@namzu/sandbox 13.0.0 → 14.0.0

package/dist/backends/kubernetes/sandbox.js

@@ -0,0 +1,299 @@
+/**
+ * The {@link Sandbox} a kubernetes acquire hands back: the SDK contract,
+ * served over the guest agent's TCP transport, with the lease that keeps the
+ * cluster from deleting the pod out from under a long run.
+ *
+ * Split out of `index.ts` because that file is about the CONTROL plane —
+ * claim, poll, address, release — and this one is about the DATA plane, and
+ * the two are read for different reasons.
+ *
+ * ## What it implements, and what it deliberately does not
+ *
+ * Implemented: `exec` (through the shared {@link RemoteExecutionController},
+ * so an `AbortSignal` terminates the guest process rather than abandoning
+ * the wait), `writeFile`, `readFile`, `listFiles`, `openTerminal`,
+ * `openTcpConnection`, `destroy`.
+ *
+ * Absent on purpose, because the SDK's contract says a backend that cannot
+ * honour an optional method must omit it rather than accept and ignore:
+ *
+ *  - `setNetworkPolicy` — egress here is a `NetworkPolicy` attached to the
+ *    pool's `SandboxTemplate`. There is no per-running-pod knob to turn, and
+ *    a policy accepted and not applied is worse than one never offered: the
+ *    caller stops looking.
+ *  - `spawnDetached` — the guest agent has no op that starts a process and
+ *    returns it running. A host asking for background jobs must be told no.
+ *  - `walkFiles` — not in this batch. A host that requires bounded search
+ *    refuses an absent method, which is the honest answer today.
+ *
+ * ## Terminals are owned
+ *
+ * `openTerminal` is only a compliant implementation if `destroy()` kills and
+ * awaits every terminal it returned, so open terminals are tracked and
+ * reaped before the object is released — the same thing the Firecracker
+ * backend does, for the same contract.
+ *
+ * ## Two terminal states, one `SandboxStatus`
+ *
+ * `SandboxStatus` has exactly four members and this change does not widen
+ * the SDK's union, so both ways a sandbox ends report `'destroyed'`. They
+ * are told apart by the error a later call throws:
+ * {@link KubernetesSandboxDestroyedError} (this host released it) and
+ * {@link KubernetesSandboxGoneError} (the cluster deleted it — the lease
+ * renewal found the object already gone).
+ */
+import { OperationDeadline } from '../readiness.js';
+import { RemoteCancellationUnknownError, } from '../remote-execution-controller.js';
+import { KubernetesLeaseRenewal } from './lease.js';
+/**
+ * How long a retirement triggered by an unconfirmed cancellation may spend
+ * deleting the object. Separate from every other clock on the path: the
+ * caller's own deadline has usually already expired by the time this runs,
+ * and reusing it would mean skipping teardown exactly when a command of
+ * unknown state is still out there.
+ */
+const RETIREMENT_TIMEOUT_MS = 15_000;
+/** Thrown by any operation on a sandbox this host already destroyed. */
+export class KubernetesSandboxDestroyedError extends Error {
+    operation;
+    sandboxName;
+    name = 'KubernetesSandboxDestroyedError';
+    constructor(operation, sandboxName) {
+        super(`kubernetes sandbox ${sandboxName} has been destroyed; ${operation}() cannot be admitted. Acquire a new sandbox — a destroyed one's pod, Service and claim are deleted and its agent address no longer resolves.`);
+        this.operation = operation;
+        this.sandboxName = sandboxName;
+    }
+}
+/**
+ * Thrown by any operation on a sandbox the CLUSTER removed while this
+ * handle still held it — the lease renewal PATCH came back 404/410. Distinct
+ * from {@link KubernetesSandboxDestroyedError} because nothing this host did
+ * caused it: the object expired, an operator deleted it, or the controller
+ * reaped it, and the actionable advice is different.
+ */
+export class KubernetesSandboxGoneError extends Error {
+    operation;
+    sandboxName;
+    name = 'KubernetesSandboxGoneError';
+    constructor(operation, sandboxName) {
+        super(`kubernetes sandbox ${sandboxName} no longer exists on the cluster; ${operation}() cannot be admitted. Its lease renewal found the object already deleted — it expired (spec.lifecycle.shutdownTime), an operator deleted it, or the controller reaped it. Nothing this handle can do brings it back; acquire a new sandbox.`);
+        this.operation = operation;
+        this.sandboxName = sandboxName;
+    }
+}
+function detectEnvironment() {
+    // The guest runs Linux; the enum describes the host-facing shape of the
+    // worker, not the isolation technology under it. Firecracker's guest
+    // reports the same for the same reason.
+    return 'linux-namespace';
+}
+/**
+ * Build the handle. It does NOT run the acquire-time privilege probe — that
+ * is `create()`'s job in `index.ts`, so that a refusal can destroy this
+ * object before any caller has a reference to it, and so this function stays
+ * usable by the workspace path that runs its own probe.
