@namzu/sandbox 26.0.0 → 27.0.0

package/dist/backends/kubernetes/workspace-allocate.d.ts

@@ -0,0 +1,206 @@
+/**
+ * Allocating a workspace without adopting or waking anything, bound to an
+ * allocation the host recorded first.
+ *
+ * `createKubernetesWorkspace` is create-or-adopt: a 409 turns into "this is
+ * mine from before", and the pod may be resumed before it returns. A host
+ * that persists its intent BEFORE creating something durable, and has to
+ * prove afterwards that what it finds is exactly what it created, needs the
+ * opposite verbs:
+ *
+ *  - {@link resolveKubernetesExecutionProfile} — what a workspace created
+ *    from this configuration would run, as content plus one fingerprint.
+ *    Creates nothing. The host persists the result, then allocates.
+ *  - {@link allocateKubernetesWorkspace} — ONE create request. A same-name
+ *    object is a typed conflict and is never touched; the pod is never
+ *    resumed; the answer is an acknowledgement carrying the new Sandbox's
+ *    uid, not readiness.
+ *  - {@link recoverKubernetesWorkspaceAllocation} — the only way out of a
+ *    create whose reply never arrived. Read-only.
+ *
+ * ## Fingerprint canonicalisation
+ *
+ * The execution profile fingerprint is `sha256:<hex>` of
+ * `JSON.stringify(canonical(content))`, where `canonical` sorts the keys of
+ * every object by UTF-16 code unit, drops members whose value is
+ * `undefined`, keeps arrays in order, and `JSON.stringify` adds no
+ * whitespace. `content` is {@link KubernetesExecutionProfile.content}.
+ */
+import { type KubernetesObservedAllocation, type KubernetesWorkspaceAllocation, type KubernetesWorkspaceAllocationMismatch } from './allocation.js';
+import { type KubernetesBackendInternalConfig } from './index.js';
+import { KUBERNETES_PER_SANDBOX_PROFILE_VARIANT } from './workspace-per-sandbox.js';
+/** `resolveKubernetesExecutionProfile`'s options. */
+export interface KubernetesExecutionProfileOptions {
+    /** The SandboxTemplate to resolve; defaults to `config.sandboxTemplateName`. */
+    readonly sandboxTemplateName?: string;
+    /**
+     * The workspace the profile is for. Only read when
+     * `config.egress.perSandbox` is configured: the per-sandbox selector
+     * label's VALUE is the Sandbox's name, so `podTemplateHash` is per
+     * workspace there. Without it that hash is taken over the template
+     * WITHOUT the label, and is not the revision a handle reports. The
+     * fingerprint never depends on it.
+     */
+    readonly workspaceId?: string;
+    readonly signal?: AbortSignal;
+}
+/**
+ * What a workspace created from this configuration would run.
+ *
+ *  - `fingerprint` — `sha256:<hex>` over {@link content}; the value stored
+ *    in the profile annotation and the one `expectedAllocation.executionProfile`
+ *    carries.
+ *  - `podTemplateHash` — the revision of the pod template alone, the same
+ *    value `templateRevision` reports on a handle.
+ *  - `variant` — `'core/no-network+per-sandbox'` when
+ *    `config.egress.perSandbox` is configured over a core `no-network`
+ *    baseline, and ABSENT otherwise (over another baseline the content still
+ *    changes the fingerprint but claims no name), so the profile of every
+ *    configuration that predates the option keeps its fingerprint byte for
+ *    byte. Present only after the admission fence that
+ *    bounds the host's per-sandbox writes was read and found to enforce:
+ *    resolving the profile is how a host learns it is admitted.
+ *  - `content` — what was fingerprinted, so a host can persist exactly it:
+ *    the pod template after this backend's overlays, the template's volume
+ *    claim templates, the egress policy as translated from `config.egress`
+ *    (kind, name, manifest — config-derived, not read from the cluster), and
+ *    the ingress verification settings.
+ */
+export interface KubernetesExecutionProfile {
+    readonly fingerprint: string;
+    readonly podTemplateHash: string;
+    readonly sandboxTemplateName: string;
+    readonly variant?: typeof KUBERNETES_PER_SANDBOX_PROFILE_VARIANT;
+    readonly content: Readonly<Record<string, unknown>>;
+}
+/**
+ * Resolve and fingerprint what a workspace created from `config` would run —
+ * the pod template with this backend's overlays, the template's disks, the
+ * egress policy translated from `config.egress` and the ingress settings —
+ * without creating, waking or writing anything. One GET: the
+ * SandboxTemplate.
+ *
+ * The host persists the result, then passes `fingerprint` as
+ * `allocation.executionProfile` to {@link allocateKubernetesWorkspace}, which
+ * refuses to create if the profile resolves differently by then.
