@namzu/sandbox 13.0.0 → 15.0.0

package/dist/backends/kubernetes/objects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,wCAAwC;AACxC,eAAO,MAAM,iBAAiB,oBAAoB,CAAA;AAClD,6EAA6E;AAC7E,eAAO,MAAM,4BAA4B,+BAA+B,CAAA;AACxE,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,YAAY,CAAA;AAE5C,oEAAoE;AACpE,eAAO,MAAM,eAAe,UAAU,CAAA;AAatC,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACvD;AAED,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CACpC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC9B,UAAU,EAAE,SAAS,mBAAmB,EAAE,GAAG,SAAS,EACtD,IAAI,EAAE,MAAM,GACV,OAAO,CAET;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAqB;IACrC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,GAAG,kBAAkB,GAAG,QAAQ,CAAA;IAClE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACzC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;IAC1C;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE;QAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAClD,CAAA;CACD;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACpD,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAC7B,CAAA;CACD;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,wBAAwB,CAAA;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,CAAA;CAC5C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAChD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAC1B,CAAA;IACD,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAC/B,CAAA;CACD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;QAC5B,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KACjC,CAAA;IACD,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,GAAG,WAAW,CAAA;IAChD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC7C,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;CACrE;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAA;CACvC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;CAC3C;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;QACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;QAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;KACrE,CAAA;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;QACrD;;;;;;;;;WASG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;QACpD;;;;;WAKG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;KAC1D,CAAA;CACD;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE;QAChB,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC1E,CAAA;CACD;AAED,6EAA6E;AAC7E,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAO1E;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;CACvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAS/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAGlE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,0BAA0B,8BAA8B,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,wCAAwC,+CAA+C,CAAA;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,2BAA2B,kCAAkC,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,gCAAgC,uCAAuC,CAAA;AA6BpF;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,kBAAkB,GAAG,MAAM,CAKvE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,KAAK,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IAClC;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CACjC;AAKD,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,GAAG,kBAAkB,CAgB1F;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG9F;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAErF;AAED,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAC9C,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,GAAG,WAAW,CAAA;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;CACzC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,GAAG,SAAS,kBAAkB,EAAE,CAoFjG;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CACnC,mBAAmB,EAAE,MAAM,GACzB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAElC;AAED,uDAAuD;AACvD,eAAO,MAAM,6BAA6B,sBAAsB,CAAA;AAChE,eAAO,MAAM,+BAA+B,OAAO,CAAA;AAEnD;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,cAAc,CAAA;AAC1D,eAAO,MAAM,iCAAiC,OAAO,CAAA;AAMrD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACxC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,GACvB,MAAM,CAIR;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gCAAgC,iCAAiC,CAAA;AAC9E,eAAO,MAAM,kCAAkC,OAAO,CAAA;AAEtD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACpB"}

package/dist/backends/kubernetes/objects.js

@@ -0,0 +1,518 @@
+/**
+ * Wire shapes and paths for the agent-sandbox CRDs this backend touches.
+ *
+ * Every field name here was read off the CRDs a real cluster serves —
+ * `kubectl get crd -o json` against agent-sandbox v1.0.2 on a kind cluster —
+ * and cross-checked against the upstream `sandbox_types.go` /
+ * `sandboxclaim_types.go` doc comments. Where the two disagree the served CRD
+ * wins, because it is what the API server validates against: the Go source on
+ * upstream main has already moved `Sandbox`'s `shutdownTime` /
+ * `shutdownPolicy` under a `lifecycle` block, and v1beta1 as served still
+ * carries them at the top of `spec`.
+ *
+ * The shapes are deliberately partial. This backend reads four fields out of a
+ * Sandbox status and writes three into a claim spec; typing the rest of a
+ * PodSpec would be a vendored copy of the core API that goes stale on its own
+ * schedule. A pod template read from a SandboxTemplate is carried through as
+ * an opaque record for exactly that reason — it is copied, never interpreted.
+ *
+ * Two groups, both `v1beta1` and both singular-versioned today:
+ *   - `agents.x-k8s.io`            → sandboxes
+ *   - `extensions.agents.x-k8s.io` → sandboxtemplates, sandboxwarmpools,
+ *                                    sandboxclaims
+ */
+import { createHash } from 'node:crypto';
+/** Group serving the `Sandbox` kind. */
+export const SANDBOX_API_GROUP = 'agents.x-k8s.io';
+/** Group serving `SandboxTemplate`, `SandboxWarmPool` and `SandboxClaim`. */
+export const SANDBOX_EXTENSIONS_API_GROUP = 'extensions.agents.x-k8s.io';
+/** The only version either group serves in agent-sandbox v1.0.2. */
+export const SANDBOX_API_VERSION = 'v1beta1';
+/** `status.conditions[].type` both kinds report readiness under. */
+export const READY_CONDITION = 'Ready';
+/**
+ * True only for an explicit `status: 'True'`. An absent condition, an
+ * `Unknown` and a `False` are all "not yet", never "assume so" — the
+ * controller writes `Unknown` while it is still deciding.
