@namzu/sandbox 13.0.0 → 15.0.0

package/dist/index.d.ts

@@ -34,10 +34,60 @@
  * scheduler, not a scheduler.
  */
 import type { ContainerSandboxLayout, Sandbox, SandboxProvider } from '@namzu/sdk';
+import type { KubernetesEgressConfig } from './backends/kubernetes/egress-policy.js';
+import { type KubernetesAgentAddressMode, type KubernetesClusterAccess, type KubernetesReadTaskCapacityOptions, type KubernetesReleaseTaskSandboxesOptions, type KubernetesTaskCapacity } from './backends/kubernetes/index.js';
+import type { KubernetesIngressConfig } from './backends/kubernetes/ingress-policy.js';
+import { type KubernetesWorkspace, type KubernetesWorkspaceOptions, type KubernetesWorkspaceSummary, type KubernetesWorkspaceSuspendOptions, type KubernetesWorkspaceTransitionOptions } from './backends/kubernetes/workspace.js';
 export type { ContainerSandboxLayout, ContainerSandboxLayoutMount, ContainerSandboxMountSource, ContainerSandboxSkillMount, ResolvedContainerSandboxLayout, } from '@namzu/sdk';
 export { SANDBOX_DEFAULT_OUTPUTS_PATH, SANDBOX_DEFAULT_SKILLS_PARENT, SANDBOX_DEFAULT_TOOL_RESULTS_PATH, SANDBOX_DEFAULT_TRANSCRIPTS_PATH, SANDBOX_DEFAULT_UPLOADS_PATH, } from '@namzu/sdk';
 export type { FirecrackerBackendInternalConfig, OrchestratorTokenProvider, } from './backends/firecracker/index.js';
-export { FIRECRACKER_AGENT_PROTOCOL_VERSION, type SandboxAgentHandle, type VsockTransportOptions, VsockAgentTransport, } from './backends/firecracker/transport.js';
+export { AgentDialFailedError, AgentPreauthFrameTooLargeError, AgentReadFileStreamUnsupportedError, AgentWriteFileTooLargeError, DEFAULT_MAX_WRITE_FILE_BYTES, FIRECRACKER_AGENT_PROTOCOL_VERSION, GUEST_FRAME_LIMIT_BYTES, type SandboxAgentHandle, TCP_PREAUTH_FRAME_LIMIT_BYTES, type VsockTransportOptions, VsockAgentTransport, } from './backends/firecracker/transport.js';
+export { WRITE_FILE_PARTS_FEATURE, type WriteFilePart, } from './backends/firecracker/protocol.js';
+export { MIN_STREAM_HEARTBEAT_MS, STREAM_HEARTBEAT_FEATURE, STREAM_HEARTBEAT_MAX_ECHO_FACTOR, STREAM_HEARTBEAT_MISS_LIMIT, type StreamHeartbeat, } from './backends/firecracker/protocol.js';
+export { READ_FILE_STREAM_FEATURE, type ReadFileStreamEvent, type ReadFileStreamRequest, } from './backends/firecracker/protocol.js';
+export type { KubernetesAgentAddressMode, KubernetesClusterAccess, } from './backends/kubernetes/index.js';
+export type { EgressProfileLabel, KubernetesCiliumDnsNarrowing, KubernetesCiliumEgressNarrowing, KubernetesEgressConfig, KubernetesEgressEngine, KubernetesEgressPolicy, KubernetesEgressVerification, KubernetesOnlyEgressPolicy, KubernetesPerSandboxEgressConfig, } from './backends/kubernetes/egress-policy.js';
+export { KubernetesPerSandboxEgressConfigError } from './backends/kubernetes/egress-policy.js';
+export { KubernetesWorkspacePerSandboxEgressConfigError } from './backends/kubernetes/egress-policy.js';
+export { DEFAULT_PER_SANDBOX_EGRESS_LABEL_KEY } from './backends/kubernetes/egress-policy.js';
+export { KubernetesAdmissionFenceMissingError, KubernetesAdmissionFenceUnreadableError, KubernetesNetworkPolicyHostError, KubernetesOwnerUidMissingError, PER_SANDBOX_POLICY_NAME_PREFIX, } from './backends/kubernetes/per-sandbox-policy.js';
+export { DEFAULT_EGRESS_PROFILE_LABEL_KEY } from './backends/kubernetes/egress-policy.js';
+export type { EgressPolicyRefusal, EgressPolicyVerdict, ExaminedEgressPolicy, } from './backends/kubernetes/egress-policy.js';
+export { KubernetesEgressNarrowingUnsupportedError, KubernetesEgressPolicyConfigError, KubernetesEgressPolicyUnionError, } from './backends/kubernetes/egress-policy.js';
+export { KubernetesEgressProfileConfigError, KubernetesPodLabelNotObservedError, KubernetesPodLabelsRejectedError, } from './backends/kubernetes/egress-policy.js';