+ */
+export declare function resolveKubernetesExecutionProfile(config: KubernetesBackendInternalConfig, options?: KubernetesExecutionProfileOptions): Promise<KubernetesExecutionProfile>;
+/** {@link allocateKubernetesWorkspace}'s options. */
+export interface KubernetesWorkspaceAllocateOptions {
+    readonly workspaceId: string;
+    readonly allocation: KubernetesWorkspaceAllocation;
+    /** The holder epoch to create the workspace under; see `createKubernetesWorkspace`. */
+    readonly epoch?: number;
+    readonly sandboxTemplateName?: string;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Acknowledgement that the API server accepted the create. It says the
+ * object exists and which one it is; it does not say the pod is scheduled,
+ * the disk is bound or the guest answers — open it with
+ * `openKubernetesWorkspace({ waitForReady: true })` for that.
+ */
+export interface KubernetesWorkspaceAllocationReceipt {
+    readonly workspaceId: string;
+    readonly sandboxName: string;
+    readonly namespace: string;
+    /** The created Sandbox's `metadata.uid`. */
+    readonly sandboxUid: string;
+    /**
+     * What the object carries. From `allocate` the profile fingerprint is
+     * always present; from recovery it is whatever the annotation holds.
+     */
+    readonly allocation: KubernetesWorkspaceAllocation;
+    readonly epoch?: number;
+    /** The pod-template revision stored with the object. */
+    readonly templateRevision: string;
+}
+/** Why a create's outcome is unknown. */
+export type KubernetesAllocationUnknownReason = 'timeout' | 'connection' | 'server-error' | 'aborted' | 'unreadable-reply';
+/**
+ * The create request was sent and no usable reply came back, so the object
+ * may or may not exist. The request was NOT retried and will not be: resolve
+ * it with {@link recoverKubernetesWorkspaceAllocation}.
+ */
+export interface KubernetesWorkspaceAllocationUnknown {
+    readonly outcome: 'unknown';
+    readonly reason: KubernetesAllocationUnknownReason;
+    readonly workspaceId: string;
+    readonly sandboxName: string;
+    /** What was sent, including the resolved profile fingerprint. */
+    readonly allocation: Required<KubernetesWorkspaceAllocation>;
+    readonly epoch?: number;
+    /** The failure that made it unknown. */
+    readonly error: unknown;
+}
+export type KubernetesWorkspaceAllocationResult = {
+    readonly outcome: 'created';
+    readonly receipt: KubernetesWorkspaceAllocationReceipt;
+} | KubernetesWorkspaceAllocationUnknown;
+/**
+ * Create a workspace Sandbox, exactly once, bound to `allocation`. Never
+ * adopts, never resumes, never retries.
+ *
+ * Before the request, and read-only: the same egress and ingress checks
+ * `createKubernetesWorkspace` makes, the block-disk check, and — when
+ * `allocation.executionProfile` is given — that the profile resolves to it
+ * ({@link KubernetesExecutionProfileDriftError} otherwise). A refusal there
+ * sends no create.
+ *
+ * Then ONE POST, which carries the allocation annotations (see the
+ * `*_ANNOTATION_KEY` constants), the holder epoch when one is passed, and
+ * the pod-template revision:
+ *
+ *  - 201 → `{ outcome: 'created', receipt }`.
+ *  - 409 → {@link KubernetesWorkspaceAllocationConflictError}; the existing
+ *    object was not read, touched or woken.
+ *  - a timeout, a reset connection, a 5xx or a caller abort after the request
+ *    was sent, or a reply with no uid → `{ outcome: 'unknown' }`. The POST is
+ *    not repeated.
+ *  - any other rejection (401, 403, 404, 4xx) rejects as itself: the server
+ *    answered, and nothing was created.
+ */
+export declare function allocateKubernetesWorkspace(config: KubernetesBackendInternalConfig, options: KubernetesWorkspaceAllocateOptions): Promise<KubernetesWorkspaceAllocationResult>;
+/** {@link recoverKubernetesWorkspaceAllocation}'s options. */
+export interface KubernetesWorkspaceAllocationRecoverOptions {
+    readonly workspaceId: string;
+    /** The allocation that was sent; `executionProfile` is compared when present. */
+    readonly allocation: KubernetesWorkspaceAllocation;
+    /** When given, a workspace held at a higher epoch refuses the read. */
+    readonly epoch?: number;
+    readonly signal?: AbortSignal;
+}
+/**
+ * What a read-only look found after an unknown create.
+ *
+ *  - `created` — a Sandbox stands there carrying exactly the allocation;
+ *    `receipt` is the one the lost reply would have been.
+ *  - `absent` — no Sandbox stands there at the moment of the read. A create
+ *    still in flight at the API server could land afterwards, so this is a
+ *    point-in-time answer: allocate again with the SAME allocation is safe
+ *    (a late landing makes it a typed conflict, and recovery then says
+ *    `created`), a different allocation under this id is not.
+ *  - `different` — something else stands there; `mismatch` says what differs.
