typekro 0.44.0 → 0.45.0

package/dist/factories/traefik/utils/helm-values-mapper.d.ts

@@ -1,18 +1,5 @@
-/**
- * Traefik Helm values mapping.
- *
- * Turns the bootstrap composition's runtime spec into values for the official
- * `traefik` chart 41.5.0, then applies the security pins from #172 LAST so no
- * caller — not even the build-time `values` passthrough — can re-enable the
- * dashboard or the insecure API.
- *
- * Every value produced here may be a schema reference in KRO mode. The mapping
- * therefore never branches on a spec value; it only places values into the
- * tree. Decisions about which configuration EXISTS live in
- * {@link TraefikHelmValuesMapperOptions} and are concrete at build time.
- */
 import type { RefOrValue } from '../../../core/types/references.js';
-import type { TraefikBootstrapConfig, TraefikContainerSecurityContext, TraefikHelmValues, TraefikPodSecurityContext, TraefikRawHelmValues, TraefikServiceType } from '../types.js';
+import type { TraefikAccessLogOptions, TraefikBootstrapConfig, TraefikContainerSecurityContext, TraefikHelmValues, TraefikLocalPluginDeclaration, TraefikPluginDeclaration, TraefikPodSecurityContext, TraefikRawHelmValues, TraefikServiceType } from '../types.js';
 /**
  * Pod-level security context Traefik runs with.
  *
@@ -63,29 +50,7 @@ export declare const TRAEFIK_SECURITY_PINS: {
         sendAnonymousUsage: false;
     };
 };
-/**
- * Values that hand ownership of the entrypoint Service to TypeKro.
- *
- * The chart would otherwise create the Service itself, and a composition can
- * only project a resource's status if that resource is part of its graph.
- * Observing the chart's Service instead made every fresh direct deployment fail
- * before it started: the direct engine resolves external references BEFORE it
- * applies anything, and a `404` on the not-yet-created Service is fatal.
- *
- * Three pins make the owned Service possible. Two are constants and live here;
- * the third takes the release name, so {@link applyTraefikOwnershipPins} adds
- * it.
- *
- * - `service.enabled: false` — the chart skips its whole Service template.
- * - `nameOverride` — fixes the chart's `app.kubernetes.io/name` pod label.
- * - `instanceLabelOverride` — fixes `app.kubernetes.io/instance`, which the
- *   chart otherwise derives from the Helm release name. `traefikHelmRelease`
- *   pins `spec.releaseName` to the same name, so the two agree; the pin keeps
- *   the selector exact even if a release ever arrives under another name.
- *
- * Together those two labels are exactly the chart's own pod selector, so the
- * owned Service front-ends the same pods the chart's Service would have.
- */
+/** Values that hand ownership of the entrypoint Service to TypeKro. */
 export declare const TRAEFIK_OWNERSHIP_PINS: {
     service: {
         enabled: false;
@@ -101,10 +66,21 @@ export interface TraefikHelmValuesMapperOptions {
      * boundary is {@link TraefikRawHelmValues} rather than the managed type.
      */
     readonly baseValues?: TraefikRawHelmValues;
+    /** Access-log field and header policy. */
+    readonly accessLog?: TraefikAccessLogOptions;
+    /** Registry plugins; see `TraefikBootstrapBuildOptions.plugins`. */
+    readonly plugins?: Readonly<Record<string, TraefikPluginDeclaration>>;
+    readonly localPlugins?: Readonly<Record<string, TraefikLocalPluginDeclaration>>;
+    /** @default true when any plugin is declared */
+    readonly abortOnPluginFailure?: boolean;
+    /**
+     * Skip the check that refuses `/0` trusted ranges and `insecure` proxy trust.
+     * @default false
+     */
+    readonly dangerouslyTrustAnySource?: boolean;
     /**
-     * Emit a permanent `web` → `websecure` redirect. The chart disables the
-     * redirect by omitting `ports.web.http.redirections.entryPoint`, so this is
-     * structural rather than a value. @default true
+     * Emit a permanent `web` → `websecure` redirect that leaves
+     * `/.well-known/acme-challenge/` unredirected. @default true
      */
     readonly redirectWebToWebsecure?: boolean;
     /**
@@ -149,6 +125,18 @@ export declare function applyTraefikOwnershipPins(values: TraefikHelmValues, ins
  * @param config - The bootstrap spec. `service.type` may be a schema reference.
  */
 export declare function traefikEntrypointServiceType(config: TraefikBootstrapConfig): TraefikServiceType;
+/**
+ * Load-balancer fields of the owned entrypoint Service, each only when the spec sets it.
+ *
+ * The API server refuses `externalTrafficPolicy` on a ClusterIP Service and an
+ * empty `loadBalancerClass` anywhere. In KRO mode the spec is a proxy, so every
+ * field is emitted and serialization guards it with `omit()`.
+ */
+export declare function traefikEntrypointServiceLoadBalancer(config: TraefikBootstrapConfig): {
+    loadBalancerClass?: string;
+    externalTrafficPolicy?: 'Cluster' | 'Local';
+    loadBalancerSourceRanges?: string[];
+};
 /**
  * Map the bootstrap runtime spec onto official-chart values.
  *
@@ -175,6 +163,8 @@ export interface TraefikHelmValuesValidationContext {
      * entrypoint Service is a TypeKro-owned resource, not a chart value.
      */
     readonly serviceType?: TraefikServiceType;
+    /** Annotations on the owned Service, e.g. from `awsNlbServiceAnnotations`. */
+    readonly serviceAnnotations?: Readonly<Record<string, string>>;
 }
 /**
  * Report configuration that is legal but likely a mistake at an edge.

