@namzu/sandbox 14.0.0 → 16.0.0

package/dist/backends/kubernetes/per-sandbox-policy.d.ts

@@ -0,0 +1,219 @@
+/**
+ * Per-sandbox egress: one policy object per LIVE sandbox, written by this
+ * host while the sandbox runs, so `Sandbox.setNetworkPolicy` means something
+ * here instead of being omitted.
+ *
+ * ## Why this is a separate file from `egress-policy.ts`
+ *
+ * That one is about the boundary an OPERATOR applies and this backend only
+ * ever reads: one object per backend, translated from config, verified and
+ * never written. This one is about an object this backend CREATES, replaces
+ * and lets the cluster collect — a different lifecycle, a different RBAC
+ * grant, and the only place in `@namzu/sandbox` that writes a policy at all.
+ * They share the manifest builder and the read-back comparator, which is the
+ * point: two spellings of "what a namzu egress policy looks like" would be
+ * one comparing itself against the other's shape.
+ *
+ * ## The shape
+ *
+ *  - **Name** `namzu-sbx-<uid>`, where the uid is the object the acquire
+ *    created for this sandbox — the `SandboxClaim` on the pooled path, the
+ *    `Sandbox` on the pool-less one. Unique per sandbox by construction, and
+ *    derivable from the owner reference alone, which is what lets the
+ *    admission policy check the two against each other.
+ *  - **Selector** one per-sandbox pod label, composed by
+ *    `composeAdditionalPodLabels` — the ONE composer — and carried onto the
+ *    pod as claim-time metadata before the pod exists. Not patched onto a
+ *    running pod: this backend holds no write verb on pods, and a label added
+ *    after the fact would leave a window in which the policy selected nothing.
+ *  - **Owner** an `ownerReferences` entry naming that same object, so
+ *    `destroy()` deletes the claim and the cluster's garbage collector
+ *    removes the policy. This backend issues no deletion of its own on
+ *    teardown, which is what keeps a crashed host from leaking policies.
+ *  - **Rules** the DNS-visibility rule plus one `toFQDNs` rule per allowed
+ *    host — `SandboxNetworkPolicy.allowedHosts`'s own grammar, where
+ *    `.example.com` means the domain and its subdomains. A `.domain` entry
+ *    and `narrowing.tlsServerNames` are refused TOGETHER: a TLS server name
+ *    is one exact SNI value and an expanded entry is a name plus a pattern,
+ *    so no single value means both and the emitted policy would deny the
+ *    domain it claims to allow.
+ *
+ * ## The fence is not a nicety
+ *
+ * Writing these needs `create`/`patch`/`delete` on the namespace's
+ * `ciliumnetworkpolicies`, and RBAC has no way to say "only the objects you
+ * own". A host holding those verbs could widen — or simply delete — the
+ * operator's own baseline policy. So before the FIRST write, this module
+ * proves an operator applied a `ValidatingAdmissionPolicy` and its binding,
+ * and refuses with {@link KubernetesAdmissionFenceMissingError}, having
+ * written nothing, if either is absent. The shipped example
+ * (`k8s/manifests/validatingadmissionpolicy-cilium.yaml`) bounds the host
+ * identity to this name prefix, an owner reference whose uid the name has to
+ * match, ONE selector label whose VALUE is that owner's own name (the shape
+ * alone would not bound anything — one label is exactly what selects every
+ * sandbox pod in the namespace), `toFQDNs` entries that each name something
+ * (`matchPattern: '*'` is a `toFQDNs` rule and is not an allowlist), the
+ * kube-dns rule on port 53, no address-based or entity-based peers and no
+ * ingress.
+ *
+ * ## Union, not replacement
+ *
+ * The cluster unions every policy selecting a pod, so what this writes ADDS
+ * to whatever `config.egress.policy` translated to. Under a `no-network` or
+ * `deny-all` baseline that makes the per-sandbox list the pod's whole
+ * boundary, which is the deployment this capability is for; under
+ * `allow-all` it adds nothing to a pod that could already reach everything,
+ * and `setNetworkPolicy([])` there does not deny everything the way
+ * `SandboxNetworkPolicy` describes. Nothing refuses that wiring — a
+ * permissive baseline with per-sandbox additions is a legitimate deployment
+ * — but it is not the one the SDK's sentence is about.
+ *
+ * ## What is NOT proven anywhere in this repository
+ *
+ * That any of it is ENFORCED. Enforcement is one CNI's data plane, and the
+ * only cluster available here runs none — every object below is proved
+ * against a fake API server, and its lifecycle, ownership, garbage collection
+ * and admission refusals against a local single-node cluster. "The allowed
+ * host answers and the disallowed one does not" is a statement about a
+ * network, and it needs a cluster that enforces plus a positive control.
+ */
+import type { SandboxNetworkPolicy } from '@namzu/sdk';
+import { type KubernetesEgressConfig, KubernetesNetworkPolicyHostError, type KubernetesPerSandboxEgressConfig } from './egress-policy.js';
+import { type KubernetesClient } from './k8s-client.js';
+import { type KubernetesOwnerReference } from './objects.js';
+/**
+ * Every per-sandbox policy's name starts with this, and the shipped admission
+ * policy refuses one that does not.
