@namzu/sandbox 12.0.1 → 14.0.0

package/dist/backends/kubernetes/lease.js

@@ -0,0 +1,151 @@
+/**
+ * Lease renewal for an acquired kubernetes sandbox.
+ *
+ * Acquire stamps an ABSOLUTE `shutdownTime` (now + `claimTtlSeconds`) plus
+ * `shutdownPolicy: Delete` onto every object it creates. That is the leak
+ * guard: a host that dies mid-run costs the cluster one expiry rather than a
+ * sandbox that lives forever. It is also, unrenewed, a deadline on the RUN —
+ * a session that outlives the TTL has its pod deleted underneath it, mid
+ * command, with no error the host can attribute to anything.
+ *
+ * The two requirements are not in tension, they just need a second half:
+ * a live handle renews its own lease, and a dead host stops renewing. So
+ * this timer is owned by the Sandbox handle, and `destroy()` stops it.
+ *
+ * ## The shape of the timer
+ *
+ * One `setTimeout` chained per tick, never `setInterval`: a renewal PATCH
+ * that takes longer than the interval must not queue a second one behind
+ * it. The interval is HALF the TTL, so a single failed tick still leaves a
+ * whole half-TTL of headroom for the next one to succeed, and it is
+ * jittered ±10% so a hundred handles acquired in the same second do not
+ * PATCH the API server in the same millisecond forever after.
+ *
+ * The timer is `unref`'d: a host process that has finished its work should
+ * exit, not linger because a sandbox handle is still counting. A handle
+ * nobody destroyed then expires on the cluster's clock exactly as an
+ * abandoned one does, which is the behaviour the TTL exists for.
+ *
+ * ## Every tick is bounded
+ *
+ * A renewal that FAILS is survivable — it is reported and retried with half
+ * a TTL of headroom. A renewal that HANGS is not: the next tick is scheduled
+ * only after the current one settles, so a PATCH that never answers parks
+ * the loop forever, reports nothing, and lets the lease expire in silence —
+ * precisely the defect this file exists to close, moved onto the failure
+ * path. An API server that accepts a connection and then never responds is
+ * an ordinary cluster event, so each PATCH runs under its own deadline: it
+ * aborts the request through the signal the client already takes, and an
+ * expiry is then just another reported failure that retries on the next
+ * tick.
+ *
+ * ## What each outcome means
+ *
+ *  - Success → the object's expiry moves a full TTL into the future.
+ *  - Any error, a tick that ran out of time included → reported to
+ *    `onRenewalError` and RETRIED on the next tick. A transient API blip
+ *    must not tear down a working sandbox, and there is still half a TTL of
+ *    headroom.
+ *  - Already gone (404/410) → the object this handle owns no longer exists.
+ *    Nothing will bring it back, so the loop stops and the handle is marked
+ *    gone; every later call fails with a named error instead of dialing an
+ *    address whose pod the controller has already deleted.
+ */
+import { OperationDeadline } from '../readiness.js';
+import { KubernetesAlreadyGoneError } from './k8s-client.js';
+/**
+ * The ceiling on one renewal PATCH. A write to the API server that has not
+ * answered in half a minute is not going to; at the one-hour default TTL the
+ * derived quarter-interval would otherwise be 7.5 minutes of silence.
+ */
+const MAX_RENEWAL_TIMEOUT_MS = 30_000;
+/** ±10%: enough to spread a synchronised fleet, far too little to matter
+ * against a half-TTL of headroom. */
+const JITTER_FRACTION = 0.1;
+export function jitteredInterval(baseMs, random) {
+    const factor = 1 - JITTER_FRACTION + random() * (2 * JITTER_FRACTION);
+    // Never zero, whatever a caller passes: a zero-delay chain would spin.
+    return Math.max(1, Math.round(baseMs * factor));
+}
+/**
+ * The renewal loop. Start it when the handle is handed out, stop it on
+ * `destroy()`. Both are idempotent.
+ */
+export class KubernetesLeaseRenewal {
+    options;
+    timer;
+    stopped = false;
+    started = false;
+    baseIntervalMs;
+    patchTimeoutMs;
+    random;
+    constructor(options) {
+        this.options = options;
+        this.baseIntervalMs = options.intervalMs ?? Math.max(1, (options.ttlSeconds * 1_000) / 2);
+        this.patchTimeoutMs =
+            options.patchTimeoutMs ??
