@namzu/sandbox 12.0.1 → 14.0.0

package/dist/backends/kubernetes/egress-policy.js

@@ -0,0 +1,314 @@
+/**
+ * Egress policy translation for the Kubernetes backend, and the
+ * verify-not-trust check that stops a misconfigured cluster from silently
+ * running unenforced.
+ *
+ * Mirrors two existing shapes rather than inventing a third:
+ *
+ *  - `../firecracker/index.ts`'s `resolveNetworkPolicy` — a pure(ish) mapping
+ *    from the shared {@link EgressPolicy} union to what one specific
+ *    enforcement point can actually carry, with an exhaustive switch that
+ *    refuses an unknown kind instead of defaulting to open.
+ *  - `../docker/index.ts`'s `assertNetworkCarriesThePolicy` — the refusal
+ *    discipline. That function does not trust a docker network's NAME to
+ *    mean "internal"; it inspects the daemon's own `{{.Internal}}` flag. The
+ *    same principle drives {@link verifyEgressPolicyApplied} here: this
+ *    backend does not trust that an operator applied the right
+ *    `NetworkPolicy` because a name matches — it GETs the live object and
+ *    compares its shape.
+ *
+ * ## What core `NetworkPolicy` can and cannot express
+ *
+ * Core Kubernetes `NetworkPolicy` has exactly three ways to name a
+ * destination: `ipBlock` (CIDR), `podSelector` and `namespaceSelector`. There
+ * is no hostname or FQDN concept anywhere in the resource. So of the four
+ * {@link EgressPolicy} kinds:
+ *
+ *  - `deny-all` and `allow-all` are fully expressible — neither needs a
+ *    hostname.
+ *  - `static` and `resolver` are hostname allowlists and are NOT expressible
+ *    under core `NetworkPolicy` at all. {@link assertEgressPolicyIsEnforceable}
+ *    throws a named error for both, rather than silently downgrading to an
+ *    `HTTP_PROXY`/`HTTPS_PROXY` environment variable the way the container
+ *    tier's open allowlist gap does (`#398`) — a workload that ignores a
+ *    proxy variable bypasses it entirely, and repeating that mistake behind a
+ *    Kubernetes-shaped manifest would not fix it.
+ *
+ * `KubernetesEgressConfig.engine: 'cilium'` is the one escape hatch, and it
+ * is opt-in: a cluster that actually runs Cilium can express a hostname
+ * allowlist as a `CiliumNetworkPolicy` with `toFQDNs`, so declaring the
+ * engine turns the refusal into an emission. No other engine is supported in
+ * this batch — Calico's `HostEndpoint`/`GlobalNetworkPolicy` and any other
+ * FQDN-capable CNI would need their own translation, added as their own
+ * `engine` value with their own resource shape, not folded into this one by
+ * guessing.
+ *
+ * ## Why a NetworkPolicy always allows the cluster's own DNS
+ *
+ * agent-sandbox's OWN managed `NetworkPolicy`
+ * (`SandboxTemplateSpec.networkPolicy` /
+ * `networkPolicyManagement: Managed`, the CRD's default) already leaves the
+ * cluster's own name service reachable — the upstream reference deployment
+ * (kubernetes-sigs/agent-sandbox `examples/kata-aks/sandboxtemplate.yaml`)
+ * ships exactly "ingress from the router only, egress limited to DNS (53)
+ * and TCP/443". {@link CLUSTER_DNS_EGRESS_RULE} matches that convention
+ * (CoreDNS/kube-dns lives in the `kube-system` namespace on every cluster
+ * this was checked against) rather than inventing a different one.
+ *
+ * This is not a case of one policy overriding another: the Kubernetes API
+ * server UNIONS every `NetworkPolicy` selecting a pod — traffic is allowed if
+ * ANY matching policy's rule allows it, never the intersection — so this
+ * rule does not need to duplicate the managed policy to avoid "fighting" it
+ * in the sense of narrowing anything. It exists so THIS backend's own
+ * translated policy is self-sufficient: on a cluster where an operator left
+ * `networkPolicyManagement: Unmanaged`, or copied the managed shape
+ * imperfectly, `deny-all` still means "the cluster's own name service,
+ * nothing else" instead of a pod that cannot even resolve
+ * `kubernetes.default`.
