@namzu/sandbox 14.0.0 → 16.0.0

package/dist/index.d.ts

@@ -9,11 +9,29 @@
  *
  * Two tiers, each a trust boundary:
  *
- *  • `container` — one OCI container per task, seccomp on, tmpfs
- *    workdir, no network unless asked. The same path on a laptop and
- *    on a Linux replica anywhere. The tier for trusted prompts and
- *    contained workloads. Boundary: kernel namespaces, or a
- *    userspace-kernel runtime where one is installed.
+ *  • `container` — one OCI container per task, with the container itself
+ *    as the boundary: kernel namespaces, or a userspace-kernel runtime
+ *    where one is installed. The same path on a laptop and on a Linux
+ *    replica anywhere. The tier for trusted prompts and contained
+ *    workloads. What confines the workload INSIDE the container is
+ *    applied by each backend and documented where it is applied, not
+ *    promised here: `container:docker` drops every capability, sets
+ *    no-new-privileges, gives the container an IPC namespace nothing else can
+ *    join and mounts its root filesystem read-only over a named writable set
+ *    (see `backends/docker/index.ts`), while the ACI standby pool takes
+ *    its controls from the container-group profile its pool was built
+ *    from. This line used to claim "seccomp on, tmpfs workdir, no
+ *    network unless asked" on both their behalf, and none of the three
+ *    is a property this package establishes: nothing here passes a
+ *    seccomp flag, so what filters a container's syscalls is the daemon's
+ *    own profile rather than a default this package sets; the directory
+ *    the agent works in is the layout's `outputs` bind mount — a host
+ *    directory the run is collected from — rather than a tmpfs that would
+ *    lose it when the container exits; and the network a container is
+ *    attached to is a fact about
+ *    the backend's own configuration — a daemon network whose internals
+ *    the egress policy is checked against, or the container group's
+ *    subnet or public address.
  *
  *  • `microvm` — one hardware-virtualized guest per task. The boundary
  *    to reach for when the prompt itself is adversarial, at the cost
@@ -35,19 +53,59 @@
  */
 import type { ContainerSandboxLayout, Sandbox, SandboxProvider } from '@namzu/sdk';
 import type { KubernetesEgressConfig } from './backends/kubernetes/egress-policy.js';
-import { type KubernetesClusterAccess } from './backends/kubernetes/index.js';
-import { type KubernetesWorkspace, type KubernetesWorkspaceOptions } from './backends/kubernetes/workspace.js';
+import { type KubernetesAgentAddressMode, type KubernetesClusterAccess, type KubernetesReadTaskCapacityOptions, type KubernetesReleaseTaskSandboxesOptions, type KubernetesTaskCapacity } from './backends/kubernetes/index.js';
+import type { KubernetesIngressConfig } from './backends/kubernetes/ingress-policy.js';
+import { type KubernetesWorkspace, type KubernetesWorkspaceOptions, type KubernetesWorkspaceSummary, type KubernetesWorkspaceSuspendOptions, type KubernetesWorkspaceTransitionOptions } from './backends/kubernetes/workspace.js';
 export type { ContainerSandboxLayout, ContainerSandboxLayoutMount, ContainerSandboxMountSource, ContainerSandboxSkillMount, ResolvedContainerSandboxLayout, } from '@namzu/sdk';
 export { SANDBOX_DEFAULT_OUTPUTS_PATH, SANDBOX_DEFAULT_SKILLS_PARENT, SANDBOX_DEFAULT_TOOL_RESULTS_PATH, SANDBOX_DEFAULT_TRANSCRIPTS_PATH, SANDBOX_DEFAULT_UPLOADS_PATH, } from '@namzu/sdk';
 export type { FirecrackerBackendInternalConfig, OrchestratorTokenProvider, } from './backends/firecracker/index.js';
-export { AgentPreauthFrameTooLargeError, FIRECRACKER_AGENT_PROTOCOL_VERSION, type SandboxAgentHandle, TCP_PREAUTH_FRAME_LIMIT_BYTES, type VsockTransportOptions, VsockAgentTransport, } from './backends/firecracker/transport.js';
-export type { KubernetesClusterAccess } from './backends/kubernetes/index.js';