+ */
+export function isConditionTrue(conditions, type) {
+    return conditions?.some((c) => c.type === type && c.status === 'True') === true;
+}
+/** The pod's own address, whichever of the two fields this cluster fills. */
+export function readPodIP(pod) {
+    const status = pod?.status;
+    if (typeof status?.podIP === 'string' && status.podIP !== '')
+        return status.podIP;
+    for (const entry of status?.podIPs ?? []) {
+        if (typeof entry?.ip === 'string' && entry.ip !== '')
+            return entry.ip;
+    }
+    return undefined;
+}
+/**
+ * A pod whose uid is still worth binding to: not being deleted, and not in a
+ * phase it cannot leave.
+ *
+ * The case this exists for is resume. A resumed sandbox's pod keeps the
+ * SAME NAME and gets a new uid and a new IP, so while the outgoing pod is
+ * terminating a `GET` by that name answers with the pod on its way out, and a
+ * list by the sandbox's selector returns every pod still carrying its labels,
+ * that one included. Binding to the terminating pod's uid produces a token the
+ * new agent refuses, and the failure arrives as a flat `unauthorized` with
+ * nothing pointing at the race that caused it.
+ */
+export function isPodLive(pod) {
+    if (!pod?.metadata)
+        return false;
+    // `!= null`, not `!== undefined`: an explicit JSON null would otherwise
+    // read as "terminating" and make a perfectly healthy pod unbindable. The
+    // API server omits the field rather than nulling it, so this never fires
+    // against a real cluster — it costs nothing not to depend on that.
+    if (pod.metadata.deletionTimestamp != null)
+        return false;
+    const phase = pod.status?.phase;
+    return phase !== 'Succeeded' && phase !== 'Failed';
+}
+/**
+ * A pod whose containers have stopped: it is still an object, and nothing in
+ * it is executing any more.
+ *
+ * NOT the negation of {@link isPodLive}, and the gap between the two is the
+ * whole point. A terminating pod — `deletionTimestamp` set, phase still
+ * `Running` — is not live (never bind to it: its uid is about to stop being
+ * a valid token) and not stopped either (its process is still running, and on
+ * a workspace it is still writing to the caller's block device until it exits
+ * or `terminationGracePeriodSeconds` runs out). A suspend that treated the
+ * timestamp as "gone" would resolve mid-drain and promise a quiesced disk it
+ * had not waited for.
+ */
+export function isPodStopped(pod) {
+    const phase = pod?.status?.phase;
+    return phase === 'Succeeded' || phase === 'Failed';
+}
+/**
+ * Backend-owned pod label naming which `SandboxTemplate` a Sandbox's pod was
+ * built from.
+ *
+ * agent-sandbox's OWN template-adoption controller selects pods by a
+ * controller-owned label, `agents.x-k8s.io/sandbox-template-ref-hash` — but
+ * that label is written only onto a Sandbox ADOPTED out of a
+ * `SandboxWarmPool` (the controller re-parents ownership and re-labels on
+ * bind). A Sandbox this backend POSTs directly (the pool-less path in
+ * `index.ts`'s `buildSandboxBody`) is never adopted, so it never gets that
+ * label — a direct Sandbox's pod would carry nothing a `NetworkPolicy`
+ * could reliably select it by. This backend writes its own label instead, on
+ * every Sandbox it creates, pooled or direct, so `egress-policy.ts`'s
+ * translated `NetworkPolicy` has one selector that always matches.
+ *
+ * `namzu.ai` matches the published domain (`packages/cli/package.json`'s
+ * `homepage`); there is no pre-existing Kubernetes label or annotation
+ * prefix anywhere in this repo to follow instead — the closest existing
+ * convention, `NAMZU_AGENT_*` / `NAMZU_SANDBOX_*` env vars, is not a
+ * label-safe shape.
+ *
+ * W8's `SandboxTemplate` manifests MUST set this same label (value = the
+ * template's own name) on their `podTemplate.metadata.labels`, so a POOLED
+ * sandbox's pod carries it too — the pool's pods are built from that
+ * template's `podTemplate` directly, not through `buildSandboxBody`, so
+ * nothing here can put it there for them. Skipping that step means a
+ * translated `NetworkPolicy`'s `podSelector` matches only sandboxes this
+ * backend created directly and none of the pooled ones — see
+ * `docs/sdk/kubernetes-sandbox.md`'s egress section.
