@namzu/sandbox 13.0.0 → 14.0.0

package/dist/backends/kubernetes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAG9C,OAAO,EACN,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAEN,+BAA+B,EAC/B,uBAAuB,EACvB,qBAAqB,EACrB,yBAAyB,GACzB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAEN,0BAA0B,EAE1B,sBAAsB,GACtB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAGN,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,EAM5B,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,SAAS,EACT,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,GACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AA6GzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAChC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,8BAA8B,GAAG,MAAM,CAAA;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAA;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAG1C;IACA,OAAO,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,mBAAmB,EAAE;QAC/F,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,qBAAqB;KACrC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,gCAAgC,GAAG;IACxC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACnC,CAAC,eAAe,EAAE,cAAc,CAAC;IACjC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,KAAK,EAAE,uBAAuB,CAAC;CACvB,CAAA;AAEV,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC/D,MAAM,aAAa,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEtC,MAAM,IAAI,KAAK,CACd,6DAA6D,aAAa;SACxE,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;SACzB,IAAI,CACJ,IAAI,CACJ,sYAAsY,CACxY,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAG9C;IACA,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;QAAE,OAAM;IACtF,MAAM,IAAI,KAAK,CACd,gEAAgE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,yPAAyP,CAC3a,CAAA;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAuC;IAC7E,MAAM,SAAS,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;IACpD,8BAA8B,CAAC,MAAM,CAAC,CAAA;IACtC,iEAAiE;IACjE,kEAAkE;IAClE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAA;IACtF,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3D,4EAA4E;IAC5E,uEAAuE;IACvE,uEAAuE;IACvE,gEAAgE;IAChE,IAAI,kBAA6C,CAAA;IACjD,OAAO;QACN,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,kBAAkB,KAAK,4BAA4B,CAClD,MAAM,EACN,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,mBAAmB,EAC1B,MAAM,CAAC,MAAM,EACb,OAAO,CAAC,MAAM,CACd,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACxB,kBAAkB,GAAG,SAAS,CAAA;oBAC9B,MAAM,GAAG,CAAA;gBACV,CAAC,CAAC,CAAA;gBACF,MAAM,kBAAkB,CAAA;YACzB,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;YACtF,OAAO,MAAM,kBAAkB,CAC9B,WAAW,EACX,MAAM,EACN,OAAO,EACP,qBAAqB,CAAC,SAAS,CAAC,SAAS,CAAC,CAC1C,CAAA;QACF,CAAC;KACD,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,MAAwB,EACxB,SAAiB,EACjB,mBAA2B,EAC3B,MAA8B,EAC9B,MAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAA;IACtC,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE;QACrE,SAAS;QACT,IAAI,EAAE,MAAM,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,mBAAmB,CAAC;QAC9E,mBAAmB;KACnB,CAAC,CAAA;IACF,MAAM,yBAAyB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;AAC5D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,MAAuC;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IACzD,OAAO;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,MAAwB,EACxB,MAAuC,EACvC,OAA8B,EAC9B,SAA0E;IAE1E,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,8BAA8B,CAAC,MAAM,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;IAClC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,IAAI,yBAAyB,CAAA;IACtE,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,UAAU,GAAG,cAAc,iBAAiB,EAAE,EAAE,CAAA;IACtD,MAAM,SAAS,GACd,MAAM,CAAC,YAAY,KAAK,SAAS;QAChC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC;QAClC,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAEtC,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAAiB,EAAE;QAC7D,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,gEAAgE;YAChE,IAAI,CAAC,CAAC,GAAG,YAAY,0BAA0B,CAAC;gBAAE,MAAM,GAAG,CAAA;QAC5D,CAAC;IACF,CAAC,CAAA;IAED,uEAAuE;IACvE,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,8DAA8D;IAC9D,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,KAAK,GAAG,KAAK,EAAE,gBAAwB,EAAE,MAAoB,EAAiB,EAAE;QACrF,MAAM,KAAK,GACV,MAAM,CAAC,YAAY,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,EAAE;YAC7D,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,CAAA;QAChD,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;IACxD,CAAC,CAAA;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CACrC,SAAS,CAAC,SAAS,EACnB,sBAAsB,EACtB,OAAO,CAAC,MAAM,CACd,CAAA;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,UAAU,GACf,MAAM,CAAC,YAAY,KAAK,SAAS;QAChC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC;QAChC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,UAAU,GACf,MAAM,CAAC,YAAY,KAAK,SAAS;QAChC,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC;QAC1E,CAAC,CAAC,gBAAgB,CAAC;YACjB,SAAS;YACT,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACvC,