@namzu/sandbox 14.0.0 → 15.0.0

package/dist/backends/kubernetes/k8s-client.js

@@ -40,6 +40,32 @@
  * `CredentialError` naming the attempted verb and resource — never the
  * token, which this module never logs or embeds in any thrown message.
  *
+ * ## What a failure carries, and what it deliberately does not
+ * Everything else — a connect failure, and every non-2xx status the mapping
+ * above does not name — rejects with {@link KubernetesApiError}, which
+ * carries the verb, the path, the status where there was one, and the
+ * `Retry-After` the server sent with a 429 or a 503. That is METADATA and
+ * nothing more: there is no retry loop and no retry policy in this module.
+ * A retry is a decision about the OPERATION — a GET during a readiness poll
+ * may be repeated, a POST that may already have committed may not — and this
+ * client cannot tell those apart. `backends/kubernetes/index.ts` owns the
+ * policy, beside the acquire it serves and inside that acquire's existing
+ * deadline.
+ *
+ * ## Deadlines
+ * Every request carries its own bound
+ * ({@link KubernetesClientOptions.requestTimeoutMs}, default
+ * {@link DEFAULT_API_REQUEST_TIMEOUT_MS}) on top of whatever signal the
+ * caller passed, because the caller's signal is optional everywhere and
+ * several call sites are SHARED flights that run under whichever caller
+ * arrived first — one signal-less `destroy()` against an API server that
+ * accepted a request and never answered would otherwise pin every later
+ * caller joined to it. The bound covers `getToken()`, the connection and
+ * reading the body, on both transports, and expiry rejects with
+ * {@link KubernetesApiTimeoutError} rather than the generic `failed:` error
+ * so a caller can tell a timeout from a refusal. A caller's own abort still
+ * behaves exactly as it did.
+ *
  * ## Not in v1
  * No watch, no informers, no resourceVersion/bookmark tracking. Readiness is
  * polled by the caller with `../readiness.js`'s `OperationDeadline`, exactly
@@ -47,6 +73,16 @@
  */
 import { readFileSync } from 'node:fs';
 import https from 'node:https';
+/**
+ * Default {@link KubernetesClientOptions.requestTimeoutMs} — 30 s.
+ *
+ * The same cap `lease.ts` already puts on a renewal PATCH, and below the
+ * 60 s `readyTimeoutMs` default, so a request that times out still leaves
+ * the readiness budget something to report with.
+ */
+export const DEFAULT_API_REQUEST_TIMEOUT_MS = 30_000;
+/** Floor for {@link KubernetesClientOptions.requestTimeoutMs} — 1 s. */
+export const MIN_API_REQUEST_TIMEOUT_MS = 1_000;
 const DEFAULT_SERVICE_ACCOUNT_DIR = '/var/run/secrets/kubernetes.io/serviceaccount';
 /** 404/410 → this. A teardown path treats it as "already achieved". */
 export class KubernetesAlreadyGoneError extends Error {
@@ -72,6 +108,51 @@ export class KubernetesConflictError extends Error {
         this.name = 'KubernetesConflictError';
     }
 }
+/**
+ * A JSON Patch the API server would not apply: 422 Unprocessable Entity.
+ *
+ * ## What the API server actually says, measured
+ *
+ * Against a real API server (v1.37.0) and the agent-sandbox `Sandbox` CRD, a
+ * JSON Patch whose `test` clause does not hold answers **422** with this
+ * body, byte for byte:
+ *
+ * ```json
+ * {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure",
+ *  "message":"the server rejected our request due to an error in our request",
+ *  "reason":"Invalid","details":{},"code":422}
+ * ```
+ *
+ * A patch that is simply WRONG — a pointer into a member that does not
+ * exist, say — answers with exactly the same status, the same reason and the
+ * same message. The server does not name the operation that failed, so
+ * nothing this class could read off the response would tell a lost race from
+ * a malformed body, and a class that claimed to would be lying.
+ *
+ * So it says what it can honestly say: the patch did not apply and NOTHING
+ * was changed. Deciding which of the two it was belongs to the caller that
+ * knows what it tested — `workspace.ts` re-reads the object and compares the
+ * value it tested against what is stored now: changed ⇒ somebody raced it,
+ * unchanged ⇒ the body is wrong and the error is rethrown rather than
+ * retried forever.
+ *
+ * Not a {@link KubernetesConflictError}: that one is 409, which the same
+ * server returns for a DELETE whose `preconditions.resourceVersion` does not
+ * match (measured on the same cluster, with a message that DOES name the two
+ * versions). The two statuses mean different things and are kept apart.