+ */
+export const SANDBOX_TEMPLATE_LABEL_KEY = 'sandbox.namzu.ai/template';
+/**
+ * Backend-owned annotation naming when a Sandbox's `spec.operatingMode` was
+ * last changed BY THIS BACKEND, RFC 3339.
+ *
+ * It exists because nothing already on the object answers the question, and
+ * an inventory that never wakes a workspace is the reason to ask it: a
+ * retention pass deleting the workspaces nobody has resumed for a month reads
+ * this and `metadata.creationTimestamp` and nothing else.
+ *
+ * The obvious candidate is the controller's own `Suspended` condition and its
+ * `lastTransitionTime`, and upstream's `sandbox_types.go` rules it out in the
+ * same breath it documents it: "the controller does not currently remove this
+ * condition when the Sandbox is resumed", so after a resume the condition is
+ * still True and its timestamp still names the suspend that preceded it. The
+ * `Ready` condition's timestamp is no better — it moves for every pod that
+ * comes and goes, a crash-restart included, and a workspace whose pod
+ * restarted has not changed operating mode at all.
+ *
+ * So the two patches that DO change the mode stamp the moment they were sent,
+ * and the value is exactly that: the host's clock at the moment it asked, not
+ * the cluster's at the moment it applied. It is an inventory column, never a
+ * lock or an ordering, and nothing in this backend reads it back to make a
+ * decision. A Sandbox whose mode has never been changed since it was created
+ * carries no annotation at all, and is reported without one rather than with
+ * a guess.
+ *
+ * Same prefix as {@link SANDBOX_TEMPLATE_LABEL_KEY}, for the same reason.
+ */
+export const OPERATING_MODE_CHANGED_AT_ANNOTATION_KEY = 'sandbox.namzu.ai/operating-mode-changed-at';
+/**
+ * Backend-owned annotation carrying the HOLDER EPOCH: a decimal integer the
+ * host raises whenever authority over this workspace moves to another
+ * process.
+ *
+ * A workspace id is a name, not a lock, and a host that drives one workspace
+ * from more than one process has to decide which of them may suspend, resume
+ * or delete it. Checking its own epoch and then calling `suspend()` does not
+ * close the race, because the write that follows is a separate request and
+ * the API server accepts it. So the epoch is stored HERE, on the object every
+ * lifecycle write targets, and every such write carries it as a condition in
+ * the same request — see {@link buildHolderEpochPatch}.
+ *
+ * The rule: a write carrying epoch `e` applies when the stored epoch is `<=
+ * e`, and sets the stored epoch to `e` in the same request. A stored epoch
+ * greater than `e` refuses it. An object with NO annotation reads as 0, so
+ * every workspace created before this existed accepts its first
+ * epoch-carrying write.
+ *
+ * It is the caller's number, never this backend's: nothing here invents,
+ * increments or persists an epoch of its own, and a call that passes none
+ * sends exactly the requests it always sent.
+ *
+ * Same prefix as {@link SANDBOX_TEMPLATE_LABEL_KEY} and
+ * {@link OPERATING_MODE_CHANGED_AT_ANNOTATION_KEY}, for the same reason.
+ */
+export const HOLDER_EPOCH_ANNOTATION_KEY = 'sandbox.namzu.ai/holder-epoch';
+/**
+ * Backend-owned annotation carrying a hash of the pod template a Sandbox was
+ * last built with.
+ *
+ * A Sandbox's `spec.podTemplate` is a COPY of the SandboxTemplate's, taken
+ * once, and the controller rebuilds every replacement pod from that copy
+ * rather than from the template — so a workspace kept for weeks runs the pod
+ * spec it was created with, and an edit to the template (a new image tag, a
+ * memory limit, a grace period, an env entry) reaches only workspaces created
+ * after it. Nothing on the object answers "is this copy still the template's
+ * current one": the two are separate objects with separate
+ * `resourceVersion`s, and comparing the templates field by field on every
+ * open would be a second, weaker copy of the overlay rules.
+ *
+ * So the value is a hash of exactly what was written: the template's
+ * `podTemplate` AFTER this backend's own overlays (the template label and the
+ * configured `runtimeClassName`), which is the object the Sandbox carries.
+ * Hashing before the overlays would report drift on every workspace whose
+ * RuntimeClass this backend chose.