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAC1E;YACD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,YAAY;YACZ,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAA;IAEL,IAAI,CAAC;QACJ,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;QACtF,MAAM,OAAO,GACZ,MAAM,CAAC,YAAY,KAAK,SAAS;YAChC,CAAC,CAAC,MAAM,cAAc,CACpB,KAAK,EAAE,MAAM,EAAE,EAAE,CAChB,gBAAgB,CACf,MAAM,MAAM,CAAC,OAAO,CACnB,KAAK,EACL,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,EAChC,SAAS,EACT,MAAM,CACN,EACD,UAAU,CACV,EACF,QAAQ,EACR,SAAS,EACT,SAAS,UAAU,EAAE,CACrB;YACF,CAAC,CAAC,MAAM,cAAc,CACpB,KAAK,EAAE,MAAM,EAAE,EAAE,CAChB,kBAAkB,CACjB,MAAM,MAAM,CAAC,OAAO,CACnB,KAAK,EACL,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,EAClC,SAAS,EACT,MAAM,CACN,CACD,EACF,QAAQ,EACR,SAAS,EACT,WAAW,UAAU,EAAE,CACvB,CAAA;QAEJ,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3C,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CACpD,CAAA;QACD,OAAO;YACN,OAAO;YACP,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,IAAI,kBAAkB,EAAE,KAAK,CAAC;YAClF,SAAS;YACT,UAAU;YACV,OAAO;YACP,KAAK;SACL,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;QACtB,CAAC,CAAC,CAAA;QACF,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CACtB,SAAiB,EACjB,IAAY,EACZ,YAAoB,EACpB,YAAoB;IAEpB,OAAO;QACN,UAAU,EAAE,GAAG,4BAA4B,IAAI,mBAAmB,EAAE;QACpE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,IAAI,EAAE;YACL,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;YACnC,SAAS,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE;SACrD;KACD,CAAA;AACF,CAAC;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA2B;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAA;IAChD,MAAM,IAAI,GACT,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACrC,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;QACrE,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAG;QAChB,GAAG,WAAW,CAAC,QAAQ;QACvB,MAAM,EAAE;YACP,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM;YAC/B,GAAG,oBAAoB,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACpD;KACD,CAAA;IACD,OAAO;QACN,UAAU,EAAE,GAAG,iBAAiB,IAAI,mBAAmB,EAAE;QACzD,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAC9D,IAAI,EAAE;YACL,aAAa,EAAE,SAAS;YACxB,OAAO,EAAE,IAAI;YACb,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE;gBAClE,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,KAAK,SAAS;gBACtD,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC;YACN,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC/C;KACD,CAAA;AACF,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,MAAwB,EACxB,SAAiB,EACjB,mBAA2B,EAC3B,MAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CACpC,KAAK,EACL,mBAAmB,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACnD,SAAS,EACT,MAAM,CACN,CAAA;IACD,MAAM,WAAW,GAAG,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAA;IAC/C,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CACd,+BAA+B,mBAAmB,iBAAiB,SAAS,mKAAmK,CAC/O,CAAA;IACF,CAAC;IACD,MAAM,oBAAoB,GAAG,QAAQ,EAAE,IAAI,EAAE,oBAAoB,CAAA;IACjE,OAAO;QACN,WAAW;QACX,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAA;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAClC,OAAiC,EACjC,SAAiB,EACjB,KAAa;IAEb,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;IACvD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACd,uBAAuB,OAAO,CAAC,IAAI,kKAAkK,CACrM,CAAA;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;AACrD,CAAC;AAED,SAAS,gBAAgB,CACxB,KAAuC,EACvC,SAAiB;IAEjB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,CAAC;QAAE,OAAO,SAAS,CAAA;IAClF,MAAM,KAAK,GAAG,KAAK,EAAE,MAAM,EAAE,OAAO,CAAA;IACpC,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACd,4BAA4B,SAAS,8FAA8F,CACnI,CAAA;IACF,CAAC;IACD,OAAO;QACN,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAA;AACF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CACjC,OAAoC;IAEpC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,CAAC;QAAE,OAAO,SAAS,CAAA;IACpF,MAAM,IAAI,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAA;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,CAAA;IAC9B,OAAO;QACN,IAAI;QACJ,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAA;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,IAA4E,EAC5E,QAA2B,EAC3B,SAA0E,EAC1E,KAAa;IAEb,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACxC,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,wBAAwB,SAAS,CAAC,SAAS,KAAK,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,MAAwB,EACxB,SAAiB,EACjB,OAAiC,EACjC,MAAoB;IAEpB,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,KAAK,EACL,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAChC,SAAS,EACT,MAAM,CACN,CAAA;QACD,MAAM,GAAG,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAA;QAC9B,sEAAsE;QACtE,4DAA4D;QAC5D,qEAAqE;QACrE,gEAAgE;QAChE,0CAA0C;QAC1C,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,GAAG,YAAY,0BAA0B,CAAC;YAAE,MAAM,GAAG,CAAA;IAC5D,CAAC;IAED,MAAM,QAAQ,GACb,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IACvF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAChC,KAAK,EACL,