+ */
+export type KubernetesWorkspaceAllocationRecovery = {
+    readonly state: 'created';
+    readonly receipt: KubernetesWorkspaceAllocationReceipt;
+} | {
+    readonly state: 'absent';
+    readonly workspaceId: string;
+    readonly sandboxName: string;
+} | {
+    readonly state: 'different';
+    readonly workspaceId: string;
+    readonly sandboxName: string;
+    readonly mismatch: KubernetesWorkspaceAllocationMismatch;
+    readonly observed: KubernetesObservedAllocation;
+    readonly sandboxUid: string | undefined;
+};
+/**
+ * Settle an unknown create by reading: one GET of the Sandbox, compared with
+ * the expected allocation. Never creates, wakes or writes. A read that did
+ * not answer rejects as itself — it is never reported as `absent`.
+ */
+export declare function recoverKubernetesWorkspaceAllocation(config: KubernetesBackendInternalConfig, options: KubernetesWorkspaceAllocationRecoverOptions): Promise<KubernetesWorkspaceAllocationRecovery>;
+//# sourceMappingURL=workspace-allocate.d.ts.map

package/dist/backends/kubernetes/workspace-allocate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-allocate.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/workspace-allocate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAEN,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAElC,KAAK,qCAAqC,EAI1C,MAAM,iBAAiB,CAAA;AAQxB,OAAO,EAEN,KAAK,+BAA+B,EAQpC,MAAM,YAAY,CAAA;AAuBnB,OAAO,EACN,sCAAsC,EAGtC,MAAM,4BAA4B,CAAA;AAYnC,qDAAqD;AACrD,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,sCAAsC,CAAA;IAChE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACnD;AAuID;;;;;;;;;;GAUG;AACH,wBAAsB,iCAAiC,CACtD,MAAM,EAAE,+BAA+B,EACvC,OAAO,GAAE,iCAAsC,GAC7C,OAAO,CAAC,0BAA0B,CAAC,CAUrC;AAED,qDAAqD;AACrD,MAAM,WAAW,kCAAkC;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAA;IAClD,uFAAuF;IACvF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oCAAoC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAA;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CACjC;AAED,yCAAyC;AACzC,MAAM,MAAM,iCAAiC,GAC1C,SAAS,GACT,YAAY,GACZ,cAAc,GACd,SAAS,GACT,kBAAkB,CAAA;AAErB;;;;GAIG;AACH,MAAM,WAAW,oCAAoC;IACpD,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,6BAA6B,CAAC,CAAA;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,MAAM,mCAAmC,GAC5C;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAA;CAAE,GACvF,oCAAoC,CAAA;AAevC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,2BAA2B,CAChD,MAAM,EAAE,+BAA+B,EACvC,OAAO,EAAE,kCAAkC,GACzC,OAAO,CAAC,mCAAmC,CAAC,CAkG9C;AAED,8DAA8D;AAC9D,MAAM,WAAW,2CAA2C;IAC3D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAA;IAClD,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qCAAqC,GAC9C;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACxF;IACA,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,qCAAqC,CAAA;IACxD,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAA;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;CACtC,CAAA;AAEJ;;;;GAIG;AACH,wBAAsB,oCAAoC,CACzD,MAAM,EAAE,+BAA+B,EACvC,OAAO,EAAE,2CAA2C,GAClD,OAAO,CAAC,qCAAqC,CAAC,CAgEhD"}

package/dist/backends/kubernetes/workspace-allocate.js

@@ -0,0 +1,332 @@
+/**
+ * Allocating a workspace without adopting or waking anything, bound to an
+ * allocation the host recorded first.
+ *
+ * `createKubernetesWorkspace` is create-or-adopt: a 409 turns into "this is
+ * mine from before", and the pod may be resumed before it returns. A host
+ * that persists its intent BEFORE creating something durable, and has to
+ * prove afterwards that what it finds is exactly what it created, needs the
+ * opposite verbs:
+ *
+ *  - {@link resolveKubernetesExecutionProfile} — what a workspace created
+ *    from this configuration would run, as content plus one fingerprint.
+ *    Creates nothing. The host persists the result, then allocates.
+ *  - {@link allocateKubernetesWorkspace} — ONE create request. A same-name
+ *    object is a typed conflict and is never touched; the pod is never
+ *    resumed; the answer is an acknowledgement carrying the new Sandbox's
+ *    uid, not readiness.
+ *  - {@link recoverKubernetesWorkspaceAllocation} — the only way out of a
+ *    create whose reply never arrived. Read-only.
+ *
+ * ## Fingerprint canonicalisation
+ *
+ * The execution profile fingerprint is `sha256:<hex>` of
+ * `JSON.stringify(canonical(content))`, where `canonical` sorts the keys of
+ * every object by UTF-16 code unit, drops members whose value is
+ * `undefined`, keeps arrays in order, and `JSON.stringify` adds no
+ * whitespace. `content` is {@link KubernetesExecutionProfile.content}.