+ */
+export function buildKubernetesSandbox(options) {
+    // The cluster owns this name. Preserving it verbatim as the sandbox id —
+    // as the Firecracker backend preserves its orchestrator's — means a log
+    // line carrying an id is also a `kubectl get sandbox` argument.
+    const id = options.name;
+    const transport = options.transport;
+    let lifecycle = 'active';
+    let activeExecutions = 0;
+    let teardownPromise;
+    let teardownComplete = false;
+    let retirementPromise;
+    const terminals = new Set();
+    // No `renew` ⇒ no expiry to move ⇒ no loop. `stop()` on the undefined
+    // case is the caller's problem to not have, which is why every use below
+    // goes through `lease?.stop()`.
+    const renew = options.renew;
+    const ttlSeconds = options.ttlSeconds;
+    // The type above already pairs the two. This is the runtime half of the
+    // same rule, for a caller that reached here through a cast or from
+    // JavaScript: a lease stamping `now + 0` expires the moment it is written,
+    // and every tick would report success while the controller deleted the
+    // object underneath it.
+    if (renew !== undefined && (typeof ttlSeconds !== 'number' || ttlSeconds <= 0)) {
+        throw new Error(`kubernetes: sandbox ${options.name} was given a lease renewal with ttlSeconds ${String(ttlSeconds)}. A renewal re-stamps shutdownTime as now + ttlSeconds, so a zero or absent TTL stamps an expiry that has already passed and the object is reaped while the loop reports every tick a success. Pass renew and a positive ttlSeconds together, or neither — an object with no expiry (a persistent workspace) runs no renewal loop.`);
+    }
+    // `ttlSeconds === undefined` is unreachable once `renew` is defined — the
+    // throw above saw to that — and is written out anyway because it is what
+    // narrows the field to a number for the constructor below.
+    const lease = renew === undefined || ttlSeconds === undefined
+        ? undefined
+        : new KubernetesLeaseRenewal({
+            ttlSeconds,
+            renew,
+            onGone: () => {
+                // The object is gone; the pod behind the address went with it.
+                // Refuse every later call by name rather than let it dial into a
+                // connect timeout with nothing to explain it.
+                if (lifecycle === 'active')
+                    lifecycle = 'gone';
+            },
+            ...(options.onRenewalError !== undefined
+                ? { onRenewalError: options.onRenewalError }
+                : {}),
+            ...(options.leaseIntervalMs !== undefined ? { intervalMs: options.leaseIntervalMs } : {}),
+        });
+    lease?.start();
+    const assertAdmissible = (operation) => {
+        if (lifecycle === 'active')
+            return;
+        if (lifecycle === 'gone')
+            throw new KubernetesSandboxGoneError(operation, options.name);
+        throw new KubernetesSandboxDestroyedError(operation, options.name);
+    };
+    const teardown = (signal) => {
+        if (lifecycle === 'active')
+            lifecycle = 'retiring';
+        lease?.stop();
+        if (teardownComplete)
+            return Promise.resolve();
+        if (teardownPromise)
+            return teardownPromise;
+        const shared = options.release(signal).then(() => {
+            teardownComplete = true;
+            lifecycle = 'destroyed';
+        }, (error) => {
+            // A failed teardown must stay retryable; keeping the rejected
+            // promise would answer every later destroy() with the same
+            // stale failure.
+            if (teardownPromise === shared)
+                teardownPromise = undefined;
+            throw error;
+        });
+        teardownPromise = shared;
+        return shared;
+    };
+    /**
+     * A command whose cancellation the guest could not confirm may still be
+     * running in that pod, so the pod stops being reusable. Retire it and
+     * report whether the retirement landed, on the error the caller is about
+     * to receive.
+     */
+    const retire = () => {
+        if (lifecycle === 'active')
+            lifecycle = 'retiring';
+        retirementPromise ??= new OperationDeadline(RETIREMENT_TIMEOUT_MS, `kubernetes sandbox ${options.name} retirement`)
+            .run(async (signal) => await teardown(signal))
+            .then(() => ({ accepted: true }))
+            .catch((error) => ({
+            accepted: false,
+            error: error instanceof Error ? error : new Error(String(error)),
+        }));
+        return retirementPromise;
+    };
+    const runExecution = async (operation, run) => {
+        assertAdmissible(operation);
+        activeExecutions += 1;
+        try {
+            return await run();
+        }
+        catch (error) {
+            if (error instanceof RemoteCancellationUnknownError) {
+                error.retirement = await retire();
+            }
+            throw error;
+        }
+        finally {
+            activeExecutions = Math.max(0, activeExecutions - 1);
+        }
+    };
+    return {
+        id,
+        get status() {
+            // Four members, and no new one: a cluster-side disappearance and a
+            // host-side destroy both read as 'destroyed' here and are told
+            // apart by the error a later call throws.
+            if (lifecycle !== 'active')
+                return 'destroyed';
+            return activeExecutions > 0 ? 'busy' : 'ready';
+        },
+        rootDir: options.rootDir,
+        environment: detectEnvironment(),
+        async exec(command, argv, opts) {
+            return await runExecution('exec', async () => await transport.exec(command, argv, opts));
+        },
+        /**
+         * Every `tcp` request dials a fresh connection, so its envelope is
+         * also that connection's first, not-yet-authenticated frame and is
+         * bounded by the guest's pre-auth frame ceiling (8 MiB by default).