+ *
+ * ## Never a proxy environment variable
+ *
+ * No code path in this module emits `HTTP_PROXY`, `HTTPS_PROXY` or any other
+ * proxy variable, and none of the module's own string constants contain
+ * those substrings either — a dedicated test scans both. Proxy variables are
+ * advisory: a process that does not read them is not bounded by them. The
+ * boundary here is the `NetworkPolicy` object itself, enforced by the CNI in
+ * the kernel, not by the workload's cooperation.
+ */
+import { isDeepStrictEqual } from 'node:util';
+import { KubernetesAlreadyGoneError } from './k8s-client.js';
+import { CILIUM_NETWORK_POLICY_API_GROUP, CILIUM_NETWORK_POLICY_API_VERSION, CORE_NETWORK_POLICY_API_GROUP, CORE_NETWORK_POLICY_API_VERSION, ciliumNetworkPolicyPath, networkPolicyPath, sandboxTemplateLabel, } from './objects.js';
+/** `${sandboxTemplateName}-egress`, the name {@link KubernetesEgressConfig.networkPolicyName} defaults to. */
+export function defaultEgressPolicyName(sandboxTemplateName) {
+    return `${sandboxTemplateName}-egress`;
+}
+/**
+ * Named refusal for a hostname allowlist with no FQDN-capable engine
+ * declared. Thrown SYNCHRONOUSLY from `buildKubernetesBackend` — see
+ * {@link assertEgressPolicyIsEnforceable} — so a misconfiguration surfaces
+ * during host wiring, the same moment `assertRuntimeClassIsApplicable` and
+ * the readiness-bounds validation do, rather than on the first `create()`.
+ */
+export class KubernetesUnenforceableEgressPolicyError extends Error {
+    policyKind;
+    name = 'KubernetesUnenforceableEgressPolicyError';
+    constructor(policyKind) {
+        super(`The kubernetes sandbox backend cannot enforce an egress policy of kind '${policyKind}' as a NetworkPolicy: core Kubernetes NetworkPolicy has only ipBlock, podSelector and namespaceSelector — it has no hostname/FQDN concept at all. This cluster needs an FQDN-capable policy engine: set config.egress.engine to 'cilium' if the target cluster actually runs it (see docs/sdk/kubernetes-sandbox.md's egress section), or configure an egress policy of 'deny-all' or 'allow-all' instead. Refusing rather than silently downgrading to an HTTP_PROXY/HTTPS_PROXY environment variable an uncooperative process can ignore.`);
+        this.policyKind = policyKind;
+    }
+}
+/**
+ * Synchronous, no-I/O precondition: can `policy.kind` be enforced under
+ * `engine` at all. Deliberately decided from the KIND alone — a `resolver`
+ * policy's `resolve()` is never invoked here, both because calling it just to
+ * prove a refusal would be wasted work (and possibly a side effect the host
+ * did not expect yet) and because this has to stay callable synchronously
+ * from `buildKubernetesBackend`, which contacts nothing.
+ */
+export function assertEgressPolicyIsEnforceable(policy, engine) {
+    if ((policy.kind === 'static' || policy.kind === 'resolver') && engine !== 'cilium') {
+        throw new KubernetesUnenforceableEgressPolicyError(policy.kind);
+    }
+}
+/**
+ * The cluster DNS egress rule every translated `NetworkPolicy` carries,
+ * including on `deny-all`. See the module doc's "Why a NetworkPolicy always
+ * allows the cluster's own DNS" section.