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,EAChC,SAAS,EACT,MAAM,CACN,CAAA;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAA;YAC7B,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAA;QACtC,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CACd,oDAAoD,OAAO,CAAC,IAAI,iBAAiB,SAAS,+QAA+Q,CACzW,CAAA;AACF,CAAC;AAED,KAAK,UAAU,mBAAmB,CACjC,MAAwB,EACxB,SAAiB,EACjB,OAAiC,EACjC,MAAoB;IAEpB,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CACnC,KAAK,EACL,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EACpC,SAAS,EACT,MAAM,CACN,CAAA;QACD,OAAO,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,0BAA0B;YAAE,OAAO,SAAS,CAAA;QAC/D,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,KAAK,UAAU,kBAAkB,CAChC,WAAkC,EAClC,MAAuC,EACvC,OAA8B,EAC9B,cAAsB;IAEtB,MAAM,OAAO,GAAG,sBAAsB,CAAC;QACtC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI;QAC9B,OAAO,EAAE,OAAO,CAAC,gBAAgB;QACjC,SAAS,EAAE,IAAI,wBAAwB,CAAC,WAAW,CAAC,KAAK,CAAC;QAC1D,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,mBAAmB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,CAAA;IACF,IAAI,CAAC;QACJ,MAAM,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QAClC,CAAC,CAAC,CAAA;QACF,MAAM,GAAG,CAAA;IACV,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAAgB,EAChB,WAAmB,EACnB,cAAsB,EACtB,MAAoB;IAEpB,yEAAyE;IACzE,mEAAmE;IACnE,oEAAoE;IACpE,MAAM,UAAU,GAAG,8BAA8B,WAAW,EAAE,CAAA;IAC9D,IAAI,CAAC;QACJ,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,GAAG,CAClE,KAAK,EAAE,UAAU,EAAE,EAAE,CACpB,MAAM,iBAAiB,CACtB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAClF,WAAW,CACX,CACF,CAAA;QACD,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,EAAE,cAAc,EAAE,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,qEAAqE;QACrE,sEAAsE;QACtE,gEAAgE;QAChE,IAAI,GAAG,YAAY,wBAAwB,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACzE,MAAM,sBAAsB,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC"}

package/dist/backends/kubernetes/k8s-client.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Minimal Kubernetes API client: bare fetch/https transport plus in-cluster
+ * ServiceAccount bootstrap.
+ *
+ * Sibling of the ACI and Firecracker control-plane clients: same
+ * dependency-free shape, different API. No `@kubernetes/client-node`, no
+ * kubeconfig parsing, no exec-credential-plugin invocation, no YAML anywhere
+ * — `@namzu/sandbox` still declares zero runtime `dependencies` after this
+ * module.
+ *
+ * ## Auth / SDK-dependency boundary
+ * Two access sources, neither needing a YAML parser:
+ *  - `{ inCluster: true }` reads the projected ServiceAccount volume
+ *    (`token`, `ca.crt`, `namespace`) plus `KUBERNETES_SERVICE_HOST` /
+ *    `KUBERNETES_SERVICE_PORT` — pure file + env reads, the same boundary
+ *    `kubectl` itself uses inside a pod. The token file is re-read on EVERY
+ *    request because kubelet rotates projected tokens under the pod; caching
+ *    it would produce an intermittent 401 hours into a long-lived host
+ *    process.
+ *  - `{ server, ca?, getToken }` supplied by the caller mirrors ACI's
+ *    `ArmTokenProvider` and Firecracker's `OrchestratorTokenProvider`
+ *    (`../aci-standby-pool/index.ts`, `../firecracker/index.ts`). Kubeconfig
+ *    parsing, context merging and exec-credential-plugin invocation
+ *    (kubelogin, gcloud, aws-iam-authenticator, ...) all stay OUTSIDE this
+ *    package; the caller resolves a bearer token however it likes.
+ *
+ * ## Transport
+ * Default path is bare global `fetch`. When a custom CA is present — always
+ * true in-cluster, since the cluster CA is never in the process's system
+ * trust store — the call goes through `node:https.request` with that `ca`
+ * and `rejectUnauthorized: true` instead, exactly as
+ * `../firecracker/index.ts` splits `fetchOrchestratorRequest` from
+ * `httpsOrchestratorRequest` ("the package declares no undici dependency").
+ *
+ * ## Status mapping
+ * 404/410 become an `AlreadyGoneError` sentinel a teardown path can treat as
+ * success (ACI's `armCall(..., [404, 410])` accepts the same pair for
+ * exactly that reason — see `../aci-standby-pool/index.ts`). 409 becomes a
+ * `ConflictError` an adoption/retry path can catch. 401/403 become a
+ * `CredentialError` naming the attempted verb and resource — never the
+ * token, which this module never logs or embeds in any thrown message.
+ *
+ * ## Not in v1
+ * No watch, no informers, no resourceVersion/bookmark tracking. Readiness is
+ * polled by the caller with `../readiness.js`'s `OperationDeadline`, exactly
+ * as ACI polls `provisioningState`.
+ */
+/** The only verbs anything in this backend needs to send. */
+export type KubernetesHttpMethod = 'GET' | 'POST' | 'PATCH' | 'DELETE';
+/**
+ * Authentication callback. Caller returns a fresh bearer token. Invoked on
+ * every request so a long-running host survives token rotation — the same
+ * contract as ACI's `ArmTokenProvider` and Firecracker's
+ * `OrchestratorTokenProvider`.