+export type { ExaminedIngressPolicy, IngressPolicyRefusal, IngressPolicyVerdict, KubernetesIngressConfig, KubernetesIngressEngine, 
+/** @deprecated Renamed to `UnreadPolicySource`; both checks report it. */
+UnreadIngressPolicySource, UnreadPolicySource, } from './backends/kubernetes/ingress-policy.js';
+export { KubernetesIngressPolicyError } from './backends/kubernetes/ingress-policy.js';
+export { KubernetesPrivilegeProbeError, type PrivilegeProbeFailure, type ProcStatusPrivileges, } from './backends/kubernetes/privilege-probe.js';
+export { KubernetesSandboxDestroyedError, KubernetesSandboxGoneError, } from './backends/kubernetes/sandbox.js';
+export { KubernetesAgentAddressUnresolvableError, KubernetesAgentRetiringError, KubernetesAgentUnauthorizedError, } from './backends/kubernetes/transport.js';
+export type { KubernetesAttachExecutionOptions, KubernetesAttachRefusal, KubernetesDetachedExecOptions, } from './backends/kubernetes/transport.js';
+export { KubernetesExecutionAttachUnsupportedError, KubernetesExecutionDetachedError, KubernetesExecutionNotAttachableError, } from './backends/kubernetes/transport.js';
+export type { KubernetesAttachTerminalOptions, KubernetesOpenTerminalOptions, KubernetesReadSessionOptions, KubernetesSessionOutput, KubernetesSessionRefusal, KubernetesSessionSummary, KubernetesSessionTerminal, KubernetesStartDetachedOptions, KubernetesWorkspaceTerminal, } from './backends/kubernetes/transport.js';
+export { KubernetesSessionRefusedError, KubernetesSessionsUnsupportedError, } from './backends/kubernetes/transport.js';
+export { AgentSessionDetachedError } from './backends/firecracker/transport.js';
+export { SESSIONS_FEATURE, type SessionDetachReason, type SessionKind, type SessionState, } from './backends/firecracker/protocol.js';
+export type { KubernetesQuiesceOptions, KubernetesWorkspaceQuiesceRequest, } from './backends/kubernetes/workspace.js';
+export type { KubernetesQuiesceReport } from './backends/kubernetes/transport.js';
+export { KubernetesQuiesceUnconfirmedError, KubernetesQuiesceUnsupportedError, } from './backends/kubernetes/transport.js';
+export { QUIESCE_FEATURE, type QuiesceScope, type QuiescedProcess, } from './backends/firecracker/protocol.js';
+export type { KubernetesFlushOptions, KubernetesWorkspaceFlushRequest, } from './backends/kubernetes/workspace.js';
+export type { KubernetesFlushReport } from './backends/kubernetes/transport.js';
+export { KubernetesFlushUnconfirmedError, KubernetesFlushUnreachableError, KubernetesFlushUnsupportedError, } from './backends/kubernetes/transport.js';
+export { FLUSH_FEATURE } from './backends/firecracker/protocol.js';
+export { DEFAULT_API_REQUEST_TIMEOUT_MS, KubernetesApiError, type KubernetesApiFailureTransport, KubernetesApiTimeoutError, type KubernetesHttpMethod, KubernetesPatchNotAppliedError, MIN_API_REQUEST_TIMEOUT_MS, } from './backends/kubernetes/k8s-client.js';
+export { KubernetesAlreadyGoneError, KubernetesConflictError, KubernetesCredentialError, } from './backends/kubernetes/k8s-client.js';
+export { KubernetesAcquireError, type KubernetesAcquireFailureReason, ReadinessPollTimeout, TERMINAL_CLAIM_REASONS, } from './backends/kubernetes/index.js';
+export { KubernetesEgressPolicyMismatchError, KubernetesEgressPolicyNotAppliedError, KubernetesUnenforceableEgressPolicyError, } from './backends/kubernetes/egress-policy.js';
+/** Default `KubernetesBackendConfig.streamHeartbeatMs` — see there. */
+export { DEFAULT_STREAM_HEARTBEAT_MS } from './backends/kubernetes/index.js';
+export type { KubernetesReadTaskCapacityOptions, KubernetesReleaseTaskSandboxesOptions, KubernetesTaskCapacity, } from './backends/kubernetes/index.js';
+export { KUBERNETES_CLAIMANT_RBAC_RULES, type KubernetesRbacRule, type KubernetesRbacVerb, } from './backends/kubernetes/rbac.js';