+ */
+const CLUSTER_DNS_EGRESS_RULE = {
+    to: [{ namespaceSelector: { matchLabels: { 'kubernetes.io/metadata.name': 'kube-system' } } }],
+    ports: [
+        { protocol: 'UDP', port: 53 },
+        { protocol: 'TCP', port: 53 },
+    ],
+};
+/**
+ * Cilium requires DNS lookups to be explicitly allowed AND made visible to
+ * the agent before `toFQDNs` enforcement can match anything a name resolves
+ * to: without a preceding rule granting DNS and turning on visibility, the
+ * sandbox's own lookups for the allowed hosts are invisible to Cilium's
+ * FQDN-to-IP mapping and `toFQDNs` matches nothing, which would make a
+ * `static`/`resolver` policy fail closed for every host rather than only the
+ * disallowed ones.
+ *
+ * Shape verified against Cilium's own worked example — the `toFQDNs`
+ * `CiliumNetworkPolicy` at https://docs.cilium.io/en/stable/security/dns/
+ * (the "DNS Based" policy walkthrough) allows egress to `kube-dns` on port 53
+ * with `rules.dns: [{ matchPattern: "*" }]` alongside its own `toFQDNs` rule
+ * — this constant reproduces that DNS-allow rule verbatim, including the
+ * `k8s:` label-source prefix on both `toEndpoints` selector keys (an
+ * unprefixed key defaults to label source `any`, a superset that would still
+ * match, but `any` is not what the cited example uses).
+ */
+const CILIUM_DNS_VISIBILITY_RULE = {
+    toEndpoints: [
+        {
+            matchLabels: {
+                'k8s:io.kubernetes.pod.namespace': 'kube-system',
+                'k8s:k8s-app': 'kube-dns',
+            },
+        },
+    ],
+    toPorts: [
+        {
+            ports: [{ port: '53', protocol: 'ANY' }],
+            rules: { dns: [{ matchPattern: '*' }] },
+        },
+    ],
+};
+function buildCoreNetworkPolicy(target, egress) {
+    return {
+        kind: 'NetworkPolicy',
+        namespace: target.namespace,
+        name: target.name,
+        manifest: {
+            apiVersion: `${CORE_NETWORK_POLICY_API_GROUP}/${CORE_NETWORK_POLICY_API_VERSION}`,
+            kind: 'NetworkPolicy',
+            metadata: { name: target.name, namespace: target.namespace },
+            spec: {
+                podSelector: { matchLabels: sandboxTemplateLabel(target.sandboxTemplateName) },
+                policyTypes: ['Egress'],
+                egress,
+            },
+        },
+    };
+}
+function buildCiliumNetworkPolicy(target, allowedHosts) {
+    return {
+        kind: 'CiliumNetworkPolicy',
+        namespace: target.namespace,
+        name: target.name,
+        manifest: {
+            apiVersion: `${CILIUM_NETWORK_POLICY_API_GROUP}/${CILIUM_NETWORK_POLICY_API_VERSION}`,
+            kind: 'CiliumNetworkPolicy',
+            metadata: { name: target.name, namespace: target.namespace },
+            spec: {
+                endpointSelector: { matchLabels: sandboxTemplateLabel(target.sandboxTemplateName) },
+                egress: [
+                    CILIUM_DNS_VISIBILITY_RULE,
+                    { toFQDNs: allowedHosts.map((host) => ({ matchName: host })) },
+                ],
+            },
+        },
+    };
+}
+/**
+ * The pure translation: an {@link EgressPolicy} plus the declared
+ * {@link KubernetesEgressEngine} in, the concrete manifest this backend can
+ * ask an operator to apply out. Async only because `resolver` carries an
+ * async `resolve()` — `deny-all`, `allow-all` and `static` never await
+ * anything.
+ *
+ * `resolver` is resolved ONCE here (at whatever call site first needs the
+ * manifest — `buildKubernetesBackend`'s first `create()`, in practice), not
+ * once per `create()` the way the docker and Firecracker backends re-resolve
+ * a PER-SANDBOX `resolver` policy on every call. That is a deliberate
+ * difference, not a shortcut: the enforcement point here is one
+ * `NetworkPolicy`/`CiliumNetworkPolicy` object shared by every sandbox this
+ * backend produces, so there is exactly one manifest to compare the resolved
+ * hosts against, and re-resolving on every `create()` would only produce a
+ * value nothing downstream re-applies to the cluster.