+ *
+ * It is a CONSTANT rather than an option because it is half of a contract
+ * with an object an operator applies: a configurable prefix would be a
+ * configuration the fence could not know about, and a fence that trusted the
+ * host to tell it what to allow would not be one.
+ */
+export declare const PER_SANDBOX_POLICY_NAME_PREFIX = "namzu-sbx-";
+/** `namzu-sbx-<uid>` — the only name this backend ever writes a policy under. */
+export declare function perSandboxPolicyName(ownerUid: string): string;
+/**
+ * The object a per-sandbox policy belongs to: what the acquire created, which
+ * is what the cluster deletes when the sandbox is destroyed.
+ *
+ * Two kinds, because this backend has two acquire paths and both must be able
+ * to carry the capability: a `SandboxClaim` when the sandbox came out of a
+ * warm pool, the `Sandbox` itself when it did not. The claim is the one the
+ * issue names; the direct object works identically for garbage collection,
+ * and refusing the pool-less path would be refusing it for a reason that is
+ * about the pool rather than about the policy.
+ */
+export interface PerSandboxPolicyOwner {
+    readonly kind: 'SandboxClaim' | 'Sandbox';
+    readonly name: string;
+    /** `metadata.uid`, as the API server assigned it. Also the policy's name suffix. */
+    readonly uid: string;
+}
+/** The `ownerReferences` entry that makes the cluster collect the policy. */
+export declare function perSandboxPolicyOwnerReference(owner: PerSandboxPolicyOwner): KubernetesOwnerReference;
+/**
+ * Raised when the fence check is REFUSED rather than answered — a 401/403 on
+ * one of the two cluster-scoped admission objects.
+ *
+ * Its own class rather than a reuse of
+ * {@link KubernetesAdmissionFenceMissingError}, because the two ask for
+ * different actions and conflating them would send an operator to apply a
+ * fence that may already be there: 404 means the object does not exist, 403
+ * means this host may not look. The most common cause is applying
+ * `rbac-per-sandbox-egress.yaml`'s namespaced Role without the ClusterRole in
+ * the same file, so the message names that file rather than the manifest the
+ * missing-fence error names.
+ */
+export declare class KubernetesAdmissionFenceUnreadableError extends Error {
+    readonly resourceKind: 'ValidatingAdmissionPolicy' | 'ValidatingAdmissionPolicyBinding';
+    readonly objectName: string;
+    readonly path: string;
+    readonly name = "KubernetesAdmissionFenceUnreadableError";
+    constructor(resourceKind: 'ValidatingAdmissionPolicy' | 'ValidatingAdmissionPolicyBinding', objectName: string, path: string, cause: unknown);
+}
+/**
+ * Raised when the admission fence is not in place — the policy, its binding,
+ * or both — and therefore before anything has been written.
+ *
+ * Refusing rather than proceeding is the whole design: the fence is what
+ * makes the write verbs safe to hold, so a deployment that granted them and
+ * has not applied the fence is in exactly the state the capability exists to
+ * avoid. A `ValidatingAdmissionPolicy` with no BINDING is inert — it validates
+ * nothing at all — which is why the binding is checked separately rather than
+ * assumed from the policy's existence.
+ */
+export declare class KubernetesAdmissionFenceMissingError extends Error {
+    readonly resourceKind: 'ValidatingAdmissionPolicy' | 'ValidatingAdmissionPolicyBinding';
+    readonly objectName: string;
+    readonly path: string;
+    readonly name = "KubernetesAdmissionFenceMissingError";
+    constructor(resourceKind: 'ValidatingAdmissionPolicy' | 'ValidatingAdmissionPolicyBinding', objectName: string, path: string);
+}
+/**
+ * Raised for an `allowedHosts` entry this backend will not translate —
+ * re-exported rather than defined here.
+ *
+ * It lives in `egress-policy.ts` beside {@link assertHostsFitNarrowing} and
+ * {@link assertUsableHost}, because the config-level translation raises the
+ * same class for the same entry and this module imports both checks from
+ * there: defining it here would make the two modules import each other. The
+ * identifier is re-exported so every existing import path — including the
+ * package index — keeps resolving.
+ */
+export { KubernetesNetworkPolicyHostError };
+/**
+ * Raised when the object an acquire created reported no `metadata.uid`.
+ *
+ * Its own exported class rather than a bare `Error` because every other
+ * refusal this capability adds is catchable by class, and this one refuses an
+ * ACQUIRE: a caller that wants to fall back to a sandbox without per-sandbox
+ * egress has to be able to tell it from a readiness timeout.
+ */
+export declare class KubernetesOwnerUidMissingError extends Error {
+    readonly objectName: string;
+    readonly namespace: string;
+    readonly name = "KubernetesOwnerUidMissingError";
+    constructor(objectName: string, namespace: string);
+}
+/**
+ * The once-per-backend proof that the fence exists.
+ *
+ * Memoized on SUCCESS only, exactly as the egress named-object check is: a
+ * transient API failure must not wedge every later `setNetworkPolicy` behind
+ * a stale rejection, and an operator who applies the fence after the first
+ * refusal gets the next call through without restarting the host.