+ */
+export type KubernetesTokenProvider = () => Promise<string>;
+/**
+ * In-cluster bootstrap. The token, CA and namespace come off the projected
+ * ServiceAccount volume; the API server address comes off the env vars the
+ * kubelet always sets for the pod's default-namespace Service.
+ */
+export interface InClusterKubernetesAccess {
+    readonly inCluster: true;
+    /**
+     * Overridable so tests never touch the real projected-volume path.
+     * Defaults to `/var/run/secrets/kubernetes.io/serviceaccount`.
+     */
+    readonly serviceAccountDir?: string;
+}
+/**
+ * Caller-supplied server + credential (see {@link KubernetesTokenProvider}).
+ * `namespace` is required here because, unlike the in-cluster path, there is
+ * no ServiceAccount file to read it from — the caller must say which
+ * namespace this client operates in.
+ */
+export interface ExplicitKubernetesAccess {
+    readonly inCluster?: false;
+    readonly server: string;
+    readonly namespace: string;
+    /** Custom cluster CA. Present → the client dials over `node:https`. */
+    readonly ca?: string | Buffer;
+    readonly getToken: KubernetesTokenProvider;
+}
+export type KubernetesAccess = InClusterKubernetesAccess | ExplicitKubernetesAccess;
+export interface KubernetesClient {
+    /**
+     * `path` is the API-server path (e.g.
+     * `/apis/agents.x-k8s.io/v1/namespaces/ns/sandboxclaims/id`), not a full
+     * URL. Returns the parsed JSON body, or `undefined` for a 204 or an empty
+     * body. Rejects with {@link KubernetesAlreadyGoneError},
+     * {@link KubernetesConflictError} or {@link KubernetesCredentialError} for
+     * the status codes each names; any other non-2xx status rejects with a
+     * plain `Error`.
+     */
+    request<T>(method: KubernetesHttpMethod, path: string, body?: unknown, signal?: AbortSignal): Promise<T | undefined>;
+    /** From the ServiceAccount file in-cluster, from config otherwise. */
+    namespace(): string;
+}
+/** 404/410 → this. A teardown path treats it as "already achieved". */
+export declare class KubernetesAlreadyGoneError extends Error {
+    readonly method: KubernetesHttpMethod;
+    readonly resource: string;
+    readonly status: number;
+    constructor(method: KubernetesHttpMethod, resource: string, status: number);
+}
+/** 409 → this. An adoption/retry path can catch it and re-read + retry. */
+export declare class KubernetesConflictError extends Error {
+    readonly method: KubernetesHttpMethod;
+    readonly resource: string;
+    constructor(method: KubernetesHttpMethod, resource: string);
+}
+/**
+ * 401/403 → this. Names the attempted verb and resource only — never the
+ * token, and never the response body (the API server does not echo the
+ * token back, but the body is untrusted content this module has no reason
+ * to repeat into a thrown message).
+ */
+export declare class KubernetesCredentialError extends Error {
+    readonly verb: KubernetesHttpMethod;
+    readonly resource: string;
+    readonly status: number;
+    constructor(verb: KubernetesHttpMethod, resource: string, status: number);
+}
+export declare function createKubernetesClient(access: KubernetesAccess): KubernetesClient;
+//# sourceMappingURL=k8s-client.d.ts.map

package/dist/backends/kubernetes/k8s-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k8s-client.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/k8s-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAKH,6DAA6D;AAC7D,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEtE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;AAE3D;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAA;CAC1C;AAED,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,GAAG,wBAAwB,CAAA;AAEnF,MAAM,WAAW,gBAAgB;IAChC;;;;;;;;OAQG;IACH,OAAO,CAAC,CAAC,EACR,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAA;IACzB,sEAAsE;IACtE,SAAS,IAAI,MAAM,CAAA;CACnB;AAID,uEAAuE;AACvE,qBAAa,0BAA2B,SAAQ,KAAK;IAEnD,QAAQ,CAAC,MAAM,EAAE,oBAAoB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAFd,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAKxB;AAED,2EAA2E;AAC3E,qBAAa,uBAAwB,SAAQ,KAAK;IAEhD,QAAQ,CAAC,MAAM,EAAE,oBAAoB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBADhB,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,MAAM;CAK1B;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAElD,QAAQ,CAAC,IAAI,EAAE,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAFd,IAAI,EAAE,oBAAoB,EAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAKxB;AAoID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAkEjF"}

package/dist/backends/kubernetes/k8s-client.js

@@ -0,0 +1,246 @@
+/**
+ * Minimal Kubernetes API client: bare fetch/https transport plus in-cluster
+ * ServiceAccount bootstrap.
+ *
+ * Sibling of the ACI and Firecracker control-plane clients: same
+ * dependency-free shape, different API. No `@kubernetes/client-node`, no
+ * kubeconfig parsing, no exec-credential-plugin invocation, no YAML anywhere
+ * — `@namzu/sandbox` still declares zero runtime `dependencies` after this
+ * module.
