
                 };
             };
             spec: {
@@ -68,10 +72,7 @@ export declare function watcher(assets: Assets, hash: string): {
                         mountPath: string;
                         readOnly: boolean;
                     }[];
-                    env: {
-                        name: string;
-                        value: string;
-                    }[];
+                    env: V1EnvVar[];
                 }[];
                 volumes: {
                     name: string;

package/dist/lib/assets/pods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pods.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/pods.ts"],"names":[],"mappings":";AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAGhD,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAG3B,yCAAyC;AACzC,eAAO,MAAM,SAAS,EAAE,IAAI,CAAC,SAI5B,CAAC;AAEF,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA2HnD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,UAAU,CAgHxE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAgBlF"}
+{"version":3,"file":"pods.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/pods.ts"],"names":[],"mappings":";AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAGhD,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAI3B,yCAAyC;AACzC,eAAO,MAAM,SAAS,EAAE,IAAI,CAAC,SAI5B,CAAC;AAEF,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA0HnD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,UAAU,CAgHxE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAgBlF"}

package/dist/lib/logger.d.ts

@@ -1,10 +1,3 @@
-declare const Log: import("pino").Logger<{
-    transport: {
-        target: string;
-        options: {
-            colorize: boolean;
-        };
-    } | undefined;
-}>;
+declare const Log: import("pino").Logger<never>;
 export default Log;
 //# sourceMappingURL=logger.d.ts.map

package/dist/lib/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAgBA,QAAA,MAAM,GAAG;;;;;;;EAEP,CAAC;AAMH,eAAe,GAAG,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAgBA,QAAA,MAAM,GAAG,8BAEP,CAAC;AAMH,eAAe,GAAG,CAAC"}

package/dist/lib/module.d.ts

@@ -18,6 +18,8 @@ export type ModuleConfig = {
     alwaysIgnore: WebhookIgnore;
     /** Define the log level for the in-cluster controllers */
     logLevel?: string;
+    /** Propagate env variables to in-cluster controllers */
+    env?: Record<string, string>;
 };
 export type PackageJSON = {
     description: string;

package/dist/lib/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../src/lib/module.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAI1F,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG;IACzB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,YAAY,EAAE,aAAa,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,qHAAqH;IACrH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAE7C,6GAA6G;IAC7G,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,GAAG,gBAAgB,KAAK,IAAI,CAAC;CAC9D,CAAC;AAGF,eAAO,MAAM,WAAW,eAA+C,CAAC;AAGxE,eAAO,MAAM,WAAW,eAA0C,CAAC;AAEnE,eAAO,MAAM,SAAS,eAAwC,CAAC;AAE/D,qBAAa,UAAU;;IAGrB;;;;;;OAMG;gBACS,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,YAAY,GAAE,UAAU,EAAO,EAAE,IAAI,GAAE,iBAAsB;IAiD7G;;;;;OAKG;IACH,KAAK,0BAEH;CACH"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../src/lib/module.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAI1F,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG;IACzB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,YAAY,EAAE,aAAa,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,qHAAqH;IACrH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAE7C,6GAA6G;IAC7G,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,GAAG,gBAAgB,KAAK,IAAI,CAAC;CAC9D,CAAC;AAGF,eAAO,MAAM,WAAW,eAA+C,CAAC;AAGxE,eAAO,MAAM,WAAW,eAA0C,CAAC;AAEnE,eAAO,MAAM,SAAS,eAAwC,CAAC;AAE/D,qBAAa,UAAU;;IAGrB;;;;;;OAMG;gBACS,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,YAAY,GAAE,UAAU,EAAO,EAAE,IAAI,GAAE,iBAAsB;IAiD7G;;;;;OAKG;IACH,KAAK,0BAEH;CACH"}