+ */
+import { KubernetesExecutionProfileDriftError, KubernetesWorkspaceAllocationConflictError, assertAllocation, firstAllocationMismatch, observedAllocation, } from './allocation.js';
+import { assertEgressPolicyIsEnforceable, assertEgressProfileIsUsable, assertPerSandboxEgressIsUsable, composeAdditionalPodLabels, perSandboxEgressLabelKey, } from './egress-policy.js';
+import { DEFAULT_AGENT_PORT, buildEgressBoundary, buildIngressVerifier, buildSandboxBody, clientAccess, clientOptions, readSandboxTemplate, sandboxPodLabels, } from './index.js';
+import { ingressVerificationEnabled, resolveIngressEngine } from './ingress-policy.js';
+import { KubernetesAlreadyGoneError, KubernetesApiError, KubernetesApiTimeoutError, KubernetesConflictError, createKubernetesClient, } from './k8s-client.js';
+import { ALLOCATION_ID_ANNOTATION_KEY, ALLOCATION_SCOPE_ANNOTATION_KEY, EXECUTION_PROFILE_ANNOTATION_KEY, HOLDER_EPOCH_ANNOTATION_KEY, POD_TEMPLATE_HASH_ANNOTATION_KEY, canonicalFingerprint, readHolderEpoch, sandboxCollectionPath, sandboxPath, } from './objects.js';
+import { buildAdmissionFence } from './per-sandbox-policy.js';
+import { KUBERNETES_PER_SANDBOX_PROFILE_VARIANT, perSandboxWorkspaceLabels, withoutPerSandboxLabel, } from './workspace-per-sandbox.js';
+import { KubernetesWorkspacePreconditionError, assertBlockModeWorkspaceDisk, assertHolderEpoch, buildPodTemplateRefresh, workspaceSandboxName, } from './workspace.js';
+/** Bumped when the shape of {@link KubernetesExecutionProfile.content} changes. */
+const EXECUTION_PROFILE_CONTENT_VERSION = 1;
+async function planProfile(config, sandboxTemplateName, signal, workspaceName) {
+    assertPerSandboxEgressIsUsable(config.egress);
+    assertEgressProfileIsUsable(config.egress);
+    if (config.egress) {
+        assertEgressPolicyIsEnforceable(config.egress.policy, config.egress.engine ?? 'core', config.egress.ciliumNarrowing);
+    }
+    const client = createKubernetesClient(clientAccess(config), clientOptions(config));
+    const templateName = sandboxTemplateName ?? config.sandboxTemplateName;
+    const boundary = buildEgressBoundary(client, config, templateName);
+    const template = await readSandboxTemplate(client, config.namespace, templateName, signal);
+    assertBlockModeWorkspaceDisk(`SandboxTemplate ${templateName} in namespace ${config.namespace}`, template.podTemplate, template.volumeClaimTemplates);
+    // Per-sandbox egress: the profile is admitted only when the fence that
+    // bounds the host's writes verifies, read here so a configuration whose
+    // fence is missing or inert never yields a fingerprint to persist.
+    const perSandbox = config.egress?.perSandbox;
+    if (perSandbox !== undefined) {
+        await buildAdmissionFence(client, perSandbox, config.namespace).assertApplied(signal);
+    }
+    const perSandboxKey = perSandboxEgressLabelKey(config.egress);
+    // The variant is named for what it is: a core `no-network` baseline plus
+    // per-sandbox widening. Over any other baseline `perSandbox` still
+    // changes the fingerprint (it is in the content) but claims no name, so a
+    // host that admits only the named variant refuses the rest.
+    const carriesVariant = perSandbox !== undefined &&
+        config.egress?.policy.kind === 'no-network' &&
+        (config.egress.engine ?? 'core') === 'core';
+    // The label's value is the Sandbox's name, which the profile does not
+    // know: the fingerprinted template is built without it, and the body and
+    // the revision stamped on the object are built with it.
+    const stableLabels = composeAdditionalPodLabels(config.egress);
+    const podLabels = composeAdditionalPodLabels(config.egress, perSandboxKey !== undefined && workspaceName !== undefined
+        ? { [perSandboxKey]: workspaceName }
+        : undefined);
+    const stableRefresh = buildPodTemplateRefresh(template, templateName, config.runtimeClassName, stableLabels);
+    const refresh = perSandboxKey !== undefined && workspaceName !== undefined
+        ? buildPodTemplateRefresh(template, templateName, config.runtimeClassName, podLabels)
+        : stableRefresh;
+    const translated = await boundary?.translatedPolicy();
+    const ingressOn = ingressVerificationEnabled(config.ingress);
+    const content = {
+        version: EXECUTION_PROFILE_CONTENT_VERSION,
+        namespace: config.namespace,
+        sandboxTemplateName: templateName,
+        podTemplate: stableRefresh.podTemplate,
+        volumeClaimTemplates: stableRefresh.volumeClaimTemplates ?? null,
+        egress: translated === undefined
+            ? null
+            : {
+                kind: translated.kind,
+                policyKind: translated.policyKind,
+                name: translated.name,
+                manifest: translated.manifest,
+            },
+        ingress: ingressOn
+            ? {
+                verified: true,
+                engine: resolveIngressEngine(config.ingress, config.egress?.engine),
+                agentPort: config.agentPort ?? DEFAULT_AGENT_PORT,
+            }
+            : { verified: false },
+        // Absent without perSandbox, so an existing profile's fingerprint is
+        // unchanged. With it, the variant name and everything the host's
+        // per-sandbox writes depend on: a fence renamed, a different
+        // permitted-hosts ConfigMap or another selector key is another
+        // profile, and a workspace allocated under one is not adopted under
+        // the other.
