@intentius/chant-k8s-client 0.31.0

package/dist/client.d.ts

@@ -0,0 +1,122 @@
+/**
+ * The chant Kubernetes API client — chant #1074.
+ *
+ * ## What is rented and what is chant's
+ *
+ * `@kubernetes/client-node` supplies transport and authentication: kubeconfig
+ * parsing and merging, client certificates, bearer tokens, exec credential
+ * plugins with expiry-aware caching, in-cluster service-account credentials,
+ * TLS (CA bundles, `insecure-skip-tls-verify`, `tls-server-name`), HTTP and
+ * SOCKS proxies, and impersonation. That work is done, maintained, and
+ * security-sensitive; reimplementing it buys nothing.
+ *
+ * Chant supplies the rest: resource resolution through the cluster's own
+ * discovery (rather than a table someone has to keep extending), bounded
+ * concurrency, typed failures, an exec-plugin allowlist, and credential
+ * provenance.
+ *
+ * ## Raw objects, not deserialized models
+ *
+ * The library also ships `KubernetesObjectApi`, which does path construction
+ * and discovery. It is not used, for one reason: it runs every response
+ * through `ObjectSerializer`, which coerces known kinds into generated model
+ * classes — dropping fields the model does not declare and turning timestamps
+ * into `Date`s — while passing CRDs through raw. An observation path must not
+ * behave differently for a Deployment and a RayCluster, and `managedFields`
+ * (the epic's whole point, chant #1076) is exactly the sort of field a model
+ * coercion loses. So requests are issued against the library's `RequestContext`
+ * and the JSON is used as it arrived.
+ *
+ * ## The one seam
+ *
+ * `requestLayer` replaces the library's HTTP send and nothing else. Everything
+ * above it — kubeconfig parsing, context selection, URL construction, the auth
+ * path that writes the `Authorization` header — runs for real, which is what
+ * makes a test that injects one worth writing.
+ */
+import type { ApiResourceInfo, ClientProvenance, K8sClientOptions, K8sObject, ObjectRef, ResourceSelector } from "./types.js";
+type ClientNode = typeof import("@kubernetes/client-node");
+/**
+ * Load `@kubernetes/client-node`, once per process.
+ *
+ * Deliberately a function, not a module-level `await import`: this package is
+ * an optional dependency reached only from chant's read/write paths, and
+ * resolving it at module load would defeat that. Nothing here touches the
+ * filesystem at module init either (chant #1081).
+ */
+export declare function loadClientNode(): Promise<ClientNode>;
+/** True when `@kubernetes/client-node` can be loaded in this install. */
+export declare function isK8sClientAvailable(): Promise<boolean>;
+/**
+ * The kubeconfig's own current-context, without building a client.
+ *
+ * This is what the environment→cluster binding compares against (chant #1100):
+ * "the ambient context" is a property of the kubeconfig, and reading it should
+ * not require the kubeconfig to also resolve to a usable cluster — a binding
+ * pointing at a valid context has to survive a broken current-context, which is
+ * exactly the situation the binding exists to fix. Returns undefined when no
+ * kubeconfig can be read at all.
+ */
+export declare function readAmbientContext(options?: Pick<K8sClientOptions, "kubeconfig" | "kubeconfigPath">): Promise<string | undefined>;
+/** Options for a single object read. */
+export interface ReadOptions {
+    signal?: AbortSignal;
+}
+/** Options for {@link K8sClient.apply}. */
+export interface ApplyOptions {
+    /** Field manager recorded on the objects this apply owns. Default `chant`. */
+    fieldManager?: string;
+    /**
+     * Take ownership of fields another manager owns instead of failing with a
+     * 409. Default false — chant #1075 is where the conflict surface proper
+     * lives; here a conflict simply arrives as a typed {@link K8sApiError}.
+     */
+    force?: boolean;
+    /** Server-side dry run — validates and returns the result, persists nothing. */
+    dryRun?: boolean;
+    signal?: AbortSignal;
+}
+/** The client surface the k8s lexicon consumes. */
+export interface K8sClient {
+    /** Where this client is pointed and what authorized it. */
+    readonly provenance: ClientProvenance;
+    /** Namespace the resolved context defaults to. */
+    readonly defaultNamespace: string;
+    /**
+     * Resolve a selector against the cluster's API discovery. Returns undefined
+     * when discovery answered and reported no such resource — which means no
+     * instance of it can exist.