-export type { KubernetesEgressConfig, KubernetesEgressEngine, } from './backends/kubernetes/egress-policy.js';
+export { AgentDialFailedError, AgentPreauthFrameTooLargeError, AgentReadFileStreamUnsupportedError, AgentWriteFileTooLargeError, DEFAULT_MAX_WRITE_FILE_BYTES, FIRECRACKER_AGENT_PROTOCOL_VERSION, GUEST_FRAME_LIMIT_BYTES, type SandboxAgentHandle, TCP_PREAUTH_FRAME_LIMIT_BYTES, type VsockTransportOptions, VsockAgentTransport, } from './backends/firecracker/transport.js';
+export { WRITE_FILE_PARTS_FEATURE, type WriteFilePart, } from './backends/firecracker/protocol.js';
+export { MIN_STREAM_HEARTBEAT_MS, STREAM_HEARTBEAT_FEATURE, STREAM_HEARTBEAT_MAX_ECHO_FACTOR, STREAM_HEARTBEAT_MISS_LIMIT, type StreamHeartbeat, } from './backends/firecracker/protocol.js';
+export { READ_FILE_STREAM_FEATURE, type ReadFileStreamEvent, type ReadFileStreamRequest, } from './backends/firecracker/protocol.js';
+export type { KubernetesAgentAddressMode, KubernetesClusterAccess, } from './backends/kubernetes/index.js';
+export type { EgressProfileLabel, KubernetesCiliumDnsNarrowing, KubernetesCiliumEgressNarrowing, KubernetesEgressConfig, KubernetesEgressEngine, KubernetesEgressPolicy, KubernetesEgressVerification, KubernetesOnlyEgressPolicy, KubernetesPerSandboxEgressConfig, } from './backends/kubernetes/egress-policy.js';
+export { KubernetesPerSandboxEgressConfigError } from './backends/kubernetes/egress-policy.js';
+export { KubernetesWorkspacePerSandboxEgressConfigError } from './backends/kubernetes/egress-policy.js';
+export { DEFAULT_PER_SANDBOX_EGRESS_LABEL_KEY } from './backends/kubernetes/egress-policy.js';
+export { KubernetesAdmissionFenceMissingError, KubernetesAdmissionFenceUnreadableError, KubernetesNetworkPolicyHostError, KubernetesOwnerUidMissingError, PER_SANDBOX_POLICY_NAME_PREFIX, } from './backends/kubernetes/per-sandbox-policy.js';
+export { DEFAULT_EGRESS_PROFILE_LABEL_KEY } from './backends/kubernetes/egress-policy.js';
+export type { EgressPolicyRefusal, EgressPolicyVerdict, ExaminedEgressPolicy, } from './backends/kubernetes/egress-policy.js';
+export { KubernetesEgressNarrowingUnsupportedError, KubernetesEgressPolicyConfigError, KubernetesEgressPolicyUnionError, } from './backends/kubernetes/egress-policy.js';
+export { KubernetesEgressProfileConfigError, KubernetesPodLabelNotObservedError, KubernetesPodLabelsRejectedError, } from './backends/kubernetes/egress-policy.js';
+export type { ExaminedIngressPolicy, IngressPolicyRefusal, IngressPolicyVerdict, KubernetesIngressConfig, KubernetesIngressEngine, 
+/** @deprecated Renamed to `UnreadPolicySource`; both checks report it. */
+UnreadIngressPolicySource, UnreadPolicySource, } from './backends/kubernetes/ingress-policy.js';
+export { KubernetesIngressPolicyError } from './backends/kubernetes/ingress-policy.js';
 export { KubernetesPrivilegeProbeError, type PrivilegeProbeFailure, type ProcStatusPrivileges, } from './backends/kubernetes/privilege-probe.js';
 export { KubernetesSandboxDestroyedError, KubernetesSandboxGoneError, } from './backends/kubernetes/sandbox.js';
-export { KubernetesAgentUnauthorizedError } from './backends/kubernetes/transport.js';
-export type { KubernetesWorkspace, KubernetesWorkspaceDestroyOptions, KubernetesWorkspaceOptions, KubernetesWorkspaceTransitionOptions, } from './backends/kubernetes/workspace.js';
-export { KubernetesWorkspaceDiskError, KubernetesWorkspaceMismatchError, KubernetesWorkspaceSuspendTimeoutError, KubernetesWorkspaceSuspendedError, } from './backends/kubernetes/workspace.js';
+export { KubernetesAgentAddressUnresolvableError, KubernetesAgentRetiringError, KubernetesAgentUnauthorizedError, } from './backends/kubernetes/transport.js';
+export type { KubernetesAttachExecutionOptions, KubernetesAttachRefusal, KubernetesDetachedExecOptions, } from './backends/kubernetes/transport.js';
+export { KubernetesExecutionAttachUnsupportedError, KubernetesExecutionDetachedError, KubernetesExecutionNotAttachableError, } from './backends/kubernetes/transport.js';