+                Math.max(1, Math.min(MAX_RENEWAL_TIMEOUT_MS, Math.round(this.baseIntervalMs / 4)));
+        this.random = options.random ?? Math.random;
+    }
+    /**
+     * The loop is alive: it has been started and not stopped. Deliberately
+     * NOT "a timer is pending" — `tick()` clears the timer before it awaits,
+     * so a liveness check written that way reads false for the whole duration
+     * of an in-flight renewal and would quietly pass against a loop that had
+     * parked forever inside one.
+     */
+    get active() {
+        return !this.stopped && this.started;
+    }
+    start() {
+        if (this.stopped || this.timer !== undefined)
+            return;
+        this.started = true;
+        this.schedule();
+    }
+    stop() {
+        this.stopped = true;
+        if (this.timer !== undefined) {
+            clearTimeout(this.timer);
+            this.timer = undefined;
+        }
+    }
+    schedule() {
+        if (this.stopped)
+            return;
+        const timer = setTimeout(() => {
+            void this.tick();
+        }, jitteredInterval(this.baseIntervalMs, this.random));
+        // A pending renewal must never be the reason a host process stays up.
+        timer.unref?.();
+        this.timer = timer;
+    }
+    /** Exposed for tests: one renewal attempt plus its scheduling decision. */
+    async tick() {
+        this.timer = undefined;
+        if (this.stopped)
+            return;
+        const shutdownTime = new Date(Date.now() + this.options.ttlSeconds * 1_000).toISOString();
+        try {
+            // On its own clock: the next tick is scheduled only once this one
+            // settles, so an unbounded PATCH that never answers would park the
+            // loop permanently and let the lease expire with nothing reported.
+            // The deadline aborts the request and hands the expiry to the same
+            // report-and-retry path every other failure takes.
+            await new OperationDeadline(this.patchTimeoutMs, 'kubernetes lease renewal').run(async (signal) => await this.options.renew(shutdownTime, signal));
+        }
+        catch (error) {
+            if (error instanceof KubernetesAlreadyGoneError) {
+                this.stop();
+                this.options.onGone();
+                return;
+            }
+            // Everything else is transient until proven otherwise: report it
+            // and try again on the next tick, which is still half a TTL
+            // before anything expires.
+            this.options.onRenewalError?.(error);
+        }
+        this.schedule();
+    }
+}
+//# sourceMappingURL=lease.js.map

package/dist/backends/kubernetes/lease.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAwC5D;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAA;AAErC;qCACqC;AACrC,MAAM,eAAe,GAAG,GAAG,CAAA;AAE3B,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAoB;IACpE,MAAM,MAAM,GAAG,CAAC,GAAG,eAAe,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,CAAA;IACrE,uEAAuE;IACvE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAA;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IAQL;IAPrB,KAAK,CAA2C;IAChD,OAAO,GAAG,KAAK,CAAA;IACf,OAAO,GAAG,KAAK,CAAA;IACN,cAAc,CAAQ;IACtB,cAAc,CAAQ;IACtB,MAAM,CAAc;IAErC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACxD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QACzF,IAAI,CAAC,cAAc;YAClB,OAAO,CAAC,cAAc;gBACtB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACnF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,IAAI,MAAM;QACT,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAA;IACrC,CAAC;IAED,KAAK;QACJ,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAM;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,QAAQ,EAAE,CAAA;IAChB,CAAC;IAED,IAAI;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACxB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;QACvB,CAAC;IACF,CAAC;IAEO,QAAQ;QACf,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QACxB,MAAM,KAAK,GAAG,UAAU,CACvB,GAAG,EAAE;YACJ,KAAK,IAAI,CAAC,IAAI,EAAE,CAAA;QACjB,CAAC,EACD,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAClD,CAAA;QACD,sEAAsE;QACtE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QACf,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACnB,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;QACtB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QACxB,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QACzF,IAAI,CAAC;YACJ,kEAAkE;YAClE,mEAAmE;YACnE,mEAAmE;YACnE,mEAAmE;YACnE,mDAAmD;YACnD,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAC/E,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAChE,CAAA;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,EAAE,CAAA;gBACX,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;gBACrB,OAAM;YACP,CAAC;YACD,iEAAiE;YACjE,4DAA4D;YAC5D,2BAA2B;YAC3B,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAA;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAA;IAChB,CAAC;CACD"}

package/dist/backends/kubernetes/objects.d.ts

@@ -0,0 +1,282 @@
+/**
+ * Wire shapes and paths for the agent-sandbox CRDs this backend touches.