+         * The transport checks that BEFORE dialing and throws
+         * `AgentPreauthFrameTooLargeError` naming the limit; it is passed
+         * through unwrapped so a caller can catch that class and chunk,
+         * rather than having to pattern-match a message.
+         */
+        async writeFile(path, content) {
+            assertAdmissible('writeFile');
+            const buf = Buffer.isBuffer(content) ? content : Buffer.from(content, 'utf8');
+            await transport.writeFile(path, buf);
+        },
+        async readFile(path) {
+            assertAdmissible('readFile');
+            return await transport.readFile(path);
+        },
+        async openTerminal(terminalOptions) {
+            assertAdmissible('openTerminal');
+            const terminal = await transport.openTerminal(terminalOptions);
+            terminals.add(terminal);
+            void terminal.exited.finally(() => terminals.delete(terminal));
+            return terminal;
+        },
+        async openTcpConnection(connectOptions) {
+            assertAdmissible('openTcpConnection');
+            return await transport.openTcpConnection(connectOptions);
+        },
+        async listFiles(rootPath) {
+            return await runExecution('listFiles', async () => {
+                // Same wire as docker/aci/firecracker: `find -printf '%p\t%s\n'`,
+                // parsed line by line, with a non-zero exit (a root that does
+                // not exist yet) mapped to "empty" as the SDK contract asks.
+                const result = await transport.exec('find', [rootPath, '-type', 'f', '-printf', '%p\t%s\n']);
+                if (result.exitCode !== 0)
+                    return [];
+                const entries = [];
+                for (const rawLine of result.stdout.split('\n')) {
+                    if (!rawLine)
+                        continue;
+                    const tab = rawLine.indexOf('\t');
+                    if (tab < 0)
+                        continue;
+                    const filePath = rawLine.slice(0, tab);
+                    const size = Number.parseInt(rawLine.slice(tab + 1), 10);
+                    if (!filePath || !Number.isFinite(size))
+                        continue;
+                    entries.push({ path: filePath, size });
+                }
+                return entries;
+            });
+        },
+        async destroy(destroyOptions) {
+            if (retirementPromise) {
+                const observation = await retirementPromise;
+                if (observation.accepted)
+                    return;
+                retirementPromise = undefined;
+            }
+            // A terminal owns an interactive process tree in this pod. Stop and
+            // await every one before releasing the object, so the SDK's
+            // ownership contract is real rather than best-effort bookkeeping.
+            lifecycle = lifecycle === 'active' ? 'retiring' : lifecycle;
+            lease?.stop();
+            const activeTerminals = [...terminals];
+            for (const terminal of activeTerminals)
+                terminal.kill('SIGKILL');
+            await Promise.allSettled(activeTerminals.map((terminal) => terminal.exited));
+            terminals.clear();
+            // Deleting the claim cascades to the sandbox it adopted through the
+            // ownerReferences the controller re-parents on bind, so one DELETE
+            // retires the pod, the Service and the object. An object that is
+            // already gone counts as released — that is the state DELETE was
+            // asking for.
+            await teardown(destroyOptions?.signal);
+        },
+    };
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/backends/kubernetes/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAiBH,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EACN,8BAA8B,GAE9B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAGnD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAEpC,wEAAwE;AACxE,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAI/C;IACA;IAJQ,IAAI,GAAG,iCAAiC,CAAA;IAE1D,YACU,SAAiB,EACjB,WAAmB;QAE5B,KAAK,CACJ,sBAAsB,WAAW,wBAAwB,SAAS,+IAA+I,CACjN,CAAA;QALQ,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;IAK7B,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAI1C;IACA;IAJQ,IAAI,GAAG,4BAA4B,CAAA;IAErD,YACU,SAAiB,EACjB,WAAmB;QAE5B,KAAK,CACJ,sBAAsB,WAAW,qCAAqC,SAAS,8OAA8O,CAC7T,CAAA;QALQ,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;IAK7B,CAAC;CACD;AAgDD,SAAS,iBAAiB;IACzB,wEAAwE;IACxE,qEAAqE;IACrE,wCAAwC;IACxC,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiC;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAiB,CAAA;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAGnC,IAAI,SAAS,GAAc,QAAQ,CAAA;IACnC,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,IAAI,eAA0C,CAAA;IAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAC5B,IAAI,iBAAoE,CAAA;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAA;IAE5C,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,wEAAwE;IACxE,mEAAmE;IACnE,2EAA2E;IAC3E,uEAAuE;IACvE,wBAAwB;IACxB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