+export type { KubernetesAttachTerminalOptions, KubernetesOpenTerminalOptions, KubernetesReadSessionOptions, KubernetesSessionOutput, KubernetesSessionRefusal, KubernetesSessionSummary, KubernetesSessionTerminal, KubernetesStartDetachedOptions, KubernetesWorkspaceTerminal, } from './backends/kubernetes/transport.js';
+export { KubernetesSessionRefusedError, KubernetesSessionsUnsupportedError, } from './backends/kubernetes/transport.js';
+export { AgentSessionDetachedError } from './backends/firecracker/transport.js';
+export { SESSIONS_FEATURE, type SessionDetachReason, type SessionKind, type SessionState, } from './backends/firecracker/protocol.js';
+export type { KubernetesQuiesceOptions, KubernetesWorkspaceQuiesceRequest, } from './backends/kubernetes/workspace.js';
+export type { KubernetesQuiesceReport } from './backends/kubernetes/transport.js';
+export { KubernetesQuiesceUnconfirmedError, KubernetesQuiesceUnsupportedError, } from './backends/kubernetes/transport.js';
+export { QUIESCE_FEATURE, type QuiesceScope, type QuiescedProcess, } from './backends/firecracker/protocol.js';
+export type { KubernetesFlushOptions, KubernetesWorkspaceFlushRequest, } from './backends/kubernetes/workspace.js';
+export type { KubernetesFlushReport } from './backends/kubernetes/transport.js';
+export { KubernetesFlushUnconfirmedError, KubernetesFlushUnreachableError, KubernetesFlushUnsupportedError, } from './backends/kubernetes/transport.js';
+export { FLUSH_FEATURE } from './backends/firecracker/protocol.js';
+export { DEFAULT_API_REQUEST_TIMEOUT_MS, KubernetesApiError, type KubernetesApiFailureTransport, KubernetesApiTimeoutError, type KubernetesHttpMethod, KubernetesPatchNotAppliedError, MIN_API_REQUEST_TIMEOUT_MS, } from './backends/kubernetes/k8s-client.js';
+export { KubernetesAlreadyGoneError, KubernetesConflictError, KubernetesCredentialError, } from './backends/kubernetes/k8s-client.js';
+export { KubernetesAcquireError, type KubernetesAcquireFailureReason, ReadinessPollTimeout, TERMINAL_CLAIM_REASONS, } from './backends/kubernetes/index.js';
+export { KubernetesEgressPolicyMismatchError, KubernetesEgressPolicyNotAppliedError, KubernetesUnenforceableEgressPolicyError, } from './backends/kubernetes/egress-policy.js';
+/** Default `KubernetesBackendConfig.streamHeartbeatMs` — see there. */
+export { DEFAULT_STREAM_HEARTBEAT_MS } from './backends/kubernetes/index.js';
+export type { KubernetesReadTaskCapacityOptions, KubernetesReleaseTaskSandboxesOptions, KubernetesTaskCapacity, } from './backends/kubernetes/index.js';
+export { KUBERNETES_CLAIMANT_RBAC_RULES, type KubernetesRbacRule, type KubernetesRbacVerb, } from './backends/kubernetes/rbac.js';
+export type { KubernetesKillSessionOptions, KubernetesWorkspace, KubernetesWorkspaceAgentState, KubernetesWorkspaceCancellationNotice, KubernetesWorkspaceDestroyOptions, KubernetesWorkspaceOptions, KubernetesWorkspaceOrigin, KubernetesWorkspaceStartFailurePolicy, KubernetesWorkspaceSummary, KubernetesWorkspaceSuspendOptions, KubernetesWorkspaceSuspensionNotice, KubernetesWorkspaceTransitionOptions, } from './backends/kubernetes/workspace.js';
+export type { KubernetesGuestEvidence, KubernetesGuestRestart, KubernetesGuestRestartReason, KubernetesWorkspaceIdentity, } from './backends/kubernetes/identity.js';
+export { KubernetesWorkspaceGuestGoneError, KubernetesWorkspaceReplacedError, } from './backends/kubernetes/identity.js';
+export { KubernetesWorkspaceDiskError, KubernetesWorkspaceMismatchError, KubernetesWorkspacePreconditionError, KubernetesWorkspaceSuspendTimeoutError, KubernetesWorkspaceSuspendedError, } from './backends/kubernetes/workspace.js';
 /**
  * Top-level sandbox tier, and the trust boundary it buys:
  *
@@ -217,6 +275,46 @@ export interface ContainerBackendConfig {
      * collisions with Docker / orchestrator labels.