+ */
+export class KubernetesPatchNotAppliedError extends Error {
+    method;
+    resource;
+    status;
+    constructor(method, resource, status) {
+        super(`kubernetes ${method} ${resource} -> ${status}: the API server did not apply the JSON patch and changed nothing. It does not say which operation failed, so this is either a \`test\` clause that no longer holds — another holder wrote the object first — or a patch body that is wrong.`);
+        this.method = method;
+        this.resource = resource;
+        this.status = status;
+        this.name = 'KubernetesPatchNotAppliedError';
+    }
+}
 /**
  * 401/403 → this. Names the attempted verb and resource only — never the
  * token, and never the response body (the API server does not echo the
@@ -90,6 +171,157 @@ export class KubernetesCredentialError extends Error {
         this.name = 'KubernetesCredentialError';
     }
 }
+/**
+ * The request outlived {@link KubernetesClientOptions.requestTimeoutMs}.
+ *
+ * Deliberately NOT the generic `failed:` error: a caller that can tell a
+ * timeout from a refusal can retry an idempotent write, and one that cannot
+ * has to treat every failure alike. Carries the verb, the resource path and
+ * the bound that expired — and, like every other error in this module,
+ * never the bearer token.
+ *
+ * A timeout says nothing about whether the request was APPLIED, which is
+ * why nothing here tries to: a suspend restores the state it saw and sends
+ * its idempotent patch again, a create POST that landed is adopted through
+ * the 409 path, and a DELETE that already applied counts as done.
+ */
+export class KubernetesApiTimeoutError extends Error {
+    verb;
+    resource;
+    timeoutMs;
+    constructor(verb, resource, timeoutMs) {
+        super(`kubernetes ${verb} ${resource} was still unanswered ${timeoutMs}ms after it was sent, and was given up on (apiRequestTimeoutMs). Whether the API server applied it is unknown. Raise apiRequestTimeoutMs if this cluster is genuinely this slow.`);
+        this.verb = verb;
+        this.resource = resource;
+        this.timeoutMs = timeoutMs;
+        this.name = 'KubernetesApiTimeoutError';
+    }
+}
+/**
+ * Every API failure this client does not already name: a connect failure, and
+ * every non-2xx status outside 401/403/404/409/410 (and the 422 a JSON patch
+ * gets).
+ *
+ * It exists because "a burst past node capacity" and "the API server is down"
+ * used to be the same plain `Error`, separable only by matching the message
+ * text a release is free to reword. The fields are the smallest set that
+ * makes the difference decidable by a caller:
+ *
+ *  - `status` — absent for a connect failure, present for every answered one.
+ *  - `retryAfterMs` — the `Retry-After` header the API server sends with a
+ *    429 (its own priority-and-fairness queue shedding load) and sometimes
+ *    with a 503, normalised to milliseconds from either spelling the header
+ *    allows. Absent when the server sent none, which is not the same as zero.
+ *  - `transport` — see {@link KubernetesApiFailureTransport}.
+ *  - `cause` — the underlying error for a connect failure.
+ *
+ * **There is no retry here.** This class is metadata; `index.ts` decides what
+ * is worth repeating, because only the caller knows whether the operation is
+ * idempotent and only the caller owns a clock to repeat it inside.
+ *
+ * The message keeps the exact wording both throw sites used before, so a host
+ * that logs it sees no change and only a host that inspects the type gains
+ * anything.
+ */
+export class KubernetesApiError extends Error {
+    method;
+    path;
+    status;
+    retryAfterMs;
+    transport;
+    constructor(message, details) {
+        super(message, details.cause !== undefined ? { cause: details.cause } : undefined);
+        this.name = 'KubernetesApiError';
+        this.method = details.method;
+        this.path = details.path;
+        if (details.status !== undefined)
+            this.status = details.status;
+        if (details.retryAfterMs !== undefined)
+            this.retryAfterMs = details.retryAfterMs;
+        this.transport = details.transport;
+    }
+}
+/**
+ * `Retry-After`, in milliseconds, or `undefined` when the server sent none or
+ * sent one that cannot be read.
+ *
+ * RFC 9110 allows two spellings and the API server uses the first: a
+ * delta-seconds integer (`Retry-After: 1`), which is what
+ * priority-and-fairness sends with a 429. The HTTP-date spelling is accepted
+ * too, because a proxy in front of the API server may rewrite it. A date in
+ * the past, or a negative delta, reads as `0` — "now" — rather than being
+ * discarded, because the server still said to wait and the answer to "how
+ * long" is "no longer".
+ */
+export function parseRetryAfterMs(header) {
+    if (header === undefined)
+        return undefined;
+    const raw = header.trim();
+    if (raw === '')
+        return undefined;
+    if (/^-?\d+$/.test(raw)) {
+        const seconds = Number(raw);
+        if (!Number.isSafeInteger(seconds))
+            return undefined;
+        return Math.max(0, seconds * 1_000);
+    }
+    const at = Date.parse(raw);
+    if (Number.isNaN(at))
+        return undefined;
+    return Math.max(0, at - Date.now());
+}
+/**
+ * Validate the configured bound, or supply the default.
+ *
+ * There is no disabling value, and `0` is refused rather than read as
+ * "unbounded": an unanswered request is not a supported configuration.
+ * Several call sites are single-flight promises that run under the FIRST
+ * caller's signal and never consult a later one's, so one hung request
+ * does not block one caller — it blocks every caller that joined it, on a
+ * handle whose state already refuses data-plane calls. A cluster with a
+ * genuinely slow API server raises the number.