CACd,uBAAuB,OAAO,CAAC,IAAI,8CAA8C,MAAM,CAAC,UAAU,CAAC,oUAAoU,CACva,CAAA;IACF,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,KAAK,GACV,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAC9C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,sBAAsB,CAAC;YAC3B,UAAU;YACV,KAAK;YACL,MAAM,EAAE,GAAG,EAAE;gBACZ,+DAA+D;gBAC/D,iEAAiE;gBACjE,8CAA8C;gBAC9C,IAAI,SAAS,KAAK,QAAQ;oBAAE,SAAS,GAAG,MAAM,CAAA;YAC/C,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAA;IACL,KAAK,EAAE,KAAK,EAAE,CAAA;IAEd,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACpD,IAAI,SAAS,KAAK,QAAQ;YAAE,OAAM;QAClC,IAAI,SAAS,KAAK,MAAM;YAAE,MAAM,IAAI,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACvF,MAAM,IAAI,+BAA+B,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,CAAC,MAAoB,EAAiB,EAAE;QACxD,IAAI,SAAS,KAAK,QAAQ;YAAE,SAAS,GAAG,UAAU,CAAA;QAClD,KAAK,EAAE,IAAI,EAAE,CAAA;QACb,IAAI,gBAAgB;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC9C,IAAI,eAAe;YAAE,OAAO,eAAe,CAAA;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1C,GAAG,EAAE;YACJ,gBAAgB,GAAG,IAAI,CAAA;YACvB,SAAS,GAAG,WAAW,CAAA;QACxB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YAClB,8DAA8D;YAC9D,2DAA2D;YAC3D,iBAAiB;YACjB,IAAI,eAAe,KAAK,MAAM;gBAAE,eAAe,GAAG,SAAS,CAAA;YAC3D,MAAM,KAAK,CAAA;QACZ,CAAC,CACD,CAAA;QACD,eAAe,GAAG,MAAM,CAAA;QACxB,OAAO,MAAM,CAAA;IACd,CAAC,CAAA;IAED;;;;;OAKG;IACH,MAAM,MAAM,GAAG,GAA0C,EAAE;QAC1D,IAAI,SAAS,KAAK,QAAQ;YAAE,SAAS,GAAG,UAAU,CAAA;QAClD,iBAAiB,KAAK,IAAI,iBAAiB,CAC1C,qBAAqB,EACrB,sBAAsB,OAAO,CAAC,IAAI,aAAa,CAC/C;aACC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC7C,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC;aACzC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;YAC3B,QAAQ,EAAE,KAAc;YACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAChE,CAAC,CAAC,CAAA;QACJ,OAAO,iBAAiB,CAAA;IACzB,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,EAAK,SAAiB,EAAE,GAAqB,EAAc,EAAE;QACtF,gBAAgB,CAAC,SAAS,CAAC,CAAA;QAC3B,gBAAgB,IAAI,CAAC,CAAA;QACrB,IAAI,CAAC;YACJ,OAAO,MAAM,GAAG,EAAE,CAAA;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;gBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;YAClC,CAAC;YACD,MAAM,KAAK,CAAA;QACZ,CAAC;gBAAS,CAAC;YACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;QACrD,CAAC;IACF,CAAC,CAAA;IAED,OAAO;QACN,EAAE;QACF,IAAI,MAAM;YACT,mEAAmE;YACnE,+DAA+D;YAC/D,0CAA0C;YAC1C,IAAI,SAAS,KAAK,QAAQ;gBAAE,OAAO,WAAW,CAAA;YAC9C,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;QAC/C,CAAC;QACD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,iBAAiB,EAAE;QAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;YAEzB,OAAO,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACzF,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;YACrD,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC7E,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAY;YAC1B,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC5B,OAAO,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,eAAoC;YACtD,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,eAAe,CAAC,CAAA;YAC9D,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACvB,KAAK,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC9D,OAAO,QAAQ,CAAA;QAChB,CAAC;QAED,KAAK,CAAC,iBAAiB,CACtB,cAAwC;YAExC,gBAAgB,CAAC,mBAAmB,CAAC,CAAA;YACrC,OAAO,MAAM,SAAS,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACzD,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAgB;YAC/B,OAAO,MAAM,YAAY,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;gBACjD,kEAAkE;gBAClE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;gBAC5F,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAA;gBACpC,MAAM,OAAO,GAAuB,EAAE,CAAA;gBACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,OAAO;wBAAE,SAAQ;oBACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;oBACjC,IAAI,GAAG,GAAG,CAAC;wBAAE,SAAQ;oBACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;oBACtC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBACxD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,SAAQ;oBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;gBACvC,CAAC;gBACD,OAAO,OAAO,CAAA;YACf,CAAC,CAAC,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,cAAsC;YACnD,IAAI,iBAAiB,EAAE,CAAC;gBACvB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAA;gBAC3C,IAAI,WAAW,CAAC,QAAQ;oBAAE,OAAM;gBAChC,iBAAiB,GAAG,SAAS,CAAA;YAC9B,CAAC;YACD,oEAAoE;YACpE,4DAA4D;YAC5D,kEAAkE;YAClE,SAAS,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3D,KAAK,EAAE,IAAI,EAAE,CAAA;YACb,MAAM,eAAe,GAAG,CAAC,GAAG,SAAS,CAAC,CAAA;YACtC,KAAK,MAAM,QAAQ,IAAI,eAAe;gBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAChE,MAAM,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;YAC5E,SAAS,CAAC,KAAK,EAAE,CAAA;YACjB,oEAAoE;YACpE,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,cAAc;YACd,MAAM,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACvC,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/backends/kubernetes/transport.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Host-side transport for the kubernetes backend's guest agent: the same
+ * `agent/agent.cjs` the Firecracker tier bakes into its golden image,
+ * reached over the pod network instead of a host-local vsock/unix socket.