      */
     readonly labels?: Readonly<Record<string, string>>;
+    /**
+     * CPU cores the container may use, rendered as `--cpus`. Unset by
+     * default, like `memoryLimitMb` and `maxProcesses`, and for the same
+     * reason: the value that is right is a property of the host's machine
+     * and of the workload, and a number chosen here would silently throttle
+     * runs that finish inside their timeout today.
+     *
+     * It is set at provider construction rather than per `create()` call,
+     * because the documented deployment builds one provider per task — and
+     * because the ACI and kubernetes backends cannot apply a per-sandbox CPU
+     * limit, so a per-call field would be a control they would have to
+     * refuse. See `backends/docker/index.ts` for what it renders.
+     */
+    readonly cpuLimit?: number;
+    /**
+     * Mount the container's root filesystem read-only. Default `true`.
+     *
+     * On by default with the paths that stay writable named in
+     * `backends/docker/index.ts` (`writableRootfsPaths` extends them). Set it
+     * to `false` to make the whole container filesystem writable again, which a
+     * host whose image writes somewhere the writable set cannot describe needs,
+     * and which is why the switch exists rather than the baseline being
+     * unconditional. It gives up that one control: the capability drop,
+     * `no-new-privileges` and `--ipc private` are applied to every container
+     * whatever this says, so it is not a way back to the previous argv.
+     */
+    readonly readOnlyRootfs?: boolean;
+    /**
+     * Extra paths to keep writable under `--read-only`, each mounted
+     * `--tmpfs`.
+     *
+     * The default set is the reference image's needs, read off its Dockerfile.
+     * A host that points `image` at its own build says what that image needs
+     * here, because the backend cannot read an image's writable set and the
+     * alternative to asking is guessing. Setting this beside
+     * `readOnlyRootfs: false` is refused: with a writable root filesystem the
+     * mounts would add nothing, and accepting a control that is not applied is
+     * the failure this package refuses everywhere else.
+     */
+    readonly writableRootfsPaths?: readonly string[];
 }
 /**
  * `microvm` tier, against namzu's own guest orchestrator.
@@ -374,6 +472,24 @@ export interface KubernetesBackendConfig {
     readonly warmPoolName?: string;
     /** TCP port the in-pod guest agent listens on. Default 1024. */
     readonly agentPort?: number;
+    /**
+     * Which of a sandbox's two addresses the transport dials.
+     *
+     * `'service'` (default) is the Sandbox's `status.serviceFQDN`, which
+     * outlives the pod and is re-resolved on every dial — and which ONLY the
+     * cluster's own DNS answers. A host running outside the cluster fails
+     * every call at name resolution, readiness included, so it reads as a
+     * sandbox that never came up.
+     *
+     * `'pod-ip'` dials the bound pod's IP, read from the same `GET` that
+     * reads its bind token. For a host outside the cluster with a route to
+     * the pod network. It needs that route and a `NetworkPolicy` admitting
+     * the host's address range on {@link agentPort}; the IP dies with its
+     * pod, which the backend covers by re-reading it on every resume and once
+     * after a connect failure. Nothing else changes: same bind token, same
+     * privilege probe, same egress verification.
+     */
+    readonly agentAddress?: KubernetesAgentAddressMode;
     /** Delay between readiness polls. Default 50ms. */
     readonly readyPollIntervalMs?: number;
     /** Total deadline from create to an addressed, Ready sandbox. Default 60000ms. */
@@ -389,10 +505,12 @@ export interface KubernetesBackendConfig {
      *
      * The handle renews its own `shutdownTime` every half-TTL for as long as
      * it is alive, so a run that outlives `claimTtlSeconds` keeps its pod.
-     * A failed renewal is retried on the next tick, half a TTL before
-     * anything expires; this callback is where the diagnostic goes, because
-     * `@namzu/sandbox` owns no logger and reads none from module scope.
-     * Setting it changes nothing about behaviour.
+     * A failed renewal is retried on a short capped backoff — starting at one
+     * second, not the next half-TTL tick — so a single API blip near a
+     * scheduled renewal gets several more chances before anything expires;
+     * this callback is where the diagnostic goes, because `@namzu/sandbox`
+     * owns no logger and reads none from module scope. Setting it changes
+     * nothing about behaviour.