package/dist/factories/traefik/utils/helm-values-mapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helm-values-mapper.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/helm-values-mapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAWpE,OAAO,KAAK,EACV,sBAAsB,EACtB,+BAA+B,EAC/B,iBAAiB,EAEjB,yBAAyB,EAEzB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,EAAE,yBAK1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,EAAE,+BAIhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;CAME,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,sBAAsB;;;;;CAGC,CAAC;AAErC,iFAAiF;AACjF,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;CAC/C;AAsCD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAarF;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,GAChC,iBAAiB,CAOnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,sBAAsB,GAAG,kBAAkB,CAE/F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,sBAAsB,EAC9B,OAAO,GAAE,8BAAmC,GAC3C,iBAAiB,CAkJnB;AAED,sFAAsF;AACtF,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAC3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,kCAAuC,GAC/C,MAAM,EAAE,CAkDV;AAED;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,WAAgC,CAAC"}
+{"version":3,"file":"helm-values-mapper.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/helm-values-mapper.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AA0BpE,OAAO,KAAK,EACV,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,iBAAiB,EACjB,6BAA6B,EAE7B,wBAAwB,EACxB,yBAAyB,EAEzB,oBAAoB,EACpB,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,EAAE,yBAK1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,EAAE,+BAIhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;CAME,CAAC;AAqBrC,uEAAuE;AACvE,eAAO,MAAM,sBAAsB;;;;;CAGC,CAAC;AAErC,iFAAiF;AACjF,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAC3C,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC,CAAC;IAChF,gDAAgD;IAChD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C;;;OAGG;IAKH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;CAC/C;AA2CD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAarF;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,GAChC,iBAAiB,CAOnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,sBAAsB,GAAG,kBAAkB,CAE/F;AAED;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,sBAAsB,GAAG;IACpF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5C,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACrC,CAaA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,sBAAsB,EAC9B,OAAO,GAAE,8BAAmC,GAC3C,iBAAiB,CAuOnB;AAgJD,sFAAsF;AACtF,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,kCAAuC,GAC/C,MAAM,EAAE,CAwFV;AAeD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,WAAgC,CAAC"}

package/dist/factories/traefik/utils/helm-values-mapper.js

@@ -1,19 +1,20 @@
-/**
- * Traefik Helm values mapping.
- *
- * Turns the bootstrap composition's runtime spec into values for the official
- * `traefik` chart 41.5.0, then applies the security pins from #172 LAST so no
- * caller — not even the build-time `values` passthrough — can re-enable the
- * dashboard or the insecure API.
- *
- * Every value produced here may be a schema reference in KRO mode. The mapping
- * therefore never branches on a spec value; it only places values into the
- * tree. Decisions about which configuration EXISTS live in
- * {@link TraefikHelmValuesMapperOptions} and are concrete at build time.
- */
+// Traefik Helm values mapping.
+//
+// Turns the bootstrap composition's runtime spec into values for the official
+// `traefik` chart 41.5.0, then applies the security pins from #172 LAST so no
+// caller — not even the build-time `values` passthrough — can re-enable the
+// dashboard or the insecure API.
+//
+// Every value produced here may be a schema reference in KRO mode. The mapping
+// therefore never branches on a spec value; it only places values into the
+// tree. Decisions about which configuration EXISTS live in
+// {@link TraefikHelmValuesMapperOptions} and are concrete at build time.
 import { Cel } from '../../../core/references/cel.js';
 import { isCelExpression, isKubernetesRef } from '../../../utils/type-guards.js';
-import { DEFAULT_TRAEFIK_CHART_VERSION, DEFAULT_TRAEFIK_INGRESS_CLASS, DEFAULT_TRAEFIK_NAMESPACE, DEFAULT_TRAEFIK_WEB_PORT, DEFAULT_TRAEFIK_WEBSECURE_PORT, TRAEFIK_POD_NAME_LABEL_VALUE, TRAEFIK_WEBSECURE_ENTRYPOINT, } from '../constants.js';
+import { DEFAULT_TRAEFIK_CHART_VERSION, DEFAULT_TRAEFIK_INGRESS_CLASS, DEFAULT_TRAEFIK_METRICS_PORT, DEFAULT_TRAEFIK_TERMINATION_GRACE_SECONDS, DEFAULT_TRAEFIK_NAMESPACE, DEFAULT_TRAEFIK_WEB_PORT, DEFAULT_TRAEFIK_WEBSECURE_PORT, TRAEFIK_METRICS_ENTRYPOINT, TRAEFIK_POD_NAME_LABEL_VALUE, TRAEFIK_WEB_ENTRYPOINT, TRAEFIK_WEBSECURE_ENTRYPOINT, } from '../constants.js';
+import { traefikAccessLogFields } from './access-log.js';
+import { assertTraefikPlugins, traefikLocalPluginMountPath, traefikRawVolumeNames, } from './plugins.js';
+import { assertTraefikProxyTrust, traefikBroadTrustWarnings, traefikStrictTrustedIPs, } from './proxy-trust.js';
 /**
  * Pod-level security context Traefik runs with.
  *
@@ -59,29 +60,26 @@ export const TRAEFIK_SECURITY_PINS = {
     securityContext: TRAEFIK_CONTAINER_SECURITY_CONTEXT,
     global: { checkNewVersion: false, sendAnonymousUsage: false },
 };
-/**
- * Values that hand ownership of the entrypoint Service to TypeKro.
- *
- * The chart would otherwise create the Service itself, and a composition can
- * only project a resource's status if that resource is part of its graph.
- * Observing the chart's Service instead made every fresh direct deployment fail
- * before it started: the direct engine resolves external references BEFORE it
- * applies anything, and a `404` on the not-yet-created Service is fatal.
- *
- * Three pins make the owned Service possible. Two are constants and live here;
- * the third takes the release name, so {@link applyTraefikOwnershipPins} adds
- * it.
- *
- * - `service.enabled: false` — the chart skips its whole Service template.
- * - `nameOverride` — fixes the chart's `app.kubernetes.io/name` pod label.
- * - `instanceLabelOverride` — fixes `app.kubernetes.io/instance`, which the
- *   chart otherwise derives from the Helm release name. `traefikHelmRelease`
- *   pins `spec.releaseName` to the same name, so the two agree; the pin keeps
- *   the selector exact even if a release ever arrives under another name.
- *
- * Together those two labels are exactly the chart's own pod selector, so the
- * owned Service front-ends the same pods the chart's Service would have.
- */
+// The chart would otherwise create the Service itself, and a composition can
+// only project a resource's status if that resource is part of its graph.
+// Observing the chart's Service instead made every fresh direct deployment fail
+// before it started: the direct engine resolves external references BEFORE it
+// applies anything, and a `404` on the not-yet-created Service is fatal.
+//
+// Three pins make the owned Service possible. Two are constants and live here;
+// the third takes the release name, so {@link applyTraefikOwnershipPins} adds
+// it.
+//
+// - `service.enabled: false` — the chart skips its whole Service template.
