@tickernelz/paperclip-pro-plugin-kubernetes 2026.925.0

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2025 Paperclip AI
+Copyright (c) 2026 Zhafron Adani Kautsar (paperclip-pro fork modifications)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,180 @@
+# @tickernelz/paperclip-pro-plugin-kubernetes (alpha)
+
+First-party Paperclip sandbox-provider plugin for Kubernetes.
+
+**Alpha:** the default backend (`sandbox-cr`) is built on `kubernetes-sigs/agent-sandbox` v1alpha1 — expect breaking changes as that CRD evolves toward Beta. A stable fallback backend (`job`, using `batch/v1` Job) is available for clusters without agent-sandbox installed, but it does NOT support multi-command exec (paperclip-server's adapter-install pattern requires sandbox-cr).
+
+## Prerequisites
+
+### For `sandbox-cr` backend (default, recommended)
+
+1. A Kubernetes cluster running k8s 1.27+
+2. [`kubernetes-sigs/agent-sandbox`](https://github.com/kubernetes-sigs/agent-sandbox) controller installed in the cluster (alpha — installs the `sandboxes.agents.x-k8s.io/v1alpha1` CRD and controller)
+3. Paperclip-server running with access to the cluster (in-cluster via `inCluster: true` or external via `kubeconfig`)
+
+### For `job` backend (stable fallback)
+
+1. A Kubernetes cluster running k8s 1.27+
+2. Paperclip-server with cluster access — no additional controllers or CRDs required
+
+## Installation
+
+```bash
+paperclip-pro plugin install @tickernelz/paperclip-pro-plugin-kubernetes
+```
+
+Or, for local development:
+
+```bash
+paperclip-pro plugin install --local /path/to/paperclip/packages/plugins/sandbox-providers/kubernetes
+```
+
+## Backends
+
+The plugin supports two backend modes, selected via the `backend` config field:
+
+| Backend | Default | Stability | Multi-command exec | Requires |
+|---|---|---|---|---|
+| `sandbox-cr` | Yes | Alpha | Yes | `kubernetes-sigs/agent-sandbox` controller |
+| `job` | No | Stable | No | Nothing beyond k8s 1.27+ |
+
+**`sandbox-cr` (default):** Creates a `Sandbox` CR (`agents.x-k8s.io/v1alpha1`) whose controller provisions a long-lived pod running `sleep infinity`. paperclip-server execs individual commands into the running pod — this is the multi-command adapter-install pattern. When you `releaseLease`, the Sandbox CR is deleted and the controller tears down the pod.
+
+**`job` (stable fallback):** Creates a `batch/v1` Job. The container entrypoint runs once and exits — no multi-command exec possible. Use this when you cannot install agent-sandbox, or when you need strictly stable Kubernetes APIs. Note: paperclip-server's adapter-install pattern will not work in job mode.
+
+### Migrating from `job` to `sandbox-cr`
+
+1. Install the agent-sandbox controller: `kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/install.yaml`
+2. Update your environment config to set `backend: "sandbox-cr"` (or remove `backend` since `sandbox-cr` is the default)
+3. New leases will use the Sandbox CR backend. Existing leases created with `job` mode continue to use job semantics until they are released.
+
+## Configuration
+
+Create a `sandbox` environment with `driver: kubernetes`. One of these auth fields is required:
+
+- `inCluster: true` — use the in-pod ServiceAccount credentials (when paperclip-server runs inside the same cluster).
+- `kubeconfig: <YAML>` — inline kubeconfig (stored as a company secret).
+- `kubeconfigSecretRef: <secret-uuid>` — reference to an existing Paperclip secret.
+
+Common optional fields:
+
+| Field | Default | Purpose |