package/dist/lib.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/lib.ts", "../src/lib/capability.ts", "../src/lib/logger.ts", "../src/lib/module.ts", "../src/lib/controller/index.ts", "../src/lib/metrics.ts", "../src/lib/mutate-processor.ts", "../src/lib/errors.ts", "../src/lib/k8s.ts", "../src/lib/filter.ts", "../src/lib/mutate-request.ts", "../src/lib/utils.ts", "../src/lib/validate-request.ts", "../src/lib/validate-processor.ts", "../src/lib/controller/store.ts", "../src/lib/watch-processor.ts", "../src/lib/storage.ts", "../src/lib/schedule.ts", "../src/lib/module-helpers.ts"],
-  "sourcesContent": ["import { K8s, RegisterKind, kind as a, fetch, fetchStatus, kind } from \"kubernetes-fluent-client\";\nimport * as R from \"ramda\";\n\nimport { Capability } from \"./lib/capability\";\nimport Log from \"./lib/logger\";\nimport { PeprModule } from \"./lib/module\";\nimport { PeprMutateRequest } from \"./lib/mutate-request\";\nimport * as PeprUtils from \"./lib/utils\";\nimport { PeprValidateRequest } from \"./lib/validate-request\";\nimport { containers } from \"./lib/module-helpers\";\n\nexport {\n  Capability,\n  K8s,\n  Log,\n  PeprModule,\n  PeprMutateRequest,\n  PeprUtils,\n  PeprValidateRequest,\n  R,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n  containers,\n};\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { GenericClass, GroupVersionKind, modelToGroupVersionKind } from \"kubernetes-fluent-client\";\nimport { WatchAction } from \"kubernetes-fluent-client/dist/fluent/types\";\nimport { pickBy } from \"ramda\";\n\nimport Log from \"./logger\";\nimport { isBuildMode, isDevMode, isWatchMode } from \"./module\";\nimport { PeprStore, Storage } from \"./storage\";\nimport { OnSchedule, Schedule } from \"./schedule\";\nimport {\n  Binding,\n  BindingFilter,\n  BindingWithName,\n  CapabilityCfg,\n  CapabilityExport,\n  Event,\n  MutateAction,\n  MutateActionChain,\n  ValidateAction,\n  ValidateActionChain,\n  WhenSelector,\n} from \"./types\";\n\nconst registerAdmission = isBuildMode() || !isWatchMode();\nconst registerWatch = isBuildMode() || isWatchMode() || isDevMode();\n\n/**\n * A capability is a unit of functionality that can be registered with the Pepr runtime.\n */\nexport class Capability implements CapabilityExport {\n  #name: string;\n  #description: string;\n  #namespaces?: string[] | undefined;\n  #bindings: Binding[] = [];\n  #store = new Storage();\n  #scheduleStore = new Storage();\n  #registered = false;\n  #scheduleRegistered = false;\n  hasSchedule: boolean;\n\n  /**\n   * Run code on a schedule with the capability.\n   *\n   * @param schedule The schedule to run the code on\n   * @returns\n   */\n  OnSchedule: (schedule: Schedule) => void = (schedule: Schedule) => {\n    const { name, every, unit, run, startTime, completions } = schedule;\n    this.hasSchedule = true;\n\n    if (process.env.PEPR_WATCH_MODE === \"true\") {\n      // Only create/watch schedule store if necessary\n\n      // Create a new schedule\n      const newSchedule: Schedule = {\n        name,\n        every,\n        unit,\n        run,\n        startTime,\n        completions,\n      };\n\n      this.#scheduleStore.onReady(() => {\n        new OnSchedule(newSchedule).setStore(this.#scheduleStore);\n      });\n    }\n  };\n\n  /**\n   * Store is a key-value data store that can be used to persist data that should be shared\n   * between requests. Each capability has its own store, and the data is persisted in Kubernetes\n   * in the `pepr-system` namespace.\n   *\n   * Note: You should only access the store from within an action.\n   */\n  Store: PeprStore = {\n    clear: this.#store.clear,\n    getItem: this.#store.getItem,\n    removeItem: this.#store.removeItem,\n    setItem: this.#store.setItem,\n    subscribe: this.#store.subscribe,\n    onReady: this.#store.onReady,\n    setItemAndWait: this.#store.setItemAndWait,\n  };\n\n  /**\n   * ScheduleStore is a key-value data store used to persist schedule data that should be shared\n   * between intervals. Each Schedule shares store, and the data is persisted in Kubernetes\n   * in the `pepr-system` namespace.\n   *\n   * Note: There is no direct access to schedule store\n   */\n  ScheduleStore: PeprStore = {\n    clear: this.#scheduleStore.clear,\n    getItem: this.#scheduleStore.getItem,\n    removeItem: this.#scheduleStore.removeItem,\n    setItemAndWait: this.#scheduleStore.setItemAndWait,\n    setItem: this.#scheduleStore.setItem,\n    subscribe: this.#scheduleStore.subscribe,\n    onReady: this.#scheduleStore.onReady,\n  };\n\n  get bindings() {\n    return this.#bindings;\n  }\n\n  get name() {\n    return this.#name;\n  }\n\n  get description() {\n    return this.#description;\n  }\n\n  get namespaces() {\n    return this.#namespaces || [];\n  }\n\n  constructor(cfg: CapabilityCfg) {\n    this.#name = cfg.name;\n    this.#description = cfg.description;\n    this.#namespaces = cfg.namespaces;\n    this.hasSchedule = false;\n\n    Log.info(`Capability ${this.#name} registered`);\n    Log.debug(cfg);\n  }\n\n  /**\n   * Register the store with the capability. This is called automatically by the Pepr controller.\n   *\n   * @param store\n   */\n  registerScheduleStore = () => {\n    Log.info(`Registering schedule store for ${this.#name}`);\n\n    if (this.#scheduleRegistered) {\n      throw new Error(`Schedule store already registered for ${this.#name}`);\n    }\n\n    this.#scheduleRegistered = true;\n\n    // Pass back any ready callback to the controller\n    return {\n      scheduleStore: this.#scheduleStore,\n    };\n  };\n\n  /**\n   * Register the store with the capability. This is called automatically by the Pepr controller.\n   *\n   * @param store\n   */\n  registerStore = () => {\n    Log.info(`Registering store for ${this.#name}`);\n\n    if (this.#registered) {\n      throw new Error(`Store already registered for ${this.#name}`);\n    }\n\n    this.#registered = true;\n\n    // Pass back any ready callback to the controller\n    return {\n      store: this.#store,\n    };\n  };\n\n  /**\n   * The When method is used to register a action to be executed when a Kubernetes resource is\n   * processed by Pepr. The action will be executed if the resource matches the specified kind and any\n   * filters that are applied.\n   *\n   * @param model the KubernetesObject model to match\n   * @param kind if using a custom KubernetesObject not available in `a.*`, specify the GroupVersionKind\n   * @returns\n   */\n  When = <T extends GenericClass>(model: T, kind?: GroupVersionKind): WhenSelector<T> => {\n    const matchedKind = modelToGroupVersionKind(model.name);\n\n    // If the kind is not specified and the model is not a KubernetesObject, throw an error\n    if (!matchedKind && !kind) {\n      throw new Error(`Kind not specified for ${model.name}`);\n    }\n\n    const binding: Binding = {\n      model,\n      // If the kind is not specified, use the matched kind from the model\n      kind: kind || matchedKind,\n      event: Event.Any,\n      filters: {\n        name: \"\",\n        namespaces: [],\n        labels: {},\n        annotations: {},\n      },\n    };\n\n    const bindings = this.#bindings;\n    const prefix = `${this.#name}: ${model.name}`;\n    const commonChain = { WithLabel, WithAnnotation, Mutate, Validate, Watch };\n    const isNotEmpty = (value: object) => Object.keys(value).length > 0;\n    const log = (message: string, cbString: string) => {\n      const filteredObj = pickBy(isNotEmpty, binding.filters);\n\n      Log.info(`${message} configured for ${binding.event}`, prefix);\n      Log.info(filteredObj, prefix);\n      Log.debug(cbString, prefix);\n    };\n\n    function Validate(validateCallback: ValidateAction<T>): ValidateActionChain<T> {\n      if (registerAdmission) {\n        log(\"Validate Action\", validateCallback.toString());\n\n        // Push the binding to the list of bindings for this capability as a new BindingAction\n        // with the callback function to preserve\n        bindings.push({\n          ...binding,\n          isValidate: true,\n          validateCallback,\n        });\n      }\n\n      return { Watch };\n    }\n\n    function Mutate(mutateCallback: MutateAction<T>): MutateActionChain<T> {\n      if (registerAdmission) {\n        log(\"Mutate Action\", mutateCallback.toString());\n\n        // Push the binding to the list of bindings for this capability as a new BindingAction\n        // with the callback function to preserve\n        bindings.push({\n          ...binding,\n          isMutate: true,\n          mutateCallback,\n        });\n      }\n\n      // Now only allow adding actions to the same binding\n      return { Watch, Validate };\n    }\n\n    function Watch(watchCallback: WatchAction<T>) {\n      if (registerWatch) {\n        log(\"Watch Action\", watchCallback.toString());\n\n        bindings.push({\n          ...binding,\n          isWatch: true,\n          watchCallback,\n        });\n      }\n    }\n\n    function InNamespace(...namespaces: string[]): BindingWithName<T> {\n      Log.debug(`Add namespaces filter ${namespaces}`, prefix);\n      binding.filters.namespaces.push(...namespaces);\n      return { ...commonChain, WithName };\n    }\n\n    function WithName(name: string): BindingFilter<T> {\n      Log.debug(`Add name filter ${name}`, prefix);\n      binding.filters.name = name;\n      return commonChain;\n    }\n\n    function WithLabel(key: string, value = \"\"): BindingFilter<T> {\n      Log.debug(`Add label filter ${key}=${value}`, prefix);\n      binding.filters.labels[key] = value;\n      return commonChain;\n    }\n\n    function WithAnnotation(key: string, value = \"\"): BindingFilter<T> {\n      Log.debug(`Add annotation filter ${key}=${value}`, prefix);\n      binding.filters.annotations[key] = value;\n      return commonChain;\n    }\n\n    function bindEvent(event: Event) {\n      binding.event = event;\n      return {\n        ...commonChain,\n        InNamespace,\n        WithName,\n      };\n    }\n\n    return {\n      IsCreatedOrUpdated: () => bindEvent(Event.CreateOrUpdate),\n      IsCreated: () => bindEvent(Event.Create),\n      IsUpdated: () => bindEvent(Event.Update),\n      IsDeleted: () => bindEvent(Event.Delete),\n    };\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { pino } from \"pino\";\n\nconst isPrettyLog = process.env.PEPR_PRETTY_LOGS === \"true\";\n\nconst pretty = {\n  target: \"pino-pretty\",\n  options: {\n    colorize: true,\n  },\n};\n\nconst transport = isPrettyLog ? pretty : undefined;\n\nconst Log = pino({\n  transport,\n});\n\nif (process.env.LOG_LEVEL) {\n  Log.level = process.env.LOG_LEVEL;\n}\n\nexport default Log;\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { clone } from \"ramda\";\n\nimport { Capability } from \"./capability\";\nimport { Controller } from \"./controller\";\nimport { ValidateError } from \"./errors\";\nimport { AdmissionRequest, MutateResponse, ValidateResponse, WebhookIgnore } from \"./k8s\";\nimport { CapabilityExport } from \"./types\";\nimport { setupWatch } from \"./watch-processor\";\n\n/** Global configuration for the Pepr runtime. */\nexport type ModuleConfig = {\n  /** The user-defined name for the module */\n  name: string;\n  /** The Pepr version this module uses */\n  peprVersion?: string;\n  /** The user-defined version of the module */\n  appVersion?: string;\n  /** A unique identifier for this Pepr module. This is automatically generated by Pepr. */\n  uuid: string;\n  /** A description of the Pepr module and what it does. */\n  description?: string;\n  /** Reject K8s resource AdmissionRequests on error. */\n  onError?: string;\n  /** Configure global exclusions that will never be processed by Pepr. */\n  alwaysIgnore: WebhookIgnore;\n  /** Define the log level for the in-cluster controllers */\n  logLevel?: string;\n};\n\nexport type PackageJSON = {\n  description: string;\n  pepr: ModuleConfig;\n};\n\nexport type PeprModuleOptions = {\n  deferStart?: boolean;\n\n  /** A user-defined callback to pre-process or intercept a Pepr request from K8s immediately before it is processed */\n  beforeHook?: (req: AdmissionRequest) => void;\n\n  /** A user-defined callback to post-process or intercept a Pepr response just before it is returned to K8s */\n  afterHook?: (res: MutateResponse | ValidateResponse) => void;\n};\n\n// Track if this is a watch mode controller\nexport const isWatchMode = () => process.env.PEPR_WATCH_MODE === \"true\";\n\n// Track if Pepr is running in build mode\nexport const isBuildMode = () => process.env.PEPR_MODE === \"build\";\n\nexport const isDevMode = () => process.env.PEPR_MODE === \"dev\";\n\nexport class PeprModule {\n  #controller!: Controller;\n\n  /**\n   * Create a new Pepr runtime\n   *\n   * @param config The configuration for the Pepr runtime\n   * @param capabilities The capabilities to be loaded into the Pepr runtime\n   * @param opts Options for the Pepr runtime\n   */\n  constructor({ description, pepr }: PackageJSON, capabilities: Capability[] = [], opts: PeprModuleOptions = {}) {\n    const config: ModuleConfig = clone(pepr);\n    config.description = description;\n\n    // Need to validate at runtime since TS gets sad about parsing the package.json\n    ValidateError(config.onError);\n\n    // Handle build mode\n    if (isBuildMode()) {\n      // Fail if process.send is not defined\n      if (!process.send) {\n        throw new Error(\"process.send is not defined\");\n      }\n\n      const exportedCapabilities: CapabilityExport[] = [];\n\n      // Send capability map to parent process\n      for (const capability of capabilities) {\n        // Convert the capability to a capability config\n        exportedCapabilities.push({\n          name: capability.name,\n          description: capability.description,\n          namespaces: capability.namespaces,\n          bindings: capability.bindings,\n          hasSchedule: capability.hasSchedule,\n        });\n      }\n\n      // Send the capabilities back to the parent process\n      process.send(exportedCapabilities);\n\n      return;\n    }\n\n    this.#controller = new Controller(config, capabilities, opts.beforeHook, opts.afterHook, () => {\n      // Wait for the controller to be ready before setting up watches\n      if (isWatchMode() || isDevMode()) {\n        setupWatch(capabilities);\n      }\n    });\n\n    // Stop processing if deferStart is set to true\n    if (opts.deferStart) {\n      return;\n    }\n\n    this.start();\n  }\n\n  /**\n   * Start the Pepr runtime manually.\n   * Normally this is called automatically when the Pepr module is instantiated, but can be called manually if `deferStart` is set to `true` in the constructor.\n   *\n   * @param port\n   */\n  start = (port = 3000) => {\n    this.#controller.startServer(port);\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport express, { NextFunction } from \"express\";\nimport fs from \"fs\";\nimport https from \"https\";\n\nimport { Capability } from \"../capability\";\nimport { MutateResponse, AdmissionRequest, ValidateResponse } from \"../k8s\";\nimport Log from \"../logger\";\nimport { MetricsCollector } from \"../metrics\";\nimport { ModuleConfig, isWatchMode } from \"../module\";\nimport { mutateProcessor } from \"../mutate-processor\";\nimport { validateProcessor } from \"../validate-processor\";\nimport { PeprControllerStore } from \"./store\";\nimport { ResponseItem } from \"../types\";\n\nexport class Controller {\n  // Track whether the server is running\n  #running = false;\n\n  // Metrics collector\n  #metricsCollector = new MetricsCollector(\"pepr\");\n\n  // The token used to authenticate requests\n  #token = \"\";\n\n  // The express app instance\n  readonly #app = express();\n\n  // Initialized with the constructor\n  readonly #config: ModuleConfig;\n  readonly #capabilities: Capability[];\n  readonly #beforeHook?: (req: AdmissionRequest) => void;\n  readonly #afterHook?: (res: MutateResponse) => void;\n\n  constructor(\n    config: ModuleConfig,\n    capabilities: Capability[],\n    beforeHook?: (req: AdmissionRequest) => void,\n    afterHook?: (res: MutateResponse) => void,\n    onReady?: () => void,\n  ) {\n    this.#config = config;\n    this.#capabilities = capabilities;\n\n    // Initialize the Pepr store for each capability\n    new PeprControllerStore(config, capabilities, `pepr-${config.uuid}-store`, () => {\n      this.#bindEndpoints();\n      onReady && onReady();\n      Log.info(\"\u2705 Controller startup complete\");\n      // Initialize the schedule store for each capability\n      new PeprControllerStore(config, capabilities, `pepr-${config.uuid}-schedule`, () => {\n        Log.info(\"\u2705 Scheduling processed\");\n      });\n    });\n\n    // Middleware for logging requests\n    this.#app.use(Controller.#logger);\n\n    // Middleware for parsing JSON, limit to 2mb vs 100K for K8s compatibility\n    this.#app.use(express.json({ limit: \"2mb\" }));\n\n    if (beforeHook) {\n      Log.info(`Using beforeHook: ${beforeHook}`);\n      this.#beforeHook = beforeHook;\n    }\n\n    if (afterHook) {\n      Log.info(`Using afterHook: ${afterHook}`);\n      this.#afterHook = afterHook;\n    }\n  }\n\n  /** Start the webhook server */\n  startServer = (port: number) => {\n    if (this.#running) {\n      throw new Error(\"Cannot start Pepr module: Pepr module was not instantiated with deferStart=true\");\n    }\n\n    // Load SSL certificate and key\n    const options = {\n      key: fs.readFileSync(process.env.SSL_KEY_PATH || \"/etc/certs/tls.key\"),\n      cert: fs.readFileSync(process.env.SSL_CERT_PATH || \"/etc/certs/tls.crt\"),\n    };\n\n    // Get the API token if not in watch mode\n    if (!isWatchMode()) {\n      // Get the API token from the environment variable or the mounted secret\n      this.#token = process.env.PEPR_API_TOKEN || fs.readFileSync(\"/app/api-token/value\").toString().trim();\n      Log.info(`Using API token: ${this.#token}`);\n\n      if (!this.#token) {\n        throw new Error(\"API token not found\");\n      }\n    }\n\n    // Create HTTPS server\n    const server = https.createServer(options, this.#app).listen(port);\n\n    // Handle server listening event\n    server.on(\"listening\", () => {\n      Log.info(`Server listening on port ${port}`);\n      // Track that the server is running\n      this.#running = true;\n    });\n\n    // Handle EADDRINUSE errors\n    server.on(\"error\", (e: { code: string }) => {\n      if (e.code === \"EADDRINUSE\") {\n        Log.warn(\n          `Address in use, retrying in 2 seconds. If this persists, ensure ${port} is not in use, e.g. \"lsof -i :${port}\"`,\n        );\n        setTimeout(() => {\n          server.close();\n          server.listen(port);\n        }, 2000);\n      }\n    });\n\n    // Listen for the SIGTERM signal and gracefully close the server\n    process.on(\"SIGTERM\", () => {\n      Log.info(\"Received SIGTERM, closing server\");\n      server.close(() => {\n        Log.info(\"Server closed\");\n        process.exit(0);\n      });\n    });\n  };\n\n  #bindEndpoints = () => {\n    // Health check endpoint\n    this.#app.get(\"/healthz\", Controller.#healthz);\n\n    // Metrics endpoint\n    this.#app.get(\"/metrics\", this.#metrics);\n\n    if (isWatchMode()) {\n      return;\n    }\n\n    // Require auth for webhook endpoints\n    this.#app.use([\"/mutate/:token\", \"/validate/:token\"], this.#validateToken);\n\n    // Mutate endpoint\n    this.#app.post(\"/mutate/:token\", this.#admissionReq(\"Mutate\"));\n\n    // Validate endpoint\n    this.#app.post(\"/validate/:token\", this.#admissionReq(\"Validate\"));\n  };\n\n  /**\n   * Validate the token in the request path\n   *\n   * @param req The incoming request\n   * @param res The outgoing response\n   * @param next The next middleware function\n   * @returns\n   */\n  #validateToken = (req: express.Request, res: express.Response, next: NextFunction) => {\n    // Validate the token\n    const { token } = req.params;\n    if (token !== this.#token) {\n      const err = `Unauthorized: invalid token '${token.replace(/[^\\w]/g, \"_\")}'`;\n      Log.warn(err);\n      res.status(401).send(err);\n      this.#metricsCollector.alert();\n      return;\n    }\n\n    // Token is valid, continue\n    next();\n  };\n\n  /**\n   * Metrics endpoint handler\n   *\n   * @param req the incoming request\n   * @param res the outgoing response\n   */\n  #metrics = async (req: express.Request, res: express.Response) => {\n    try {\n      res.send(await this.#metricsCollector.getMetrics());\n    } catch (err) {\n      Log.error(err);\n      res.status(500).send(\"Internal Server Error\");\n    }\n  };\n\n  /**\n   * Admission request handler for both mutate and validate requests\n   *\n   * @param admissionKind the type of admission request\n   * @returns the request handler\n   */\n  #admissionReq = (admissionKind: \"Mutate\" | \"Validate\") => {\n    // Create the admission request handler\n    return async (req: express.Request, res: express.Response) => {\n      // Start the metrics timer\n      const startTime = MetricsCollector.observeStart();\n\n      try {\n        // Get the request from the body or create an empty request\n        const request: AdmissionRequest = req.body?.request || ({} as AdmissionRequest);\n\n        // Run the before hook if it exists\n        this.#beforeHook && this.#beforeHook(request || {});\n\n        // Setup identifiers for logging\n        const name = request?.name ? `/${request.name}` : \"\";\n        const namespace = request?.namespace || \"\";\n        const gvk = request?.kind || { group: \"\", version: \"\", kind: \"\" };\n\n        const reqMetadata = {\n          uid: request.uid,\n          namespace,\n          name,\n        };\n\n        Log.info({ ...reqMetadata, gvk, operation: request.operation, admissionKind }, \"Incoming request\");\n        Log.debug({ ...reqMetadata, request }, \"Incoming request body\");\n\n        // Process the request\n        let response: MutateResponse | ValidateResponse[];\n\n        // Call mutate or validate based on the admission kind\n        if (admissionKind === \"Mutate\") {\n          response = await mutateProcessor(this.#config, this.#capabilities, request, reqMetadata);\n        } else {\n          response = await validateProcessor(this.#capabilities, request, reqMetadata);\n        }\n\n        // Run the after hook if it exists\n        const responseList: ValidateResponse[] | MutateResponse[] = Array.isArray(response) ? response : [response];\n        responseList.map(res => {\n          this.#afterHook && this.#afterHook(res);\n          // Log the response\n          Log.debug({ ...reqMetadata, res }, \"Check response\");\n        });\n\n        let kubeAdmissionResponse: ValidateResponse[] | MutateResponse | ResponseItem;\n\n        if (admissionKind === \"Mutate\") {\n          kubeAdmissionResponse = response;\n          Log.debug({ ...reqMetadata, response }, \"Outgoing response\");\n          res.send({\n            apiVersion: \"admission.k8s.io/v1\",\n            kind: \"AdmissionReview\",\n            response: kubeAdmissionResponse,\n          });\n        } else {\n          kubeAdmissionResponse = {\n            uid: responseList[0].uid,\n            allowed: responseList.filter(r => !r.allowed).length === 0,\n            status: {\n              message: (responseList as ValidateResponse[])\n                .filter(rl => !rl.allowed)\n                .map(curr => curr.status?.message)\n                .join(\"; \"),\n            },\n          };\n          res.send({\n            apiVersion: \"admission.k8s.io/v1\",\n            kind: \"AdmissionReview\",\n            response: kubeAdmissionResponse,\n          });\n        }\n\n        Log.debug({ ...reqMetadata, kubeAdmissionResponse }, \"Outgoing response\");\n\n        this.#metricsCollector.observeEnd(startTime, admissionKind);\n      } catch (err) {\n        Log.error(err);\n        res.status(500).send(\"Internal Server Error\");\n        this.#metricsCollector.error();\n      }\n    };\n  };\n\n  /**\n   * Middleware for logging requests\n   *\n   * @param req the incoming request\n   * @param res the outgoing response\n   * @param next the next middleware function\n   */\n  static #logger(req: express.Request, res: express.Response, next: express.NextFunction) {\n    const startTime = Date.now();\n\n    res.on(\"finish\", () => {\n      const elapsedTime = Date.now() - startTime;\n      const message = {\n        uid: req.body?.request?.uid,\n        method: req.method,\n        url: req.originalUrl,\n        status: res.statusCode,\n        duration: `${elapsedTime} ms`,\n      };\n\n      res.statusCode >= 300 ? Log.warn(message) : Log.info(message);\n    });\n\n    next();\n  }\n  /**\n   * Health check endpoint handler\n   *\n   * @param req the incoming request\n   * @param res the outgoing response\n   */\n  static #healthz(req: express.Request, res: express.Response) {\n    try {\n      res.send(\"OK\");\n    } catch (err) {\n      Log.error(err);\n      res.status(500).send(\"Internal Server Error\");\n    }\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\n/* eslint-disable class-methods-use-this */\n\nimport { performance } from \"perf_hooks\";\nimport promClient, { Counter, Registry, Summary } from \"prom-client\";\nimport Log from \"./logger\";\n\nconst loggingPrefix = \"MetricsCollector\";\n\ninterface MetricNames {\n  errors: string;\n  alerts: string;\n  mutate: string;\n  validate: string;\n}\n\ninterface MetricArgs {\n  name: string;\n  help: string;\n  registers: Registry[];\n}\n\n/**\n * MetricsCollector class handles metrics collection using prom-client and performance hooks.\n */\nexport class MetricsCollector {\n  #registry: Registry;\n  #counters: Map<string, Counter<string>> = new Map();\n  #summaries: Map<string, Summary<string>> = new Map();\n  #prefix: string;\n\n  #metricNames: MetricNames = {\n    errors: \"errors\",\n    alerts: \"alerts\",\n    mutate: \"Mutate\",\n    validate: \"Validate\",\n  };\n\n  /**\n   * Creates a MetricsCollector instance with prefixed metrics.\n   * @param [prefix='pepr'] - The prefix for the metric names.\n   */\n  constructor(prefix = \"pepr\") {\n    this.#registry = new Registry();\n    this.#prefix = prefix;\n    this.addCounter(this.#metricNames.errors, \"Mutation/Validate errors encountered\");\n    this.addCounter(this.#metricNames.alerts, \"Mutation/Validate bad api token received\");\n    this.addSummary(this.#metricNames.mutate, \"Mutation operation summary\");\n    this.addSummary(this.#metricNames.validate, \"Validation operation summary\");\n  }\n\n  #getMetricName = (name: string) => `${this.#prefix}_${name}`;\n\n  #addMetric = <T extends Counter<string> | Summary<string>>(\n    collection: Map<string, T>,\n    MetricType: new (args: MetricArgs) => T,\n    name: string,\n    help: string,\n  ) => {\n    if (collection.has(this.#getMetricName(name))) {\n      Log.debug(`Metric for ${name} already exists`, loggingPrefix);\n      return;\n    }\n\n    const metric = new MetricType({\n      name: this.#getMetricName(name),\n      help,\n      registers: [this.#registry],\n    });\n\n    collection.set(this.#getMetricName(name), metric);\n  };\n\n  addCounter = (name: string, help: string) => {\n    this.#addMetric(this.#counters, promClient.Counter, name, help);\n  };\n\n  addSummary = (name: string, help: string) => {\n    this.#addMetric(this.#summaries, promClient.Summary, name, help);\n  };\n\n  incCounter = (name: string) => {\n    this.#counters.get(this.#getMetricName(name))?.inc();\n  };\n\n  /**\n   * Increments the error counter.\n   */\n  error = () => this.incCounter(this.#metricNames.errors);\n\n  /**\n   * Increments the alerts counter.\n   */\n  alert = () => this.incCounter(this.#metricNames.alerts);\n\n  /**\n   * Observes the duration since the provided start time and updates the summary.\n   * @param startTime - The start time.\n   * @param name - The metrics summary to increment.\n   */\n  observeEnd = (startTime: number, name: string = this.#metricNames.mutate) => {\n    this.#summaries.get(this.#getMetricName(name))?.observe(performance.now() - startTime);\n  };\n\n  /**\n   * Fetches the current metrics from the registry.\n   * @returns The metrics.\n   */\n  getMetrics = () => this.#registry.metrics();\n\n  /**\n   * Returns the current timestamp from performance.now() method. Useful for start timing an operation.\n   * @returns The timestamp.\n   */\n  static observeStart() {\n    return performance.now();\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport jsonPatch from \"fast-json-patch\";\nimport { kind } from \"kubernetes-fluent-client\";\n\nimport { Capability } from \"./capability\";\nimport { Errors } from \"./errors\";\nimport { shouldSkipRequest } from \"./filter\";\nimport { MutateResponse, AdmissionRequest } from \"./k8s\";\nimport Log from \"./logger\";\nimport { ModuleConfig } from \"./module\";\nimport { PeprMutateRequest } from \"./mutate-request\";\nimport { base64Encode, convertFromBase64Map, convertToBase64Map } from \"./utils\";\n\nexport async function mutateProcessor(\n  config: ModuleConfig,\n  capabilities: Capability[],\n  req: AdmissionRequest,\n  reqMetadata: Record<string, string>,\n): Promise<MutateResponse> {\n  const wrapped = new PeprMutateRequest(req);\n  const response: MutateResponse = {\n    uid: req.uid,\n    warnings: [],\n    allowed: false,\n  };\n\n  // Track whether any capability matched the request\n  let matchedAction = false;\n\n  // Track data fields that should be skipped during decoding\n  let skipDecode: string[] = [];\n\n  // If the resource is a secret, decode the data\n  const isSecret = req.kind.version == \"v1\" && req.kind.kind == \"Secret\";\n  if (isSecret) {\n    skipDecode = convertFromBase64Map(wrapped.Raw as unknown as kind.Secret);\n  }\n\n  Log.info(reqMetadata, `Processing request`);\n\n  for (const { name, bindings, namespaces } of capabilities) {\n    const actionMetadata = { ...reqMetadata, name };\n\n    for (const action of bindings) {\n      // Skip this action if it's not a mutate action\n      if (!action.mutateCallback) {\n        continue;\n      }\n\n      // Continue to the next action without doing anything if this one should be skipped\n      if (shouldSkipRequest(action, req, namespaces)) {\n        continue;\n      }\n\n      const label = action.mutateCallback.name;\n      Log.info(actionMetadata, `Processing matched action ${label}`);\n\n      matchedAction = true;\n\n      // Add annotations to the request to indicate that the capability started processing\n      // this will allow tracking of failed mutations that were permitted to continue\n      const updateStatus = (status: string) => {\n        // Only update the status if the request is a CREATE or UPDATE (we don't use CONNECT)\n        if (req.operation == \"DELETE\") {\n          return;\n        }\n\n        const identifier = `${config.uuid}.pepr.dev/${name}`;\n        wrapped.Raw.metadata = wrapped.Raw.metadata || {};\n        wrapped.Raw.metadata.annotations = wrapped.Raw.metadata.annotations || {};\n        wrapped.Raw.metadata.annotations[identifier] = status;\n      };\n\n      updateStatus(\"started\");\n\n      try {\n        // Run the action\n        await action.mutateCallback(wrapped);\n\n        Log.info(actionMetadata, `Action succeeded`);\n\n        // Add annotations to the request to indicate that the capability succeeded\n        updateStatus(\"succeeded\");\n      } catch (e) {\n        Log.warn(actionMetadata, `Action failed: ${e}`);\n        updateStatus(\"warning\");\n\n        // Annoying ts false positive\n        response.warnings = response.warnings || [];\n        response.warnings.push(`Action failed: ${e}`);\n\n        switch (config.onError) {\n          case Errors.reject:\n            Log.error(actionMetadata, `Action failed: ${e}`);\n            response.result = \"Pepr module configured to reject on error\";\n            return response;\n\n          case Errors.audit:\n            response.auditAnnotations = response.auditAnnotations || {};\n            response.auditAnnotations[Date.now()] = e;\n            break;\n        }\n      }\n    }\n  }\n\n  // If we've made it this far, the request is allowed\n  response.allowed = true;\n\n  // If no capability matched the request, exit early\n  if (!matchedAction) {\n    Log.info(reqMetadata, `No matching actions found`);\n    return response;\n  }\n\n  // delete operations can't be mutate, just return before the transformation\n  if (req.operation == \"DELETE\") {\n    return response;\n  }\n\n  const transformed = wrapped.Raw;\n\n  // Post-process the Secret requests to convert it back to the original format\n  if (isSecret) {\n    convertToBase64Map(transformed as unknown as kind.Secret, skipDecode);\n  }\n\n  // Compare the original request to the modified request to get the patches\n  const patches = jsonPatch.compare(req.object, transformed);\n\n  // Only add the patch if there are patches to apply\n  if (patches.length > 0) {\n    response.patchType = \"JSONPatch\";\n    // Webhook must be base64-encoded\n    // https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#response\n    response.patch = base64Encode(JSON.stringify(patches));\n  }\n\n  // Remove the warnings array if it's empty\n  if (response.warnings && response.warnings.length < 1) {\n    delete response.warnings;\n  }\n\n  Log.debug({ ...reqMetadata, patches }, `Patches generated`);\n\n  return response;\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nexport const Errors = {\n  audit: \"audit\",\n  ignore: \"ignore\",\n  reject: \"reject\",\n};\n\nexport const ErrorList = Object.values(Errors);\n\n/**\n * Validate the error or throw an error\n * @param error\n */\nexport function ValidateError(error = \"\") {\n  if (!ErrorList.includes(error)) {\n    throw new Error(`Invalid error: ${error}. Must be one of: ${ErrorList.join(\", \")}`);\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { GenericKind, GroupVersionKind, KubernetesObject, RegisterKind } from \"kubernetes-fluent-client\";\n\nexport enum Operation {\n  CREATE = \"CREATE\",\n  UPDATE = \"UPDATE\",\n  DELETE = \"DELETE\",\n  CONNECT = \"CONNECT\",\n}\n\n/**\n * PeprStore for internal use by Pepr. This is used to store arbitrary data in the cluster.