+        ...(perSandbox !== undefined && perSandboxKey !== undefined
+            ? {
+                ...(carriesVariant ? { variant: KUBERNETES_PER_SANDBOX_PROFILE_VARIANT } : {}),
+                perSandbox: {
+                    engine: perSandbox.engine,
+                    labelKey: perSandboxKey,
+                    admissionPolicyName: perSandbox.admissionPolicyName,
+                    admissionPolicyBindingName: perSandbox.admissionPolicyBindingName ?? `${perSandbox.admissionPolicyName}-binding`,
+                    hostIdentity: perSandbox.hostIdentity ?? null,
+                    permittedHostsParam: perSandbox.permittedHostsParam ?? null,
+                    narrowing: perSandbox.narrowing ?? null,
+                },
+            }
+            : {}),
+    };
+    return {
+        client,
+        templateName,
+        template,
+        boundary,
+        podLabels,
+        workspacePodLabels: sandboxPodLabels(template, templateName, podLabels),
+        profile: {
+            fingerprint: canonicalFingerprint(content),
+            podTemplateHash: refresh.hash,
+            sandboxTemplateName: templateName,
+            ...(carriesVariant ? { variant: KUBERNETES_PER_SANDBOX_PROFILE_VARIANT } : {}),
+            content,
+        },
+    };
+}
+/**
+ * Resolve and fingerprint what a workspace created from `config` would run —
+ * the pod template with this backend's overlays, the template's disks, the
+ * egress policy translated from `config.egress` and the ingress settings —
+ * without creating, waking or writing anything. One GET: the
+ * SandboxTemplate.
+ *
+ * The host persists the result, then passes `fingerprint` as
+ * `allocation.executionProfile` to {@link allocateKubernetesWorkspace}, which
+ * refuses to create if the profile resolves differently by then.
+ */
+export async function resolveKubernetesExecutionProfile(config, options = {}) {
+    options.signal?.throwIfAborted();
+    return (await planProfile(config, options.sandboxTemplateName, options.signal, options.workspaceId !== undefined ? workspaceSandboxName(options.workspaceId) : undefined)).profile;
+}
+function unknownReason(err, signal) {
+    if (err instanceof KubernetesApiTimeoutError)
+        return 'timeout';
+    if (signal?.aborted === true)
+        return 'aborted';
+    if (err instanceof KubernetesApiError) {
+        if (err.transport === 'connect')
+            return 'connection';
+        if (err.status !== undefined && err.status >= 500)
+            return 'server-error';
+    }
+    return undefined;
+}
+/**
+ * Create a workspace Sandbox, exactly once, bound to `allocation`. Never
+ * adopts, never resumes, never retries.
+ *
+ * Before the request, and read-only: the same egress and ingress checks
+ * `createKubernetesWorkspace` makes, the block-disk check, and — when
+ * `allocation.executionProfile` is given — that the profile resolves to it
+ * ({@link KubernetesExecutionProfileDriftError} otherwise). A refusal there
+ * sends no create.
+ *
+ * Then ONE POST, which carries the allocation annotations (see the
+ * `*_ANNOTATION_KEY` constants), the holder epoch when one is passed, and
+ * the pod-template revision:
+ *
+ *  - 201 → `{ outcome: 'created', receipt }`.
+ *  - 409 → {@link KubernetesWorkspaceAllocationConflictError}; the existing
+ *    object was not read, touched or woken.
+ *  - a timeout, a reset connection, a 5xx or a caller abort after the request
+ *    was sent, or a reply with no uid → `{ outcome: 'unknown' }`. The POST is
+ *    not repeated.
+ *  - any other rejection (401, 403, 404, 4xx) rejects as itself: the server
+ *    answered, and nothing was created.
+ */
+export async function allocateKubernetesWorkspace(config, options) {
+    options.signal?.throwIfAborted();
+    const { workspaceId, signal } = options;
+    assertAllocation(options.allocation, 'allocateKubernetesWorkspace');
+    const epoch = assertHolderEpoch(options.epoch, 'allocateKubernetesWorkspace');
+    const name = workspaceSandboxName(workspaceId);
+    const plan = await planProfile(config, options.sandboxTemplateName, signal, name);
+    const { fingerprint } = plan.profile;
+    if (options.allocation.executionProfile !== undefined &&
+        options.allocation.executionProfile !== fingerprint) {
+        throw new KubernetesExecutionProfileDriftError(workspaceId, options.allocation.executionProfile, fingerprint);
+    }
+    // The same pre-create checks the create-or-adopt path makes, against the
+    // labels this POST stamps. All GETs; a refusal leaves nothing behind.