+|---|---|---|
+| `backend` | `"sandbox-cr"` | `sandbox-cr` (alpha, requires agent-sandbox controller) or `job` (stable, one-shot entrypoint). |
+| `adapterType` | `"claude_local"` | One of the supported adapter types (claude_local, codex_local, gemini_local, cursor_local, opencode_local, pi_local). Determines runtime image + env keys + egress allow-list. |
+| `namespacePrefix` | `"paperclip-"` | Prefix for the per-company tenant namespace. |
+| `companySlug` | derived from companyId | Override the auto-derived company slug. |
+| `imageRegistry` | (none) | Override the default registry for agent runtime images. |
+| `imageAllowList` | `[]` | Glob patterns of allowed `target.imageOverride` values. Empty = no override permitted. |
+| `imagePullSecrets` | `[]` | Names of pre-created Docker image pull secrets in the tenant namespace. |
+| `egressAllowFqdns` | `[]` | Additional FQDNs (beyond adapter defaults like `api.anthropic.com`). |
+| `egressAllowCidrs` | `[]` | Additional CIDRs to allow egress to. |
+| `egressMode` | `"standard"` | `standard` (NetworkPolicy + CIDRs) or `cilium` (CiliumNetworkPolicy + FQDN allow-list). |
+| `runtimeClassName` | (none) | e.g. `kata-fc` for Firecracker-backed microVMs. Cluster must have the RuntimeClass installed. |
+| `serviceAccountAnnotations` | `{}` | Annotations applied to per-tenant ServiceAccount (e.g. IRSA `eks.amazonaws.com/role-arn`). |
+| `jobTtlSecondsAfterFinished` | `900` | Seconds after a Job completes before garbage-collection. |
+| `podActivityDeadlineSec` | `3600` | Hard ceiling on a single run's wall-clock time. |
+
+Full JSON Schema in `src/manifest.ts`.
+
+### Task-scoped egress grants
+
+Keep provider-level egress defaults narrow, then grant only the destinations a task needs through its execution workspace settings:
+
+```json
+{
+  "executionWorkspaceSettings": {
+    "networkEgress": {
+      "allowFqdns": ["github.com", "pypi.org"],
+      "allowCidrs": []
+    }
+  }
+}
+```
+
+The provider creates a workload-owned policy selected by the task run label, so the additional destinations do not become reachable from other concurrent agent pods. Cilium mode enforces FQDNs directly. Standard NetworkPolicy mode cannot express FQDNs, so an FQDN grant permits public IPv4 TCP 80/443 for that run while excluding private, loopback, link-local, CGNAT, and multicast ranges. Network failures that look policy-related include the grant path in stderr, and the sandbox exposes the effective policy through `PAPERCLIP_NETWORK_EGRESS_*` environment variables.
+
+## What gets created in your cluster
+
+For each company that runs agents (created lazily on first dispatch):
+
+```
+Namespace          paperclip-{companySlug}        (PSS: restricted enforce + audit)
+ServiceAccount     paperclip-tenant-sa
+Role               paperclip-tenant-role          (only get pods/log)
+RoleBinding        paperclip-tenant-rb
+ResourceQuota      paperclip-quota                (pods, requests/limits cpu+memory)
+LimitRange         paperclip-limits               (container max/min/default/defaultRequest)
+NetworkPolicy      paperclip-deny-all             (deny ingress + egress baseline)
+NetworkPolicy      paperclip-egress-allow         (DNS + paperclip-server callback + user CIDRs)
+                   OR CiliumNetworkPolicy paperclip-egress-fqdn if egressMode=cilium
+```
+
+For each agent run (sandbox-cr backend):
+
+```
+Sandbox CR         pc-{ulid}                       (agents.x-k8s.io/v1alpha1; explicit delete on release)