+     */
+    resolve(selector: ResourceSelector, signal?: AbortSignal): Promise<ApiResourceInfo | undefined>;
+    /** GET one object. Throws {@link K8sApiError} with `notFound` when absent. */
+    read(ref: ObjectRef, options?: ReadOptions): Promise<K8sObject>;
+    /** GET one object, returning undefined instead of throwing on a 404. */
+    readIfPresent(ref: ObjectRef, options?: ReadOptions): Promise<K8sObject | undefined>;
+    /** LIST a kind, optionally namespaced. Follows `continue` tokens. */
+    list(selector: ResourceSelector, options?: {
+        namespace?: string;
+        signal?: AbortSignal;
+    }): Promise<K8sObject[]>;
+    /** Server-side apply one object. Creates it when absent. */
+    apply(object: K8sObject, options?: ApplyOptions): Promise<K8sObject>;
+    /** Run `fn` over `items` with this client's concurrency ceiling. */
+    concurrently<T, R>(items: readonly T[], fn: (item: T, index: number) => Promise<R>): Promise<R[]>;
+    /** The API resource lists discovery has been asked for so far, for tests and diagnostics. */
+    discoveryCacheKeys(): string[];
+}
+/**
+ * Build a client. Nothing is read from the network here — the kubeconfig is
+ * parsed, the context resolved, and the credential policy enforced, all before
+ * the first request, so a refusal happens before any exec plugin runs.
+ */
+export declare function createK8sClient(options?: K8sClientOptions): Promise<K8sClient>;
+/** `v1` → `/api/v1`; `apps/v1` → `/apis/apps/v1`. */
+export declare function apiVersionPath(apiVersion: string): string;
+/** `apps/v1` → `["apps", "v1"]`; `v1` → `["", "v1"]`. */
+export declare function splitApiVersion(apiVersion: string): [group: string, version: string];
+/** Human phrasing of a selector, for error messages. */
+export declare function selectorText(selector: ResourceSelector): string;
+/** Human phrasing of an object reference, for error messages. */
+export declare function refText(ref: ObjectRef): string;
+export {};
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAYH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,SAAS,EAET,gBAAgB,EAEjB,MAAM,SAAS,CAAC;AAEjB,KAAK,UAAU,GAAG,cAAc,yBAAyB,CAAC,CAAC;AAI3D;;;;;;;GAOG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,CAQ1D;AAED,yEAAyE;AACzE,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO7D;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,gBAAgB,CAAM,GACpE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW7B;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,kDAAkD;IAClD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAChG,8EAA8E;IAC9E,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChE,wEAAwE;IACxE,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACrF,qEAAqE;IACrE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/G,4DAA4D;IAC5D,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,oEAAoE;IACpE,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,6FAA6F;IAC7F,kBAAkB,IAAI,MAAM,EAAE,CAAC;CAChC;AAcD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC,CA8WxF;AAED,qDAAqD;AACrD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAGpF;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAM/D;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAE9C"}

package/dist/concurrency.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Bounded concurrency — chant #1074's "a 100-entity project is not 100 serial
+ * spawns" criterion.
+ *
+ * Unbounded is not the answer either: firing 400 requests at an API server in
+ * one tick gets the client throttled (429) or the apiserver's priority-and-
+ * fairness queue drops it, and both look like read failures rather than what
+ * they are. A small fixed window is what `kubectl` itself uses for parallel
+ * gets.
+ */
+/** Default in-flight request ceiling. */
+export declare const DEFAULT_CONCURRENCY = 8;
+/**
+ * Map `items` through `fn` with at most `limit` running at once, preserving
+ * input order in the result. Never rejects: `fn`'s own rejections are the
+ * caller's to model (the observation path turns each into a per-entity
+ * verdict), so `fn` is expected to resolve with a discriminated outcome.
+ */
+export declare function mapConcurrent<T, R>(items: readonly T[], fn: (item: T, index: number) => Promise<R>, limit?: number): Promise<R[]>;
+//# sourceMappingURL=concurrency.d.ts.map

package/dist/concurrency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.d.ts","sourceRoot":"","sources":["../src/concurrency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yCAAyC;AACzC,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,CAAC,EACtC,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAC1C,KAAK,GAAE,MAA4B,GAClC,OAAO,CAAC,CAAC,EAAE,CAAC,CAed"}

package/dist/credentials.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Credential policy — chant #1074's managed-cluster half.