+ */
+export function resolveRequestTimeoutMs(value) {
+    if (value === undefined)
+        return DEFAULT_API_REQUEST_TIMEOUT_MS;
+    if (!Number.isSafeInteger(value) || value < MIN_API_REQUEST_TIMEOUT_MS) {
+        throw new Error(`kubernetes: apiRequestTimeoutMs must be an integer of at least ${MIN_API_REQUEST_TIMEOUT_MS}ms, got ${JSON.stringify(value)}. No value disables the bound: a request the API server accepted and never answered would hang its caller — and every later caller joined to the same single-flight suspend, delete or verification — until the process was killed. Raise the number instead; the default is ${DEFAULT_API_REQUEST_TIMEOUT_MS}ms.`);
+    }
+    return value;
+}
+/**
+ * Await `promise`, but give up the moment `signal` aborts, rejecting with
+ * that signal's reason.
+ *
+ * `getToken()` is a caller-supplied callback and `res.text()` is a body the
+ * peer may simply stop sending, and neither takes a signal of its own, so
+ * without this the bound would cover only the part of a request this module
+ * happens to hold a socket for. The late settlement is swallowed rather
+ * than left dangling: an unobserved rejection is still a rejection.
+ */
+function settleOnAbort(promise, signal) {
+    if (signal.aborted) {
+        void promise.catch(() => { });
+        return Promise.reject(signal.reason);
+    }
+    return new Promise((resolve, reject) => {
+        let done = false;
+        const onAbort = () => {
+            done = true;
+            reject(signal.reason);
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener('abort', onAbort);
+            if (!done)
+                resolve(value);
+        }, (error) => {
+            signal.removeEventListener('abort', onAbort);
+            if (!done)
+                reject(error);
+        });
+    });
+}
 function stripTrailingSlash(url) {
     return url.endsWith('/') ? url.slice(0, -1) : url;
 }
@@ -133,6 +365,7 @@ async function fetchRequest(url, method, headers, payload, signal) {
     return {
         status: res.status,
         contentType: res.headers.get('content-type') ?? '',
+        header: (name) => res.headers.get(name) ?? undefined,
         text: () => res.text(),
     };
 }
@@ -165,6 +398,10 @@ function httpsRequest(url, method, headers, payload, ca, signal) {
                 resolve({
                     status: res.statusCode ?? 0,
                     contentType: Array.isArray(ct) ? (ct[0] ?? '') : (ct ?? ''),
+                    header: (name) => {
+                        const value = res.headers[name];
+                        return Array.isArray(value) ? value[0] : value;
+                    },
                     text: async () => Buffer.concat(chunks).toString('utf8'),
                 });
             });
@@ -177,66 +414,136 @@ function httpsRequest(url, method, headers, payload, ca, signal) {
     });
 }
 /**
- * `PATCH` always carries a JSON MERGE patch body (RFC 7386) — never
+ * `PATCH` carries a JSON MERGE patch body (RFC 7386) unless the caller asked
+ * for `json`, which sends an RFC 6902 operation list instead — never
  * server-side apply, never YAML. `POST` carries a plain JSON create body.
- * `GET`/`DELETE` normally carry no body; if a caller ever does pass one to
- * `DELETE` it is sent as plain JSON.
+ * `GET`/`DELETE` normally carry no body; when a caller does pass one to
+ * `DELETE` — a `DeleteOptions` with `preconditions` — it is sent as plain
+ * JSON, which is what the API server expects there.
  */
-function contentTypeFor(method) {
-    return method === 'PATCH' ? 'application/merge-patch+json' : 'application/json';
+function contentTypeFor(method, patchType) {
+    if (method !== 'PATCH')
+        return 'application/json';
+    return patchType === 'json' ? 'application/json-patch+json' : 'application/merge-patch+json';
 }
-export function createKubernetesClient(access) {
+export function createKubernetesClient(access, options = {}) {
     const resolved = access.inCluster === true ? resolveInCluster(access) : resolveExplicit(access);
-    async function request(method, path, body, signal) {
-        signal?.throwIfAborted();
-        const token = await resolved.getToken();
+    // Validated at construction, not at the first request: a configuration
+    // this module will never honour should be refused where the operator can
+    // still see which backend it came from.
+    const requestTimeoutMs = resolveRequestTimeoutMs(options.requestTimeoutMs);
+    async function request(method, path, body, signal, patchType = 'merge') {
         signal?.throwIfAborted();
-        const url = `${resolved.baseUrl}${path}`;
-        const payload = body !== undefined ? JSON.stringify(body) : undefined;
-        const headers = {
-            Authorization: `Bearer ${token}`,
-            Accept: 'application/json',
-        };
-        if (payload !== undefined)
-            headers['content-type'] = contentTypeFor(method);
-        let res;
+        // The caller's signal is WRAPPED, never replaced: `deadline` aborts
+        // with the caller's own reason when the caller aborts, so every path
+        // below behaves exactly as it did, and with a
+        // KubernetesApiTimeoutError when the bound expires first. Combined by
+        // hand rather than with `AbortSignal.any`, which this package's
+        // declared Node floor (20.0) predates.