+Pod                pc-{ulid}-{podSuffix}           (managed by Sandbox controller; torn down on CR delete)
+Secret             pc-{ulid}-env                   (owned by Sandbox CR; cascade-deleted)
+```
+
+For each agent run (job backend):
+
+```
+Job                pc-{ulid}                       (backoffLimit: 0, ttlSecondsAfterFinished from config)
+Pod                pc-{ulid}-{podSuffix}           (owned by Job; cascade-deleted)
+Secret             pc-{ulid}-env                   (owned by Job; cascade-deleted)
+```
+
+## Security baseline
+
+Every agent pod is:
+
+- non-root (`runAsUser: 1000`, `runAsGroup: 1000`, `runAsNonRoot: true`)
+- drops ALL Linux capabilities, `allowPrivilegeEscalation: false`
+- `readOnlyRootFilesystem: true` with explicit `emptyDir` mounts for `/workspace`, `/home/paperclip`, `/home/paperclip/.cache`, `/tmp`
+- `seccompProfile: RuntimeDefault`
+- Tini as PID 1 (reaps zombies, forwards signals)
+- `fsGroupChangePolicy: OnRootMismatch` (fast PVC startup; openclaw-operator lesson)
+- `automountServiceAccountToken: true` (for the agent shim's paperclip-server callback)
+
+Plus per-namespace `pod-security.kubernetes.io/enforce: restricted` and a deny-all NetworkPolicy baseline with explicit egress allow-list (DNS, paperclip-server, configured FQDNs/CIDRs).
+
+The per-run Secret carrying the bootstrap token and adapter API keys has `ownerReferences` pointing at the owning Job, so a single `kubectl delete job …` cascades cleanly to the Pod and Secret.
+
+## Optional Kata-FC microVM isolation
+
+For stronger isolation, install [Kata Containers](https://github.com/kata-containers/kata-containers) with the Firecracker hypervisor, then set `runtimeClassName: kata-fc` in the plugin config. Each agent pod will run inside a Firecracker microVM. Requires nested-virt-capable nodes (bare-metal or specific cloud instance types).
+
+## Roadmap
+
+- **Phase A (done):** `sandbox-cr` backend — multi-command exec via agent-sandbox Sandbox CRD.
+- **Phase B:** Warm pool support — pre-provisioned Sandbox CRs for sub-second cold starts. The `SandboxOrchestrator` interface reserves optional `pause?`/`resume?` extension slots.
+- **Phase C:** Kata-FC + snapshots — `runtimeClassName: kata-fc` with VM snapshot for fast restore.
+- **Phase D:** Contribute back to agent-sandbox upstream if their Beta model diverges from our needs. The `SandboxOrchestrator` interface (`src/sandbox-orchestrator.ts`) is the clean swap point — a new implementation can be added without touching `plugin.ts` business logic.
+
+## Lessons learned (from openclaw-operator)
+
+This plugin adopts patterns from `openclaw-rocks/openclaw-operator`:
+
+- Tini PID 1 (issue #471 — zombie helper processes)
+- Read-only rootFS with explicit writable mounts (issue #456 — ~/.config not writable)
+- Strategic merge on reconcile (issue #446 — preserve third-party annotations)
+- Multi-storage-class testing (issue #448 — `local-path-provisioner` differences)
+- Image version compat matrix (issue #462 — runtime deps cannot resolve after upgrade)
+
+## Development
+
+```bash
+cd packages/plugins/sandbox-providers/kubernetes
+pnpm install --ignore-workspace
+pnpm test           # unit tests only (fast)
+pnpm typecheck
+pnpm build
+```
+
+To run the kind-cluster integration test (requires `kubectl --context kind-paperclip` and a pre-loaded alpine image; see `test/integration/end-to-end-run.test.ts`):
+
+```bash
+RUN_K8S_INTEGRATION_TESTS=1 pnpm test test/integration/end-to-end-run.test.ts
+```