+ */
+export interface PerSandboxPolicyFence {
+    assertApplied(signal?: AbortSignal): Promise<void>;
+}
+export declare function buildAdmissionFence(client: KubernetesClient, perSandbox: KubernetesPerSandboxEgressConfig): PerSandboxPolicyFence;
+/** What one sandbox's policy writer needs to know. */
+export interface PerSandboxPolicySetterOptions {
+    readonly client: KubernetesClient;
+    readonly fence: PerSandboxPolicyFence;
+    readonly namespace: string;
+    readonly egress: KubernetesEgressConfig & {
+        readonly perSandbox: KubernetesPerSandboxEgressConfig;
+    };
+    /** The object the acquire created, which owns the policy. */
+    readonly owner: PerSandboxPolicyOwner;
+    /**
+     * The per-sandbox label's VALUE on this sandbox's pod — the name of the
+     * object above, put there by `composeAdditionalPodLabels` and CONFIRMED on
+     * the bound pod before the sandbox was admitted. The key comes from
+     * config, through the one resolver.
+     */
+    readonly selectorValue: string;
+}
+/**
+ * Build the `setNetworkPolicy` this backend attaches to a sandbox handle.
+ *
+ * Calls are SERIALIZED per sandbox. Two overlapping calls would otherwise
+ * interleave create, replace and read-back against one object, and the loser
+ * would resolve having verified the winner's rules — a caller told its policy
+ * was applied when a different one is in force is the exact failure the
+ * read-back exists to prevent.
+ */
+export declare function buildPerSandboxPolicySetter(options: PerSandboxPolicySetterOptions): (policy: SandboxNetworkPolicy) => Promise<void>;
+//# sourceMappingURL=per-sandbox-policy.d.ts.map

package/dist/backends/kubernetes/per-sandbox-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"per-sandbox-policy.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/per-sandbox-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD,OAAO,EACN,KAAK,sBAAsB,EAC3B,gCAAgC,EAChC,KAAK,gCAAgC,EAQrC,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAEN,KAAK,gBAAgB,EAGrB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,KAAK,wBAAwB,EAQ7B,MAAM,cAAc,CAAA;AAErB;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,eAAe,CAAA;AAE1D,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oFAAoF;IACpF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACpB;AAED,6EAA6E;AAC7E,wBAAgB,8BAA8B,CAC7C,KAAK,EAAE,qBAAqB,GAC1B,wBAAwB,CAS1B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,uCAAwC,SAAQ,KAAK;IAIhE,QAAQ,CAAC,YAAY,EAAE,2BAA2B,GAAG,kCAAkC;IACvF,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM;IALtB,SAAkB,IAAI,6CAA4C;gBAGxD,YAAY,EAAE,2BAA2B,GAAG,kCAAkC,EAC9E,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACrB,KAAK,EAAE,OAAO;CAOf;AAED;;;;;;;;;;GAUG;AACH,qBAAa,oCAAqC,SAAQ,KAAK;IAI7D,QAAQ,CAAC,YAAY,EAAE,2BAA2B,GAAG,kCAAkC;IACvF,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM;IALtB,SAAkB,IAAI,0CAAyC;gBAGrD,YAAY,EAAE,2BAA2B,GAAG,kCAAkC,EAC9E,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM;CAMtB;AAED;;;;;;;;;;GAUG;AACH,OAAO,EAAE,gCAAgC,EAAE,CAAA;AA4B3C;;;;;;;GAOG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;IAIvD,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAJ3B,SAAkB,IAAI,oCAAmC;gBAG/C,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM;CAM3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACrC,aAAa,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClD;AAED,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,gCAAgC,GAC1C,qBAAqB,CA+CvB;AAED,sDAAsD;AACtD,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG;QACzC,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAA;KACrD,CAAA;IACD,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,6BAA6B,GACpC,CAAC,MAAM,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAiIjD"}

package/dist/backends/kubernetes/per-sandbox-policy.js

@@ -0,0 +1,375 @@
+/**
+ * Per-sandbox egress: one policy object per LIVE sandbox, written by this
+ * host while the sandbox runs, so `Sandbox.setNetworkPolicy` means something
+ * here instead of being omitted.
+ *
+ * ## Why this is a separate file from `egress-policy.ts`
+ *
+ * That one is about the boundary an OPERATOR applies and this backend only
+ * ever reads: one object per backend, translated from config, verified and
+ * never written. This one is about an object this backend CREATES, replaces
+ * and lets the cluster collect — a different lifecycle, a different RBAC
+ * grant, and the only place in `@namzu/sandbox` that writes a policy at all.
+ * They share the manifest builder and the read-back comparator, which is the
+ * point: two spellings of "what a namzu egress policy looks like" would be
+ * one comparing itself against the other's shape.
+ *
+ * ## The shape
+ *
+ *  - **Name** `namzu-sbx-<uid>`, where the uid is the object the acquire
+ *    created for this sandbox — the `SandboxClaim` on the pooled path, the
+ *    `Sandbox` on the pool-less one. Unique per sandbox by construction, and
+ *    derivable from the owner reference alone, which is what lets the
+ *    admission policy check the two against each other.
+ *  - **Selector** one per-sandbox pod label, composed by
+ *    `composeAdditionalPodLabels` — the ONE composer — and carried onto the
+ *    pod as claim-time metadata before the pod exists. Not patched onto a
+ *    running pod: this backend holds no write verb on pods, and a label added
+ *    after the fact would leave a window in which the policy selected nothing.