+        const deadlineController = new AbortController();
+        const deadline = deadlineController.signal;
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            deadlineController.abort(new KubernetesApiTimeoutError(method, path, requestTimeoutMs));
+        }, requestTimeoutMs);
+        timer.unref?.();
+        const forwardCallerAbort = () => deadlineController.abort(signal?.reason);
+        signal?.addEventListener('abort', forwardCallerAbort, { once: true });
+        /** True while the CALLER is the one who gave up, which wins. */
+        const callerGaveUp = () => signal?.aborted === true;
+        const readBody = async (res) => await settleOnAbort(res.text(), deadline);
         try {
-            res =
-                resolved.ca !== undefined
-                    ? await httpsRequest(url, method, headers, payload, resolved.ca, signal)
-                    : await fetchRequest(url, method, headers, payload, signal);
-        }
-        catch (err) {
-            throw new Error(`kubernetes ${method} ${path} failed: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
-        }
-        if (res.status === 401 || res.status === 403) {
-            await res.text();
-            signal?.throwIfAborted();
-            throw new KubernetesCredentialError(method, path, res.status);
-        }
-        if (res.status === 404 || res.status === 410) {
-            await res.text();
-            signal?.throwIfAborted();
-            throw new KubernetesAlreadyGoneError(method, path, res.status);
-        }
-        if (res.status === 409) {
-            await res.text();
-            signal?.throwIfAborted();
-            throw new KubernetesConflictError(method, path);
-        }
-        if (res.status < 200 || res.status >= 300) {
-            const text = await res.text();
-            signal?.throwIfAborted();
-            throw new Error(`kubernetes ${method} ${path} -> ${res.status}: ${text}`);
-        }
-        if (res.status === 204)
+            // Covered by the bound at last: `getToken()` is caller code that
+            // takes no signal of its own, and an in-cluster token read that
+            // blocks on a wedged volume used to be unbounded on every request.
+            const token = await settleOnAbort(resolved.getToken(), deadline);
+            deadline.throwIfAborted();
+            const url = `${resolved.baseUrl}${path}`;
+            const payload = body !== undefined ? JSON.stringify(body) : undefined;
+            const headers = {
+                Authorization: `Bearer ${token}`,
+                Accept: 'application/json',
+            };
+            if (payload !== undefined)
+                headers['content-type'] = contentTypeFor(method, patchType);
+            let res;
+            try {
+                res =
+                    resolved.ca !== undefined
+                        ? await httpsRequest(url, method, headers, payload, resolved.ca, deadline)
+                        : await fetchRequest(url, method, headers, payload, deadline);
+            }
+            catch (err) {
+                if (err instanceof KubernetesApiTimeoutError)
+                    throw err;
+                // A timeout is named rather than folded into `failed:`; a
+                // caller's own abort still produces the wrapped error it
+                // always produced.
+                if (timedOut && !callerGaveUp()) {
+                    throw new KubernetesApiTimeoutError(method, path, requestTimeoutMs);
+                }
+                // Same sentence it has always thrown, on a class that says which
+                // half failed. Nothing here decides whether to try again: see
+                // {@link KubernetesApiError}.
+                throw new KubernetesApiError(`kubernetes ${method} ${path} failed: ${err instanceof Error ? err.message : String(err)}`, { method, path, transport: 'connect', cause: err });
+            }
+            if (res.status === 401 || res.status === 403) {
+                await readBody(res);
+                deadline.throwIfAborted();
+                throw new KubernetesCredentialError(method, path, res.status);
+            }
+            if (res.status === 404 || res.status === 410) {
+                await readBody(res);
+                deadline.throwIfAborted();
+                throw new KubernetesAlreadyGoneError(method, path, res.status);
+            }
+            if (res.status === 409) {
+                await readBody(res);
+                deadline.throwIfAborted();
+                throw new KubernetesConflictError(method, path);
+            }
+            // Before the generic mapping, and only for the dialect that has a
+            // `test` clause to fail: a merge patch has no condition, so a 422
+            // on one is a malformed body and belongs in the generic error
+            // where it always was.
+            if (res.status === 422 && method === 'PATCH' && patchType === 'json') {
+                await readBody(res);
+                deadline.throwIfAborted();
+                throw new KubernetesPatchNotAppliedError(method, path, res.status);
+            }
+            if (res.status < 200 || res.status >= 300) {
+                // Read BEFORE the body, because `readBody` can abort out of this
+                // block and the header is the whole reason a caller can wait the
+                // length the server asked for rather than a length it invented.
+                // Only for the two statuses that mean "later, not never": a 400
+                // carrying one would be the server contradicting itself.