+export type { KubernetesKillSessionOptions, KubernetesWorkspace, KubernetesWorkspaceAgentState, KubernetesWorkspaceCancellationNotice, KubernetesWorkspaceDestroyOptions, KubernetesWorkspaceOptions, KubernetesWorkspaceOrigin, KubernetesWorkspaceStartFailurePolicy, KubernetesWorkspaceSummary, KubernetesWorkspaceSuspendOptions, KubernetesWorkspaceSuspensionNotice, KubernetesWorkspaceTransitionOptions, } from './backends/kubernetes/workspace.js';
+export type { KubernetesGuestEvidence, KubernetesGuestRestart, KubernetesGuestRestartReason, KubernetesWorkspaceIdentity, } from './backends/kubernetes/identity.js';
+export { KubernetesWorkspaceGuestGoneError, KubernetesWorkspaceReplacedError, } from './backends/kubernetes/identity.js';
+export { KubernetesWorkspaceDiskError, KubernetesWorkspaceMismatchError, KubernetesWorkspacePreconditionError, KubernetesWorkspaceSuspendTimeoutError, KubernetesWorkspaceSuspendedError, } from './backends/kubernetes/workspace.js';
 /**
  * Top-level sandbox tier, and the trust boundary it buys:
  *
@@ -65,7 +115,7 @@ export type SandboxTier = 'container' | 'microvm';
  * tier has its own configuration shape — picking a tier picks the
  * shape automatically via TS narrowing.
  */
-export type SandboxBackendConfig = ContainerBackendConfig | ACIStandbyPoolBackendConfig | MicroVMBackendConfig;
+export type SandboxBackendConfig = ContainerBackendConfig | ACIStandbyPoolBackendConfig | MicroVMBackendConfig | KubernetesBackendConfig;
 /**
  * Azure Container Instances Standby Pool backend. Container tier,
  * managed-microvm-ish: every claim is a fresh ACI container group
@@ -316,6 +366,199 @@ export interface AgentSnapshotRef {
     readonly agentId: string;
     readonly version: string;
 }
+/**
+ * `microvm` tier, against a Kubernetes cluster running the agent-sandbox
+ * controller (kubernetes-sigs/agent-sandbox) with a VM-isolating
+ * RuntimeClass such as Kata.
+ *
+ * `microvm` because the tier names the strength of the boundary rather than
+ * the orchestrator behind it: a pod scheduled onto a Kata RuntimeClass runs
+ * in a hardware-virtualized guest, and the same field on the same tier is how
+ * a host says "give me a VM, I do not care who starts it".
+ *
+ * Sandboxes are claimed out of a `SandboxWarmPool` when {@link warmPoolName}
+ * names one, which is what makes the acquire sub-second; without it every
+ * create is a `Sandbox` built from {@link sandboxTemplateName}'s podTemplate
+ * and pays a full pod start. This package speaks the API server with bare
+ * `fetch` and carries no Kubernetes client dependency: credentials arrive
+ * through {@link access}, and kubeconfig parsing (context merging,
+ * exec credential plugins) stays in the host that owns it.
+ */
+export interface KubernetesBackendConfig {
+    readonly tier: 'microvm';
+    readonly service: 'kubernetes';
+    /** Namespace the claims, sandboxes and their pods live in. */
+    readonly namespace: string;
+    /**
+     * How to reach the API server. `{ inCluster: true }` reads the projected
+     * ServiceAccount volume and the kubelet's `KUBERNETES_SERVICE_*` env, which
+     * is the production path; otherwise the host supplies the server URL, an
+     * optional cluster CA and a `getToken()` callback — the same boundary this
+     * package already draws for ACI's `getArmToken` and Firecracker's
+     * `getToken`.
+     */
+    readonly access: KubernetesClusterAccess;
+    /**
+     * `SandboxTemplate` whose `podTemplate` a POOL-LESS create copies into the
+     * `Sandbox` it posts. Required because `Sandbox.spec` has no `templateRef`
+     * — only a `SandboxWarmPool` references a template — so the pod spec has to
+     * be carried across by the client. The warm path does not read it; the
+     * pool's own `sandboxTemplateRef` decides there.