+ *  - **Owner** an `ownerReferences` entry naming that same object, so
+ *    `destroy()` deletes the claim and the cluster's garbage collector
+ *    removes the policy. This backend issues no deletion of its own on
+ *    teardown, which is what keeps a crashed host from leaking policies.
+ *  - **Rules** the DNS-visibility rule plus one `toFQDNs` rule per allowed
+ *    host — `SandboxNetworkPolicy.allowedHosts`'s own grammar, where
+ *    `.example.com` means the domain and its subdomains. A `.domain` entry
+ *    and `narrowing.tlsServerNames` are refused TOGETHER: a TLS server name
+ *    is one exact SNI value and an expanded entry is a name plus a pattern,
+ *    so no single value means both and the emitted policy would deny the
+ *    domain it claims to allow.
+ *
+ * ## The fence is not a nicety
+ *
+ * Writing these needs `create`/`patch`/`delete` on the namespace's
+ * `ciliumnetworkpolicies`, and RBAC has no way to say "only the objects you
+ * own". A host holding those verbs could widen — or simply delete — the
+ * operator's own baseline policy. So before the FIRST write, this module
+ * proves an operator applied a `ValidatingAdmissionPolicy` and its binding,
+ * and refuses with {@link KubernetesAdmissionFenceMissingError}, having
+ * written nothing, if either is absent. The shipped example
+ * (`k8s/manifests/validatingadmissionpolicy-cilium.yaml`) bounds the host
+ * identity to this name prefix, an owner reference whose uid the name has to
+ * match, ONE selector label whose VALUE is that owner's own name (the shape
+ * alone would not bound anything — one label is exactly what selects every
+ * sandbox pod in the namespace), `toFQDNs` entries that each name something
+ * (`matchPattern: '*'` is a `toFQDNs` rule and is not an allowlist), the
+ * kube-dns rule on port 53, no address-based or entity-based peers and no
+ * ingress.
+ *
+ * ## Union, not replacement
+ *
+ * The cluster unions every policy selecting a pod, so what this writes ADDS
+ * to whatever `config.egress.policy` translated to. Under a `no-network` or
+ * `deny-all` baseline that makes the per-sandbox list the pod's whole
+ * boundary, which is the deployment this capability is for; under
+ * `allow-all` it adds nothing to a pod that could already reach everything,
+ * and `setNetworkPolicy([])` there does not deny everything the way
+ * `SandboxNetworkPolicy` describes. Nothing refuses that wiring — a
+ * permissive baseline with per-sandbox additions is a legitimate deployment
+ * — but it is not the one the SDK's sentence is about.
+ *
+ * ## What is NOT proven anywhere in this repository
+ *
+ * That any of it is ENFORCED. Enforcement is one CNI's data plane, and the
+ * only cluster available here runs none — every object below is proved
+ * against a fake API server, and its lifecycle, ownership, garbage collection
+ * and admission refusals against a local single-node cluster. "The allowed
+ * host answers and the disallowed one does not" is a statement about a
+ * network, and it needs a cluster that enforces plus a positive control.
+ */
+import { KubernetesNetworkPolicyHostError, PER_SANDBOX_NARROWING_REFUSAL, assertHostsFitNarrowing, assertUsableHost, buildCiliumEgressManifest, perSandboxEgressLabelKey, verifyEgressPolicyApplied, } from './egress-policy.js';
+import { KubernetesAlreadyGoneError, KubernetesConflictError, KubernetesCredentialError, } from './k8s-client.js';
+import { SANDBOX_API_GROUP, SANDBOX_API_VERSION, SANDBOX_EXTENSIONS_API_GROUP, ciliumNetworkPolicyCollectionPath, ciliumNetworkPolicyPath, validatingAdmissionPolicyBindingPath, validatingAdmissionPolicyPath, } from './objects.js';
+/**
+ * Every per-sandbox policy's name starts with this, and the shipped admission
+ * policy refuses one that does not.
+ *
+ * It is a CONSTANT rather than an option because it is half of a contract
+ * with an object an operator applies: a configurable prefix would be a
+ * configuration the fence could not know about, and a fence that trusted the
+ * host to tell it what to allow would not be one.
+ */
+export const PER_SANDBOX_POLICY_NAME_PREFIX = 'namzu-sbx-';
+/** `namzu-sbx-<uid>` — the only name this backend ever writes a policy under. */
+export function perSandboxPolicyName(ownerUid) {
+    return `${PER_SANDBOX_POLICY_NAME_PREFIX}${ownerUid}`;
+}
+/** The `ownerReferences` entry that makes the cluster collect the policy. */
+export function perSandboxPolicyOwnerReference(owner) {
+    return {
+        apiVersion: `${owner.kind === 'SandboxClaim' ? SANDBOX_EXTENSIONS_API_GROUP : SANDBOX_API_GROUP}/${SANDBOX_API_VERSION}`,
+        kind: owner.kind,
+        name: owner.name,
+        uid: owner.uid,
+    };
+}
+/**
+ * Raised when the fence check is REFUSED rather than answered — a 401/403 on
+ * one of the two cluster-scoped admission objects.