+ *
+ * Every byte on the wire goes through {@link VsockAgentTransport}
+ * constructed with a `{ kind: 'tcp' }` handle (`../firecracker/transport.js`):
+ * the SAME per-call dial (fresh connection, no cached socket, no cached
+ * IP — a Service-FQDN host re-resolves on every call, so a resumed pod's
+ * new address costs nothing extra), the SAME 8-hex-length framing, and
+ * the SAME token-in-envelope credential. Nothing about the wire is
+ * reimplemented here.
+ *
+ * This module supplies its OWN {@link RemoteExecutionAdapter} to the
+ * shared {@link RemoteExecutionController} — a third adapter against the
+ * same controller, alongside `http-worker-client.ts` and
+ * `firecracker/transport.ts`, each of which does this independently — so
+ * it can report where an `exec()` call's wall time actually goes: the
+ * dial(s), the reserve round trip, the execute round trip, and the small
+ * amount of local bookkeeping after the peer's own work is done
+ * ("drain"). That attribution is the whole point of `onTiming`: the
+ * Firecracker relay path has a known, unexplained fixed cost, and the
+ * sub-second warm-acquire target this backend is judged against must be
+ * measured, not guessed at.
+ */
+import type { OpenTerminalOptions, SandboxExecOptions, SandboxExecResult, SandboxTcpConnectOptions, SandboxTcpConnection, TerminalSession } from '@namzu/sdk';
+import { type SandboxAgentHandle, type VsockTransportOptions } from '../firecracker/transport.js';
+/** The one {@link SandboxAgentHandle} arm this backend ever constructs. */
+export type KubernetesAgentHandle = Extract<SandboxAgentHandle, {
+    kind: 'tcp';
+}>;
+/**
+ * Thrown when the guest agent refuses a request because the handle's
+ * token does not match what the pod is bound to. Named distinctly from
+ * {@link RemoteProtocolError} so a caller can tell "this credential is
+ * wrong" (never going to succeed by retrying) from "the wire shape was
+ * unexpected".
+ */
+export declare class KubernetesAgentUnauthorizedError extends Error {
+    constructor(message?: string);
+}
+/**
+ * One `exec()` call's wall-time breakdown. Durations are NOT a partition
+ * of a single total — `reserveMs` and `executeMs` each include their OWN
+ * dial, which is also folded into `dialMs` — this is a diagnostic
+ * breakdown for attribution, not an accounting identity. Never carries a
+ * token, a command, its arguments, or any output.
+ */
+export interface KubernetesTransportTiming {
+    /** Total time spent establishing TCP connections for this call. */
+    readonly dialMs: number;
+    /** Time spent on the `reserve-execution` round trip (dial included). */
+    readonly reserveMs: number;
+    /** Time spent on the `execute` round trip (dial included). */
+    readonly executeMs: number;
+    /**
+     * Time between the execute round trip settling and `exec()` itself
+     * resolving — the shared controller's own post-execute bookkeeping
+     * (clearing timers, tearing down the observation race). Always small
+     * on the happy path; distinct from `executeMs` because it is spent
+     * locally, after the peer has nothing left to do.
+     */
+    readonly drainMs: number;
+}
+export interface KubernetesTransportOptions extends VsockTransportOptions {
+    /**
+     * Fires once per completed `exec()` call (success or failure) with
+     * the four phase durations above. The payload is exactly those four
+     * numbers — never the token, never a command, argv, or output.
+     */
+    readonly onTiming?: (timing: KubernetesTransportTiming) => void;
+}
+/**
+ * The kubernetes backend's dialable transport: a `tcp` handle plus a
+ * `RemoteExecutionAdapter` built from it, so `exec()` gets the same
+ * reserve-before-admission behaviour (cancellation, timeout ownership,
+ * "do not infer complete output on an ambiguous cancel") every other
+ * remote backend gets, while every network operation is delegated to
+ * {@link VsockAgentTransport} for the actual dial/frame/token work.
+ */
+export declare class KubernetesAgentTransport {
+    private readonly handle;
+    private readonly transportOptions;
+    private readonly onTiming?;
+    /** Simple pass-through operations share one transport instance. */
+    private readonly wire;
+    constructor(handle: KubernetesAgentHandle, options?: KubernetesTransportOptions);
+    /** Readiness probe — never requires a token; see `protocol.ts`. */
+    healthz(signal?: AbortSignal): Promise<boolean>;
+    /** Poll until `healthz` succeeds or the timeout elapses. */
+    waitForReady(timeoutMs: number, pollIntervalMs: number, signal?: AbortSignal): Promise<void>;
+    /**
+     * The raw `reserve-execution` primitive, exposed directly (rather than
+     * only reachable as a side effect of `exec()`) so the reservation
+     * round trip is independently observable and testable against the
+     * real guest.