+                const retryAfterMs = res.status === 429 || res.status === 503
+                    ? parseRetryAfterMs(res.header('retry-after'))
+                    : undefined;
+                const text = await readBody(res);
+                deadline.throwIfAborted();
+                throw new KubernetesApiError(`kubernetes ${method} ${path} -> ${res.status}: ${text}`, {
+                    method,
+                    path,
+                    status: res.status,
+                    ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+                    transport: 'status',
+                });
+            }
+            if (res.status === 204)
+                return undefined;
+            if (res.contentType.includes('application/json')) {
+                const text = await readBody(res);
+                deadline.throwIfAborted();
+                return text.length > 0 ? JSON.parse(text) : undefined;
+            }
             return undefined;
-        if (res.contentType.includes('application/json')) {
-            const text = await res.text();
-            signal?.throwIfAborted();
-            return text.length > 0 ? JSON.parse(text) : undefined;
         }
-        return undefined;
+        finally {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', forwardCallerAbort);
+        }
     }
     return {
         request,

package/dist/backends/kubernetes/k8s-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"k8s-client.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/k8s-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,MAAM,YAAY,CAAA;AAgE9B,MAAM,2BAA2B,GAAG,+CAA+C,CAAA;AAEnF,uEAAuE;AACvE,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAE1C;IACA;IACA;IAHV,YACU,MAA4B,EAC5B,QAAgB,EAChB,MAAc;QAEvB,KAAK,CAAC,cAAc,MAAM,IAAI,QAAQ,OAAO,MAAM,gBAAgB,CAAC,CAAA;QAJ3D,WAAM,GAAN,MAAM,CAAsB;QAC5B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IACzC,CAAC;CACD;AAED,2EAA2E;AAC3E,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAEvC;IACA;IAFV,YACU,MAA4B,EAC5B,QAAgB;QAEzB,KAAK,CAAC,cAAc,MAAM,IAAI,QAAQ,mBAAmB,CAAC,CAAA;QAHjD,WAAM,GAAN,MAAM,CAAsB;QAC5B,aAAQ,GAAR,QAAQ,CAAQ;QAGzB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACtC,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEzC;IACA;IACA;IAHV,YACU,IAA0B,EAC1B,QAAgB,EAChB,MAAc;QAEvB,KAAK,CAAC,0BAA0B,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAA;QAJrD,SAAI,GAAJ,IAAI,CAAsB;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACxC,CAAC;CACD;AAED,SAAS,kBAAkB,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAClD,CAAC;AASD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAiC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,IAAI,2BAA2B,CAAA;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IAChD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACd,4FAA4F,CAC5F,CAAA;IACF,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,GAAG,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACjE,OAAO;QACN,OAAO,EAAE,WAAW,IAAI,IAAI,IAAI,EAAE;QAClC,EAAE;QACF,SAAS;QACT,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,GAAG,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE;KACjE,CAAA;AACF,CAAC;AAED,SAAS,eAAe,CAAC,MAAgC;IACxD,OAAO;QACN,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KACzB,CAAA;AACF,CAAC;AASD,+EAA+E;AAC/E,KAAK,UAAU,YAAY,CAC1B,GAAW,EACX,MAA4B,EAC5B,OAA+B,EAC/B,OAA2B,EAC3B,MAAoB;IAEpB,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC7C,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAA;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAClD,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE;KACtB,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CACpB,GAAW,EACX,MAA4B,EAC5B,OAA+B,EAC/B,OAA2B,EAC3B,EAAmB,EACnB,MAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3B,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CACxB;YACC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG;YACpD,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,MAAM;YACN,OAAO;YACP,EAAE;YACF,kBAAkB,EAAE,IAAI;YACxB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,EACD,CAAC,GAAG,EAAE,EAAE;YACP,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACrD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBAClB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;gBACtC,OAAO,CAAC;oBACP,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;oBAC3B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;oBAC3D,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBACxD,CAAC,CAAA;YACH,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACxB,CAAC,CACD,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,IAAI,OAAO,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,GAAG,CAAC,GAAG,EAAE,CAAA;IACV,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,MAA4B;IACnD,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,kBAAkB,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IAE/F,KAAK,UAAU,OAAO,CACrB,MAA4B,EAC5B,IAAY,EACZ,IAAc,EACd,MAAoB;QAEpB,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAA;QACvC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,IAAI,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACrE,MAAM,OAAO,GAA2B;YACvC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,kBAAkB;SAC1B,CAAA;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;QAE3E,IAAI,GAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,GAAG;gBACF,QAAQ,CAAC,EAAE,KAAK,SAAS;oBACxB,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;oBACxE,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACd,cAAc,MAAM,IAAI,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1F,EAAE,KAAK,EAAE,GAAG,EAAE,CACd,CAAA;QACF,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC9C,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,IAAI,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC9C,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,IAAI,0BAA0B,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,IAAI,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAA;QACxC,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAO,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7D,CAAC;QACD,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,OAAO;QACN,OAAO;QACP,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS;KACnC,CAAA;AACF,CAAC"}