      */
     readonly onLeaseRenewalError?: (error: unknown) => void;
     /**
@@ -415,10 +533,89 @@ export interface KubernetesBackendConfig {
      * enforcement point is one object attached to the template and cannot be
      * rewritten per running sandbox. `static` and `resolver` — hostname
      * allowlists — throw a named error at construction unless `engine` is
-     * `'cilium'`: core `NetworkPolicy` has no FQDN concept at all. See
+     * `'cilium'`: core `NetworkPolicy` has no FQDN concept at all.
+     *
+     * `policy` also takes two kinds that exist only here, because only a
+     * `NetworkPolicy` can express them: `{ kind: 'no-network' }` (nothing
+     * leaves the pod, the cluster resolver included — which `'deny-all'` never
+     * meant, since it allows DNS and a cluster resolver forwards outside
+     * names) and `{ kind: 'public-internet', exceptCidrs? }` (the internet,
+     * minus the private ranges, carrier-grade NAT, link-local and one cloud
+     * platform endpoint). `'deny-all'` and `'allow-all'` emit exactly the
+     * manifests they always have.
+     *
+     * **Setting this now checks the UNION.** Since every policy selecting a
+     * pod is unioned by the API server, the check reads the named object AND
+     * enumerates the namespace's policies, refusing when any of them lets out
+     * more than `policy` does. `verify: 'named-object-only'` restores the
+     * single-object check exactly. See
      * `docs/sdk/kubernetes-sandbox.md`'s egress section.
      */
     readonly egress?: KubernetesEgressConfig;
+    /**
+     * Whether this backend proves, before creating a sandbox, that an applied
+     * policy actually closes {@link agentPort} on the pod it is about to hand
+     * back — and against which policy resources.
+     *
+     * **Unset means verify.** This is the one field here whose absent value is
+     * the strict one, because the deployment that needs the check is the one
+     * that would never have switched it on: the guest agent's own source calls
+     * the network rule in front of its port the boundary, and until this field
+     * existed nothing confirmed there was one.
+     *
+     * `{ engine: 'cilium' }` also enumerates that CNI's own policy CRD;
+     * `engine` otherwise defaults to `egress?.engine ?? 'core'`.
+     *
+     * `'unverified'` reads no policy and issues no request. It is the
+     * supported answer for a deployment whose boundary a namespaced Role
+     * cannot see — a cluster-scoped policy, a service mesh, a cloud security
+     * group — and it is a claim the deployment makes on purpose rather than a
+     * default it inherits. See `docs/sdk/kubernetes-sandbox.md`'s ingress
+     * section.
+     */
+    readonly ingress?: KubernetesIngressConfig;
+    /**
+     * How long a single Kubernetes API request may take, end to end —
+     * resolving the token, connecting, and reading the reply. Default
+     * `30000`; minimum `1000`; there is no value that turns it off.
+     *
+     * The caller's `signal` is optional everywhere and several of this
+     * backend's requests are SHARED flights that run under whichever caller
+     * arrived first, so a signal-less `destroy()` against an API server that
+     * accepted a request and never answered used to pin every later caller
+     * joined to it. Expiry rejects with `KubernetesApiTimeoutError`, which
+     * says nothing about whether the request was applied — the paths that
+     * send one already cope with not knowing.
+     */
+    readonly apiRequestTimeoutMs?: number;
+    /**
+     * Interval of the liveness heartbeat `openTerminal` and
+     * `openTcpConnection` streams negotiate with the guest. Default `15000`;
+     * `0` sends none, which is exactly how every release before this one
+     * behaved.
+     *
+     * A quiet shell is healthy, so nothing replaced the read-idle timer the
+     * transport clears once a stream is ready: a partition that delivered no
+     * FIN and no RST left `exited`/`closed` unresolved on the host and the
+     * shell's process group alive in the guest. Three missed intervals end
+     * the stream on both sides. It is negotiated per stream — the guest
+     * echoes the interval in its `ready` event and sends nothing new unless
+     * it did — so an older guest image behaves exactly as it does today.
+     */
+    readonly streamHeartbeatMs?: number;
+    /**
+     * Extra labels written onto every `SandboxClaim` this backend POSTs —
+     * `metadata.labels` only, never the pod's own labels. Unset means no
+     * labels beyond what the controller itself writes, and every claim body
+     * is byte-for-byte what it was before this option existed.