+ *
+ * On EKS, AKS and GKE, kubeconfig authentication is an **exec credential
+ * plugin**: `aws eks get-token`, `kubelogin`, `gke-gcloud-auth-plugin`. So on
+ * the clusters most people actually run, a "native" client still spawns a
+ * process — once per token instead of once per resource read. That is still
+ * the win the issue is after, but it is worth stating rather than implying,
+ * because an exec plugin runs an arbitrary binary named in a file chant did
+ * not write.
+ *
+ * Three things are chant's to decide, and they live here:
+ *
+ * 1. **Allowlist.** The plugin's command must be on a list, not merely present
+ *    in the kubeconfig. The default covers the three managed providers.
+ * 2. **Caching.** `@kubernetes/client-node`'s `ExecAuth` caches a credential
+ *    until its `expirationTimestamp`, keyed by kubeconfig user. The client
+ *    builds one `KubeConfig` per session and reuses it for every request, so a
+ *    200-entity observation invokes `aws eks get-token` once rather than 200
+ *    times. That is a property of not rebuilding the config, so it is asserted
+ *    in this package's tests rather than reimplemented here.
+ * 3. **Provenance.** Which credential path authorized a read is recorded on
+ *    the client and travels with the observation.
+ */
+import type { CredentialPath } from "./types.js";
+/**
+ * Exec credential plugins chant will execute without being asked twice.
+ *
+ * The three managed-Kubernetes providers plus `kubectl`, which is what
+ * `kubectl config set-credentials --exec-command` writes for OIDC setups that
+ * shell back through the binary the user already trusts. Anything else has to
+ * be named explicitly in `k8s.execCredentialPlugins`.
+ */
+export declare const DEFAULT_EXEC_ALLOWLIST: readonly string[];
+/** The exec stanza of a kubeconfig user, as far as this module cares. */
+export interface ExecConfig {
+    command?: string;
+    args?: string[];
+    env?: Array<{
+        name: string;
+        value: string;
+    }>;
+}
+/** The kubeconfig user fields this module reads. */
+export interface KubeConfigUser {
+    name?: string;
+    exec?: ExecConfig;
+    authProvider?: {
+        name?: string;
+        config?: {
+            exec?: ExecConfig;
+        };
+    };
+    token?: string;
+    certData?: string;
+    certFile?: string;
+    username?: string;
+    password?: string;
+}
+/**
+ * The exec stanza this user authenticates with, if any. `authProvider` can
+ * carry one too — client-node's `ExecAuth.isAuthProvider` accepts both shapes,
+ * so the gate has to look in both places or it is trivially bypassed.
+ */
+export declare function execConfigOf(user: KubeConfigUser | null | undefined): ExecConfig | undefined;
+/**
+ * Reduce a plugin command to the name that is allowlisted: `aws` for `aws`,
+ * for `/usr/local/bin/aws`, and for `C:\\tools\\aws.exe`. Matching the bare
+ * name rather than the full path is deliberate — the path varies per machine,
+ * and pinning it would make the allowlist unusable — but it does mean the
+ * allowlist expresses "which tool", not "which file".
+ */
+export declare function execCommandName(command: string): string;
+/**
+ * Throw unless the user's exec plugin (if it has one) is allowlisted. Called
+ * before the client issues its first request, so a refusal happens before any
+ * binary runs — the check is worthless if it fires after the spawn.
+ */
+export declare function assertExecCredentialAllowed(user: KubeConfigUser | null | undefined, allowlist?: readonly string[]): void;
+/** Which credential path a kubeconfig user represents, for provenance. */
+export declare function credentialPathOf(user: KubeConfigUser | null | undefined): {
+    credential: CredentialPath;
+    execCommand?: string;
+};
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAMnD,CAAC;AAEF,yEAAyE;AACzE,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9C;AAED,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,UAAU,CAAA;SAAE,CAAA;KAAE,CAAC;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAM5F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACvC,SAAS,GAAE,SAAS,MAAM,EAA2B,GACpD,IAAI,CAMN;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GAAG;IACzE,UAAU,EAAE,cAAc,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAQA"}

package/dist/errors.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Typed failures — chant #1074.