+{"version":3,"file":"k8s-client.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/k8s-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,MAAM,YAAY,CAAA;AA8E9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAA;AAEpD,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAA;AA8B/C,MAAM,2BAA2B,GAAG,+CAA+C,CAAA;AAEnF,uEAAuE;AACvE,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAE1C;IACA;IACA;IAHV,YACU,MAA4B,EAC5B,QAAgB,EAChB,MAAc;QAEvB,KAAK,CAAC,cAAc,MAAM,IAAI,QAAQ,OAAO,MAAM,gBAAgB,CAAC,CAAA;QAJ3D,WAAM,GAAN,MAAM,CAAsB;QAC5B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IACzC,CAAC;CACD;AAED,2EAA2E;AAC3E,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAEvC;IACA;IAFV,YACU,MAA4B,EAC5B,QAAgB;QAEzB,KAAK,CAAC,cAAc,MAAM,IAAI,QAAQ,mBAAmB,CAAC,CAAA;QAHjD,WAAM,GAAN,MAAM,CAAsB;QAC5B,aAAQ,GAAR,QAAQ,CAAQ;QAGzB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACtC,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAE9C;IACA;IACA;IAHV,YACU,MAA4B,EAC5B,QAAgB,EAChB,MAAc;QAEvB,KAAK,CACJ,cAAc,MAAM,IAAI,QAAQ,OAAO,MAAM,8OAA8O,CAC3R,CAAA;QANQ,WAAM,GAAN,MAAM,CAAsB;QAC5B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAKvB,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAA;IAC7C,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEzC;IACA;IACA;IAHV,YACU,IAA0B,EAC1B,QAAgB,EAChB,MAAc;QAEvB,KAAK,CAAC,0BAA0B,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAA;QAJrD,SAAI,GAAJ,IAAI,CAAsB;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACxC,CAAC;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEzC;IACA;IACA;IAHV,YACU,IAA0B,EAC1B,QAAgB,EAChB,SAAiB;QAE1B,KAAK,CACJ,cAAc,IAAI,IAAI,QAAQ,yBAAyB,SAAS,kLAAkL,CAClP,CAAA;QANQ,SAAI,GAAJ,IAAI,CAAsB;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,cAAS,GAAT,SAAS,CAAQ;QAK1B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACxC,CAAC;CACD;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACnC,MAAM,CAAsB;IAC5B,IAAI,CAAQ;IACZ,MAAM,CAAS;IACf,YAAY,CAAS;IACrB,SAAS,CAA+B;IAEjD,YACC,OAAe,EACf,OAOC;QAED,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAClF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC9D,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAA;QAChF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,CAAC;CACD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC3D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IACzB,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAChC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAA;QACpD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,8BAA8B,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,0BAA0B,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACd,kEAAkE,0BAA0B,WAAW,IAAI,CAAC,SAAS,CACpH,KAAK,CACL,gRAAgR,8BAA8B,KAAK,CACpT,CAAA;IACF,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAI,OAAmB,EAAE,MAAmB;IACjE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5B,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzC,IAAI,IAAI,GAAG,KAAK,CAAA;QAChB,MAAM,OAAO,GAAG,GAAG,EAAE;YACpB,IAAI,GAAG,IAAI,CAAA;YACX,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACtB,CAAC,CAAA;QACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,OAAO,CAAC,IAAI,CACX,CAAC,KAAK,EAAE,EAAE;YACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAC5C,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YAClB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAC5C,IAAI,CAAC,IAAI;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACzB,CAAC,CACD,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAClD,CAAC;AASD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAiC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,IAAI,2BAA2B,CAAA;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IAChD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACd,4FAA4F,CAC5F,CAAA;IACF,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,GAAG,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACjE,OAAO;QACN,OAAO,EAAE,WAAW,IAAI,IAAI,IAAI,EAAE;QAClC,EAAE;QACF,SAAS;QACT,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,GAAG,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE;KACjE,CAAA;AACF,CAAC;AAED,SAAS,eAAe,CAAC,MAAgC;IACxD,OAAO;QACN,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KACzB,CAAA;AACF,CAAC;AAmBD,+EAA+E;AAC/E,KAAK,UAAU,YAAY,CAC1B,GAAW,EACX,MAA4B,EAC5B,OAA+B,EAC/B,OAA2B,EAC3B,MAAoB;IAEpB,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC7C,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAA;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAClD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS;QACpD,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE;KACtB,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CACpB,GAAW,EACX,MAA4B,EAC5B,OAA+B,EAC/B,OAA2B,EAC3B,EAAmB,EACnB,MAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3B,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CACxB;YACC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG;YACpD,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,MAAM;YACN,OAAO;YACP,EAAE;YACF,kBAAkB,EAAE,IAAI;YACxB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,EACD,CAAC,GAAG,EAAE,EAAE;YACP,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACrD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBAClB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;gBACtC,OAAO,CAAC;oBACP,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;oBAC3B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;oBAC3D,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;wBAChB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;wBAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC/C,CAAC;oBACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBACxD,CAAC,CAAA;YACH,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACxB,CAAC,CACD,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,IAAI,OAAO,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,GAAG,CAAC,GAAG,EAAE,CAAA;IACV,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAA4B,EAAE,SAA8B;IACnF,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,kBAAkB,CAAA;IACjD