+// - `nameOverride` — fixes the chart's `app.kubernetes.io/name` pod label.
+// - `instanceLabelOverride` — fixes `app.kubernetes.io/instance`, which the
+//   chart otherwise derives from the Helm release name. `traefikHelmRelease`
+//   pins `spec.releaseName` to the same name, so the two agree; the pin keeps
+//   the selector exact even if a release ever arrives under another name.
+//
+// Together those two labels are exactly the chart's own pod selector, so the
+// owned Service front-ends the same pods the chart's Service would have.
+/** Values that hand ownership of the entrypoint Service to TypeKro. */
 export const TRAEFIK_OWNERSHIP_PINS = {
     service: { enabled: false },
     nameOverride: TRAEFIK_POD_NAME_LABEL_VALUE,
@@ -100,6 +98,10 @@ function isGraphValue(value) {
 function isPlainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+/** A raw-values section as an object, or `{}` when it is absent or not an object. */
+function sectionOf(value) {
+    return isPlainObject(value) && !isGraphValue(value) ? value : {};
+}
 /**
  * Merge `override` onto `base` one level deep.
  *
@@ -167,6 +169,27 @@ export function applyTraefikOwnershipPins(values, instanceLabel) {
 export function traefikEntrypointServiceType(config) {
     return Cel.default(config.service?.type, 'LoadBalancer');
 }
+/**
+ * Load-balancer fields of the owned entrypoint Service, each only when the spec sets it.
+ *
+ * The API server refuses `externalTrafficPolicy` on a ClusterIP Service and an
+ * empty `loadBalancerClass` anywhere. In KRO mode the spec is a proxy, so every
+ * field is emitted and serialization guards it with `omit()`.
+ */
+export function traefikEntrypointServiceLoadBalancer(config) {
+    const service = config.service;
+    return {
+        ...(service?.loadBalancerClass !== undefined && {
+            loadBalancerClass: service.loadBalancerClass,
+        }),
+        ...(service?.externalTrafficPolicy !== undefined && {
+            externalTrafficPolicy: service.externalTrafficPolicy,
+        }),
+        ...(service?.loadBalancerSourceRanges !== undefined && {
+            loadBalancerSourceRanges: service.loadBalancerSourceRanges,
+        }),
+    };
+}
 /**
  * Map the bootstrap runtime spec onto official-chart values.
  *
@@ -192,6 +215,8 @@ export function mapTraefikConfigToHelmValues(config, options = {}) {
     // making direct and KRO deployments disagree.
     const ingressClass = Cel.default(config.ingressClass, DEFAULT_TRAEFIK_INGRESS_CLASS);
     const redirect = options.redirectWebToWebsecure ?? true;
+    // Concrete at build time, so the mapper may ask what it contains.
+    const base = options.baseValues ?? {};
     // OTLP is enabled by the PRESENCE of an endpoint. In KRO mode the endpoint is
     // a schema reference, so the enablement has to be a CEL comparison — a
     // JavaScript truthiness test on a proxy is always true. With a concrete spec
@@ -216,9 +241,29 @@ export function mapTraefikConfigToHelmValues(config, options = {}) {
     const webPort = {
         exposedPort: Cel.default(config.entrypoints?.web?.exposedPort, DEFAULT_TRAEFIK_WEB_PORT),
         expose: { default: true },
+        ...entrypointTrust(config.entrypoints?.web, options.dangerouslyTrustAnySource ?? false),
+        transport: { lifeCycle: entrypointLifecycle(config.entrypoints?.web) },
         ...(redirect
             ? {
+                // The redirect router Traefik generates for an entrypoint redirection
+                // has priority `MaxInt - 1`, so it outranks every other router on
+                // `web` — including the one cert-manager's HTTP-01 solver creates for
+                // `/.well-known/acme-challenge/<token>`. The challenge would then be
+                // answered with a 301 to `websecure`, where no solver route exists.
+                //
+                // `allowACMEByPass` is Traefik's own fix (v3, `pkg/provider/traefik/
+                // internal.go`): the generated redirect rule becomes
+                // ``HostRegexp(`^.+$`) && !PathPrefix(`/.well-known/acme-challenge/`)``,
+                // so ONLY the challenge path falls through to the routers on `web`.
+                //
+                // Lowering the redirect's priority instead would have been wrong: a
+                // router that names no entrypoint attaches to every entrypoint, so a
+                // low-priority redirect would serve every such route over plain HTTP
+                // rather than redirecting it. Excluding the one path keeps everything
+                // else redirected.
+                allowACMEByPass: true,
                 http: {
+                    aliasHeadersStrategy: aliasStrategy(config.entrypoints?.web),
                     redirections: {
                         entryPoint: {
                             to: TRAEFIK_WEBSECURE_ENTRYPOINT,
@@ -228,14 +273,18 @@ export function mapTraefikConfigToHelmValues(config, options = {}) {
                     },
                 },
             }
-            : {}),
+            : { http: { aliasHeadersStrategy: aliasStrategy(config.entrypoints?.web) } }),
     };
     const websecurePort = {
         exposedPort: Cel.default(config.entrypoints?.websecure?.exposedPort, DEFAULT_TRAEFIK_WEBSECURE_PORT),
         expose: { default: true },
+        ...entrypointTrust(config.entrypoints?.websecure, options.dangerouslyTrustAnySource ?? false),
         // TLS lives under `http` in chart 41.5.0 — `ports.websecure.tls` is
         // rejected outright by the chart's values.schema.json.
-        http: { tls: { enabled: true } },
+        http: {
+            tls: { enabled: true },
+            aliasHeadersStrategy: aliasStrategy(config.entrypoints?.websecure),
+        },
         // An edge fronting requests longer than Traefik's 60s default must raise
         // the responding timeouts here as well as the upstream ServersTransport.
         transport: {
@@ -244,6 +293,7 @@ export function mapTraefikConfigToHelmValues(config, options = {}) {
                 writeTimeout: Cel.default(config.entrypoints?.websecure?.writeTimeout, '90s'),
                 idleTimeout: Cel.default(config.entrypoints?.websecure?.idleTimeout, '180s'),
             },
+            lifeCycle: entrypointLifecycle(config.entrypoints?.websecure),
         },
     };
     const mapped = {
@@ -252,7 +302,33 @@ export function mapTraefikConfigToHelmValues(config, options = {}) {
         // Deployment — and of the Service the chart's Ingress `publishedService`
         // path points at, which must match the Service this factory owns.
         fullnameOverride: config.name,
-        deployment: { replicas: Cel.default(config.replicas, 2) },
+        deployment: {
+            replicas: Cel.default(config.replicas, 2),
+            // Covers both entrypoints' default grace (10s accept + 30s drain).