\n */\nexport class PeprStore extends GenericKind {\n  declare data: {\n    [key: string]: string;\n  };\n}\n\nexport const peprStoreGVK = {\n  kind: \"PeprStore\",\n  version: \"v1\",\n  group: \"pepr.dev\",\n};\n\nRegisterKind(PeprStore, peprStoreGVK);\n\n/**\n * GroupVersionResource unambiguously identifies a resource. It doesn't anonymously include GroupVersion\n * to avoid automatic coercion. It doesn't use a GroupVersion to avoid custom marshalling\n */\nexport interface GroupVersionResource {\n  readonly group: string;\n  readonly version: string;\n  readonly resource: string;\n}\n\n/**\n * A Kubernetes admission request to be processed by a capability.\n */\nexport interface AdmissionRequest<T = KubernetesObject> {\n  /** UID is an identifier for the individual request/response. */\n  readonly uid: string;\n\n  /** Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) */\n  readonly kind: GroupVersionKind;\n\n  /** Resource is the fully-qualified resource being requested (for example, v1.pods) */\n  readonly resource: GroupVersionResource;\n\n  /** SubResource is the sub-resource being requested, if any (for example, \"status\" or \"scale\") */\n  readonly subResource?: string;\n\n  /** RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). */\n  readonly requestKind?: GroupVersionKind;\n\n  /** RequestResource is the fully-qualified resource of the original API request (for example, v1.pods). */\n  readonly requestResource?: GroupVersionResource;\n\n  /** RequestSubResource is the sub-resource of the original API request, if any (for example, \"status\" or \"scale\"). */\n  readonly requestSubResource?: string;\n\n  /**\n   * Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and\n   * rely on the server to generate the name. If that is the case, this method will return the empty string.\n   */\n  readonly name: string;\n\n  /** Namespace is the namespace associated with the request (if any). */\n  readonly namespace?: string;\n\n  /**\n   * Operation is the operation being performed. This may be different than the operation\n   * requested. e.g. a patch can result in either a CREATE or UPDATE Operation.\n   */\n  readonly operation: Operation;\n\n  /** UserInfo is information about the requesting user */\n  readonly userInfo: {\n    /** The name that uniquely identifies this user among all active users. */\n    username?: string;\n\n    /**\n     * A unique value that identifies this user across time. If this user is deleted\n     * and another user by the same name is added, they will have different UIDs.\n     */\n    uid?: string;\n\n    /** The names of groups this user is a part of. */\n    groups?: string[];\n\n    /** Any additional information provided by the authenticator. */\n    extra?: {\n      [key: string]: string[];\n    };\n  };\n\n  /** Object is the object from the incoming request prior to default values being applied */\n  readonly object: T;\n\n  /** OldObject is the existing object. Only populated for UPDATE or DELETE requests. */\n  readonly oldObject?: T;\n\n  /** DryRun indicates that modifications will definitely not be persisted for this request. Defaults to false. */\n  readonly dryRun?: boolean;\n\n  /**\n   * Options contains the options for the operation being performed.\n   * e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be\n   * different than the options the caller provided. e.g. for a patch request the performed\n   * Operation might be a CREATE, in which case the Options will a\n   * `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  readonly options?: any;\n}\n\nexport interface MutateResponse {\n  /** UID is an identifier for the individual request/response. This must be copied over from the corresponding AdmissionRequest. */\n  uid: string;\n\n  /** Allowed indicates whether or not the admission request was permitted. */\n  allowed: boolean;\n\n  /** Result contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\". */\n  result?: string;\n\n  /** The patch body. Currently we only support \"JSONPatch\" which implements RFC 6902. */\n  patch?: string;\n\n  /** The type of Patch. Currently we only allow \"JSONPatch\". */\n  patchType?: \"JSONPatch\";\n\n  /**\n   * AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).\n   *\n   * See https://kubernetes.io/docs/reference/labels-annotations-taints/audit-annotations/ for more information\n   */\n  auditAnnotations?: {\n    [key: string]: string;\n  };\n\n  /** warnings is a list of warning messages to return to the requesting API client. */\n  warnings?: string[];\n}\n\nexport interface ValidateResponse extends MutateResponse {\n  /** Status contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\". */\n  status?: {\n    /** A machine-readable description of why this operation is in the\n         \"Failure\" status. If this value is empty there is no information available. */\n    code: number;\n\n    /** A human-readable description of the status of this operation. */\n    message: string;\n  };\n}\n\nexport type WebhookIgnore = {\n  /**\n   * List of Kubernetes namespaces to always ignore.\n   * Any resources in these namespaces will be ignored by Pepr.\n   *\n   * Note: `kube-system` and `pepr-system` are always ignored.\n   */\n  namespaces?: string[];\n  /**\n   * List of Kubernetes labels to always ignore.\n   * Any resources with these labels will be ignored by Pepr.\n   *\n   * The example below will ignore any resources with the label `my-label=ulta-secret`:\n   * ```\n   * alwaysIgnore:\n   *   labels: [{ \"my-label\": \"ultra-secret\" }]\n   * ```\n   */\n  labels?: Record<string, string>[];\n};\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { AdmissionRequest, Operation } from \"./k8s\";\nimport logger from \"./logger\";\nimport { Binding, Event } from \"./types\";\n\n/**\n * shouldSkipRequest determines if a request should be skipped based on the binding filters.\n *\n * @param binding the action binding\n * @param req the incoming request\n * @returns\n */\nexport function shouldSkipRequest(binding: Binding, req: AdmissionRequest, capabilityNamespaces: string[]) {\n  const { group, kind, version } = binding.kind || {};\n  const { namespaces, labels, annotations, name } = binding.filters || {};\n  const operation = req.operation.toUpperCase();\n  // Use the old object if the request is a DELETE operation\n  const srcObject = operation === Operation.DELETE ? req.oldObject : req.object;\n  const { metadata } = srcObject || {};\n  const combinedNamespaces = [...namespaces, ...capabilityNamespaces];\n\n  // Test for matching operation\n  if (!binding.event.includes(operation) && !binding.event.includes(Event.Any)) {\n    return true;\n  }\n\n  // Test name first, since it's the most specific\n  if (name && name !== req.name) {\n    return true;\n  }\n\n  // Test for matching kinds\n  if (kind !== req.kind.kind) {\n    return true;\n  }\n\n  // Test for matching groups\n  if (group && group !== req.kind.group) {\n    return true;\n  }\n\n  // Test for matching versions\n  if (version && version !== req.kind.version) {\n    return true;\n  }\n\n  // Test for matching namespaces\n  if (combinedNamespaces.length && !combinedNamespaces.includes(req.namespace || \"\")) {\n    logger.debug(\"Namespace does not match\");\n    return true;\n  }\n\n  // Test for matching labels\n  for (const [key, value] of Object.entries(labels)) {\n    const testKey = metadata?.labels?.[key];\n\n    // First check if the label exists\n    if (!testKey) {\n      logger.debug(`Label ${key} does not exist`);\n      return true;\n    }\n\n    // Then check if the value matches, if specified\n    if (value && testKey !== value) {\n      logger.debug(`${testKey} does not match ${value}`);\n      return true;\n    }\n  }\n\n  // Test for matching annotations\n  for (const [key, value] of Object.entries(annotations)) {\n    const testKey = metadata?.annotations?.[key];\n\n    // First check if the annotation exists\n    if (!testKey) {\n      logger.debug(`Annotation ${key} does not exist`);\n      return true;\n    }\n\n    // Then check if the value matches, if specified\n    if (value && testKey !== value) {\n      logger.debug(`${testKey} does not match ${value}`);\n      return true;\n    }\n  }\n\n  // No failed filters, so we should not skip this request\n  return false;\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { KubernetesObject } from \"kubernetes-fluent-client\";\nimport { clone, mergeDeepRight } from \"ramda\";\n\nimport { AdmissionRequest, Operation } from \"./k8s\";\nimport { DeepPartial } from \"./types\";\n\n/**\n * The RequestWrapper class provides methods to modify Kubernetes objects in the context\n * of a mutating webhook request.\n */\nexport class PeprMutateRequest<T extends KubernetesObject> {\n  Raw: T;\n\n  #input: AdmissionRequest<T>;\n\n  get PermitSideEffects() {\n    return !this.#input.dryRun;\n  }\n\n  /**\n   * Indicates whether the request is a dry run.\n   * @returns true if the request is a dry run, false otherwise.\n   */\n  get IsDryRun() {\n    return this.#input.dryRun;\n  }\n\n  /**\n   * Provides access to the old resource in the request if available.\n   * @returns The old Kubernetes resource object or null if not available.\n   */\n  get OldResource() {\n    return this.#input.oldObject;\n  }\n\n  /**\n   * Provides access to the request object.\n   * @returns The request object containing the Kubernetes resource.\n   */\n  get Request() {\n    return this.#input;\n  }\n\n  /**\n   * Creates a new instance of the action class.\n   * @param input - The request object containing the Kubernetes resource to modify.\n   */\n  constructor(input: AdmissionRequest<T>) {\n    this.#input = input;\n\n    // If this is a DELETE operation, use the oldObject instead\n    if (input.operation.toUpperCase() === Operation.DELETE) {\n      this.Raw = clone(input.oldObject as T);\n    } else {\n      // Otherwise, use the incoming object\n      this.Raw = clone(input.object);\n    }\n\n    if (!this.Raw) {\n      throw new Error(\"unable to load the request object into PeprRequest.RawP\");\n    }\n  }\n\n  /**\n   * Deep merges the provided object with the current resource.\n   *\n   * @param obj - The object to merge with the current resource.\n   */\n  Merge = (obj: DeepPartial<T>) => {\n    this.Raw = mergeDeepRight(this.Raw, obj) as unknown as T;\n  };\n\n  /**\n   * Updates a label on the Kubernetes resource.\n   * @param key - The key of the label to update.\n   * @param value - The value of the label.\n   * @returns The current action instance for method chaining.\n   */\n  SetLabel = (key: string, value: string) => {\n    const ref = this.Raw;\n\n    ref.metadata = ref.metadata ?? {};\n    ref.metadata.labels = ref.metadata.labels ?? {};\n    ref.metadata.labels[key] = value;\n\n    return this;\n  };\n\n  /**\n   * Updates an annotation on the Kubernetes resource.\n   * @param key - The key of the annotation to update.\n   * @param value - The value of the annotation.\n   * @returns The current action instance for method chaining.\n   */\n  SetAnnotation = (key: string, value: string) => {\n    const ref = this.Raw;\n\n    ref.metadata = ref.metadata ?? {};\n    ref.metadata.annotations = ref.metadata.annotations ?? {};\n    ref.metadata.annotations[key] = value;\n\n    return this;\n  };\n\n  /**\n   * Removes a label from the Kubernetes resource.\n   * @param key - The key of the label to remove.\n   * @returns The current Action instance for method chaining.\n   */\n  RemoveLabel = (key: string) => {\n    if (this.Raw.metadata?.labels?.[key]) {\n      delete this.Raw.metadata.labels[key];\n    }\n\n    return this;\n  };\n\n  /**\n   * Removes an annotation from the Kubernetes resource.\n   * @param key - The key of the annotation to remove.\n   * @returns The current Action instance for method chaining.\n   */\n  RemoveAnnotation = (key: string) => {\n    if (this.Raw.metadata?.annotations?.[key]) {\n      delete this.Raw.metadata.annotations[key];\n    }\n\n    return this;\n  };\n\n  /**\n   * Check if a label exists on the Kubernetes resource.\n   *\n   * @param key the label key to check\n   * @returns\n   */\n  HasLabel = (key: string) => {\n    return this.Raw.metadata?.labels?.[key] !== undefined;\n  };\n\n  /**\n   * Check if an annotation exists on the Kubernetes resource.\n   *\n   * @param key the annotation key to check\n   * @returns\n   */\n  HasAnnotation = (key: string) => {\n    return this.Raw.metadata?.annotations?.[key] !== undefined;\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport Log from \"./logger\";\n\n/** Test if a string is ascii or not */\nexport const isAscii = /^[\\s\\x20-\\x7E]*$/;\n\n/**\n * Encode all ascii values in a map to base64\n * @param obj The object to encode\n * @param skip A list of keys to skip encoding\n */\nexport function convertToBase64Map(obj: { data?: Record<string, string> }, skip: string[]) {\n  obj.data = obj.data ?? {};\n  for (const key in obj.data) {\n    const value = obj.data[key];\n    // Only encode ascii values\n    obj.data[key] = skip.includes(key) ? value : base64Encode(value);\n  }\n}\n\n/**\n * Decode all ascii values in a map from base64 to utf-8\n * @param obj The object to decode\n * @returns A list of keys that were skipped\n */\nexport function convertFromBase64Map(obj: { data?: Record<string, string> }) {\n  const skip: string[] = [];\n\n  obj.data = obj.data ?? {};\n  for (const key in obj.data) {\n    if (obj.data[key] == undefined) {\n      obj.data[key] = \"\";\n    } else {\n      const decoded = base64Decode(obj.data[key]);\n      if (isAscii.test(decoded)) {\n        // Only decode ascii values\n        obj.data[key] = decoded;\n      } else {\n        skip.push(key);\n      }\n    }\n  }\n  Log.debug(`Non-ascii data detected in keys: ${skip}, skipping automatic base64 decoding`);\n  return skip;\n}\n\n/** Decode a base64 string */\nexport function base64Decode(data: string) {\n  return Buffer.from(data, \"base64\").toString(\"utf-8\");\n}\n\n/** Encode a string to base64 */\nexport function base64Encode(data: string) {\n  return Buffer.from(data).toString(\"base64\");\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\n/* eslint-disable class-methods-use-this */\n\nimport { KubernetesObject } from \"kubernetes-fluent-client\";\n\nimport { clone } from \"ramda\";\nimport { Operation, AdmissionRequest } from \"./k8s\";\nimport { ValidateActionResponse } from \"./types\";\n\n/**\n * The RequestWrapper class provides methods to modify Kubernetes objects in the context\n * of a mutating webhook request.\n */\nexport class PeprValidateRequest<T extends KubernetesObject> {\n  Raw: T;\n\n  #input: AdmissionRequest<T>;\n\n  /**\n   * Provides access to the old resource in the request if available.\n   * @returns The old Kubernetes resource object or null if not available.\n   */\n  get OldResource() {\n    return this.#input.oldObject;\n  }\n\n  /**\n   * Provides access to the request object.\n   * @returns The request object containing the Kubernetes resource.\n   */\n  get Request() {\n    return this.#input;\n  }\n\n  /**\n   * Creates a new instance of the Action class.\n   * @param input - The request object containing the Kubernetes resource to modify.\n   */\n  constructor(input: AdmissionRequest<T>) {\n    this.#input = input;\n\n    // If this is a DELETE operation, use the oldObject instead\n    if (input.operation.toUpperCase() === Operation.DELETE) {\n      this.Raw = clone(input.oldObject as T);\n    } else {\n      // Otherwise, use the incoming object\n      this.Raw = clone(input.object);\n    }\n\n    if (!this.Raw) {\n      throw new Error(\"unable to load the request object into PeprRequest.Raw\");\n    }\n  }\n\n  /**\n   * Check if a label exists on the Kubernetes resource.\n   *\n   * @param key the label key to check\n   * @returns\n   */\n  HasLabel = (key: string) => {\n    return this.Raw.metadata?.labels?.[key] !== undefined;\n  };\n\n  /**\n   * Check if an annotation exists on the Kubernetes resource.\n   *\n   * @param key the annotation key to check\n   * @returns\n   */\n  HasAnnotation = (key: string) => {\n    return this.Raw.metadata?.annotations?.[key] !== undefined;\n  };\n\n  /**\n   * Create a validation response that allows the request.\n   *\n   * @returns The validation response.\n   */\n  Approve = (): ValidateActionResponse => {\n    return {\n      allowed: true,\n    };\n  };\n\n  /**\n   * Create a validation response that denies the request.\n   *\n   * @param statusMessage Optional status message to return to the user.\n   * @param statusCode Optional status code to return to the user.\n   * @returns The validation response.\n   */\n  Deny = (statusMessage?: string, statusCode?: number): ValidateActionResponse => {\n    return {\n      allowed: false,\n      statusCode,\n      statusMessage,\n    };\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { kind } from \"kubernetes-fluent-client\";\n\nimport { Capability } from \"./capability\";\nimport { shouldSkipRequest } from \"./filter\";\nimport { AdmissionRequest, ValidateResponse } from \"./k8s\";\nimport Log from \"./logger\";\nimport { convertFromBase64Map } from \"./utils\";\nimport { PeprValidateRequest } from \"./validate-request\";\n\nexport async function validateProcessor(\n  capabilities: Capability[],\n  req: AdmissionRequest,\n  reqMetadata: Record<string, string>,\n): Promise<ValidateResponse[]> {\n  const wrapped = new PeprValidateRequest(req);\n  const response: ValidateResponse[] = [];\n\n  // If the resource is a secret, decode the data\n  const isSecret = req.kind.version == \"v1\" && req.kind.kind == \"Secret\";\n  if (isSecret) {\n    convertFromBase64Map(wrapped.Raw as unknown as kind.Secret);\n  }\n\n  Log.info(reqMetadata, `Processing validation request`);\n\n  for (const { name, bindings, namespaces } of capabilities) {\n    const actionMetadata = { ...reqMetadata, name };\n\n    for (const action of bindings) {\n      // Skip this action if it's not a validation action\n      if (!action.validateCallback) {\n        continue;\n      }\n\n      const localResponse: ValidateResponse = {\n        uid: req.uid,\n        allowed: true, // Assume it's allowed until a validation check fails\n      };\n\n      // Continue to the next action without doing anything if this one should be skipped\n      if (shouldSkipRequest(action, req, namespaces)) {\n        continue;\n      }\n\n      const label = action.validateCallback.name;\n      Log.info(actionMetadata, `Processing matched action ${label}`);\n\n      try {\n        // Run the validation callback, if it fails set allowed to false\n        const resp = await action.validateCallback(wrapped);\n        localResponse.allowed = resp.allowed;\n\n        // If the validation callback returned a status code or message, set it in the Response\n        if (resp.statusCode || resp.statusMessage) {\n          localResponse.status = {\n            code: resp.statusCode || 400,\n            message: resp.statusMessage || `Validation failed for ${name}`,\n          };\n        }\n\n        Log.info(actionMetadata, `Validation Action completed: ${resp.allowed ? \"allowed\" : \"denied\"}`);\n      } catch (e) {\n        // If any validation throws an error, note the failure in the Response\n        Log.error(actionMetadata, `Action failed: ${e}`);\n        localResponse.allowed = false;\n        localResponse.status = {\n          code: 500,\n          message: `Action failed with error: ${e}`,\n        };\n        return [localResponse];\n      }\n      response.push(localResponse);\n    }\n  }\n\n  return response;\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { Operation } from \"fast-json-patch\";\nimport { K8s } from \"kubernetes-fluent-client\";\nimport { startsWith } from \"ramda\";\n\nimport { Capability } from \"../capability\";\nimport { PeprStore } from \"../k8s\";\nimport Log from \"../logger\";\nimport { ModuleConfig } from \"../module\";\nimport { DataOp, DataSender, DataStore, Storage } from \"../storage\";\n\nconst namespace = \"pepr-system\";\nexport const debounceBackoff = 5000;\n\nexport class PeprControllerStore {\n  #name: string;\n  #stores: Record<string, Storage> = {};\n  #sendDebounce: NodeJS.Timeout | undefined;\n  #onReady?: () => void;\n\n  constructor(config: ModuleConfig, capabilities: Capability[], name: string, onReady?: () => void) {\n    this.#onReady = onReady;\n\n    // Setup Pepr State bindings\n    this.#name = name;\n\n    if (name.includes(\"schedule\")) {\n      // Establish the store for each capability\n      for (const { name, registerScheduleStore, hasSchedule } of capabilities) {\n        // Guard Clause to exit  early\n        if (hasSchedule !== true) {\n          continue;\n        }\n        // Register the scheduleStore with the capability\n        const { scheduleStore } = registerScheduleStore();\n\n        // Bind the store sender to the capability\n        scheduleStore.registerSender(this.#send(name));\n\n        // Store the storage instance\n        this.#stores[name] = scheduleStore;\n      }\n    } else {\n      // Establish the store for each capability\n      for (const { name, registerStore } of capabilities) {\n        // Register the store with the capability\n        const { store } = registerStore();\n\n        // Bind the store sender to the capability\n        store.registerSender(this.#send(name));\n\n        // Store the storage instance\n        this.#stores[name] = store;\n      }\n    }\n\n    // Add a jitter to the Store creation to avoid collisions\n    setTimeout(\n      () =>\n        K8s(PeprStore)\n          .InNamespace(namespace)\n          .Get(this.#name)\n          // If the get succeeds, setup the watch\n          .then(this.#setupWatch)\n          // Otherwise, create the resource\n          .catch(this.#createStoreResource),\n      Math.random() * 3000,\n    );\n  }\n\n  #setupWatch = () => {\n    void K8s(PeprStore, { name: this.#name, namespace }).Watch(this.#receive);\n  };\n\n  #receive = (store: PeprStore) => {\n    Log.debug(store, \"Pepr Store update\");\n\n    // Wrap the update in a debounced function\n    const debounced = () => {\n      // Base64 decode the data\n      const data: DataStore = store.data || {};\n\n      // Loop over each stored capability\n      for (const name of Object.keys(this.#stores)) {\n        // Get the prefix offset for the keys\n        const offset = `${name}-`.length;\n\n        // Get any keys that match the capability name prefix\n        const filtered: DataStore = {};\n\n        // Loop over each key in the secret\n        for (const key of Object.keys(data)) {\n          // Match on the capability name as a prefix\n          if (startsWith(name, key)) {\n            // Strip the prefix and store the value\n            filtered[key.slice(offset)] = data[key];\n          }\n        }\n\n        // Send the data to the receiver callback\n        this.#stores[name].receive(filtered);\n      }\n\n      // Call the onReady callback if this is the first time the secret has been read\n      if (this.#onReady) {\n        this.#onReady();\n        this.#onReady = undefined;\n      }\n    };\n\n    // Debounce the update to 1 second to avoid multiple rapid calls\n    clearTimeout(this.#sendDebounce);\n    this.#sendDebounce = setTimeout(debounced, debounceBackoff);\n  };\n\n  #send = (capabilityName: string) => {\n    const sendCache: Record<string, Operation> = {};\n\n    // Load the sendCache with patch operations\n    const fillCache = (op: DataOp, key: string[], val?: string) => {\n      if (op === \"add\") {\n        const path = `/data/${capabilityName}-${key}`;\n        const value = val || \"\";\n        const cacheIdx = [op, path, value].join(\":\");\n\n        // Add the operation to the cache\n        sendCache[cacheIdx] = { op, path, value };\n\n        return;\n      }\n\n      if (op === \"remove\") {\n        if (key.length < 1) {\n          throw new Error(`Key is required for REMOVE operation`);\n        }\n\n        for (const k of key) {\n          const path = `/data/${capabilityName}-${k}`;\n          const cacheIdx = [op, path].join(\":\");\n\n          // Add the operation to the cache\n          sendCache[cacheIdx] = { op, path };\n        }\n\n        return;\n      }\n\n      // If we get here, the operation is not supported\n      throw new Error(`Unsupported operation: ${op}`);\n    };\n\n    // Send the cached updates to the cluster\n    const flushCache = async () => {\n      const indexes = Object.keys(sendCache);\n      const payload = Object.values(sendCache);\n\n      // Loop over each key in the cache and delete it to avoid collisions with other sender calls\n      for (const idx of indexes) {\n        delete sendCache[idx];\n      }\n\n      try {\n        // Send the patch to the cluster\n        await K8s(PeprStore, { namespace, name: this.#name }).Patch(payload);\n      } catch (err) {\n        Log.error(err, \"Pepr store update failure\");\n\n        // On failure to update, re-add the operations to the cache to be retried\n        for (const idx of indexes) {\n          sendCache[idx] = payload[Number(idx)];\n        }\n      }\n    };\n\n    // Create a sender function for the capability to add/remove data from the store\n    const sender: DataSender = async (op: DataOp, key: string[], val?: string) => {\n      fillCache(op, key, val);\n    };\n\n    // Send any cached updates every debounceBackoff milliseconds\n    setInterval(() => {\n      if (Object.keys(sendCache).length > 0) {\n        Log.debug(sendCache, \"Sending updates to Pepr store\");\n        void flushCache();\n      }\n    }, debounceBackoff);\n\n    return sender;\n  };\n\n  #createStoreResource = async (e: unknown) => {\n    Log.info(`Pepr store not found, creating...`);\n    Log.debug(e);\n\n    try {\n      await K8s(PeprStore).Apply({\n        metadata: {\n          name: this.#name,\n          namespace,\n        },\n        data: {\n          // JSON Patch will die if the data is empty, so we need to add a placeholder\n          __pepr_do_not_delete__: \"k-thx-bye\",\n        },\n      });\n\n      // Now that the resource exists, setup the watch\n      this.#setupWatch();\n    } catch (err) {\n      Log.error(err, \"Failed to create Pepr store\");\n    }\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { K8s } from \"kubernetes-fluent-client\";\nimport { WatchPhase } from \"kubernetes-fluent-client/dist/fluent/types\";\n\nimport { WatchCfg } from \"kubernetes-fluent-client/dist/fluent/watch\";\nimport { Capability } from \"./capability\";\nimport Log from \"./logger\";\nimport { Binding, Event } from \"./types\";\n\nexport function setupWatch(capabilities: Capability[]) {\n  capabilities\n    .flatMap(c => c.bindings)\n    .filter(binding => binding.isWatch)\n    .forEach(runBinding);\n}\n\nasync function runBinding(binding: Binding) {\n  // Map the event to the watch phase\n  const eventToPhaseMap = {\n    [Event.Create]: [WatchPhase.Added],\n    [Event.Update]: [WatchPhase.Modified],\n    [Event.CreateOrUpdate]: [WatchPhase.Added, WatchPhase.Modified],\n    [Event.Delete]: [WatchPhase.Deleted],\n    [Event.Any]: [WatchPhase.Added, WatchPhase.Modified, WatchPhase.Deleted],\n  };\n\n  // Get the phases to match, default to any\n  const phaseMatch: WatchPhase[] = eventToPhaseMap[binding.event] || eventToPhaseMap[Event.Any];\n\n  const watchCfg: WatchCfg = {\n    retryMax: 3,\n    retryDelaySec: 5,\n    retryFail(e) {\n      // If failure continues, log and exit\n      Log.error(e, \"Watch failed after 3 attempts, giving up\");\n      process.exit(1);\n    },\n  };\n\n  // Watch the resource\n  await K8s(binding.model, binding.filters).Watch((obj, type) => {\n    // If the type matches the phase, call the watch callback\n    if (phaseMatch.includes(type)) {\n      try {\n        // This may be a promise, but we don't need to wait for it\n        void binding.watchCallback?.(obj, type);\n      } catch (e) {\n        // Errors in the watch callback should not crash the controller\n        Log.error(e, \"Error executing watch callback\");\n      }\n    }\n  }, watchCfg);\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { clone } from \"ramda\";\nimport Log from \"./logger\";\n\nexport type DataOp = \"add\" | \"remove\";\nexport type DataStore = Record<string, string>;\nexport type DataSender = (op: DataOp, keys: string[], value?: string) => void;\nexport type DataReceiver = (data: DataStore) => void;\nexport type Unsubscribe = () => void;\n\nconst MAX_WAIT_TIME = 15000;\nexport interface PeprStore {\n  /**\n   * Returns the current value associated with the given key, or null if the given key does not exist.\n   */\n  getItem(key: string): string | null;\n  /**\n   * Removes all key/value pairs, if there are any.\n   */\n  clear(): void;\n  /**\n   * Removes the key/value pair with the given key, if a key/value pair with the given key exists.\n   */\n  removeItem(key: string): void;\n  /**\n   * Sets the value of the pair identified by key to value, creating a new key/value pair if none existed for key previously.\n   */\n  setItem(key: string, value: string): void;\n\n  /**\n   * Subscribe to changes in the store. This API behaves similarly to the [Svelte Store API](https://vercel.com/docs/beginner-sveltekit/svelte-stores#using-the-store).\n   *\n   * @param listener - The callback to be invoked when the store changes.\n   * @returns A function to unsubscribe from the listener.\n   */\n  subscribe(listener: DataReceiver): Unsubscribe;\n\n  /**\n   * Register a function to be called when the store is ready.\n   */\n  onReady(callback: DataReceiver): void;\n\n  /**\n   * Sets the value of the pair identified by key to value, creating a new key/value pair if none existed for key previously.\n   * Resolves when the key/value show up in the store.\n   */\n  setItemAndWait(key: string, value: string): Promise<void>;\n}\n\n/**\n * A key-value data store that can be used to persist data that should be shared across Pepr controllers and capabilities.\n *\n * The API is similar to the [Storage API](https://developer.mozilla.org/docs/Web/API/Storage)\n */\nexport class Storage implements PeprStore {\n  #store: DataStore = {};\n  #send!: DataSender;\n  #subscribers: Record<number, DataReceiver> = {};\n  #subscriberId = 0;\n  #readyHandlers: DataReceiver[] = [];\n\n  registerSender = (send: DataSender) => {\n    this.#send = send;\n  };\n\n  receive = (data: DataStore) => {\n    Log.debug(data, `Pepr store data received`);\n    this.#store = data || {};\n\n    this.#onReady();\n\n    // Notify all subscribers\n    for (const idx in this.#subscribers) {\n      // Send a unique clone of the store to each subscriber\n      this.#subscribers[idx](clone(this.#store));\n    }\n  };\n\n  getItem = (key: string) => {\n    // Return null if the value is the empty string\n    return this.#store[key] || null;\n  };\n\n  clear = () => {\n    this.#dispatchUpdate(\"remove\", Object.keys(this.#store));\n  };\n\n  removeItem = (key: string) => {\n    this.#dispatchUpdate(\"remove\", [key]);\n  };\n\n  setItem = (key: string, value: string) => {\n    this.#dispatchUpdate(\"add\", [key], value);\n  };\n\n  /**\n   * Creates a promise and subscribes to the store, the promise resolves when\n   * the key and value are seen in the store.\n   *\n   * @param key - The key to add into the store\n   * @param value - The value of the key\n   * @returns\n   */\n  setItemAndWait = (key: string, value: string) => {\n    this.#dispatchUpdate(\"add\", [key], value);\n    return new Promise<void>((resolve, reject) => {\n      const unsubscribe = this.subscribe(data => {\n        if (data[key] === value) {\n          unsubscribe();\n          resolve();\n        }\n      });\n\n      // If promise has not resolved before MAX_WAIT_TIME reject\n      setTimeout(() => {\n        unsubscribe();\n        return reject();\n      }, MAX_WAIT_TIME);\n    });\n  };\n\n  subscribe = (subscriber: DataReceiver) => {\n    const idx = this.#subscriberId++;\n    this.#subscribers[idx] = subscriber;\n    return () => this.unsubscribe(idx);\n  };\n\n  onReady = (callback: DataReceiver) => {\n    this.