typekro 0.33.8 → 0.33.10

package/dist/factories/clickstack/compositions/clickstack-bootstrap.d.ts

@@ -1,7 +1,7 @@
 /**
  * ClickStack (HyperDX) Bootstrap Composition — EXTERNAL ClickHouse only.
  *
- * Deploys the OFFICIAL `clickstack` chart (3.0.x, MIT) from
+ * Deploys the OFFICIAL `clickstack` chart (3.2.x, MIT) from
  * https://clickhouse.github.io/ClickStack-helm-charts via HelmRepository and
  * HelmRelease resources. Build-around: we wrap the official chart — never
  * hand-rolled manifests. NOT the archived hyperdxio/helm-charts repo, NOT the
@@ -59,6 +59,7 @@
  *     username: 'otelcollector',
  *     password: '…',
  *   },
+ *   apiKey: '…',
  * });
  * ```
  *
@@ -69,26 +70,27 @@
  * await bootstrap.factory('kro').deploy({
  *   name: 'clickstack',
  *   clickhouse: { host: '…' },
+ *   apiKey: '…',
  *   mongoUri: 'mongodb://user:pass@mongo.example.com:27017/hyperdx',
  * });
  * ```
  */
-import { type ClickStackExternalMongoBuildOptions, type ClickStackInternalMongoBuildOptions } from '../types.js';
-declare function buildInternalComposition(options: ClickStackInternalMongoBuildOptions): import("../../../index.js").CallableComposition<{
+import { type ClickStackInlineExternalMongoBuildOptions, type ClickStackInlineInternalMongoBuildOptions, type ClickStackSecretValuesExternalMongoBuildOptions, type ClickStackSecretValuesInternalMongoBuildOptions } from '../types.js';
+declare function buildInternalInlineComposition(options: ClickStackInlineInternalMongoBuildOptions): import("../../../index.js").CallableComposition<{
+    apiKey: string;
     name: string;
     clickhouse: {
         host: string;
+        password?: string;
+        appPassword?: string;
         nativePort?: number;
         httpPort?: number;
         database?: string;
         username?: string;
-        password?: string;
         appUsername?: string;
-        appPassword?: string;
     };
     namespace?: string;
     version?: string;
-    apiKey?: string;
     hyperdx?: {
         replicas?: number;
         resources?: {
@@ -125,22 +127,127 @@ declare function buildInternalComposition(options: ClickStackInternalMongoBuildO
     };
     version?: string;
 }>;
-declare function buildExternalComposition(options: ClickStackExternalMongoBuildOptions): import("../../../index.js").CallableComposition<{
+declare function buildInternalSecretValuesComposition(options: ClickStackSecretValuesInternalMongoBuildOptions): import("../../../index.js").CallableComposition<{
+    credentialsSecret: {
+        name: string;
+        valuesKey?: string;
+    };
+    clickhouse: {
+        host: string;
+        nativePort?: number;
+        httpPort?: number;
+        database?: string;
+        username?: string;
+        appUsername?: string;
+    };
+    name: string;
+    namespace?: string;
+    version?: string;
+    hyperdx?: {
+        replicas?: number;
+        resources?: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        image?: {
+            repository?: string;
+            tag?: string;
+            pullPolicy?: "Always" | "IfNotPresent" | "Never";
+        };
+        frontendUrl?: string;
+    };
+}, {
+    ready: boolean;
+    phase: "Ready" | "Failed" | "Installing";
+    ui: {
+        url: string;
+    };
+    gateway: {
+        otlpHttpEndpoint: string;
+        otlpGrpcEndpoint: string;
+    };
+    app: {
+        host: string;
+        appPort: number;
+        apiPort: number;
+    };
+    version?: string;
+}>;
+declare function buildExternalInlineComposition(options: ClickStackInlineExternalMongoBuildOptions): import("../../../index.js").CallableComposition<{
+    apiKey: string;
     mongoUri: string;
     name: string;
     clickhouse: {
         host: string;
+        password?: string;
+        appPassword?: string;
         nativePort?: number;
         httpPort?: number;
         database?: string;
         username?: string;
-        password?: string;
         appUsername?: string;
-        appPassword?: string;
     };
     namespace?: string;
     version?: string;
-    apiKey?: string;
+    hyperdx?: {
+        replicas?: number;
+        resources?: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        image?: {
+            repository?: string;
+            tag?: string;
+            pullPolicy?: "Always" | "IfNotPresent" | "Never";
+        };
+        frontendUrl?: string;
+    };
+}, {
+    ready: boolean;
+    phase: "Ready" | "Failed" | "Installing";
+    ui: {
+        url: string;
+    };
+    gateway: {
+        otlpHttpEndpoint: string;
+        otlpGrpcEndpoint: string;
+    };
+    app: {
+        host: string;
+        appPort: number;
+        apiPort: number;
+    };
+    version?: string;
+}>;
+declare function buildExternalSecretValuesComposition(options: ClickStackSecretValuesExternalMongoBuildOptions): import("../../../index.js").CallableComposition<{
+    credentialsSecret: {
+        name: string;
+        valuesKey?: string;
+    };
+    mongoUri: string;
+    clickhouse: {
+        host: string;
+        nativePort?: number;
+        httpPort?: number;
+        database?: string;
+        username?: string;
+        appUsername?: string;
+    };
+    name: string;
+    namespace?: string;
+    version?: string;
     hyperdx?: {
         replicas?: number;
         resources?: {
@@ -178,36 +285,42 @@ declare function buildExternalComposition(options: ClickStackExternalMongoBuildO
     version?: string;
 }>;
 /** Composition type for the internal-Mongo variant. */
-export type ClickStackBootstrapComposition = ReturnType<typeof buildInternalComposition>;
+export type ClickStackBootstrapComposition = ReturnType<typeof buildInternalInlineComposition>;
+/** Composition type for the Secret-backed internal-Mongo variant. */
+export type ClickStackSecretValuesBootstrapComposition = ReturnType<typeof buildInternalSecretValuesComposition>;
 /** Composition type for the external-Mongo variant. */
-export type ClickStackExternalMongoBootstrapComposition = ReturnType<typeof buildExternalComposition>;
+export type ClickStackExternalMongoBootstrapComposition = ReturnType<typeof buildExternalInlineComposition>;
+/** Composition type for the Secret-backed external-Mongo variant. */
+export type ClickStackSecretValuesExternalMongoBootstrapComposition = ReturnType<typeof buildExternalSecretValuesComposition>;
 /**
  * Construct a ClickStack bootstrap composition variant. Build-time options
  * select WHICH resources exist (Mongo mode/storage) and bake static raw chart
  * values; everything per-instance stays in the runtime spec.