,OAAO,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,8BAA8B,CAAA;AAC7F,CAAC;AAED,MAAM,UAAU,sBAAsB,CACrC,MAAwB,EACxB,UAAmC,EAAE;IAErC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IAC/F,uEAAuE;IACvE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAE1E,KAAK,UAAU,OAAO,CACrB,MAA4B,EAC5B,IAAY,EACZ,IAAc,EACd,MAAoB,EACpB,YAAiC,OAAO;QAExC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,oEAAoE;QACpE,qEAAqE;QACrE,8CAA8C;QAC9C,sEAAsE;QACtE,gEAAgE;QAChE,uCAAuC;QACvC,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAA;QAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAA;QAC1C,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,QAAQ,GAAG,IAAI,CAAA;YACf,kBAAkB,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAA;QACxF,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACpB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QACf,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACzE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACrE,gEAAgE;QAChE,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAA;QACnD,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAgB,EAAmB,EAAE,CAC5D,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAA;QAE1C,IAAI,CAAC;YACJ,iEAAiE;YACjE,gEAAgE;YAChE,mEAAmE;YACnE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAA;YAChE,QAAQ,CAAC,cAAc,EAAE,CAAA;YACzB,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,IAAI,EAAE,CAAA;YACxC,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACrE,MAAM,OAAO,GAA2B;gBACvC,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,kBAAkB;aAC1B,CAAA;YACD,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YAEtF,IAAI,GAAgB,CAAA;YACpB,IAAI,CAAC;gBACJ,GAAG;oBACF,QAAQ,CAAC,EAAE,KAAK,SAAS;wBACxB,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;wBAC1E,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;YAChE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,IAAI,GAAG,YAAY,yBAAyB;oBAAE,MAAM,GAAG,CAAA;gBACvD,0DAA0D;gBAC1D,yDAAyD;gBACzD,mBAAmB;gBACnB,IAAI,QAAQ,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;oBACjC,MAAM,IAAI,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAA;gBACpE,CAAC;gBACD,iEAAiE;gBACjE,8DAA8D;gBAC9D,8BAA8B;gBAC9B,MAAM,IAAI,kBAAkB,CAC3B,cAAc,MAAM,IAAI,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1F,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAClD,CAAA;YACF,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9C,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACnB,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,MAAM,IAAI,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9D,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9C,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACnB,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,MAAM,IAAI,0BAA0B,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAC/D,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACnB,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,MAAM,IAAI,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAChD,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,8DAA8D;YAC9D,uBAAuB;YACvB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,OAAO,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACtE,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACnB,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,MAAM,IAAI,8BAA8B,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YACnE,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3C,iEAAiE;gBACjE,iEAAiE;gBACjE,gEAAgE;gBAChE,gEAAgE;gBAChE,yDAAyD;gBACzD,MAAM,YAAY,GACjB,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBACvC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;oBAC9C,CAAC,CAAC,SAAS,CAAA;gBACb,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAChC,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,MAAM,IAAI,kBAAkB,CAAC,cAAc,MAAM,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE;oBACtF,MAAM;oBACN,IAAI;oBACJ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,SAAS,EAAE,QAAQ;iBACnB,CAAC,CAAA;YACH,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAA;YACxC,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAChC,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAO,CAAC,CAAC,CAAC,SAAS,CAAA;YAC7D,CAAC;YACD,OAAO,SAAS,CAAA;QACjB,CAAC;gBAAS,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;QACzD,CAAC;IACF,CAAC;IAED,OAAO;QACN,OAAO;QACP,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS;KACnC,CAAA;AACF,CAAC"}

package/dist/backends/kubernetes/lease.d.ts

@@ -16,36 +16,48 @@
  *
  * One `setTimeout` chained per tick, never `setInterval`: a renewal PATCH
  * that takes longer than the interval must not queue a second one behind
- * it. The interval is HALF the TTL, so a single failed tick still leaves a
- * whole half-TTL of headroom for the next one to succeed, and it is
- * jittered ±10% so a hundred handles acquired in the same second do not
- * PATCH the API server in the same millisecond forever after.
+ * it. On SUCCESS the interval is HALF the TTL, jittered ±10% so a hundred
+ * handles acquired in the same second do not PATCH the API server in the
+ * same millisecond forever after.
  *
  * The timer is `unref`'d: a host process that has finished its work should
  * exit, not linger because a sandbox handle is still counting. A handle
  * nobody destroyed then expires on the cluster's clock exactly as an
  * abandoned one does, which is the behaviour the TTL exists for.
  *
+ * ## A failed tick does not wait for the next half-TTL
+ *
+ * Waiting a full half-TTL before retrying a FAILED renewal means one blip at
+ * exactly the wrong moment is a coin flip against the object's own
+ * `shutdownTime`: the retry and the expiry are both roughly a TTL after the
+ * last success, so a single failure can lose that race. A failed tick
+ * instead retries on capped exponential backoff — starting at one second,
+ * doubling, capped at whichever is smaller of thirty seconds or a
+ * twentieth of the TTL — so an outage around a scheduled renewal gets many
+ * attempts inside the window that actually matters, not one. Every success
+ * resets the backoff and returns the loop to the normal half-TTL cadence.