+ *
+ * Every field name here was read off the CRDs a real cluster serves —
+ * `kubectl get crd -o json` against agent-sandbox v1.0.2 on a kind cluster —
+ * and cross-checked against the upstream `sandbox_types.go` /
+ * `sandboxclaim_types.go` doc comments. Where the two disagree the served CRD
+ * wins, because it is what the API server validates against: the Go source on
+ * upstream main has already moved `Sandbox`'s `shutdownTime` /
+ * `shutdownPolicy` under a `lifecycle` block, and v1beta1 as served still
+ * carries them at the top of `spec`.
+ *
+ * The shapes are deliberately partial. This backend reads four fields out of a
+ * Sandbox status and writes three into a claim spec; typing the rest of a
+ * PodSpec would be a vendored copy of the core API that goes stale on its own
+ * schedule. A pod template read from a SandboxTemplate is carried through as
+ * an opaque record for exactly that reason — it is copied, never interpreted.
+ *
+ * Two groups, both `v1beta1` and both singular-versioned today:
+ *   - `agents.x-k8s.io`            → sandboxes
+ *   - `extensions.agents.x-k8s.io` → sandboxtemplates, sandboxwarmpools,
+ *                                    sandboxclaims
+ */
+/** Group serving the `Sandbox` kind. */
+export declare const SANDBOX_API_GROUP = "agents.x-k8s.io";
+/** Group serving `SandboxTemplate`, `SandboxWarmPool` and `SandboxClaim`. */
+export declare const SANDBOX_EXTENSIONS_API_GROUP = "extensions.agents.x-k8s.io";
+/** The only version either group serves in agent-sandbox v1.0.2. */
+export declare const SANDBOX_API_VERSION = "v1beta1";
+/** `status.conditions[].type` both kinds report readiness under. */
+export declare const READY_CONDITION = "Ready";
+export interface KubernetesObjectMeta {
+    readonly name?: string;
+    readonly namespace?: string;
+    readonly uid?: string;
+    /**
+     * Set the moment a DELETE is accepted, long before the object goes away.
+     * A pod that carries one is on its way out and must never be bound to —
+     * see {@link isPodLive}.
+     */
+    readonly deletionTimestamp?: string;
+    readonly labels?: Readonly<Record<string, string>>;
+    readonly annotations?: Readonly<Record<string, string>>;
+}
+/** `metav1.Condition`, as both CRDs embed it. */
+export interface KubernetesCondition {
+    readonly type: string;
+    readonly status: 'True' | 'False' | 'Unknown';
+    readonly reason?: string;
+    readonly message?: string;
+    readonly lastTransitionTime?: string;
+}
+/**
+ * True only for an explicit `status: 'True'`. An absent condition, an
+ * `Unknown` and a `False` are all "not yet", never "assume so" — the
+ * controller writes `Unknown` while it is still deciding.
+ */
+export declare function isConditionTrue(conditions: readonly KubernetesCondition[] | undefined, type: string): boolean;
+/**
+ * `SandboxClaim.spec.lifecycle`.
+ *
+ * `shutdownTime` is the only one of the three that bounds a claim whose owner
+ * disappeared: the controller deletes the claim's resources once the wall
+ * clock reaches it, whatever the claim is doing. `ttlSecondsAfterFinished`
+ * reads like the leak guard and is not one — upstream's own comment says "the
+ * timer starts from the mirrored Finished condition's LastTransitionTime", so
+ * a claim whose host crashed before finishing never starts that clock.
+ */
+export interface SandboxClaimLifecycle {
+    /** RFC 3339. Absolute expiry; the claim never expires without it. */
+    readonly shutdownTime?: string;
+    /**
+     * What happens to the claim OBJECT at expiry. `Retain` (the CRD default)
+     * deletes the Sandbox, Pod and Service but leaves the claim behind, so a
+     * host that crashes daily accumulates claims forever.
+     */
+    readonly shutdownPolicy?: 'Delete' | 'DeleteForeground' | 'Retain';
+    readonly ttlSecondsAfterFinished?: number;
+}
+/**
+ * `SandboxClaim.spec`. `warmPoolRef` is REQUIRED by the CRD, which is why
+ * there is no such thing as a pool-less claim and the no-pool path has to
+ * create a Sandbox directly.
+ *
+ * `env` and `volumeClaimTemplates` exist on this spec and are deliberately
+ * absent from this type: setting either forces the claim to cold-start rather
+ * than adopt a warm pool sandbox, which is the one thing the warm path exists
+ * to avoid. A field that cannot be named cannot be set by accident.