+ *
+ * Its own class rather than a reuse of
+ * {@link KubernetesAdmissionFenceMissingError}, because the two ask for
+ * different actions and conflating them would send an operator to apply a
+ * fence that may already be there: 404 means the object does not exist, 403
+ * means this host may not look. The most common cause is applying
+ * `rbac-per-sandbox-egress.yaml`'s namespaced Role without the ClusterRole in
+ * the same file, so the message names that file rather than the manifest the
+ * missing-fence error names.
+ */
+export class KubernetesAdmissionFenceUnreadableError extends Error {
+    resourceKind;
+    objectName;
+    path;
+    name = 'KubernetesAdmissionFenceUnreadableError';
+    constructor(resourceKind, objectName, path, cause) {
+        super(`kubernetes: config.egress.perSandbox is configured but this host may not READ the ${resourceKind} named ${objectName} (${path}), so it cannot prove the fence that bounds what it writes. Both admission objects are cluster-scoped: the namespaced Role in k8s/manifests/rbac-per-sandbox-egress.yaml is not enough on its own, and the ClusterRole and ClusterRoleBinding in that same file are what grant the read. Nothing was written.`, { cause });
+        this.resourceKind = resourceKind;
+        this.objectName = objectName;
+        this.path = path;
+    }
+}
+/**
+ * Raised when the admission fence is not in place — the policy, its binding,
+ * or both — and therefore before anything has been written.
+ *
+ * Refusing rather than proceeding is the whole design: the fence is what
+ * makes the write verbs safe to hold, so a deployment that granted them and
+ * has not applied the fence is in exactly the state the capability exists to
+ * avoid. A `ValidatingAdmissionPolicy` with no BINDING is inert — it validates
+ * nothing at all — which is why the binding is checked separately rather than
+ * assumed from the policy's existence.
+ */
+export class KubernetesAdmissionFenceMissingError extends Error {
+    resourceKind;
+    objectName;
+    path;
+    name = 'KubernetesAdmissionFenceMissingError';
+    constructor(resourceKind, objectName, path) {
+        super(`kubernetes: config.egress.perSandbox is configured but no ${resourceKind} named ${objectName} exists (${path}), so nothing would bound what this host writes to the namespace's CiliumNetworkPolicies. Apply k8s/manifests/validatingadmissionpolicy-cilium.yaml (and its binding) before calling setNetworkPolicy — the host holds create/patch/delete on every policy in the namespace, and the fence is what limits that to objects named ${PER_SANDBOX_POLICY_NAME_PREFIX}<owner uid>, selected by one label, carrying only toFQDNs and the cluster-DNS rule. Nothing was written.`);
+        this.resourceKind = resourceKind;
+        this.objectName = objectName;
+        this.path = path;
+    }
+}
+/**
+ * Raised for an `allowedHosts` entry this backend will not translate —
+ * re-exported rather than defined here.
+ *
+ * It lives in `egress-policy.ts` beside {@link assertHostsFitNarrowing} and
+ * {@link assertUsableHost}, because the config-level translation raises the
+ * same class for the same entry and this module imports both checks from
+ * there: defining it here would make the two modules import each other. The
+ * identifier is re-exported so every existing import path — including the
+ * package index — keeps resolving.
+ */
+export { KubernetesNetworkPolicyHostError };
+/**
+ * One `allowedHosts` entry, validated and canonicalised to the bytes a
+ * `CiliumNetworkPolicy` should carry.
+ *
+ * Lowercasing is not leniency: DNS names are case-insensitive, so
+ * `API.example.com` and `api.example.com` name the same host, and Cilium's
+ * `matchName` is compared against what the DNS proxy saw — lowercase. The
+ * docker backend accepts either case, and a list that worked there and threw
+ * here would be a portability trap with no boundary behind it.
+ *
+ * The grammar itself is {@link assertUsableHost}'s, in `egress-policy.ts`
+ * beside the error it throws, because it is no longer only this writer's: the
+ * shared translation calls it too, so a config-level allowlist is refused the
+ * same entries this path refuses. What is HERE is the part that is this
+ * writer's alone — the canonicalisation, applied before the fence is read and
+ * before anything is queued behind a previous call.
+ */
+function normalizeHost(entry) {
+    if (typeof entry !== 'string') {
+        throw new KubernetesNetworkPolicyHostError(String(entry), 'is not a string');
+    }
+    const canonical = entry.toLowerCase();
+    assertUsableHost(canonical);
+    return canonical;
+}
+/**
+ * Raised when the object an acquire created reported no `metadata.uid`.
+ *
+ * Its own exported class rather than a bare `Error` because every other
+ * refusal this capability adds is catchable by class, and this one refuses an
+ * ACQUIRE: a caller that wants to fall back to a sandbox without per-sandbox
+ * egress has to be able to tell it from a readiness timeout.