package/dist/adapter-defaults.d.ts

@@ -0,0 +1,29 @@
+import type { AdapterRegistryEntry } from "./adapter-registry.js";
+export interface AdapterDefaults {
+    runtimeImage: string;
+    envKeys: string[];
+    allowFqdns: string[];
+    probeCommand: string[];
+    /** Non-secret env injected as the base layer for the Job (process-env wins on top). */
+    defaultEnv?: Record<string, string>;
+}
+export declare const KNOWN_ADAPTER_TYPES: ReadonlySet<string>;
+/**
+ * Resolve the runtime defaults for an adapter. When a `registry` is supplied it
+ * is authoritative (replace semantics): the type MUST be present and complete,
+ * else this throws. With no registry, falls back to the built-in REGISTRY.
+ */
+export declare function getAdapterDefaults(adapterType: string, registry?: readonly AdapterRegistryEntry[]): AdapterDefaults;
+/**
+ * Resolve the adapter type for a single run: prefer the run's adapter (the agent's,
+ * from the lease params) so one environment can serve mixed harnesses; fall back to
+ * the environment's configured default adapter when the run does not specify one.
+ */
+export declare function resolveRunAdapterType(runAdapterType: string | null | undefined, configAdapterType: string): string;
+/**
+ * Build the per-run env for the Job: the non-secret `defaultEnv` is the base
+ * and the process-env values (the secret API keys named by `envKeys`) override
+ * it. Pure for testability.
+ */
+export declare function buildAdapterEnv(defaults: AdapterDefaults, processEnv?: NodeJS.ProcessEnv): Record<string, string>;
+//# sourceMappingURL=adapter-defaults.d.ts.map

package/dist/adapter-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-defaults.d.ts","sourceRoot":"","sources":["../src/adapter-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAyCD,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAkC,CAAC;AAqBvF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,GACzC,eAAe,CAajB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACzC,iBAAiB,EAAE,MAAM,GACxB,MAAM,CAGR;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,eAAe,EACzB,UAAU,GAAE,MAAM,CAAC,UAAwB,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB"}

package/dist/adapter-defaults.js

@@ -0,0 +1,98 @@
+const REGISTRY = {
+    claude_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-claude:v1",
+        envKeys: ["ANTHROPIC_API_KEY"],
+        allowFqdns: ["api.anthropic.com"],
+        probeCommand: ["claude", "--version"],
+    },
+    codex_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-codex:v1",
+        envKeys: ["OPENAI_API_KEY"],
+        allowFqdns: ["api.openai.com"],
+        probeCommand: ["codex", "--version"],
+    },
+    gemini_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-gemini:v1",
+        envKeys: ["GOOGLE_API_KEY", "GEMINI_API_KEY"],
+        allowFqdns: ["generativelanguage.googleapis.com"],
+        probeCommand: ["gemini", "--version"],
+    },
+    cursor_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-cursor:v1",
+        envKeys: ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"],
+        allowFqdns: ["api.anthropic.com", "api.openai.com"],
+        probeCommand: ["cursor-agent", "--version"],
+    },
+    opencode_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-opencode:v1",
+        envKeys: ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "OPENROUTER_API_KEY"],
+        allowFqdns: ["api.anthropic.com", "api.openai.com", "openrouter.ai"],
+        probeCommand: ["opencode", "--version"],
+    },
+    pi_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-pi:v1",
+        envKeys: ["ANTHROPIC_API_KEY"],
+        allowFqdns: ["api.anthropic.com"],
+        probeCommand: ["pi", "--version"],
+    },
+};
+export const KNOWN_ADAPTER_TYPES = new Set(Object.keys(REGISTRY));
+function fromRegistryEntry(entry) {
+    // Only runtimeImage is strictly required. The array fields are optional and
+    // default to []: the operator emits them with `omitempty`, so a genuinely
+    // empty allowFqdns/envKeys/probeCommand arrives as undefined, which is valid
+    // (no extra egress / no forwarded secrets / no probe), NOT an error.
+    if (!entry.runtimeImage) {
+        throw new Error(`Adapter "${entry.adapterType}" is missing required runtime field: runtimeImage`);
+    }
+    return {
+        runtimeImage: entry.runtimeImage,
+        envKeys: entry.envKeys ?? [],
+        allowFqdns: entry.allowFqdns ?? [],
+        probeCommand: entry.probeCommand ?? [],
+        defaultEnv: entry.defaultEnv,
+    };
+}
+/**
+ * Resolve the runtime defaults for an adapter. When a `registry` is supplied it
+ * is authoritative (replace semantics): the type MUST be present and complete,
+ * else this throws. With no registry, falls back to the built-in REGISTRY.
+ */
+export function getAdapterDefaults(adapterType, registry) {
+    if (registry && registry.length > 0) {
+        const entry = registry.find((e) => e.adapterType === adapterType);
+        if (!entry) {
+            throw new Error(`Adapter "${adapterType}" is not in the configured adapter registry`);
+        }
+        return fromRegistryEntry(entry);
+    }
+    const defaults = REGISTRY[adapterType];
+    if (!defaults) {
+        throw new Error(`Unknown adapter type: ${adapterType}`);
+    }
+    return defaults;
+}
+/**
+ * Resolve the adapter type for a single run: prefer the run's adapter (the agent's,
+ * from the lease params) so one environment can serve mixed harnesses; fall back to
+ * the environment's configured default adapter when the run does not specify one.
+ */
+export function resolveRunAdapterType(runAdapterType, configAdapterType) {
+    const trimmed = typeof runAdapterType === "string" ? runAdapterType.trim() : "";
+    return trimmed.length > 0 ? trimmed : configAdapterType;
+}
+/**
+ * Build the per-run env for the Job: the non-secret `defaultEnv` is the base
+ * and the process-env values (the secret API keys named by `envKeys`) override
+ * it. Pure for testability.
+ */
+export function buildAdapterEnv(defaults, processEnv = process.env) {
+    const out = { ...(defaults.defaultEnv ?? {}) };
+    for (const k of defaults.envKeys) {
+        const v = processEnv[k];
+        if (v)
+            out[k] = v;
+    }
+    return out;
+}
+//# sourceMappingURL=adapter-defaults.js.map