+ *
+ * Written by the workspace paths only — the create POST and the refresh patch
+ * — and read back as `templateRevision` on a handle. A task sandbox is
+ * ephemeral and has nothing to drift from, so its create body is unchanged.
+ * A workspace created before this existed carries no annotation and reports
+ * `templateRevision: undefined`, which reads honestly as "unknown", never as
+ * "current".
+ *
+ * Same prefix as {@link SANDBOX_TEMPLATE_LABEL_KEY}, for the same reason.
+ */
+export const POD_TEMPLATE_HASH_ANNOTATION_KEY = 'sandbox.namzu.ai/pod-template-hash';
+/** Object keys in code-unit order, so the hash does not depend on a locale. */
+function compareKeys(left, right) {
+    if (left < right)
+        return -1;
+    return left > right ? 1 : 0;
+}
+/**
+ * The same JSON with its object keys sorted, recursively.
+ *
+ * `JSON.stringify` preserves insertion order, and the two pod templates this
+ * hash has to compare never have the same one: one comes back from the API
+ * server's own serialisation of a stored object and the other is built here
+ * by spreading a template's members into a fresh object. Without this, every
+ * comparison would report drift that does not exist.
+ */
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalJson);
+    if (typeof value !== 'object' || value === null)
+        return value;
+    const canonical = {};
+    for (const key of Object.keys(value).sort(compareKeys)) {
+        const member = value[key];
+        if (member === undefined)
+            continue;
+        canonical[key] = canonicalJson(member);
+    }
+    return canonical;
+}
+/**
+ * `sha256:<hex>` over the pod template, for
+ * {@link POD_TEMPLATE_HASH_ANNOTATION_KEY}.
+ *
+ * It is an identity, not a checksum of anything security-relevant: two hosts
+ * running the same release against the same template must compute the same
+ * string, and a template edit must change it. Nothing here compares it
+ * against a value an untrusted party chose.
+ */
+export function podTemplateHash(podTemplate) {
+    const digest = createHash('sha256')
+        .update(JSON.stringify(canonicalJson(podTemplate)))
+        .digest('hex');
+    return `sha256:${digest}`;
+}
+/**
+ * One JSON Pointer reference token (RFC 6901 §3): `~` becomes `~0` and `/`
+ * becomes `~1`, in that order — the reverse order would turn a literal `~1`
+ * into a slash.
+ *
+ * An annotation key always contains a `/` (`sandbox.namzu.ai/holder-epoch`),
+ * so the pointer to one is unusable without this.
+ */
+export function escapeJsonPointerSegment(token) {
+    return token.replace(/~/g, '~0').replace(/\//g, '~1');
+}
+/** Pointer to one annotation on an object's own metadata. */
+export function annotationPointer(key) {
+    return `/metadata/annotations/${escapeJsonPointerSegment(key)}`;
+}
+/** Decimal, no sign, no padding, no exponent — what this backend writes. */
+const HOLDER_EPOCH_PATTERN = /^(?:0|[1-9][0-9]*)$/;
+/** Read {@link HOLDER_EPOCH_ANNOTATION_KEY} off an object's metadata. */
+export function readHolderEpoch(meta) {
+    const annotations = meta?.annotations;
+    const resourceVersion = typeof meta?.resourceVersion === 'string' && meta.resourceVersion !== ''
+        ? meta.resourceVersion
+        : undefined;
+    const stored = annotations?.[HOLDER_EPOCH_ANNOTATION_KEY];
+    const base = {
+        hasAnnotations: annotations !== undefined,
+        ...(resourceVersion !== undefined ? { resourceVersion } : {}),
+    };
+    if (typeof stored !== 'string')
+        return { ...base, epoch: 0 };
+    if (!HOLDER_EPOCH_PATTERN.test(stored))
+        return { ...base, annotation: stored };
+    const parsed = Number(stored);
+    if (!Number.isSafeInteger(parsed))
+        return { ...base, annotation: stored };
+    return { ...base, epoch: parsed, annotation: stored };
+}
+/**
+ * Read {@link POD_TEMPLATE_HASH_ANNOTATION_KEY} off an object's metadata.
+ *
+ * Absent — an object created before this existed, or one an older release
+ * refreshed — is `undefined`, which reads as "unknown" everywhere it is
+ * consumed. It is deliberately never compared as an empty string: a
+ * revision nobody recorded is not a revision that differs.