+ *
+ * ## Auth / SDK-dependency boundary
+ * Two access sources, neither needing a YAML parser:
+ *  - `{ inCluster: true }` reads the projected ServiceAccount volume
+ *    (`token`, `ca.crt`, `namespace`) plus `KUBERNETES_SERVICE_HOST` /
+ *    `KUBERNETES_SERVICE_PORT` — pure file + env reads, the same boundary
+ *    `kubectl` itself uses inside a pod. The token file is re-read on EVERY
+ *    request because kubelet rotates projected tokens under the pod; caching
+ *    it would produce an intermittent 401 hours into a long-lived host
+ *    process.
+ *  - `{ server, ca?, getToken }` supplied by the caller mirrors ACI's
+ *    `ArmTokenProvider` and Firecracker's `OrchestratorTokenProvider`
+ *    (`../aci-standby-pool/index.ts`, `../firecracker/index.ts`). Kubeconfig
+ *    parsing, context merging and exec-credential-plugin invocation
+ *    (kubelogin, gcloud, aws-iam-authenticator, ...) all stay OUTSIDE this
+ *    package; the caller resolves a bearer token however it likes.
+ *
+ * ## Transport
+ * Default path is bare global `fetch`. When a custom CA is present — always
+ * true in-cluster, since the cluster CA is never in the process's system
+ * trust store — the call goes through `node:https.request` with that `ca`
+ * and `rejectUnauthorized: true` instead, exactly as
+ * `../firecracker/index.ts` splits `fetchOrchestratorRequest` from
+ * `httpsOrchestratorRequest` ("the package declares no undici dependency").
+ *
+ * ## Status mapping
+ * 404/410 become an `AlreadyGoneError` sentinel a teardown path can treat as
+ * success (ACI's `armCall(..., [404, 410])` accepts the same pair for
+ * exactly that reason — see `../aci-standby-pool/index.ts`). 409 becomes a
+ * `ConflictError` an adoption/retry path can catch. 401/403 become a
+ * `CredentialError` naming the attempted verb and resource — never the
+ * token, which this module never logs or embeds in any thrown message.
+ *
+ * ## Not in v1
+ * No watch, no informers, no resourceVersion/bookmark tracking. Readiness is
+ * polled by the caller with `../readiness.js`'s `OperationDeadline`, exactly
+ * as ACI polls `provisioningState`.
+ */
+import { readFileSync } from 'node:fs';
+import https from 'node:https';
+const DEFAULT_SERVICE_ACCOUNT_DIR = '/var/run/secrets/kubernetes.io/serviceaccount';
+/** 404/410 → this. A teardown path treats it as "already achieved". */
+export class KubernetesAlreadyGoneError extends Error {
+    method;
+    resource;
+    status;
+    constructor(method, resource, status) {
+        super(`kubernetes ${method} ${resource} -> ${status}: already gone`);
+        this.method = method;
+        this.resource = resource;
+        this.status = status;
+        this.name = 'KubernetesAlreadyGoneError';
+    }
+}
+/** 409 → this. An adoption/retry path can catch it and re-read + retry. */
+export class KubernetesConflictError extends Error {
+    method;
+    resource;
+    constructor(method, resource) {
+        super(`kubernetes ${method} ${resource} -> 409: conflict`);
+        this.method = method;
+        this.resource = resource;
+        this.name = 'KubernetesConflictError';
+    }
+}
+/**
+ * 401/403 → this. Names the attempted verb and resource only — never the
+ * token, and never the response body (the API server does not echo the
+ * token back, but the body is untrusted content this module has no reason
+ * to repeat into a thrown message).
+ */
+export class KubernetesCredentialError extends Error {
+    verb;
+    resource;
+    status;
+    constructor(verb, resource, status) {
+        super(`kubernetes API refused ${verb} ${resource}: ${status}`);
+        this.verb = verb;
+        this.resource = resource;
+        this.status = status;
+        this.name = 'KubernetesCredentialError';
+    }
+}
+function stripTrailingSlash(url) {
+    return url.endsWith('/') ? url.slice(0, -1) : url;
+}
+/**
+ * Reads `ca.crt` and `namespace` once (they do not rotate for the pod's
+ * lifetime); returns a `getToken` closure that re-reads `token` on every
+ * call, because kubelet DOES rotate the projected token under a live pod.