#readyHandlers.push(callback);\n  };\n\n  /**\n   * Remove a subscriber from the list of subscribers.\n   * @param idx - The index of the subscriber to remove.\n   */\n  unsubscribe = (idx: number) => {\n    delete this.#subscribers[idx];\n  };\n\n  #onReady = () => {\n    // Notify all ready handlers with a clone of the store\n    for (const handler of this.#readyHandlers) {\n      handler(clone(this.#store));\n    }\n\n    // Make this a noop so that it can't be called again\n    this.#onReady = () => {};\n  };\n\n  /**\n   * Dispatch an update to the store and notify all subscribers.\n   * @param  op - The type of operation to perform.\n   * @param  keys - The keys to update.\n   * @param  [value] - The new value.\n   */\n  #dispatchUpdate = (op: DataOp, keys: string[], value?: string) => {\n    this.#send(op, keys, value);\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { PeprStore } from \"./storage\";\n\ntype Unit = \"seconds\" | \"second\" | \"minute\" | \"minutes\" | \"hours\" | \"hour\";\n\nexport interface Schedule {\n  /**\n   * * The name of the store\n   */\n  name: string;\n  /**\n   * The value associated with a unit of time\n   */\n  every: number;\n  /**\n   * The unit of time\n   */\n  unit: Unit;\n  /**\n   * The code to run\n   */\n  run: () => void;\n  /**\n   * The start time of the schedule\n   */\n  startTime?: Date | undefined;\n\n  /**\n   * The number of times the schedule has run\n   */\n  completions?: number | undefined;\n  /**\n   * Tje intervalID to clear the interval\n   */\n  intervalID?: NodeJS.Timeout;\n}\n\nexport class OnSchedule implements Schedule {\n  intervalId: NodeJS.Timeout | null = null;\n  store: PeprStore | undefined;\n  name!: string;\n  completions?: number | undefined;\n  every: number;\n  unit: Unit;\n  run!: () => void;\n  startTime?: Date | undefined;\n  duration: number | undefined;\n  lastTimestamp: Date | undefined;\n\n  constructor(schedule: Schedule) {\n    this.name = schedule.name;\n    this.run = schedule.run;\n    this.every = schedule.every;\n    this.unit = schedule.unit;\n    this.startTime = schedule?.startTime;\n    this.completions = schedule?.completions;\n  }\n  setStore(store: PeprStore) {\n    this.store = store;\n    this.startInterval();\n  }\n  startInterval() {\n    this.checkStore();\n    this.getDuration();\n    this.setupInterval();\n  }\n  /**\n   * Checks the store for this schedule and sets the values if it exists\n   * @returns\n   */\n  checkStore() {\n    const result = this.store && this.store.getItem(this.name);\n    if (result) {\n      const storedSchedule = JSON.parse(result);\n      this.completions = storedSchedule?.completions;\n      this.startTime = storedSchedule?.startTime;\n      this.lastTimestamp = storedSchedule?.lastTimestamp;\n    }\n  }\n\n  /**\n   * Saves the schedule to the store\n   * @returns\n   */\n  saveToStore() {\n    const schedule = {\n      completions: this.completions,\n      startTime: this.startTime,\n      lastTimestamp: new Date(),\n      name: this.name,\n    };\n    this.store && this.store.setItem(this.name, JSON.stringify(schedule));\n  }\n\n  /**\n   * Gets the durations in milliseconds\n   */\n  getDuration() {\n    switch (this.unit) {\n      case \"seconds\":\n        if (this.every < 10) throw new Error(\"10 Seconds in the smallest interval allowed\");\n        this.duration = 1000 * this.every;\n        break;\n      case \"minutes\":\n      case \"minute\":\n        this.duration = 1000 * 60 * this.every;\n        break;\n      case \"hours\":\n      case \"hour\":\n        this.duration = 1000 * 60 * 60 * this.every;\n        break;\n      default:\n        throw new Error(\"Invalid time unit\");\n    }\n  }\n\n  /**\n   * Sets up the interval\n   */\n  setupInterval() {\n    const now = new Date();\n    let delay: number | undefined;\n\n    if (this.lastTimestamp && this.startTime) {\n      this.startTime = undefined;\n    }\n\n    if (this.startTime) {\n      delay = this.startTime.getTime() - now.getTime();\n    } else if (this.lastTimestamp && this.duration) {\n      const lastTimestamp = new Date(this.lastTimestamp);\n      delay = this.duration - (now.getTime() - lastTimestamp.getTime());\n    }\n\n    if (delay === undefined || delay <= 0) {\n      this.start();\n    } else {\n      setTimeout(() => {\n        this.start();\n      }, delay);\n    }\n  }\n\n  /**\n   * Starts the interval\n   */\n  start() {\n    this.intervalId = setInterval(() => {\n      if (this.completions === 0) {\n        this.stop();\n        return;\n      } else {\n        this.run();\n\n        if (this.completions && this.completions !== 0) {\n          this.completions -= 1;\n        }\n        this.saveToStore();\n      }\n    }, this.duration);\n  }\n\n  /**\n   * Stops the interval\n   */\n  stop() {\n    if (this.intervalId) {\n      clearInterval(this.intervalId);\n      this.intervalId = null;\n    }\n    this.store && this.store.removeItem(this.name);\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { PeprValidateRequest } from \"./validate-request\";\nimport { PeprMutateRequest } from \"./mutate-request\";\nimport { a } from \"../lib\";\n\n// Returns all containers in the pod\nexport function containers(\n  request: PeprValidateRequest<a.Pod> | PeprMutateRequest<a.Pod>,\n  containerType?: \"containers\" | \"initContainers\" | \"ephemeralContainers\",\n) {\n  const containers = request.Raw.spec?.containers || [];\n  const initContainers = request.Raw.spec?.initContainers || [];\n  const ephemeralContainers = request.Raw.spec?.ephemeralContainers || [];\n\n  if (containerType === \"containers\") {\n    return containers;\n  }\n  if (containerType === \"initContainers\") {\n    return initContainers;\n  }\n  if (containerType === \"ephemeralContainers\") {\n    return ephemeralContainers;\n  }\n  return [...containers, ...initContainers, ...ephemeralContainers];\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4CAAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAC,mCAAuE;AACvE,QAAmB;;;ACEnB,IAAAC,mCAAwE;AAExE,IAAAC,gBAAuB;;;ACFvB,kBAAqB;AAErB,IAAM,cAAc,QAAQ,IAAI,qBAAqB;AAErD,IAAM,SAAS;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AAAA,IACP,UAAU;AAAA,EACZ;AACF;AAEA,IAAM,YAAY,cAAc,SAAS;AAEzC,IAAM,UAAM,kBAAK;AAAA,EACf;AACF,CAAC;AAED,IAAI,QAAQ,IAAI,WAAW;AACzB,MAAI,QAAQ,QAAQ,IAAI;AAC1B;AAEA,IAAO,iBAAQ;;;ACrBf,IAAAC,gBAAsB;;;ACAtB,qBAAsC;AACtC,gBAAe;AACf,mBAAkB;;;ACAlB,wBAA4B;AAC5B,yBAAuD;AAGvD,IAAM,gBAAgB;AAkBf,IAAM,mBAAN,MAAuB;AAAA,EAC5B;AAAA,EACA,YAA0C,oBAAI,IAAI;AAAA,EAClD,aAA2C,oBAAI,IAAI;AAAA,EACnD;AAAA,EAEA,eAA4B;AAAA,IAC1B,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,SAAS,QAAQ;AAC3B,SAAK,YAAY,IAAI,4BAAS;AAC9B,SAAK,UAAU;AACf,SAAK,WAAW,KAAK,aAAa,QAAQ,sCAAsC;AAChF,SAAK,WAAW,KAAK,aAAa,QAAQ,0CAA0C;AACpF,SAAK,WAAW,KAAK,aAAa,QAAQ,4BAA4B;AACtE,SAAK,WAAW,KAAK,aAAa,UAAU,8BAA8B;AAAA,EAC5E;AAAA,EAEA,iBAAiB,CAAC,SAAiB,GAAG,KAAK,OAAO,IAAI,IAAI;AAAA,EAE1D,aAAa,CACX,YACA,YACA,MACA,SACG;AACH,QAAI,WAAW,IAAI,KAAK,eAAe,IAAI,CAAC,GAAG;AAC7C,qBAAI,MAAM,cAAc,IAAI,mBAAmB,aAAa;AAC5D;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,WAAW;AAAA,MAC5B,MAAM,KAAK,eAAe,IAAI;AAAA,MAC9B;AAAA,MACA,WAAW,CAAC,KAAK,SAAS;AAAA,IAC5B,CAAC;AAED,eAAW,IAAI,KAAK,eAAe,IAAI,GAAG,MAAM;AAAA,EAClD;AAAA,EAEA,aAAa,CAAC,MAAc,SAAiB;AAC3C,SAAK,WAAW,KAAK,WAAW,mBAAAC,QAAW,SAAS,MAAM,IAAI;AAAA,EAChE;AAAA,EAEA,aAAa,CAAC,MAAc,SAAiB;AAC3C,SAAK,WAAW,KAAK,YAAY,mBAAAA,QAAW,SAAS,MAAM,IAAI;AAAA,EACjE;AAAA,EAEA,aAAa,CAAC,SAAiB;AAC7B,SAAK,UAAU,IAAI,KAAK,eAAe,IAAI,CAAC,GAAG,IAAI;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,MAAM,KAAK,WAAW,KAAK,aAAa,MAAM;AAAA;AAAA;AAAA;AAAA,EAKtD,QAAQ,MAAM,KAAK,WAAW,KAAK,aAAa,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtD,aAAa,CAAC,WAAmB,OAAe,KAAK,aAAa,WAAW;AAC3E,SAAK,WAAW,IAAI,KAAK,eAAe,IAAI,CAAC,GAAG,QAAQ,8BAAY,IAAI,IAAI,SAAS;AAAA,EACvF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa,MAAM,KAAK,UAAU,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1C,OAAO,eAAe;AACpB,WAAO,8BAAY,IAAI;AAAA,EACzB;AACF;;;ACpHA,6BAAsB;;;ACAf,IAAM,SAAS;AAAA,EACpB,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,IAAM,YAAY,OAAO,OAAO,MAAM;AAMtC,SAAS,cAAc,QAAQ,IAAI;AACxC,MAAI,CAAC,UAAU,SAAS,KAAK,GAAG;AAC9B,UAAM,IAAI,MAAM,kBAAkB,KAAK,qBAAqB,UAAU,KAAK,IAAI,CAAC,EAAE;AAAA,EACpF;AACF;;;AChBA,sCAA8E;AAYvE,IAAM,YAAN,cAAwB,4CAAY;AAI3C;AAEO,IAAM,eAAe;AAAA,EAC1B,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AACT;AAAA,IAEA,8CAAa,WAAW,YAAY;;;ACb7B,SAAS,kBAAkB,SAAkB,KAAuB,sBAAgC;AACzG,QAAM,EAAE,OAAO,MAAAC,OAAM,QAAQ,IAAI,QAAQ,QAAQ,CAAC;AAClD,QAAM,EAAE,YAAY,QAAQ,aAAa,KAAK,IAAI,QAAQ,WAAW,CAAC;AACtE,QAAM,YAAY,IAAI,UAAU,YAAY;AAE5C,QAAM,YAAY,sCAAiC,IAAI,YAAY,IAAI;AACvE,QAAM,EAAE,SAAS,IAAI,aAAa,CAAC;AACnC,QAAM,qBAAqB,CAAC,GAAG,YAAY,GAAG,oBAAoB;AAGlE,MAAI,CAAC,QAAQ,MAAM,SAAS,SAAS,KAAK,CAAC,QAAQ,MAAM,sBAAkB,GAAG;AAC5E,WAAO;AAAA,EACT;AAGA,MAAI,QAAQ,SAAS,IAAI,MAAM;AAC7B,WAAO;AAAA,EACT;AAGA,MAAIA,UAAS,IAAI,KAAK,MAAM;AAC1B,WAAO;AAAA,EACT;AAGA,MAAI,SAAS,UAAU,IAAI,KAAK,OAAO;AACrC,WAAO;AAAA,EACT;AAGA,MAAI,WAAW,YAAY,IAAI,KAAK,SAAS;AAC3C,WAAO;AAAA,EACT;AAGA,MAAI,mBAAmB,UAAU,CAAC,mBAAmB,SAAS,IAAI,aAAa,EAAE,GAAG;AAClF,mBAAO,MAAM,0BAA0B;AACvC,WAAO;AAAA,EACT;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAM,UAAU,UAAU,SAAS,GAAG;AAGtC,QAAI,CAAC,SAAS;AACZ,qBAAO,MAAM,SAAS,GAAG,iBAAiB;AAC1C,aAAO;AAAA,IACT;AAGA,QAAI,SAAS,YAAY,OAAO;AAC9B,qBAAO,MAAM,GAAG,OAAO,mBAAmB,KAAK,EAAE;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,WAAW,GAAG;AACtD,UAAM,UAAU,UAAU,cAAc,GAAG;AAG3C,QAAI,CAAC,SAAS;AACZ,qBAAO,MAAM,cAAc,GAAG,iBAAiB;AAC/C,aAAO;AAAA,IACT;AAGA,QAAI,SAAS,YAAY,OAAO;AAC9B,qBAAO,MAAM,GAAG,OAAO,mBAAmB,KAAK,EAAE;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AAGA,SAAO;AACT;;;ACtFA,mBAAsC;AAS/B,IAAM,oBAAN,MAAoD;AAAA,EACzD;AAAA,EAEA;AAAA,EAEA,IAAI,oBAAoB;AACtB,WAAO,CAAC,KAAK,OAAO;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAAc;AAChB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,UAAU;AACZ,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAA4B;AACtC,SAAK,SAAS;AAGd,QAAI,MAAM,UAAU,YAAY,6BAAwB;AACtD,WAAK,UAAM,oBAAM,MAAM,SAAc;AAAA,IACvC,OAAO;AAEL,WAAK,UAAM,oBAAM,MAAM,MAAM;AAAA,IAC/B;AAEA,QAAI,CAAC,KAAK,KAAK;AACb,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ,CAAC,QAAwB;AAC/B,SAAK,UAAM,6BAAe,KAAK,KAAK,GAAG;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,CAAC,KAAa,UAAkB;AACzC,UAAM,MAAM,KAAK;AAEjB,QAAI,WAAW,IAAI,YAAY,CAAC;AAChC,QAAI,SAAS,SAAS,IAAI,SAAS,UAAU,CAAC;AAC9C,QAAI,SAAS,OAAO,GAAG,IAAI;AAE3B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,CAAC,KAAa,UAAkB;AAC9C,UAAM,MAAM,KAAK;AAEjB,QAAI,WAAW,IAAI,YAAY,CAAC;AAChC,QAAI,SAAS,cAAc,IAAI,SAAS,eAAe,CAAC;AACxD,QAAI,SAAS,YAAY,GAAG,IAAI;AAEhC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc,CAAC,QAAgB;AAC7B,QAAI,KAAK,IAAI,UAAU,SAAS,GAAG,GAAG;AACpC,aAAO,KAAK,IAAI,SAAS,OAAO,GAAG;AAAA,IACrC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBAAmB,CAAC,QAAgB;AAClC,QAAI,KAAK,IAAI,UAAU,cAAc,GAAG,GAAG;AACzC,aAAO,KAAK,IAAI,SAAS,YAAY,GAAG;AAAA,IAC1C;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,CAAC,QAAgB;AAC1B,WAAO,KAAK,IAAI,UAAU,SAAS,GAAG,MAAM;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,CAAC,QAAgB;AAC/B,WAAO,KAAK,IAAI,UAAU,cAAc,GAAG,MAAM;AAAA,EACnD;AACF;;;ACxJA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMO,IAAM,UAAU;AAOhB,SAAS,mBAAmB,KAAwC,MAAgB;AACzF,MAAI,OAAO,IAAI,QAAQ,CAAC;AACxB,aAAW,OAAO,IAAI,MAAM;AAC1B,UAAM,QAAQ,IAAI,KAAK,GAAG;AAE1B,QAAI,KAAK,GAAG,IAAI,KAAK,SAAS,GAAG,IAAI,QAAQ,aAAa,KAAK;AAAA,EACjE;AACF;AAOO,SAAS,qBAAqB,KAAwC;AAC3E,QAAM,OAAiB,CAAC;AAExB,MAAI,OAAO,IAAI,QAAQ,CAAC;AACxB,aAAW,OAAO,IAAI,MAAM;AAC1B,QAAI,IAAI,KAAK,GAAG,KAAK,QAAW;AAC9B,UAAI,KAAK,GAAG,IAAI;AAAA,IAClB,OAAO;AACL,YAAM,UAAU,aAAa,IAAI,KAAK,GAAG,CAAC;AAC1C,UAAI,QAAQ,KAAK,OAAO,GAAG;AAEzB,YAAI,KAAK,GAAG,IAAI;AAAA,MAClB,OAAO;AACL,aAAK,KAAK,GAAG;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,iBAAI,MAAM,oCAAoC,IAAI,sCAAsC;AACxF,SAAO;AACT;AAGO,SAAS,aAAa,MAAc;AACzC,SAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,SAAS,OAAO;AACrD;AAGO,SAAS,aAAa,MAAc;AACzC,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,QAAQ;AAC5C;;;ALzCA,eAAsB,gBACpB,QACA,cACA,KACA,aACyB;AACzB,QAAM,UAAU,IAAI,kBAAkB,GAAG;AACzC,QAAM,WAA2B;AAAA,IAC/B,KAAK,IAAI;AAAA,IACT,UAAU,CAAC;AAAA,IACX,SAAS;AAAA,EACX;AAGA,MAAI,gBAAgB;AAGpB,MAAI,aAAuB,CAAC;AAG5B,QAAM,WAAW,IAAI,KAAK,WAAW,QAAQ,IAAI,KAAK,QAAQ;AAC9D,MAAI,UAAU;AACZ,iBAAa,qBAAqB,QAAQ,GAA6B;AAAA,EACzE;AAEA,iBAAI,KAAK,aAAa,oBAAoB;AAE1C,aAAW,EAAE,MAAM,UAAU,WAAW,KAAK,cAAc;AACzD,UAAM,iBAAiB,EAAE,GAAG,aAAa,KAAK;AAE9C,eAAW,UAAU,UAAU;AAE7B,UAAI,CAAC,OAAO,gBAAgB;AAC1B;AAAA,MACF;AAGA,UAAI,kBAAkB,QAAQ,KAAK,UAAU,GAAG;AAC9C;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,eAAe;AACpC,qBAAI,KAAK,gBAAgB,6BAA6B,KAAK,EAAE;AAE7D,sBAAgB;AAIhB,YAAM,eAAe,CAAC,WAAmB;AAEvC,YAAI,IAAI,aAAa,UAAU;AAC7B;AAAA,QACF;AAEA,cAAM,aAAa,GAAG,OAAO,IAAI,aAAa,IAAI;AAClD,gBAAQ,IAAI,WAAW,QAAQ,IAAI,YAAY,CAAC;AAChD,gBAAQ,IAAI,SAAS,cAAc,QAAQ,IAAI,SAAS,eAAe,CAAC;AACxE,gBAAQ,IAAI,SAAS,YAAY,UAAU,IAAI;AAAA,MACjD;AAEA,mBAAa,SAAS;AAEtB,UAAI;AAEF,cAAM,OAAO,eAAe,OAAO;AAEnC,uBAAI,KAAK,gBAAgB,kBAAkB;AAG3C,qBAAa,WAAW;AAAA,MAC1B,SAAS,GAAG;AACV,uBAAI,KAAK,gBAAgB,kBAAkB,CAAC,EAAE;AAC9C,qBAAa,SAAS;AAGtB,iBAAS,WAAW,SAAS,YAAY,CAAC;AAC1C,iBAAS,SAAS,KAAK,kBAAkB,CAAC,EAAE;AAE5C,gBAAQ,OAAO,SAAS;AAAA,UACtB,KAAK,OAAO;AACV,2BAAI,MAAM,gBAAgB,kBAAkB,CAAC,EAAE;AAC/C,qBAAS,SAAS;AAClB,mBAAO;AAAA,UAET,KAAK,OAAO;AACV,qBAAS,mBAAmB,SAAS,oBAAoB,CAAC;AAC1D,qBAAS,iBAAiB,KAAK,IAAI,CAAC,IAAI;AACxC;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,WAAS,UAAU;AAGnB,MAAI,CAAC,eAAe;AAClB,mBAAI,KAAK,aAAa,2BAA2B;AACjD,WAAO;AAAA,EACT;AAGA,MAAI,IAAI,aAAa,UAAU;AAC7B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,QAAQ;AAG5B,MAAI,UAAU;AACZ,uBAAmB,aAAuC,UAAU;AAAA,EACtE;AAGA,QAAM,UAAU,uBAAAC,QAAU,QAAQ,IAAI,QAAQ,WAAW;AAGzD,MAAI,QAAQ,SAAS,GAAG;AACtB,aAAS,YAAY;AAGrB,aAAS,QAAQ,aAAa,KAAK,UAAU,OAAO,CAAC;AAAA,EACvD;AAGA,MAAI,SAAS,YAAY,SAAS,SAAS,SAAS,GAAG;AACrD,WAAO,SAAS;AAAA,EAClB;AAEA,iBAAI,MAAM,EAAE,GAAG,aAAa,QAAQ,GAAG,mBAAmB;AAE1D,SAAO;AACT;;;AM7IA,IAAAC,gBAAsB;AAQf,IAAM,sBAAN,MAAsD;AAAA,EAC3D;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAAc;AAChB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,UAAU;AACZ,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAA4B;AACtC,SAAK,SAAS;AAGd,QAAI,MAAM,UAAU,YAAY,6BAAwB;AACtD,WAAK,UAAM,qBAAM,MAAM,SAAc;AAAA,IACvC,OAAO;AAEL,WAAK,UAAM,qBAAM,MAAM,MAAM;AAAA,IAC/B;AAEA,QAAI,CAAC,KAAK,KAAK;AACb,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,CAAC,QAAgB;AAC1B,WAAO,KAAK,IAAI,UAAU,SAAS,GAAG,MAAM;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,CAAC,QAAgB;AAC/B,WAAO,KAAK,IAAI,UAAU,cAAc,GAAG,MAAM;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAAU,MAA8B;AACtC,WAAO;AAAA,MACL,SAAS;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,CAAC,eAAwB,eAAgD;AAC9E,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;;;ACzFA,eAAsB,kBACpB,cACA,KACA,aAC6B;AAC7B,QAAM,UAAU,IAAI,oBAAoB,GAAG;AAC3C,QAAM,WAA+B,CAAC;AAGtC,QAAM,WAAW,IAAI,KAAK,WAAW,QAAQ,IAAI,KAAK,QAAQ;AAC9D,MAAI,UAAU;AACZ,yBAAqB,QAAQ,GAA6B;AAAA,EAC5D;AAEA,iBAAI,KAAK,aAAa,+BAA+B;AAErD,aAAW,EAAE,MAAM,UAAU,WAAW,KAAK,cAAc;AACzD,UAAM,iBAAiB,EAAE,GAAG,aAAa,KAAK;AAE9C,eAAW,UAAU,UAAU;AAE7B,UAAI,CAAC,OAAO,kBAAkB;AAC5B;AAAA,MACF;AAEA,YAAM,gBAAkC;AAAA,QACtC,KAAK,IAAI;AAAA,QACT,SAAS;AAAA;AAAA,MACX;AAGA,UAAI,kBAAkB,QAAQ,KAAK,UAAU,GAAG;AAC9C;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,iBAAiB;AACtC,qBAAI,KAAK,gBAAgB,6BAA6B,KAAK,EAAE;AAE7D,UAAI;AAEF,cAAM,OAAO,MAAM,OAAO,iBAAiB,OAAO;AAClD,sBAAc,UAAU,KAAK;AAG7B,YAAI,KAAK,cAAc,KAAK,eAAe;AACzC,wBAAc,SAAS;AAAA,YACrB,MAAM,KAAK,cAAc;AAAA,YACzB,SAAS,KAAK,iBAAiB,yBAAyB,IAAI;AAAA,UAC9D;AAAA,QACF;AAEA,uBAAI,KAAK,gBAAgB,gCAAgC,KAAK,UAAU,YAAY,QAAQ,EAAE;AAAA,MAChG,SAAS,GAAG;AAEV,uBAAI,MAAM,gBAAgB,kBAAkB,CAAC,EAAE;AAC/C,sBAAc,UAAU;AACxB,sBAAc,SAAS;AAAA,UACrB,MAAM;AAAA,UACN,SAAS,6BAA6B,CAAC;AAAA,QACzC;AACA,eAAO,CAAC,aAAa;AAAA,MACvB;AACA,eAAS,KAAK,aAAa;AAAA,IAC7B;AAAA,EACF;AAEA,SAAO;AACT;;;AC3EA,IAAAC,mCAAoB;AACpB,IAAAC,gBAA2B;AAQ3B,IAAM,YAAY;AACX,IAAM,kBAAkB;AAExB,IAAM,sBAAN,MAA0B;AAAA,EAC/B;AAAA,EACA,UAAmC,CAAC;AAAA,EACpC;AAAA,EACA;AAAA,EAEA,YAAY,QAAsB,cAA4B,MAAc,SAAsB;AAChG,SAAK,WAAW;AAGhB,SAAK,QAAQ;AAEb,QAAI,KAAK,SAAS,UAAU,GAAG;AAE7B,iBAAW,EAAE,MAAAC,OAAM,uBAAuB,YAAY,KAAK,cAAc;AAEvE,YAAI,gBAAgB,MAAM;AACxB;AAAA,QACF;AAEA,cAAM,EAAE,cAAc,IAAI,sBAAsB;AAGhD,sBAAc,eAAe,KAAK,MAAMA,KAAI,CAAC;AAG7C,aAAK,QAAQA,KAAI,IAAI;AAAA,MACvB;AAAA,IACF,OAAO;AAEL,iBAAW,EAAE,MAAAA,OAAM,cAAc,KAAK,cAAc;AAElD,cAAM,EAAE,MAAM,IAAI,cAAc;AAGhC,cAAM,eAAe,KAAK,MAAMA,KAAI,CAAC;AAGrC,aAAK,QAAQA,KAAI,IAAI;AAAA,MACvB;AAAA,IACF;AAGA;AAAA,MACE,UACE,sCAAI,SAAS,EACV,YAAY,SAAS,EACrB,IAAI,KAAK,KAAK,EAEd,KAAK,KAAK,WAAW,EAErB,MAAM,KAAK,oBAAoB;AAAA,MACpC,KAAK,OAAO,IAAI;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,cAAc,MAAM;AAClB,aAAK,sCAAI,WAAW,EAAE,MAAM,KAAK,OAAO,UAAU,CAAC,EAAE,MAAM,KAAK,QAAQ;AAAA,EAC1E;AAAA,EAEA,WAAW,CAAC,UAAqB;AAC/B,mBAAI,MAAM,OAAO,mBAAmB;AAGpC,UAAM,YAAY,MAAM;AAEtB,YAAM,OAAkB,MAAM,QAAQ,CAAC;AAGvC,iBAAW,QAAQ,OAAO,KAAK,KAAK,OAAO,GAAG;AAE5C,cAAM,SAAS,GAAG,IAAI,IAAI;AAG1B,cAAM,WAAsB,CAAC;AAG7B,mBAAW,OAAO,OAAO,KAAK,IAAI,GAAG;AAEnC,kBAAI,0BAAW,MAAM,GAAG,GAAG;AAEzB,qBAAS,IAAI,MAAM,MAAM,CAAC,IAAI,KAAK,GAAG;AAAA,UACxC;AAAA,QACF;AAGA,aAAK,QAAQ,IAAI,EAAE,QAAQ,QAAQ;AAAA,MACrC;AAGA,UAAI,KAAK,UAAU;AACjB,aAAK,SAAS;AACd,aAAK,WAAW;AAAA,MAClB;AAAA,IACF;AAGA,iBAAa,KAAK,aAAa;AAC/B,SAAK,gBAAgB,WAAW,WAAW,eAAe;AAAA,EAC5D;AAAA,EAEA,QAAQ,CAAC,mBAA2B;AAClC,UAAM,YAAuC,CAAC;AAG9C,UAAM,YAAY,CAAC,IAAY,KAAe,QAAiB;AAC7D,UAAI,OAAO,OAAO;AAChB,cAAM,OAAO,SAAS,cAAc,IAAI,GAAG;AAC3C,cAAM,QAAQ,OAAO;AACrB,cAAM,WAAW,CAAC,IAAI,MAAM,KAAK,EAAE,KAAK,GAAG;AAG3C,kBAAU,QAAQ,IAAI,EAAE,IAAI,MAAM,MAAM;AAExC;AAAA,MACF;AAEA,UAAI,OAAO,UAAU;AACnB,YAAI,IAAI,SAAS,GAAG;AAClB,gBAAM,IAAI,MAAM,sCAAsC;AAAA,QACxD;AAEA,mBAAW,KAAK,KAAK;AACnB,gBAAM,OAAO,SAAS,cAAc,IAAI,CAAC;AACzC,gBAAM,WAAW,CAAC,IAAI,IAAI,EAAE,KAAK,GAAG;AAGpC,oBAAU,QAAQ,IAAI,EAAE,IAAI,KAAK;AAAA,QACnC;AAEA;AAAA,MACF;AAGA,YAAM,IAAI,MAAM,0BAA0B,EAAE,EAAE;AAAA,IAChD;AAGA,UAAM,aAAa,YAAY;AAC7B,YAAM,UAAU,OAAO,KAAK,SAAS;AACrC,YAAM,UAAU,OAAO,OAAO,SAAS;AAGvC,iBAAW,OAAO,SAAS;AACzB,eAAO,UAAU,GAAG;AAAA,MACtB;AAEA,UAAI;AAEF,kBAAM,sCAAI,WAAW,EAAE,WAAW,MAAM,KAAK,MAAM,CAAC,EAAE,MAAM,OAAO;AAAA,MACrE,SAAS,KAAK;AACZ,uBAAI,MAAM,KAAK,2BAA2B;AAG1C,mBAAW,OAAO,SAAS;AACzB,oBAAU,GAAG,IAAI,QAAQ,OAAO,GAAG,CAAC;AAAA,QACtC;AAAA,MACF;AAAA,IACF;AAGA,UAAM,SAAqB,OAAO,IAAY,KAAe,QAAiB;AAC5E,gBAAU,IAAI,KAAK,GAAG;AAAA,IACxB;AAGA,gBAAY,MAAM;AAChB,UAAI,OAAO,KAAK,SAAS,EAAE,SAAS,GAAG;AACrC,uBAAI,MAAM,WAAW,+BAA+B;AACpD,aAAK,WAAW;AAAA,MAClB;AAAA,IACF,GAAG,eAAe;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,uBAAuB,OAAO,MAAe;AAC3C,mBAAI,KAAK,mCAAmC;AAC5C,mBAAI,MAAM,CAAC;AAEX,QAAI;AACF,gBAAM,sCAAI,SAAS,EAAE,MAAM;AAAA,QACzB,UAAU;AAAA,UACR,MAAM,KAAK;AAAA,UACX;AAAA,QACF;AAAA,QACA,MAAM;AAAA;AAAA,UAEJ,wBAAwB;AAAA,QAC1B;AAAA,MACF,CAAC;AAGD,WAAK,YAAY;AAAA,IACnB,SAAS,KAAK;AACZ,qBAAI,MAAM,KAAK,6BAA6B;AAAA,IAC9C;AAAA,EACF;AACF;;;AVrMO,IAAM,aAAN,MAAM,YAAW;AAAA;AAAA,EAEtB,WAAW;AAAA;AAAA,EAGX,oBAAoB,IAAI,iBAAiB,MAAM;AAAA;AAAA,EAG/C,SAAS;AAAA;AAAA,EAGA,WAAO,eAAAC,SAAQ;AAAA;AAAA,EAGf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,QACA,cACA,YACA,WACA,SACA;AACA,SAAK,UAAU;AACf,SAAK,gBAAgB;AAGrB,QAAI,oBAAoB,QAAQ,cAAc,QAAQ,OAAO,IAAI,UAAU,MAAM;AAC/E,WAAK,eAAe;AACpB,iBAAW,QAAQ;AACnB,qBAAI,KAAK,oCAA+B;AAExC,UAAI,oBAAoB,QAAQ,cAAc,QAAQ,OAAO,IAAI,aAAa,MAAM;AAClF,uBAAI,KAAK,6BAAwB;AAAA,MACnC,CAAC;AAAA,IACH,CAAC;AAGD,SAAK,KAAK,IAAI,YAAW,OAAO;AAGhC,SAAK,KAAK,IAAI,eAAAA,QAAQ,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AAE5C,QAAI,YAAY;AACd,qBAAI,KAAK,qBAAqB,UAAU,EAAE;AAC1C,WAAK,cAAc;AAAA,IACrB;AAEA,QAAI,WAAW;AACb,qBAAI,KAAK,oBAAoB,SAAS,EAAE;AACxC,WAAK,aAAa;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGA,cAAc,CAAC,SAAiB;AAC9B,QAAI,KAAK,UAAU;AACjB,YAAM,IAAI,MAAM,iFAAiF;AAAA,IACnG;AAGA,UAAM,UAAU;AAAA,MACd,KAAK,UAAAC,QAAG,aAAa,QAAQ,IAAI,gBAAgB,oBAAoB;AAAA,MACrE,MAAM,UAAAA,QAAG,aAAa,QAAQ,IAAI,iBAAiB,oBAAoB;AAAA,IACzE;AAGA,QAAI,CAAC,YAAY,GAAG;AAElB,WAAK,SAAS,QAAQ,IAAI,kBAAkB,UAAAA,QAAG,aAAa,sBAAsB,EAAE,SAAS,EAAE,KAAK;AACpG,qBAAI,KAAK,oBAAoB,KAAK,MAAM,EAAE;AAE1C,UAAI,CAAC,KAAK,QAAQ;AAChB,cAAM,IAAI,MAAM,qBAAqB;AAAA,MACvC;AAAA,IACF;AAGA,UAAM,SAAS,aAAAC,QAAM,aAAa,SAAS,KAAK,IAAI,EAAE,OAAO,IAAI;AAGjE,WAAO,GAAG,aAAa,MAAM;AAC3B,qBAAI,KAAK,4BAA4B,IAAI,EAAE;AAE3C,WAAK,WAAW;AAAA,IAClB,CAAC;AAGD,WAAO,GAAG,SAAS,CAAC,MAAwB;AAC1C,UAAI,EAAE,SAAS,cAAc;AAC3B,uBAAI;AAAA,UACF,mEAAmE,IAAI,kCAAkC,IAAI;AAAA,QAC/G;AACA,mBAAW,MAAM;AACf,iBAAO,MAAM;AACb,iBAAO,OAAO,IAAI;AAAA,QACpB,GAAG,GAAI;AAAA,MACT;AAAA,IACF,CAAC;AAGD,YAAQ,GAAG,WAAW,MAAM;AAC1B,qBAAI,KAAK,kCAAkC;AAC3C,aAAO,MAAM,MAAM;AACjB,uBAAI,KAAK,eAAe;AACxB,gBAAQ,KAAK,CAAC;AAAA,MAChB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,iBAAiB,MAAM;AAErB,SAAK,KAAK,IAAI,YAAY,YAAW,QAAQ;AAG7C,SAAK,KAAK,IAAI,YAAY,KAAK,QAAQ;AAEvC,QAAI,YAAY,GAAG;AACjB;AAAA,IACF;AAGA,SAAK,KAAK,IAAI,CAAC,kBAAkB,kBAAkB,GAAG,KAAK,cAAc;AAGzE,SAAK,KAAK,KAAK,kBAAkB,KAAK,cAAc,QAAQ,CAAC;AAG7D,SAAK,KAAK,KAAK,oBAAoB,KAAK,cAAc,UAAU,CAAC;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,iBAAiB,CAAC,KAAsB,KAAuB,SAAuB;AAEpF,UAAM,EAAE,MAAM,IAAI,IAAI;AACtB,QAAI,UAAU,KAAK,QAAQ;AACzB,YAAM,MAAM,gCAAgC,MAAM,QAAQ,UAAU,GAAG,CAAC;AACxE,qBAAI,KAAK,GAAG;AACZ,UAAI,OAAO,GAAG,EAAE,KAAK,GAAG;AACxB,WAAK,kBAAkB,MAAM;AAC7B;AAAA,IACF;AAGA,SAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,OAAO,KAAsB,QAA0B;AAChE,QAAI;AACF,UAAI,KAAK,MAAM,KAAK,kBAAkB,WAAW,CAAC;AAAA,IACpD,SAAS,KAAK;AACZ,qBAAI,MAAM,GAAG;AACb,UAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,CAAC,kBAAyC;AAExD,WAAO,OAAO,KAAsB,QAA0B;AAE5D,YAAM,YAAY,iBAAiB,aAAa;AAEhD,UAAI;AAEF,cAAM,UAA4B,IAAI,MAAM,WAAY,CAAC;AAGzD,aAAK,eAAe,KAAK,YAAY,WAAW,CAAC,CAAC;AAGlD,cAAM,OAAO,SAAS,OAAO,IAAI,QAAQ,IAAI,KAAK;AAClD,cAAMC,aAAY,SAAS,aAAa;AACxC,cAAM,MAAM,SAAS,QAAQ,EAAE,OAAO,IAAI,SAAS,IAAI,MAAM,GAAG;AAEhE,cAAM,cAAc;AAAA,UAClB,KAAK,QAAQ;AAAA,UACb,WAAAA;AAAA,UACA;AAAA,QACF;AAEA,uBAAI,KAAK,EAAE,GAAG,aAAa,KAAK,WAAW,QAAQ,WAAW,cAAc,GAAG,kBAAkB;AACjG,uBAAI,MAAM,EAAE,GAAG,aAAa,QAAQ,GAAG,uBAAuB;AAG9D,YAAI;AAGJ,YAAI,kBAAkB,UAAU;AAC9B,qBAAW,MAAM,gBAAgB,KAAK,SAAS,KAAK,eAAe,SAAS,WAAW;AAAA,QACzF,OAAO;AACL,qBAAW,MAAM,kBAAkB,KAAK,eAAe,SAAS,WAAW;AAAA,QAC7E;AAGA,cAAM,eAAsD,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AAC1G,qBAAa,IAAI,CAAAC,SAAO;AACtB,eAAK,cAAc,KAAK,WAAWA,IAAG;AAEtC,yBAAI,MAAM,EAAE,GAAG,aAAa,KAAAA,KAAI,GAAG,gBAAgB;AAAA,QACrD,CAAC;AAED,YAAI;AAEJ,YAAI,kBAAkB,UAAU;AAC9B,kCAAwB;AACxB,yBAAI,MAAM,EAAE,GAAG,aAAa,SAAS,GAAG,mBAAmB;AAC3D,cAAI,KAAK;AAAA,YACP,YAAY;AAAA,YACZ,MAAM;AAAA,YACN,UAAU;AAAA,UACZ,CAAC;AAAA,QACH,OAAO;AACL,kCAAwB;AAAA,YACtB,KAAK,aAAa,CAAC,EAAE;AAAA,YACrB,SAAS,aAAa,OAAO,OAAK,CAAC,EAAE,OAAO,EAAE,WAAW;AAAA,YACzD,QAAQ;AAAA,cACN,SAAU,aACP,OAAO,QAAM,CAAC,GAAG,OAAO,EACxB,IAAI,UAAQ,KAAK,QAAQ,OAAO,EAChC,KAAK,IAAI;AAAA,YACd;AAAA,UACF;AACA,cAAI,KAAK;AAAA,YACP,YAAY;AAAA,YACZ,MAAM;AAAA,YACN,UAAU;AAAA,UACZ,CAAC;AAAA,QACH;AAEA,uBAAI,MAAM,EAAE,GAAG,aAAa,sBAAsB,GAAG,mBAAmB;AAExE,aAAK,kBAAkB,WAAW,WAAW,aAAa;AAAA,MAC5D,SAAS,KAAK;AACZ,uBAAI,MAAM,GAAG;AACb,YAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAC5C,aAAK,kBAAkB,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,QAAQ,KAAsB,KAAuB,MAA4B;AACtF,UAAM,YAAY,KAAK,IAAI;AAE3B,QAAI,GAAG,UAAU,MAAM;AACrB,YAAM,cAAc,KAAK,IAAI,IAAI;AACjC,YAAM,UAAU;AAAA,QACd,KAAK,IAAI,MAAM,SAAS;AAAA,QACxB,QAAQ,IAAI;AAAA,QACZ,KAAK,IAAI;AAAA,QACT,QAAQ,IAAI;AAAA,QACZ,UAAU,GAAG,WAAW;AAAA,MAC1B;AAEA,UAAI,cAAc,MAAM,eAAI,KAAK,OAAO,IAAI,eAAI,KAAK,OAAO;AAAA,IAC9D,CAAC;AAED,SAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,SAAS,KAAsB,KAAuB;AAC3D,QAAI;AACF,UAAI,KAAK,IAAI;AAAA,IACf,SAAS,KAAK;AACZ,qBAAI,MAAM,GAAG;AACb,UAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAAA,IAC9C;AAAA,EACF;AACF;;;AW3TA,IAAAC,mCAAoB;AACpB,IAAAC,gBAA2B;AAOpB,SAAS,WAAW,cAA4B;AACrD,eACG,QAAQ,OAAK,EAAE,QAAQ,EACvB,OAAO,aAAW,QAAQ,OAAO,EACjC,QAAQ,UAAU;AACvB;AAEA,eAAe,WAAW,SAAkB;AAE1C,QAAM,kBAAkB;AAAA,IACtB,sBAAa,GAAG,CAAC,yBAAW,KAAK;AAAA,IACjC,sBAAa,GAAG,CAAC,yBAAW,QAAQ;AAAA,IACpC,sCAAqB,GAAG,CAAC,yBAAW,OAAO,yBAAW,QAAQ;AAAA,IAC9D,sBAAa,GAAG,CAAC,yBAAW,OAAO;AAAA,IACnC,cAAU,GAAG,CAAC,yBAAW,OAAO,yBAAW,UAAU,yBAAW,OAAO;AAAA,EACzE;AAGA,QAAM,aAA2B,gBAAgB,QAAQ,KAAK,KAAK,6BAAyB;AAE5F,QAAM,WAAqB;AAAA,IACzB,UAAU;AAAA,IACV,eAAe;AAAA,IACf,UAAU,GAAG;AAEX,qBAAI,MAAM,GAAG,0CAA0C;AACvD,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAGA,YAAM,sCAAI,QAAQ,OAAO,QAAQ,OAAO,EAAE,MAAM,CAAC,KAAK,SAAS;AAE7D,QAAI,WAAW,SAAS,IAAI,GAAG;AAC7B,UAAI;AAEF,aAAK,QAAQ,gBAAgB,KAAK,IAAI;AAAA,MACxC,SAAS,GAAG;AAEV,uBAAI,MAAM,GAAG,gCAAgC;AAAA,MAC/C;AAAA,IACF;AAAA,EACF,GAAG,QAAQ;AACb;;;AZNO,IAAM,cAAc,MAAM,QAAQ,IAAI,oBAAoB;AAG1D,IAAM,cAAc,MAAM,QAAQ,IAAI,cAAc;AAEpD,IAAM,YAAY,MAAM,QAAQ,IAAI,cAAc;AAElD,IAAM,aAAN,MAAiB;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAY,EAAE,aAAa,KAAK,GAAgB,eAA6B,CAAC,GAAG,OAA0B,CAAC,GAAG;AAC7G,UAAM,aAAuB,qBAAM,IAAI;AACvC,WAAO,cAAc;AAGrB,kBAAc,OAAO,OAAO;AAG5B,QAAI,YAAY,GAAG;AAEjB,UAAI,CAAC,QAAQ,MAAM;AACjB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,YAAM,uBAA2C,CAAC;AAGlD,iBAAW,cAAc,cAAc;AAErC,6BAAqB,KAAK;AAAA,UACxB,MAAM,WAAW;AAAA,UACjB,aAAa,WAAW;AAAA,UACxB,YAAY,WAAW;AAAA,UACvB,UAAU,WAAW;AAAA,UACrB,aAAa,WAAW;AAAA,QAC1B,CAAC;AAAA,MACH;AAGA,cAAQ,KAAK,oBAAoB;AAEjC;AAAA,IACF;AAEA,SAAK,cAAc,IAAI,WAAW,QAAQ,cAAc,KAAK,YAAY,KAAK,WAAW,MAAM;AAE7F,UAAI,YAAY,KAAK,UAAU,GAAG;AAChC,mBAAW,YAAY;AAAA,MACzB;AAAA,IACF,CAAC;AAGD,QAAI,KAAK,YAAY;AACnB;AAAA,IACF;AAEA,SAAK,MAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,QAAQ,CAAC,OAAO,QAAS;AACvB,SAAK,YAAY,YAAY,IAAI;AAAA,EACnC;AACF;;;AaxHA,IAAAC,gBAAsB;AAStB,IAAM,gBAAgB;AA4Cf,IAAM,UAAN,MAAmC;AAAA,EACxC,SAAoB,CAAC;AAAA,EACrB;AAAA,EACA,eAA6C,CAAC;AAAA,EAC9C,gBAAgB;AAAA,EAChB,iBAAiC,CAAC;AAAA,EAElC,iBAAiB,CAAC,SAAqB;AACrC,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,UAAU,CAAC,SAAoB;AAC7B,mBAAI,MAAM,MAAM,0BAA0B;AAC1C,SAAK,SAAS,QAAQ,CAAC;AAEvB,SAAK,SAAS;AAGd,eAAW,OAAO,KAAK,cAAc;AAEnC,WAAK,aAAa,GAAG,MAAE,qBAAM,KAAK,MAAM,CAAC;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,UAAU,CAAC,QAAgB;AAEzB,WAAO,KAAK,OAAO,GAAG,KAAK;AAAA,EAC7B;AAAA,EAEA,QAAQ,MAAM;AACZ,SAAK,gBAAgB,UAAU,OAAO,KAAK,KAAK,MAAM,CAAC;AAAA,EACzD;AAAA,EAEA,aAAa,CAAC,QAAgB;AAC5B,SAAK,gBAAgB,UAAU,CAAC,GAAG,CAAC;AAAA,EACtC;AAAA,EAEA,UAAU,CAAC,KAAa,UAAkB;AACxC,SAAK,gBAAgB,OAAO,CAAC,GAAG,GAAG,KAAK;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,iBAAiB,CAAC,KAAa,UAAkB;AAC/C,SAAK,gBAAgB,OAAO,CAAC,GAAG,GAAG,KAAK;AACxC,WAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,YAAM,cAAc,KAAK,UAAU,UAAQ;AACzC,YAAI,KAAK,GAAG,MAAM,OAAO;AACvB,sBAAY;AACZ,kBAAQ;AAAA,QACV;AAAA,MACF,CAAC;AAGD,iBAAW,MAAM;AACf,oBAAY;AACZ,eAAO,OAAO;AAAA,MAChB,GAAG,aAAa;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EAEA,YAAY,CAAC,eAA6B;AACxC,UAAM,MAAM,KAAK;AACjB,SAAK,aAAa,GAAG,IAAI;AACzB,WAAO,MAAM,KAAK,YAAY,GAAG;AAAA,EACnC;AAAA,EAEA,UAAU,CAAC,aAA2B;AACpC,SAAK,eAAe,KAAK,QAAQ;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,CAAC,QAAgB;AAC7B,WAAO,KAAK,aAAa,GAAG;AAAA,EAC9B;AAAA,EAEA,WAAW,MAAM;AAEf,eAAW,WAAW,KAAK,gBAAgB;AACzC,kBAAQ,qBAAM,KAAK,MAAM,CAAC;AAAA,IAC5B;AAGA,SAAK,WAAW,MAAM;AAAA,IAAC;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,kBAAkB,CAAC,IAAY,MAAgB,UAAmB;AAChE,SAAK,MAAM,IAAI,MAAM,KAAK;AAAA,EAC5B;AACF;;;ACzHO,IAAM,aAAN,MAAqC;AAAA,EAC1C,aAAoC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA,YAAY,UAAoB;AAC9B,SAAK,OAAO,SAAS;AACrB,SAAK,MAAM,SAAS;AACpB,SAAK,QAAQ,SAAS;AACtB,SAAK,OAAO,SAAS;AACrB,SAAK,YAAY,UAAU;AAC3B,SAAK,cAAc,UAAU;AAAA,EAC/B;AAAA,EACA,SAAS,OAAkB;AACzB,SAAK,QAAQ;AACb,SAAK,cAAc;AAAA,EACrB;AAAA,EACA,gBAAgB;AACd,SAAK,WAAW;AAChB,SAAK,YAAY;AACjB,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa;AACX,UAAM,SAAS,KAAK,SAAS,KAAK,MAAM,QAAQ,KAAK,IAAI;AACzD,QAAI,QAAQ;AACV,YAAM,iBAAiB,KAAK,MAAM,MAAM;AACxC,WAAK,cAAc,gBAAgB;AACnC,WAAK,YAAY,gBAAgB;AACjC,WAAK,gBAAgB,gBAAgB;AAAA,IACvC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc;AACZ,UAAM,WAAW;AAAA,MACf,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,eAAe,oBAAI,KAAK;AAAA,MACxB,MAAM,KAAK;AAAA,IACb;AACA,SAAK,SAAS,KAAK,MAAM,QAAQ,KAAK,MAAM,KAAK,UAAU,QAAQ,CAAC;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc;AACZ,YAAQ,KAAK,MAAM;AAAA,MACjB,KAAK;AACH,YAAI,KAAK,QAAQ;AAAI,gBAAM,IAAI,MAAM,6CAA6C;AAClF,aAAK,WAAW,MAAO,KAAK;AAC5B;AAAA,MACF,KAAK;AAAA,MACL,KAAK;AACH,aAAK,WAAW,MAAO,KAAK,KAAK;AACjC;AAAA,MACF,KAAK;AAAA,MACL,KAAK;AACH,aAAK,WAAW,MAAO,KAAK,KAAK,KAAK;AACtC;AAAA,MACF;AACE,cAAM,IAAI,MAAM,mBAAmB;AAAA,IACvC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB;AACd,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI;AAEJ,QAAI,KAAK,iBAAiB,KAAK,WAAW;AACxC,WAAK,YAAY;AAAA,IACnB;AAEA,QAAI,KAAK,WAAW;AAClB,cAAQ,KAAK,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA,IACjD,WAAW,KAAK,iBAAiB,KAAK,UAAU;AAC9C,YAAM,gBAAgB,IAAI,KAAK,KAAK,aAAa;AACjD,cAAQ,KAAK,YAAY,IAAI,QAAQ,IAAI,cAAc,QAAQ;AAAA,IACjE;AAEA,QAAI,UAAU,UAAa,SAAS,GAAG;AACrC,WAAK,MAAM;AAAA,IACb,OAAO;AACL,iBAAW,MAAM;AACf,aAAK,MAAM;AAAA,MACb,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ;AACN,SAAK,aAAa,YAAY,MAAM;AAClC,UAAI,KAAK,gBAAgB,GAAG;AAC1B,aAAK,KAAK;AACV;AAAA,MACF,OAAO;AACL,aAAK,IAAI;AAET,YAAI,KAAK,eAAe,KAAK,gBAAgB,GAAG;AAC9C,eAAK,eAAe;AAAA,QACtB;AACA,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,GAAG,KAAK,QAAQ;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO;AACL,QAAI,KAAK,YAAY;AACnB,oBAAc,KAAK,UAAU;AAC7B,WAAK,aAAa;AAAA,IACpB;AACA,SAAK,SAAS,KAAK,MAAM,WAAW,KAAK,IAAI;AAAA,EAC/C;AACF;;;AhBrJA,IAAM,oBAAoB,YAAY,KAAK,CAAC,YAAY;AACxD,IAAM,gBAAgB,YAAY,KAAK,YAAY,KAAK,UAAU;AAK3D,IAAM,aAAN,MAA6C;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAuB,CAAC;AAAA,EACxB,SAAS,IAAI,QAAQ;AAAA,EACrB,iBAAiB,IAAI,QAAQ;AAAA,EAC7B,cAAc;AAAA,EACd,sBAAsB;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAA2C,CAAC,aAAuB;AACjE,UAAM,EAAE,MAAM,OAAO,MAAM,KAAK,WAAW,YAAY,IAAI;AAC3D,SAAK,cAAc;AAEnB,QAAI,QAAQ,IAAI,oBAAoB,QAAQ;AAI1C,YAAM,cAAwB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,WAAK,eAAe,QAAQ,MAAM;AAChC,YAAI,WAAW,WAAW,EAAE,SAAS,KAAK,cAAc;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,QAAmB;AAAA,IACjB,OAAO,KAAK,OAAO;AAAA,IACnB,SAAS,KAAK,OAAO;AAAA,IACrB,YAAY,KAAK,OAAO;AAAA,IACxB,SAAS,KAAK,OAAO;AAAA,IACrB,WAAW,KAAK,OAAO;AAAA,IACvB,SAAS,KAAK,OAAO;AAAA,IACrB,gBAAgB,KAAK,OAAO;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,gBAA2B;AAAA,IACzB,OAAO,KAAK,eAAe;AAAA,IAC3B,SAAS,KAAK,eAAe;AAAA,IAC7B,YAAY,KAAK,eAAe;AAAA,IAChC,gBAAgB,KAAK,eAAe;AAAA,IACpC,SAAS,KAAK,eAAe;AAAA,IAC7B,WAAW,KAAK,eAAe;AAAA,IAC/B,SAAS,KAAK,eAAe;AAAA,EAC/B;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,OAAO;AACT,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,cAAc;AAChB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,aAAa;AACf,WAAO,KAAK,eAAe,CAAC;AAAA,EAC9B;AAAA,EAEA,YAAY,KAAoB;AAC9B,SAAK,QAAQ,IAAI;AACjB,SAAK,eAAe,IAAI;AACxB,SAAK,cAAc,IAAI;AACvB,SAAK,cAAc;AAEnB,mBAAI,KAAK,cAAc,KAAK,KAAK,aAAa;AAC9C,mBAAI,MAAM,GAAG;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,wBAAwB,MAAM;AAC5B,mBAAI,KAAK,kCAAkC,KAAK,KAAK,EAAE;AAEvD,QAAI,KAAK,qBAAqB;AAC5B,YAAM,IAAI,MAAM,yCAAyC,KAAK,KAAK,EAAE;AAAA,IACvE;AAEA,SAAK,sBAAsB;AAG3B,WAAO;AAAA,MACL,eAAe,KAAK;AAAA,IACtB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,MAAM;AACpB,mBAAI,KAAK,yBAAyB,KAAK,KAAK,EAAE;AAE9C,QAAI,KAAK,aAAa;AACpB,YAAM,IAAI,MAAM,gCAAgC,KAAK,KAAK,EAAE;AAAA,IAC9D;AAEA,SAAK,cAAc;AAGnB,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,IACd;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,CAAyB,OAAUC,UAA6C;AACrF,UAAM,kBAAc,0DAAwB,MAAM,IAAI;AAGtD,QAAI,CAAC,eAAe,CAACA,OAAM;AACzB,YAAM,IAAI,MAAM,0BAA0B,MAAM,IAAI,EAAE;AAAA,IACxD;AAEA,UAAM,UAAmB;AAAA,MACvB;AAAA;AAAA,MAEA,MAAMA,SAAQ;AAAA,MACd;AAAA,MACA,SAAS;AAAA,QACP,MAAM;AAAA,QACN,YAAY,CAAC;AAAA,QACb,QAAQ,CAAC;AAAA,QACT,aAAa,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,WAAW,KAAK;AACtB,UAAM,SAAS,GAAG,KAAK,KAAK,KAAK,MAAM,IAAI;AAC3C,UAAM,cAAc,EAAE,WAAW,gBAAgB,QAAQ,UAAU,MAAM;AACzE,UAAM,aAAa,CAAC,UAAkB,OAAO,KAAK,KAAK,EAAE,SAAS;AAClE,UAAM,MAAM,CAAC,SAAiB,aAAqB;AACjD,YAAM,kBAAc,sBAAO,YAAY,QAAQ,OAAO;AAEtD,qBAAI,KAAK,GAAG,OAAO,mBAAmB,QAAQ,KAAK,IAAI,MAAM;AAC7D,qBAAI,KAAK,aAAa,MAAM;AAC5B,qBAAI,MAAM,UAAU,MAAM;AAAA,IAC5B;AAEA,aAAS,SAAS,kBAA6D;AAC7E,UAAI,mBAAmB;AACrB,YAAI,mBAAmB,iBAAiB,SAAS,CAAC;AAIlD,iBAAS,KAAK;AAAA,UACZ,GAAG;AAAA,UACH,YAAY;AAAA,UACZ;AAAA,QACF,CAAC;AAAA,MACH;AAEA,aAAO,EAAE,MAAM;AAAA,IACjB;AAEA,aAAS,OAAO,gBAAuD;AACrE,UAAI,mBAAmB;AACrB,YAAI,iBAAiB,eAAe,SAAS,CAAC;AAI9C,iBAAS,KAAK;AAAA,UACZ,GAAG;AAAA,UACH,UAAU;AAAA,UACV;AAAA,QACF,CAAC;AAAA,MACH;AAGA,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAEA,aAAS,MAAM,eAA+B;AAC5C,UAAI,eAAe;AACjB,YAAI,gBAAgB,cAAc,SAAS,CAAC;AAE5C,iBAAS,KAAK;AAAA,UACZ,GAAG;AAAA,UACH,SAAS;AAAA,UACT;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,aAAS,eAAe,YAA0C;AAChE,qBAAI,MAAM,yBAAyB,UAAU,IAAI,MAAM;AACvD,cAAQ,QAAQ,WAAW,KAAK,GAAG,UAAU;AAC7C,aAAO,EAAE,GAAG,aAAa,SAAS;AAAA,IACpC;AAEA,aAAS,SAAS,MAAgC;AAChD,qBAAI,MAAM,mBAAmB,IAAI,IAAI,MAAM;AAC3C,cAAQ,QAAQ,OAAO;AACvB,aAAO;AAAA,IACT;AAEA,aAAS,UAAU,KAAa,QAAQ,IAAsB;AAC5D,qBAAI,MAAM,oBAAoB,GAAG,IAAI,KAAK,IAAI,MAAM;AACpD,cAAQ,QAAQ,OAAO,GAAG,IAAI;AAC9B,aAAO;AAAA,IACT;AAEA,aAAS,eAAe,KAAa,QAAQ,IAAsB;AACjE,qBAAI,MAAM,yBAAyB,GAAG,IAAI,KAAK,IAAI,MAAM;AACzD,cAAQ,QAAQ,YAAY,GAAG,IAAI;AACnC,aAAO;AAAA,IACT;AAEA,aAAS,UAAU,OAAc;AAC/B,cAAQ,QAAQ;AAChB,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,oBAAoB,MAAM,+CAA8B;AAAA,MACxD,WAAW,MAAM,+BAAsB;AAAA,MACvC,WAAW,MAAM,+BAAsB;AAAA,MACvC,WAAW,MAAM,+BAAsB;AAAA,IACzC;AAAA,EACF;AACF;;;AiBlSO,SAAS,WACd,SACA,eACA;AACA,QAAMC,cAAa,QAAQ,IAAI,MAAM,cAAc,CAAC;AACpD,QAAM,iBAAiB,QAAQ,IAAI,MAAM,kBAAkB,CAAC;AAC5D,QAAM,sBAAsB,QAAQ,IAAI,MAAM,uBAAuB,CAAC;AAEtE,MAAI,kBAAkB,cAAc;AAClC,WAAOA;AAAA,EACT;AACA,MAAI,kBAAkB,kBAAkB;AACtC,WAAO;AAAA,EACT;AACA,MAAI,kBAAkB,uBAAuB;AAC3C,WAAO;AAAA,EACT;AACA,SAAO,CAAC,GAAGA,aAAY,GAAG,gBAAgB,GAAG,mBAAmB;AAClE;",