+    const subject = `to allocate workspace ${workspaceId} as Sandbox ${name} in namespace ${config.namespace}`;
+    if (config.egress)
+        await plan.boundary?.verifyNamedObject(signal);
+    const verifyIngress = buildIngressVerifier(plan.client, config);
+    if (verifyIngress !== undefined)
+        await verifyIngress(plan.workspacePodLabels, subject, signal);
+    // Without the per-sandbox label, for the reason `createKubernetesWorkspace`
+    // gives: the only policy selecting by it is this workspace's own.
+    await plan.boundary?.verifyUnion(withoutPerSandboxLabel(plan.workspacePodLabels, perSandboxWorkspaceLabels(config.egress, name)), subject, signal);
+    const stored = {
+        id: options.allocation.id,
+        scopeFingerprint: options.allocation.scopeFingerprint,
+        executionProfile: fingerprint,
+    };
+    const body = buildSandboxBody({
+        namespace: config.namespace,
+        name,
+        template: plan.template,
+        sandboxTemplateName: plan.templateName,
+        podLabels: plan.podLabels,
+        annotations: {
+            ...(epoch !== undefined ? { [HOLDER_EPOCH_ANNOTATION_KEY]: String(epoch) } : {}),
+            [POD_TEMPLATE_HASH_ANNOTATION_KEY]: plan.profile.podTemplateHash,
+            [ALLOCATION_ID_ANNOTATION_KEY]: stored.id,
+            [ALLOCATION_SCOPE_ANNOTATION_KEY]: stored.scopeFingerprint,
+            [EXECUTION_PROFILE_ANNOTATION_KEY]: stored.executionProfile,
+        },
+        ...(config.runtimeClassName !== undefined ? { runtimeClassName: config.runtimeClassName } : {}),
+    });
+    const unknown = (reason, error) => ({
+        outcome: 'unknown',
+        reason,
+        workspaceId,
+        sandboxName: name,
+        allocation: stored,
+        ...(epoch !== undefined ? { epoch } : {}),
+        error,
+    });
+    let created;
+    try {
+        // The one and only create. `client.request` does not retry.
+        created = await plan.client.request('POST', sandboxCollectionPath(config.namespace), body, signal);
+    }
+    catch (err) {
+        if (err instanceof KubernetesConflictError) {
+            throw new KubernetesWorkspaceAllocationConflictError(workspaceId, name);
+        }
+        const reason = unknownReason(err, signal);
+        if (reason === undefined)
+            throw err;
+        return unknown(reason, err);
+    }
+    const sandboxUid = created?.metadata?.uid;
+    if (typeof sandboxUid !== 'string' || sandboxUid === '') {
+        return unknown('unreadable-reply', new Error('the create reply carried no metadata.uid'));
+    }
+    return {
+        outcome: 'created',
+        receipt: {
+            workspaceId,
+            sandboxName: name,
+            namespace: config.namespace,
+            sandboxUid,
+            allocation: stored,
+            ...(epoch !== undefined ? { epoch } : {}),
+            templateRevision: plan.profile.podTemplateHash,
+        },
+    };
+}
+/**
+ * Settle an unknown create by reading: one GET of the Sandbox, compared with
+ * the expected allocation. Never creates, wakes or writes. A read that did
+ * not answer rejects as itself — it is never reported as `absent`.
+ */
+export async function recoverKubernetesWorkspaceAllocation(config, options) {
+    options.signal?.throwIfAborted();
+    const { workspaceId } = options;
+    assertAllocation(options.allocation, 'recoverKubernetesWorkspaceAllocation');
+    const epoch = assertHolderEpoch(options.epoch, 'recoverKubernetesWorkspaceAllocation');
+    const name = workspaceSandboxName(workspaceId);
+    const client = createKubernetesClient(clientAccess(config), clientOptions(config));
+    let sandbox;
+    try {
+        sandbox = await client.request('GET', sandboxPath(config.namespace, name), undefined, options.signal);
+    }
+    catch (err) {
+        if (!(err instanceof KubernetesAlreadyGoneError))
+            throw err;
+    }
+    if (sandbox === undefined)
+        return { state: 'absent', workspaceId, sandboxName: name };
+    if (epoch !== undefined) {
+        const held = readHolderEpoch(sandbox.metadata);
+        if (held.epoch === undefined || held.epoch > epoch) {
+            throw new KubernetesWorkspacePreconditionError('recoverKubernetesWorkspaceAllocation', workspaceId, name, epoch, held.epoch, held.annotation);
+        }
+    }
+    const mismatch = firstAllocationMismatch(sandbox, options.allocation);
+    const sandboxUid = sandbox.metadata?.uid;
+    if (mismatch !== undefined || typeof sandboxUid !== 'string' || sandboxUid === '') {
+        return {
+            state: 'different',
+            workspaceId,
+            sandboxName: name,
+            mismatch: mismatch?.kind ?? 'allocation-id',
+            observed: observedAllocation(sandbox),
+            sandboxUid,
+        };
+    }
+    const observed = observedAllocation(sandbox);
+    return {
+        state: 'created',
+        receipt: {
+            workspaceId,
+            sandboxName: name,
+            namespace: config.namespace,
+            sandboxUid,
+            allocation: {
+                id: options.allocation.id,
+                scopeFingerprint: options.allocation.scopeFingerprint,
+                ...(observed.executionProfile !== undefined
+                    ? { executionProfile: observed.executionProfile }
+                    : {}),
+            },
+            ...(epoch !== undefined ? { epoch } : {}),
+            // Present: the template-content check above refuses an object without it.