+            terminationGracePeriodSeconds: Cel.default(config.terminationGracePeriodSeconds, sectionOf(base.deployment).terminationGracePeriodSeconds ??
+                DEFAULT_TRAEFIK_TERMINATION_GRACE_SECONDS),
+        },
+        // A PDB by default: without one a node drain can evict every replica at
+        // once. `maxUnavailable: 1` never blocks a drain, even at one replica. A
+        // `podDisruptionBudget` in the raw values owns the section instead, because
+        // merging the two could set `minAvailable` and `maxUnavailable` together,
+        // which the API server rejects.
+        ...(base.podDisruptionBudget === undefined && {
+            podDisruptionBudget: {
+                enabled: Cel.default(config.podDisruptionBudget?.enabled, true),
+                maxUnavailable: Cel.default(config.podDisruptionBudget?.maxUnavailable, 1),
+            },
+        }),
+        // The spec wins, then the raw values, then nothing. Placing a spec field
+        // alone would drop a raw value in KRO mode, where the key is always
+        // emitted and `omit()` removes it when the spec is silent.
+        ...specOverBase('nodeSelector', config.scheduling?.nodeSelector, base),
+        ...specOverBase('tolerations', config.scheduling?.tolerations, base),
+        ...specOverBase('priorityClassName', config.scheduling?.priorityClassName, base),
+        // Raw `topologySpreadConstraints` replace the default spread.
+        ...(base.topologySpreadConstraints === undefined && {
+            topologySpreadConstraints: traefikTopologySpread(config),
+        }),
         ingressClass: {
             enabled: true,
             // Claiming the cluster-default IngressClass would silently capture every
@@ -264,9 +340,18 @@ export function mapTraefikConfigToHelmValues(config, options = {}) {
             kubernetesCRD: {
                 enabled: Cel.default(config.providers?.crd, true),
                 ingressClass,
+                allowEmptyServices: Cel.default(config.providers?.allowEmptyServices, true),
+                allowCrossNamespace: Cel.default(config.providers?.allowCrossNamespace, false),
+                ...(config.providers?.namespaces !== undefined && {
+                    namespaces: config.providers.namespaces,
+                }),
             },
             kubernetesIngress: {
                 enabled: Cel.default(config.providers?.kubernetesIngress, false),
+                allowEmptyServices: Cel.default(config.providers?.allowEmptyServices, true),
+                ...(config.providers?.namespaces !== undefined && {
+                    namespaces: config.providers.namespaces,
+                }),
                 // The chart emits `--providers.kubernetesingress.ingressendpoint.
                 // publishedservice` only when it created the Service itself, or when a
                 // pathOverride names one. This factory owns the Service, so the
@@ -289,8 +374,18 @@ export function mapTraefikConfigToHelmValues(config, options = {}) {
             // Health and metrics traffic on the internal entrypoint would otherwise
             // dominate the access log.
             addInternals: false,
+            fields: traefikAccessLogFields(options.accessLog),
         },
         metrics: {
+            // @security Prometheus is served on the internal `metrics` entrypoint,
+            // which the owned Service never publishes and `ports.metrics` below keeps
+            // unexposed. Other Prometheus settings (labels, the chart's metrics
+            // Service, a ServiceMonitor) are chart surface for the raw values, which
+            // this keeps rather than replaces.
+            prometheus: {
+                ...sectionOf(sectionOf(base.metrics).prometheus),
+                entryPoint: TRAEFIK_METRICS_ENTRYPOINT,
+            },
             otlp: {
                 enabled: otlpEnabled,
                 grpc: { enabled: otlpEnabled, endpoint: otlpEndpoint, insecure: otlpInsecure },
@@ -309,6 +404,11 @@ export function mapTraefikConfigToHelmValues(config, options = {}) {
             // @security The internal entrypoint serves /ping, metrics and the (pinned
             // off) dashboard. It must never be published by the Service.
             traefik: { expose: { default: false } },
+            [TRAEFIK_METRICS_ENTRYPOINT]: {
+                ...sectionOf(sectionOf(base.ports)[TRAEFIK_METRICS_ENTRYPOINT]),
+                port: DEFAULT_TRAEFIK_METRICS_PORT,
+                expose: { default: false },
+            },
         },
         // No `service` section: the entrypoint Service — its type, annotations and
         // published ports — is a resource this factory owns, not a chart value.
@@ -317,8 +417,132 @@ export function mapTraefikConfigToHelmValues(config, options = {}) {
             limits: { cpu: '1', memory: '512Mi' },
         },
     };
+    const experimental = pluginValues(options, base);
+    if (experimental)
+        mapped.experimental = experimental;
     const merged = mergeSections(options.baseValues ?? {}, mapped);
-    return applyTraefikSecurityPins(applyTraefikOwnershipPins(merged, config.name));
+    const pinned = applyTraefikSecurityPins(applyTraefikOwnershipPins(merged, config.name));
+    if (!options.dangerouslyTrustAnySource)
+        assertTraefikProxyTrust(pinned);
+    return pinned;
+}
+/**
+ * The `experimental` plugin section, or `undefined` when no plugin is declared.
+ *
+ * Raw-values plugins are kept beside the typed ones; `validateTraefikHelmValues`
+ * warns about any that carry no hash.
+ */
+function pluginValues(options, base) {
+    const plugins = options.plugins ?? {};
+    const localPlugins = options.localPlugins ?? {};
+    if (Object.keys(plugins).length === 0 && Object.keys(localPlugins).length === 0) {
+        return undefined;
+    }
+    assertTraefikPlugins(plugins, localPlugins, traefikRawVolumeNames(base));
+    const baseExperimental = sectionOf(base.experimental);
+    return {
+        plugins: {
+            ...sectionOf(baseExperimental.plugins),
+            ...Object.fromEntries(Object.entries(plugins).map(([name, { moduleName, version, hash }]) => [
+                name,
+                { moduleName, version, hash },
+            ])),
+        },
+        localPlugins: {
+            ...sectionOf(baseExperimental.localPlugins),
+            ...Object.fromEntries(Object.entries(localPlugins).map(([name, plugin]) => [
+                name,
+                { ...plugin, mountPath: traefikLocalPluginMountPath(plugin.moduleName) },
+            ])),
+        },
+        // A security plugin that silently fails to load leaves its routes
+        // unprotected. Refusing to start keeps the previous replicas serving.