+ *
+ * The kubectl path this client replaces reported failures as a non-zero exit
+ * plus a line of English on stderr, which every caller then had to pattern
+ * match (`classifyKubectlFailure` in core is that pattern matcher). The API
+ * server already sends a machine-readable `Status` object with a numeric code
+ * and a `reason` enum; these errors carry it through instead of re-deriving it
+ * from prose.
+ */
+/** The `Status` object a Kubernetes API server returns on a failed request. */
+export interface K8sStatus {
+    kind?: string;
+    apiVersion?: string;
+    status?: string;
+    message?: string;
+    /** e.g. "NotFound", "Forbidden", "Unauthorized", "Conflict", "AlreadyExists". */
+    reason?: string;
+    code?: number;
+    details?: unknown;
+}
+/**
+ * The API server answered, and the answer was a failure. `statusCode` and
+ * `reason` come from the response, not from parsing text.
+ */
+export declare class K8sApiError extends Error {
+    readonly statusCode: number;
+    readonly reason: string | undefined;
+    readonly apiMessage: string;
+    /** What was being addressed, e.g. `apps/v1 Deployment prod/web`. */
+    readonly target?: string | undefined;
+    readonly status?: K8sStatus | undefined;
+    constructor(statusCode: number, reason: string | undefined, apiMessage: string, 
+    /** What was being addressed, e.g. `apps/v1 Deployment prod/web`. */
+    target?: string | undefined, status?: K8sStatus | undefined);
+    /** The object is not there. The only failure that establishes absence. */
+    get notFound(): boolean;
+    /** RBAC denied the read. Proves nothing about whether the object exists. */
+    get forbidden(): boolean;
+    /** No usable credentials for this cluster. */
+    get unauthorized(): boolean;
+    /** Server-side-apply field-ownership conflict (chant #1075 surfaces these properly). */
+    get conflict(): boolean;
+    /**
+     * Build from a raw response body, which is a `Status` on every well-behaved
+     * Kubernetes error and occasionally plain text from a proxy in front of one.
+     */
+    static fromResponse(statusCode: number, body: string, target?: string): K8sApiError;
+}
+/**
+ * The request never reached an API server — DNS, TCP, TLS, proxy, or an
+ * aborted signal. Distinct from {@link K8sApiError} because "I could not
+ * connect" and "the server said no" are different observations.
+ */
+export declare class K8sTransportError extends Error {
+    readonly target?: string | undefined;
+    constructor(message: string, target?: string | undefined, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * `@kubernetes/client-node` is not installed. It is an ordinary dependency of
+ * this package, so this only happens when the package tree was pruned
+ * (`npm install --omit=optional`, a slimmed container image). Named separately
+ * so the k8s lexicon can tell a missing dependency from a broken cluster.
+ */
+export declare class K8sClientUnavailableError extends Error {
+    constructor(cause?: unknown);
+}
+/**
+ * The kubeconfig names an exec credential plugin that is not on the allowlist.
+ *
+ * An exec plugin is an arbitrary binary named in a file chant did not write,
+ * run with the CLI's privileges. EKS/AKS/GKE all need one, so refusing them
+ * outright would make this client useless on managed clusters — but executing
+ * whatever the file names is not a default worth having either.
+ */
+export declare class ExecCredentialNotAllowedError extends Error {
+    readonly command: string;
+    readonly allowed: readonly string[];
+    constructor(command: string, allowed: readonly string[]);
+}
+/** The kubeconfig could not be read, or names no usable cluster/context. */
+export declare class KubeConfigError extends Error {
+    constructor(message: string);
+}
+/**
+ * The cluster's own discovery does not serve this kind. Distinct from a 404 on
+ * an instance: no instance of an unserved kind can exist, which is a real
+ * absence rather than an unread hole.