+            templateRevision: sandbox.metadata?.annotations?.[POD_TEMPLATE_HASH_ANNOTATION_KEY] ?? '',
+        },
+    };
+}
+//# sourceMappingURL=workspace-allocate.js.map

package/dist/backends/kubernetes/workspace-allocate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-allocate.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/workspace-allocate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACN,oCAAoC,EAGpC,0CAA0C,EAE1C,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,GAClB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,0BAA0B,EAC1B,wBAAwB,GACxB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACN,kBAAkB,EAElB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,gBAAgB,GAChB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,EACN,0BAA0B,EAC1B,kBAAkB,EAClB,yBAAyB,EAEzB,uBAAuB,EACvB,sBAAsB,GACtB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,gCAAgC,EAEhC,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,WAAW,GACX,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC7D,OAAO,EACN,sCAAsC,EACtC,yBAAyB,EACzB,sBAAsB,GACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACN,oCAAoC,EACpC,4BAA4B,EAC5B,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,GACpB,MAAM,gBAAgB,CAAA;AAEvB,mFAAmF;AACnF,MAAM,iCAAiC,GAAG,CAAC,CAAA;AA0D3C,KAAK,UAAU,WAAW,CACzB,MAAuC,EACvC,mBAAuC,EACvC,MAA+B,EAC/B,aAAsB;IAEtB,8BAA8B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7C,2BAA2B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,+BAA+B,CAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EACpB,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,EAC9B,MAAM,CAAC,MAAM,CAAC,eAAe,CAC7B,CAAA;IACF,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAClF,MAAM,YAAY,GAAG,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,CAAA;IACtE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;IAC1F,4BAA4B,CAC3B,mBAAmB,YAAY,iBAAiB,MAAM,CAAC,SAAS,EAAE,EAClE,QAAQ,CAAC,WAAW,EACpB,QAAQ,CAAC,oBAAoB,CAC7B,CAAA;IACD,uEAAuE;IACvE,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAA;IAC5C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IACtF,CAAC;IACD,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7D,yEAAyE;IACzE,mEAAmE;IACnE,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,cAAc,GACnB,UAAU,KAAK,SAAS;QACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,YAAY;QAC3C,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,MAAM,CAAA;IAC5C,sEAAsE;IACtE,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,YAAY,GAAG,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,0BAA0B,CAC3C,MAAM,CAAC,MAAM,EACb,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS;QACzD,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,aAAa,EAAE;QACpC,CAAC,CAAC,SAAS,CACZ,CAAA;IACD,MAAM,aAAa,GAAG,uBAAuB,CAC5C,QAAQ,EACR,YAAY,EACZ,MAAM,CAAC,gBAAgB,EACvB,YAAY,CACZ,CAAA;IACD,MAAM,OAAO,GACZ,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS;QACzD,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC;QACrF,CAAC,CAAC,aAAa,CAAA;IACjB,MAAM,UAAU,GAAG,MAAM,QAAQ,EAAE,gBAAgB,EAAE,CAAA;IACrD,MAAM,SAAS,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5D,MAAM,OAAO,GAA4B;QACxC,OAAO,EAAE,iCAAiC;QAC1C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,mBAAmB,EAAE,YAAY;QACjC,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,oBAAoB,EAAE,aAAa,CAAC,oBAAoB,IAAI,IAAI;QAChE,MAAM,EACL,UAAU,KAAK,SAAS;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACA,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC7B;QACJ,OAAO,EAAE,SAAS;YACjB,CAAC,CAAC;gBACA,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;gBACnE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,kBAAkB;aACjD;YACF,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACtB,qEAAqE;QACrE,iEAAiE;QACjE,6DAA6D;QAC7D,+DAA+D;QAC/D,oEAAoE;QACpE,aAAa;QACb,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS;YAC1D,CAAC,CAAC;gBACA,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,UAAU,EAAE;oBACX,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,QAAQ,EAAE,aAAa;oBACvB,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;oBACnD,0BAA0B,EACzB,UAAU,CAAC,0BAA0B,IAAI,GAAG,UAAU,CAAC,mBAAmB,UAAU;oBACrF,YAAY,EAAE,UAAU,CAAC,YAAY,IAAI,IAAI;oBAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,IAAI,IAAI;oBAC3D,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,IAAI;iBACvC;aACD;YACF,CAAC,CAAC,EAAE,CAAC;KACN,CAAA;IACD,OAAO;QACN,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,QAAQ;QACR,SAAS;QACT,kBAAkB,EAAE,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC;QACvE,OAAO,EAAE;YACR,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC;YAC1C,eAAe,EAAE,OAAO,CAAC,IAAI;YAC7B,mBAAmB,EAAE,YAAY;YACjC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO;SACP;KACD,CAAA;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,MAAuC,EACvC,UAA6C,EAAE;IAE/C,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,OAAO,CACN,MAAM,WAAW,CAChB,MAAM,EACN,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CACzF,CACD,CAAC,OAAO,CAAA;AACV,CAAC;AA+DD,SAAS,aAAa,CACrB,GAAY,EACZ,MAA+B;IAE/B,IAAI,GAAG,YAAY,yBAAyB;QAAE,OAAO,SAAS,CAAA;IAC9