+        abortOnPluginFailure: options.abortOnPluginFailure ?? true,
+    };
+}
+/**
+ * A top-level value from the spec, falling back to the same key in the raw values.
+ *
+ * Emits nothing when the spec is concretely unset and the raw values do not
+ * set the key either.
+ */
+function specOverBase(key, specValue, base) {
+    if (specValue === undefined)
+        return {};
+    const baseValue = base[key];
+    return {
+        [key]: baseValue === undefined
+            ? specValue
+            : Cel.default(specValue, baseValue),
+    };
+}
+/**
+ * What one entrypoint does with headers whose names alias another, `delete`
+ * by default. See `traefikEntrypointAliasShape` in `types.ts`.
+ */
+function aliasStrategy(entrypoint) {
+    return Cel.default(entrypoint?.aliasHeadersStrategy, 'delete');
+}
+/** Shutdown timing of one entrypoint, with the edge defaults. */
+function entrypointLifecycle(entrypoint) {
+    return {
+        requestAcceptGraceTimeout: Cel.default(entrypoint?.requestAcceptGraceTimeout, '10s'),
+        graceTimeOut: Cel.default(entrypoint?.graceTimeOut, '30s'),
+    };
+}
+/**
+ * Soft zone and node spread for the Traefik pods.
+ *
+ * The selector is the chart's own pod selector, which the ownership pins make
+ * exact: `nameOverride` and `instanceLabelOverride` (= `config.name`).
+ */
+function traefikTopologySpread(config) {
+    const labelSelector = {
+        matchLabels: {
+            'app.kubernetes.io/name': TRAEFIK_POD_NAME_LABEL_VALUE,
+            'app.kubernetes.io/instance': config.name,
+        },
+    };
+    // Count skew per ReplicaSet, so a rolling update spreads the new pods
+    // instead of balancing them against the old ones it is about to delete.
+    const matchLabelKeys = ['pod-template-hash'];
+    return [
+        {
+            maxSkew: 1,
+            topologyKey: 'topology.kubernetes.io/zone',
+            whenUnsatisfiable: Cel.default(config.scheduling?.zoneSpread, 'ScheduleAnyway'),
+            labelSelector,
+            matchLabelKeys,
+        },
+        {
+            maxSkew: 1,
+            topologyKey: 'kubernetes.io/hostname',
+            whenUnsatisfiable: Cel.default(config.scheduling?.nodeSpread, 'ScheduleAnyway'),
+            labelSelector,
+            matchLabelKeys,
+        },
+    ];
+}
+/**
+ * The PROXY protocol and forwarded-header trust of one entrypoint.
+ *
+ * A block is emitted only when the spec carries it. In KRO mode the spec is a
+ * schema proxy, so the block is always emitted and its `trustedIPs` reference
+ * is wrapped in `has() ? ... : omit()` by serialization.
+ */
+function entrypointTrust(entrypoint, allowAnySource) {
+    return {
+        ...(entrypoint?.proxyProtocol !== undefined && {
+            proxyProtocol: {
+                trustedIPs: traefikStrictTrustedIPs(entrypoint.proxyProtocol.trustedIPs, allowAnySource),
+            },
+        }),
+        ...(entrypoint?.forwardedHeaders !== undefined && {
+            forwardedHeaders: {
+                trustedIPs: traefikStrictTrustedIPs(entrypoint.forwardedHeaders.trustedIPs, allowAnySource),
+            },
+        }),
+    };
 }
 /**
  * Report configuration that is legal but likely a mistake at an edge.
@@ -357,11 +581,54 @@ export function validateTraefikHelmValues(values, context = {}) {
     if (!values.resources?.requests) {
         warnings.push('No resource requests specified for Traefik. Set CPU and memory requests so the edge is not evicted first under pressure.');
     }
+    // An NLB with PROXY protocol prepends a header to every connection, health
+    // checks included. An entrypoint that does not expect it parses the header
+    // as the start of a TLS handshake or HTTP request and drops the connection.
+    if (context.serviceAnnotations?.['service.beta.kubernetes.io/aws-load-balancer-proxy-protocol'] !==
+        undefined) {
+        for (const name of [TRAEFIK_WEB_ENTRYPOINT, TRAEFIK_WEBSECURE_ENTRYPOINT]) {
+            if (!values.ports?.[name]?.proxyProtocol?.trustedIPs) {
+                warnings.push(`The load balancer sends PROXY protocol headers, but the \`${name}\` entrypoint has no proxyProtocol.trustedIPs. Every connection to it will fail; set entrypoints.${name}.proxyProtocol.trustedIPs to the load balancer's source ranges.`);
+            }
+        }
+    }
+    warnings.push(...traefikBroadTrustWarnings(values));
+    // Kubernetes kills the pod at terminationGracePeriodSeconds, whatever
+    // Traefik is still draining.
+    const terminationGrace = values.deployment?.terminationGracePeriodSeconds;
+    if (typeof terminationGrace === 'number') {
+        for (const [name, port] of Object.entries(values.ports ?? {})) {
+            const lifeCycle = port?.transport?.lifeCycle;
+            const accept = durationSeconds(lifeCycle?.requestAcceptGraceTimeout);
+            const drain = durationSeconds(lifeCycle?.graceTimeOut);
+            if (accept !== undefined && drain !== undefined && accept + drain >= terminationGrace) {
+                warnings.push(`The \`${name}\` entrypoint needs ${accept + drain}s to shut down (requestAcceptGraceTimeout + graceTimeOut), but terminationGracePeriodSeconds is ${terminationGrace}. Kubernetes will kill Traefik before in-flight requests finish.`);
+            }
+        }
+    }
+    for (const [name, plugin] of Object.entries(values.experimental?.plugins ?? {})) {
+        if (isPlainObject(plugin) && typeof plugin.hash !== 'string') {
+            warnings.push(`Traefik plugin ${name} has no hash, so Traefik runs whatever archive the registry serves for its version. Declare it through the plugins build option, which requires one.`);
+        }
+    }
     if (values.ports?.traefik?.expose?.default === true) {
         warnings.push('The internal `traefik` entrypoint is exposed by the Service. It serves /ping and metrics and should stay cluster-internal.');
     }
     return warnings;
 }
+/** Seconds in a concrete Go duration or nanosecond count; `undefined` for a reference. */
+function durationSeconds(value) {
+    if (typeof value === 'number')
+        return value / 1e9;
+    if (typeof value !== 'string' || !/^(\d+(\.\d+)?(ns|us|ms|s|m|h))+$/.test(value))
+        return undefined;
+    const unit = { ns: 1e-9, us: 1e-6, ms: 1e-3, s: 1, m: 60, h: 3600 };
+    let total = 0;
+    for (const [, amount, , suffix] of value.matchAll(/(\d+(\.\d+)?)(ns|us|ms|s|m|h)/g)) {
+        total += Number(amount) * (unit[suffix] ?? 0);
+    }
+    return total;
+}
 /**
  * The chart version this factory is verified against.