+ */
+export interface SandboxClaimResourceSpec {
+    readonly warmPoolRef: {
+        readonly name: string;
+    };
+    readonly lifecycle?: SandboxClaimLifecycle;
+}
+/**
+ * `SandboxClaim.status`. `sandbox` is the whole reason the claim path reads
+ * status back: an adopted pool sandbox keeps the generated name the pool gave
+ * it, so the bound object is routinely NOT named after the claim.
+ */
+export interface SandboxClaimResourceStatus {
+    readonly conditions?: readonly KubernetesCondition[];
+    readonly sandbox?: {
+        readonly name?: string;
+        readonly podIPs?: readonly string[];
+        readonly serviceFQDN?: string;
+    };
+}
+export interface SandboxClaimResource {
+    readonly apiVersion?: string;
+    readonly kind?: string;
+    readonly metadata?: KubernetesObjectMeta;
+    readonly spec?: SandboxClaimResourceSpec;
+    readonly status?: SandboxClaimResourceStatus;
+}
+/**
+ * `podTemplate` on a Sandbox or a SandboxTemplate. `spec` is a core `PodSpec`,
+ * carried opaquely: this backend copies one from a template into a Sandbox and
+ * overlays at most `runtimeClassName`.
+ */
+export interface SandboxPodTemplate {
+    readonly metadata?: KubernetesObjectMeta;
+    readonly spec: Readonly<Record<string, unknown>>;
+}
+/**
+ * One `spec.volumeClaimTemplates` entry.
+ *
+ * Partial in the same way every other shape here is: a workspace's disk is
+ * COPIED verbatim from the `SandboxTemplate` that declares it, and only the
+ * two fields this backend has to reason about are named — the entry's own
+ * `metadata.name`, which is how the controller wires the mount (StatefulSet
+ * style: the PVC is created as `<entry name>-<sandbox name>` and no explicit
+ * `volumes:` entry is needed in the podTemplate), and `spec.volumeMode`,
+ * which decides whether the guest gets a raw block device or a filesystem
+ * passthrough. The index signatures carry everything else across untouched.
+ */
+export interface SandboxVolumeClaimTemplate {
+    readonly metadata?: KubernetesObjectMeta;
+    readonly spec?: {
+        readonly volumeMode?: string;
+        readonly [field: string]: unknown;
+    };
+    readonly [field: string]: unknown;
+}
+export interface SandboxResourceSpec {
+    readonly operatingMode?: 'Running' | 'Suspended';
+    readonly podTemplate: SandboxPodTemplate;
+    /** Create a headless Service, and with it a `status.serviceFQDN`. */
+    readonly service?: boolean;
+    readonly shutdownPolicy?: 'Delete' | 'Retain';
+    /** RFC 3339, top-level on v1beta1 Sandbox (NOT under `lifecycle`). */
+    readonly shutdownTime?: string;
+    /**
+     * CEL-immutable on the served CRD ("volumeClaimTemplates is immutable"),
+     * which is why a workspace's disk has to be in the spec from creation and
+     * cannot be attached to a sandbox that is already running.
+     */
+    readonly volumeClaimTemplates?: readonly SandboxVolumeClaimTemplate[];
+}
+/**
+ * `Sandbox.status`. Note what is NOT here: a pod name. The backing pod is
+ * named after the Sandbox itself in v1.0.2, and `selector` — a serialised
+ * label selector, e.g. `agents.x-k8s.io/sandbox-name-hash=<hash>` — is the
+ * only thing in the API that finds the pod without relying on that.
+ */
+export interface SandboxResourceStatus {
+    readonly conditions?: readonly KubernetesCondition[];
+    readonly nodeName?: string;
+    readonly podIPs?: readonly string[];
+    readonly selector?: string;
+    readonly service?: string;
+    readonly serviceFQDN?: string;
+}
+export interface SandboxResource {
+    readonly apiVersion?: string;
+    readonly kind?: string;
+    readonly metadata?: KubernetesObjectMeta;
+    readonly spec?: SandboxResourceSpec;
+    readonly status?: SandboxResourceStatus;
+}
+export interface SandboxTemplateResource {
+    readonly metadata?: KubernetesObjectMeta;
+    readonly spec?: {
+        readonly podTemplate?: SandboxPodTemplate;
+        readonly service?: boolean;
+        readonly volumeClaimTemplates?: readonly SandboxVolumeClaimTemplate[];
+    };
+}
+/**
+ * `metadata.uid` is the per-instance agent bind token; the other two fields
+ * exist only to answer "is this the pod that uid belongs to, or the one being
+ * deleted?" — see {@link isPodLive}.