package/dist/adapter-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-defaults.js","sourceRoot":"","sources":["../src/adapter-defaults.ts"],"names":[],"mappings":"AAWA,MAAM,QAAQ,GAAoC;IAChD,YAAY,EAAE;QACZ,YAAY,EAAE,6CAA6C;QAC3D,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,UAAU,EAAE,CAAC,mBAAmB,CAAC;QACjC,YAAY,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;KACtC;IACD,WAAW,EAAE;QACX,YAAY,EAAE,4CAA4C;QAC1D,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;KACrC;IACD,YAAY,EAAE;QACZ,YAAY,EAAE,6CAA6C;QAC3D,OAAO,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QAC7C,UAAU,EAAE,CAAC,mCAAmC,CAAC;QACjD,YAAY,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;KACtC;IACD,YAAY,EAAE;QACZ,YAAY,EAAE,6CAA6C;QAC3D,OAAO,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QAChD,UAAU,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QACnD,YAAY,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC;KAC5C;IACD,cAAc,EAAE;QACd,YAAY,EAAE,+CAA+C;QAC7D,OAAO,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,CAAC;QACtE,UAAU,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,CAAC;QACpE,YAAY,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;KACxC;IACD,QAAQ,EAAE;QACR,YAAY,EAAE,yCAAyC;QACvD,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,UAAU,EAAE,CAAC,mBAAmB,CAAC;QACjC,YAAY,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;KAClC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEvF,SAAS,iBAAiB,CAAC,KAA2B;IACpD,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,YAAY,KAAK,CAAC,WAAW,mDAAmD,CACjF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,QAA0C;IAE1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,YAAY,WAAW,6CAA6C,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,cAAyC,EACzC,iBAAyB;IAEzB,MAAM,OAAO,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAyB,EACzB,aAAgC,OAAO,CAAC,GAAG;IAE3C,MAAM,GAAG,GAA2B,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/adapter-registry.d.ts