+     */
+    reserve(signal?: AbortSignal): Promise<unknown>;
+    /**
+     * The raw `cancel-execution` primitive, exposed for the same reason
+     * {@link reserve} is: it is a control request with its own refusal
+     * semantics, and proving those against the real guest should not require
+     * driving a whole cancelled `exec()` to reach it.
+     */
+    cancel(executionId: string, signal?: AbortSignal): Promise<unknown>;
+    writeFile(path: string, content: Buffer): Promise<void>;
+    readFile(path: string): Promise<Buffer>;
+    openTerminal(options: OpenTerminalOptions): Promise<TerminalSession>;
+    openTcpConnection(options: SandboxTcpConnectOptions): Promise<SandboxTcpConnection>;
+    /**
+     * Run one command through a fresh, call-scoped adapter + controller.
+     * Fresh per call — not shared instance state — because
+     * {@link VsockAgentTransport} itself carries no cross-call connection
+     * state (it dials fresh every time), so building one per `exec()` is
+     * free and makes concurrent `exec()` calls on the same
+     * `KubernetesAgentTransport` correctly independent: each gets its own
+     * `onDial` closure and its own timing accumulator, with no shared
+     * mutable field for two in-flight calls to race on.
+     */
+    exec(command: string, argv?: string[], opts?: SandboxExecOptions): Promise<SandboxExecResult>;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/backends/kubernetes/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EACX,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,MAAM,YAAY,CAAA;AAGnB,OAAO,EAEN,KAAK,kBAAkB,EAEvB,KAAK,qBAAqB,EAC1B,MAAM,6BAA6B,CAAA;AAMpC,2EAA2E;AAC3E,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAAA;AAEhF;;;;;;GAMG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;gBAEzD,OAAO,SAA8F;CAKtG;AAiCD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACzC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,0BAA2B,SAAQ,qBAAqB;IACxE;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,yBAAyB,KAAK,IAAI,CAAA;CAC/D;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAuB;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAA6C;IACvE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAE9B,MAAM,EAAE,qBAAqB,EAAE,OAAO,GAAE,0BAA+B;IAQnF,mEAAmE;IAC7D,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrD,4DAA4D;IACtD,YAAY,CACjB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;OAKG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrD;;;;;OAKG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAQnE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIvC,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC;IAIpE,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAIzF;;;;;;;;;OASG;IACG,IAAI,CACT,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,EAAE,EACf,IAAI,CAAC,EAAE,kBAAkB,GACvB,OAAO,CAAC,iBAAiB,CAAC;CAgE7B"}

package/dist/backends/kubernetes/transport.js

@@ -0,0 +1,197 @@
+/**
+ * Host-side transport for the kubernetes backend's guest agent: the same
+ * `agent/agent.cjs` the Firecracker tier bakes into its golden image,
+ * reached over the pod network instead of a host-local vsock/unix socket.
+ *
+ * Every byte on the wire goes through {@link VsockAgentTransport}
+ * constructed with a `{ kind: 'tcp' }` handle (`../firecracker/transport.js`):
+ * the SAME per-call dial (fresh connection, no cached socket, no cached
+ * IP — a Service-FQDN host re-resolves on every call, so a resumed pod's
+ * new address costs nothing extra), the SAME 8-hex-length framing, and
+ * the SAME token-in-envelope credential. Nothing about the wire is
+ * reimplemented here.
+ *
+ * This module supplies its OWN {@link RemoteExecutionAdapter} to the
+ * shared {@link RemoteExecutionController} — a third adapter against the
+ * same controller, alongside `http-worker-client.ts` and
+ * `firecracker/transport.ts`, each of which does this independently — so
+ * it can report where an `exec()` call's wall time actually goes: the
+ * dial(s), the reserve round trip, the execute round trip, and the small
+ * amount of local bookkeeping after the peer's own work is done
+ * ("drain"). That attribution is the whole point of `onTiming`: the
+ * Firecracker relay path has a known, unexplained fixed cost, and the
+ * sub-second warm-acquire target this backend is judged against must be
+ * measured, not guessed at.
+ */
+import { VsockAgentTransport, } from '../firecracker/transport.js';
+import { RemoteExecutionController, } from '../remote-execution-controller.js';
+/**
+ * Thrown when the guest agent refuses a request because the handle's
+ * token does not match what the pod is bound to. Named distinctly from
+ * {@link RemoteProtocolError} so a caller can tell "this credential is
+ * wrong" (never going to succeed by retrying) from "the wire shape was
+ * unexpected".