  */
-export declare function makeClickstackBootstrap(options?: ClickStackInternalMongoBuildOptions): ClickStackBootstrapComposition;
-export declare function makeClickstackBootstrap(options: ClickStackExternalMongoBuildOptions): ClickStackExternalMongoBootstrapComposition;
+export declare function makeClickstackBootstrap(options?: ClickStackInlineInternalMongoBuildOptions): ClickStackBootstrapComposition;
+export declare function makeClickstackBootstrap(options: ClickStackSecretValuesInternalMongoBuildOptions): ClickStackSecretValuesBootstrapComposition;
+export declare function makeClickstackBootstrap(options: ClickStackInlineExternalMongoBuildOptions): ClickStackExternalMongoBootstrapComposition;
+export declare function makeClickstackBootstrap(options: ClickStackSecretValuesExternalMongoBuildOptions): ClickStackSecretValuesExternalMongoBootstrapComposition;
 /**
  * The default ClickStack bootstrap: internal single-replica Mongo (dev-first),
  * default RGD name/kind. Use `makeClickstackBootstrap(...)` for the
  * external-Mongo variant, custom Mongo storage, or static raw chart values.
  */
 export declare const clickstackBootstrap: import("../../../index.js").CallableComposition<{
+    apiKey: string;
     name: string;
     clickhouse: {
         host: string;
+        password?: string;
+        appPassword?: string;
         nativePort?: number;
         httpPort?: number;
         database?: string;
         username?: string;
-        password?: string;
         appUsername?: string;
-        appPassword?: string;
     };
     namespace?: string;
     version?: string;
-    apiKey?: string;
     hyperdx?: {
         replicas?: number;
         resources?: {

package/dist/factories/clickstack/compositions/clickstack-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clickstack-bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/factories/clickstack/compositions/clickstack-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAoBH,OAAO,EAQL,KAAK,mCAAmC,EACxC,KAAK,mCAAmC,EAEzC,MAAM,aAAa,CAAC;AAyJrB,iBAAS,wBAAwB,CAAC,OAAO,EAAE,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAe7E;AAED,iBAAS,wBAAwB,CAAC,OAAO,EAAE,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAc7E;AAED,uDAAuD;AACvD,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzF,uDAAuD;AACvD,MAAM,MAAM,2CAA2C,GAAG,UAAU,CAClE,OAAO,wBAAwB,CAChC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,CAAC,EAAE,mCAAmC,GAC5C,8BAA8B,CAAC;AAClC,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,mCAAmC,GAC3C,2CAA2C,CAAC;AAmB/C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA4B,CAAC"}
+{"version":3,"file":"clickstack-bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/factories/clickstack/compositions/clickstack-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAwBH,OAAO,EASL,KAAK,yCAAyC,EAC9C,KAAK,yCAAyC,EAK9C,KAAK,+CAA+C,EAGpD,KAAK,+CAA+C,EACrD,MAAM,aAAa,CAAC;AAwXrB,iBAAS,8BAA8B,CAAC,OAAO,EAAE,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAYzF;AAED,iBAAS,oCAAoC,CAC3C,OAAO,EAAE,+CAA+C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAezD;AAED,iBAAS,8BAA8B,CAAC,OAAO,EAAE,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAYzF;AAED,iBAAS,oCAAoC,CAC3C,OAAO,EAAE,+CAA+C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAezD;AAED,uDAAuD;AACvD,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE/F,qEAAqE;AACrE,MAAM,MAAM,0CAA0C,GAAG,UAAU,CACjE,OAAO,oCAAoC,CAC5C,CAAC;AAEF,uDAAuD;AACvD,MAAM,MAAM,2CAA2C,GAAG,UAAU,CAClE,OAAO,8BAA8B,CACtC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,uDAAuD,GAAG,UAAU,CAC9E,OAAO,oCAAoC,CAC5C,CAAC;AAoBF;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,CAAC,EAAE,yCAAyC,GAClD,8BAA8B,CAAC;AAClC,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,+CAA+C,GACvD,0CAA0C,CAAC;AAC9C,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,yCAAyC,GACjD,2CAA2C,CAAC;AAC/C,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,+CAA+C,GACvD,uDAAuD,CAAC;AAkD3D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA4B,CAAC"}

package/dist/factories/clickstack/compositions/clickstack-bootstrap.js

@@ -1,7 +1,7 @@
 /**
  * ClickStack (HyperDX) Bootstrap Composition — EXTERNAL ClickHouse only.