@@ -0,0 +1,64 @@
+import { z } from "zod";
+/**
+ * One declarative agent-harness ("adapter") entry. Governs picker availability
+ * and, for sandboxed (Kubernetes) runs, the runtime wiring.
+ *
+ * NOTE: this shape is intentionally duplicated across the package boundary. It
+ * MUST stay structurally in sync with:
+ *   - server `@tickernelz/paperclip-pro-shared` `adapterRegistryEntrySchema` (the parser side)
+ *   - operator `AdapterRegistryEntry` Go struct (PAPERCLIP_ADAPTERS emitter)
+ * The duplication is deliberate: this plugin is standalone-installable and must
+ * not pull in heavy workspace packages at runtime.
+ */
+export declare const adapterRegistryEntrySchema: z.ZodObject<{
+    adapterType: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    runtimeImage: z.ZodOptional<z.ZodString>;
+    envKeys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    allowFqdns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    probeCommand: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    defaultEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strict", z.ZodTypeAny, {
+    adapterType: string;
+    enabled: boolean;
+    runtimeImage?: string | undefined;
+    envKeys?: string[] | undefined;
+    allowFqdns?: string[] | undefined;
+    probeCommand?: string[] | undefined;
+    defaultEnv?: Record<string, string> | undefined;
+}, {
+    adapterType: string;
+    enabled?: boolean | undefined;
+    runtimeImage?: string | undefined;
+    envKeys?: string[] | undefined;
+    allowFqdns?: string[] | undefined;
+    probeCommand?: string[] | undefined;
+    defaultEnv?: Record<string, string> | undefined;
+}>;
+export declare const adapterRegistrySchema: z.ZodArray<z.ZodObject<{
+    adapterType: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    runtimeImage: z.ZodOptional<z.ZodString>;
+    envKeys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    allowFqdns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    probeCommand: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    defaultEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strict", z.ZodTypeAny, {
+    adapterType: string;
+    enabled: boolean;
+    runtimeImage?: string | undefined;
+    envKeys?: string[] | undefined;
+    allowFqdns?: string[] | undefined;
+    probeCommand?: string[] | undefined;
+    defaultEnv?: Record<string, string> | undefined;
+}, {
+    adapterType: string;
+    enabled?: boolean | undefined;
+    runtimeImage?: string | undefined;
+    envKeys?: string[] | undefined;
+    allowFqdns?: string[] | undefined;
+    probeCommand?: string[] | undefined;
+    defaultEnv?: Record<string, string> | undefined;
+}>, "many">;
+export type AdapterRegistryEntry = z.infer<typeof adapterRegistryEntrySchema>;
+//# sourceMappingURL=adapter-registry.d.ts.map

package/dist/adapter-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-registry.d.ts","sourceRoot":"","sources":["../src/adapter-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;EAU5B,CAAC;AAEZ,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;WAAsC,CAAC;AAEzE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/adapter-registry.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+/**
+ * One declarative agent-harness ("adapter") entry. Governs picker availability
+ * and, for sandboxed (Kubernetes) runs, the runtime wiring.
+ *
+ * NOTE: this shape is intentionally duplicated across the package boundary. It
+ * MUST stay structurally in sync with:
+ *   - server `@tickernelz/paperclip-pro-shared` `adapterRegistryEntrySchema` (the parser side)
+ *   - operator `AdapterRegistryEntry` Go struct (PAPERCLIP_ADAPTERS emitter)
+ * The duplication is deliberate: this plugin is standalone-installable and must
+ * not pull in heavy workspace packages at runtime.
+ */
+export const adapterRegistryEntrySchema = z
+    .object({
+    adapterType: z.string().min(1),
+    enabled: z.boolean().default(true),
+    runtimeImage: z.string().optional(),
+    envKeys: z.array(z.string()).optional(),
+    allowFqdns: z.array(z.string()).optional(),
+    probeCommand: z.array(z.string()).optional(),
+    defaultEnv: z.record(z.string()).optional(),
+})
+    .strict();
+export const adapterRegistrySchema = z.array(adapterRegistryEntrySchema);
+//# sourceMappingURL=adapter-registry.js.map

package/dist/adapter-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-registry.js","sourceRoot":"","sources":["../src/adapter-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC"}