+     */
+    readonly sandboxTemplateName: string;
+    /**
+     * `SandboxWarmPool` to claim from. Absent → every create posts a `Sandbox`
+     * directly, because `SandboxClaim.spec.warmPoolRef` is a required field and
+     * a pool-less claim does not exist in the API.
+     */
+    readonly warmPoolName?: string;
+    /** TCP port the in-pod guest agent listens on. Default 1024. */
+    readonly agentPort?: number;
+    /**
+     * Which of a sandbox's two addresses the transport dials.
+     *
+     * `'service'` (default) is the Sandbox's `status.serviceFQDN`, which
+     * outlives the pod and is re-resolved on every dial — and which ONLY the
+     * cluster's own DNS answers. A host running outside the cluster fails
+     * every call at name resolution, readiness included, so it reads as a
+     * sandbox that never came up.
+     *
+     * `'pod-ip'` dials the bound pod's IP, read from the same `GET` that
+     * reads its bind token. For a host outside the cluster with a route to
+     * the pod network. It needs that route and a `NetworkPolicy` admitting
+     * the host's address range on {@link agentPort}; the IP dies with its
+     * pod, which the backend covers by re-reading it on every resume and once
+     * after a connect failure. Nothing else changes: same bind token, same
+     * privilege probe, same egress verification.
+     */
+    readonly agentAddress?: KubernetesAgentAddressMode;
+    /** Delay between readiness polls. Default 50ms. */
+    readonly readyPollIntervalMs?: number;
+    /** Total deadline from create to an addressed, Ready sandbox. Default 60000ms. */
+    readonly readyTimeoutMs?: number;
+    /**
+     * Wall-clock lifetime written into every object this backend creates, so a
+     * host that dies mid-run costs the cluster one expiry rather than a leaked
+     * sandbox. Default 3600.
+     */
+    readonly claimTtlSeconds?: number;
+    /**
+     * Every lease-renewal failure that is not "the object is already gone".
+     *
+     * The handle renews its own `shutdownTime` every half-TTL for as long as
+     * it is alive, so a run that outlives `claimTtlSeconds` keeps its pod.
+     * A failed renewal is retried on a short capped backoff — starting at one
+     * second, not the next half-TTL tick — so a single API blip near a
+     * scheduled renewal gets several more chances before anything expires;
+     * this callback is where the diagnostic goes, because `@namzu/sandbox`
+     * owns no logger and reads none from module scope. Setting it changes
+     * nothing about behaviour.
+     */
+    readonly onLeaseRenewalError?: (error: unknown) => void;
+    /**
+     * RuntimeClass for a POOL-LESS create. Refused together with
+     * {@link warmPoolName}: a pooled sandbox is already running under the
+     * RuntimeClass its `SandboxTemplate` named, and a claim cannot change it —
+     * so accepting it there would quietly drop the choice of VM boundary.
+     */
+    readonly runtimeClassName?: string;
+    /**
+     * Egress policy this backend expects an operator to have applied as a
+     * `NetworkPolicy` (or, under `engine: 'cilium'`, a `CiliumNetworkPolicy`)
+     * scoped to every Sandbox this backend produces. Unset means this backend
+     * neither computes nor checks one — the cluster's default posture (the
+     * `SandboxTemplate`'s own managed `NetworkPolicy`) is all that applies.
+     *
+     * This is a CONFIG-level, whole-backend policy, not a per-`create()` one:
+     * `SandboxBackendOptions.egress` is still refused by name (see
+     * `backends/kubernetes/index.ts`'s `assertEnforceable`), because the
+     * enforcement point is one object attached to the template and cannot be
+     * rewritten per running sandbox. `static` and `resolver` — hostname
+     * allowlists — throw a named error at construction unless `engine` is
+     * `'cilium'`: core `NetworkPolicy` has no FQDN concept at all.
+     *
+     * `policy` also takes two kinds that exist only here, because only a
+     * `NetworkPolicy` can express them: `{ kind: 'no-network' }` (nothing
+     * leaves the pod, the cluster resolver included — which `'deny-all'` never
+     * meant, since it allows DNS and a cluster resolver forwards outside
+     * names) and `{ kind: 'public-internet', exceptCidrs? }` (the internet,
+     * minus the private ranges, carrier-grade NAT, link-local and one cloud
+     * platform endpoint). `'deny-all'` and `'allow-all'` emit exactly the
+     * manifests they always have.