  *
- * Deploys the OFFICIAL `clickstack` chart (3.0.x, MIT) from
+ * Deploys the OFFICIAL `clickstack` chart (3.2.x, MIT) from
  * https://clickhouse.github.io/ClickStack-helm-charts via HelmRepository and
  * HelmRelease resources. Build-around: we wrap the official chart — never
  * hand-rolled manifests. NOT the archived hyperdxio/helm-charts repo, NOT the
@@ -59,6 +59,7 @@
  *     username: 'otelcollector',
  *     password: '…',
  *   },
+ *   apiKey: '…',
  * });
  * ```
  *
@@ -69,21 +70,78 @@
  * await bootstrap.factory('kro').deploy({
  *   name: 'clickstack',
  *   clickhouse: { host: '…' },
+ *   apiKey: '…',
  *   mongoUri: 'mongodb://user:pass@mongo.example.com:27017/hyperdx',
  * });
  * ```
  */
 import { kubernetesComposition } from '../../../core/composition/imperative.js';
 import { DEFAULT_FLUX_NAMESPACE } from '../../../core/config/defaults.js';
+import { registerPortableReadinessEvaluator } from '../../../core/readiness/portable-strategies.js';
 import { Cel } from '../../../core/references/cel.js';
 import { singleton } from '../../../core/singleton/singleton.js';
 import { containsKubernetesRefs, isKubernetesRef } from '../../../utils/type-guards.js';
+import { helmReleaseConditionSummary } from '../../helm/status.js';
 import { namespace } from '../../kubernetes/core/namespace.js';
+import { cronJob } from '../../kubernetes/workloads/cron-job.js';
 import { CLICKSTACK_API_PORT, CLICKSTACK_APP_PORT, CLICKSTACK_GATEWAY_NAME_SUFFIX, CLICKSTACK_OTLP_GRPC_PORT, CLICKSTACK_OTLP_HTTP_PORT, clickstackHelmRelease, DEFAULT_CLICKSTACK_REPO_NAME, DEFAULT_CLICKSTACK_REPO_URL, DEFAULT_CLICKSTACK_VERSION, } from '../resources/helm.js';
 import { clickstackMongoService, clickstackMongoStatefulSet } from '../resources/mongo.js';
-import { ClickStackBootstrapConfigSchema, ClickStackBootstrapStatusSchema, ClickStackExternalMongoBootstrapConfigSchema, } from '../types.js';
+import { ClickStackBootstrapConfigSchema, ClickStackBootstrapStatusSchema, ClickStackExternalMongoBootstrapConfigSchema, ClickStackSecretValuesBootstrapConfigSchema, ClickStackSecretValuesExternalMongoBootstrapConfigSchema, } from '../types.js';
 import { DEFAULT_CLICKSTACK_NAMESPACE, mapClickStackConfigToHelmValues, } from '../utils/helm-values-mapper.js';
 import { clickstackHelmRepositoryBootstrap } from './clickstack-helm-repository.js';
+const CLICKSTACK_CHART_PLACEHOLDER_API_KEY = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx';
+const clickstackTeamBootstrapReadiness = registerPortableReadinessEvaluator('typekro.readiness.clickstack.team-bootstrap', '1', (liveResource) => {
+    const status = liveResource.status;
+    const scheduledAt = status?.lastScheduleTime
+        ? new Date(status.lastScheduleTime).getTime()
+        : Number.NaN;
+    const succeededAt = status?.lastSuccessfulTime
+        ? new Date(status.lastSuccessfulTime).getTime()
+        : Number.NaN;
+    if (Number.isFinite(scheduledAt) && Number.isFinite(succeededAt) && succeededAt >= scheduledAt) {
+        return {
+            ready: true,
+            reason: 'BootstrapCurrent',
+            message: 'The latest ClickStack Team credential convergence succeeded',
+        };
+    }
+    return {
+        ready: false,
+        reason: status?.active?.length ? 'BootstrapActive' : 'BootstrapPending',
+        message: status?.lastScheduleTime
+            ? 'The latest ClickStack Team credential convergence has not succeeded'
+            : 'The ClickStack Team credential convergence has not run yet',
+    };
+});
+const inlineSchemaFieldValidations = {
+    apiKey: `self != "${CLICKSTACK_CHART_PLACEHOLDER_API_KEY}"`,
+};
+const CLICKSTACK_TEAM_BOOTSTRAP_SCRIPT = [
+    "const database = db.getSiblingDB('hyperdx');",
+    'const apiKey = process.env.HYPERDX_API_KEY;',
+    "if (typeof apiKey !== 'string' || apiKey.trim().length === 0) throw new Error('HYPERDX_API_KEY is required.');",
+    `if (apiKey === '${CLICKSTACK_CHART_PLACEHOLDER_API_KEY}') throw new Error('HYPERDX_API_KEY must override the published ClickStack chart placeholder.');`,
+    "const hookId = 'typekro-managed-ingestion';",
+    'const teams = database.teams.find({ hookId }).toArray();',
+    "if (teams.length > 1) throw new Error('Multiple TypeKro-managed ClickStack Teams exist.');",
+    'if (teams.length === 0) {',
+    '  const now = new Date();',
+    '  database.teams.insertOne({',
+    "    name: 'Applik8s Observability',",
+    '    allowedAuthMethods: [],',
+    '    hookId,',
+    '    apiKey,',
+    '    collectorAuthenticationEnforced: true,',
+    '    isMetricsSeriesTableEnabled: false,',
+    '    createdAt: now,',
+    '    updatedAt: now,',
+    '  });',
+    '} else if (teams[0].apiKey !== apiKey || teams[0].collectorAuthenticationEnforced !== true) {',
+    '  database.teams.updateOne({ _id: teams[0]._id }, {',
+    '    $set: { apiKey, collectorAuthenticationEnforced: true, updatedAt: new Date() },',
+    '  });',
+    '}',
+].join('\n');
 /**
  * Shared composition body. `build` is CONCRETE (construction-time), so every
  * plain-JS branch below is on build config — never on the (possibly
@@ -98,19 +156,43 @@ import { clickstackHelmRepositoryBootstrap } from './clickstack-helm-repository.
  */
 function bootstrapBody(spec, build) {
     {
+        const credentialsSecret = spec.credentialsSecret;
         const resolvedNamespace = isKubernetesRef(spec.namespace)
             ? Cel.default(spec.namespace, DEFAULT_CLICKSTACK_NAMESPACE)
             : (spec.namespace ?? DEFAULT_CLICKSTACK_NAMESPACE);
         const resolvedVersion = isKubernetesRef(spec.version)
             ? Cel.default(spec.version, DEFAULT_CLICKSTACK_VERSION)
             : (spec.version ?? DEFAULT_CLICKSTACK_VERSION);
+        if (build.credentialSource === 'inline') {
+            const inlineApiKey = spec.apiKey;
+            if (!isKubernetesRef(inlineApiKey) &&
+                (inlineApiKey.trim().length === 0 || inlineApiKey === CLICKSTACK_CHART_PLACEHOLDER_API_KEY)) {
+                throw new Error('ClickStack inline credential mode requires a non-empty apiKey that is not the published chart placeholder.');
+            }
+        }
         const helmValues = mapClickStackConfigToHelmValues(spec, {
             mongoMode: build.mongoMode,
+            credentialSource: build.credentialSource,
             ...(build.values !== undefined && { values: build.values }),
         });
+        if (build.credentialSource === 'secretValues' &&
+            !isKubernetesRef(credentialsSecret) &&
+            credentialsSecret === undefined) {
+            throw new Error('ClickStack secretValues credential mode requires credentialsSecret.');
+        }
+        if (build.credentialSource === 'secretValues' &&
+            !isKubernetesRef(spec.clickhouse) &&
+            (spec.clickhouse.password !== undefined ||
+                spec.clickhouse.appPassword !== undefined ||
+                spec.apiKey !== undefined ||
+                spec.customValues !== undefined)) {
+            throw new Error('ClickStack secretValues credential mode rejects inline clickhouse.password, clickhouse.appPassword, apiKey, and runtime customValues.');
+        }
         const _clickstackNamespace = namespace({
             metadata: {
-                name: resolvedNamespace,
+                // This resource is active only when namespace is omitted, so its
+                // identity is always TypeKro's documented standalone default.