  *

package/dist/factories/traefik/utils/helm-values-mapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helm-values-mapper.js","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/helm-values-mapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAYzB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA8B;IACrE,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,KAAK;IACjB,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;CAC3C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAoC;IACjF,wBAAwB,EAAE,KAAK;IAC/B,sBAAsB,EAAE,IAAI;IAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;IACxD,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;IAChF,kBAAkB,EAAE,4BAA4B;IAChD,eAAe,EAAE,kCAAkC;IACnD,MAAM,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE;CAC3B,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3B,YAAY,EAAE,4BAA4B;CACR,CAAC;AA+BrC;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,IAA0B,EAC1B,QAA2B;IAE3B,MAAM,MAAM,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC;YACT,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACxF,CAAC;IACD,OAAO,MAA2B,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAyB;IAChE,OAAO;QACL,GAAG,MAAM;QACT,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC,GAAG,EAAE;QACpD,YAAY,EAAE;YACZ,GAAG,MAAM,CAAC,YAAY;YACtB,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAChE,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE;SACrE;QACD,kBAAkB,EAAE,EAAE,GAAG,MAAM,CAAC,kBAAkB,EAAE,GAAG,4BAA4B,EAAE;QACrF,eAAe,EAAE,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,GAAG,kCAAkC,EAAE;QACrF,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,EACzB,aAAiC;IAEjC,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,sBAAsB,CAAC,OAAO,EAAE;QACjE,YAAY,EAAE,sBAAsB,CAAC,YAAY;QACjD,qBAAqB,EAAE,aAAuB;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAA8B;IACzE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAA8B,EAC9B,UAA0C,EAAE;IAE5C,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,sBAAsB,IAAI,IAAI,CAAC;IAExD,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;IAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,WAAW,GAAY,YAAY,CAAC,aAAa,CAAC;QACtD,CAAC,CAAC,6EAA6E;YAC7E,4EAA4E;YAC5E,mEAAmE;YACnE,GAAG,CAAC,IAAI,CAAU,YAAY,EAAE,QAAQ,CAAC;QAC3C,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAEzE,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,gCAAgC;IAChC,MAAM,OAAO,GAAsB;QACjC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,CAAC;QACxF,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACzB,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC;gBACE,IAAI,EAAE;oBACJ,YAAY,EAAE;wBACZ,UAAU,EAAE;4BACV,EAAE,EAAE,4BAA4B;4BAChC,MAAM,EAAE,OAAO;4BACf,SAAS,EAAE,IAAI;yBAChB;qBACF;iBACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,aAAa,GAAsB;QACvC,WAAW,EAAE,GAAG,CAAC,OAAO,CACtB,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,EAC1C,8BAA8B,CAC/B;QACD,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACzB,oEAAoE;QACpE,uDAAuD;QACvD,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAChC,yEAAyE;QACzE,yEAAyE;QACzE,SAAS,EAAE;YACT,kBAAkB,EAAE;gBAClB,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC;gBAC3E,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC;gBAC7E,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;aAC7E;SACF;KACF,CAAC;IAEF,MAAM,MAAM,GAAsB;QAChC,sEAAsE;QACtE,2EAA2E;QAC3E,yEAAyE;QACzE,kEAAkE;QAClE,gBAAgB,EAAE,MAAM,CAAC,IAAI;QAC7B,UAAU,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE;QACzD,YAAY,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,yEAAyE;YACzE,kEAAkE;YAClE,cAAc,EAAE,KAAK;YACrB,IAAI,EAAE,YAAY;SACnB;QACD,SAAS,EAAE;YACT,aAAa,EAAE;gBACb,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC;gBACjD,YAAY;aACb;YACD,iBAAiB,EAAE;gBACjB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,CAAC;gBAChE,kEAAkE;gBAClE,uEAAuE;gBACvE,gEAAgE;gBAChE,sEAAsE;gBACtE,wEAAwE;gBACxE,uBAAuB;gBACvB,gBAAgB,EAAE;oBAChB,OAAO,EAAE,IAAI;oBACb,YAAY,EAAE,GAAG,CAAC,QAAQ,CACxB,OAAO,EACP,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,yBAAyB,CAAC,EACnF,MAAM,CAAC,IAAI,CACZ;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC;aAC1D;SACF;QACD,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;QACpE,SAAS,EAAE;YACT,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC;YAC7C,MAAM,EAAE,MAAM;YACd,wEAAwE;YACxE,2BAA2B;YAC3B,YAAY,EAAE,KAAK;SACpB;QACD,OAAO,EAAE;YACP,IAAI,EAAE;gBACJ,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;aAC/E;SACF;QACD,OAAO,EAAE;YACP,WAAW,EAAE,eAAe;YAC5B,IAAI,EAAE;gBACJ,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;aAC/E;SACF;QACD,KAAK,EAAE;YACL,GAAG,EAAE,OAAO;YACZ,SAAS,EAAE,aAAa;YACxB,0EAA0E;YAC1E,6DAA6D;YAC7D,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;SACxC;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,SAAS,EAAE;YACT,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;YAC1C,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;SACtC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,wBAAwB,CAAC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAClF,CAAC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,EACzB,UAA8C,EAAE;IAEhD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CACX,yHAAyH,CAC1H,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CACX,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CACX,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CACX,6IAA6I,CAC9I,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CACX,oIAAoI,CACrI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CACX,sMAAsM,CACvM,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,EAAE,QAAQ,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,cAAc,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CACX,8HAA8H,CAC/H,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CACX,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CACX,4HAA4H,CAC7H,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,6BAA6B,CAAC"}