+     *
+     * The intended use is a host-instance identity, so a restarted host can
+     * find and {@link releaseKubernetesTaskSandboxes} a crashed predecessor's
+     * claims well before `claimTtlSeconds` reaps them on its own — see
+     * {@link readKubernetesTaskCapacity} for reading pool headroom
+     * alongside it.
+     */
+    readonly claimLabels?: Record<string, string>;
 }
 /**
  * Egress allowlist resolution. Host-supplied policy decides whether
@@ -597,6 +794,85 @@ export declare function createSandboxProvider(config: SandboxProviderConfig): Sa
  * deprivileged, exactly as `provider.create()` does for a task sandbox.
  */
 export declare function createKubernetesWorkspace(config: KubernetesBackendConfig, options: KubernetesWorkspaceOptions): Promise<KubernetesWorkspace>;
+/**
+ * Every workspace this backend owns in the namespace, read off the objects
+ * and waking none of them.
+ *
+ * The inventory {@link createKubernetesWorkspace} cannot give you: it adopts
+ * AND resumes, so taking stock through it would start a pod for every
+ * suspended workspace it looked at. This issues one GET of the sandboxes
+ * collection and sends no PATCH and no DELETE — a suspended workspace is
+ * still suspended afterwards.
+ *
+ * Needs `list` on `sandboxes` in the namespace, which is the one RBAC verb
+ * the task path did not already require.
+ */
+export declare function listKubernetesWorkspaces(config: KubernetesBackendConfig, options?: KubernetesWorkspaceTransitionOptions): Promise<readonly KubernetesWorkspaceSummary[]>;
+/**
+ * Delete a workspace by id — the Sandbox, and with it the Pod, the Service
+ * and the PVC — without adopting or resuming it first.
+ *
+ * Exactly what `destroy({ deleteDisk: true })` does to the cluster, with the
+ * same guarantees: an object already gone counts as deleted, and a DELETE
+ * that fails rejects and stays retryable. The files are gone and nothing
+ * brings them back.
+ *
+ * It is the retention verb. Removing a month-old suspended workspace through
+ * a handle meant starting its pod and probing it purely to tell it to go
+ * away; the name is deterministic, so the object never needed opening.
+ */
+export declare function deleteKubernetesWorkspace(config: KubernetesBackendConfig, workspaceId: string, options?: KubernetesWorkspaceTransitionOptions): Promise<void>;
+/**
+ * Suspend a workspace by id: send the `operatingMode: Suspended` patch and
+ * wait for the pod to actually stop, without adopting the workspace.
+ *
+ * Resolves only once the pod is gone or in a terminal phase — a suspend is a
+ * promise that the disk is quiesced, and the patch being accepted says only
+ * that the controller has been asked. A pod that outlives `readyTimeoutMs`
+ * rejects with `KubernetesWorkspaceSuspendTimeoutError`, leaving the object
+ * as the patch left it.
+ *
+ * A handle another process is holding is not told. It finds out on its next
+ * call — which fails at the transport and is re-read into a
+ * `KubernetesWorkspaceSuspendedError` — or when that process calls
+ * `refresh()`.
+ *
+ * It takes the suspend options shape and REFUSES `quiesce` rather than
+ * accepting the flag and dropping it: this verb never dials the agent, so
+ * there is no connection here on which anything could be stopped. Quiescing
+ * needs a handle — `createKubernetesWorkspace()`, then
+ * `suspend({ quiesce: true })`.
+ */
+export declare function suspendKubernetesWorkspace(config: KubernetesBackendConfig, workspaceId: string, options?: KubernetesWorkspaceSuspendOptions): Promise<void>;
+/**
+ * Recover a crashed host's task-path claims: LIST every `SandboxClaim`
+ * carrying `options.labelSelector`, `DELETE` each, and report what was
+ * removed.
+ *
+ * Deletes claims only — the controller's own ownerReferences take the bound
+ * Sandbox, its Pod and its Service down behind each one; nothing here reads
+ * or touches those objects directly. `labelSelector` is REQUIRED and refused
+ * before any request goes out if it is empty: falling back to matching every
+ * claim would delete a live fleet's work.
+ *
+ * Pairs with `config.claimLabels`: a host stamps its own identity onto every
+ * claim it creates, and a restarted instance passes that same selector here
+ * to reclaim its predecessor's warm-pool capacity well before
+ * `claimTtlSeconds` would reap it on its own.
+ */
+export declare function releaseKubernetesTaskSandboxes(config: KubernetesBackendConfig, options: KubernetesReleaseTaskSandboxesOptions): Promise<{
+    readonly deleted: number;
+    readonly names: readonly string[];
+}>;
+/**
+ * Read task-pool headroom before admitting more work: three GETs
+ * (`SandboxWarmPool`, the claims collection, the pods collection), no
+ * writes.