+ */
+export async function translateEgressPolicy(policy, engine, target) {
+    assertEgressPolicyIsEnforceable(policy, engine);
+    switch (policy.kind) {
+        case 'deny-all':
+            return buildCoreNetworkPolicy(target, [CLUSTER_DNS_EGRESS_RULE]);
+        case 'allow-all':
+            // No `to`/`ports` on an egress rule matches every destination and
+            // every port. `CLUSTER_DNS_EGRESS_RULE` is a strict subset of this,
+            // so it is folded in rather than listed twice.
+            return buildCoreNetworkPolicy(target, [{}]);
+        case 'static':
+            // `assertEgressPolicyIsEnforceable` already threw above unless
+            // `engine === 'cilium'`, so reaching here means it did not.
+            return buildCiliumNetworkPolicy(target, policy.allowedHosts);
+        case 'resolver': {
+            const allowedHosts = await policy.resolve();
+            return buildCiliumNetworkPolicy(target, allowedHosts);
+        }
+        default: {
+            const exhaustive = policy;
+            throw new Error(`kubernetes: unhandled egress policy kind ${JSON.stringify(exhaustive)}. Refusing rather than defaulting to unrestricted network access.`);
+        }
+    }
+}
+/**
+ * Raised by {@link verifyEgressPolicyApplied} when the named object does not
+ * exist at all. This backend never CREATES the policy itself — like the
+ * docker backend's network, the boundary is operator-applied so it gets
+ * reviewed outside the hot create path, by whoever has cluster-admin rather
+ * than by whatever created the ServiceAccount token this backend runs with.
+ */
+export class KubernetesEgressPolicyNotAppliedError extends Error {
+    resourceKind;
+    path;
+    name = 'KubernetesEgressPolicyNotAppliedError';
+    constructor(resourceKind, path) {
+        super(`kubernetes: config.egress is set but no ${resourceKind} exists at ${path}. This backend never creates the egress policy itself — apply the manifest it computed (see docs/sdk/kubernetes-sandbox.md's egress section) before creating a sandbox with an egress policy configured. Refusing rather than creating a sandbox with no enforced network boundary.`);
+        this.resourceKind = resourceKind;
+        this.path = path;
+    }
+}
+/** Raised when the applied object exists but does not match the translation. */
+export class KubernetesEgressPolicyMismatchError extends Error {
+    resourceKind;
+    path;
+    reason;
+    name = 'KubernetesEgressPolicyMismatchError';
+    constructor(resourceKind, path, reason) {
+        super(`kubernetes: the ${resourceKind} at ${path} does not match the egress policy config.egress computed: ${reason}. Re-apply the manifest this backend translated rather than hand-editing the cluster object — a policy that has drifted from config silently changes what a sandbox can reach without config saying so.`);
+        this.resourceKind = resourceKind;
+        this.path = path;
+        this.reason = reason;
+    }
+}
+/**
+ * Verify-not-trust: GET the object {@link translateEgressPolicy} named and
+ * assert its shape actually matches, rather than trusting that an object
+ * with the right name does what config says. Mirrors
+ * `../docker/index.ts`'s `assertNetworkCarriesThePolicy`, which inspects the
+ * daemon's own `{{.Internal}}` flag instead of trusting a network's name.
+ *
+ * Checks exactly three things, each named separately in a mismatch so an
+ * operator sees which one to fix:
+ *  - the selector (`podSelector` for `NetworkPolicy`, `endpointSelector` for
+ *    `CiliumNetworkPolicy`) carries the expected template label:
+ *  - `NetworkPolicy` additionally declares `policyTypes` including
+ *    `'Egress'` — a `NetworkPolicy` with an `egress` array but no `'Egress'`
+ *    in `policyTypes` enforces nothing on egress at all;
+ *  - the `egress` rule array matches the translation exactly.
+ *
+ * Never mutates and never creates — a 404/410 is refused, not repaired.