+ */
+export function readPodTemplateHash(meta) {
+    const stored = meta?.annotations?.[POD_TEMPLATE_HASH_ANNOTATION_KEY];
+    return typeof stored === 'string' && stored !== '' ? stored : undefined;
+}
+/** A stored epoch of `epoch` or lower lets a write carrying `epoch` through. */
+export function holderEpochAllows(reading, epoch) {
+    return reading.epoch !== undefined && reading.epoch <= epoch;
+}
+/**
+ * The one conditional-write builder this backend has, and the only place a
+ * JSON Patch body is composed.
+ *
+ * Every clause is decided from ONE read, and the whole thing goes up as one
+ * request: the condition and the mutation are in the same body, so there is
+ * no window between checking and writing for another holder to fit into.
+ *
+ * Three shapes, decided by what that read saw:
+ *
+ *  - the object carries the epoch annotation ⇒ `test` it by its exact stored
+ *    string, then `add` the new value over it;
+ *  - the object carries annotations but not this one ⇒ `test`
+ *    `/metadata/resourceVersion` instead, then `add` the member;
+ *  - the object carries no `metadata.annotations` at all ⇒ the same
+ *    `resourceVersion` test, then `add` the map whole, because there is no
+ *    member to add one to.
+ *
+ * The `resourceVersion` fallback is the migration case and nothing more: it
+ * fires once, on a workspace created before this release, and from the first
+ * epoch write onwards the annotation is what is tested. That matters because
+ * a controller status write moves `resourceVersion` without touching the
+ * annotation, and under the annotation test those are simply not conditions
+ * this write is interested in.
+ *
+ * A call carrying NO epoch skips all three: it tests only what
+ * {@link HolderEpochPatchInput.tests} carries and writes no epoch annotation,
+ * which is how a workspace refresh conditions itself on `spec.operatingMode`
+ * without fencing a host that never asked for a fence.
+ *
+ * Every `test` precedes every mutation, which RFC 6902 requires of a
+ * condition: operations apply in order, so a `test` written after an `add`
+ * would be testing this patch's own work. Mutations go up in a fixed order —
+ * annotations, then `spec.podTemplate`, then `spec.operatingMode` — so the
+ * body a given input produces is one body and a test can assert it.
+ */
+export function buildHolderEpochPatch(input) {
+    const { reading, epoch } = input;
+    const epochPointer = annotationPointer(HOLDER_EPOCH_ANNOTATION_KEY);
+    const tests = [];
+    if (epoch === undefined) {
+        // Unfenced: the caller's own clauses are the whole condition, and an
+        // unconditional JSON patch is refused rather than sent. Every caller
+        // on this branch is conditioning on something — a refresh on
+        // `spec.operatingMode` — and one that passed nothing would be asking
+        // for a blind write in the one builder that exists to prevent them.
+        if ((input.tests ?? []).length === 0) {
+            throw new Error('kubernetes: cannot build a conditional patch that carries neither a holder epoch nor a test clause — there is nothing to condition the write on.');
+        }
+    }
+    else if (reading.annotation !== undefined) {
+        tests.push({ op: 'test', path: epochPointer, value: reading.annotation });
+    }
+    else if (reading.resourceVersion !== undefined) {
+        tests.push({ op: 'test', path: '/metadata/resourceVersion', value: reading.resourceVersion });
+    }
+    else {
+        // Unreachable from every call site here — each one builds from an
+        // object it just read, and the API server sets `resourceVersion` on
+        // every object it serves. It throws rather than sending an
+        // UNCONDITIONAL patch, because a fenced write that quietly stopped
+        // being fenced is the defect this whole path exists to prevent.
+        throw new Error('kubernetes: cannot build a holder-epoch patch from an object that carries neither the holder-epoch annotation nor a metadata.resourceVersion — there is nothing to condition the write on.');
+    }
+    tests.push(...(input.tests ?? []));
+    const mutations = [];
+    // Every annotation this body writes, in one place: the epoch when the
+    // write is fenced, the mode stamp when the mode moves, and whatever else
+    // the caller is landing atomically with them.
+    const annotations = {
+        ...(epoch !== undefined ? { [HOLDER_EPOCH_ANNOTATION_KEY]: String(epoch) } : {}),
+        ...(input.operatingModeChangedAt !== undefined
+            ? { [OPERATING_MODE_CHANGED_AT_ANNOTATION_KEY]: input.operatingModeChangedAt }
+            : {}),
+        ...input.annotations,
+    };
+    const keys = Object.keys(annotations);
+    if (keys.length > 0) {
+        if (!reading.hasAnnotations) {
+            // No member to add one to, so the map goes up whole — and a whole
+            // map REPLACES whatever is there, so this one operation is the only
+            // mutation in this builder that can erase another writer's work.