+ *
  * ## Every tick is bounded
  *
- * A renewal that FAILS is survivable — it is reported and retried with half
- * a TTL of headroom. A renewal that HANGS is not: the next tick is scheduled
+ * A renewal that FAILS is survivable — it is reported and retried on a
+ * short backoff. A renewal that HANGS is not: the next tick is scheduled
  * only after the current one settles, so a PATCH that never answers parks
  * the loop forever, reports nothing, and lets the lease expire in silence —
  * precisely the defect this file exists to close, moved onto the failure
  * path. An API server that accepts a connection and then never responds is
  * an ordinary cluster event, so each PATCH runs under its own deadline: it
  * aborts the request through the signal the client already takes, and an
- * expiry is then just another reported failure that retries on the next
- * tick.
+ * expiry is then just another reported failure that retries on backoff.
  *
  * ## What each outcome means
  *
- *  - Success → the object's expiry moves a full TTL into the future.
+ *  - Success → the object's expiry moves a full TTL into the future, the
+ *    backoff resets, and the next tick is a half-TTL away again.
  *  - Any error, a tick that ran out of time included → reported to
- *    `onRenewalError` and RETRIED on the next tick. A transient API blip
- *    must not tear down a working sandbox, and there is still half a TTL of
- *    headroom.
+ *    `onRenewalError` and RETRIED on a backoff far shorter than the
+ *    half-TTL interval. A transient API blip must not tear down a working
+ *    sandbox, and the loop keeps trying rather than spend the object's
+ *    remaining headroom waiting.
  *  - Already gone (404/410) → the object this handle owns no longer exists.
  *    Nothing will bring it back, so the loop stops and the handle is marked
  *    gone; every later call fails with a named error instead of dialing an
@@ -82,7 +94,7 @@ export interface LeaseRenewalOptions {
      * Defaults to a quarter of the interval, capped at
      * {@link MAX_RENEWAL_TIMEOUT_MS} — a fraction rather than the whole
      * interval so that a stalled API server still leaves the loop several
-     * attempts inside the half-TTL of headroom.
+     * backoff-paced attempts before the next regular half-TTL tick.
      */
     readonly patchTimeoutMs?: number;
     /** Deterministic jitter for tests. Defaults to `Math.random`. */
@@ -100,7 +112,13 @@ export declare class KubernetesLeaseRenewal {
     private started;
     private readonly baseIntervalMs;
     private readonly patchTimeoutMs;
+    private readonly retryBackoffCapMs;
     private readonly random;
+    /**
+     * Non-gone failures since the last success (or since the loop started).
+     * Reset to 0 by every success; drives how far the next retry backs off.
+     */
+    private consecutiveFailures;
     constructor(options: LeaseRenewalOptions);
     /**
      * The loop is alive: it has been started and not stopped. Deliberately
@@ -112,7 +130,15 @@ export declare class KubernetesLeaseRenewal {
     get active(): boolean;
     start(): void;
     stop(): void;
-    private schedule;
+    private scheduleNext;
+    /**
+     * The delay before the NEXT retry after a non-gone failure: capped
+     * exponential backoff from {@link RETRY_BACKOFF_FLOOR_MS}, doubling on
+     * every consecutive failure, ceilinged at {@link retryBackoffCapMs}.
+     * Called only once `consecutiveFailures` has already been incremented for
+     * the failure that just happened, so the first retry uses the floor.
+     */
+    private retryDelayMs;
     /** Exposed for tests: one renewal attempt plus its scheduling decision. */
     tick(): Promise<void>;
 }

package/dist/backends/kubernetes/lease.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lease.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAKH,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IACnC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7E,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IAClD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;CAC9B;AAaD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM,CAI7E;AAED;;;GAGG;AACH,qBAAa,sBAAsB;IAQtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAER,OAAO,EAAE,mBAAmB;IAQzD;;;;;;OAMG;IACH,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,KAAK,IAAI,IAAI;IAMb,IAAI,IAAI,IAAI;IAQZ,OAAO,CAAC,QAAQ;IAahB,2EAA2E;IACrE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA0B3B"}
+{"version":3,"file":"lease.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAKH,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IACnC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7E,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IAClD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;CAC9B;AA8BD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM,CAI7E;AAED;;;GAGG;AACH,qBAAa,sBAAsB;IActB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAbpC,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC;;;OAGG;IACH,OAAO,CAAC,mBAAmB,CAAI;gBAEF,OAAO,EAAE,mBAAmB;IAYzD;;;;;;OAMG;IACH,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,KAAK,IAAI,IAAI;IAMb,IAAI,IAAI,IAAI;IAQZ,OAAO,CAAC,YAAY;IAapB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAKpB,2EAA2E;IACrE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA+B3B"}