+ */
+export interface PodResource {
+    readonly metadata?: KubernetesObjectMeta;
+    readonly status?: {
+        readonly phase?: string;
+    };
+}
+export interface PodListResource {
+    readonly items?: readonly PodResource[];
+}
+/**
+ * A pod whose uid is still worth binding to: not being deleted, and not in a
+ * phase it cannot leave.
+ *
+ * The case this exists for is resume. A resumed sandbox's pod keeps the
+ * SAME NAME and gets a new uid and a new IP, so while the outgoing pod is
+ * terminating a `GET` by that name answers with the pod on its way out, and a
+ * list by the sandbox's selector returns every pod still carrying its labels,
+ * that one included. Binding to the terminating pod's uid produces a token the
+ * new agent refuses, and the failure arrives as a flat `unauthorized` with
+ * nothing pointing at the race that caused it.
+ */
+export declare function isPodLive(pod: PodResource | undefined): boolean;
+/**
+ * A pod whose containers have stopped: it is still an object, and nothing in
+ * it is executing any more.
+ *
+ * NOT the negation of {@link isPodLive}, and the gap between the two is the
+ * whole point. A terminating pod — `deletionTimestamp` set, phase still
+ * `Running` — is not live (never bind to it: its uid is about to stop being
+ * a valid token) and not stopped either (its process is still running, and on
+ * a workspace it is still writing to the caller's block device until it exits
+ * or `terminationGracePeriodSeconds` runs out). A suspend that treated the
+ * timestamp as "gone" would resolve mid-drain and promise a quiesced disk it
+ * had not waited for.
+ */
+export declare function isPodStopped(pod: PodResource | undefined): boolean;
+/**
+ * Backend-owned pod label naming which `SandboxTemplate` a Sandbox's pod was
+ * built from.
+ *
+ * agent-sandbox's OWN template-adoption controller selects pods by a
+ * controller-owned label, `agents.x-k8s.io/sandbox-template-ref-hash` — but
+ * that label is written only onto a Sandbox ADOPTED out of a
+ * `SandboxWarmPool` (the controller re-parents ownership and re-labels on
+ * bind). A Sandbox this backend POSTs directly (the pool-less path in
+ * `index.ts`'s `buildSandboxBody`) is never adopted, so it never gets that
+ * label — a direct Sandbox's pod would carry nothing a `NetworkPolicy`
+ * could reliably select it by. This backend writes its own label instead, on
+ * every Sandbox it creates, pooled or direct, so `egress-policy.ts`'s
+ * translated `NetworkPolicy` has one selector that always matches.
+ *
+ * `namzu.ai` matches the published domain (`packages/cli/package.json`'s
+ * `homepage`); there is no pre-existing Kubernetes label or annotation
+ * prefix anywhere in this repo to follow instead — the closest existing
+ * convention, `NAMZU_AGENT_*` / `NAMZU_SANDBOX_*` env vars, is not a
+ * label-safe shape.
+ *
+ * W8's `SandboxTemplate` manifests MUST set this same label (value = the
+ * template's own name) on their `podTemplate.metadata.labels`, so a POOLED
+ * sandbox's pod carries it too — the pool's pods are built from that
+ * template's `podTemplate` directly, not through `buildSandboxBody`, so
+ * nothing here can put it there for them. Skipping that step means a
+ * translated `NetworkPolicy`'s `podSelector` matches only sandboxes this
+ * backend created directly and none of the pooled ones — see
+ * `docs/sdk/kubernetes-sandbox.md`'s egress section.
+ */
+export declare const SANDBOX_TEMPLATE_LABEL_KEY = "sandbox.namzu.ai/template";
+/** `{ [SANDBOX_TEMPLATE_LABEL_KEY]: sandboxTemplateName }`, as a matchLabels-ready object. */
+export declare function sandboxTemplateLabel(sandboxTemplateName: string): Readonly<Record<string, string>>;
+/** Core `NetworkPolicy` — a stock resource, no CRD. */
+export declare const CORE_NETWORK_POLICY_API_GROUP = "networking.k8s.io";
+export declare const CORE_NETWORK_POLICY_API_VERSION = "v1";
+/**
+ * Cilium's FQDN-capable policy CRD. Only reached when
+ * `KubernetesEgressConfig.engine` is explicitly `'cilium'` — see
+ * `egress-policy.ts`.