+            // The window is real: between the GET that saw no annotations and
+            // this patch, another process can stamp one without moving
+            // `spec.operatingMode` — a suspend carrying a holder epoch onto an
+            // already-Suspended object does exactly that — and an unconditional
+            // whole-map `add` would silently unfence the workspace it took.
+            // `resourceVersion` is what closes it. The fenced path already
+            // tests it on this branch (an object with no annotations has no
+            // epoch annotation to test); this adds the same clause for an
+            // UNFENCED caller, whose own clauses are about `spec` and say
+            // nothing about `metadata`.
+            if (!tests.some((test) => test.path === '/metadata/resourceVersion')) {
+                if (reading.resourceVersion === undefined) {
+                    throw new Error('kubernetes: cannot add a metadata.annotations map to an object that carries no metadata.resourceVersion — a whole-map write with nothing to condition it on would overwrite annotations written since the read.');
+                }
+                tests.push({
+                    op: 'test',
+                    path: '/metadata/resourceVersion',
+                    value: reading.resourceVersion,
+                });
+            }
+            mutations.push({ op: 'add', path: '/metadata/annotations', value: annotations });
+        }
+        else {
+            for (const key of keys) {
+                mutations.push({ op: 'add', path: annotationPointer(key), value: annotations[key] });
+            }
+        }
+    }
+    if (input.podTemplate !== undefined) {
+        mutations.push({ op: 'add', path: '/spec/podTemplate', value: input.podTemplate });
+    }
+    if (input.operatingMode !== undefined) {
+        mutations.push({ op: 'add', path: '/spec/operatingMode', value: input.operatingMode });
+    }
+    return [...tests, ...mutations];
+}
+/** `{ [SANDBOX_TEMPLATE_LABEL_KEY]: sandboxTemplateName }`, as a matchLabels-ready object. */
+export function sandboxTemplateLabel(sandboxTemplateName) {
+    return { [SANDBOX_TEMPLATE_LABEL_KEY]: sandboxTemplateName };
+}
+/** Core `NetworkPolicy` — a stock resource, no CRD. */
+export const CORE_NETWORK_POLICY_API_GROUP = 'networking.k8s.io';
+export const CORE_NETWORK_POLICY_API_VERSION = 'v1';
+/**
+ * Cilium's FQDN-capable policy CRD. Only reached when
+ * `KubernetesEgressConfig.engine` is explicitly `'cilium'` — see
+ * `egress-policy.ts`.
+ */
+export const CILIUM_NETWORK_POLICY_API_GROUP = 'cilium.io';
+export const CILIUM_NETWORK_POLICY_API_VERSION = 'v2';
+function segment(value) {
+    return encodeURIComponent(value);
+}
+export function claimCollectionPath(namespace) {
+    return `/apis/${SANDBOX_EXTENSIONS_API_GROUP}/${SANDBOX_API_VERSION}/namespaces/${segment(namespace)}/sandboxclaims`;
+}
+export function claimPath(namespace, name) {
+    return `${claimCollectionPath(namespace)}/${segment(name)}`;
+}
+/** The claims collection, narrowed to a `labelSelector` — same shape as {@link podListPath}. */
+export function claimListPath(namespace, labelSelector) {
+    return `${claimCollectionPath(namespace)}?labelSelector=${encodeURIComponent(labelSelector)}`;
+}
+export function warmPoolPath(namespace, name) {
+    return `/apis/${SANDBOX_EXTENSIONS_API_GROUP}/${SANDBOX_API_VERSION}/namespaces/${segment(namespace)}/sandboxwarmpools/${segment(name)}`;
+}
+export function sandboxCollectionPath(namespace) {
+    return `/apis/${SANDBOX_API_GROUP}/${SANDBOX_API_VERSION}/namespaces/${segment(namespace)}/sandboxes`;
+}
+export function sandboxPath(namespace, name) {
+    return `${sandboxCollectionPath(namespace)}/${segment(name)}`;
+}
+export function sandboxTemplatePath(namespace, name) {
+    return `/apis/${SANDBOX_EXTENSIONS_API_GROUP}/${SANDBOX_API_VERSION}/namespaces/${segment(namespace)}/sandboxtemplates/${segment(name)}`;
+}
+/**
+ * The PVC the controller creates for one `volumeClaimTemplates` entry:
+ * `<entry name>-<sandbox name>`, in the Sandbox's own namespace.
+ *
+ * Written out here rather than derived at each call site because it is a
+ * NAME the controller owns, not one this backend chooses — a release that
+ * changes it breaks every read of it at once, and the one place to notice
+ * that is a function whose whole body is the convention.