+ */
+export async function verifyEgressPolicyApplied(client, translated, signal) {
+    const path = translated.kind === 'CiliumNetworkPolicy'
+        ? ciliumNetworkPolicyPath(translated.namespace, translated.name)
+        : networkPolicyPath(translated.namespace, translated.name);
+    let resource;
+    try {
+        resource = await client.request('GET', path, undefined, signal);
+    }
+    catch (err) {
+        if (err instanceof KubernetesAlreadyGoneError) {
+            throw new KubernetesEgressPolicyNotAppliedError(translated.kind, path);
+        }
+        throw err;
+    }
+    const expectedSpec = translated.manifest.spec;
+    const actualSpec = resource?.spec ?? {};
+    const selectorKey = translated.kind === 'CiliumNetworkPolicy' ? 'endpointSelector' : 'podSelector';
+    if (!isDeepStrictEqual(actualSpec[selectorKey], expectedSpec[selectorKey])) {
+        throw new KubernetesEgressPolicyMismatchError(translated.kind, path, `spec.${selectorKey} is ${JSON.stringify(actualSpec[selectorKey])}, expected ${JSON.stringify(expectedSpec[selectorKey])} — the label every Sandbox this backend creates carries`);
+    }
+    if (translated.kind === 'NetworkPolicy') {
+        const policyTypes = actualSpec.policyTypes;
+        if (!Array.isArray(policyTypes) || !policyTypes.includes('Egress')) {
+            throw new KubernetesEgressPolicyMismatchError(translated.kind, path, `spec.policyTypes is ${JSON.stringify(policyTypes)}, expected an array containing 'Egress' — without it, spec.egress enforces nothing`);
+        }
+    }
+    if (!isDeepStrictEqual(actualSpec.egress, expectedSpec.egress)) {
+        throw new KubernetesEgressPolicyMismatchError(translated.kind, path, `spec.egress is ${JSON.stringify(actualSpec.egress)}, expected ${JSON.stringify(expectedSpec.egress)}`);
+    }
+}
+//# sourceMappingURL=egress-policy.js.map

package/dist/backends/kubernetes/egress-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-policy.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/egress-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,OAAO,EAAE,0BAA0B,EAAyB,MAAM,iBAAiB,CAAA;AACnF,OAAO,EACN,+BAA+B,EAC/B,iCAAiC,EACjC,6BAA6B,EAC7B,+BAA+B,EAC/B,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,GACpB,MAAM,cAAc,CAAA;AAgErB,8GAA8G;AAC9G,MAAM,UAAU,uBAAuB,CAAC,mBAA2B;IAClE,OAAO,GAAG,mBAAmB,SAAS,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wCAAyC,SAAQ,KAAK;IAG7C;IAFH,IAAI,GAAG,0CAA0C,CAAA;IAEnE,YAAqB,UAAiC;QACrD,KAAK,CACJ,2EAA2E,UAAU,6gBAA6gB,CAClmB,CAAA;QAHmB,eAAU,GAAV,UAAU,CAAuB;IAItD,CAAC;CACD;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC9C,MAAoB,EACpB,MAA8B;IAE9B,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrF,MAAM,IAAI,wCAAwC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAG;IAC/B,EAAE,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,6BAA6B,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAC9F,KAAK,EAAE;QACN,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QAC7B,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;KAC7B;CACQ,CAAA;AAEV;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,0BAA0B,GAAG;IAClC,WAAW,EAAE;QACZ;YACC,WAAW,EAAE;gBACZ,iCAAiC,EAAE,aAAa;gBAChD,aAAa,EAAE,UAAU;aACzB;SACD;KACD;IACD,OAAO,EAAE;QACR;YACC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACxC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;SACvC;KACD;CACQ,CAAA;AAEV,SAAS,sBAAsB,CAC9B,MAA0B,EAC1B,MAAoD;IAEpD,OAAO;QACN,