+  "sourcesContent": ["import { K8s, RegisterKind, kind as a, fetch, fetchStatus, kind } from \"kubernetes-fluent-client\";\nimport * as R from \"ramda\";\n\nimport { Capability } from \"./lib/capability\";\nimport Log from \"./lib/logger\";\nimport { PeprModule } from \"./lib/module\";\nimport { PeprMutateRequest } from \"./lib/mutate-request\";\nimport * as PeprUtils from \"./lib/utils\";\nimport { PeprValidateRequest } from \"./lib/validate-request\";\nimport { containers } from \"./lib/module-helpers\";\n\nexport {\n  Capability,\n  K8s,\n  Log,\n  PeprModule,\n  PeprMutateRequest,\n  PeprUtils,\n  PeprValidateRequest,\n  R,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n  containers,\n};\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { GenericClass, GroupVersionKind, modelToGroupVersionKind } from \"kubernetes-fluent-client\";\nimport { WatchAction } from \"kubernetes-fluent-client/dist/fluent/types\";\nimport { pickBy } from \"ramda\";\n\nimport Log from \"./logger\";\nimport { isBuildMode, isDevMode, isWatchMode } from \"./module\";\nimport { PeprStore, Storage } from \"./storage\";\nimport { OnSchedule, Schedule } from \"./schedule\";\nimport {\n  Binding,\n  BindingFilter,\n  BindingWithName,\n  CapabilityCfg,\n  CapabilityExport,\n  Event,\n  MutateAction,\n  MutateActionChain,\n  ValidateAction,\n  ValidateActionChain,\n  WhenSelector,\n} from \"./types\";\n\nconst registerAdmission = isBuildMode() || !isWatchMode();\nconst registerWatch = isBuildMode() || isWatchMode() || isDevMode();\n\n/**\n * A capability is a unit of functionality that can be registered with the Pepr runtime.\n */\nexport class Capability implements CapabilityExport {\n  #name: string;\n  #description: string;\n  #namespaces?: string[] | undefined;\n  #bindings: Binding[] = [];\n  #store = new Storage();\n  #scheduleStore = new Storage();\n  #registered = false;\n  #scheduleRegistered = false;\n  hasSchedule: boolean;\n\n  /**\n   * Run code on a schedule with the capability.\n   *\n   * @param schedule The schedule to run the code on\n   * @returns\n   */\n  OnSchedule: (schedule: Schedule) => void = (schedule: Schedule) => {\n    const { name, every, unit, run, startTime, completions } = schedule;\n    this.hasSchedule = true;\n\n    if (process.env.PEPR_WATCH_MODE === \"true\") {\n      // Only create/watch schedule store if necessary\n\n      // Create a new schedule\n      const newSchedule: Schedule = {\n        name,\n        every,\n        unit,\n        run,\n        startTime,\n        completions,\n      };\n\n      this.#scheduleStore.onReady(() => {\n        new OnSchedule(newSchedule).setStore(this.#scheduleStore);\n      });\n    }\n  };\n\n  /**\n   * Store is a key-value data store that can be used to persist data that should be shared\n   * between requests. Each capability has its own store, and the data is persisted in Kubernetes\n   * in the `pepr-system` namespace.\n   *\n   * Note: You should only access the store from within an action.\n   */\n  Store: PeprStore = {\n    clear: this.#store.clear,\n    getItem: this.#store.getItem,\n    removeItem: this.#store.removeItem,\n    setItem: this.#store.setItem,\n    subscribe: this.#store.subscribe,\n    onReady: this.#store.onReady,\n    setItemAndWait: this.#store.setItemAndWait,\n  };\n\n  /**\n   * ScheduleStore is a key-value data store used to persist schedule data that should be shared\n   * between intervals. Each Schedule shares store, and the data is persisted in Kubernetes\n   * in the `pepr-system` namespace.\n   *\n   * Note: There is no direct access to schedule store\n   */\n  ScheduleStore: PeprStore = {\n    clear: this.#scheduleStore.clear,\n    getItem: this.#scheduleStore.getItem,\n    removeItem: this.#scheduleStore.removeItem,\n    setItemAndWait: this.#scheduleStore.setItemAndWait,\n    setItem: this.#scheduleStore.setItem,\n    subscribe: this.#scheduleStore.subscribe,\n    onReady: this.#scheduleStore.onReady,\n  };\n\n  get bindings() {\n    return this.#bindings;\n  }\n\n  get name() {\n    return this.#name;\n  }\n\n  get description() {\n    return this.#description;\n  }\n\n  get namespaces() {\n    return this.#namespaces || [];\n  }\n\n  constructor(cfg: CapabilityCfg) {\n    this.#name = cfg.name;\n    this.#description = cfg.description;\n    this.#namespaces = cfg.namespaces;\n    this.hasSchedule = false;\n\n    Log.info(`Capability ${this.#name} registered`);\n    Log.debug(cfg);\n  }\n\n  /**\n   * Register the store with the capability. This is called automatically by the Pepr controller.\n   *\n   * @param store\n   */\n  registerScheduleStore = () => {\n    Log.info(`Registering schedule store for ${this.#name}`);\n\n    if (this.#scheduleRegistered) {\n      throw new Error(`Schedule store already registered for ${this.#name}`);\n    }\n\n    this.#scheduleRegistered = true;\n\n    // Pass back any ready callback to the controller\n    return {\n      scheduleStore: this.#scheduleStore,\n    };\n  };\n\n  /**\n   * Register the store with the capability. This is called automatically by the Pepr controller.\n   *\n   * @param store\n   */\n  registerStore = () => {\n    Log.info(`Registering store for ${this.#name}`);\n\n    if (this.#registered) {\n      throw new Error(`Store already registered for ${this.#name}`);\n    }\n\n    this.#registered = true;\n\n    // Pass back any ready callback to the controller\n    return {\n      store: this.#store,\n    };\n  };\n\n  /**\n   * The When method is used to register a action to be executed when a Kubernetes resource is\n   * processed by Pepr. The action will be executed if the resource matches the specified kind and any\n   * filters that are applied.\n   *\n   * @param model the KubernetesObject model to match\n   * @param kind if using a custom KubernetesObject not available in `a.*`, specify the GroupVersionKind\n   * @returns\n   */\n  When = <T extends GenericClass>(model: T, kind?: GroupVersionKind): WhenSelector<T> => {\n    const matchedKind = modelToGroupVersionKind(model.name);\n\n    // If the kind is not specified and the model is not a KubernetesObject, throw an error\n    if (!matchedKind && !kind) {\n      throw new Error(`Kind not specified for ${model.name}`);\n    }\n\n    const binding: Binding = {\n      model,\n      // If the kind is not specified, use the matched kind from the model\n      kind: kind || matchedKind,\n      event: Event.Any,\n      filters: {\n        name: \"\",\n        namespaces: [],\n        labels: {},\n        annotations: {},\n      },\n    };\n\n    const bindings = this.#bindings;\n    const prefix = `${this.#name}: ${model.name}`;\n    const commonChain = { WithLabel, WithAnnotation, Mutate, Validate, Watch };\n    const isNotEmpty = (value: object) => Object.keys(value).length > 0;\n    const log = (message: string, cbString: string) => {\n      const filteredObj = pickBy(isNotEmpty, binding.filters);\n\n      Log.info(`${message} configured for ${binding.event}`, prefix);\n      Log.info(filteredObj, prefix);\n      Log.debug(cbString, prefix);\n    };\n\n    function Validate(validateCallback: ValidateAction<T>): ValidateActionChain<T> {\n      if (registerAdmission) {\n        log(\"Validate Action\", validateCallback.toString());\n\n        // Push the binding to the list of bindings for this capability as a new BindingAction\n        // with the callback function to preserve\n        bindings.push({\n          ...binding,\n          isValidate: true,\n          validateCallback,\n        });\n      }\n\n      return { Watch };\n    }\n\n    function Mutate(mutateCallback: MutateAction<T>): MutateActionChain<T> {\n      if (registerAdmission) {\n        log(\"Mutate Action\", mutateCallback.toString());\n\n        // Push the binding to the list of bindings for this capability as a new BindingAction\n        // with the callback function to preserve\n        bindings.push({\n          ...binding,\n          isMutate: true,\n          mutateCallback,\n        });\n      }\n\n      // Now only allow adding actions to the same binding\n      return { Watch, Validate };\n    }\n\n    function Watch(watchCallback: WatchAction<T>) {\n      if (registerWatch) {\n        log(\"Watch Action\", watchCallback.toString());\n\n        bindings.push({\n          ...binding,\n          isWatch: true,\n          watchCallback,\n        });\n      }\n    }\n\n    function InNamespace(...namespaces: string[]): BindingWithName<T> {\n      Log.debug(`Add namespaces filter ${namespaces}`, prefix);\n      binding.filters.namespaces.push(...namespaces);\n      return { ...commonChain, WithName };\n    }\n\n    function WithName(name: string): BindingFilter<T> {\n      Log.debug(`Add name filter ${name}`, prefix);\n      binding.filters.name = name;\n      return commonChain;\n    }\n\n    function WithLabel(key: string, value = \"\"): BindingFilter<T> {\n      Log.debug(`Add label filter ${key}=${value}`, prefix);\n      binding.filters.labels[key] = value;\n      return commonChain;\n    }\n\n    function WithAnnotation(key: string, value = \"\"): BindingFilter<T> {\n      Log.debug(`Add annotation filter ${key}=${value}`, prefix);\n      binding.filters.annotations[key] = value;\n      return commonChain;\n    }\n\n    function bindEvent(event: Event) {\n      binding.event = event;\n      return {\n        ...commonChain,\n        InNamespace,\n        WithName,\n      };\n    }\n\n    return {\n      IsCreatedOrUpdated: () => bindEvent(Event.CreateOrUpdate),\n      IsCreated: () => bindEvent(Event.Create),\n      IsUpdated: () => bindEvent(Event.Update),\n      IsDeleted: () => bindEvent(Event.Delete),\n    };\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { pino } from \"pino\";\n\nconst isPrettyLog = process.env.PEPR_PRETTY_LOGS === \"true\";\n\nconst pretty = {\n  target: \"pino-pretty\",\n  options: {\n    colorize: true,\n  },\n};\n\nconst transport = isPrettyLog ? pretty : undefined;\n\nconst Log = pino({\n  transport,\n});\n\nif (process.env.LOG_LEVEL) {\n  Log.level = process.env.LOG_LEVEL;\n}\n\nexport default Log;\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { clone } from \"ramda\";\n\nimport { Capability } from \"./capability\";\nimport { Controller } from \"./controller\";\nimport { ValidateError } from \"./errors\";\nimport { AdmissionRequest, MutateResponse, ValidateResponse, WebhookIgnore } from \"./k8s\";\nimport { CapabilityExport } from \"./types\";\nimport { setupWatch } from \"./watch-processor\";\n\n/** Global configuration for the Pepr runtime. */\nexport type ModuleConfig = {\n  /** The user-defined name for the module */\n  name: string;\n  /** The Pepr version this module uses */\n  peprVersion?: string;\n  /** The user-defined version of the module */\n  appVersion?: string;\n  /** A unique identifier for this Pepr module. This is automatically generated by Pepr. */\n  uuid: string;\n  /** A description of the Pepr module and what it does. */\n  description?: string;\n  /** Reject K8s resource AdmissionRequests on error. */\n  onError?: string;\n  /** Configure global exclusions that will never be processed by Pepr. */\n  alwaysIgnore: WebhookIgnore;\n  /** Define the log level for the in-cluster controllers */\n  logLevel?: string;\n  /** Propagate env variables to in-cluster controllers */\n  env?: Record<string, string>;\n};\n\nexport type PackageJSON = {\n  description: string;\n  pepr: ModuleConfig;\n};\n\nexport type PeprModuleOptions = {\n  deferStart?: boolean;\n\n  /** A user-defined callback to pre-process or intercept a Pepr request from K8s immediately before it is processed */\n  beforeHook?: (req: AdmissionRequest) => void;\n\n  /** A user-defined callback to post-process or intercept a Pepr response just before it is returned to K8s */\n  afterHook?: (res: MutateResponse | ValidateResponse) => void;\n};\n\n// Track if this is a watch mode controller\nexport const isWatchMode = () => process.env.PEPR_WATCH_MODE === \"true\";\n\n// Track if Pepr is running in build mode\nexport const isBuildMode = () => process.env.PEPR_MODE === \"build\";\n\nexport const isDevMode = () => process.env.PEPR_MODE === \"dev\";\n\nexport class PeprModule {\n  #controller!: Controller;\n\n  /**\n   * Create a new Pepr runtime\n   *\n   * @param config The configuration for the Pepr runtime\n   * @param capabilities The capabilities to be loaded into the Pepr runtime\n   * @param opts Options for the Pepr runtime\n   */\n  constructor({ description, pepr }: PackageJSON, capabilities: Capability[] = [], opts: PeprModuleOptions = {}) {\n    const config: ModuleConfig = clone(pepr);\n    config.description = description;\n\n    // Need to validate at runtime since TS gets sad about parsing the package.json\n    ValidateError(config.onError);\n\n    // Handle build mode\n    if (isBuildMode()) {\n      // Fail if process.send is not defined\n      if (!process.send) {\n        throw new Error(\"process.send is not defined\");\n      }\n\n      const exportedCapabilities: CapabilityExport[] = [];\n\n      // Send capability map to parent process\n      for (const capability of capabilities) {\n        // Convert the capability to a capability config\n        exportedCapabilities.push({\n          name: capability.name,\n          description: capability.description,\n          namespaces: capability.namespaces,\n          bindings: capability.bindings,\n          hasSchedule: capability.hasSchedule,\n        });\n      }\n\n      // Send the capabilities back to the parent process\n      process.send(exportedCapabilities);\n\n      return;\n    }\n\n    this.#controller = new Controller(config, capabilities, opts.beforeHook, opts.afterHook, () => {\n      // Wait for the controller to be ready before setting up watches\n      if (isWatchMode() || isDevMode()) {\n        setupWatch(capabilities);\n      }\n    });\n\n    // Stop processing if deferStart is set to true\n    if (opts.deferStart) {\n      return;\n    }\n\n    this.start();\n  }\n\n  /**\n   * Start the Pepr runtime manually.\n   * Normally this is called automatically when the Pepr module is instantiated, but can be called manually if `deferStart` is set to `true` in the constructor.\n   *\n   * @param port\n   */\n  start = (port = 3000) => {\n    this.#controller.startServer(port);\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport express, { NextFunction } from \"express\";\nimport fs from \"fs\";\nimport https from \"https\";\n\nimport { Capability } from \"../capability\";\nimport { MutateResponse, AdmissionRequest, ValidateResponse } from \"../k8s\";\nimport Log from \"../logger\";\nimport { MetricsCollector } from \"../metrics\";\nimport { ModuleConfig, isWatchMode } from \"../module\";\nimport { mutateProcessor } from \"../mutate-processor\";\nimport { validateProcessor } from \"../validate-processor\";\nimport { PeprControllerStore } from \"./store\";\nimport { ResponseItem } from \"../types\";\n\nexport class Controller {\n  // Track whether the server is running\n  #running = false;\n\n  // Metrics collector\n  #metricsCollector = new MetricsCollector(\"pepr\");\n\n  // The token used to authenticate requests\n  #token = \"\";\n\n  // The express app instance\n  readonly #app = express();\n\n  // Initialized with the constructor\n  readonly #config: ModuleConfig;\n  readonly #capabilities: Capability[];\n  readonly #beforeHook?: (req: AdmissionRequest) => void;\n  readonly #afterHook?: (res: MutateResponse) => void;\n\n  constructor(\n    config: ModuleConfig,\n    capabilities: Capability[],\n    beforeHook?: (req: AdmissionRequest) => void,\n    afterHook?: (res: MutateResponse) => void,\n    onReady?: () => void,\n  ) {\n    this.#config = config;\n    this.#capabilities = capabilities;\n\n    // Initialize the Pepr store for each capability\n    new PeprControllerStore(config, capabilities, `pepr-${config.uuid}-store`, () => {\n      this.#bindEndpoints();\n      onReady && onReady();\n      Log.info(\"\u2705 Controller startup complete\");\n      // Initialize the schedule store for each capability\n      new PeprControllerStore(config, capabilities, `pepr-${config.uuid}-schedule`, () => {\n        Log.info(\"\u2705 Scheduling processed\");\n      });\n    });\n\n    // Middleware for logging requests\n    this.#app.use(Controller.#logger);\n\n    // Middleware for parsing JSON, limit to 2mb vs 100K for K8s compatibility\n    this.#app.use(express.json({ limit: \"2mb\" }));\n\n    if (beforeHook) {\n      Log.info(`Using beforeHook: ${beforeHook}`);\n      this.#beforeHook = beforeHook;\n    }\n\n    if (afterHook) {\n      Log.info(`Using afterHook: ${afterHook}`);\n      this.#afterHook = afterHook;\n    }\n  }\n\n  /** Start the webhook server */\n  startServer = (port: number) => {\n    if (this.#running) {\n      throw new Error(\"Cannot start Pepr module: Pepr module was not instantiated with deferStart=true\");\n    }\n\n    // Load SSL certificate and key\n    const options = {\n      key: fs.readFileSync(process.env.SSL_KEY_PATH || \"/etc/certs/tls.key\"),\n      cert: fs.readFileSync(process.env.SSL_CERT_PATH || \"/etc/certs/tls.crt\"),\n    };\n\n    // Get the API token if not in watch mode\n    if (!isWatchMode()) {\n      // Get the API token from the environment variable or the mounted secret\n      this.#token = process.env.PEPR_API_TOKEN || fs.readFileSync(\"/app/api-token/value\").toString().trim();\n      Log.info(`Using API token: ${this.#token}`);\n\n      if (!this.#token) {\n        throw new Error(\"API token not found\");\n      }\n    }\n\n    // Create HTTPS server\n    const server = https.createServer(options, this.#app).listen(port);\n\n    // Handle server listening event\n    server.on(\"listening\", () => {\n      Log.info(`Server listening on port ${port}`);\n      // Track that the server is running\n      this.#running = true;\n    });\n\n    // Handle EADDRINUSE errors\n    server.on(\"error\", (e: { code: string }) => {\n      if (e.code === \"EADDRINUSE\") {\n        Log.warn(\n          `Address in use, retrying in 2 seconds. If this persists, ensure ${port} is not in use, e.g. \"lsof -i :${port}\"`,\n        );\n        setTimeout(() => {\n          server.close();\n          server.listen(port);\n        }, 2000);\n      }\n    });\n\n    // Listen for the SIGTERM signal and gracefully close the server\n    process.on(\"SIGTERM\", () => {\n      Log.info(\"Received SIGTERM, closing server\");\n      server.close(() => {\n        Log.info(\"Server closed\");\n        process.exit(0);\n      });\n    });\n  };\n\n  #bindEndpoints = () => {\n    // Health check endpoint\n    this.#app.get(\"/healthz\", Controller.#healthz);\n\n    // Metrics endpoint\n    this.#app.get(\"/metrics\", this.#metrics);\n\n    if (isWatchMode()) {\n      return;\n    }\n\n    // Require auth for webhook endpoints\n    this.#app.use([\"/mutate/:token\", \"/validate/:token\"], this.#validateToken);\n\n    // Mutate endpoint\n    this.#app.post(\"/mutate/:token\", this.#admissionReq(\"Mutate\"));\n\n    // Validate endpoint\n    this.#app.post(\"/validate/:token\", this.#admissionReq(\"Validate\"));\n  };\n\n  /**\n   * Validate the token in the request path\n   *\n   * @param req The incoming request\n   * @param res The outgoing response\n   * @param next The next middleware function\n   * @returns\n   */\n  #validateToken = (req: express.Request, res: express.Response, next: NextFunction) => {\n    // Validate the token\n    const { token } = req.params;\n    if (token !== this.#token) {\n      const err = `Unauthorized: invalid token '${token.replace(/[^\\w]/g, \"_\")}'`;\n      Log.warn(err);\n      res.status(401).send(err);\n      this.#metricsCollector.alert();\n      return;\n    }\n\n    // Token is valid, continue\n    next();\n  };\n\n  /**\n   * Metrics endpoint handler\n   *\n   * @param req the incoming request\n   * @param res the outgoing response\n   */\n  #metrics = async (req: express.Request, res: express.Response) => {\n    try {\n      res.send(await this.#metricsCollector.getMetrics());\n    } catch (err) {\n      Log.error(err);\n      res.status(500).send(\"Internal Server Error\");\n    }\n  };\n\n  /**\n   * Admission request handler for both mutate and validate requests\n   *\n   * @param admissionKind the type of admission request\n   * @returns the request handler\n   */\n  #admissionReq = (admissionKind: \"Mutate\" | \"Validate\") => {\n    // Create the admission request handler\n    return async (req: express.Request, res: express.Response) => {\n      // Start the metrics timer\n      const startTime = MetricsCollector.observeStart();\n\n      try {\n        // Get the request from the body or create an empty request\n        const request: AdmissionRequest = req.body?.request || ({} as AdmissionRequest);\n\n        // Run the before hook if it exists\n        this.#beforeHook && this.#beforeHook(request || {});\n\n        // Setup identifiers for logging\n        const name = request?.name ? `/${request.name}` : \"\";\n        const namespace = request?.namespace || \"\";\n        const gvk = request?.kind || { group: \"\", version: \"\", kind: \"\" };\n\n        const reqMetadata = {\n          uid: request.uid,\n          namespace,\n          name,\n        };\n\n        Log.info({ ...reqMetadata, gvk, operation: request.operation, admissionKind }, \"Incoming request\");\n        Log.debug({ ...reqMetadata, request }, \"Incoming request body\");\n\n        // Process the request\n        let response: MutateResponse | ValidateResponse[];\n\n        // Call mutate or validate based on the admission kind\n        if (admissionKind === \"Mutate\") {\n          response = await mutateProcessor(this.#config, this.#capabilities, request, reqMetadata);\n        } else {\n          response = await validateProcessor(this.#capabilities, request, reqMetadata);\n        }\n\n        // Run the after hook if it exists\n        const responseList: ValidateResponse[] | MutateResponse[] = Array.isArray(response) ? response : [response];\n        responseList.map(res => {\n          this.#afterHook && this.#afterHook(res);\n          // Log the response\n          Log.debug({ ...reqMetadata, res }, \"Check response\");\n        });\n\n        let kubeAdmissionResponse: ValidateResponse[] | MutateResponse | ResponseItem;\n\n        if (admissionKind === \"Mutate\") {\n          kubeAdmissionResponse = response;\n          Log.debug({ ...reqMetadata, response }, \"Outgoing response\");\n          res.send({\n            apiVersion: \"admission.k8s.io/v1\",\n            kind: \"AdmissionReview\",\n            response: kubeAdmissionResponse,\n          });\n        } else {\n          kubeAdmissionResponse = {\n            uid: responseList[0].uid,\n            allowed: responseList.filter(r => !r.allowed).length === 0,\n            status: {\n              message: (responseList as ValidateResponse[])\n                .filter(rl => !rl.allowed)\n                .map(curr => curr.status?.message)\n                .join(\"; \"),\n            },\n          };\n          res.send({\n            apiVersion: \"admission.k8s.io/v1\",\n            kind: \"AdmissionReview\",\n            response: kubeAdmissionResponse,\n          });\n        }\n\n        Log.debug({ ...reqMetadata, kubeAdmissionResponse }, \"Outgoing response\");\n\n        this.#metricsCollector.observeEnd(startTime, admissionKind);\n      } catch (err) {\n        Log.error(err);\n        res.status(500).send(\"Internal Server Error\");\n        this.#metricsCollector.error();\n      }\n    };\n  };\n\n  /**\n   * Middleware for logging requests\n   *\n   * @param req the incoming request\n   * @param res the outgoing response\n   * @param next the next middleware function\n   */\n  static #logger(req: express.Request, res: express.Response, next: express.NextFunction) {\n    const startTime = Date.now();\n\n    res.on(\"finish\", () => {\n      const elapsedTime = Date.now() - startTime;\n      const message = {\n        uid: req.body?.request?.uid,\n        method: req.method,\n        url: req.originalUrl,\n        status: res.statusCode,\n        duration: `${elapsedTime} ms`,\n      };\n\n      res.statusCode >= 300 ? Log.warn(message) : Log.info(message);\n    });\n\n    next();\n  }\n  /**\n   * Health check endpoint handler\n   *\n   * @param req the incoming request\n   * @param res the outgoing response\n   */\n  static #healthz(req: express.Request, res: express.Response) {\n    try {\n      res.send(\"OK\");\n    } catch (err) {\n      Log.error(err);\n      res.status(500).send(\"Internal Server Error\");\n    }\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\n/* eslint-disable class-methods-use-this */\n\nimport { performance } from \"perf_hooks\";\nimport promClient, { Counter, Registry, Summary } from \"prom-client\";\nimport Log from \"./logger\";\n\nconst loggingPrefix = \"MetricsCollector\";\n\ninterface MetricNames {\n  errors: string;\n  alerts: string;\n  mutate: string;\n  validate: string;\n}\n\ninterface MetricArgs {\n  name: string;\n  help: string;\n  registers: Registry[];\n}\n\n/**\n * MetricsCollector class handles metrics collection using prom-client and performance hooks.\n */\nexport class MetricsCollector {\n  #registry: Registry;\n  #counters: Map<string, Counter<string>> = new Map();\n  #summaries: Map<string, Summary<string>> = new Map();\n  #prefix: string;\n\n  #metricNames: MetricNames = {\n    errors: \"errors\",\n    alerts: \"alerts\",\n    mutate: \"Mutate\",\n    validate: \"Validate\",\n  };\n\n  /**\n   * Creates a MetricsCollector instance with prefixed metrics.\n   * @param [prefix='pepr'] - The prefix for the metric names.\n   */\n  constructor(prefix = \"pepr\") {\n    this.#registry = new Registry();\n    this.#prefix = prefix;\n    this.addCounter(this.#metricNames.errors, \"Mutation/Validate errors encountered\");\n    this.addCounter(this.#metricNames.alerts, \"Mutation/Validate bad api token received\");\n    this.addSummary(this.#metricNames.mutate, \"Mutation operation summary\");\n    this.addSummary(this.#metricNames.validate, \"Validation operation summary\");\n  }\n\n  #getMetricName = (name: string) => `${this.#prefix}_${name}`;\n\n  #addMetric = <T extends Counter<string> | Summary<string>>(\n    collection: Map<string, T>,\n    MetricType: new (args: MetricArgs) => T,\n    name: string,\n    help: string,\n  ) => {\n    if (collection.has(this.#getMetricName(name))) {\n      Log.debug(`Metric for ${name} already exists`, loggingPrefix);\n      return;\n    }\n\n    const metric = new MetricType({\n      name: this.#getMetricName(name),\n      help,\n      registers: [this.#registry],\n    });\n\n    collection.set(this.#getMetricName(name), metric);\n  };\n\n  addCounter = (name: string, help: string) => {\n    this.#addMetric(this.#counters, promClient.Counter, name, help);\n  };\n\n  addSummary = (name: string, help: string) => {\n    this.#addMetric(this.#summaries, promClient.Summary, name, help);\n  };\n\n  incCounter = (name: string) => {\n    this.#counters.get(this.#getMetricName(name))?.inc();\n  };\n\n  /**\n   * Increments the error counter.\n   */\n  error = () => this.incCounter(this.#metricNames.errors);\n\n  /**\n   * Increments the alerts counter.\n   */\n  alert = () => this.incCounter(this.#metricNames.alerts);\n\n  /**\n   * Observes the duration since the provided start time and updates the summary.\n   * @param startTime - The start time.\n   * @param name - The metrics summary to increment.\n   */\n  observeEnd = (startTime: number, name: string = this.#metricNames.mutate) => {\n    this.#summaries.get(this.#getMetricName(name))?.observe(performance.now() - startTime);\n  };\n\n  /**\n   * Fetches the current metrics from the registry.\n   * @returns The metrics.\n   */\n  getMetrics = () => this.#registry.metrics();\n\n  /**\n   * Returns the current timestamp from performance.now() method. Useful for start timing an operation.\n   * @returns The timestamp.\n   */\n  static observeStart() {\n    return performance.now();\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport jsonPatch from \"fast-json-patch\";\nimport { kind } from \"kubernetes-fluent-client\";\n\nimport { Capability } from \"./capability\";\nimport { Errors } from \"./errors\";\nimport { shouldSkipRequest } from \"./filter\";\nimport { MutateResponse, AdmissionRequest } from \"./k8s\";\nimport Log from \"./logger\";\nimport { ModuleConfig } from \"./module\";\nimport { PeprMutateRequest } from \"./mutate-request\";\nimport { base64Encode, convertFromBase64Map, convertToBase64Map } from \"./utils\";\n\nexport async function mutateProcessor(\n  config: ModuleConfig,\n  capabilities: Capability[],\n  req: AdmissionRequest,\n  reqMetadata: Record<string, string>,\n): Promise<MutateResponse> {\n  const wrapped = new PeprMutateRequest(req);\n  const response: MutateResponse = {\n    uid: req.uid,\n    warnings: [],\n    allowed: false,\n  };\n\n  // Track whether any capability matched the request\n  let matchedAction = false;\n\n  // Track data fields that should be skipped during decoding\n  let skipDecode: string[] = [];\n\n  // If the resource is a secret, decode the data\n  const isSecret = req.kind.version == \"v1\" && req.kind.kind == \"Secret\";\n  if (isSecret) {\n    skipDecode = convertFromBase64Map(wrapped.Raw as unknown as kind.Secret);\n  }\n\n  Log.info(reqMetadata, `Processing request`);\n\n  for (const { name, bindings, namespaces } of capabilities) {\n    const actionMetadata = { ...reqMetadata, name };\n\n    for (const action of bindings) {\n      // Skip this action if it's not a mutate action\n      if (!action.mutateCallback) {\n        continue;\n      }\n\n      // Continue to the next action without doing anything if this one should be skipped\n      if (shouldSkipRequest(action, req, namespaces)) {\n        continue;\n      }\n\n      const label = action.mutateCallback.name;\n      Log.info(actionMetadata, `Processing matched action ${label}`);\n\n      matchedAction = true;\n\n      // Add annotations to the request to indicate that the capability started processing\n      // this will allow tracking of failed mutations that were permitted to continue\n      const updateStatus = (status: string) => {\n        // Only update the status if the request is a CREATE or UPDATE (we don't use CONNECT)\n        if (req.operation == \"DELETE\") {\n          return;\n        }\n\n        const identifier = `${config.uuid}.pepr.dev/${name}`;\n        wrapped.Raw.metadata = wrapped.Raw.metadata || {};\n        wrapped.Raw.metadata.annotations = wrapped.Raw.metadata.annotations || {};\n        wrapped.Raw.metadata.annotations[identifier] = status;\n      };\n\n      updateStatus(\"started\");\n\n      try {\n        // Run the action\n        await action.mutateCallback(wrapped);\n\n        Log.info(actionMetadata, `Action succeeded`);\n\n        // Add annotations to the request to indicate that the capability succeeded\n        updateStatus(\"succeeded\");\n      } catch (e) {\n        Log.warn(actionMetadata, `Action failed: ${e}`);\n        updateStatus(\"warning\");\n\n        // Annoying ts false positive\n        response.warnings = response.warnings || [];\n        response.warnings.push(`Action failed: ${e}`);\n\n        switch (config.onError) {\n          case Errors.reject:\n            Log.error(actionMetadata, `Action failed: ${e}`);\n            response.result = \"Pepr module configured to reject on error\";\n            return response;\n\n          case Errors.audit:\n            response.auditAnnotations = response.auditAnnotations || {};\n            response.auditAnnotations[Date.now()] = e;\n            break;\n        }\n      }\n    }\n  }\n\n  // If we've made it this far, the request is allowed\n  response.allowed = true;\n\n  // If no capability matched the request, exit early\n  if (!matchedAction) {\n    Log.info(reqMetadata, `No matching actions found`);\n    return response;\n  }\n\n  // delete operations can't be mutate, just return before the transformation\n  if (req.operation == \"DELETE\") {\n    return response;\n  }\n\n  const transformed = wrapped.Raw;\n\n  // Post-process the Secret requests to convert it back to the original format\n  if (isSecret) {\n    convertToBase64Map(transformed as unknown as kind.Secret, skipDecode);\n  }\n\n  // Compare the original request to the modified request to get the patches\n  const patches = jsonPatch.compare(req.object, transformed);\n\n  // Only add the patch if there are patches to apply\n  if (patches.length > 0) {\n    response.patchType = \"JSONPatch\";\n    // Webhook must be base64-encoded\n    // https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#response\n    response.patch = base64Encode(JSON.stringify(patches));\n  }\n\n  // Remove the warnings array if it's empty\n  if (response.warnings && response.warnings.length < 1) {\n    delete response.warnings;\n  }\n\n  Log.debug({ ...reqMetadata, patches }, `Patches generated`);\n\n  return response;\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nexport const Errors = {\n  audit: \"audit\",\n  ignore: \"ignore\",\n  reject: \"reject\",\n};\n\nexport const ErrorList = Object.values(Errors);\n\n/**\n * Validate the error or throw an error\n * @param error\n */\nexport function ValidateError(error = \"\") {\n  if (!ErrorList.includes(error)) {\n    throw new Error(`Invalid error: ${error}. Must be one of: ${ErrorList.join(\", \")}`);\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { GenericKind, GroupVersionKind, KubernetesObject, RegisterKind } from \"kubernetes-fluent-client\";\n\nexport enum Operation {\n  CREATE = \"CREATE\",\n  UPDATE = \"UPDATE\",\n  DELETE = \"DELETE\",\n  CONNECT = \"CONNECT\",\n}\n\n/**\n * PeprStore for internal use by Pepr. This is used to store arbitrary data in the cluster.