+{"version":3,"file":"helm-values-mapper.js","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/helm-values-mapper.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,iCAAiC;AACjC,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2DAA2D;AAC3D,yEAAyE;AAEzE,OAAO,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,EAC5B,yCAAyC,EACzC,yBAAyB,EACzB,wBAAwB,EACxB,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAgB1B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA8B;IACrE,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,KAAK;IACjB,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;CAC3C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAoC;IACjF,wBAAwB,EAAE,KAAK;IAC/B,sBAAsB,EAAE,IAAI;IAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;IACxD,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;IAChF,kBAAkB,EAAE,4BAA4B;IAChD,eAAe,EAAE,kCAAkC;IACnD,MAAM,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE;CAC3B,CAAC;AAErC,6EAA6E;AAC7E,0EAA0E;AAC1E,gFAAgF;AAChF,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,MAAM;AACN,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3B,YAAY,EAAE,4BAA4B;CACR,CAAC;AA8CrC;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,IAA0B,EAC1B,QAA2B;IAE3B,MAAM,MAAM,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC;YACT,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACxF,CAAC;IACD,OAAO,MAA2B,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAyB;IAChE,OAAO;QACL,GAAG,MAAM;QACT,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC,GAAG,EAAE;QACpD,YAAY,EAAE;YACZ,GAAG,MAAM,CAAC,YAAY;YACtB,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAChE,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE;SACrE;QACD,kBAAkB,EAAE,EAAE,GAAG,MAAM,CAAC,kBAAkB,EAAE,GAAG,4BAA4B,EAAE;QACrF,eAAe,EAAE,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,GAAG,kCAAkC,EAAE;QACrF,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,EACzB,aAAiC;IAEjC,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,sBAAsB,CAAC,OAAO,EAAE;QACjE,YAAY,EAAE,sBAAsB,CAAC,YAAY;QACjD,qBAAqB,EAAE,aAAuB;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAA8B;IACzE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oCAAoC,CAAC,MAA8B;IAKjF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,OAAO;QACL,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,SAAS,IAAI;YAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;SAC7C,CAAC;QACF,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,IAAI;YAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;SACrD,CAAC;QACF,GAAG,CAAC,OAAO,EAAE,wBAAwB,KAAK,SAAS,IAAI;YACrD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;SAC3D,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAA8B,EAC9B,UAA0C,EAAE;IAE5C,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,sBAAsB,IAAI,IAAI,CAAC;IACxD,kEAAkE;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAEtC,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;IAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,WAAW,GAAY,YAAY,CAAC,aAAa,CAAC;QACtD,CAAC,CAAC,6EAA6E;YAC7E,4EAA4E;YAC5E,mEAAmE;YACnE,GAAG,CAAC,IAAI,CAAU,YAAY,EAAE,QAAQ,CAAC;QAC3C,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAEzE,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,gCAAgC;IAChC,MAAM,OAAO,GAAsB;QACjC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,CAAC;QACxF,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACzB,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,yBAAyB,IAAI,KAAK,CAAC;QACvF,SAAS,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE;QACtE,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC;gBACE,sEAAsE;gBACtE,kEAAkE;gBAClE,sEAAsE;gBACtE,qEAAqE;gBACrE,oEAAoE;gBACpE,EAAE;gBACF,qEAAqE;gBACrE,qDAAqD;gBACrD,yEAAyE;gBACzE,oEAAoE;gBACpE,EAAE;gBACF,oEAAoE;gBACpE,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,mBAAmB;gBACnB,eAAe,EAAE,IAAI;gBACrB,IAAI,EAAE;oBACJ,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC;oBAC5D,YAAY,EAAE;wBACZ,UAAU,EAAE;4BACV,EAAE,EAAE,4BAA4B;4BAChC,MAAM,EAAE,OAAO;4BACf,SAAS,EAAE,IAAI;yBAChB;qBACF;iBACF;aACF;YACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;KAChF,CAAC;IAEF,MAAM,aAAa,GAAsB;QACvC,WAAW,EAAE,GAAG,CAAC,OAAO,CACtB,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,EAC1C,8BAA8B,CAC/B;QACD,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACzB,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,yBAAyB,IAAI,KAAK,CAAC;QAC7F,oEAAoE;QACpE,uDAAuD;QACvD,IAAI,EAAE;YACJ,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACtB,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC;SACnE;QACD,yEAAyE;QACzE,yEAAyE;QACzE,SAAS,EAAE;YACT,kBAAkB,EAAE;gBAClB,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC;gBAC3E,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC;gBAC7E,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;aAC7E;YACD,SAAS,EAAE,mBAAmB,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC;SAC9D;KACF,CAAC;IAEF,MAAM,MAAM,GAAsB;QAChC,sEAAsE;QACtE,2EAA2E;QAC3E,yEAAyE;QACzE,kEAAkE;QAClE,gBAAgB,EAAE,MAAM,CAAC,IAAI;QAC7B,UAAU,EAAE;YACV,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzC,mEAAmE;YACnE,6BAA6B,EAAE,GAAG,CAAC,OAAO,CACxC,MAAM,CAAC,6BAA6B,EACnC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,6BAAoD;gBAC9E,yCAAyC,CAC5C;SACF;QACD,wEAAwE;QACxE,yEAAyE;QACzE,4EAA4E;QAC5E,0EAA0E;QAC1E,gCAAgC;QAChC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,IAAI;YAC5C,mBAAmB,EAAE;gBACnB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC;gBAC/D,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,cAAc,EAAE,CAAC,CAAC;aAC3E;SACF,CAAC;QACF,yEAAyE;QACzE,oEAAoE;QACpE,2DAA2D;QAC3D,GAAG,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC;QACtE,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC;QACpE,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,iBAAiB,EAAE,IAAI,CAAC;QAChF,8DAA8D;QAC9D,GAAG,CAAC,IAAI,CAAC,yBAAyB,KAAK,SAAS,IAAI;YAClD,yBAAyB,EAAE,qBAAqB,CAAC,MAAM,CAAC;SACzD,CAAC;QACF,YAAY,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,yEAAyE;YACzE,kEAAkE;YAClE,cAAc,EAAE,KAAK;YACrB,IAAI,EAAE,YAAY;SACnB;QACD,SAAS,EAAE;YACT,aAAa,EAAE;gBACb,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC;gBACjD,YAAY;gBACZ,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,EAAE,IAAI,CAAC;gBAC3E,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,EAAE,KAAK,CAAC;gBAC9E,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,KAAK,SAAS,IAAI;oBAChD,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;iBACxC,CAAC;aACH;YACD,iBAAiB,EAAE;gBACjB