+ */
+function resolveInCluster(access) {
+    const dir = access.serviceAccountDir ?? DEFAULT_SERVICE_ACCOUNT_DIR;
+    const host = process.env.KUBERNETES_SERVICE_HOST;
+    const port = process.env.KUBERNETES_SERVICE_PORT;
+    if (host === undefined || host === '' || port === undefined || port === '') {
+        throw new Error('kubernetes: in-cluster access requires KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT');
+    }
+    const ca = readFileSync(`${dir}/ca.crt`);
+    const namespace = readFileSync(`${dir}/namespace`, 'utf8').trim();
+    return {
+        baseUrl: `https://${host}:${port}`,
+        ca,
+        namespace,
+        getToken: async () => readFileSync(`${dir}/token`, 'utf8').trim(),
+    };
+}
+function resolveExplicit(access) {
+    return {
+        baseUrl: stripTrailingSlash(access.server),
+        ca: access.ca,
+        namespace: access.namespace,
+        getToken: access.getToken,
+    };
+}
+/** The plain-`fetch` path — the DEFAULT, used whenever no custom CA is set. */
+async function fetchRequest(url, method, headers, payload, signal) {
+    const init = { method, headers };
+    if (payload !== undefined)
+        init.body = payload;
+    if (signal !== undefined)
+        init.signal = signal;
+    const res = await fetch(url, init);
+    return {
+        status: res.status,
+        contentType: res.headers.get('content-type') ?? '',
+        text: () => res.text(),
+    };
+}
+/**
+ * The custom-CA path: a `node:https` request presenting the injected `ca`
+ * and verifying the API server's cert against it (`rejectUnauthorized:
+ * true`). `node:https` is used rather than fetch+a custom dispatcher because
+ * the package declares no undici dependency — `node:https` is always
+ * importable and needs nothing added (mirrors
+ * `../firecracker/index.ts`'s `httpsOrchestratorRequest`).
+ */
+function httpsRequest(url, method, headers, payload, ca, signal) {
+    const target = new URL(url);
+    return new Promise((resolve, reject) => {
+        const req = https.request({
+            protocol: target.protocol,
+            hostname: target.hostname,
+            port: target.port !== '' ? Number(target.port) : 443,
+            path: `${target.pathname}${target.search}`,
+            method,
+            headers,
+            ca,
+            rejectUnauthorized: true,
+            ...(signal !== undefined ? { signal } : {}),
+        }, (res) => {
+            const chunks = [];
+            res.on('data', (chunk) => chunks.push(chunk));
+            res.on('end', () => {
+                const ct = res.headers['content-type'];
+                resolve({
+                    status: res.statusCode ?? 0,
+                    contentType: Array.isArray(ct) ? (ct[0] ?? '') : (ct ?? ''),
+                    text: async () => Buffer.concat(chunks).toString('utf8'),
+                });
+            });
+            res.on('error', reject);
+        });
+        req.on('error', reject);
+        if (payload !== undefined)
+            req.write(payload);
+        req.end();
+    });
+}
+/**
+ * `PATCH` always carries a JSON MERGE patch body (RFC 7386) — never
+ * server-side apply, never YAML. `POST` carries a plain JSON create body.
+ * `GET`/`DELETE` normally carry no body; if a caller ever does pass one to
+ * `DELETE` it is sent as plain JSON.
+ */
+function contentTypeFor(method) {
+    return method === 'PATCH' ? 'application/merge-patch+json' : 'application/json';
+}
+export function createKubernetesClient(access) {
+    const resolved = access.inCluster === true ? resolveInCluster(access) : resolveExplicit(access);
+    async function request(method, path, body, signal) {
+        signal?.throwIfAborted();
+        const token = await resolved.getToken();
+        signal?.throwIfAborted();
+        const url = `${resolved.baseUrl}${path}`;
+        const payload = body !== undefined ? JSON.stringify(body) : undefined;
+        const headers = {
+            Authorization: `Bearer ${token}`,
+            Accept: 'application/json',
+        };
+        if (payload !== undefined)
+            headers['content-type'] = contentTypeFor(method);
+        let res;
+        try {
+            res =
+                resolved.ca !== undefined
+                    ? await httpsRequest(url, method, headers, payload, resolved.ca, signal)
+                    : await fetchRequest(url, method, headers, payload, signal);
+        }
+        catch (err) {
+            throw new Error(`kubernetes ${method} ${path} failed: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+        }
+        if (res.status === 401 || res.status === 403) {
+            await res.text();
+            signal?.throwIfAborted();
+            throw new KubernetesCredentialError(method, path, res.status);
+        }
+        if (res.status === 404 || res.status === 410) {
+            await res.text();
+            signal?.throwIfAborted();
+            throw new KubernetesAlreadyGoneError(method, path, res.status);
+        }
+        if (res.status === 409) {
+            await res.text();
+            signal?.throwIfAborted();
+            throw new KubernetesConflictError(method, path);
+        }
+        if (res.status < 200 || res.status >= 300) {
+            const text = await res.text();
+            signal?.throwIfAborted();
+            throw new Error(`kubernetes ${method} ${path} -> ${res.status}: ${text}`);
+        }
+        if (res.status === 204)
+            return undefined;
+        if (res.contentType.includes('application/json')) {
+            const text = await res.text();
+            signal?.throwIfAborted();
+            return text.length > 0 ? JSON.parse(text) : undefined;
+        }
+        return undefined;
+    }
+    return {
+        request,
+        namespace: () => resolved.namespace,
+    };
+}
+//# sourceMappingURL=k8s-client.js.map