+                name: DEFAULT_CLICKSTACK_NAMESPACE,
                 labels: {
                     'app.kubernetes.io/name': 'clickstack',
                     'app.kubernetes.io/instance': spec.name,
@@ -118,7 +200,7 @@ function bootstrapBody(spec, build) {
                 },
             },
             id: 'clickstackNamespace',
-        });
+        }).withIncludeWhen(isKubernetesRef(spec.namespace) ? Cel.not(spec.namespace) : spec.namespace === undefined);
         // One cluster-level Flux source shared by every ClickStack instance —
         // singleton(...) keeps it out of any single instance's KRO ApplySet
         // (see clickstack-helm-repository.ts for the ownership rationale).
@@ -160,9 +242,100 @@ function bootstrapBody(spec, build) {
             namespace: resolvedNamespace,
             version: resolvedVersion,
             values: helmValues,
+            ...(build.credentialSource === 'secretValues'
+                ? {
+                    valuesFrom: [
+                        {
+                            kind: 'Secret',
+                            // biome-ignore lint/style/noNonNullAssertion: the secretValues schema requires credentialsSecret
+                            name: credentialsSecret.name,
+                            valuesKey: isKubernetesRef(credentialsSecret?.valuesKey)
+                                ? Cel.default(credentialsSecret.valuesKey, 'values.yaml')
+                                : (credentialsSecret?.valuesKey ?? 'values.yaml'),
+                        },
+                    ],
+                }
+                : {}),
             id: 'clickstackHelmRelease',
         });
-        const helmReleaseReady = Cel.expr(_clickstackHelmRelease.status.conditions, '.exists(c, c.type == "Ready" && c.status == "True")');
+        // HyperDX's production OpAMP controller activates OTLP only after its
+        // authoritative Team collection contains an ingestion key. The chart's
+        // HYPERDX_API_KEY environment value configures application telemetry but
+        // does not create that Team. Bootstrap one framework-owned Team from the
+        // chart-owned Secret, after the release (and therefore Mongo) is ready.
+        // This keeps the credential out of the Job manifest, coexists with
+        // application-created Teams, and converges the framework-owned key when a
+        // referenced Secret or Mongo URI rotates. A one-shot Job cannot observe
+        // either update after it completes, so this deliberately uses an
+        // idempotent minute-level CronJob. Readiness requires a successful run;
+        // the script rejects the chart's public placeholder key, making an absent
+        // Secret values override fail closed.
+        const mongoUri = build.mongoMode === 'external'
+            ? spec.mongoUri
+            : Cel.template('mongodb://%s-mongodb.%s.svc.cluster.local:27017/hyperdx', spec.name, resolvedNamespace);
+        const _teamBootstrap = cronJob({
+            id: 'clickstackTeamBootstrap',
+            metadata: {
+                name: `${spec.name}-team-bootstrap`,
+                namespace: resolvedNamespace,
+                labels: {
+                    'app.kubernetes.io/name': 'clickstack-team-bootstrap',
+                    'app.kubernetes.io/instance': spec.name,
+                    'app.kubernetes.io/managed-by': 'typekro',
+                },
+            },
+            spec: {
+                schedule: '* * * * *',
+                concurrencyPolicy: 'Forbid',
+                startingDeadlineSeconds: 60,
+                successfulJobsHistoryLimit: 1,
+                failedJobsHistoryLimit: 3,
+                jobTemplate: {
+                    spec: {
+                        backoffLimit: 6,
+                        template: {
+                            metadata: {
+                                labels: {
+                                    'app.kubernetes.io/name': 'clickstack-team-bootstrap',
+                                    'app.kubernetes.io/instance': spec.name,
+                                },
+                            },
+                            spec: {
+                                restartPolicy: 'Never',
+                                containers: [
+                                    {
+                                        name: 'team-bootstrap',
+                                        image: 'mongo:7',
+                                        command: [
+                                            'mongosh',
+                                            '--quiet',
+                                            mongoUri,
+                                            '--eval',
+                                            CLICKSTACK_TEAM_BOOTSTRAP_SCRIPT,
+                                        ],
+                                        env: [
+                                            {
+                                                name: 'HYPERDX_API_KEY',
+                                                valueFrom: {
+                                                    secretKeyRef: {
+                                                        name: 'clickstack-secret',
+                                                        key: 'HYPERDX_API_KEY',
+                                                        optional: false,
+                                                    },
+                                                },
+                                            },
+                                        ],
+                                    },
+                                ],
+                            },
+                        },
+                    },
+                },
+            },
+        }).withReadinessEvaluator(clickstackTeamBootstrapReadiness);
+        _teamBootstrap.dependsOn(_clickstackHelmRelease);
+        const helmReleaseStatus = helmReleaseConditionSummary(_clickstackHelmRelease);
+        const teamBootstrapReady = Cel.expr('has(clickstackTeamBootstrap.status.lastScheduleTime) && ', 'has(clickstackTeamBootstrap.status.lastSuccessfulTime) && ', 'string(clickstackTeamBootstrap.status.lastSuccessfulTime) >= ', 'string(clickstackTeamBootstrap.status.lastScheduleTime)');
         // Status endpoints derive from the owned HelmRelease resource so they
         // serialize as KRO status CEL and land on the live KRO CR's status
         // (same reachability class as the PR #93 review finding). Naming is
@@ -188,10 +361,8 @@ function bootstrapBody(spec, build) {
         // final-pipeline test). Unchanged by this migration: raw Cel.expr before
         // and after; only the metadata endpoint fields switched to template literals.