+ */
+export declare const CILIUM_NETWORK_POLICY_API_GROUP = "cilium.io";
+export declare const CILIUM_NETWORK_POLICY_API_VERSION = "v2";
+export declare function claimCollectionPath(namespace: string): string;
+export declare function claimPath(namespace: string, name: string): string;
+export declare function sandboxCollectionPath(namespace: string): string;
+export declare function sandboxPath(namespace: string, name: string): string;
+export declare function sandboxTemplatePath(namespace: string, name: string): string;
+export declare function podPath(namespace: string, name: string): string;
+export declare function podListPath(namespace: string, labelSelector: string): string;
+export declare function networkPolicyPath(namespace: string, name: string): string;
+export declare function ciliumNetworkPolicyPath(namespace: string, name: string): string;
+//# sourceMappingURL=objects.d.ts.map

package/dist/backends/kubernetes/objects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,wCAAwC;AACxC,eAAO,MAAM,iBAAiB,oBAAoB,CAAA;AAClD,6EAA6E;AAC7E,eAAO,MAAM,4BAA4B,+BAA+B,CAAA;AACxE,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,YAAY,CAAA;AAE5C,oEAAoE;AACpE,eAAO,MAAM,eAAe,UAAU,CAAA;AAatC,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACvD;AAED,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CACpC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC9B,UAAU,EAAE,SAAS,mBAAmB,EAAE,GAAG,SAAS,EACtD,IAAI,EAAE,MAAM,GACV,OAAO,CAET;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAqB;IACrC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,GAAG,kBAAkB,GAAG,QAAQ,CAAA;IAClE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACzC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACpD,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAC7B,CAAA;CACD;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,wBAAwB,CAAA;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,CAAA;CAC5C;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;QAC5B,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KACjC,CAAA;IACD,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,GAAG,WAAW,CAAA;IAChD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC7C,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;CACrE;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAA;CACvC;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;QACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;QAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;KACrE,CAAA;CACD;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC7C;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;CACvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAS/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAGlE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,0BAA0B,8BAA8B,CAAA;AAErE,8FAA8F;AAC9F,wBAAgB,oBAAoB,CACnC,mBAAmB,EAAE,MAAM,GACzB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAElC;AAED,uDAAuD;AACvD,eAAO,MAAM,6BAA6B,sBAAsB,CAAA;AAChE,eAAO,MAAM,+BAA+B,OAAO,CAAA;AAEnD;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,cAAc,CAAA;AAC1D,eAAO,MAAM,iCAAiC,OAAO,CAAA;AAMrD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/E"}

package/dist/backends/kubernetes/objects.js

@@ -0,0 +1,156 @@
+/**
+ * Wire shapes and paths for the agent-sandbox CRDs this backend touches.
+ *
+ * Every field name here was read off the CRDs a real cluster serves —
+ * `kubectl get crd -o json` against agent-sandbox v1.0.2 on a kind cluster —
+ * and cross-checked against the upstream `sandbox_types.go` /
+ * `sandboxclaim_types.go` doc comments. Where the two disagree the served CRD
+ * wins, because it is what the API server validates against: the Go source on
+ * upstream main has already moved `Sandbox`'s `shutdownTime` /
+ * `shutdownPolicy` under a `lifecycle` block, and v1beta1 as served still
+ * carries them at the top of `spec`.
+ *
+ * The shapes are deliberately partial. This backend reads four fields out of a
+ * Sandbox status and writes three into a claim spec; typing the rest of a
+ * PodSpec would be a vendored copy of the core API that goes stale on its own
+ * schedule. A pod template read from a SandboxTemplate is carried through as
+ * an opaque record for exactly that reason — it is copied, never interpreted.
+ *
+ * Two groups, both `v1beta1` and both singular-versioned today:
+ *   - `agents.x-k8s.io`            → sandboxes
+ *   - `extensions.agents.x-k8s.io` → sandboxtemplates, sandboxwarmpools,
+ *                                    sandboxclaims
+ */
+/** Group serving the `Sandbox` kind. */
+export const SANDBOX_API_GROUP = 'agents.x-k8s.io';
+/** Group serving `SandboxTemplate`, `SandboxWarmPool` and `SandboxClaim`. */
+export const SANDBOX_EXTENSIONS_API_GROUP = 'extensions.agents.x-k8s.io';
+/** The only version either group serves in agent-sandbox v1.0.2. */
+export const SANDBOX_API_VERSION = 'v1beta1';
+/** `status.conditions[].type` both kinds report readiness under. */
+export const READY_CONDITION = 'Ready';
+/**
+ * True only for an explicit `status: 'True'`. An absent condition, an
+ * `Unknown` and a `False` are all "not yet", never "assume so" — the
+ * controller writes `Unknown` while it is still deciding.