+ *
+ * Requires `config.warmPoolName` — a pool-less backend (every create is a
+ * direct Sandbox) has no `SandboxWarmPool` to report on.
+ */
+export declare function readKubernetesTaskCapacity(config: KubernetesBackendConfig, options?: KubernetesReadTaskCapacityOptions): Promise<KubernetesTaskCapacity>;
 /**
  * Thrown by the factory when a backend is requested before its
  * implementation has landed. Makes the staged rollout legible —

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EACX,sBAAsB,EACtB,OAAO,EAEP,eAAe,EACf,MAAM,YAAY,CAAA;AAKnB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAA;AACpF,OAAO,EAEN,KAAK,uBAAuB,EAE5B,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAE/B,MAAM,oCAAoC,CAAA;AAK3C,YAAY,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC9B,MAAM,YAAY,CAAA;AAOnB,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAMnB,YAAY,EACX,gCAAgC,EAChC,yBAAyB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACN,8BAA8B,EAC9B,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAK5C,YAAY,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAA;AAG7E,YAAY,EACX,sBAAsB,EACtB,sBAAsB,GACtB,MAAM,wCAAwC,CAAA;AAK/C,OAAO,EACN,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GACzB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAA;AAOrF,YAAY,EACX,mBAAmB,EACnB,iCAAiC,EACjC,0BAA0B,EAC1B,oCAAoC,GACpC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,4BAA4B,EAC5B,gCAAgC,EAChC,sCAAsC,EACtC,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAM3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,SAAS,CAAA;AAEjD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC7B,sBAAsB,GACtB,2BAA2B,GAC3B,oBAAoB,GACpB,uBAAuB,CAAA;AAE1B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,uFAAuF;IACvF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACX,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,mBAAmB,CAAA;AAE1B,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAAE,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,qBAAqB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAC9B,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACrC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;CACxC,CAAC,CAAA;AAEL,UAAU,yBAAyB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAA;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CAoCpF;AAuJD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAgBD;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;aAG/B,OAAO,EAAE,MAAM;IAF3C,SAAkB,IAAI,uCAAsC;gBAEhC,OAAO,EAAE,MAAM;CAK3C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;aAI9C,OAAO,EAAE,SAAS,MAAM,EAAE;IAH3C,SAAkB,IAAI,2CAA0C;gBAG/C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ9B,MAAM,IAAI;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;KACf;CAQD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CACvC;AA4BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAE1E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EACX,sBAAsB,EACtB,OAAO,EAEP,eAAe,EACf,MAAM,YAAY,CAAA;AAKnB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAA;AACpF,OAAO,EACN,KAAK,0BAA0B,EAE/B,KAAK,uBAAuB,EAC5B,KAAK,iCAAiC,EACtC,KAAK,qCAAqC,EAC1C,KAAK,sBAAsB,EAI3B,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAA;AACtF,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,oCAAoC,EAKzC,MAAM,oCAAoC,CAAA;AAK3C,YAAY,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC9B,MAAM,YAAY,CAAA;AAOnB,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAMnB,YAAY,EACX,gCAAgC,EAChC,yBAAyB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACN,oBAAoB,EACpB,8BAA8B,EAC9B,mCAAmC,EACnC,2BAA2B,EAC3B,4BAA4B,EAC5B,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAK5C,OAAO,EACN,wBAAwB,EACxB,KAAK,aAAa,GAClB,MAAM,oCAAoC,CAAA;AAK3C,OAAO,EACN,uBAAuB,EACvB,wBAAwB,EACxB,gCAAgC,EAChC,2BAA2B,EAC3B,KAAK,eAAe,GACpB,MAAM,oCAAoC,CAAA;AAM3C,OAAO,EACN,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC1B,MAAM,oCAAoC,CAAA;AAQ3C,YAAY,EACX,0BAA0B,EAC1B,uBAAuB,GACvB,MAAM,gCAAgC,CAAA;AAKvC,YAAY,EACX,kBAAkB,EAClB,4BAA4B,EAC5B,+BAA+B,EAC/B,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAmB/C,OAAO,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAA;AAC9F,OAAO,EAAE,8CAA8C,EAAE,MAAM,wCAAwC,CAAA;AACvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAA;AAC7F,OAAO,EACN,oCAAoC,EACpC,uCAAuC,EACvC,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC9B,MAAM,6CAA6C,CAAA;AAMpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAA;AAMzF,YAAY,EACX,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACpB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACN,yCAAyC,EACzC,iCAAiC,EACjC,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAW/C,OAAO,EACN,