         return {
-            ready: helmReleaseReady,
-            phase: Cel.expr('clickstackHelmRelease.status.conditions.exists(c, c.type == "Ready" && c.status == "False") ' +
-                '? "Failed" : clickstackHelmRelease.status.conditions.exists(c, c.type == "Ready" && ' +
-                'c.status == "True") ? "Ready" : "Installing"'),
+            ready: Cel.expr(helmReleaseStatus.ready, ' && ', teamBootstrapReady),
+            phase: Cel.expr(helmReleaseStatus.failed, ' ? "Failed" : (', helmReleaseStatus.ready, ' && ', teamBootstrapReady, ' ? "Ready" : "Installing")'),
             version: resolvedVersion,
             ui: {
                 url: `http://${_clickstackHelmRelease.metadata.name}.${_clickstackHelmRelease.metadata.namespace}.svc.cluster.local:${CLICKSTACK_APP_PORT}`,
@@ -210,31 +381,72 @@ function bootstrapBody(spec, build) {
         };
     }
 }
-function buildInternalComposition(options) {
-    const build = {
+function resolveInternalBuild(options) {
+    return {
         mongoMode: 'internal',
+        credentialSource: options.credentials?.source ?? 'inline',
         ...(options.mongo?.storage !== undefined && { storage: options.mongo.storage }),
         ...(options.values !== undefined && { values: options.values }),
     };
+}
+function resolveExternalBuild(options) {
+    return {
+        mongoMode: 'external',
+        credentialSource: options.credentials?.source ?? 'inline',
+        ...(options.values !== undefined && { values: options.values }),
+    };
+}
+function buildInternalInlineComposition(options) {
+    const build = resolveInternalBuild(options);
     return kubernetesComposition({
         name: options.name ?? 'clickstack-bootstrap',
         kind: options.kind ?? 'ClickStackBootstrap',
         spec: ClickStackBootstrapConfigSchema,
         status: ClickStackBootstrapStatusSchema,
-    }, (spec) => bootstrapBody(spec, build));
+    }, (spec) => bootstrapBody(spec, build), { schemaFieldValidations: inlineSchemaFieldValidations });
 }
-function buildExternalComposition(options) {
+function buildInternalSecretValuesComposition(options) {
     const build = {
-        mongoMode: 'external',
-        ...(options.values !== undefined && { values: options.values }),
+        ...resolveInternalBuild(options),
+        credentialSource: 'secretValues',
     };
+    return kubernetesComposition({
+        name: options.name ?? 'clickstack-bootstrap',
+        kind: options.kind ?? 'ClickStackBootstrap',
+        spec: ClickStackSecretValuesBootstrapConfigSchema,
+        status: ClickStackBootstrapStatusSchema,
+    }, (spec) => bootstrapBody(spec, build));
+}
+function buildExternalInlineComposition(options) {
+    const build = resolveExternalBuild(options);
     return kubernetesComposition({
         name: options.name ?? 'clickstack-bootstrap-external-mongo',
         kind: options.kind ?? 'ClickStackExternalMongoBootstrap',
         spec: ClickStackExternalMongoBootstrapConfigSchema,
         status: ClickStackBootstrapStatusSchema,
+    }, (spec) => bootstrapBody(spec, build), { schemaFieldValidations: inlineSchemaFieldValidations });
+}
+function buildExternalSecretValuesComposition(options) {
+    const build = {
+        ...resolveExternalBuild(options),
+        credentialSource: 'secretValues',
+    };
+    return kubernetesComposition({
+        name: options.name ?? 'clickstack-bootstrap-external-mongo',
+        kind: options.kind ?? 'ClickStackExternalMongoBootstrap',
+        spec: ClickStackSecretValuesExternalMongoBootstrapConfigSchema,
+        status: ClickStackBootstrapStatusSchema,
     }, (spec) => bootstrapBody(spec, build));
 }
+function isSecretValuesExternalBuild(options) {
+    return options.mongo?.mode === 'external' && options.credentials?.source === 'secretValues';
+}
+function isInlineExternalBuild(options) {
+    return options.mongo?.mode === 'external' && options.credentials?.source !== 'secretValues';
+}
+function isSecretValuesInternalBuild(options) {
+    return options.mongo?.mode !== 'external' && options.credentials?.source === 'secretValues';
+}
 export function makeClickstackBootstrap(options = {}) {
     // Build-time options must be CONCRETE: they select which resources exist and bake static chart
     // values at construction — a schema ref here can never serialize (loud > silent mis-serialization).
@@ -243,10 +455,32 @@ export function makeClickstackBootstrap(options = {}) {
             'Build-time options (mongo mode/storage, static chart values, name/kind) are fixed at ' +
             'construction — move per-instance values into the runtime spec instead.');
     }
-    if (options.mongo?.mode === 'external') {
-        return buildExternalComposition(options);
+    if (options.credentials?.source === 'secretValues') {
+        const hyperdx = options.values?.hyperdx;
+        const deployment = hyperdx && typeof hyperdx === 'object' && !Array.isArray(hyperdx)
+            ? hyperdx.deployment
+            : undefined;
+        if (hyperdx &&
+            typeof hyperdx === 'object' &&
+            !Array.isArray(hyperdx) &&
+            (hyperdx.secrets !== undefined ||
+                (deployment &&