+     *
+     * **Setting this now checks the UNION.** Since every policy selecting a
+     * pod is unioned by the API server, the check reads the named object AND
+     * enumerates the namespace's policies, refusing when any of them lets out
+     * more than `policy` does. `verify: 'named-object-only'` restores the
+     * single-object check exactly. See
+     * `docs/sdk/kubernetes-sandbox.md`'s egress section.
+     */
+    readonly egress?: KubernetesEgressConfig;
+    /**
+     * Whether this backend proves, before creating a sandbox, that an applied
+     * policy actually closes {@link agentPort} on the pod it is about to hand
+     * back — and against which policy resources.
+     *
+     * **Unset means verify.** This is the one field here whose absent value is
+     * the strict one, because the deployment that needs the check is the one
+     * that would never have switched it on: the guest agent's own source calls
+     * the network rule in front of its port the boundary, and until this field
+     * existed nothing confirmed there was one.
+     *
+     * `{ engine: 'cilium' }` also enumerates that CNI's own policy CRD;
+     * `engine` otherwise defaults to `egress?.engine ?? 'core'`.
+     *
+     * `'unverified'` reads no policy and issues no request. It is the
+     * supported answer for a deployment whose boundary a namespaced Role
+     * cannot see — a cluster-scoped policy, a service mesh, a cloud security
+     * group — and it is a claim the deployment makes on purpose rather than a
+     * default it inherits. See `docs/sdk/kubernetes-sandbox.md`'s ingress
+     * section.
+     */
+    readonly ingress?: KubernetesIngressConfig;
+    /**
+     * How long a single Kubernetes API request may take, end to end —
+     * resolving the token, connecting, and reading the reply. Default
+     * `30000`; minimum `1000`; there is no value that turns it off.
+     *
+     * The caller's `signal` is optional everywhere and several of this
+     * backend's requests are SHARED flights that run under whichever caller
+     * arrived first, so a signal-less `destroy()` against an API server that
+     * accepted a request and never answered used to pin every later caller
+     * joined to it. Expiry rejects with `KubernetesApiTimeoutError`, which
+     * says nothing about whether the request was applied — the paths that
+     * send one already cope with not knowing.
+     */
+    readonly apiRequestTimeoutMs?: number;
+    /**
+     * Interval of the liveness heartbeat `openTerminal` and
+     * `openTcpConnection` streams negotiate with the guest. Default `15000`;
+     * `0` sends none, which is exactly how every release before this one
+     * behaved.
+     *
+     * A quiet shell is healthy, so nothing replaced the read-idle timer the
+     * transport clears once a stream is ready: a partition that delivered no
+     * FIN and no RST left `exited`/`closed` unresolved on the host and the
+     * shell's process group alive in the guest. Three missed intervals end
+     * the stream on both sides. It is negotiated per stream — the guest
+     * echoes the interval in its `ready` event and sends nothing new unless
+     * it did — so an older guest image behaves exactly as it does today.
+     */
+    readonly streamHeartbeatMs?: number;
+    /**
+     * Extra labels written onto every `SandboxClaim` this backend POSTs —
+     * `metadata.labels` only, never the pod's own labels. Unset means no
+     * labels beyond what the controller itself writes, and every claim body
+     * is byte-for-byte what it was before this option existed.
+     *
+     * The intended use is a host-instance identity, so a restarted host can
+     * find and {@link releaseKubernetesTaskSandboxes} a crashed predecessor's
+     * claims well before `claimTtlSeconds` reaps them on its own — see
+     * {@link readKubernetesTaskCapacity} for reading pool headroom
+     * alongside it.
+     */
+    readonly claimLabels?: Record<string, string>;
+}
 /**
  * Egress allowlist resolution. Host-supplied policy decides whether
  * an outbound request is allowed before the proxy opens a socket.
@@ -433,8 +676,13 @@ export interface SandboxBackendOptions {
 export type SandboxProviderConfig = (SandboxProviderConfigBase & {
     readonly backend: ContainerBackendConfig;
     readonly layout: ContainerSandboxLayout;
+}) | (SandboxProviderConfigBase & {
+    readonly backend: ACIStandbyPoolBackendConfig;
+    readonly layout: ContainerSandboxLayout;
 }) | (SandboxProviderConfigBase & {
     readonly backend: MicroVMBackendConfig;
+}) | (SandboxProviderConfigBase & {
+    readonly backend: KubernetesBackendConfig;
 });
 interface SandboxProviderConfigBase {
     readonly defaultEgress?: EgressPolicy;
@@ -467,6 +715,106 @@ interface SandboxProviderConfigBase {
  * of a provider that confines nothing.