\n */\nexport class PeprStore extends GenericKind {\n  declare data: {\n    [key: string]: string;\n  };\n}\n\nexport const peprStoreGVK = {\n  kind: \"PeprStore\",\n  version: \"v1\",\n  group: \"pepr.dev\",\n};\n\nRegisterKind(PeprStore, peprStoreGVK);\n\n/**\n * GroupVersionResource unambiguously identifies a resource. It doesn't anonymously include GroupVersion\n * to avoid automatic coercion. It doesn't use a GroupVersion to avoid custom marshalling\n */\nexport interface GroupVersionResource {\n  readonly group: string;\n  readonly version: string;\n  readonly resource: string;\n}\n\n/**\n * A Kubernetes admission request to be processed by a capability.\n */\nexport interface AdmissionRequest<T = KubernetesObject> {\n  /** UID is an identifier for the individual request/response. */\n  readonly uid: string;\n\n  /** Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) */\n  readonly kind: GroupVersionKind;\n\n  /** Resource is the fully-qualified resource being requested (for example, v1.pods) */\n  readonly resource: GroupVersionResource;\n\n  /** SubResource is the sub-resource being requested, if any (for example, \"status\" or \"scale\") */\n  readonly subResource?: string;\n\n  /** RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). */\n  readonly requestKind?: GroupVersionKind;\n\n  /** RequestResource is the fully-qualified resource of the original API request (for example, v1.pods). */\n  readonly requestResource?: GroupVersionResource;\n\n  /** RequestSubResource is the sub-resource of the original API request, if any (for example, \"status\" or \"scale\"). */\n  readonly requestSubResource?: string;\n\n  /**\n   * Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and\n   * rely on the server to generate the name. If that is the case, this method will return the empty string.\n   */\n  readonly name: string;\n\n  /** Namespace is the namespace associated with the request (if any). */\n  readonly namespace?: string;\n\n  /**\n   * Operation is the operation being performed. This may be different than the operation\n   * requested. e.g. a patch can result in either a CREATE or UPDATE Operation.\n   */\n  readonly operation: Operation;\n\n  /** UserInfo is information about the requesting user */\n  readonly userInfo: {\n    /** The name that uniquely identifies this user among all active users. */\n    username?: string;\n\n    /**\n     * A unique value that identifies this user across time. If this user is deleted\n     * and another user by the same name is added, they will have different UIDs.\n     */\n    uid?: string;\n\n    /** The names of groups this user is a part of. */\n    groups?: string[];\n\n    /** Any additional information provided by the authenticator. */\n    extra?: {\n      [key: string]: string[];\n    };\n  };\n\n  /** Object is the object from the incoming request prior to default values being applied */\n  readonly object: T;\n\n  /** OldObject is the existing object. Only populated for UPDATE or DELETE requests. */\n  readonly oldObject?: T;\n\n  /** DryRun indicates that modifications will definitely not be persisted for this request. Defaults to false. */\n  readonly dryRun?: boolean;\n\n  /**\n   * Options contains the options for the operation being performed.\n   * e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be\n   * different than the options the caller provided. e.g. for a patch request the performed\n   * Operation might be a CREATE, in which case the Options will a\n   * `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  readonly options?: any;\n}\n\nexport interface MutateResponse {\n  /** UID is an identifier for the individual request/response. This must be copied over from the corresponding AdmissionRequest. */\n  uid: string;\n\n  /** Allowed indicates whether or not the admission request was permitted. */\n  allowed: boolean;\n\n  /** Result contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\". */\n  result?: string;\n\n  /** The patch body. Currently we only support \"JSONPatch\" which implements RFC 6902. */\n  patch?: string;\n\n  /** The type of Patch. Currently we only allow \"JSONPatch\". */\n  patchType?: \"JSONPatch\";\n\n  /**\n   * AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).\n   *\n   * See https://kubernetes.io/docs/reference/labels-annotations-taints/audit-annotations/ for more information\n   */\n  auditAnnotations?: {\n    [key: string]: string;\n  };\n\n  /** warnings is a list of warning messages to return to the requesting API client. */\n  warnings?: string[];\n}\n\nexport interface ValidateResponse extends MutateResponse {\n  /** Status contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\". */\n  status?: {\n    /** A machine-readable description of why this operation is in the\n         \"Failure\" status. If this value is empty there is no information available. */\n    code: number;\n\n    /** A human-readable description of the status of this operation. */\n    message: string;\n  };\n}\n\nexport type WebhookIgnore = {\n  /**\n   * List of Kubernetes namespaces to always ignore.\n   * Any resources in these namespaces will be ignored by Pepr.\n   *\n   * Note: `kube-system` and `pepr-system` are always ignored.\n   */\n  namespaces?: string[];\n  /**\n   * List of Kubernetes labels to always ignore.\n   * Any resources with these labels will be ignored by Pepr.\n   *\n   * The example below will ignore any resources with the label `my-label=ulta-secret`:\n   * ```\n   * alwaysIgnore:\n   *   labels: [{ \"my-label\": \"ultra-secret\" }]\n   * ```\n   */\n  labels?: Record<string, string>[];\n};\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { AdmissionRequest, Operation } from \"./k8s\";\nimport logger from \"./logger\";\nimport { Binding, Event } from \"./types\";\n\n/**\n * shouldSkipRequest determines if a request should be skipped based on the binding filters.\n *\n * @param binding the action binding\n * @param req the incoming request\n * @returns\n */\nexport function shouldSkipRequest(binding: Binding, req: AdmissionRequest, capabilityNamespaces: string[]) {\n  const { group, kind, version } = binding.kind || {};\n  const { namespaces, labels, annotations, name } = binding.filters || {};\n  const operation = req.operation.toUpperCase();\n  // Use the old object if the request is a DELETE operation\n  const srcObject = operation === Operation.DELETE ? req.oldObject : req.object;\n  const { metadata } = srcObject || {};\n  const combinedNamespaces = [...namespaces, ...capabilityNamespaces];\n\n  // Test for matching operation\n  if (!binding.event.includes(operation) && !binding.event.includes(Event.Any)) {\n    return true;\n  }\n\n  // Test name first, since it's the most specific\n  if (name && name !== req.name) {\n    return true;\n  }\n\n  // Test for matching kinds\n  if (kind !== req.kind.kind) {\n    return true;\n  }\n\n  // Test for matching groups\n  if (group && group !== req.kind.group) {\n    return true;\n  }\n\n  // Test for matching versions\n  if (version && version !== req.kind.version) {\n    return true;\n  }\n\n  // Test for matching namespaces\n  if (combinedNamespaces.length && !combinedNamespaces.includes(req.namespace || \"\")) {\n    logger.debug(\"Namespace does not match\");\n    return true;\n  }\n\n  // Test for matching labels\n  for (const [key, value] of Object.entries(labels)) {\n    const testKey = metadata?.labels?.[key];\n\n    // First check if the label exists\n    if (!testKey) {\n      logger.debug(`Label ${key} does not exist`);\n      return true;\n    }\n\n    // Then check if the value matches, if specified\n    if (value && testKey !== value) {\n      logger.debug(`${testKey} does not match ${value}`);\n      return true;\n    }\n  }\n\n  // Test for matching annotations\n  for (const [key, value] of Object.entries(annotations)) {\n    const testKey = metadata?.annotations?.[key];\n\n    // First check if the annotation exists\n    if (!testKey) {\n      logger.debug(`Annotation ${key} does not exist`);\n      return true;\n    }\n\n    // Then check if the value matches, if specified\n    if (value && testKey !== value) {\n      logger.debug(`${testKey} does not match ${value}`);\n      return true;\n    }\n  }\n\n  // No failed filters, so we should not skip this request\n  return false;\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { KubernetesObject } from \"kubernetes-fluent-client\";\nimport { clone, mergeDeepRight } from \"ramda\";\n\nimport { AdmissionRequest, Operation } from \"./k8s\";\nimport { DeepPartial } from \"./types\";\n\n/**\n * The RequestWrapper class provides methods to modify Kubernetes objects in the context\n * of a mutating webhook request.\n */\nexport class PeprMutateRequest<T extends KubernetesObject> {\n  Raw: T;\n\n  #input: AdmissionRequest<T>;\n\n  get PermitSideEffects() {\n    return !this.#input.dryRun;\n  }\n\n  /**\n   * Indicates whether the request is a dry run.\n   * @returns true if the request is a dry run, false otherwise.\n   */\n  get IsDryRun() {\n    return this.#input.dryRun;\n  }\n\n  /**\n   * Provides access to the old resource in the request if available.\n   * @returns The old Kubernetes resource object or null if not available.\n   */\n  get OldResource() {\n    return this.#input.oldObject;\n  }\n\n  /**\n   * Provides access to the request object.\n   * @returns The request object containing the Kubernetes resource.\n   */\n  get Request() {\n    return this.#input;\n  }\n\n  /**\n   * Creates a new instance of the action class.\n   * @param input - The request object containing the Kubernetes resource to modify.\n   */\n  constructor(input: AdmissionRequest<T>) {\n    this.#input = input;\n\n    // If this is a DELETE operation, use the oldObject instead\n    if (input.operation.toUpperCase() === Operation.DELETE) {\n      this.Raw = clone(input.oldObject as T);\n    } else {\n      // Otherwise, use the incoming object\n      this.Raw = clone(input.object);\n    }\n\n    if (!this.Raw) {\n      throw new Error(\"unable to load the request object into PeprRequest.RawP\");\n    }\n  }\n\n  /**\n   * Deep merges the provided object with the current resource.\n   *\n   * @param obj - The object to merge with the current resource.\n   */\n  Merge = (obj: DeepPartial<T>) => {\n    this.Raw = mergeDeepRight(this.Raw, obj) as unknown as T;\n  };\n\n  /**\n   * Updates a label on the Kubernetes resource.\n   * @param key - The key of the label to update.\n   * @param value - The value of the label.\n   * @returns The current action instance for method chaining.\n   */\n  SetLabel = (key: string, value: string) => {\n    const ref = this.Raw;\n\n    ref.metadata = ref.metadata ?? {};\n    ref.metadata.labels = ref.metadata.labels ?? {};\n    ref.metadata.labels[key] = value;\n\n    return this;\n  };\n\n  /**\n   * Updates an annotation on the Kubernetes resource.\n   * @param key - The key of the annotation to update.\n   * @param value - The value of the annotation.\n   * @returns The current action instance for method chaining.\n   */\n  SetAnnotation = (key: string, value: string) => {\n    const ref = this.Raw;\n\n    ref.metadata = ref.metadata ?? {};\n    ref.metadata.annotations = ref.metadata.annotations ?? {};\n    ref.metadata.annotations[key] = value;\n\n    return this;\n  };\n\n  /**\n   * Removes a label from the Kubernetes resource.\n   * @param key - The key of the label to remove.\n   * @returns The current Action instance for method chaining.\n   */\n  RemoveLabel = (key: string) => {\n    if (this.Raw.metadata?.labels?.[key]) {\n      delete this.Raw.metadata.labels[key];\n    }\n\n    return this;\n  };\n\n  /**\n   * Removes an annotation from the Kubernetes resource.\n   * @param key - The key of the annotation to remove.\n   * @returns The current Action instance for method chaining.\n   */\n  RemoveAnnotation = (key: string) => {\n    if (this.Raw.metadata?.annotations?.[key]) {\n      delete this.Raw.metadata.annotations[key];\n    }\n\n    return this;\n  };\n\n  /**\n   * Check if a label exists on the Kubernetes resource.\n   *\n   * @param key the label key to check\n   * @returns\n   */\n  HasLabel = (key: string) => {\n    return this.Raw.metadata?.labels?.[key] !== undefined;\n  };\n\n  /**\n   * Check if an annotation exists on the Kubernetes resource.\n   *\n   * @param key the annotation key to check\n   * @returns\n   */\n  HasAnnotation = (key: string) => {\n    return this.Raw.metadata?.annotations?.[key] !== undefined;\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport Log from \"./logger\";\n\n/** Test if a string is ascii or not */\nexport const isAscii = /^[\\s\\x20-\\x7E]*$/;\n\n/**\n * Encode all ascii values in a map to base64\n * @param obj The object to encode\n * @param skip A list of keys to skip encoding\n */\nexport function convertToBase64Map(obj: { data?: Record<string, string> }, skip: string[]) {\n  obj.data = obj.data ?? {};\n  for (const key in obj.data) {\n    const value = obj.data[key];\n    // Only encode ascii values\n    obj.data[key] = skip.includes(key) ? value : base64Encode(value);\n  }\n}\n\n/**\n * Decode all ascii values in a map from base64 to utf-8\n * @param obj The object to decode\n * @returns A list of keys that were skipped\n */\nexport function convertFromBase64Map(obj: { data?: Record<string, string> }) {\n  const skip: string[] = [];\n\n  obj.data = obj.data ?? {};\n  for (const key in obj.data) {\n    if (obj.data[key] == undefined) {\n      obj.data[key] = \"\";\n    } else {\n      const decoded = base64Decode(obj.data[key]);\n      if (isAscii.test(decoded)) {\n        // Only decode ascii values\n        obj.data[key] = decoded;\n      } else {\n        skip.push(key);\n      }\n    }\n  }\n  Log.debug(`Non-ascii data detected in keys: ${skip}, skipping automatic base64 decoding`);\n  return skip;\n}\n\n/** Decode a base64 string */\nexport function base64Decode(data: string) {\n  return Buffer.from(data, \"base64\").toString(\"utf-8\");\n}\n\n/** Encode a string to base64 */\nexport function base64Encode(data: string) {\n  return Buffer.from(data).toString(\"base64\");\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\n/* eslint-disable class-methods-use-this */\n\nimport { KubernetesObject } from \"kubernetes-fluent-client\";\n\nimport { clone } from \"ramda\";\nimport { Operation, AdmissionRequest } from \"./k8s\";\nimport { ValidateActionResponse } from \"./types\";\n\n/**\n * The RequestWrapper class provides methods to modify Kubernetes objects in the context\n * of a mutating webhook request.\n */\nexport class PeprValidateRequest<T extends KubernetesObject> {\n  Raw: T;\n\n  #input: AdmissionRequest<T>;\n\n  /**\n   * Provides access to the old resource in the request if available.\n   * @returns The old Kubernetes resource object or null if not available.\n   */\n  get OldResource() {\n    return this.#input.oldObject;\n  }\n\n  /**\n   * Provides access to the request object.\n   * @returns The request object containing the Kubernetes resource.\n   */\n  get Request() {\n    return this.#input;\n  }\n\n  /**\n   * Creates a new instance of the Action class.\n   * @param input - The request object containing the Kubernetes resource to modify.\n   */\n  constructor(input: AdmissionRequest<T>) {\n    this.#input = input;\n\n    // If this is a DELETE operation, use the oldObject instead\n    if (input.operation.toUpperCase() === Operation.DELETE) {\n      this.Raw = clone(input.oldObject as T);\n    } else {\n      // Otherwise, use the incoming object\n      this.Raw = clone(input.object);\n    }\n\n    if (!this.Raw) {\n      throw new Error(\"unable to load the request object into PeprRequest.Raw\");\n    }\n  }\n\n  /**\n   * Check if a label exists on the Kubernetes resource.\n   *\n   * @param key the label key to check\n   * @returns\n   */\n  HasLabel = (key: string) => {\n    return this.Raw.metadata?.labels?.[key] !== undefined;\n  };\n\n  /**\n   * Check if an annotation exists on the Kubernetes resource.\n   *\n   * @param key the annotation key to check\n   * @returns\n   */\n  HasAnnotation = (key: string) => {\n    return this.Raw.metadata?.annotations?.[key] !== undefined;\n  };\n\n  /**\n   * Create a validation response that allows the request.\n   *\n   * @returns The validation response.\n   */\n  Approve = (): ValidateActionResponse => {\n    return {\n      allowed: true,\n    };\n  };\n\n  /**\n   * Create a validation response that denies the request.\n   *\n   * @param statusMessage Optional status message to return to the user.\n   * @param statusCode Optional status code to return to the user.\n   * @returns The validation response.\n   */\n  Deny = (statusMessage?: string, statusCode?: number): ValidateActionResponse => {\n    return {\n      allowed: false,\n      statusCode,\n      statusMessage,\n    };\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { kind } from \"kubernetes-fluent-client\";\n\nimport { Capability } from \"./capability\";\nimport { shouldSkipRequest } from \"./filter\";\nimport { AdmissionRequest, ValidateResponse } from \"./k8s\";\nimport Log from \"./logger\";\nimport { convertFromBase64Map } from \"./utils\";\nimport { PeprValidateRequest } from \"./validate-request\";\n\nexport async function validateProcessor(\n  capabilities: Capability[],\n  req: AdmissionRequest,\n  reqMetadata: Record<string, string>,\n): Promise<ValidateResponse[]> {\n  const wrapped = new PeprValidateRequest(req);\n  const response: ValidateResponse[] = [];\n\n  // If the resource is a secret, decode the data\n  const isSecret = req.kind.version == \"v1\" && req.kind.kind == \"Secret\";\n  if (isSecret) {\n    convertFromBase64Map(wrapped.Raw as unknown as kind.Secret);\n  }\n\n  Log.info(reqMetadata, `Processing validation request`);\n\n  for (const { name, bindings, namespaces } of capabilities) {\n    const actionMetadata = { ...reqMetadata, name };\n\n    for (const action of bindings) {\n      // Skip this action if it's not a validation action\n      if (!action.validateCallback) {\n        continue;\n      }\n\n      const localResponse: ValidateResponse = {\n        uid: req.uid,\n        allowed: true, // Assume it's allowed until a validation check fails\n      };\n\n      // Continue to the next action without doing anything if this one should be skipped\n      if (shouldSkipRequest(action, req, namespaces)) {\n        continue;\n      }\n\n      const label = action.validateCallback.name;\n      Log.info(actionMetadata, `Processing matched action ${label}`);\n\n      try {\n        // Run the validation callback, if it fails set allowed to false\n        const resp = await action.validateCallback(wrapped);\n        localResponse.allowed = resp.allowed;\n\n        // If the validation callback returned a status code or message, set it in the Response\n        if (resp.statusCode || resp.statusMessage) {\n          localResponse.status = {\n            code: resp.statusCode || 400,\n            message: resp.statusMessage || `Validation failed for ${name}`,\n          };\n        }\n\n        Log.info(actionMetadata, `Validation Action completed: ${resp.allowed ? \"allowed\" : \"denied\"}`);\n      } catch (e) {\n        // If any validation throws an error, note the failure in the Response\n        Log.error(actionMetadata, `Action failed: ${e}`);\n        localResponse.allowed = false;\n        localResponse.status = {\n          code: 500,\n          message: `Action failed with error: ${e}`,\n        };\n        return [localResponse];\n      }\n      response.push(localResponse);\n    }\n  }\n\n  return response;\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { Operation } from \"fast-json-patch\";\nimport { K8s } from \"kubernetes-fluent-client\";\nimport { startsWith } from \"ramda\";\n\nimport { Capability } from \"../capability\";\nimport { PeprStore } from \"../k8s\";\nimport Log from \"../logger\";\nimport { ModuleConfig } from \"../module\";\nimport { DataOp, DataSender, DataStore, Storage } from \"../storage\";\n\nconst namespace = \"pepr-system\";\nexport const debounceBackoff = 5000;\n\nexport class PeprControllerStore {\n  #name: string;\n  #stores: Record<string, Storage> = {};\n  #sendDebounce: NodeJS.Timeout | undefined;\n  #onReady?: () => void;\n\n  constructor(config: ModuleConfig, capabilities: Capability[], name: string, onReady?: () => void) {\n    this.#onReady = onReady;\n\n    // Setup Pepr State bindings\n    this.#name = name;\n\n    if (name.includes(\"schedule\")) {\n      // Establish the store for each capability\n      for (const { name, registerScheduleStore, hasSchedule } of capabilities) {\n        // Guard Clause to exit  early\n        if (hasSchedule !== true) {\n          continue;\n        }\n        // Register the scheduleStore with the capability\n        const { scheduleStore } = registerScheduleStore();\n\n        // Bind the store sender to the capability\n        scheduleStore.registerSender(this.#send(name));\n\n        // Store the storage instance\n        this.#stores[name] = scheduleStore;\n      }\n    } else {\n      // Establish the store for each capability\n      for (const { name, registerStore } of capabilities) {\n        // Register the store with the capability\n        const { store } = registerStore();\n\n        // Bind the store sender to the capability\n        store.registerSender(this.#send(name));\n\n        // Store the storage instance\n        this.#stores[name] = store;\n      }\n    }\n\n    // Add a jitter to the Store creation to avoid collisions\n    setTimeout(\n      () =>\n        K8s(PeprStore)\n          .InNamespace(namespace)\n          .Get(this.#name)\n          // If the get succeeds, setup the watch\n          .then(this.#setupWatch)\n          // Otherwise, create the resource\n          .catch(this.#createStoreResource),\n      Math.random() * 3000,\n    );\n  }\n\n  #setupWatch = () => {\n    void K8s(PeprStore, { name: this.#name, namespace }).Watch(this.#receive);\n  };\n\n  #receive = (store: PeprStore) => {\n    Log.debug(store, \"Pepr Store update\");\n\n    // Wrap the update in a debounced function\n    const debounced = () => {\n      // Base64 decode the data\n      const data: DataStore = store.data || {};\n\n      // Loop over each stored capability\n      for (const name of Object.keys(this.#stores)) {\n        // Get the prefix offset for the keys\n        const offset = `${name}-`.length;\n\n        // Get any keys that match the capability name prefix\n        const filtered: DataStore = {};\n\n        // Loop over each key in the secret\n        for (const key of Object.keys(data)) {\n          // Match on the capability name as a prefix\n          if (startsWith(name, key)) {\n            // Strip the prefix and store the value\n            filtered[key.slice(offset)] = data[key];\n          }\n        }\n\n        // Send the data to the receiver callback\n        this.#stores[name].receive(filtered);\n      }\n\n      // Call the onReady callback if this is the first time the secret has been read\n      if (this.#onReady) {\n        this.#onReady();\n        this.#onReady = undefined;\n      }\n    };\n\n    // Debounce the update to 1 second to avoid multiple rapid calls\n    clearTimeout(this.#sendDebounce);\n    this.#sendDebounce = setTimeout(debounced, debounceBackoff);\n  };\n\n  #send = (capabilityName: string) => {\n    const sendCache: Record<string, Operation> = {};\n\n    // Load the sendCache with patch operations\n    const fillCache = (op: DataOp, key: string[], val?: string) => {\n      if (op === \"add\") {\n        const path = `/data/${capabilityName}-${key}`;\n        const value = val || \"\";\n        const cacheIdx = [op, path, value].join(\":\");\n\n        // Add the operation to the cache\n        sendCache[cacheIdx] = { op, path, value };\n\n        return;\n      }\n\n      if (op === \"remove\") {\n        if (key.length < 1) {\n          throw new Error(`Key is required for REMOVE operation`);\n        }\n\n        for (const k of key) {\n          const path = `/data/${capabilityName}-${k}`;\n          const cacheIdx = [op, path].join(\":\");\n\n          // Add the operation to the cache\n          sendCache[cacheIdx] = { op, path };\n        }\n\n        return;\n      }\n\n      // If we get here, the operation is not supported\n      throw new Error(`Unsupported operation: ${op}`);\n    };\n\n    // Send the cached updates to the cluster\n    const flushCache = async () => {\n      const indexes = Object.keys(sendCache);\n      const payload = Object.values(sendCache);\n\n      // Loop over each key in the cache and delete it to avoid collisions with other sender calls\n      for (const idx of indexes) {\n        delete sendCache[idx];\n      }\n\n      try {\n        // Send the patch to the cluster\n        await K8s(PeprStore, { namespace, name: this.#name }).Patch(payload);\n      } catch (err) {\n        Log.error(err, \"Pepr store update failure\");\n\n        // On failure to update, re-add the operations to the cache to be retried\n        for (const idx of indexes) {\n          sendCache[idx] = payload[Number(idx)];\n        }\n      }\n    };\n\n    // Create a sender function for the capability to add/remove data from the store\n    const sender: DataSender = async (op: DataOp, key: string[], val?: string) => {\n      fillCache(op, key, val);\n    };\n\n    // Send any cached updates every debounceBackoff milliseconds\n    setInterval(() => {\n      if (Object.keys(sendCache).length > 0) {\n        Log.debug(sendCache, \"Sending updates to Pepr store\");\n        void flushCache();\n      }\n    }, debounceBackoff);\n\n    return sender;\n  };\n\n  #createStoreResource = async (e: unknown) => {\n    Log.info(`Pepr store not found, creating...`);\n    Log.debug(e);\n\n    try {\n      await K8s(PeprStore).Apply({\n        metadata: {\n          name: this.#name,\n          namespace,\n        },\n        data: {\n          // JSON Patch will die if the data is empty, so we need to add a placeholder\n          __pepr_do_not_delete__: \"k-thx-bye\",\n        },\n      });\n\n      // Now that the resource exists, setup the watch\n      this.#setupWatch();\n    } catch (err) {\n      Log.error(err, \"Failed to create Pepr store\");\n    }\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { K8s } from \"kubernetes-fluent-client\";\nimport { WatchPhase } from \"kubernetes-fluent-client/dist/fluent/types\";\n\nimport { WatchCfg } from \"kubernetes-fluent-client/dist/fluent/watch\";\nimport { Capability } from \"./capability\";\nimport Log from \"./logger\";\nimport { Binding, Event } from \"./types\";\n\nexport function setupWatch(capabilities: Capability[]) {\n  capabilities\n    .flatMap(c => c.bindings)\n    .filter(binding => binding.isWatch)\n    .forEach(runBinding);\n}\n\nasync function runBinding(binding: Binding) {\n  // Map the event to the watch phase\n  const eventToPhaseMap = {\n    [Event.Create]: [WatchPhase.Added],\n    [Event.Update]: [WatchPhase.Modified],\n    [Event.CreateOrUpdate]: [WatchPhase.Added, WatchPhase.Modified],\n    [Event.Delete]: [WatchPhase.Deleted],\n    [Event.Any]: [WatchPhase.Added, WatchPhase.Modified, WatchPhase.Deleted],\n  };\n\n  // Get the phases to match, default to any\n  const phaseMatch: WatchPhase[] = eventToPhaseMap[binding.event] || eventToPhaseMap[Event.Any];\n\n  const watchCfg: WatchCfg = {\n    retryMax: 3,\n    retryDelaySec: 5,\n    retryFail(e) {\n      // If failure continues, log and exit\n      Log.error(e, \"Watch failed after 3 attempts, giving up\");\n      process.exit(1);\n    },\n  };\n\n  // Watch the resource\n  await K8s(binding.model, binding.filters).Watch((obj, type) => {\n    // If the type matches the phase, call the watch callback\n    if (phaseMatch.includes(type)) {\n      try {\n        // This may be a promise, but we don't need to wait for it\n        void binding.watchCallback?.(obj, type);\n      } catch (e) {\n        // Errors in the watch callback should not crash the controller\n        Log.error(e, \"Error executing watch callback\");\n      }\n    }\n  }, watchCfg);\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { clone } from \"ramda\";\nimport Log from \"./logger\";\n\nexport type DataOp = \"add\" | \"remove\";\nexport type DataStore = Record<string, string>;\nexport type DataSender = (op: DataOp, keys: string[], value?: string) => void;\nexport type DataReceiver = (data: DataStore) => void;\nexport type Unsubscribe = () => void;\n\nconst MAX_WAIT_TIME = 15000;\nexport interface PeprStore {\n  /**\n   * Returns the current value associated with the given key, or null if the given key does not exist.\n   */\n  getItem(key: string): string | null;\n  /**\n   * Removes all key/value pairs, if there are any.\n   */\n  clear(): void;\n  /**\n   * Removes the key/value pair with the given key, if a key/value pair with the given key exists.\n   */\n  removeItem(key: string): void;\n  /**\n   * Sets the value of the pair identified by key to value, creating a new key/value pair if none existed for key previously.\n   */\n  setItem(key: string, value: string): void;\n\n  /**\n   * Subscribe to changes in the store. This API behaves similarly to the [Svelte Store API](https://vercel.com/docs/beginner-sveltekit/svelte-stores#using-the-store).\n   *\n   * @param listener - The callback to be invoked when the store changes.\n   * @returns A function to unsubscribe from the listener.\n   */\n  subscribe(listener: DataReceiver): Unsubscribe;\n\n  /**\n   * Register a function to be called when the store is ready.\n   */\n  onReady(callback: DataReceiver): void;\n\n  /**\n   * Sets the value of the pair identified by key to value, creating a new key/value pair if none existed for key previously.\n   * Resolves when the key/value show up in the store.\n   */\n  setItemAndWait(key: string, value: string): Promise<void>;\n}\n\n/**\n * A key-value data store that can be used to persist data that should be shared across Pepr controllers and capabilities.\n *\n * The API is similar to the [Storage API](https://developer.mozilla.org/docs/Web/API/Storage)\n */\nexport class Storage implements PeprStore {\n  #store: DataStore = {};\n  #send!: DataSender;\n  #subscribers: Record<number, DataReceiver> = {};\n  #subscriberId = 0;\n  #readyHandlers: DataReceiver[] = [];\n\n  registerSender = (send: DataSender) => {\n    this.#send = send;\n  };\n\n  receive = (data: DataStore) => {\n    Log.debug(data, `Pepr store data received`);\n    this.#store = data || {};\n\n    this.#onReady();\n\n    // Notify all subscribers\n    for (const idx in this.#subscribers) {\n      // Send a unique clone of the store to each subscriber\n      this.#subscribers[idx](clone(this.#store));\n    }\n  };\n\n  getItem = (key: string) => {\n    // Return null if the value is the empty string\n    return this.#store[key] || null;\n  };\n\n  clear = () => {\n    this.#dispatchUpdate(\"remove\", Object.keys(this.#store));\n  };\n\n  removeItem = (key: string) => {\n    this.#dispatchUpdate(\"remove\", [key]);\n  };\n\n  setItem = (key: string, value: string) => {\n    this.#dispatchUpdate(\"add\", [key], value);\n  };\n\n  /**\n   * Creates a promise and subscribes to the store, the promise resolves when\n   * the key and value are seen in the store.\n   *\n   * @param key - The key to add into the store\n   * @param value - The value of the key\n   * @returns\n   */\n  setItemAndWait = (key: string, value: string) => {\n    this.#dispatchUpdate(\"add\", [key], value);\n    return new Promise<void>((resolve, reject) => {\n      const unsubscribe = this.subscribe(data => {\n        if (data[key] === value) {\n          unsubscribe();\n          resolve();\n        }\n      });\n\n      // If promise has not resolved before MAX_WAIT_TIME reject\n      setTimeout(() => {\n        unsubscribe();\n        return reject();\n      }, MAX_WAIT_TIME);\n    });\n  };\n\n  subscribe = (subscriber: DataReceiver) => {\n    const idx = this.#subscriberId++;\n    this.#subscribers[idx] = subscriber;\n    return () => this.unsubscribe(idx);\n  };\n\n  onReady = (callback: DataReceiver) => {\n    this.#readyHandlers.push(callback);\n  };\n\n  /**\n   * Remove a subscriber from the list of subscribers.\n   * @param idx - The index of the subscriber to remove.\n   */\n  unsubscribe = (idx: number) => {\n    delete this.#subscribers[idx];\n  };\n\n  #onReady = () => {\n    // Notify all ready handlers with a clone of the store\n    for (const handler of this.