package/dist/backends/kubernetes/k8s-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"k8s-client.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/k8s-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,MAAM,YAAY,CAAA;AAgE9B,MAAM,2BAA2B,GAAG,+CAA+C,CAAA;AAEnF,uEAAuE;AACvE,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAE1C;IACA;IACA;IAHV,YACU,MAA4B,EAC5B,QAAgB,EAChB,MAAc;QAEvB,KAAK,CAAC,cAAc,MAAM,IAAI,QAAQ,OAAO,MAAM,gBAAgB,CAAC,CAAA;QAJ3D,WAAM,GAAN,MAAM,CAAsB;QAC5B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IACzC,CAAC;CACD;AAED,2EAA2E;AAC3E,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAEvC;IACA;IAFV,YACU,MAA4B,EAC5B,QAAgB;QAEzB,KAAK,CAAC,cAAc,MAAM,IAAI,QAAQ,mBAAmB,CAAC,CAAA;QAHjD,WAAM,GAAN,MAAM,CAAsB;QAC5B,aAAQ,GAAR,QAAQ,CAAQ;QAGzB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACtC,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEzC;IACA;IACA;IAHV,YACU,IAA0B,EAC1B,QAAgB,EAChB,MAAc;QAEvB,KAAK,CAAC,0BAA0B,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAA;QAJrD,SAAI,GAAJ,IAAI,CAAsB;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACxC,CAAC;CACD;AAED,SAAS,kBAAkB,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAClD,CAAC;AASD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAiC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,IAAI,2BAA2B,CAAA;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IAChD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACd,4FAA4F,CAC5F,CAAA;IACF,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,GAAG,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACjE,OAAO;QACN,OAAO,EAAE,WAAW,IAAI,IAAI,IAAI,EAAE;QAClC,EAAE;QACF,SAAS;QACT,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,GAAG,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE;KACjE,CAAA;AACF,CAAC;AAED,SAAS,eAAe,CAAC,MAAgC;IACxD,OAAO;QACN,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KACzB,CAAA;AACF,CAAC;AASD,+EAA+E;AAC/E,KAAK,UAAU,YAAY,CAC1B,GAAW,EACX,MAA4B,EAC5B,OAA+B,EAC/B,OAA2B,EAC3B,MAAoB;IAEpB,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC7C,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAA;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAClD,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE;KACtB,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CACpB,GAAW,EACX,MAA4B,EAC5B,OAA+B,EAC/B,OAA2B,EAC3B,EAAmB,EACnB,MAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3B,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CACxB;YACC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG;YACpD,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,MAAM;YACN,OAAO;YACP,EAAE;YACF,kBAAkB,EAAE,IAAI;YACxB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,EACD,CAAC,GAAG,EAAE,EAAE;YACP,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACrD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBAClB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;gBACtC,OAAO,CAAC;oBACP,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;oBAC3B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;oBAC3D,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBACxD,CAAC,CAAA;YACH,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACxB,CAAC,CACD,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,IAAI,OAAO,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,GAAG,CAAC,GAAG,EAAE,CAAA;IACV,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,MAA4B;IACnD,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,kBAAkB,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IAE/F,KAAK,UAAU,OAAO,CACrB,MAA4B,EAC5B,IAAY,EACZ,IAAc,EACd,MAAoB;QAEpB,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACvC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,IAAI,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACrE,MAAM,OAAO,GAA2B;YACvC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,kBAAkB;SAC1B,CAAA;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;QAE3E,IAAI,GAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,GAAG;gBACF,QAAQ,CAAC,EAAE,KAAK,SAAS;oBACxB,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;oBACxE,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACd,cAAc,MAAM,IAAI,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1F,EAAE,KAAK,EAAE,GAAG,EAAE,CACd,CAAA;QACF,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC9C,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,IAAI,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC9C,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,IAAI,0BAA0B,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,IAAI,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAA;QACxC,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAO,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7D,CAAC;QACD,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,OAAO;QACN,OAAO;QACP,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS;KACnC,CAAA;AACF,CAAC"}

package/dist/backends/kubernetes/lease.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Lease renewal for an acquired kubernetes sandbox.
+ *
+ * Acquire stamps an ABSOLUTE `shutdownTime` (now + `claimTtlSeconds`) plus
+ * `shutdownPolicy: Delete` onto every object it creates. That is the leak
+ * guard: a host that dies mid-run costs the cluster one expiry rather than a
+ * sandbox that lives forever. It is also, unrenewed, a deadline on the RUN —
+ * a session that outlives the TTL has its pod deleted underneath it, mid
+ * command, with no error the host can attribute to anything.
+ *
+ * The two requirements are not in tension, they just need a second half:
+ * a live handle renews its own lease, and a dead host stops renewing. So
+ * this timer is owned by the Sandbox handle, and `destroy()` stops it.
+ *
+ * ## The shape of the timer
+ *
+ * One `setTimeout` chained per tick, never `setInterval`: a renewal PATCH
+ * that takes longer than the interval must not queue a second one behind
+ * it. The interval is HALF the TTL, so a single failed tick still leaves a
+ * whole half-TTL of headroom for the next one to succeed, and it is
+ * jittered ±10% so a hundred handles acquired in the same second do not
+ * PATCH the API server in the same millisecond forever after.