+ */
+export class KubernetesOwnerUidMissingError extends Error {
+    objectName;
+    namespace;
+    name = 'KubernetesOwnerUidMissingError';
+    constructor(objectName, namespace) {
+        super(`kubernetes: ${objectName} in namespace ${namespace} was created but reported no metadata.uid, in its create reply or in any readiness read. config.egress.perSandbox needs that uid: it is what a per-sandbox CiliumNetworkPolicy names in its ownerReferences (so the cluster deletes the policy with the object) and the suffix of the policy's own name. Refusing rather than handing back a sandbox whose setNetworkPolicy would write an orphan.`);
+        this.objectName = objectName;
+        this.namespace = namespace;
+    }
+}
+export function buildAdmissionFence(client, perSandbox) {
+    const policyName = perSandbox.admissionPolicyName;
+    const bindingName = perSandbox.admissionPolicyBindingName ?? `${policyName}-binding`;
+    let applied;
+    const read = async (kind, name, path, signal) => {
+        try {
+            await client.request('GET', path, undefined, signal);
+        }
+        catch (err) {
+            if (err instanceof KubernetesAlreadyGoneError) {
+                throw new KubernetesAdmissionFenceMissingError(kind, name, path);
+            }
+            // A 401/403 is NOT "the fence is missing": the object may be there
+            // and this host simply may not read it. Both refuse the write, and
+            // they send an operator to different files.
+            if (err instanceof KubernetesCredentialError) {
+                throw new KubernetesAdmissionFenceUnreadableError(kind, name, path, err);
+            }
+            throw err;
+        }
+    };
+    return {
+        async assertApplied(signal) {
+            applied ??= (async () => {
+                await read('ValidatingAdmissionPolicy', policyName, validatingAdmissionPolicyPath(policyName), signal);
+                await read('ValidatingAdmissionPolicyBinding', bindingName, validatingAdmissionPolicyBindingPath(bindingName), signal);
+            })().catch((err) => {
+                applied = undefined;
+                throw err;
+            });
+            await applied;
+        },
+    };
+}
+/**
+ * Build the `setNetworkPolicy` this backend attaches to a sandbox handle.
+ *
+ * Calls are SERIALIZED per sandbox. Two overlapping calls would otherwise
+ * interleave create, replace and read-back against one object, and the loser
+ * would resolve having verified the winner's rules — a caller told its policy
+ * was applied when a different one is in force is the exact failure the
+ * read-back exists to prevent.
+ */
+export function buildPerSandboxPolicySetter(options) {
+    const { client, fence, namespace, egress, owner, selectorValue } = options;
+    const perSandbox = egress.perSandbox;
+    const labelKey = perSandboxEgressLabelKey(egress);
+    if (labelKey === undefined) {
+        // Unreachable: the type above requires `perSandbox`, and the resolver
+        // returns a key whenever it is present.
+        throw new Error('kubernetes: per-sandbox egress is not configured');
+    }
+    const name = perSandboxPolicyName(owner.uid);
+    const path = ciliumNetworkPolicyPath(namespace, name);
+    let queue = Promise.resolve();
+    const translate = (allowedHosts) => buildCiliumEgressManifest({
+        namespace,
+        name,
+        selectorLabels: { [labelKey]: selectorValue },
+        allowedHosts,
+        // The CONFIGURED kind this stands in for: a host-supplied
+        // allowlist is exactly what `'static'` means, and a refusal that
+        // named anything else would send a reader to the wrong config key.
+        policyKind: 'static',
+        ...(perSandbox.narrowing !== undefined ? { narrowing: perSandbox.narrowing } : {}),
+        ownerReferences: [perSandboxPolicyOwnerReference(owner)],
+        refusalContext: PER_SANDBOX_NARROWING_REFUSAL,
+    });
+    const write = async (translated) => {
+        const body = translated.manifest;
+        try {
+            await client.request('POST', ciliumNetworkPolicyCollectionPath(namespace), body);
+        }
+        catch (err) {
+            // The object already exists — this sandbox is narrowing its egress
+            // a second time. A merge patch replaces `spec.egress` wholesale
+            // (RFC 7386 replaces arrays), which is what a REPLACEMENT policy
+            // needs, and the read-back below proves it rather than assuming it.
+            if (!(err instanceof KubernetesConflictError))
+                throw err;
+            await client.request('PATCH', path, body);
+        }
+        // Resolve only once the cluster's own copy deep-equals the
+        // translation, through the comparator the config-level check already
+        // uses. A policy the API server accepted and mutated — a defaulting
+        // webhook, an operator's own automation — would otherwise be reported
+        // as the policy the caller asked for.
+        //
+        // One inherited wording to know about: if the object is GONE by the
+        // time it is read back, the shared comparator raises
+        // `KubernetesEgressPolicyNotAppliedError`, whose message asks an
+        // operator to apply the manifest this backend computed. Here that is
+        // not the action — the object was written a moment ago, so it being
+        // gone means its owner was deleted underneath the call and this
+        // sandbox is already being destroyed. The refusal is still right; only
+        // its advice belongs to the other caller.
+        await verifyEgressPolicyApplied(client, translated);
+    };
+    const remove = async () => {
+        try {
+            await client.request('DELETE', path);
+        }
+        catch (err) {
+            // Already gone is the state DELETE was asking for — the cluster
+            // may have collected it with the claim while this call was in
+            // flight.