#readyHandlers) {\n      handler(clone(this.#store));\n    }\n\n    // Make this a noop so that it can't be called again\n    this.#onReady = () => {};\n  };\n\n  /**\n   * Dispatch an update to the store and notify all subscribers.\n   * @param  op - The type of operation to perform.\n   * @param  keys - The keys to update.\n   * @param  [value] - The new value.\n   */\n  #dispatchUpdate = (op: DataOp, keys: string[], value?: string) => {\n    this.#send(op, keys, value);\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { PeprStore } from \"./storage\";\n\ntype Unit = \"seconds\" | \"second\" | \"minute\" | \"minutes\" | \"hours\" | \"hour\";\n\nexport interface Schedule {\n  /**\n   * * The name of the store\n   */\n  name: string;\n  /**\n   * The value associated with a unit of time\n   */\n  every: number;\n  /**\n   * The unit of time\n   */\n  unit: Unit;\n  /**\n   * The code to run\n   */\n  run: () => void;\n  /**\n   * The start time of the schedule\n   */\n  startTime?: Date | undefined;\n\n  /**\n   * The number of times the schedule has run\n   */\n  completions?: number | undefined;\n  /**\n   * Tje intervalID to clear the interval\n   */\n  intervalID?: NodeJS.Timeout;\n}\n\nexport class OnSchedule implements Schedule {\n  intervalId: NodeJS.Timeout | null = null;\n  store: PeprStore | undefined;\n  name!: string;\n  completions?: number | undefined;\n  every: number;\n  unit: Unit;\n  run!: () => void;\n  startTime?: Date | undefined;\n  duration: number | undefined;\n  lastTimestamp: Date | undefined;\n\n  constructor(schedule: Schedule) {\n    this.name = schedule.name;\n    this.run = schedule.run;\n    this.every = schedule.every;\n    this.unit = schedule.unit;\n    this.startTime = schedule?.startTime;\n    this.completions = schedule?.completions;\n  }\n  setStore(store: PeprStore) {\n    this.store = store;\n    this.startInterval();\n  }\n  startInterval() {\n    this.checkStore();\n    this.getDuration();\n    this.setupInterval();\n  }\n  /**\n   * Checks the store for this schedule and sets the values if it exists\n   * @returns\n   */\n  checkStore() {\n    const result = this.store && this.store.getItem(this.name);\n    if (result) {\n      const storedSchedule = JSON.parse(result);\n      this.completions = storedSchedule?.completions;\n      this.startTime = storedSchedule?.startTime;\n      this.lastTimestamp = storedSchedule?.lastTimestamp;\n    }\n  }\n\n  /**\n   * Saves the schedule to the store\n   * @returns\n   */\n  saveToStore() {\n    const schedule = {\n      completions: this.completions,\n      startTime: this.startTime,\n      lastTimestamp: new Date(),\n      name: this.name,\n    };\n    this.store && this.store.setItem(this.name, JSON.stringify(schedule));\n  }\n\n  /**\n   * Gets the durations in milliseconds\n   */\n  getDuration() {\n    switch (this.unit) {\n      case \"seconds\":\n        if (this.every < 10) throw new Error(\"10 Seconds in the smallest interval allowed\");\n        this.duration = 1000 * this.every;\n        break;\n      case \"minutes\":\n      case \"minute\":\n        this.duration = 1000 * 60 * this.every;\n        break;\n      case \"hours\":\n      case \"hour\":\n        this.duration = 1000 * 60 * 60 * this.every;\n        break;\n      default:\n        throw new Error(\"Invalid time unit\");\n    }\n  }\n\n  /**\n   * Sets up the interval\n   */\n  setupInterval() {\n    const now = new Date();\n    let delay: number | undefined;\n\n    if (this.lastTimestamp && this.startTime) {\n      this.startTime = undefined;\n    }\n\n    if (this.startTime) {\n      delay = this.startTime.getTime() - now.getTime();\n    } else if (this.lastTimestamp && this.duration) {\n      const lastTimestamp = new Date(this.lastTimestamp);\n      delay = this.duration - (now.getTime() - lastTimestamp.getTime());\n    }\n\n    if (delay === undefined || delay <= 0) {\n      this.start();\n    } else {\n      setTimeout(() => {\n        this.start();\n      }, delay);\n    }\n  }\n\n  /**\n   * Starts the interval\n   */\n  start() {\n    this.intervalId = setInterval(() => {\n      if (this.completions === 0) {\n        this.stop();\n        return;\n      } else {\n        this.run();\n\n        if (this.completions && this.completions !== 0) {\n          this.completions -= 1;\n        }\n        this.saveToStore();\n      }\n    }, this.duration);\n  }\n\n  /**\n   * Stops the interval\n   */\n  stop() {\n    if (this.intervalId) {\n      clearInterval(this.intervalId);\n      this.intervalId = null;\n    }\n    this.store && this.store.removeItem(this.name);\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { PeprValidateRequest } from \"./validate-request\";\nimport { PeprMutateRequest } from \"./mutate-request\";\nimport { a } from \"../lib\";\n\n// Returns all containers in the pod\nexport function containers(\n  request: PeprValidateRequest<a.Pod> | PeprMutateRequest<a.Pod>,\n  containerType?: \"containers\" | \"initContainers\" | \"ephemeralContainers\",\n) {\n  const containers = request.Raw.spec?.containers || [];\n  const initContainers = request.Raw.spec?.initContainers || [];\n  const ephemeralContainers = request.Raw.spec?.ephemeralContainers || [];\n\n  if (containerType === \"containers\") {\n    return containers;\n  }\n  if (containerType === \"initContainers\") {\n    return initContainers;\n  }\n  if (containerType === \"ephemeralContainers\") {\n    return ephemeralContainers;\n  }\n  return [...containers, ...initContainers, ...ephemeralContainers];\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4CAAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAC,mCAAuE;AACvE,QAAmB;;;ACEnB,IAAAC,mCAAwE;AAExE,IAAAC,gBAAuB;;;ACFvB,kBAAqB;AAErB,IAAM,cAAc,QAAQ,IAAI,qBAAqB;AAErD,IAAM,SAAS;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AAAA,IACP,UAAU;AAAA,EACZ;AACF;AAEA,IAAM,YAAY,cAAc,SAAS;AAEzC,IAAM,UAAM,kBAAK;AAAA,EACf;AACF,CAAC;AAED,IAAI,QAAQ,IAAI,WAAW;AACzB,MAAI,QAAQ,QAAQ,IAAI;AAC1B;AAEA,IAAO,iBAAQ;;;ACrBf,IAAAC,gBAAsB;;;ACAtB,qBAAsC;AACtC,gBAAe;AACf,mBAAkB;;;ACAlB,wBAA4B;AAC5B,yBAAuD;AAGvD,IAAM,gBAAgB;AAkBf,IAAM,mBAAN,MAAuB;AAAA,EAC5B;AAAA,EACA,YAA0C,oBAAI,IAAI;AAAA,EAClD,aAA2C,oBAAI,IAAI;AAAA,EACnD;AAAA,EAEA,eAA4B;AAAA,IAC1B,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,SAAS,QAAQ;AAC3B,SAAK,YAAY,IAAI,4BAAS;AAC9B,SAAK,UAAU;AACf,SAAK,WAAW,KAAK,aAAa,QAAQ,sCAAsC;AAChF,SAAK,WAAW,KAAK,aAAa,QAAQ,0CAA0C;AACpF,SAAK,WAAW,KAAK,aAAa,QAAQ,4BAA4B;AACtE,SAAK,WAAW,KAAK,aAAa,UAAU,8BAA8B;AAAA,EAC5E;AAAA,EAEA,iBAAiB,CAAC,SAAiB,GAAG,KAAK,OAAO,IAAI,IAAI;AAAA,EAE1D,aAAa,CACX,YACA,YACA,MACA,SACG;AACH,QAAI,WAAW,IAAI,KAAK,eAAe,IAAI,CAAC,GAAG;AAC7C,qBAAI,MAAM,cAAc,IAAI,mBAAmB,aAAa;AAC5D;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,WAAW;AAAA,MAC5B,MAAM,KAAK,eAAe,IAAI;AAAA,MAC9B;AAAA,MACA,WAAW,CAAC,KAAK,SAAS;AAAA,IAC5B,CAAC;AAED,eAAW,IAAI,KAAK,eAAe,IAAI,GAAG,MAAM;AAAA,EAClD;AAAA,EAEA,aAAa,CAAC,MAAc,SAAiB;AAC3C,SAAK,WAAW,KAAK,WAAW,mBAAAC,QAAW,SAAS,MAAM,IAAI;AAAA,EAChE;AAAA,EAEA,aAAa,CAAC,MAAc,SAAiB;AAC3C,SAAK,WAAW,KAAK,YAAY,mBAAAA,QAAW,SAAS,MAAM,IAAI;AAAA,EACjE;AAAA,EAEA,aAAa,CAAC,SAAiB;AAC7B,SAAK,UAAU,IAAI,KAAK,eAAe,IAAI,CAAC,GAAG,IAAI;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,MAAM,KAAK,WAAW,KAAK,aAAa,MAAM;AAAA;AAAA;AAAA;AAAA,EAKtD,QAAQ,MAAM,KAAK,WAAW,KAAK,aAAa,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtD,aAAa,CAAC,WAAmB,OAAe,KAAK,aAAa,WAAW;AAC3E,SAAK,WAAW,IAAI,KAAK,eAAe,IAAI,CAAC,GAAG,QAAQ,8BAAY,IAAI,IAAI,SAAS;AAAA,EACvF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa,MAAM,KAAK,UAAU,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1C,OAAO,eAAe;AACpB,WAAO,8BAAY,IAAI;AAAA,EACzB;AACF;;;ACpHA,6BAAsB;;;ACAf,IAAM,SAAS;AAAA,EACpB,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,IAAM,YAAY,OAAO,OAAO,MAAM;AAMtC,SAAS,cAAc,QAAQ,IAAI;AACxC,MAAI,CAAC,UAAU,SAAS,KAAK,GAAG;AAC9B,UAAM,IAAI,MAAM,kBAAkB,KAAK,qBAAqB,UAAU,KAAK,IAAI,CAAC,EAAE;AAAA,EACpF;AACF;;;AChBA,sCAA8E;AAYvE,IAAM,YAAN,cAAwB,4CAAY;AAI3C;AAEO,IAAM,eAAe;AAAA,EAC1B,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AACT;AAAA,IAEA,8CAAa,WAAW,YAAY;;;ACb7B,SAAS,kBAAkB,SAAkB,KAAuB,sBAAgC;AACzG,QAAM,EAAE,OAAO,MAAAC,OAAM,QAAQ,IAAI,QAAQ,QAAQ,CAAC;AAClD,QAAM,EAAE,YAAY,QAAQ,aAAa,KAAK,IAAI,QAAQ,WAAW,CAAC;AACtE,QAAM,YAAY,IAAI,UAAU,YAAY;AAE5C,QAAM,YAAY,sCAAiC,IAAI,YAAY,IAAI;AACvE,QAAM,EAAE,SAAS,IAAI,aAAa,CAAC;AACnC,QAAM,qBAAqB,CAAC,GAAG,YAAY,GAAG,oBAAoB;AAGlE,MAAI,CAAC,QAAQ,MAAM,SAAS,SAAS,KAAK,CAAC,QAAQ,MAAM,sBAAkB,GAAG;AAC5E,WAAO;AAAA,EACT;AAGA,MAAI,QAAQ,SAAS,IAAI,MAAM;AAC7B,WAAO;AAAA,EACT;AAGA,MAAIA,UAAS,IAAI,KAAK,MAAM;AAC1B,WAAO;AAAA,EACT;AAGA,MAAI,SAAS,UAAU,IAAI,KAAK,OAAO;AACrC,WAAO;AAAA,EACT;AAGA,MAAI,WAAW,YAAY,IAAI,KAAK,SAAS;AAC3C,WAAO;AAAA,EACT;AAGA,MAAI,mBAAmB,UAAU,CAAC,mBAAmB,SAAS,IAAI,aAAa,EAAE,GAAG;AAClF,mBAAO,MAAM,0BAA0B;AACvC,WAAO;AAAA,EACT;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAM,UAAU,UAAU,SAAS,GAAG;AAGtC,QAAI,CAAC,SAAS;AACZ,qBAAO,MAAM,SAAS,GAAG,iBAAiB;AAC1C,aAAO;AAAA,IACT;AAGA,QAAI,SAAS,YAAY,OAAO;AAC9B,qBAAO,MAAM,GAAG,OAAO,mBAAmB,KAAK,EAAE;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,WAAW,GAAG;AACtD,UAAM,UAAU,UAAU,cAAc,GAAG;AAG3C,QAAI,CAAC,SAAS;AACZ,qBAAO,MAAM,cAAc,GAAG,iBAAiB;AAC/C,aAAO;AAAA,IACT;AAGA,QAAI,SAAS,YAAY,OAAO;AAC9B,qBAAO,MAAM,GAAG,OAAO,mBAAmB,KAAK,EAAE;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AAGA,SAAO;AACT;;;ACtFA,mBAAsC;AAS/B,IAAM,oBAAN,MAAoD;AAAA,EACzD;AAAA,EAEA;AAAA,EAEA,IAAI,oBAAoB;AACtB,WAAO,CAAC,KAAK,OAAO;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAAc;AAChB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,UAAU;AACZ,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAA4B;AACtC,SAAK,SAAS;AAGd,QAAI,MAAM,UAAU,YAAY,6BAAwB;AACtD,WAAK,UAAM,oBAAM,MAAM,SAAc;AAAA,IACvC,OAAO;AAEL,WAAK,UAAM,oBAAM,MAAM,MAAM;AAAA,IAC/B;AAEA,QAAI,CAAC,KAAK,KAAK;AACb,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ,CAAC,QAAwB;AAC/B,SAAK,UAAM,6BAAe,KAAK,KAAK,GAAG;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,CAAC,KAAa,UAAkB;AACzC,UAAM,MAAM,KAAK;AAEjB,QAAI,WAAW,IAAI,YAAY,CAAC;AAChC,QAAI,SAAS,SAAS,IAAI,SAAS,UAAU,CAAC;AAC9C,QAAI,SAAS,OAAO,GAAG,IAAI;AAE3B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,CAAC,KAAa,UAAkB;AAC9C,UAAM,MAAM,KAAK;AAEjB,QAAI,WAAW,IAAI,YAAY,CAAC;AAChC,QAAI,SAAS,cAAc,IAAI,SAAS,eAAe,CAAC;AACxD,QAAI,SAAS,YAAY,GAAG,IAAI;AAEhC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc,CAAC,QAAgB;AAC7B,QAAI,KAAK,IAAI,UAAU,SAAS,GAAG,GAAG;AACpC,aAAO,KAAK,IAAI,SAAS,OAAO,GAAG;AAAA,IACrC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBAAmB,CAAC,QAAgB;AAClC,QAAI,KAAK,IAAI,UAAU,cAAc,GAAG,GAAG;AACzC,aAAO,KAAK,IAAI,SAAS,YAAY,GAAG;AAAA,IAC1C;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,CAAC,QAAgB;AAC1B,WAAO,KAAK,IAAI,UAAU,SAAS,GAAG,MAAM;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,CAAC,QAAgB;AAC/B,WAAO,KAAK,IAAI,UAAU,cAAc,GAAG,MAAM;AAAA,EACnD;AACF;;;ACxJA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMO,IAAM,UAAU;AAOhB,SAAS,mBAAmB,KAAwC,MAAgB;AACzF,MAAI,OAAO,IAAI,QAAQ,CAAC;AACxB,aAAW,OAAO,IAAI,MAAM;AAC1B,UAAM,QAAQ,IAAI,KAAK,GAAG;AAE1B,QAAI,KAAK,GAAG,IAAI,KAAK,SAAS,GAAG,IAAI,QAAQ,aAAa,KAAK;AAAA,EACjE;AACF;AAOO,SAAS,qBAAqB,KAAwC;AAC3E,QAAM,OAAiB,CAAC;AAExB,MAAI,OAAO,IAAI,QAAQ,CAAC;AACxB,aAAW,OAAO,IAAI,MAAM;AAC1B,QAAI,IAAI,KAAK,GAAG,KAAK,QAAW;AAC9B,UAAI,KAAK,GAAG,IAAI;AAAA,IAClB,OAAO;AACL,YAAM,UAAU,aAAa,IAAI,KAAK,GAAG,CAAC;AAC1C,UAAI,QAAQ,KAAK,OAAO,GAAG;AAEzB,YAAI,KAAK,GAAG,IAAI;AAAA,MAClB,OAAO;AACL,aAAK,KAAK,GAAG;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,iBAAI,MAAM,oCAAoC,IAAI,sCAAsC;AACxF,SAAO;AACT;AAGO,SAAS,aAAa,MAAc;AACzC,SAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,SAAS,OAAO;AACrD;AAGO,SAAS,aAAa,MAAc;AACzC,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,QAAQ;AAC5C;;;ALzCA,eAAsB,gBACpB,QACA,cACA,KACA,aACyB;AACzB,QAAM,UAAU,IAAI,kBAAkB,GAAG;AACzC,QAAM,WAA2B;AAAA,IAC/B,KAAK,IAAI;AAAA,IACT,UAAU,CAAC;AAAA,IACX,SAAS;AAAA,EACX;AAGA,MAAI,gBAAgB;AAGpB,MAAI,aAAuB,CAAC;AAG5B,QAAM,WAAW,IAAI,KAAK,WAAW,QAAQ,IAAI,KAAK,QAAQ;AAC9D,MAAI,UAAU;AACZ,iBAAa,qBAAqB,QAAQ,GAA6B;AAAA,EACzE;AAEA,iBAAI,KAAK,aAAa,oBAAoB;AAE1C,aAAW,EAAE,MAAM,UAAU,WAAW,KAAK,cAAc;AACzD,UAAM,iBAAiB,EAAE,GAAG,aAAa,KAAK;AAE9C,eAAW,UAAU,UAAU;AAE7B,UAAI,CAAC,OAAO,gBAAgB;AAC1B;AAAA,MACF;AAGA,UAAI,kBAAkB,QAAQ,KAAK,UAAU,GAAG;AAC9C;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,eAAe;AACpC,qBAAI,KAAK,gBAAgB,6BAA6B,KAAK,EAAE;AAE7D,sBAAgB;AAIhB,YAAM,eAAe,CAAC,WAAmB;AAEvC,YAAI,IAAI,aAAa,UAAU;AAC7B;AAAA,QACF;AAEA,cAAM,aAAa,GAAG,OAAO,IAAI,aAAa,IAAI;AAClD,gBAAQ,IAAI,WAAW,QAAQ,IAAI,YAAY,CAAC;AAChD,gBAAQ,IAAI,SAAS,cAAc,QAAQ,IAAI,SAAS,eAAe,CAAC;AACxE,gBAAQ,IAAI,SAAS,YAAY,UAAU,IAAI;AAAA,MACjD;AAEA,mBAAa,SAAS;AAEtB,UAAI;AAEF,cAAM,OAAO,eAAe,OAAO;AAEnC,uBAAI,KAAK,gBAAgB,kBAAkB;AAG3C,qBAAa,WAAW;AAAA,MAC1B,SAAS,GAAG;AACV,uBAAI,KAAK,gBAAgB,kBAAkB,CAAC,EAAE;AAC9C,qBAAa,SAAS;AAGtB,iBAAS,WAAW,SAAS,YAAY,CAAC;AAC1C,iBAAS,SAAS,KAAK,kBAAkB,CAAC,EAAE;AAE5C,gBAAQ,OAAO,SAAS;AAAA,UACtB,KAAK,OAAO;AACV,2BAAI,MAAM,gBAAgB,kBAAkB,CAAC,EAAE;AAC/C,qBAAS,SAAS;AAClB,mBAAO;AAAA,UAET,KAAK,OAAO;AACV,qBAAS,mBAAmB,SAAS,oBAAoB,CAAC;AAC1D,qBAAS,iBAAiB,KAAK,IAAI,CAAC,IAAI;AACxC;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,WAAS,UAAU;AAGnB,MAAI,CAAC,eAAe;AAClB,mBAAI,KAAK,aAAa,2BAA2B;AACjD,WAAO;AAAA,EACT;AAGA,MAAI,IAAI,aAAa,UAAU;AAC7B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,QAAQ;AAG5B,MAAI,UAAU;AACZ,uBAAmB,aAAuC,UAAU;AAAA,EACtE;AAGA,QAAM,UAAU,uBAAAC,QAAU,QAAQ,IAAI,QAAQ,WAAW;AAGzD,MAAI,QAAQ,SAAS,GAAG;AACtB,aAAS,YAAY;AAGrB,aAAS,QAAQ,aAAa,KAAK,UAAU,OAAO,CAAC;AAAA,EACvD;AAGA,MAAI,SAAS,YAAY,SAAS,SAAS,SAAS,GAAG;AACrD,WAAO,SAAS;AAAA,EAClB;AAEA,iBAAI,MAAM,EAAE,GAAG,aAAa,QAAQ,GAAG,mBAAmB;AAE1D,SAAO;AACT;;;AM7IA,IAAAC,gBAAsB;AAQf,IAAM,sBAAN,MAAsD;AAAA,EAC3D;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAAc;AAChB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,UAAU;AACZ,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAA4B;AACtC,SAAK,SAAS;AAGd,QAAI,MAAM,UAAU,YAAY,6BAAwB;AACtD,WAAK,UAAM,qBAAM,MAAM,SAAc;AAAA,IACvC,OAAO;AAEL,WAAK,UAAM,qBAAM,MAAM,MAAM;AAAA,IAC/B;AAEA,QAAI,CAAC,KAAK,KAAK;AACb,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,CAAC,QAAgB;AAC1B,WAAO,KAAK,IAAI,UAAU,SAAS,GAAG,MAAM;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,CAAC,QAAgB;AAC/B,WAAO,KAAK,IAAI,UAAU,cAAc,GAAG,MAAM;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAAU,MAA8B;AACtC,WAAO;AAAA,MACL,SAAS;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,CAAC,eAAwB,eAAgD;AAC9E,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;;;ACzFA,eAAsB,kBACpB,cACA,KACA,aAC6B;AAC7B,QAAM,UAAU,IAAI,oBAAoB,GAAG;AAC3C,QAAM,WAA+B,CAAC;AAGtC,QAAM,WAAW,IAAI,KAAK,WAAW,QAAQ,IAAI,KAAK,QAAQ;AAC9D,MAAI,UAAU;AACZ,yBAAqB,QAAQ,GAA6B;AAAA,EAC5D;AAEA,iBAAI,KAAK,aAAa,+BAA+B;AAErD,aAAW,EAAE,MAAM,UAAU,WAAW,KAAK,cAAc;AACzD,UAAM,iBAAiB,EAAE,GAAG,aAAa,KAAK;AAE9C,eAAW,UAAU,UAAU;AAE7B,UAAI,CAAC,OAAO,kBAAkB;AAC5B;AAAA,MACF;AAEA,YAAM,gBAAkC;AAAA,QACtC,KAAK,IAAI;AAAA,QACT,SAAS;AAAA;AAAA,MACX;AAGA,UAAI,kBAAkB,QAAQ,KAAK,UAAU,GAAG;AAC9C;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,iBAAiB;AACtC,qBAAI,KAAK,gBAAgB,6BAA6B,KAAK,EAAE;AAE7D,UAAI;AAEF,cAAM,OAAO,MAAM,OAAO,iBAAiB,OAAO;AAClD,sBAAc,UAAU,KAAK;AAG7B,YAAI,KAAK,cAAc,KAAK,eAAe;AACzC,wBAAc,SAAS;AAAA,YACrB,MAAM,KAAK,cAAc;AAAA,YACzB,SAAS,KAAK,iBAAiB,yBAAyB,IAAI;AAAA,UAC9D;AAAA,QACF;AAEA,uBAAI,KAAK,gBAAgB,gCAAgC,KAAK,UAAU,YAAY,QAAQ,EAAE;AAAA,MAChG,SAAS,GAAG;AAEV,uBAAI,MAAM,gBAAgB,kBAAkB,CAAC,EAAE;AAC/C,sBAAc,UAAU;AACxB,sBAAc,SAAS;AAAA,UACrB,MAAM;AAAA,UACN,SAAS,6BAA6B,CAAC;AAAA,QACzC;AACA,eAAO,CAAC,aAAa;AAAA,MACvB;AACA,eAAS,KAAK,aAAa;AAAA,IAC7B;AAAA,EACF;AAEA,SAAO;AACT;;;AC3EA,IAAAC,mCAAoB;AACpB,IAAAC,gBAA2B;AAQ3B,IAAM,YAAY;AACX,IAAM,kBAAkB;AAExB,IAAM,sBAAN,MAA0B;AAAA,EAC/B;AAAA,EACA,UAAmC,CAAC;AAAA,EACpC;AAAA,EACA;AAAA,EAEA,YAAY,QAAsB,cAA4B,MAAc,SAAsB;AAChG,SAAK,WAAW;AAGhB,SAAK,QAAQ;AAEb,QAAI,KAAK,SAAS,UAAU,GAAG;AAE7B,iBAAW,EAAE,MAAAC,OAAM,uBAAuB,YAAY,KAAK,cAAc;AAEvE,YAAI,gBAAgB,MAAM;AACxB;AAAA,QACF;AAEA,cAAM,EAAE,cAAc,IAAI,sBAAsB;AAGhD,sBAAc,eAAe,KAAK,MAAMA,KAAI,CAAC;AAG7C,aAAK,QAAQA,KAAI,IAAI;AAAA,MACvB;AAAA,IACF,OAAO;AAEL,iBAAW,EAAE,MAAAA,OAAM,cAAc,KAAK,cAAc;AAElD,cAAM,EAAE,MAAM,IAAI,cAAc;AAGhC,cAAM,eAAe,KAAK,MAAMA,KAAI,CAAC;AAGrC,aAAK,QAAQA,KAAI,IAAI;AAAA,MACvB;AAAA,IACF;AAGA;AAAA,MACE,UACE,sCAAI,SAAS,EACV,YAAY,SAAS,EACrB,IAAI,KAAK,KAAK,EAEd,KAAK,KAAK,WAAW,EAErB,MAAM,KAAK,oBAAoB;AAAA,MACpC,KAAK,OAAO,IAAI;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,cAAc,MAAM;AAClB,aAAK,sCAAI,WAAW,EAAE,MAAM,KAAK,OAAO,UAAU,CAAC,EAAE,MAAM,KAAK,QAAQ;AAAA,EAC1E;AAAA,EAEA,WAAW,CAAC,UAAqB;AAC/B,mBAAI,MAAM,OAAO,mBAAmB;AAGpC,UAAM,YAAY,MAAM;AAEtB,YAAM,OAAkB,MAAM,QAAQ,CAAC;AAGvC,iBAAW,QAAQ,OAAO,KAAK,KAAK,OAAO,GAAG;AAE5C,cAAM,SAAS,GAAG,IAAI,IAAI;AAG1B,cAAM,WAAsB,CAAC;AAG7B,mBAAW,OAAO,OAAO,KAAK,IAAI,GAAG;AAEnC,kBAAI,0BAAW,MAAM,GAAG,GAAG;AAEzB,qBAAS,IAAI,MAAM,MAAM,CAAC,IAAI,KAAK,GAAG;AAAA,UACxC;AAAA,QACF;AAGA,aAAK,QAAQ,IAAI,EAAE,QAAQ,QAAQ;AAAA,MACrC;AAGA,UAAI,KAAK,UAAU;AACjB,aAAK,SAAS;AACd,aAAK,WAAW;AAAA,MAClB;AAAA,IACF;AAGA,iBAAa,KAAK,aAAa;AAC/B,SAAK,gBAAgB,WAAW,WAAW,eAAe;AAAA,EAC5D;AAAA,EAEA,QAAQ,CAAC,mBAA2B;AAClC,UAAM,YAAuC,CAAC;AAG9C,UAAM,YAAY,CAAC,IAAY,KAAe,QAAiB;AAC7D,UAAI,OAAO,OAAO;AAChB,cAAM,OAAO,SAAS,cAAc,IAAI,GAAG;AAC3C,cAAM,QAAQ,OAAO;AACrB,cAAM,WAAW,CAAC,IAAI,MAAM,KAAK,EAAE,KAAK,GAAG;AAG3C,kBAAU,QAAQ,IAAI,EAAE,IAAI,MAAM,MAAM;AAExC;AAAA,MACF;AAEA,UAAI,OAAO,UAAU;AACnB,YAAI,IAAI,SAAS,GAAG;AAClB,gBAAM,IAAI,MAAM,sCAAsC;AAAA,QACxD;AAEA,mBAAW,KAAK,KAAK;AACnB,gBAAM,OAAO,SAAS,cAAc,IAAI,CAAC;AACzC,gBAAM,WAAW,CAAC,IAAI,IAAI,EAAE,KAAK,GAAG;AAGpC,oBAAU,QAAQ,IAAI,EAAE,IAAI,KAAK;AAAA,QACnC;AAEA;AAAA,MACF;AAGA,YAAM,IAAI,MAAM,0BAA0B,EAAE,EAAE;AAAA,IAChD;AAGA,UAAM,aAAa,YAAY;AAC7B,YAAM,UAAU,OAAO,KAAK,SAAS;AACrC,YAAM,UAAU,OAAO,OAAO,SAAS;AAGvC,iBAAW,OAAO,SAAS;AACzB,eAAO,UAAU,GAAG;AAAA,MACtB;AAEA,UAAI;AAEF,kBAAM,sCAAI,WAAW,EAAE,WAAW,MAAM,KAAK,MAAM,CAAC,EAAE,MAAM,OAAO;AAAA,MACrE,SAAS,KAAK;AACZ,uBAAI,MAAM,KAAK,2BAA2B;AAG1C,mBAAW,OAAO,SAAS;AACzB,oBAAU,GAAG,IAAI,QAAQ,OAAO,GAAG,CAAC;AAAA,QACtC;AAAA,MACF;AAAA,IACF;AAGA,UAAM,SAAqB,OAAO,IAAY,KAAe,QAAiB;AAC5E,gBAAU,IAAI,KAAK,GAAG;AAAA,IACxB;AAGA,gBAAY,MAAM;AAChB,UAAI,OAAO,KAAK,SAAS,EAAE,SAAS,GAAG;AACrC,uBAAI,MAAM,WAAW,+BAA+B;AACpD,aAAK,WAAW;AAAA,MAClB;AAAA,IACF,GAAG,eAAe;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,uBAAuB,OAAO,MAAe;AAC3C,mBAAI,KAAK,mCAAmC;AAC5C,mBAAI,MAAM,CAAC;AAEX,QAAI;AACF,gBAAM,sCAAI,SAAS,EAAE,MAAM;AAAA,QACzB,UAAU;AAAA,UACR,MAAM,KAAK;AAAA,UACX;AAAA,QACF;AAAA,QACA,MAAM;AAAA;AAAA,UAEJ,wBAAwB;AAAA,QAC1B;AAAA,MACF,CAAC;AAGD,WAAK,YAAY;AAAA,IACnB,SAAS,KAAK;AACZ,qBAAI,MAAM,KAAK,6BAA6B;AAAA,IAC9C;AAAA,EACF;AACF;;;AVrMO,IAAM,aAAN,MAAM,YAAW;AAAA;AAAA,EAEtB,WAAW;AAAA;AAAA,EAGX,oBAAoB,IAAI,iBAAiB,MAAM;AAAA;AAAA,EAG/C,SAAS;AAAA;AAAA,EAGA,WAAO,eAAAC,SAAQ;AAAA;AAAA,EAGf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,QACA,cACA,YACA,WACA,SACA;AACA,SAAK,UAAU;AACf,SAAK,gBAAgB;AAGrB,QAAI,oBAAoB,QAAQ,cAAc,QAAQ,OAAO,IAAI,UAAU,MAAM;AAC/E,WAAK,eAAe;AACpB,iBAAW,QAAQ;AACnB,qBAAI,KAAK,oCAA+B;AAExC,UAAI,oBAAoB,QAAQ,cAAc,QAAQ,OAAO,IAAI,aAAa,MAAM;AAClF,uBAAI,KAAK,6BAAwB;AAAA,MACnC,CAAC;AAAA,IACH,CAAC;AAGD,SAAK,KAAK,IAAI,YAAW,OAAO;AAGhC,SAAK,KAAK,IAAI,eAAAA,QAAQ,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AAE5C,QAAI,YAAY;AACd,qBAAI,KAAK,qBAAqB,UAAU,EAAE;AAC1C,WAAK,cAAc;AAAA,IACrB;AAEA,QAAI,WAAW;AACb,qBAAI,KAAK,oBAAoB,SAAS,EAAE;AACxC,WAAK,aAAa;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGA,cAAc,CAAC,SAAiB;AAC9B,QAAI,KAAK,UAAU;AACjB,YAAM,IAAI,MAAM,iFAAiF;AAAA,IACnG;AAGA,UAAM,UAAU;AAAA,MACd,KAAK,UAAAC,QAAG,aAAa,QAAQ,IAAI,gBAAgB,oBAAoB;AAAA,MACrE,MAAM,UAAAA,QAAG,aAAa,QAAQ,IAAI,iBAAiB,oBAAoB;AAAA,IACzE;AAGA,QAAI,CAAC,YAAY,GAAG;AAElB,WAAK,SAAS,QAAQ,IAAI,kBAAkB,UAAAA,QAAG,aAAa,sBAAsB,EAAE,SAAS,EAAE,KAAK;AACpG,qBAAI,KAAK,oBAAoB,KAAK,MAAM,EAAE;AAE1C,UAAI,CAAC,KAAK,QAAQ;AAChB,cAAM,IAAI,MAAM,qBAAqB;AAAA,MACvC;AAAA,IACF;AAGA,UAAM,SAAS,aAAAC,QAAM,aAAa,SAAS,KAAK,IAAI,EAAE,OAAO,IAAI;AAGjE,WAAO,GAAG,aAAa,MAAM;AAC3B,qBAAI,KAAK,4BAA4B,IAAI,EAAE;AAE3C,WAAK,WAAW;AAAA,IAClB,CAAC;AAGD,WAAO,GAAG,SAAS,CAAC,MAAwB;AAC1C,UAAI,EAAE,SAAS,cAAc;AAC3B,uBAAI;AAAA,UACF,mEAAmE,IAAI,kCAAkC,IAAI;AAAA,QAC/G;AACA,mBAAW,MAAM;AACf,iBAAO,MAAM;AACb,iBAAO,OAAO,IAAI;AAAA,QACpB,GAAG,GAAI;AAAA,MACT;AAAA,IACF,CAAC;AAGD,YAAQ,GAAG,WAAW,MAAM;AAC1B,qBAAI,KAAK,kCAAkC;AAC3C,aAAO,MAAM,MAAM;AACjB,uBAAI,KAAK,eAAe;AACxB,gBAAQ,KAAK,CAAC;AAAA,MAChB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,iBAAiB,MAAM;AAErB,SAAK,KAAK,IAAI,YAAY,YAAW,QAAQ;AAG7C,SAAK,KAAK,IAAI,YAAY,KAAK,QAAQ;AAEvC,QAAI,YAAY,GAAG;AACjB;AAAA,IACF;AAGA,SAAK,KAAK,IAAI,CAAC,kBAAkB,kBAAkB,GAAG,KAAK,cAAc;AAGzE,SAAK,KAAK,KAAK,kBAAkB,KAAK,cAAc,QAAQ,CAAC;AAG7D,SAAK,KAAK,KAAK,oBAAoB,KAAK,cAAc,UAAU,CAAC;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,iBAAiB,CAAC,KAAsB,KAAuB,SAAuB;AAEpF,UAAM,EAAE,MAAM,IAAI,IAAI;AACtB,QAAI,UAAU,KAAK,QAAQ;AACzB,YAAM,MAAM,gCAAgC,MAAM,QAAQ,UAAU,GAAG,CAAC;AACxE,qBAAI,KAAK,GAAG;AACZ,UAAI,OAAO,GAAG,EAAE,KAAK,GAAG;AACxB,WAAK,kBAAkB,MAAM;AAC7B;AAAA,IACF;AAGA,SAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,WAAW,OAAO,KAAsB,QAA0B;AAChE,QAAI;AACF,UAAI,KAAK,MAAM,KAAK,kBAAkB,WAAW,CAAC;AAAA,IACpD,SAAS,KAAK;AACZ,qBAAI,MAAM,GAAG;AACb,UAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,CAAC,kBAAyC;AAExD,WAAO,OAAO,KAAsB,QAA0B;AAE5D,YAAM,YAAY,iBAAiB,aAAa;AAEhD,UAAI;AAEF,cAAM,UAA4B,IAAI,MAAM,WAAY,CAAC;AAGzD,aAAK,eAAe,KAAK,YAAY,WAAW,CAAC,CAAC;AAGlD,cAAM,OAAO,SAAS,OAAO,IAAI,QAAQ,IAAI,KAAK;AAClD,cAAMC,aAAY,SAAS,aAAa;AACxC,cAAM,MAAM,SAAS,QAAQ,EAAE,OAAO,IAAI,SAAS,IAAI,MAAM,GAAG;AAEhE,cAAM,cAAc;AAAA,UAClB,KAAK,QAAQ;AAAA,UACb,WAAAA;AAAA,UACA;AAAA,QACF;AAEA,uBAAI,KAAK,EAAE,GAAG,aAAa,KAAK,WAAW,QAAQ,WAAW,cAAc,GAAG,kBAAkB;AACjG,uBAAI,MAAM,EAAE,GAAG,aAAa,QAAQ,GAAG,uBAAuB;AAG9D,YAAI;AAGJ,YAAI,kBAAkB,UAAU;AAC9B,qBAAW,MAAM,gBAAgB,KAAK,SAAS,KAAK,eAAe,SAAS,WAAW;AAAA,QACzF,OAAO;AACL,qBAAW,MAAM,kBAAkB,KAAK,eAAe,SAAS,WAAW;AAAA,QAC7E;AAGA,cAAM,eAAsD,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AAC1G,qBAAa,IAAI,CAAAC,SAAO;AACtB,eAAK,cAAc,KAAK,WAAWA,IAAG;AAEtC,yBAAI,MAAM,EAAE,GAAG,aAAa,KAAAA,KAAI,GAAG,gBAAgB;AAAA,QACrD,CAAC;AAED,YAAI;AAEJ,YAAI,kBAAkB,UAAU;AAC9B,kCAAwB;AACxB,yBAAI,MAAM,EAAE,GAAG,aAAa,SAAS,GAAG,mBAAmB;AAC3D,cAAI,KAAK;AAAA,YACP,YAAY;AAAA,YACZ,MAAM;AAAA,YACN,UAAU;AAAA,UACZ,CAAC;AAAA,QACH,OAAO;AACL,kCAAwB;AAAA,YACtB,KAAK,aAAa,CAAC,EAAE;AAAA,YACrB,SAAS,aAAa,OAAO,OAAK,CAAC,EAAE,OAAO,EAAE,WAAW;AAAA,YACzD,QAAQ;AAAA,cACN,SAAU,aACP,OAAO,QAAM,CAAC,GAAG,OAAO,EACxB,IAAI,UAAQ,KAAK,QAAQ,OAAO,EAChC,KAAK,IAAI;AAAA,YACd;AAAA,UACF;AACA,cAAI,KAAK;AAAA,YACP,YAAY;AAAA,YACZ,MAAM;AAAA,YACN,UAAU;AAAA,UACZ,CAAC;AAAA,QACH;AAEA,uBAAI,MAAM,EAAE,GAAG,aAAa,sBAAsB,GAAG,mBAAmB;AAExE,aAAK,kBAAkB,WAAW,WAAW,aAAa;AAAA,MAC5D,SAAS,KAAK;AACZ,uBAAI,MAAM,GAAG;AACb,YAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAC5C,aAAK,kBAAkB,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,QAAQ,KAAsB,KAAuB,MAA4B;AACtF,UAAM,YAAY,KAAK,IAAI;AAE3B,QAAI,GAAG,UAAU,MAAM;AACrB,YAAM,cAAc,KAAK,IAAI,IAAI;AACjC,YAAM,UAAU;AAAA,QACd,KAAK,IAAI,MAAM,SAAS;AAAA,QACxB,QAAQ,IAAI;AAAA,QACZ,KAAK,IAAI;AAAA,QACT,QAAQ,IAAI;AAAA,QACZ,UAAU,GAAG,WAAW;AAAA,MAC1B;AAEA,UAAI,cAAc,MAAM,eAAI,KAAK,OAAO,IAAI,eAAI,KAAK,OAAO;AAAA,IAC9D,CAAC;AAED,SAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,SAAS,KAAsB,KAAuB;AAC3D,QAAI;AACF,UAAI,KAAK,IAAI;AAAA,IACf,SAAS,KAAK;AACZ,qBAAI,MAAM,GAAG;AACb,UAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAAA,IAC9C;AAAA,EACF;AACF;;;AW3TA,IAAAC,mCAAoB;AACpB,IAAAC,gBAA2B;AAOpB,SAAS,WAAW,cAA4B;AACrD,eACG,QAAQ,OAAK,EAAE,QAAQ,EACvB,OAAO,aAAW,QAAQ,OAAO,EACjC,QAAQ,UAAU;AACvB;AAEA,eAAe,WAAW,SAAkB;AAE1C,QAAM,kBAAkB;AAAA,IACtB,sBAAa,GAAG,CAAC,yBAAW,KAAK;AAAA,IACjC,sBAAa,GAAG,CAAC,yBAAW,QAAQ;AAAA,IACpC,sCAAqB,GAAG,CAAC,yBAAW,OAAO,yBAAW,QAAQ;AAAA,IAC9D,sBAAa,GAAG,CAAC,yBAAW,OAAO;AAAA,IACnC,cAAU,GAAG,CAAC,yBAAW,OAAO,yBAAW,UAAU,yBAAW,OAAO;AAAA,EACzE;AAGA,QAAM,aAA2B,gBAAgB,QAAQ,KAAK,KAAK,6BAAyB;AAE5F,QAAM,WAAqB;AAAA,IACzB,UAAU;AAAA,IACV,eAAe;AAAA,IACf,UAAU,GAAG;AAEX,qBAAI,MAAM,GAAG,0CAA0C;AACvD,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAGA,YAAM,sCAAI,QAAQ,OAAO,QAAQ,OAAO,EAAE,MAAM,CAAC,KAAK,SAAS;AAE7D,QAAI,WAAW,SAAS,IAAI,GAAG;AAC7B,UAAI;AAEF,aAAK,QAAQ,gBAAgB,KAAK,IAAI;AAAA,MACxC,SAAS,GAAG;AAEV,uBAAI,MAAM,GAAG,gCAAgC;AAAA,MAC/C;AAAA,IACF;AAAA,EACF,GAAG,QAAQ;AACb;;;AZJO,IAAM,cAAc,MAAM,QAAQ,IAAI,oBAAoB;AAG1D,IAAM,cAAc,MAAM,QAAQ,IAAI,cAAc;AAEpD,IAAM,YAAY,MAAM,QAAQ,IAAI,cAAc;AAElD,IAAM,aAAN,MAAiB;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAY,EAAE,aAAa,KAAK,GAAgB,eAA6B,CAAC,GAAG,OAA0B,CAAC,GAAG;AAC7G,UAAM,aAAuB,qBAAM,IAAI;AACvC,WAAO,cAAc;AAGrB,kBAAc,OAAO,OAAO;AAG5B,QAAI,YAAY,GAAG;AAEjB,UAAI,CAAC,QAAQ,MAAM;AACjB,cAAM,IAAI,MAAM,6BAA6B;AAAA,MAC/C;AAEA,YAAM,uBAA2C,CAAC;AAGlD,iBAAW,cAAc,cAAc;AAErC,6BAAqB,KAAK;AAAA,UACxB,MAAM,WAAW;AAAA,UACjB,aAAa,WAAW;AAAA,UACxB,YAAY,WAAW;AAAA,UACvB,UAAU,WAAW;AAAA,UACrB,aAAa,WAAW;AAAA,QAC1B,CAAC;AAAA,MACH;AAGA,cAAQ,KAAK,oBAAoB;AAEjC;AAAA,IACF;AAEA,SAAK,cAAc,IAAI,WAAW,QAAQ,cAAc,KAAK,YAAY,KAAK,WAAW,MAAM;AAE7F,UAAI,YAAY,KAAK,UAAU,GAAG;AAChC,mBAAW,YAAY;AAAA,MACzB;AAAA,IACF,CAAC;AAGD,QAAI,KAAK,YAAY;AACnB;AAAA,IACF;AAEA,SAAK,MAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,QAAQ,CAAC,OAAO,QAAS;AACvB,SAAK,YAAY,YAAY,IAAI;AAAA,EACnC;AACF;;;Aa1HA,IAAAC,gBAAsB;AAStB,IAAM,gBAAgB;AA4Cf,IAAM,UAAN,MAAmC;AAAA,EACxC,SAAoB,CAAC;AAAA,EACrB;AAAA,EACA,eAA6C,CAAC;AAAA,EAC9C,gBAAgB;AAAA,EAChB,iBAAiC,CAAC;AAAA,EAElC,iBAAiB,CAAC,SAAqB;AACrC,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,UAAU,CAAC,SAAoB;AAC7B,mBAAI,MAAM,MAAM,0BAA0B;AAC1C,SAAK,SAAS,QAAQ,CAAC;AAEvB,SAAK,SAAS;AAGd,eAAW,OAAO,KAAK,cAAc;AAEnC,WAAK,aAAa,GAAG,MAAE,qBAAM,KAAK,MAAM,CAAC;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,UAAU,CAAC,QAAgB;AAEzB,WAAO,KAAK,OAAO,GAAG,KAAK;AAAA,EAC7B;AAAA,EAEA,QAAQ,MAAM;AACZ,SAAK,gBAAgB,UAAU,OAAO,KAAK,KAAK,MAAM,CAAC;AAAA,EACzD;AAAA,EAEA,aAAa,CAAC,QAAgB;AAC5B,SAAK,gBAAgB,UAAU,CAAC,GAAG,CAAC;AAAA,EACtC;AAAA,EAEA,UAAU,CAAC,KAAa,UAAkB;AACxC,SAAK,gBAAgB,OAAO,CAAC,GAAG,GAAG,KAAK;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,iBAAiB,CAAC,KAAa,UAAkB;AAC/C,SAAK,gBAAgB,OAAO,CAAC,GAAG,GAAG,KAAK;AACxC,WAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,YAAM,cAAc,KAAK,UAAU,UAAQ;AACzC,YAAI,KAAK,GAAG,MAAM,OAAO;AACvB,sBAAY;AACZ,kBAAQ;AAAA,QACV;AAAA,MACF,CAAC;AAGD,iBAAW,MAAM;AACf,oBAAY;AACZ,eAAO,OAAO;AAAA,MAChB,GAAG,aAAa;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EAEA,YAAY,CAAC,eAA6B;AACxC,UAAM,MAAM,KAAK;AACjB,SAAK,aAAa,GAAG,IAAI;AACzB,WAAO,MAAM,KAAK,YAAY,GAAG;AAAA,EACnC;AAAA,EAEA,UAAU,CAAC,aAA2B;AACpC,SAAK,eAAe,KAAK,QAAQ;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,CAAC,QAAgB;AAC7B,WAAO,KAAK,aAAa,GAAG;AAAA,EAC9B;AAAA,EAEA,WAAW,MAAM;AAEf,eAAW,WAAW,KAAK,gBAAgB;AACzC,kBAAQ,qBAAM,KAAK,MAAM,CAAC;AAAA,IAC5B;AAGA,SAAK,WAAW,MAAM;AAAA,IAAC;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,kBAAkB,CAAC,IAAY,MAAgB,UAAmB;AAChE,SAAK,MAAM,IAAI,MAAM,KAAK;AAAA,EAC5B;AACF;;;ACzHO,IAAM,aAAN,MAAqC;AAAA,EAC1C,aAAoC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA,YAAY,UAAoB;AAC9B,SAAK,OAAO,SAAS;AACrB,SAAK,MAAM,SAAS;AACpB,SAAK,QAAQ,SAAS;AACtB,SAAK,OAAO,SAAS;AACrB,SAAK,YAAY,UAAU;AAC3B,SAAK,cAAc,UAAU;AAAA,EAC/B;AAAA,EACA,SAAS,OAAkB;AACzB,SAAK,QAAQ;AACb,SAAK,cAAc;AAAA,EACrB;AAAA,EACA,gBAAgB;AACd,SAAK,WAAW;AAChB,SAAK,YAAY;AACjB,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa;AACX,UAAM,SAAS,KAAK,SAAS,KAAK,MAAM,QAAQ,KAAK,IAAI;AACzD,QAAI,QAAQ;AACV,YAAM,iBAAiB,KAAK,MAAM,MAAM;AACxC,WAAK,cAAc,gBAAgB;AACnC,WAAK,YAAY,gBAAgB;AACjC,WAAK,gBAAgB,gBAAgB;AAAA,IACvC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc;AACZ,UAAM,WAAW;AAAA,MACf,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,eAAe,oBAAI,KAAK;AAAA,MACxB,MAAM,KAAK;AAAA,IACb;AACA,SAAK,SAAS,KAAK,MAAM,QAAQ,KAAK,MAAM,KAAK,UAAU,QAAQ,CAAC;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc;AACZ,YAAQ,KAAK,MAAM;AAAA,MACjB,KAAK;AACH,YAAI,KAAK,QAAQ;AAAI,gBAAM,IAAI,MAAM,6CAA6C;AAClF,aAAK,WAAW,MAAO,KAAK;AAC5B;AAAA,MACF,KAAK;AAAA,MACL,KAAK;AACH,aAAK,WAAW,MAAO,KAAK,KAAK;AACjC;AAAA,MACF,KAAK;AAAA,MACL,KAAK;AACH,aAAK,WAAW,MAAO,KAAK,KAAK,KAAK;AACtC;AAAA,MACF;AACE,cAAM,IAAI,MAAM,mBAAmB;AAAA,IACvC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB;AACd,UAAM,MAAM,oBAAI,KAAK;AACrB,QAAI;AAEJ,QAAI,KAAK,iBAAiB,KAAK,WAAW;AACxC,WAAK,YAAY;AAAA,IACnB;AAEA,QAAI,KAAK,WAAW;AAClB,cAAQ,KAAK,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA,IACjD,WAAW,KAAK,iBAAiB,KAAK,UAAU;AAC9C,YAAM,gBAAgB,IAAI,KAAK,KAAK,aAAa;AACjD,cAAQ,KAAK,YAAY,IAAI,QAAQ,IAAI,cAAc,QAAQ;AAAA,IACjE;AAEA,QAAI,UAAU,UAAa,SAAS,GAAG;AACrC,WAAK,MAAM;AAAA,IACb,OAAO;AACL,iBAAW,MAAM;AACf,aAAK,MAAM;AAAA,MACb,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ;AACN,SAAK,aAAa,YAAY,MAAM;AAClC,UAAI,KAAK,gBAAgB,GAAG;AAC1B,aAAK,KAAK;AACV;AAAA,MACF,OAAO;AACL,aAAK,IAAI;AAET,YAAI,KAAK,eAAe,KAAK,gBAAgB,GAAG;AAC9C,eAAK,eAAe;AAAA,QACtB;AACA,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,GAAG,KAAK,QAAQ;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO;AACL,QAAI,KAAK,YAAY;AACnB,oBAAc,KAAK,UAAU;AAC7B,WAAK,aAAa;AAAA,IACpB;AACA,SAAK,SAAS,KAAK,MAAM,WAAW,KAAK,IAAI;AAAA,EAC/C;AACF;;;AhBrJA,IAAM,oBAAoB,YAAY,KAAK,CAAC,YAAY;AACxD,IAAM,gBAAgB,YAAY,KAAK,YAAY,KAAK,UAAU;AAK3D,IAAM,aAAN,MAA6C;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAuB,CAAC;AAAA,EACxB,SAAS,IAAI,QAAQ;AAAA,EACrB,iBAAiB,IAAI,QAAQ;AAAA,EAC7B,cAAc;AAAA,EACd,sBAAsB;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAA2C,CAAC,aAAuB;AACjE,UAAM,EAAE,MAAM,OAAO,MAAM,KAAK,WAAW,YAAY,IAAI;AAC3D,SAAK,cAAc;AAEnB,QAAI,QAAQ,IAAI,oBAAoB,QAAQ;AAI1C,YAAM,cAAwB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,WAAK,eAAe,QAAQ,MAAM;AAChC,YAAI,WAAW,WAAW,EAAE,SAAS,KAAK,cAAc;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,QAAmB;AAAA,IACjB,OAAO,KAAK,OAAO;AAAA,IACnB,SAAS,KAAK,OAAO;AAAA,IACrB,YAAY,KAAK,OAAO;AAAA,IACxB,SAAS,KAAK,OAAO;AAAA,IACrB,WAAW,KAAK,OAAO;AAAA,IACvB,SAAS,KAAK,OAAO;AAAA,IACrB,gBAAgB,KAAK,OAAO;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,gBAA2B;AAAA,IACzB,OAAO,KAAK,eAAe;AAAA,IAC3B,SAAS,KAAK,eAAe;AAAA,IAC7B,YAAY,KAAK,eAAe;AAAA,IAChC,gBAAgB,KAAK,eAAe;AAAA,IACpC,SAAS,KAAK,eAAe;AAAA,IAC7B,WAAW,KAAK,eAAe;AAAA,IAC/B,SAAS,KAAK,eAAe;AAAA,EAC/B;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,OAAO;AACT,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,cAAc;AAChB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,aAAa;AACf,WAAO,KAAK,eAAe,CAAC;AAAA,EAC9B;AAAA,EAEA,YAAY,KAAoB;AAC9B,SAAK,QAAQ,IAAI;AACjB,SAAK,eAAe,IAAI;AACxB,SAAK,cAAc,IAAI;AACvB,SAAK,cAAc;AAEnB,mBAAI,KAAK,cAAc,KAAK,KAAK,aAAa;AAC9C,mBAAI,MAAM,GAAG;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,wBAAwB,MAAM;AAC5B,mBAAI,KAAK,kCAAkC,KAAK,KAAK,EAAE;AAEvD,QAAI,KAAK,qBAAqB;AAC5B,YAAM,IAAI,MAAM,yCAAyC,KAAK,KAAK,EAAE;AAAA,IACvE;AAEA,SAAK,sBAAsB;AAG3B,WAAO;AAAA,MACL,eAAe,KAAK;AAAA,IACtB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,MAAM;AACpB,mBAAI,KAAK,yBAAyB,KAAK,KAAK,EAAE;AAE9C,QAAI,KAAK,aAAa;AACpB,YAAM,IAAI,MAAM,gCAAgC,KAAK,KAAK,EAAE;AAAA,IAC9D;AAEA,SAAK,cAAc;AAGnB,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,IACd;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,CAAyB,OAAUC,UAA6C;AACrF,UAAM,kBAAc,0DAAwB,MAAM,IAAI;AAGtD,QAAI,CAAC,eAAe,CAACA,OAAM;AACzB,YAAM,IAAI,MAAM,0BAA0B,MAAM,IAAI,EAAE;AAAA,IACxD;AAEA,UAAM,UAAmB;AAAA,MACvB;AAAA;AAAA,MAEA,MAAMA,SAAQ;AAAA,MACd;AAAA,MACA,SAAS;AAAA,QACP,MAAM;AAAA,QACN,YAAY,CAAC;AAAA,QACb,QAAQ,CAAC;AAAA,QACT,aAAa,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,WAAW,KAAK;AACtB,UAAM,SAAS,GAAG,KAAK,KAAK,KAAK,MAAM,IAAI;AAC3C,UAAM,cAAc,EAAE,WAAW,gBAAgB,QAAQ,UAAU,MAAM;AACzE,UAAM,aAAa,CAAC,UAAkB,OAAO,KAAK,KAAK,EAAE,SAAS;AAClE,UAAM,MAAM,CAAC,SAAiB,aAAqB;AACjD,YAAM,kBAAc,sBAAO,YAAY,QAAQ,OAAO;AAEtD,qBAAI,KAAK,GAAG,OAAO,mBAAmB,QAAQ,KAAK,IAAI,MAAM;AAC7D,qBAAI,KAAK,aAAa,MAAM;AAC5B,qBAAI,MAAM,UAAU,MAAM;AAAA,IAC5B;AAEA,aAAS,SAAS,kBAA6D;AAC7E,UAAI,mBAAmB;AACrB,YAAI,mBAAmB,iBAAiB,SAAS,CAAC;AAIlD,iBAAS,KAAK;AAAA,UACZ,GAAG;AAAA,UACH,YAAY;AAAA,UACZ;AAAA,QACF,CAAC;AAAA,MACH;AAEA,aAAO,EAAE,MAAM;AAAA,IACjB;AAEA,aAAS,OAAO,gBAAuD;AACrE,UAAI,mBAAmB;AACrB,YAAI,iBAAiB,eAAe,SAAS,CAAC;AAI9C,iBAAS,KAAK;AAAA,UACZ,GAAG;AAAA,UACH,UAAU;AAAA,UACV;AAAA,QACF,CAAC;AAAA,MACH;AAGA,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAEA,aAAS,MAAM,eAA+B;AAC5C,UAAI,eAAe;AACjB,YAAI,gBAAgB,cAAc,SAAS,CAAC;AAE5C,iBAAS,KAAK;AAAA,UACZ,GAAG;AAAA,UACH,SAAS;AAAA,UACT;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,aAAS,eAAe,YAA0C;AAChE,qBAAI,MAAM,yBAAyB,UAAU,IAAI,MAAM;AACvD,cAAQ,QAAQ,WAAW,KAAK,GAAG,UAAU;AAC7C,aAAO,EAAE,GAAG,aAAa,SAAS;AAAA,IACpC;AAEA,aAAS,SAAS,MAAgC;AAChD,qBAAI,MAAM,mBAAmB,IAAI,IAAI,MAAM;AAC3C,cAAQ,QAAQ,OAAO;AACvB,aAAO;AAAA,IACT;AAEA,aAAS,UAAU,KAAa,QAAQ,IAAsB;AAC5D,qBAAI,MAAM,oBAAoB,GAAG,IAAI,KAAK,IAAI,MAAM;AACpD,cAAQ,QAAQ,OAAO,GAAG,IAAI;AAC9B,aAAO;AAAA,IACT;AAEA,aAAS,eAAe,KAAa,QAAQ,IAAsB;AACjE,qBAAI,MAAM,yBAAyB,GAAG,IAAI,KAAK,IAAI,MAAM;AACzD,cAAQ,QAAQ,YAAY,GAAG,IAAI;AACnC,aAAO;AAAA,IACT;AAEA,aAAS,UAAU,OAAc;AAC/B,cAAQ,QAAQ;AAChB,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,oBAAoB,MAAM,+CAA8B;AAAA,MACxD,WAAW,MAAM,+BAAsB;AAAA,MACvC,WAAW,MAAM,+BAAsB;AAAA,MACvC,WAAW,MAAM,+BAAsB;AAAA,IACzC;AAAA,EACF;AACF;;;AiBlSO,SAAS,WACd,SACA,eACA;AACA,QAAMC,cAAa,QAAQ,IAAI,MAAM,cAAc,CAAC;AACpD,QAAM,iBAAiB,QAAQ,IAAI,MAAM,kBAAkB,CAAC;AAC5D,QAAM,sBAAsB,QAAQ,IAAI,MAAM,uBAAuB,CAAC;AAEtE,MAAI,kBAAkB,cAAc;AAClC,WAAOA;AAAA,EACT;AACA,MAAI,kBAAkB,kBAAkB;AACtC,WAAO;AAAA,EACT;AACA,MAAI,kBAAkB,uBAAuB;AAC3C,WAAO;AAAA,EACT;AACA,SAAO,CAAC,GAAGA,aAAY,GAAG,gBAAgB,GAAG,mBAAmB;AAClE;",
   "names": ["a", "import_kubernetes_fluent_client", "import_kubernetes_fluent_client", "import_ramda", "import_ramda", "promClient", "kind", "jsonPatch", "import_ramda", "import_kubernetes_fluent_client", "import_ramda", "name", "express", "fs", "https", "namespace", "res", "import_kubernetes_fluent_client", "import_types", "import_ramda", "kind", "containers"]
 }