+ */
+export function isConditionTrue(conditions, type) {
+    return conditions?.some((c) => c.type === type && c.status === 'True') === true;
+}
+/**
+ * A pod whose uid is still worth binding to: not being deleted, and not in a
+ * phase it cannot leave.
+ *
+ * The case this exists for is resume. A resumed sandbox's pod keeps the
+ * SAME NAME and gets a new uid and a new IP, so while the outgoing pod is
+ * terminating a `GET` by that name answers with the pod on its way out, and a
+ * list by the sandbox's selector returns every pod still carrying its labels,
+ * that one included. Binding to the terminating pod's uid produces a token the
+ * new agent refuses, and the failure arrives as a flat `unauthorized` with
+ * nothing pointing at the race that caused it.
+ */
+export function isPodLive(pod) {
+    if (!pod?.metadata)
+        return false;
+    // `!= null`, not `!== undefined`: an explicit JSON null would otherwise
+    // read as "terminating" and make a perfectly healthy pod unbindable. The
+    // API server omits the field rather than nulling it, so this never fires
+    // against a real cluster — it costs nothing not to depend on that.
+    if (pod.metadata.deletionTimestamp != null)
+        return false;
+    const phase = pod.status?.phase;
+    return phase !== 'Succeeded' && phase !== 'Failed';
+}
+/**
+ * A pod whose containers have stopped: it is still an object, and nothing in
+ * it is executing any more.
+ *
+ * NOT the negation of {@link isPodLive}, and the gap between the two is the
+ * whole point. A terminating pod — `deletionTimestamp` set, phase still
+ * `Running` — is not live (never bind to it: its uid is about to stop being
+ * a valid token) and not stopped either (its process is still running, and on
+ * a workspace it is still writing to the caller's block device until it exits
+ * or `terminationGracePeriodSeconds` runs out). A suspend that treated the
+ * timestamp as "gone" would resolve mid-drain and promise a quiesced disk it
+ * had not waited for.
+ */
+export function isPodStopped(pod) {
+    const phase = pod?.status?.phase;
+    return phase === 'Succeeded' || phase === 'Failed';
+}
+/**
+ * Backend-owned pod label naming which `SandboxTemplate` a Sandbox's pod was
+ * built from.
+ *
+ * agent-sandbox's OWN template-adoption controller selects pods by a
+ * controller-owned label, `agents.x-k8s.io/sandbox-template-ref-hash` — but
+ * that label is written only onto a Sandbox ADOPTED out of a
+ * `SandboxWarmPool` (the controller re-parents ownership and re-labels on
+ * bind). A Sandbox this backend POSTs directly (the pool-less path in
+ * `index.ts`'s `buildSandboxBody`) is never adopted, so it never gets that
+ * label — a direct Sandbox's pod would carry nothing a `NetworkPolicy`
+ * could reliably select it by. This backend writes its own label instead, on
+ * every Sandbox it creates, pooled or direct, so `egress-policy.ts`'s
+ * translated `NetworkPolicy` has one selector that always matches.
+ *
+ * `namzu.ai` matches the published domain (`packages/cli/package.json`'s
+ * `homepage`); there is no pre-existing Kubernetes label or annotation
+ * prefix anywhere in this repo to follow instead — the closest existing
+ * convention, `NAMZU_AGENT_*` / `NAMZU_SANDBOX_*` env vars, is not a
+ * label-safe shape.
+ *
+ * W8's `SandboxTemplate` manifests MUST set this same label (value = the
+ * template's own name) on their `podTemplate.metadata.labels`, so a POOLED
+ * sandbox's pod carries it too — the pool's pods are built from that
+ * template's `podTemplate` directly, not through `buildSandboxBody`, so
+ * nothing here can put it there for them. Skipping that step means a
+ * translated `NetworkPolicy`'s `podSelector` matches only sandboxes this
+ * backend created directly and none of the pooled ones — see
+ * `docs/sdk/kubernetes-sandbox.md`'s egress section.