  */
 export declare function createSandboxProvider(config: SandboxProviderConfig): SandboxProvider;
+/**
+ * Create — or reattach to — a persistent workspace on a cluster running the
+ * agent-sandbox controller.
+ *
+ * A workspace is the other half of this backend, and deliberately not
+ * something {@link createSandboxProvider} can hand out: a `SandboxProvider`
+ * promises an EPHEMERAL sandbox per run (`workspaceModes: ['ephemeral']`),
+ * while this returns one object with a name the caller chose, a disk that
+ * survives a suspend, and a lifetime nothing reaps on a timer. It is its own
+ * verb so that the difference is visible at the call site.
+ *
+ * `config.warmPoolName` is ignored here: a workspace is always a `Sandbox`
+ * POSTed directly, because a claim cannot carry the immutable disk spec.
+ * `config.sandboxTemplateName` is the default template, and
+ * `options.sandboxTemplateName` overrides it — a deployment normally has a
+ * task template with no disk and a workspace template with a block one.
+ *
+ * Resolves once the workspace is Ready, addressed and has proved it is
+ * deprivileged, exactly as `provider.create()` does for a task sandbox.
+ */
+export declare function createKubernetesWorkspace(config: KubernetesBackendConfig, options: KubernetesWorkspaceOptions): Promise<KubernetesWorkspace>;
+/**
+ * Every workspace this backend owns in the namespace, read off the objects
+ * and waking none of them.
+ *
+ * The inventory {@link createKubernetesWorkspace} cannot give you: it adopts
+ * AND resumes, so taking stock through it would start a pod for every
+ * suspended workspace it looked at. This issues one GET of the sandboxes
+ * collection and sends no PATCH and no DELETE — a suspended workspace is
+ * still suspended afterwards.
+ *
+ * Needs `list` on `sandboxes` in the namespace, which is the one RBAC verb
+ * the task path did not already require.
+ */
+export declare function listKubernetesWorkspaces(config: KubernetesBackendConfig, options?: KubernetesWorkspaceTransitionOptions): Promise<readonly KubernetesWorkspaceSummary[]>;
+/**
+ * Delete a workspace by id — the Sandbox, and with it the Pod, the Service
+ * and the PVC — without adopting or resuming it first.
+ *
+ * Exactly what `destroy({ deleteDisk: true })` does to the cluster, with the
+ * same guarantees: an object already gone counts as deleted, and a DELETE
+ * that fails rejects and stays retryable. The files are gone and nothing
+ * brings them back.
+ *
+ * It is the retention verb. Removing a month-old suspended workspace through
+ * a handle meant starting its pod and probing it purely to tell it to go
+ * away; the name is deterministic, so the object never needed opening.
+ */
+export declare function deleteKubernetesWorkspace(config: KubernetesBackendConfig, workspaceId: string, options?: KubernetesWorkspaceTransitionOptions): Promise<void>;
+/**
+ * Suspend a workspace by id: send the `operatingMode: Suspended` patch and
+ * wait for the pod to actually stop, without adopting the workspace.
+ *
+ * Resolves only once the pod is gone or in a terminal phase — a suspend is a
+ * promise that the disk is quiesced, and the patch being accepted says only
+ * that the controller has been asked. A pod that outlives `readyTimeoutMs`
+ * rejects with `KubernetesWorkspaceSuspendTimeoutError`, leaving the object
+ * as the patch left it.
+ *
+ * A handle another process is holding is not told. It finds out on its next
+ * call — which fails at the transport and is re-read into a
+ * `KubernetesWorkspaceSuspendedError` — or when that process calls
+ * `refresh()`.
+ *
+ * It takes the suspend options shape and REFUSES `quiesce` rather than
+ * accepting the flag and dropping it: this verb never dials the agent, so
+ * there is no connection here on which anything could be stopped. Quiescing
+ * needs a handle — `createKubernetesWorkspace()`, then
+ * `suspend({ quiesce: true })`.
+ */
+export declare function suspendKubernetesWorkspace(config: KubernetesBackendConfig, workspaceId: string, options?: KubernetesWorkspaceSuspendOptions): Promise<void>;
+/**
+ * Recover a crashed host's task-path claims: LIST every `SandboxClaim`
+ * carrying `options.labelSelector`, `DELETE` each, and report what was
+ * removed.