+ */
+export class KubernetesAgentUnauthorizedError extends Error {
+    constructor(message = 'kubernetes tcp transport: the guest agent rejected this connection’s token (unauthorized)') {
+        super(message);
+        this.name = 'KubernetesAgentUnauthorizedError';
+    }
+}
+/** True for the wire shape `agent.cjs` sends when a token is rejected. */
+function isUnauthorized(response) {
+    if (!response || typeof response !== 'object')
+        return false;
+    const value = response;
+    return value.ok === false && value.error === 'unauthorized';
+}
+/**
+ * One framed control request, with the guest's `unauthorized` refusal
+ * turned into {@link KubernetesAgentUnauthorizedError}.
+ *
+ * BOTH control requests go through here — `reserve-execution` and
+ * `cancel-execution` — because the two are read by the same caller for
+ * opposite reasons and neither may mistake a refusal for a blip. The
+ * cancel path is the sharper of the two: {@link RemoteExecutionController}
+ * RETRIES a failed cancellation for its whole confirm window and then
+ * reports the cancellation UNCONFIRMED, which retires the sandbox. A
+ * rejected token read as a transport failure would therefore spend that
+ * window re-sending a request that can never succeed, and end by
+ * describing a wrong credential as an ambiguous outcome.
+ */
+async function requestChecked(wire, request, signal) {
+    const response = await wire.request(request, signal);
+    if (isUnauthorized(response))
+        throw new KubernetesAgentUnauthorizedError();
+    return response;
+}
+/**
+ * The kubernetes backend's dialable transport: a `tcp` handle plus a
+ * `RemoteExecutionAdapter` built from it, so `exec()` gets the same
+ * reserve-before-admission behaviour (cancellation, timeout ownership,
+ * "do not infer complete output on an ambiguous cancel") every other
+ * remote backend gets, while every network operation is delegated to
+ * {@link VsockAgentTransport} for the actual dial/frame/token work.
+ */
+export class KubernetesAgentTransport {
+    handle;
+    transportOptions;
+    onTiming;
+    /** Simple pass-through operations share one transport instance. */
+    wire;
+    constructor(handle, options = {}) {
+        const { onTiming, ...transportOptions } = options;
+        this.handle = handle;
+        this.transportOptions = transportOptions;
+        this.onTiming = onTiming;
+        this.wire = new VsockAgentTransport(handle, transportOptions);
+    }
+    /** Readiness probe — never requires a token; see `protocol.ts`. */
+    async healthz(signal) {
+        return await this.wire.healthz(signal);
+    }
+    /** Poll until `healthz` succeeds or the timeout elapses. */
+    async waitForReady(timeoutMs, pollIntervalMs, signal) {
+        return await this.wire.waitForReady(timeoutMs, pollIntervalMs, signal);
+    }
+    /**
+     * The raw `reserve-execution` primitive, exposed directly (rather than
+     * only reachable as a side effect of `exec()`) so the reservation
+     * round trip is independently observable and testable against the
+     * real guest.
+     */
+    async reserve(signal) {
+        return await requestChecked(this.wire, { op: 'reserve-execution' }, signal);
+    }
+    /**
+     * The raw `cancel-execution` primitive, exposed for the same reason
+     * {@link reserve} is: it is a control request with its own refusal
+     * semantics, and proving those against the real guest should not require
+     * driving a whole cancelled `exec()` to reach it.
+     */
+    async cancel(executionId, signal) {
+        return await requestChecked(this.wire, { op: 'cancel-execution', body: { executionId } }, signal);
+    }
+    async writeFile(path, content) {
+        return await this.wire.writeFile(path, content);
+    }
+    async readFile(path) {
+        return await this.wire.readFile(path);
+    }
+    async openTerminal(options) {
+        return await this.wire.openTerminal(options);
+    }
+    async openTcpConnection(options) {
+        return await this.wire.openTcpConnection(options);
+    }
+    /**
+     * Run one command through a fresh, call-scoped adapter + controller.
+     * Fresh per call — not shared instance state — because
+     * {@link VsockAgentTransport} itself carries no cross-call connection
+     * state (it dials fresh every time), so building one per `exec()` is
+     * free and makes concurrent `exec()` calls on the same
+     * `KubernetesAgentTransport` correctly independent: each gets its own
+     * `onDial` closure and its own timing accumulator, with no shared
+     * mutable field for two in-flight calls to race on.
+     */
+    async exec(command, argv, opts) {
+        let dialMs = 0;
+        let reserveMs = 0;
+        let executeMs = 0;
+        let executeSettledAt = 0;
+        const timedWire = new VsockAgentTransport(this.handle, {
+            ...this.transportOptions,
+            onDial: (ms) => {
+                dialMs += ms;
+            },
+        });
+        const adapter = {
+            label: 'kubernetes pod-network agent',
+            reserve: async (signal) => {
+                const startedAt = Date.now();
+                try {
+                    return await requestChecked(timedWire, { op: 'reserve-execution' }, signal);
+                }
+                finally {
+                    reserveMs += Date.now() - startedAt;
+                }
+            },
+            // Checked exactly like `reserve` — see `requestChecked`.