+ */
+export function persistentVolumeClaimPath(namespace, sandboxName, claimTemplateName) {
+    return `/api/v1/namespaces/${segment(namespace)}/persistentvolumeclaims/${segment(`${claimTemplateName}-${sandboxName}`)}`;
+}
+export function podPath(namespace, name) {
+    return `/api/v1/namespaces/${segment(namespace)}/pods/${segment(name)}`;
+}
+/** The whole pods collection, unfiltered. Read by `readKubernetesTaskCapacity` alone. */
+export function podCollectionPath(namespace) {
+    return `/api/v1/namespaces/${segment(namespace)}/pods`;
+}
+export function podListPath(namespace, labelSelector) {
+    return `/api/v1/namespaces/${segment(namespace)}/pods?labelSelector=${encodeURIComponent(labelSelector)}`;
+}
+export function networkPolicyCollectionPath(namespace) {
+    return `/apis/${CORE_NETWORK_POLICY_API_GROUP}/${CORE_NETWORK_POLICY_API_VERSION}/namespaces/${segment(namespace)}/networkpolicies`;
+}
+export function networkPolicyPath(namespace, name) {
+    return `${networkPolicyCollectionPath(namespace)}/${segment(name)}`;
+}
+export function ciliumNetworkPolicyCollectionPath(namespace) {
+    return `/apis/${CILIUM_NETWORK_POLICY_API_GROUP}/${CILIUM_NETWORK_POLICY_API_VERSION}/namespaces/${segment(namespace)}/ciliumnetworkpolicies`;
+}
+export function ciliumNetworkPolicyPath(namespace, name) {
+    return `${ciliumNetworkPolicyCollectionPath(namespace)}/${segment(name)}`;
+}
+/**
+ * Core Kubernetes' own admission-policy resources — `ValidatingAdmissionPolicy`
+ * and its binding, both CLUSTER-scoped and both stock since v1.30, so a
+ * cluster that serves this group needs nothing installed.
+ *
+ * Read by exactly one caller: the per-sandbox policy fence
+ * (`per-sandbox-policy.ts`), which refuses to write a `CiliumNetworkPolicy`
+ * at all unless an operator has applied the policy that bounds what this
+ * host may write. Never written by this backend — the fence is the operator's
+ * object, reviewed by whoever has cluster-admin, and a host that could create
+ * its own fence would not have one.
+ */
+export const ADMISSION_REGISTRATION_API_GROUP = 'admissionregistration.k8s.io';
+export const ADMISSION_REGISTRATION_API_VERSION = 'v1';
+export function validatingAdmissionPolicyPath(name) {
+    return `/apis/${ADMISSION_REGISTRATION_API_GROUP}/${ADMISSION_REGISTRATION_API_VERSION}/validatingadmissionpolicies/${segment(name)}`;
+}
+export function validatingAdmissionPolicyBindingPath(name) {
+    return `/apis/${ADMISSION_REGISTRATION_API_GROUP}/${ADMISSION_REGISTRATION_API_VERSION}/validatingadmissionpolicybindings/${segment(name)}`;
+}
+//# sourceMappingURL=objects.js.map

package/dist/backends/kubernetes/objects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"objects.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAA;AAClD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,4BAA4B,CAAA;AACxE,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAA;AAE5C,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAA;AAuDtC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC9B,UAAsD,EACtD,IAAY;IAEZ,OAAO,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,IAAI,CAAA;AAChF,CAAC;AAqPD,6EAA6E;AAC7E,MAAM,UAAU,SAAS,CAAC,GAA4B;IACrD,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,CAAA;IAC1B,IAAI,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAA;IACjF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,OAAO,KAAK,EAAE,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,EAAE,CAAA;IACtE,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,GAA4B;IACrD,IAAI,CAAC,GAAG,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAA;IAChC,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,IAAI,IAAI;QAAE,OAAO,KAAK,CAAA;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAA;IAC/B,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,GAA4B;IACxD,MAAM,KAAK,GAAG,GAAG,EAAE,MAAM,EAAE,KAAK,CAAA;IAChC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAA2B,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,4CAA4C,CAAA;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,oCAAoC,CAAA;AAEpF,+EAA+E;AAC/E,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC/C,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,CAAC,CAAC,CAAA;IAC3B,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,SAAS,GAA4B,EAAE,CAAA;IAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACnF,MAAM,MAAM,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAQ;QAClC,SAAS,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,WAA+B;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;SAClD,MAAM,CAAC,KAAK,CAAC,CAAA;IACf,OAAO,UAAU,MAAM,EAAE,CAAA;AAC1B,CAAC;AAuBD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACrD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AACtD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC5C,OAAO,yBAAyB,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAA;AAChE,CAAC;AA0BD,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAElD,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,IAAsC;IACrE,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,CAAA;IACrC,MAAM,eAAe,GACpB,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,EAAE;QACvE,CAAC,CAAC,IAAI,CAAC,