kCAAkC,EAClC,kCAAkC,EAClC,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAK/C,YAAY,EACX,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB;AACvB,0EAA0E;AAC1E,yBAAyB,EACzB,kBAAkB,GAClB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAA;AAKtF,OAAO,EACN,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GACzB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACN,uCAAuC,EAKvC,4BAA4B,EAC5B,gCAAgC,GAChC,MAAM,oCAAoC,CAAA;AAO3C,YAAY,EACX,gCAAgC,EAChC,uBAAuB,EACvB,6BAA6B,GAC7B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,yCAAyC,EACzC,gCAAgC,EAChC,qCAAqC,GACrC,MAAM,oCAAoC,CAAA;AAQ3C,YAAY,EACX,+BAA+B,EAC/B,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,2BAA2B,GAC3B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,6BAA6B,EAC7B,kCAAkC,GAClC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAA;AAI/E,OAAO,EACN,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,YAAY,GACjB,MAAM,oCAAoC,CAAA;AAM3C,YAAY,EACX,wBAAwB,EACxB,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AACjF,OAAO,EACN,iCAAiC,EACjC,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,GACpB,MAAM,oCAAoC,CAAA;AAY3C,YAAY,EACX,sBAAsB,EACtB,+BAA+B,GAC/B,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EACN,+BAA+B,EAC/B,+BAA+B,EAC/B,+BAA+B,GAC/B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAA;AASlE,OAAO,EACN,8BAA8B,EAQ9B,kBAAkB,EAClB,KAAK,6BAA6B,EAClC,yBAAyB,EACzB,KAAK,oBAAoB,EAOzB,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,qCAAqC,CAAA;AAM5C,OAAO,EACN,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,qCAAqC,CAAA;AAQ5C,OAAO,EACN,sBAAsB,EACtB,KAAK,8BAA8B,EAInC,oBAAoB,EACpB,sBAAsB,GACtB,MAAM,gCAAgC,CAAA;AAOvC,OAAO,EACN,mCAAmC,EACnC,qCAAqC,EACrC,wCAAwC,GACxC,MAAM,wCAAwC,CAAA;AAC/C,uEAAuE;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAM5E,YAAY,EACX,iCAAiC,EACjC,qCAAqC,EACrC,sBAAsB,GACtB,MAAM,gCAAgC,CAAA;AAOvC,OAAO,EACN,8BAA8B,EAC9B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACvB,MAAM,+BAA+B,CAAA;AAQtC,YAAY,EACX,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,qCAAqC,EACrC,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EACzB,qCAAqC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,oCAAoC,GACpC,MAAM,oCAAoC,CAAA;AAM3C,YAAY,EACX,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,GAC3B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAKN,iCAAiC,EAIjC,gCAAgC,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACN,4BAA4B,EAC5B,gCAAgC,EAMhC,oCAAoC,EACpC,sCAAsC,EACtC,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAM3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,SAAS,CAAA;AAEjD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC7B,sBAAsB,GACtB,2BAA2B,GAC3B,oBAAoB,GACpB,uBAAuB,CAAA;AAE1B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,uFAAuF;IACvF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAA;IAClD,mDAAmD;IACnD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAA;IACxC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAA;IAC1C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACX,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,mBAAmB,CAAA;AAE1B,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAAE,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,qBAAqB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAC9B,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACrC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;CACxC,CAAC,CAAA;AAEL,UAAU,yBAAyB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAA;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CAoCpF;AA0KD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,SAAS,0BAA0B,EAAE,CAAC,CAEhD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,uBAAuB,EAC/B,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,0BAA0B,CAC/C,MAAM,EAAE,uBAAuB,EAC/B,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,iCAAiC,GACzC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,8BAA8B,CACnD,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,qCAAqC,GAC5C,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC/C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,iCAAiC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAgBD;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;aAG/B,OAAO,EAAE,MAAM;IAF3C,SAAkB,IAAI,uCAAsC;gBAEhC,OAAO,EAAE,MAAM;CAK3C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;aAI9C,OAAO,EAAE,SAAS,MAAM,EAAE;IAH3C,SAAkB,IAAI,2CAA0C;gBAG/C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ9B,MAAM,IAAI;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;KACf;CAQD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CACvC;AA4BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAE1E"}