D,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC9C,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,YAAY,CAAA;QACpD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,cAAc,CAAA;IACzE,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,MAAuC,EACvC,OAA2C;IAE3C,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACvC,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAA;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAA;IAC7E,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,mBAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACjF,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;IACpC,IACC,OAAO,CAAC,UAAU,CAAC,gBAAgB,KAAK,SAAS;QACjD,OAAO,CAAC,UAAU,CAAC,gBAAgB,KAAK,WAAW,EAClD,CAAC;QACF,MAAM,IAAI,oCAAoC,CAC7C,WAAW,EACX,OAAO,CAAC,UAAU,CAAC,gBAAgB,EACnC,WAAW,CACX,CAAA;IACF,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,OAAO,GAAG,yBAAyB,WAAW,eAAe,IAAI,iBAAiB,MAAM,CAAC,SAAS,EAAE,CAAA;IAC1G,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACjE,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/D,IAAI,aAAa,KAAK,SAAS;QAAE,MAAM,aAAa,CAAC,IAAI,CAAC,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IAC9F,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,IAAI,CAAC,QAAQ,EAAE,WAAW,CAC/B,sBAAsB,CAAC,IAAI,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAC/F,OAAO,EACP,MAAM,CACN,CAAA;IAED,MAAM,MAAM,GAA4C;QACvD,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE;QACzB,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,gBAAgB;QACrD,gBAAgB,EAAE,WAAW;KAC7B,CAAA;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,mBAAmB,EAAE,IAAI,CAAC,YAAY;QACtC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE;YACZ,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,CAAC,gCAAgC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;YAChE,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC,EAAE;YACzC,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC,gBAAgB;YAC1D,CAAC,gCAAgC,CAAC,EAAE,MAAM,CAAC,gBAAgB;SAC3D;QACD,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,CACf,MAAyC,EACzC,KAAc,EACwB,EAAE,CAAC,CAAC;QAC1C,OAAO,EAAE,SAAS;QAClB,MAAM;QACN,WAAW;QACX,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,MAAM;QAClB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,KAAK;KACL,CAAC,CAAA;IAEF,IAAI,OAAoC,CAAA;IACxC,IAAI,CAAC;QACJ,4DAA4D;QAC5D,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAClC,MAAM,EACN,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,EACvC,IAAI,EACJ,MAAM,CACN,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;YAC5C,MAAM,IAAI,0CAA0C,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACxE,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACzC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,GAAG,CAAA;QACnC,OAAO,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAA;IACzC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC,kBAAkB,EAAE,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO;QACN,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE;YACR,WAAW;YACX,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU;YACV,UAAU,EAAE,MAAM;YAClB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;SAC9C;KACD,CAAA;AACF,CAAC;AAoCD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACzD,MAAuC,EACvC,OAAoD;IAEpD,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAC/B,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAA;IAC5E,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAA;IACtF,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAClF,IAAI,OAAoC,CAAA;IACxC,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAC7B,KAAK,EACL,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EACnC,SAAS,EACT,OAAO,CAAC,MAAM,CACd,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,GAAG,YAAY,0BAA0B,CAAC;YAAE,MAAM,GAAG,CAAA;IAC5D,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IACrF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC9C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;YACpD,MAAM,IAAI,oCAAoC,CAC7C,sCAAsC,EACtC,WAAW,EACX,IAAI,EACJ,KAAK,EACL,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,UAAU,CACf,CAAA;QACF,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAA;IACxC,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACnF,OAAO;YACN,KAAK,EAAE,WAAW;YAClB,WAAW;YACX,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,eAAe;YAC3C,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC;YACrC,UAAU;SACV,CAAA;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC5C,OAAO;QACN,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE;YACR,WAAW;YACX,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU;YACV,UAAU,EAAE;gBACX,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE;gBACzB,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,gBAAgB;gBACrD,GAAG,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS;oBAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE;oBACjD,CAAC,CAAC,EAAE,CAAC;aACN;YACD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,0EAA0E;YAC1E,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,gCAAgC,CAAC,IAAI,EAAE;SACzF;KACD,CAAA;AACF,CAAC"}