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE;YACT,UAAU,EAAE,GAAG,6BAA6B,IAAI,+BAA+B,EAAE;YACjF,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;YAC5D,IAAI,EAAE;gBACL,WAAW,EAAE,EAAE,WAAW,EAAE,oBAAoB,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE;gBAC9E,WAAW,EAAE,CAAC,QAAQ,CAAC;gBACvB,MAAM;aACN;SACD;KACD,CAAA;AACF,CAAC;AAED,SAAS,wBAAwB,CAChC,MAA0B,EAC1B,YAA+B;IAE/B,OAAO;QACN,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE;YACT,UAAU,EAAE,GAAG,+BAA+B,IAAI,iCAAiC,EAAE;YACrF,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;YAC5D,IAAI,EAAE;gBACL,gBAAgB,EAAE,EAAE,WAAW,EAAE,oBAAoB,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE;gBACnF,MAAM,EAAE;oBACP,0BAA0B;oBAC1B,EAAE,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;iBAC9D;aACD;SACD;KACD,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,MAAoB,EACpB,MAA8B,EAC9B,MAA0B;IAE1B,+BAA+B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,UAAU;YACd,OAAO,sBAAsB,CAAC,MAAM,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAA;QACjE,KAAK,WAAW;YACf,kEAAkE;YAClE,oEAAoE;YACpE,+CAA+C;YAC/C,OAAO,sBAAsB,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5C,KAAK,QAAQ;YACZ,+DAA+D;YAC/D,4DAA4D;YAC5D,OAAO,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;QAC7D,KAAK,UAAU,CAAC,CAAC,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;YAC3C,OAAO,wBAAwB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QACtD,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,UAAU,GAAU,MAAM,CAAA;YAChC,MAAM,IAAI,KAAK,CACd,4CAA4C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,mEAAmE,CACzI,CAAA;QACF,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,qCAAsC,SAAQ,KAAK;IAIrD;IACA;IAJQ,IAAI,GAAG,uCAAuC,CAAA;IAEhE,YACU,YAAqD,EACrD,IAAY;QAErB,KAAK,CACJ,2CAA2C,YAAY,cAAc,IAAI,qRAAqR,CAC9V,CAAA;QALQ,iBAAY,GAAZ,YAAY,CAAyC;QACrD,SAAI,GAAJ,IAAI,CAAQ;IAKtB,CAAC;CACD;AAED,gFAAgF;AAChF,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IAInD;IACA;IACA;IALQ,IAAI,GAAG,qCAAqC,CAAA;IAE9D,YACU,YAAqD,EACrD,IAAY,EACZ,MAAc;QAEvB,KAAK,CACJ,mBAAmB,YAAY,OAAO,IAAI,6DAA6D,MAAM,yMAAyM,CACtT,CAAA;QANQ,iBAAY,GAAZ,YAAY,CAAyC;QACrD,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;IAKxB,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,MAAwB,EACxB,UAA4C,EAC5C,MAAoB;IAEpB,MAAM,IAAI,GACT,UAAU,CAAC,IAAI,KAAK,qBAAqB;QACxC,CAAC,CAAC,uBAAuB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC;QAChE,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;IAE5D,IAAI,QAA2E,CAAA;IAC/E,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;YAC/C,MAAM,IAAI,qCAAqC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACvE,CAAC;QACD,MAAM,GAAG,CAAA;IACV,CAAC;IAED,MAAM,YAAY,GAAI,UAAU,CAAC,QAAuD,CAAC,IAAI,CAAA;IAC7F,MAAM,UAAU,GAAG,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAA;IACvC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAA;IAElG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,mCAAmC,CAC5C,UAAU,CAAC,IAAI,EACf,IAAI,EACJ,QAAQ,WAAW,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,yDAAyD,CACjL,CAAA;IACF,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAA;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,mCAAmC,CAC5C,UAAU,CAAC,IAAI,EACf,IAAI,EACJ,uBAAuB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,oFAAoF,CACtI,CAAA;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,mCAAmC,CAC5C,UAAU,CAAC,IAAI,EACf,IAAI,EACJ,kBAAkB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CACtG,CAAA;IACF,CAAC;AACF,CAAC"}