+ */
+export declare class UnknownResourceError extends Error {
+    readonly selectorText: string;
+    constructor(selectorText: string, message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAElB,UAAU,EAAE,MAAM;aAClB,MAAM,EAAE,MAAM,GAAG,SAAS;aAC1B,UAAU,EAAE,MAAM;IAClC,oEAAoE;aACpD,MAAM,CAAC,EAAE,MAAM;aACf,MAAM,CAAC,EAAE,SAAS;gBALlB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,UAAU,EAAE,MAAM;IAClC,oEAAoE;IACpD,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,MAAM,CAAC,EAAE,SAAS,YAAA;IASpC,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,4EAA4E;IAC5E,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,8CAA8C;IAC9C,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED,wFAAwF;IACxF,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW;CAapF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,MAAM,CAAC,EAAE,MAAM;gBAD/B,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA,EAC/B,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAMhC;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,KAAK,CAAC,EAAE,OAAO;CAS5B;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;aAEpC,OAAO,EAAE,MAAM;aACf,OAAO,EAAE,SAAS,MAAM,EAAE;gBAD1B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS,MAAM,EAAE;CAU7C;AAED,4EAA4E;AAC5E,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAE3B,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM,EACpC,OAAO,CAAC,EAAE,MAAM;CAKnB"}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `@intentius/chant-k8s-client` — the typed Kubernetes API client behind the
+ * k8s lexicon's read and write paths (chant #1074, epic #1073).
+ *
+ * It is a package rather than a directory inside the lexicon for one reason:
+ * this is the first chant code that holds live cluster credentials, and the
+ * synthesis-purity boundary around it should be structural rather than a lint
+ * rule. `chant build` cannot resolve this package, because nothing on the
+ * build path imports it — the lexicon reaches it through a dynamic import from
+ * modules that are themselves only loaded by the observation and Op paths, and
+ * `examples/k8s-client-boundary.test.ts` walks the static import graph to prove
+ * it stays that way.
+ */
+export { createK8sClient, readAmbientContext, loadClientNode, isK8sClientAvailable, apiVersionPath, splitApiVersion, selectorText, refText, } from "./client.js";
+export type { K8sClient, ReadOptions, ApplyOptions } from "./client.js";
+export { K8sApiError, K8sTransportError, K8sClientUnavailableError, ExecCredentialNotAllowedError, KubeConfigError, UnknownResourceError, } from "./errors.js";
+export type { K8sStatus } from "./errors.js";
+export { DEFAULT_EXEC_ALLOWLIST, assertExecCredentialAllowed, credentialPathOf, execConfigOf, execCommandName, } from "./credentials.js";
+export type { ExecConfig, KubeConfigUser } from "./credentials.js";
+export { mapConcurrent, DEFAULT_CONCURRENCY } from "./concurrency.js";
+export type { ApiResourceInfo, ClientProvenance, CredentialPath, K8sClientOptions, K8sObject, ObjectRef, RequestContextLike, RequestLayer, ResourceSelector, ResponseContextLike, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,OAAO,GACR,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAErE,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,eAAe,EACf,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,gBAAgB,EAChB,YAAY,EACZ,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEnE,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,SAAS,CAAC"}

package/dist/testing.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Test doubles for the one seam this package exposes.
+ *
+ * A fake here replaces `@kubernetes/client-node`'s HTTP send and nothing
+ * above it: the handler receives the real, fully built request — the URL the
+ * client constructed from discovery, the method, and the headers the
+ * kubeconfig's auth path wrote, `Authorization` included. So a test that uses
+ * it still exercises kubeconfig parsing, context selection, credential policy,
+ * discovery and path construction for real.
+ *
+ * It exists in the shipped package rather than in a test helper because both
+ * this package's tests and the k8s lexicon's tests need it, and because a
+ * consumer wiring chant into their own harness needs the same thing.
+ */
+import type { RequestLayer } from "./types.js";
+/** What a {@link FakeRequestHandler} sees. */
+export interface RecordedRequest {
+    method: string;
+    /** Full URL including query string. */
+    url: string;
+    /** Path only, query stripped. */
+    path: string;
+    query: Record<string, string>;
+    headers: Record<string, string>;
+    body: unknown;
+}
+/** What a handler returns. `body` is stringified when it is not already a string. */
+export interface FakeResponse {
+    status?: number;
+    body?: unknown;
+    headers?: Record<string, string>;
+}
+export type FakeRequestHandler = (request: RecordedRequest) => FakeResponse | Promise<FakeResponse>;
+/** A recording {@link RequestLayer} driven by `handler`. */
+export interface FakeRequestLayer extends RequestLayer {
+    /** Every request the client issued, in order. */
+    readonly requests: RecordedRequest[];
+    /** Paths only, in order — the usual assertion target. */
+    paths(): string[];
+}
+/**
+ * Build a fake request layer. Anything the handler does not answer 200s with
+ * an empty object, so a test only has to describe the responses it cares about.