+            if (!(err instanceof KubernetesAlreadyGoneError))
+                throw err;
+        }
+    };
+    return async (policy) => {
+        // Validated BEFORE the queue, so a malformed list is refused with
+        // nothing written and nothing waited for. `normalizeHost` also
+        // lowercases: DNS names are case-insensitive, the docker backend
+        // accepts either case, and a `CiliumNetworkPolicy` matches names the
+        // resolver returns — which are lowercase. Refusing `API.example.com`
+        // on one backend and honouring it on another would be a portability
+        // trap, so it is canonicalised here instead.
+        const hosts = [...(policy?.allowedHosts ?? [])].map(normalizeHost);
+        // And refused here rather than emitted: an entry the CONFIGURED
+        // narrowing cannot express is one whose policy would read as applied
+        // and deny what it names. The shared guard refuses it again inside the
+        // translation, so every caller is covered; this call is the earlier
+        // one, before the fence is read and before anything is queued behind a
+        // previous call.
+        assertHostsFitNarrowing(hosts, perSandbox.narrowing, 
+        // The per-sandbox context, from `egress-policy.ts` rather than
+        // rebuilt here: it is the SAME value `buildCiliumEgressManifest`
+        // refuses by on this path (`refusalContext`), so the earlier check
+        // and the translation's own cannot name different fields — and the
+        // sentence it carries is the true one here, where the entry really
+        // does become a name plus a `*.domain` pattern. Sending this caller
+        // to `config.egress.ciliumNarrowing` would name a field a
+        // `perSandbox` host never set.
+        PER_SANDBOX_NARROWING_REFUSAL);
+        // A previous call's failure belongs to that caller; this one still runs,
+        // in order behind it.
+        const run = queue.then(async () => {
+            // Before EVERY write — the DELETE below included — and before
+            // every one until the fence check succeeds: nothing is sent while
+            // the fence is missing.
+            //
+            // The DELETE is checked too because the plan's invariant is about
+            // writes, not about widening: a host that never proved the fence
+            // must not reach the namespace's policies with any verb it holds.
+            // The cost is a deployment that REMOVES the fence mid-run, whose
+            // `setNetworkPolicy([])` is then refused and whose sandbox keeps
+            // the wider per-sandbox allowance until it is destroyed and the
+            // cluster collects the policy with its owner. That is a loud,
+            // named refusal the caller can act on, which is the better half
+            // of the trade against a silent unfenced write.
+            await fence.assertApplied();
+            // An EMPTY list is not "no policy": it deletes this sandbox's own
+            // object and leaves the configured baseline — whatever
+            // `config.egress.policy` translated to, plus every other policy
+            // selecting the pod — in force.
+            if (hosts.length === 0) {
+                await remove();
+                return;
+            }
+            await write(translate(hosts));
+        });
+        queue = run.then(() => undefined, () => undefined);
+        await run;
+    };
+}
+//# sourceMappingURL=per-sandbox-policy.js.map

package/dist/backends/kubernetes/per-sandbox-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"per-sandbox-policy.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/per-sandbox-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAIH,OAAO,EAEN,gCAAgC,EAGhC,6BAA6B,EAC7B,uBAAuB,EACvB,gBAAgB,EAChB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,GACzB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACN,0BAA0B,EAE1B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAEN,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,oCAAoC,EACpC,6BAA6B,GAC7B,MAAM,cAAc,CAAA;AAErB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CAAA;AAE1D,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACpD,OAAO,GAAG,8BAA8B,GAAG,QAAQ,EAAE,CAAA;AACtD,CAAC;AAoBD,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B,CAC7C,KAA4B;IAE5B,OAAO;QACN,UAAU,EAAE,GACX,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,iBAChE,IAAI,mBAAmB,EAAE;QACzB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;KACd,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,uCAAwC,SAAQ,KAAK;IAIvD;IACA;IACA;IALQ,IAAI,GAAG,yCAAyC,CAAA;IAElE,YACU,YAA8E,EAC9E,UAAkB,EAClB,IAAY,EACrB,KAAc;QAEd,KAAK,CACJ,qFAAqF,YAAY,UAAU,UAAU,KAAK,IAAI,+SAA+S,EAC7a,EAAE,KAAK,EAAE,CACT,CAAA;QARQ,iBAAY,GAAZ,YAAY,CAAkE;QAC9E,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAQ;IAOtB,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAIpD;IACA;IACA;IALQ,IAAI,GAAG,sCAAsC,CAAA;IAE/D,YACU,YAA8E,EAC9E,UAAkB,EAClB,IAAY;QAErB,KAAK,CACJ,6DAA6D,YAAY,UAAU,UAAU,YAAY,IAAI,mUAAmU,8BAA8B,0GAA0G,CACxjB,CAAA;QANQ,iBAAY,GAAZ,YAAY,CAAkE;QAC9E,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAQ;IAKtB,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,OAAO,EAAE,gCAAgC,EAAE,CAAA;AAE3C;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,aAAa,CAAC,KAAa;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;IACrC,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAC3B,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAI9C;IACA;IAJQ,IAAI,GAAG,gCAAgC,CAAA;IAEzD,YACU,UAAkB,EAClB,SAAiB;QAE1B,KAAK,CACJ,eAAe,UAAU,iBAAiB,SAAS,oYAAoY,CACvb,CAAA;QALQ,eAAU,GAAV,UAAU,CAAQ;QAClB,cAAS,GAAT,SAAS,CAAQ;IAK3B,CAAC;CACD;AAcD,MAAM,UAAU,mBAAmB,CAClC,MAAwB,EACxB,UAA4C;IAE5C,MAAM,UAAU,GAAG,UAAU,CAAC,mBAAmB,CAAA;IACjD,MAAM,WAAW,GAAG,UAAU,CAAC,0BAA0B,IAAI,GAAG,UAAU,UAAU,CAAA;IACpF,IAAI,OAAkC,CAAA;IACtC,MAAM,IAAI,GAAG,KAAK,EACjB,IAAsE,EACtE,IAAY,EACZ,IAAY,EACZ,MAAoB,EACJ,EAAE;QAClB,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;gBAC/C,MAAM,IAAI,oCAAoC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;YACjE,CAAC;YACD,mEAAmE;YACnE,mEAAmE;YACnE,4CAA4C;YAC5C,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC9C,MAAM,IAAI,uCAAuC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;YACzE,CAAC;YACD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC,CAAA;IACD,OAAO;QACN,KAAK,CAAC,aAAa,CAAC,MAAM;YACzB,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;gBACvB,MAAM,IAAI,CACT,2BAA2B,EAC3B,UAAU,EACV,6BAA6B,CAAC,UAAU,CAAC,EACzC,MAAM,CACN,CAAA;gBACD,MAAM,IAAI,CACT,kCAAkC,EAClC,WAAW,EACX,oCAAoC,CAAC,WAAW,CAAC,EACjD,MAAM,CACN,CAAA;YACF,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAC3B,OAAO,GAAG,SAAS,CAAA;gBACnB,MAAM,GAAG,CAAA;YACV,CAAC,CAAC,CAAA;YACF,MAAM,OAAO,CAAA;QACd,CAAC;KACD,CAAA;AACF,CAAC;AAqBD;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAC1C,OAAsC;IAEtC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAA;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;IACpC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;IACjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,sEAAsE;QACtE,wCAAwC;QACxC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACrD,IAAI,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAE5C,MAAM,SAAS,GAAG,CAAC,YAA+B,EAAoC,EAAE,CACvF,yBAAyB,CAAC;QACzB,SAAS;QACT,IAAI;QACJ,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE;QAC7C,YAAY;QACZ,0DAA0D;QAC1D,iEAAiE;QACjE,mEAAmE;QACnE,UAAU,EAAE,QAAQ;QACpB,GAAG,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,eAAe,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACxD,cAAc,EAAE,6BAA6B;KAC7C,CAAC,CAAA;IAEH,MAAM,KAAK,GAAG,KAAK,EAAE,UAA4C,EAAiB,EAAE;QACnF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAA;QAChC,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,iCAAiC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;QACjF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,mEAAmE;YACnE,gEAAgE;YAChE,iEAAiE;YACjE,oEAAoE;YACpE,IAAI,CAAC,CAAC,GAAG,YAAY,uBAAuB,CAAC;gBAAE,MAAM,GAAG,CAAA;YACxD,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1C,CAAC;QACD,2DAA2D;QAC3D,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,sCAAsC;QACtC,EAAE;QACF,oEAAoE;QACpE,qDAAqD;QACrD,iEAAiE;QACjE,qEAAqE;QACrE,oEAAoE;QACpE,gEAAgE;QAChE,uEAAuE;QACvE,0CAA0C;QAC1C,MAAM,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACpD,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACxC,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,gEAAgE;YAChE,8DAA8D;YAC9D,UAAU;YACV,IAAI,CAAC,CAAC,GAAG,YAAY,0BAA0B,CAAC;gBAAE,MAAM,GAAG,CAAA;QAC5D,CAAC;IACF,CAAC,CAAA;IAED,OAAO,KAAK,EAAE,MAA4B,EAAiB,EAAE;QAC5D,kEAAkE;QAClE,+DAA+D;QAC/D,iEAAiE;QACjE,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,6CAA6C;QAC7C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAClE,gEAAgE;QAChE,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,uEAAuE;QACvE,iBAAiB;QACjB,uBAAuB,CACtB,KAAK,EACL,UAAU,CAAC,SAAS;QACpB,+DAA+D;QAC/D,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,oEAAoE;QACpE,0DAA0D;QAC1D,+BAA+B;QAC/B,6BAA6B,CAC7B,CAAA;QACD,yEAAyE;QACzE,sBAAsB;QACtB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACjC,8DAA8D;YAC9D,kEAAkE;YAClE,wBAAwB;YACxB,EAAE;YACF,kEAAkE;YAClE,iEAAiE;YACjE,kEAAkE;YAClE,iEAAiE;YACjE,iEAAiE;YACjE,gEAAgE;YAChE,8DAA8D;YAC9D,gEAAgE;YAChE,gDAAgD;YAChD,MAAM,KAAK,CAAC,aAAa,EAAE,CAAA;YAC3B,kEAAkE;YAClE,uDAAuD;YACvD,gEAAgE;YAChE,gCAAgC;YAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,MAAM,EAAE,CAAA;gBACd,OAAM;YACP,CAAC;YACD,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;QACF,KAAK,GAAG,GAAG,CAAC,IAAI,CACf,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CACf,CAAA;QACD,MAAM,GAAG,CAAA;IACV,CAAC,CAAA;AACF,CAAC"}