eAAe;QACtB,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC,2BAA2B,CAAC,CAAA;IACzD,MAAM,IAAI,GAAG;QACZ,cAAc,EAAE,WAAW,KAAK,SAAS;QACzC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAA;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IAC5D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACzE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAsC;IACzE,MAAM,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,gCAAgC,CAAC,CAAA;IACpE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AACxE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,OAA2B,EAAE,KAAa;IAC3E,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;AAC7D,CAAC;AAyDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IACjE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAChC,MAAM,YAAY,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,CAAA;IACnE,MAAM,KAAK,GAAyB,EAAE,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,qEAAqE;QACrE,qEAAqE;QACrE,6DAA6D;QAC7D,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACd,kJAAkJ,CAClJ,CAAA;QACF,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAC1E,CAAC;SAAM,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IAC9F,CAAC;SAAM,CAAC;QACP,kEAAkE;QAClE,oEAAoE;QACpE,2DAA2D;QAC3D,mEAAmE;QACnE,gEAAgE;QAChE,MAAM,IAAI,KAAK,CACd,4LAA4L,CAC5L,CAAA;IACF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;IAElC,MAAM,SAAS,GAAyB,EAAE,CAAA;IAC1C,sEAAsE;IACtE,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,WAAW,GAA2B;QAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,sBAAsB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE,CAAC,wCAAwC,CAAC,EAAE,KAAK,CAAC,sBAAsB,EAAE;YAC9E,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,KAAK,CAAC,WAAW;KACpB,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC7B,kEAAkE;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,kEAAkE;YAClE,2DAA2D;YAC3D,mEAAmE;YACnE,oEAAoE;YACpE,gEAAgE;YAChE,+DAA+D;YAC/D,gEAAgE;YAChE,8DAA8D;YAC9D,8DAA8D;YAC9D,4BAA4B;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,2BAA2B,CAAC,EAAE,CAAC;gBACtE,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,IAAI,KAAK,CACd,iNAAiN,CACjN,CAAA;gBACF,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,OAAO,CAAC,eAAe;iBAC9B,CAAC,CAAA;YACH,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QACjF,CAAC;aAAM,CAAC;YACP,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrF,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,SAAS,CAAC,CAAA;AAChC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CACnC,mBAA2B;IAE3B,OAAO,EAAE,CAAC,0BAA0B,CAAC,EAAE,mBAAmB,EAAE,CAAA;AAC7D,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAA;AAChE,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAA;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAA;AAC1D,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAA;AAErD,SAAS,OAAO,CAAC,KAAa;IAC7B,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACpD,OAAO,SAAS,4BAA4B,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAA;AACrH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,IAAY;IACxD,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,aAAqB;IACrE,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,kBAAkB,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAA;AAC9F,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,IAAY;IAC3D,OAAO,SAAS,4BAA4B,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACzI,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACtD,OAAO,SAAS,iBAAiB,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,YAAY,CAAA;AACtG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,IAAY;IAC1D,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IAClE,OAAO,SAAS,4BAA4B,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACzI,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACxC,SAAiB,EACjB,WAAmB,EACnB,iBAAyB;IAEzB,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,2BAA2B,OAAO,CAChF,GAAG,iBAAiB,IAAI,WAAW,EAAE,CACrC,EAAE,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,IAAY;IACtD,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACxE,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAClD,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,OAAO,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,aAAqB;IACnE,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,uBAAuB,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAA;AAC1G,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC5D,OAAO,SAAS,6BAA6B,IAAI,+BAA+B,eAAe,OAAO,CAAC,SAAS,CAAC,kBAAkB,CAAA;AACpI,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,IAAY;IAChE,OAAO,GAAG,2BAA2B,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,SAAiB;IAClE,OAAO,SAAS,+BAA+B,IAAI,iCAAiC,eAAe,OAAO,CAAC,SAAS,CAAC,wBAAwB,CAAA;AAC9I,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,IAAY;IACtE,OAAO,GAAG,iCAAiC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,8BAA8B,CAAA;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAA;AAEtD,MAAM,UAAU,6BAA6B,CAAC,IAAY;IACzD,OAAO,SAAS,gCAAgC,IAAI,kCAAkC,gCAAgC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACtI,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,IAAY;IAChE,OAAO,SAAS,gCAAgC,IAAI,kCAAkC,sCAAsC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC5I,CAAC"}