+ */
+export declare function fakeRequestLayer(handler: FakeRequestHandler): FakeRequestLayer;
+/** A Kubernetes `Status` failure body, for driving typed-error assertions. */
+export declare function statusBody(code: number, reason: string, message: string): Record<string, unknown>;
+/** Options for {@link fakeKubeconfig}. */
+export interface FakeKubeconfigOptions {
+    contexts?: Array<{
+        name: string;
+        cluster?: string;
+        user?: string;
+        namespace?: string;
+    }>;
+    currentContext?: string;
+    server?: string;
+    /** Static bearer token. Mutually exclusive with `exec` in practice. */
+    token?: string;
+    /** An exec credential plugin stanza, for allowlist and caching tests. */
+    exec?: {
+        command: string;
+        args?: string[];
+        env?: Array<{
+            name: string;
+            value: string;
+        }>;
+    };
+}
+/**
+ * A literal kubeconfig, so no test ever reads the developer's real one. Every
+ * test in this repo that builds a client passes one of these.
+ */
+export declare function fakeKubeconfig(options?: FakeKubeconfigOptions): string;
+/** An `APIResourceList` body, the discovery response the client resolves against. */
+export declare function apiResourceList(groupVersion: string, resources: Array<{
+    name: string;
+    kind: string;
+    namespaced?: boolean;
+    singularName?: string;
+    shortNames?: string[];
+    verbs?: string[];
+}>): Record<string, unknown>;
+//# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAsB,YAAY,EAAuB,MAAM,SAAS,CAAC;AAErF,8CAA8C;AAC9C,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,OAAO,CAAC;CACf;AAED,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,eAAe,KAAK,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;AAEpG,4DAA4D;AAC5D,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;IACrC,yDAAyD;IACzD,KAAK,IAAI,MAAM,EAAE,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,GAAG,gBAAgB,CA8B9E;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUjG;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CAC3F;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,qBAA0B,GAAG,MAAM,CAkD1E;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,KAAK,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC,GACD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAczB"}

package/dist/types.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Public data shapes for the chant Kubernetes API client (chant #1074).
+ *
+ * Everything here is plain data: no class, nothing imported from
+ * `@kubernetes/client-node`, nothing imported from chant core. The lexicon
+ * that consumes this package must be able to name these types without pulling
+ * either dependency onto the build path.
+ */
+/** A live Kubernetes object, as the API server returned it. */
+export interface K8sObject {
+    apiVersion?: string;
+    kind?: string;
+    metadata?: {
+        name?: string;
+        namespace?: string;
+        uid?: string;
+        resourceVersion?: string;
+        generation?: number;
+        creationTimestamp?: string;
+        labels?: Record<string, string>;
+        annotations?: Record<string, string>;
+        ownerReferences?: Array<Record<string, unknown>>;
+        managedFields?: Array<Record<string, unknown>>;
+        [k: string]: unknown;
+    };
+    status?: Record<string, unknown>;
+    [k: string]: unknown;
+}
+/** Addresses one object. `namespace` is ignored for cluster-scoped kinds. */
+export interface ObjectRef {
+    apiVersion: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+}
+/**
+ * How to find a resource in the cluster's discovery.
+ *
+ * - By GVK — what `describeResources` uses, because the generated operation
+ *   surface gives it an exact `apiVersion` + `kind`.
+ * - By kubectl-style resource string — what `waitForReady` uses, because its
+ *   activity contract has always taken `kind` in the form `kubectl get`
+ *   accepts (`certificates`, `raycluster.ray.io`, `Deployment`).