+                    typeof deployment === 'object' &&
+                    !Array.isArray(deployment) &&
+                    deployment.defaultConnections !== undefined))) {
+            throw new Error('makeClickstackBootstrap: secretValues credential mode rejects build-time hyperdx.secrets and hyperdx.deployment.defaultConnections. Put those values in the referenced Secret.');
+        }
+    }
+    if (isSecretValuesExternalBuild(options)) {
+        return buildExternalSecretValuesComposition(options);
+    }
+    if (isInlineExternalBuild(options)) {
+        return buildExternalInlineComposition(options);
+    }
+    if (isSecretValuesInternalBuild(options)) {
+        return buildInternalSecretValuesComposition(options);
     }
-    return buildInternalComposition(options);
+    return buildInternalInlineComposition(options);
 }
 /**
  * The default ClickStack bootstrap: internal single-replica Mongo (dev-first),

package/dist/factories/clickstack/compositions/clickstack-bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"clickstack-bootstrap.js","sourceRoot":"","sources":["../../../../src/factories/clickstack/compositions/clickstack-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAEL,+BAA+B,EAE/B,+BAA+B,EAG/B,4CAA4C,GAI7C,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AASpF;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,IAAsC,EAAE,KAA0B;IACvF,CAAC;QACC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC;YAC3D,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,4BAA4B,CAAC,CAAC;QACrD,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;YACnD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC;YACvD,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC;QAEjD,MAAM,UAAU,GAAG,+BAA+B,CAAC,IAAI,EAAE;YACvD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAC5D,CAAC,CAAC;QAEH,MAAM,oBAAoB,GAAG,SAAS,CAAC;YACrC,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE;oBACN,wBAAwB,EAAE,YAAY;oBACtC,4BAA4B,EAAE,IAAI,CAAC,IAAI;oBACvC,8BAA8B,EAAE,SAAS;iBAC1C;aACF;YACD,EAAE,EAAE,qBAAqB;SAC1B,CAAC,CAAC;QAEH,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,yBAAyB,GAAG,SAAS,CAAC,iCAAiC,EAAE;YAC7E,EAAE,EAAE,4BAA4B;YAChC,IAAI,EAAE;gBACJ,IAAI,EAAE,4BAA4B;gBAClC,SAAS,EAAE,sBAAsB;gBACjC,GAAG,EAAE,2BAA2B;aACjC;SACF,CAAC,CAAC;QAEH,uEAAuE;QACvE,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;gBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,iBAA2B;gBACtC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC7E,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,KAAK,SAAS,IAAI;oBACnD,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB;iBACjD,CAAC;gBACF,aAAa,EAAE,4BAA4B;aAC5C,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,sBAAsB,CAAC;gBAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,iBAA2B;gBACtC,SAAS,EAAE,wBAAwB;aACpC,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,EAAE;QACF,uEAAuE;QACvE,qEAAqE;QACrE,+DAA+D;QAC/D,sEAAsE;QACtE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;YACnD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,UAAU;YAClB,EAAE,EAAE,uBAAuB;SAC5B,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,GAAG,CAAC,IAAI,CAC/B,sBAAsB,CAAC,MAAM,CAAC,UAAU,EACxC,qDAAqD,CACtD,CAAC;QAEF,sEAAsE;QACtE,mEAAmE;QACnE,oEAAoE;QACpE,0EAA0E;QAC1E,sDAAsD;QACtD,4EAA4E;QAC5E,oDAAoD;QACpD,EAAE;QACF,sEAAsE;QACtE,wEAAwE;QACxE,4DAA4D;QAC5D,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,8EAA8E;QAC9E,OAAO;YACL,KAAK,EAAE,gBAAgB;YACvB,KAAK,EAAE,GAAG,CAAC,IAAI,CACb,8FAA8F;gBAC5F,sFAAsF;gBACtF,8CAA8C,CACjD;YACD,OAAO,EAAE,eAAe;YACxB,EAAE,EAAE;gBACF,GAAG,EAAE,UAAU,sBAAsB,CAAC,QAAQ,CAAC,IAAI,IAAI,sBAAsB,CAAC,QAAQ,CAAC,SAAS,sBAAsB,mBAAmB,EAAE;aAC5I;YACD,OAAO,EAAE;gBACP,gBAAgB,EAAE,UAAU,sBAAsB,CAAC,QAAQ,CAAC,IAAI,GAAG,8BAA8B,IAAI,sBAAsB,CAAC,QAAQ,CAAC,SAAS,sBAAsB,yBAAyB,EAAE;gBAC/L,gBAAgB,EAAE,UAAU,sBAAsB,CAAC,QAAQ,CAAC,IAAI,GAAG,8BAA8B,IAAI,sBAAsB,CAAC,QAAQ,CAAC,SAAS,sBAAsB,yBAAyB,EAAE;aAChM;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,IAAI,sBAAsB,CAAC,QAAQ,CAAC,SAAS,oBAAoB;gBAC9G,kEAAkE;gBAClE,gEAAgE;gBAChE,OAAO,EAAE,mBAAmB;gBAC5B,OAAO,EAAE,mBAAmB;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,OAA4C;IAC5E,MAAM,KAAK,GAAwB;QACjC,SAAS,EAAE,UAAU;QACrB,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC;IACF,OAAO,qBAAqB,CAC1B;QACE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,sBAAsB;QAC5C,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,qBAAqB;QAC3C,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,+BAA+B;KACxC,EACD,CAAC,IAA+B,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAA4C;IAC5E,MAAM,KAAK,GAAwB;QACjC,SAAS,EAAE,UAAU;QACrB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC;IACF,OAAO,qBAAqB,CAC1B;QACE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,qCAAqC;QAC3D,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,kCAAkC;QACxD,IAAI,EAAE,4CAA4C;QAClD,MAAM,EAAE,+BAA+B;KACxC,EACD,CAAC,IAA4C,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAC7E,CAAC;AACJ,CAAC;AAqBD,MAAM,UAAU,uBAAuB,CACrC,UAAkC,EAAE;IAEpC,+FAA+F;IAC/F,oGAAoG;IACpG,IAAI,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,uFAAuF;YACvF,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,wBAAwB,CAAC,OAA8C,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,wBAAwB,CAAC,OAA8C,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"clickstack-bootstrap.js","sourceRoot":"","sources":["../../../../src/factories/clickstack/compositions/clickstack-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACpG,OAAO,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAEL,+BAA+B,EAE/B,+BAA+B,EAG/B,4CAA4C,EAO5C,2CAA2C,EAG3C,wDAAwD,GAEzD,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAUpF,MAAM,oCAAoC,GAAG,sCAAsC,CAAC;AACpF,MAAM,gCAAgC,GAAG,kCAAkC,CACzE,6CAA6C,EAC7C,GAAG,EACH,CAAC,YAAY,EAAE,EAAE;IACf,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,EAAE,gBAAgB;QAC1C,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;QAC7C,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACf,MAAM,WAAW,GAAG,MAAM,EAAE,kBAAkB;QAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE;QAC/C,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACf,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC/F,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,6DAA6D;SACvE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB;QACvE,OAAO,EAAE,MAAM,EAAE,gBAAgB;YAC/B,CAAC,CAAC,qEAAqE;YACvE,CAAC,CAAC,4DAA4D;KACjE,CAAC;AACJ,CAAC,CACF,CAAC;AACF,MAAM,4BAA4B,GAAG;IACnC,MAAM,EAAE,YAAY,oCAAoC,GAAG;CACnD,CAAC;AAEX,MAAM,gCAAgC,GAAG;IACvC,8CAA8C;IAC9C,6CAA6C;IAC7C,gHAAgH;IAChH,mBAAmB,oCAAoC,kGAAkG;IACzJ,6CAA6C;IAC7C,0DAA0D;IAC1D,4FAA4F;IAC5F,2BAA2B;IAC3B,2BAA2B;IAC3B,8BAA8B;IAC9B,qCAAqC;IACrC,6BAA6B;IAC7B,aAAa;IACb,aAAa;IACb,4CAA4C;IAC5C,yCAAyC;IACzC,qBAAqB;IACrB,qBAAqB;IACrB,OAAO;IACP,+FAA+F;IAC/F,qDAAqD;IACrD,qFAAqF;IACrF,OAAO;IACP,GAAG;CACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,IAAsC,EAAE,KAA0B;IACvF,CAAC;QACC,MAAM,iBAAiB,GACrB,IAGD,CAAC,iBAAiB,CAAC;QACpB,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC;YAC3D,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,4BAA4B,CAAC,CAAC;QACrD,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;YACnD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC;YACvD,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC;QAEjD,IAAI,KAAK,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,YAAY,GAChB,IACD,CAAC,MAAM,CAAC;YACT,IACE,CAAC,eAAe,CAAC,YAAY,CAAC;gBAC9B,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,KAAK,oCAAoC,CAAC,EAC3F,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,4GAA4G,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,+BAA+B,CAAC,IAAI,EAAE;YACvD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAC5D,CAAC,CAAC;QAEH,IACE,KAAK,CAAC,gBAAgB,KAAK,cAAc;YACzC,CAAC,eAAe,CAAC,iBAAiB,CAAC;YACnC,iBAAiB,KAAK,SAAS,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QACD,IACE,KAAK,CAAC,gBAAgB,KAAK,cAAc;YACzC,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;YACjC,CAAE,IAAI,CAAC,UAAqC,CAAC,QAAQ,KAAK,SAAS;gBAChE,IAAI,CAAC,UAAwC,CAAC,WAAW,KAAK,SAAS;gBACvE,IAA6B,CAAC,MAAM,KAAK,SAAS;gBACnD,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uIAAuI,CACxI,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,SAAS,CAAC;YACrC,QAAQ,EAAE;gBACR,iEAAiE;gBACjE,8DAA8D;gBAC9D,IAAI,EAAE,4BAA4B;gBAClC,MAAM,EAAE;oBACN,wBAAwB,EAAE,YAAY;oBACtC,4BAA4B,EAAE,IAAI,CAAC,IAAI;oBACvC,8BAA8B,EAAE,SAAS;iBAC1C;aACF;YACD,EAAE,EAAE,qBAAqB;SAC1B,CAAC,CAAC,eAAe,CAChB,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CACzF,CAAC;QAEF,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,yBAAyB,GAAG,SAAS,CAAC,iCAAiC,EAAE;YAC7E,EAAE,EAAE,4BAA4B;YAChC,IAAI,EAAE;gBACJ,IAAI,EAAE,4BAA4B;gBAClC,SAAS,EAAE,sBAAsB;gBACjC,GAAG,EAAE,2BAA2B;aACjC;SACF,CAAC,CAAC;QAEH,uEAAuE;QACvE,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;gBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,iBAA2B;gBACtC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC7E,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,KAAK,SAAS,IAAI;oBACnD,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB;iBACjD,CAAC;gBACF,aAAa,EAAE,4BAA4B;aAC5C,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,sBAAsB,CAAC;gBAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,iBAA2B;gBACtC,SAAS,EAAE,wBAAwB;aACpC,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,EAAE;QACF,uEAAuE;QACvE,qEAAqE;QACrE,+DAA+D;QAC/D,sEAAsE;QACtE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;YACnD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,UAAU;YAClB,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,cAAc;gBAC3C,CAAC,CAAC;oBACE,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,QAAiB;4BACvB,iGAAiG;4BACjG,IAAI,EAAE,iBAAkB,CAAC,IAAI;4BAC7B,SAAS,EAAE,eAAe,CAAC,iBAAiB,EAAE,SAAS,CAAC;gCACtD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC;gCACzD,CAAC,CAAC,CAAC,iBAAiB,EAAE,SAAS,IAAI,aAAa,CAAC;yBACpD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,EAAE,EAAE,uBAAuB;SAC5B,CAAC,CAAC;QAEH,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,0EAA0E;QAC1E,wEAAwE;QACxE,iEAAiE;QACjE,wEAAwE;QACxE,0EAA0E;QAC1E,sCAAsC;QACtC,MAAM,QAAQ,GACZ,KAAK,CAAC,SAAS,KAAK,UAAU;YAC5B,CAAC,CAAE,IAA+C,CAAC,QAAQ;YAC3D,CAAC,CAAC,GAAG,CAAC,QAAQ,CACV,yDAAyD,EACzD,IAAI,CAAC,IAAI,EACT,iBAAiB,CAClB,CAAC;QACR,MAAM,cAAc,GAAG,OAAO,CAAC;YAC7B,EAAE,EAAE,yBAAyB;YAC7B,QAAQ,EAAE;gBACR,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,iBAAiB;gBACnC,SAAS,EAAE,iBAA2B;gBACtC,MAAM,EAAE;oBACN,wBAAwB,EAAE,2BAA2B;oBACrD,4BAA4B,EAAE,IAAI,CAAC,IAAI;oBACvC,8BAA8B,EAAE,SAAS;iBAC1C;aACF;YACD,IAAI,EAAE;gBACJ,QAAQ,EAAE,WAAW;gBACrB,iBAAiB,EAAE,QAAQ;gBAC3B,uBAAuB,EAAE,EAAE;gBAC3B,0BAA0B,EAAE,CAAC;gBAC7B,sBAAsB,EAAE,CAAC;gBACzB,WAAW,EAAE;oBACX,IAAI,EAAE;wBACJ,YAAY,EAAE,CAAC;wBACf,QAAQ,EAAE;4BACR,QAAQ,EAAE;gCACR,MAAM,EAAE;oCACN,wBAAwB,EAAE,2BAA2B;oCACrD,4BAA4B,EAAE,IAAI,CAAC,IAAI;iCACxC;6BACF;4BACD,IAAI,EAAE;gCACJ,aAAa,EAAE,OAAO;gCACtB,UAAU,EAAE;oCACV;wCACE,IAAI,EAAE,gBAAgB;wCACtB,KAAK,EAAE,SAAS;wCAChB,OAAO,EAAE;4CACP,SAAS;4CACT,SAAS;4CACT,QAAkB;4CAClB,QAAQ;4CACR,gCAAgC;yCACjC;wCACD,GAAG,EAAE;4CACH;gDACE,IAAI,EAAE,iBAAiB;gDACvB,SAAS,EAAE;oDACT,YAAY,EAAE;wDACZ,IAAI,EAAE,mBAAmB;wDACzB,GAAG,EAAE,iBAAiB;wDACtB,QAAQ,EAAE,KAAK;qDAChB;iDACF;6CACF;yCACF;qCACF;iCACF;6BACF;yBACF;qBACF;iBACF;aACF;SACF,CAAC,CAAC,sBAAsB,CAAC,gCAAgC,CAAC,CAAC;QAC5D,cAAc,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAEjD,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,sBAAsB,CAAC,CAAC;QAC9E,MAAM,kBAAkB,GAAG,GAAG,CAAC,IAAI,CACjC,0DAA0D,EAC1D,4DAA4D,EAC5D,+DAA+D,EAC/D,yDAAyD,CAC1D,CAAC;QAEF,sEAAsE;QACtE,mEAAmE;QACnE,oEAAoE;QACpE,0EAA0E;QAC1E,sDAAsD;QACtD,4EAA4E;QAC5E,oDAAoD;QACpD,EAAE;QACF,sEAAsE;QACtE,wEAAwE;QACxE,4DAA4D;QAC5D,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,8EAA8E;QAC9E,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,IAAI,CAAU,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC;YAC7E,KAAK,EAAE,GAAG,CAAC,IAAI,CACb,iBAAiB,CAAC,MAAM,EACxB,iBAAiB,EACjB,iBAAiB,CAAC,KAAK,EACvB,MAAM,EACN,kBAAkB,EAClB,4BAA4B,CAC7B;YACD,OAAO,EAAE,eAAe;YACxB,EAAE,EAAE;gBACF,GAAG,EAAE,UAAU,sBAAsB,CAAC,QAAQ,CAAC,IAAI,IAAI,sBAAsB,CAAC,QAAQ,CAAC,SAAS,sBAAsB,mBAAmB,EAAE;aAC5I;YACD,OAAO,EAAE;gBACP,gBAAgB,EAAE,UAAU,sBAAsB,CAAC,QAAQ,CAAC,IAAI,GAAG,8BAA8B,IAAI,sBAAsB,CAAC,QAAQ,CAAC,SAAS,sBAAsB,yBAAyB,EAAE;gBAC/L,gBAAgB,EAAE,UAAU,sBAAsB,CAAC,QAAQ,CAAC,IAAI,GAAG,8BAA8B,IAAI,sBAAsB,CAAC,QAAQ,CAAC,SAAS,sBAAsB,yBAAyB,EAAE;aAChM;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,IAAI,sBAAsB,CAAC,QAAQ,CAAC,SAAS,oBAAoB;gBAC9G,kEAAkE;gBAClE,gEAAgE;gBAChE,OAAO,EAAE,mBAAmB;gBAC5B,OAAO,EAAE,mBAAmB;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA4C;IACxE,OAAO;QACL,SAAS,EAAE,UAAU;QACrB,gBAAgB,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,QAAQ;QACzD,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA4C;IACxE,OAAO;QACL,SAAS,EAAE,UAAU;QACrB,gBAAgB,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,QAAQ;QACzD,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,OAAkD;IACxF,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,qBAAqB,CAC1B;QACE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,sBAAsB;QAC5C,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,qBAAqB;QAC3C,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,+BAA+B;KACxC,EACD,CAAC,IAA+B,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,EAC/D,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAC3C,OAAwD;IAExD,MAAM,KAAK,GAAwB;QACjC,GAAG,oBAAoB,CAAC,OAAO,CAAC;QAChC,gBAAgB,EAAE,cAAc;KACjC,CAAC;IACF,OAAO,qBAAqB,CAC1B;QACE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,sBAAsB;QAC5C,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,qBAAqB;QAC3C,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,+BAA+B;KACxC,EACD,CAAC,IAA2C,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,OAAkD;IACxF,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,qBAAqB,CAC1B;QACE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,qCAAqC;QAC3D,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,kCAAkC;QACxD,IAAI,EAAE,4CAA4C;QAClD,MAAM,EAAE,+BAA+B;KACxC,EACD,CAAC,IAA4C,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,EAC5E,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAC3C,OAAwD;IAExD,MAAM,KAAK,GAAwB;QACjC,GAAG,oBAAoB,CAAC,OAAO,CAAC;QAChC,gBAAgB,EAAE,cAAc;KACjC,CAAC;IACF,OAAO,qBAAqB,CAC1B;QACE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,qCAAqC;QAC3D,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,kCAAkC;QACxD,IAAI,EAAE,wDAAwD;QAC9D,MAAM,EAAE,+BAA+B;KACxC,EACD,CAAC,IAAwD,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CACzF,CAAC;AACJ,CAAC;AAoBD,SAAS,2BAA2B,CAClC,OAA+B;IAE/B,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,MAAM,KAAK,cAAc,CAAC;AAC9F,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA+B;IAE/B,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,MAAM,KAAK,cAAc,CAAC;AAC9F,CAAC;AAED,SAAS,2BAA2B,CAClC,OAA+B;IAE/B,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,MAAM,KAAK,cAAc,CAAC;AAC9F,CAAC;AAmBD,MAAM,UAAU,uBAAuB,CACrC,UAAkC,EAAE;IAMpC,+FAA+F;IAC/F,oGAAoG;IACpG,IAAI,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,uFAAuF;YACvF,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,EAAE,MAAM,KAAK,cAAc,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;QACxC,MAAM,UAAU,GACd,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/D,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,CAAC,CAAC,SAAS,CAAC;QAChB,IACE,OAAO;YACP,OAAO,OAAO,KAAK,QAAQ;YAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACvB,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;gBAC5B,CAAC,UAAU;oBACT,OAAO,UAAU,KAAK,QAAQ;oBAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;oBAC1B,UAAU,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gLAAgL,CACjL,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC"}