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,CAAC;gBAChE,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,EAAE,IAAI,CAAC;gBAC3E,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,KAAK,SAAS,IAAI;oBAChD,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;iBACxC,CAAC;gBACF,kEAAkE;gBAClE,uEAAuE;gBACvE,gEAAgE;gBAChE,sEAAsE;gBACtE,wEAAwE;gBACxE,uBAAuB;gBACvB,gBAAgB,EAAE;oBAChB,OAAO,EAAE,IAAI;oBACb,YAAY,EAAE,GAAG,CAAC,QAAQ,CACxB,OAAO,EACP,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,yBAAyB,CAAC,EACnF,MAAM,CAAC,IAAI,CACZ;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC;aAC1D;SACF;QACD,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;QACpE,SAAS,EAAE;YACT,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC;YAC7C,MAAM,EAAE,MAAM;YACd,wEAAwE;YACxE,2BAA2B;YAC3B,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC;SAClD;QACD,OAAO,EAAE;YACP,uEAAuE;YACvE,0EAA0E;YAC1E,oEAAoE;YACpE,yEAAyE;YACzE,mCAAmC;YACnC,UAAU,EAAE;gBACV,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;gBAChD,UAAU,EAAE,0BAA0B;aACvC;YACD,IAAI,EAAE;gBACJ,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;aAC/E;SACF;QACD,OAAO,EAAE;YACP,WAAW,EAAE,eAAe;YAC5B,IAAI,EAAE;gBACJ,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;aAC/E;SACF;QACD,KAAK,EAAE;YACL,GAAG,EAAE,OAAO;YACZ,SAAS,EAAE,aAAa;YACxB,0EAA0E;YAC1E,6DAA6D;YAC7D,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvC,CAAC,0BAA0B,CAAC,EAAE;gBAC5B,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBAC/D,IAAI,EAAE,4BAA4B;gBAClC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;aAC3B;SACF;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,SAAS,EAAE;YACT,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;YAC1C,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;SACtC;KACF,CAAC;IAEF,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,YAAY;QAAE,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAErD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,wBAAwB,CAAC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,OAAO,CAAC,yBAAyB;QAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,OAAuC,EACvC,IAA0B;IAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrE,IAAI;gBACJ,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE;aAC9B,CAAC,CACH;SACF;QACD,YAAY,EAAE;YACZ,GAAG,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC;YAC3C,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;gBACnD,IAAI;gBACJ,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,2BAA2B,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;aACzE,CAAC,CACH;SACF;QACD,kEAAkE;QAClE,sEAAsE;QACtE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,IAAI;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,GAAyD,EACzD,SAAkD,EAClD,IAA0B;IAE1B,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAgC,CAAC;IAC3D,OAAO;QACL,CAAC,GAAG,CAAC,EACH,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,GAAG,CAAC,OAAO,CAAS,SAAmB,EAAE,SAAmB,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CACpB,UAAqE;IAErE,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,iEAAiE;AACjE,SAAS,mBAAmB,CAC1B,UAAqE;IAErE,OAAO;QACL,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,yBAAyB,EAAE,KAAK,CAAC;QACpF,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,MAA8B;IAC3D,MAAM,aAAa,GAAG;QACpB,WAAW,EAAE;YACX,wBAAwB,EAAE,4BAA4B;YACtD,4BAA4B,EAAE,MAAM,CAAC,IAAI;SAC1C;KACF,CAAC;IACF,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,cAAc,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7C,OAAO;QACL;YACE,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,6BAA6B;YAC1C,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,gBAAgB,CAAC;YAC/E,aAAa;YACb,cAAc;SACf;QACD;YACE,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,wBAAwB;YACrC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,gBAAgB,CAAC;YAC/E,aAAa;YACb,cAAc;SACf;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACtB,UAAqE,EACrE,cAAuB;IAEvB,OAAO;QACL,GAAG,CAAC,UAAU,EAAE,aAAa,KAAK,SAAS,IAAI;YAC7C,aAAa,EAAE;gBACb,UAAU,EAAE,uBAAuB,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC;aACzF;SACF,CAAC;QACF,GAAG,CAAC,UAAU,EAAE,gBAAgB,KAAK,SAAS,IAAI;YAChD,gBAAgB,EAAE;gBAChB,UAAU,EAAE,uBAAuB,CAAC,UAAU,CAAC,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC;aAC5F;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,EACzB,UAA8C,EAAE;IAEhD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CACX,yHAAyH,CAC1H,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CACX,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CACX,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CACX,6IAA6I,CAC9I,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CACX,oIAAoI,CACrI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CACX,sMAAsM,CACvM,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,EAAE,QAAQ,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,cAAc,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CACX,8HAA8H,CAC/H,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CACX,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,IACE,OAAO,CAAC,kBAAkB,EAAE,CAAC,6DAA6D,CAAC;QAC3F,SAAS,EACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;gBACrD,QAAQ,CAAC,IAAI,CACX,6DAA6D,IAAI,oGAAoG,IAAI,iEAAiE,CAC3O,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,sEAAsE;IACtE,6BAA6B;IAC7B,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,6BAA6B,CAAC;IAC1E,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC;YAC7C,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YACvD,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,GAAG,KAAK,IAAI,gBAAgB,EAAE,CAAC;gBACtF,QAAQ,CAAC,IAAI,CACX,SAAS,IAAI,uBAAuB,MAAM,GAAG,KAAK,mGAAmG,gBAAgB,kEAAkE,CACxO,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAChF,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CACX,kBAAkB,IAAI,sJAAsJ,CAC7K,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CACX,4HAA4H,CAC7H,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,GAAG,GAAG,CAAC;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC9E,OAAO,SAAS,CAAC;IACnB,MAAM,IAAI,GAA2B,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,AAAD,EAAG,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;QACpF,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,6BAA6B,CAAC"}