+ */
+export type ResourceSelector = {
+    apiVersion: string;
+    kind: string;
+} | {
+    resource: string;
+    group?: string;
+};
+/** One entry of an `APIResourceList`, as the cluster reports it. */
+export interface ApiResourceInfo {
+    /** Plural path segment, e.g. `deployments`. */
+    name: string;
+    singularName?: string;
+    kind: string;
+    namespaced: boolean;
+    verbs: readonly string[];
+    shortNames?: readonly string[];
+    /** `""` for the core group. */
+    group: string;
+    version: string;
+    /** `v1` or `apps/v1` — what goes in a manifest. */
+    apiVersion: string;
+}
+/** Which credential path the client is authenticating with. */
+export type CredentialPath = "exec-plugin" | "auth-provider" | "token" | "client-certificate" | "basic-auth" | "in-cluster" | "none";
+/**
+ * Where an observation's credentials came from, recorded so the provenance of
+ * a read is legible (chant #1074's managed-cluster note). A read authorized by
+ * `aws eks get-token` and a read authorized by a static service-account token
+ * are not equally trustworthy inputs to a drift report.
+ */
+export interface ClientProvenance {
+    /** API server URL. */
+    server: string;
+    /** kubectl context the client resolved to. */
+    context?: string;
+    /** Where the context came from — a declared binding or the ambient default. */
+    contextSource: "bound" | "ambient";
+    credential: CredentialPath;
+    /** The exec plugin's command, when `credential` is `exec-plugin`. */
+    execCommand?: string;
+    /** Where the kubeconfig itself came from. */
+    kubeconfigSource: "explicit-string" | "explicit-path" | "default" | "in-cluster";
+}
+/** Options for {@link import("./client.js").createK8sClient}. */
+export interface K8sClientOptions {
+    /**
+     * Literal kubeconfig YAML. Wins over every other source — which is how
+     * tests avoid reading the developer's real `~/.kube/config`.
+     */
+    kubeconfig?: string;
+    /** Path to a kubeconfig file. Wins over the ambient default. */
+    kubeconfigPath?: string;
+    /**
+     * Context to use, from `k8s.profiles.<env>.context` (chant #1100/#1155).
+     * Omitted means the kubeconfig's own current-context.
+     */
+    context?: string;
+    /**
+     * Exec credential-plugin commands this client may execute. Defaults to
+     * {@link import("./credentials.js").DEFAULT_EXEC_ALLOWLIST}.
+     */
+    execAllowlist?: readonly string[];
+    /**
+     * Replaces `@kubernetes/client-node`'s HTTP send. This is the package's only
+     * seam onto the network: URL construction, kubeconfig parsing, auth header
+     * application and response handling all still run for real above it. Tests
+     * pass one; production does not.
+     */
+    requestLayer?: RequestLayer;
+    /** Max concurrent in-flight requests. Default 8. */
+    concurrency?: number;
+    /** Where the context came from, for provenance. Default `ambient`. */
+    contextSource?: "bound" | "ambient";
+}
+/**
+ * `@kubernetes/client-node`'s promise-shaped HTTP library: it receives the
+ * library's own `RequestContext` (fully built URL, method, headers including
+ * whatever the auth path put there) and returns its own `ResponseContext`.
+ *
+ * Typed structurally rather than against the library's classes so this module
+ * stays free of `@kubernetes/client-node` imports; `client.ts` checks the real
+ * shapes where it matters.
+ */
+export interface RequestLayer {
+    send(request: RequestContextLike): Promise<ResponseContextLike> | ResponseContextLike;
+}
+/** The subset of client-node's `RequestContext` this package and its tests read. */
+export interface RequestContextLike {
+    getUrl(): string;
+    getHttpMethod(): string;
+    getHeaders(): Record<string, string>;
+    getBody(): unknown;
+}
+/** The subset of client-node's `ResponseContext` this package produces and consumes. */
+export interface ResponseContextLike {
+    httpStatusCode: number;
+    headers: Record<string, string>;
+    body: {
+        text(): Promise<string>;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,eAAe,GACf,OAAO,GACP,oBAAoB,GACpB,YAAY,GACZ,YAAY,GACZ,MAAM,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,UAAU,EAAE,cAAc,CAAC;IAC3B,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,gBAAgB,EAAE,iBAAiB,GAAG,eAAe,GAAG,SAAS,GAAG,YAAY,CAAC;CAClF;AAED,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;CACvF;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,MAAM,IAAI,MAAM,CAAC;IACjB,aAAa,IAAI,MAAM,CAAC;IACxB,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,OAAO,CAAC;CACpB;AAED,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE;QAAE,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC;CACnC"}