+ *
+ * The timer is `unref`'d: a host process that has finished its work should
+ * exit, not linger because a sandbox handle is still counting. A handle
+ * nobody destroyed then expires on the cluster's clock exactly as an
+ * abandoned one does, which is the behaviour the TTL exists for.
+ *
+ * ## Every tick is bounded
+ *
+ * A renewal that FAILS is survivable — it is reported and retried with half
+ * a TTL of headroom. A renewal that HANGS is not: the next tick is scheduled
+ * only after the current one settles, so a PATCH that never answers parks
+ * the loop forever, reports nothing, and lets the lease expire in silence —
+ * precisely the defect this file exists to close, moved onto the failure
+ * path. An API server that accepts a connection and then never responds is
+ * an ordinary cluster event, so each PATCH runs under its own deadline: it
+ * aborts the request through the signal the client already takes, and an
+ * expiry is then just another reported failure that retries on the next
+ * tick.
+ *
+ * ## What each outcome means
+ *
+ *  - Success → the object's expiry moves a full TTL into the future.
+ *  - Any error, a tick that ran out of time included → reported to
+ *    `onRenewalError` and RETRIED on the next tick. A transient API blip
+ *    must not tear down a working sandbox, and there is still half a TTL of
+ *    headroom.
+ *  - Already gone (404/410) → the object this handle owns no longer exists.
+ *    Nothing will bring it back, so the loop stops and the handle is marked
+ *    gone; every later call fails with a named error instead of dialing an
+ *    address whose pod the controller has already deleted.
+ */
+/** How far each tick pushes the expiry, and how often ticks happen. */
+export interface LeaseRenewalOptions {
+    /** The same TTL acquire stamped. Each tick sets `now + ttlSeconds`. */
+    readonly ttlSeconds: number;
+    /**
+     * Send the merge patch. Rejects with whatever the client rejects with.
+     *
+     * The `signal` is the tick's own deadline and IS passed on every call —
+     * an implementation that drops it still gets abandoned on time, but its
+     * socket then stays open until the peer or the OS closes it.
+     */
+    readonly renew: (shutdownTime: string, signal?: AbortSignal) => Promise<void>;
+    /** Called once, when the renewed object turns out to be gone. */
+    readonly onGone: () => void;
+    /**
+     * Every renewal failure that is not "already gone". `@namzu/sandbox` has
+     * no logger of its own and reads none from module scope, so a diagnostic
+     * this package cannot print is handed to the caller that can.
+     */
+    readonly onRenewalError?: (error: unknown) => void;
+    /**
+     * Base interval between ticks. Defaults to half the TTL. Present so a
+     * test can drive many ticks in a few milliseconds without pretending a
+     * sub-second TTL is a realistic configuration.
+     */
+    readonly intervalMs?: number;
+    /**
+     * How long ONE renewal PATCH may take before it is abandoned and retried.
+     * Defaults to a quarter of the interval, capped at
+     * {@link MAX_RENEWAL_TIMEOUT_MS} — a fraction rather than the whole
+     * interval so that a stalled API server still leaves the loop several
+     * attempts inside the half-TTL of headroom.
+     */
+    readonly patchTimeoutMs?: number;
+    /** Deterministic jitter for tests. Defaults to `Math.random`. */
+    readonly random?: () => number;
+}
+export declare function jitteredInterval(baseMs: number, random: () => number): number;
+/**
+ * The renewal loop. Start it when the handle is handed out, stop it on
+ * `destroy()`. Both are idempotent.
+ */
+export declare class KubernetesLeaseRenewal {
+    private readonly options;
+    private timer;
+    private stopped;
+    private started;
+    private readonly baseIntervalMs;
+    private readonly patchTimeoutMs;
+    private readonly random;
+    constructor(options: LeaseRenewalOptions);
+    /**
+     * The loop is alive: it has been started and not stopped. Deliberately
+     * NOT "a timer is pending" — `tick()` clears the timer before it awaits,
+     * so a liveness check written that way reads false for the whole duration
+     * of an in-flight renewal and would quietly pass against a loop that had
+     * parked forever inside one.
+     */
+    get active(): boolean;
+    start(): void;
+    stop(): void;
+    private schedule;
+    /** Exposed for tests: one renewal attempt plus its scheduling decision. */
+    tick(): Promise<void>;
+}
+//# sourceMappingURL=lease.d.ts.map

package/dist/backends/kubernetes/lease.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAKH,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IACnC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7E,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IAClD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;CAC9B;AAaD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM,CAI7E;AAED;;;GAGG;AACH,qBAAa,sBAAsB;IAQtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAER,OAAO,EAAE,mBAAmB;IAQzD;;;;;;OAMG;IACH,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,KAAK,IAAI,IAAI;IAMb,IAAI,IAAI,IAAI;IAQZ,OAAO,CAAC,QAAQ;IAahB,2EAA2E;IACrE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA0B3B"}