+            cancel: async (executionId, signal) => await requestChecked(timedWire, { op: 'cancel-execution', body: { executionId } }, signal),
+            execute: async (executionId, cmd, execArgv, execOpts, signal, context) => {
+                const startedAt = Date.now();
+                try {
+                    return await timedWire.executeStreamed({
+                        ...(executionId ? { executionId } : {}),
+                        command: cmd,
+                        args: execArgv ?? [],
+                        ...(execOpts?.cwd !== undefined ? { cwd: execOpts.cwd } : {}),
+                        ...(execOpts?.env !== undefined ? { env: execOpts.env } : {}),
+                        ...(execOpts?.timeout !== undefined ? { timeoutMs: execOpts.timeout } : {}),
+                        ...(context?.stdin !== undefined ? { stdin: context.stdin } : {}),
+                        ...(context?.maxOutputBytes !== undefined
+                            ? { maxOutputBytes: context.maxOutputBytes }
+                            : {}),
+                    }, execOpts, signal);
+                }
+                finally {
+                    executeMs += Date.now() - startedAt;
+                    executeSettledAt = Date.now();
+                }
+            },
+        };
+        const controller = new RemoteExecutionController(adapter);
+        try {
+            return await controller.exec(command, argv, opts);
+        }
+        finally {
+            this.onTiming?.({
+                dialMs,
+                reserveMs,
+                executeMs,
+                drainMs: executeSettledAt > 0 ? Date.now() - executeSettledAt : 0,
+            });
+        }
+    }
+}
+//# sourceMappingURL=transport.js.map

package/dist/backends/kubernetes/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAYH,OAAO,EAGN,mBAAmB,GAEnB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAEN,yBAAyB,GACzB,MAAM,mCAAmC,CAAA;AAK1C;;;;;;GAMG;AACH,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAC1D,YACC,OAAO,GAAG,2FAA2F;QAErG,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAA;IAC/C,CAAC;CACD;AAED,0EAA0E;AAC1E,SAAS,cAAc,CAAC,QAAiB;IACxC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3D,MAAM,KAAK,GAAG,QAA6C,CAAA;IAC3D,OAAO,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc,CAAA;AAC5D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,cAAc,CAC5B,IAAyB,EACzB,OAAqB,EACrB,MAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACpD,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,gCAAgC,EAAE,CAAA;IAC1E,OAAO,QAAQ,CAAA;AAChB,CAAC;AAmCD;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnB,MAAM,CAAuB;IAC7B,gBAAgB,CAAuB;IACvC,QAAQ,CAA8C;IACvE,mEAAmE;IAClD,IAAI,CAAqB;IAE1C,YAAY,MAA6B,EAAE,UAAsC,EAAE;QAClF,MAAM,EAAE,QAAQ,EAAE,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAA;QACjD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAA;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;IAC9D,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,OAAO,CAAC,MAAoB;QACjC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,YAAY,CACjB,SAAiB,EACjB,cAAsB,EACtB,MAAoB;QAEpB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;IACvE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QACjC,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAA;IAC5E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,MAAoB;QACrD,OAAO,MAAM,cAAc,CAC1B,IAAI,CAAC,IAAI,EACT,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EACjD,MAAM,CACN,CAAA;IACF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC5C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QAC1B,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC9C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAAiC;QACxD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAClD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;QAEzB,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,IAAI,SAAS,GAAG,CAAC,CAAA;QACjB,IAAI,SAAS,GAAG,CAAC,CAAA;QACjB,IAAI,gBAAgB,GAAG,CAAC,CAAA;QAExB,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE;YACtD,GAAG,IAAI,CAAC,gBAAgB;YACxB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE;gBACd,MAAM,IAAI,EAAE,CAAA;YACb,CAAC;SACD,CAAC,CAAA;QAEF,MAAM,OAAO,GAA0E;YACtF,KAAK,EAAE,8BAA8B;YACrC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBAC5B,IAAI,CAAC;oBACJ,OAAO,MAAM,cAAc,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAA;gBAC5E,CAAC;wBAAS,CAAC;oBACV,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;gBACpC,CAAC;YACF,CAAC;YACD,yDAAyD;YACzD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CACrC,MAAM,cAAc,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC;YAC3F,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;gBACxE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBAC5B,IAAI,CAAC;oBACJ,OAAO,MAAM,SAAS,CAAC,eAAe,CACrC;wBACC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvC,OAAO,EAAE,GAAG;wBACZ,IAAI,EAAE,QAAQ,IAAI,EAAE;wBACpB,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7D,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7D,GAAG,CAAC,QAAQ,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC3E,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjE,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS;4BACxC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;4BAC5C,CAAC,CAAC,EAAE,CAAC;qBACN,EACD,QAAQ,EACR,MAAM,CACN,CAAA;gBACF,CAAC;wBAAS,CAAC;oBACV,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;oBACnC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBAC9B,CAAC;YACF,CAAC;SACD,CAAA;QAED,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,CAAC;YACJ,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAClD,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM;gBACN,SAAS;gBACT,SAAS;gBACT,OAAO,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;aACjE,CAAC,CAAA;QACH,CAAC;IACF,CAAC;CACD"}