+ */
+export const SANDBOX_TEMPLATE_LABEL_KEY = 'sandbox.namzu.ai/template';
+/** `{ [SANDBOX_TEMPLATE_LABEL_KEY]: sandboxTemplateName }`, as a matchLabels-ready object. */
+export function sandboxTemplateLabel(sandboxTemplateName) {
+    return { [SANDBOX_TEMPLATE_LABEL_KEY]: sandboxTemplateName };
+}
+/** Core `NetworkPolicy` — a stock resource, no CRD. */
+export const CORE_NETWORK_POLICY_API_GROUP = 'networking.k8s.io';
+export const CORE_NETWORK_POLICY_API_VERSION = 'v1';
+/**
+ * Cilium's FQDN-capable policy CRD. Only reached when
+ * `KubernetesEgressConfig.engine` is explicitly `'cilium'` — see
+ * `egress-policy.ts`.
+ */
+export const CILIUM_NETWORK_POLICY_API_GROUP = 'cilium.io';
+export const CILIUM_NETWORK_POLICY_API_VERSION = 'v2';
+function segment(value) {
+    return encodeURIComponent(value);
+}
+export function claimCollectionPath(namespace) {
+    return `/apis/${SANDBOX_EXTENSIONS_API_GROUP}/${SANDBOX_API_VERSION}/namespaces/${segment(namespace)}/sandboxclaims`;
+}
+export function claimPath(namespace, name) {
+    return `${claimCollectionPath(namespace)}/${segment(name)}`;
+}
+export function sandboxCollectionPath(namespace) {
+    return `/apis/${SANDBOX_API_GROUP}/${SANDBOX_API_VERSION}/namespaces/${segment(namespace)}/sandboxes`;
+}
+export function sandboxPath(namespace, name) {
+    return `${sandboxCollectionPath(namespace)}/${segment(name)}`;
+}
+export function sandboxTemplatePath(namespace, name) {
+    return `/apis/${SANDBOX_EXTENSIONS_API_GROUP}/${SANDBOX_API_VERSION}/namespaces/${segment(namespace)}/sandboxtemplates/${segment(name)}`;
+}
+export function podPath(namespace, name) {
+    return `/api/v1/namespaces/${segment(namespace)}/pods/${segment(name)}`;
+}
+export function podListPath(namespace, labelSelector) {
+    return `/api/v1/namespaces/${segment(namespace)}/pods?labelSelector=${encodeURIComponent(labelSelector)}`;
+}
+export function networkPolicyPath(namespace, name) {
+    return `/apis/${CORE_NETWORK_POLICY_API_GROUP}/${CORE_NETWORK_POLICY_API_VERSION}/namespaces/${segment(namespace)}/networkpolicies/${segment(name)}`;
+}
+export function ciliumNetworkPolicyPath(namespace, name) {
+    return `/apis/${CILIUM_NETWORK_POLICY_API_GROUP}/${CILIUM_NETWORK_POLICY_API_VERSION}/namespaces/${segment(namespace)}/ciliumnetworkpolicies/${segment(name)}`;
+}
+//# sourceMappingURL=objects.js.map

package/dist/backends/kubernetes/objects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"objects.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAA;AAClD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,4BAA4B,CAAA;AACxE,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAA;AAE5C,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAA;AAoCtC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC9B,UAAsD,EACtD,IAAY;IAEZ,OAAO,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,IAAI,CAAA;AAChF,CAAC;AA0JD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,GAA4B;IACrD,IAAI,CAAC,GAAG,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAA;IAChC,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,IAAI,IAAI;QAAE,OAAO,KAAK,CAAA;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAA;IAC/B,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,GAA4B;IACxD,MAAM,KAAK,GAAG,GAAG,EAAE,MAAM,EAAE,KAAK,CAAA;IAChC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAA2B,CAAA;AAErE,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CACnC,mBAA2B;IAE3B,OAAO,EAAE,CAAC,0BAA0B,CAAC,EAAE,mBAAmB,EAAE,CAAA;AAC7D,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAA;AAChE,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAA;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAA;AAC1D,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAA;AAErD,SAAS,OAAO,CAAC,KAAa;IAC7B,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACpD,OAAO,SAAS,4BAA4B,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAA;AACrH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,IAAY;IACxD,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACtD,OAAO,SAAS,iBAAiB,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,YAAY,CAAA;AACtG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,IAAY;IAC1D,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IAClE,OAAO,SAAS,4BAA4B,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACzI,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,IAAY;IACtD,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,aAAqB;IACnE,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,uBAAuB,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAA;AAC1G,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,IAAY;IAChE,OAAO,SAAS,6BAA6B,IAAI,+BAA+B,eAAe,OAAO,CAAC,SAAS,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACrJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,IAAY;IACtE,OAAO,SAAS,+BAA+B,IAAI,iCAAiC,eAAe,OAAO,CAAC,SAAS,CAAC,0BAA0B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC/J,CAAC"}