+ *
+ * Deletes claims only — the controller's own ownerReferences take the bound
+ * Sandbox, its Pod and its Service down behind each one; nothing here reads
+ * or touches those objects directly. `labelSelector` is REQUIRED and refused
+ * before any request goes out if it is empty: falling back to matching every
+ * claim would delete a live fleet's work.
+ *
+ * Pairs with `config.claimLabels`: a host stamps its own identity onto every
+ * claim it creates, and a restarted instance passes that same selector here
+ * to reclaim its predecessor's warm-pool capacity well before
+ * `claimTtlSeconds` would reap it on its own.
+ */
+export declare function releaseKubernetesTaskSandboxes(config: KubernetesBackendConfig, options: KubernetesReleaseTaskSandboxesOptions): Promise<{
+    readonly deleted: number;
+    readonly names: readonly string[];
+}>;
+/**
+ * Read task-pool headroom before admitting more work: three GETs
+ * (`SandboxWarmPool`, the claims collection, the pods collection), no
+ * writes.
+ *
+ * Requires `config.warmPoolName` — a pool-less backend (every create is a
+ * direct Sandbox) has no `SandboxWarmPool` to report on.
+ */
+export declare function readKubernetesTaskCapacity(config: KubernetesBackendConfig, options?: KubernetesReadTaskCapacityOptions): Promise<KubernetesTaskCapacity>;
 /**
  * Thrown by the factory when a backend is requested before its
  * implementation has landed. Makes the staged rollout legible —

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EACX,sBAAsB,EACtB,OAAO,EAEP,eAAe,EACf,MAAM,YAAY,CAAA;AASnB,YAAY,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC9B,MAAM,YAAY,CAAA;AAOnB,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAMnB,YAAY,EACX,gCAAgC,EAChC,yBAAyB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACN,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAM5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,SAAS,CAAA;AAEjD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC7B,sBAAsB,GACtB,2BAA2B,GAC3B,oBAAoB,CAAA;AAEvB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,uFAAuF;IACvF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACX,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,mBAAmB,CAAA;AAE1B,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAAE,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,qBAAqB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAC9B,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACrC,CAAC,CAAA;AAEL,UAAU,yBAAyB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAA;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CAoCpF;AAiID;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;aAG/B,OAAO,EAAE,MAAM;IAF3C,SAAkB,IAAI,uCAAsC;gBAEhC,OAAO,EAAE,MAAM;CAK3C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;aAI9C,OAAO,EAAE,SAAS,MAAM,EAAE;IAH3C,SAAkB,IAAI,2CAA0C;gBAG/C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ9B,MAAM,IAAI;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;KACf;CAQD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CACvC;AA4BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAE1E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EACX,sBAAsB,EACtB,OAAO,EAEP,eAAe,EACf,MAAM,YAAY,CAAA;AAKnB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAA;AACpF,OAAO,EACN,KAAK,0BAA0B,EAE/B,KAAK,uBAAuB,EAC5B,KAAK,iCAAiC,EACtC,KAAK,qCAAqC,EAC1C,KAAK,sBAAsB,EAI3B,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAA;AACtF,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,oCAAoC,EAKzC,MAAM,oCAAoC,CAAA;AAK3C,YAAY,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC9B,MAAM,YAAY,CAAA;AAOnB,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAMnB,YAAY,EACX,gCAAgC,EAChC,yBAAyB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACN,oBAAoB,EACpB,8BAA8B,EAC9B,mCAAmC,EACnC,2BAA2B,EAC3B,4BAA4B,EAC5B,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAK5C,OAAO,EACN,wBAAwB,EACxB,KAAK,aAAa,GAClB,MAAM,oCAAoC,CAAA;AAK3C,OAAO,EACN,uBAAuB,EACvB,wBAAwB,EACxB,gCAAgC,EAChC,2BAA2B,EAC3B,KAAK,eAAe,GACpB,MAAM,oCAAoC,CAAA;AAM3C,OAAO,EACN,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC1B,MAAM,oCAAoC,CAAA;AAQ3C,YAAY,EACX,0BAA0B,EAC1B,uBAAuB,GACvB,MAAM,gCAAgC,CAAA;AAKvC,YAAY,EACX,kBAAkB,EAClB,4BAA4B,EAC5B,+BAA+B,EAC/B,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAmB/C,OAAO,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAA;AAC9F,OAAO,EAAE,8CAA8C,EAAE,MAAM,wCAAwC,CAAA;AACvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAA;AAC7F,OAAO,EACN,oCAAoC,EACpC,uCAAuC,EACvC,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC9B,MAAM,6CAA6C,CAAA;AAMpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAA;AAMzF,YAAY,EACX,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACpB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACN,yCAAyC,EACzC,iCAAiC,EACjC,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAW/C,OAAO,EACN,kCAAkC,EAClC,kCAAkC,EAClC,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAK/C,YAAY,EACX,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB;AACvB,0EAA0E;AAC1E,yBAAyB,EACzB,kBAAkB,GAClB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAA;AAKtF,OAAO,EACN,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GACzB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACN,uCAAuC,EAKvC,4BAA4B,EAC5B,gCAAgC,GAChC,MAAM,oCAAoC,CAAA;AAO3C,YAAY,EACX,gCAAgC,EAChC,uBAAuB,EACvB,6BAA6B,GAC7B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,yCAAyC,EACzC,gCAAgC,EAChC,qCAAqC,GACrC,MAAM,oCAAoC,CAAA;AAQ3C,YAAY,EACX,+BAA+B,EAC/B,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,2BAA2B,GAC3B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,6BAA6B,EAC7B,kCAAkC,GAClC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAA;AAI/E,OAAO,EACN,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,YAAY,GACjB,MAAM,oCAAoC,CAAA;AAM3C,YAAY,EACX,wBAAwB,EACxB,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AACjF,OAAO,EACN,iCAAiC,EACjC,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,GACpB,MAAM,oCAAoC,CAAA;AAY3C,YAAY,EACX,sBAAsB,EACtB,+BAA+B,GAC/B,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EACN,+BAA+B,EAC/B,+BAA+B,EAC/B,+BAA+B,GAC/B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAA;AASlE,OAAO,EACN,8BAA8B,EAQ9B,kBAAkB,EAClB,KAAK,6BAA6B,EAClC,yBAAyB,EACzB,KAAK,oBAAoB,EAOzB,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,qCAAqC,CAAA;AAM5C,OAAO,EACN,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,qCAAqC,CAAA;AAQ5C,OAAO,EACN,sBAAsB,EACtB,KAAK,8BAA8B,EAInC,oBAAoB,EACpB,sBAAsB,GACtB,MAAM,gCAAgC,CAAA;AAOvC,OAAO,EACN,mCAAmC,EACnC,qCAAqC,EACrC,wCAAwC,GACxC,MAAM,wCAAwC,CAAA;AAC/C,uEAAuE;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAM5E,YAAY,EACX,iCAAiC,EACjC,qCAAqC,EACrC,sBAAsB,GACtB,MAAM,gCAAgC,CAAA;AAOvC,OAAO,EACN,8BAA8B,EAC9B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACvB,MAAM,+BAA+B,CAAA;AAQtC,YAAY,EACX,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,qCAAqC,EACrC,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EACzB,qCAAqC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,oCAAoC,GACpC,MAAM,oCAAoC,CAAA;AAM3C,YAAY,EACX,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,GAC3B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAKN,iCAAiC,EAIjC,gCAAgC,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACN,4BAA4B,EAC5B,gCAAgC,EAMhC,oCAAoC,EACpC,sCAAsC,EACtC,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAM3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,SAAS,CAAA;AAEjD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC7B,sBAAsB,GACtB,2BAA2B,GAC3B,oBAAoB,GACpB,uBAAuB,CAAA;AAE1B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,uFAAuF;IACvF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAA;IAClD,mDAAmD;IACnD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAA;IACxC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAA;IAC1C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACX,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,mBAAmB,CAAA;AAE1B,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAAE,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,qBAAqB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAC9B,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACrC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;CACxC,CAAC,CAAA;AAEL,UAAU,yBAAyB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAA;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CAoCpF;AAgKD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,SAAS,0BAA0B,EAAE,CAAC,CAEhD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,uBAAuB,EAC/B,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,0BAA0B,CAC/C,MAAM,EAAE,uBAAuB,EAC/B,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,iCAAiC,GACzC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,8BAA8B,CACnD,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,qCAAqC,GAC5C,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC/C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,iCAAiC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAgBD;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;aAG/B,OAAO,EAAE,MAAM;IAF3C,SAAkB,IAAI,uCAAsC;gBAEhC,OAAO,EAAE,MAAM;CAK3C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;aAI9C,OAAO,EAAE,SAAS,MAAM,EAAE;IAH3C,SAAkB,IAAI,2CAA0C;gBAG/C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ9B,MAAM,IAAI;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;KACf;CAQD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CACvC;AA4BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAE1E"}