package/package.json

@@ -9,7 +9,7 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "version": "0.19.0",
+  "version": "20.0.0",
   "main": "dist/lib.js",
   "types": "dist/lib.d.ts",
   "scripts": {
@@ -33,8 +33,8 @@
     "express": "4.18.2",
     "fast-json-patch": "3.1.1",
     "kubernetes-fluent-client": "1.9.0",
-    "pino": "8.16.2",
-    "pino-pretty": "10.2.3",
+    "pino": "8.17.1",
+    "pino-pretty": "10.3.0",
     "prom-client": "15.0.0",
     "ramda": "0.29.1"
   },
@@ -42,7 +42,7 @@
     "@commitlint/cli": "18.4.3",
     "@commitlint/config-conventional": "18.4.3",
     "@jest/globals": "29.7.0",
-    "@types/eslint": "8.44.8",
+    "@types/eslint": "8.44.9",
     "@types/express": "4.17.21",
     "@types/node": "18.x.x",
     "@types/node-forge": "1.3.10",

package/src/lib/assets/networking.ts

@@ -43,10 +43,14 @@ export function service(name: string): kind.Service {
     metadata: {
       name,
       namespace: "pepr-system",
+      labels: {
+        "pepr.dev/controller": "admission",
+      },
     },
     spec: {
       selector: {
         app: name,
+        "pepr.dev/controller": "admission",
       },
       ports: [
         {
@@ -65,10 +69,14 @@ export function watcherService(name: string): kind.Service {
     metadata: {
       name: `${name}-watcher`,
       namespace: "pepr-system",
+      labels: {
+        "pepr.dev/controller": "watcher",
+      },
     },
     spec: {
       selector: {
         app: `${name}-watcher`,
+        "pepr.dev/controller": "watcher",
       },
       ports: [
         {

package/src/lib/assets/pods.ts

@@ -1,10 +1,12 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-FileCopyrightText: 2023-Present The Pepr Authors
 
+import { V1EnvVar } from "@kubernetes/client-node";
 import { kind } from "kubernetes-fluent-client";
 import { gzipSync } from "zlib";
 
 import { Assets } from ".";
+import { ModuleConfig } from "../module";
 import { Binding } from "../types";
 
 /** Generate the pepr-system namespace */
@@ -45,6 +47,7 @@ export function watcher(assets: Assets, hash: string) {
       namespace: "pepr-system",
       labels: {
         app,
+        "pepr.dev/controller": "watcher",
       },
     },
     spec: {
@@ -55,12 +58,14 @@ export function watcher(assets: Assets, hash: string) {
       selector: {
         matchLabels: {
           app,
+          "pepr.dev/controller": "watcher",
         },
       },
       template: {
         metadata: {
           labels: {
             app,
+            "pepr.dev/controller": "watcher",
           },
         },
         spec: {
@@ -112,11 +117,7 @@ export function watcher(assets: Assets, hash: string) {
                   readOnly: true,
                 },
               ],
-              env: [
-                { name: "PEPR_WATCH_MODE", value: "true" },
-                { name: "PEPR_PRETTY_LOG", value: "false" },
-                { name: "LOG_LEVEL", value: config.logLevel || "debug" },
-              ],
+              env: genEnv(config, true),
             },
           ],
           volumes: [
@@ -151,6 +152,7 @@ export function deployment(assets: Assets, hash: string): kind.Deployment {
       namespace: "pepr-system",
       labels: {
         app,
+        "pepr.dev/controller": "admission",
       },
     },
     spec: {
@@ -158,12 +160,14 @@ export function deployment(assets: Assets, hash: string): kind.Deployment {
       selector: {
         matchLabels: {
           app,
+          "pepr.dev/controller": "admission",
         },
       },
       template: {
         metadata: {
           labels: {
             app,
+            "pepr.dev/controller": "admission",
           },
         },
         spec: {
@@ -204,10 +208,7 @@ export function deployment(assets: Assets, hash: string): kind.Deployment {
                   cpu: "500m",
                 },
               },
-              env: [
-                { name: "PEPR_PRETTY_LOG", value: "false" },
-                { name: "LOG_LEVEL", value: config.logLevel || "debug" },
-              ],
+              env: genEnv(config),
               volumeMounts: [
                 {
                   name: "tls-certs",
@@ -270,3 +271,19 @@ export function moduleSecret(name: string, data: Buffer, hash: string): kind.Sec
     },
   };
 }
+
+function genEnv(config: ModuleConfig, watchMode = false): V1EnvVar[] {
+  const env = [
+    { name: "PEPR_WATCH_MODE", value: watchMode ? "true" : "false" },
+    { name: "PEPR_PRETTY_LOG", value: "false" },
+    { name: "LOG_LEVEL", value: config.logLevel || "debug" },
+  ];
+
+  if (config.env) {
+    for (const [name, value] of Object.entries(config.env)) {
+      env.push({ name, value });
+    }
+  }
+
+  return env;
+}

package/src/lib/assets/webhooks.ts

@@ -129,7 +129,7 @@ export async function webhookConfig(
         name: `${name}.pepr.dev`,
         admissionReviewVersions: ["v1", "v1beta1"],
         clientConfig,
-        failurePolicy: "Ignore",
+        failurePolicy: config.onError === "reject" ? "Fail" : "Ignore",
         matchPolicy: "Equivalent",
         timeoutSeconds,
         namespaceSelector: {

package/src/lib/module.ts

@@ -28,6 +28,8 @@ export type ModuleConfig = {
   alwaysIgnore: WebhookIgnore;
   /** Define the log level for the in-cluster controllers */
   logLevel?: string;
+  /** Propagate env variables to in-cluster controllers */
+  env?: Record<string, string>;
 };
 
 export type PackageJSON = {

package/website/content/en/docs/metrics.md

@@ -72,3 +72,42 @@ GET /metrics
   pepr_Validate_sum 402.4275380000472
   pepr_Validate_count 2
 ```
+## Prometheus Operator
+
+If using the Prometheus Operator, the following `ServiceMonitor` example manifests can be used to scrape the `/metrics` endpoint for the `admission` and `watcher` controllers.
+
+```yaml
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: admission
+spec:
+  selector:
+    matchLabels:
+      pepr.dev/controller: admission
+  namespaceSelector:
+    matchNames:
+    - pepr-system
+  endpoints:
+  - targetPort: 3000
+    scheme: https
+    tlsConfig:
+      insecureSkipVerify: true
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: watcher
+spec:
+  selector:
+    matchLabels:
+      pepr.dev/controller: watcher
+  namespaceSelector:
+    matchNames:
+    - pepr-system 
+  endpoints:
+  - targetPort: 3000
+    scheme: https
+    tlsConfig:
+      insecureSkipVerify: true
+```