package/dist/cilium-network-policy.d.ts

@@ -0,0 +1,12 @@
+export interface BuildCiliumNetworkPolicyInput {
+    namespace: string;
+    paperclipServerNamespace: string;
+    egressAllowFqdns: string[];
+    egressAllowCidrs: string[];
+    name?: string;
+    endpointSelector?: Record<string, string>;
+    includeBaseRules?: boolean;
+    ownerReferences?: Record<string, unknown>[];
+}
+export declare function buildCiliumNetworkPolicyManifest(input: BuildCiliumNetworkPolicyInput): Record<string, unknown>;
+//# sourceMappingURL=cilium-network-policy.d.ts.map

package/dist/cilium-network-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cilium-network-policy.d.ts","sourceRoot":"","sources":["../src/cilium-network-policy.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB,EAAE,MAAM,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CAC7C;AAMD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyD9G"}

package/dist/cilium-network-policy.js

@@ -0,0 +1,60 @@
+// Design note: no ingress rules are defined here. Paperclip-server does NOT
+// push to agent pods — agents make outbound (egress) callbacks to
+// paperclip-server on port 3100. If server→agent push is ever needed, add a
+// targeted ingress rule scoped to the paperclip-server endpoint selector.
+export function buildCiliumNetworkPolicyManifest(input) {
+    const egress = [];
+    if (input.includeBaseRules !== false)
+        egress.push({
+            toEndpoints: [
+                { matchLabels: { "k8s:io.kubernetes.pod.namespace": "kube-system", "k8s-app": "kube-dns" } },
+            ],
+            toPorts: [
+                {
+                    ports: [
+                        { port: "53", protocol: "UDP" },
+                        { port: "53", protocol: "TCP" },
+                    ],
+                    rules: { dns: [{ matchPattern: "*" }] },
+                },
+            ],
+        });
+    if (input.egressAllowFqdns.length > 0) {
+        egress.push({
+            toFQDNs: input.egressAllowFqdns.map((fqdn) => ({ matchName: fqdn })),
+            toPorts: [{ ports: [{ port: "443", protocol: "TCP" }] }],
+        });
+    }
+    if (input.includeBaseRules !== false)
+        egress.push({
+            toEndpoints: [
+                {
+                    matchLabels: {
+                        "k8s:io.kubernetes.pod.namespace": input.paperclipServerNamespace,
+                        app: "paperclip-server",
+                    },
+                },
+            ],
+            toPorts: [{ ports: [{ port: "3100", protocol: "TCP" }] }],
+        });
+    if (input.egressAllowCidrs.length > 0) {
+        egress.push({
+            toCIDRSet: input.egressAllowCidrs.map((cidr) => ({ cidr })),
+        });
+    }
+    return {
+        apiVersion: "cilium.io/v2",
+        kind: "CiliumNetworkPolicy",
+        metadata: {
+            name: input.name ?? "paperclip-egress-fqdn",
+            namespace: input.namespace,
+            labels: { "paperclip.io/managed-by": "paperclip-k8s-plugin" },
+            ...(input.ownerReferences ? { ownerReferences: input.ownerReferences } : {}),
+        },
+        spec: {
+            endpointSelector: { matchLabels: input.endpointSelector ?? { "paperclip.io/role": "agent" } },
+            egress,
+        },
+    };
+}
+//# sourceMappingURL=cilium-network-policy.js.map

package/dist/cilium-network-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cilium-network-policy.js","sourceRoot":"","sources":["../src/cilium-network-policy.ts"],"names":[],"mappings":"AAWA,4EAA4E;AAC5E,kEAAkE;AAClE,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,UAAU,gCAAgC,CAAC,KAAoC;IACnF,MAAM,MAAM,GAA8B,EAAE,CAAC;IAE7C,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC;YAChD,WAAW,EAAE;gBACX,EAAE,WAAW,EAAE,EAAE,iCAAiC,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;aAC7F;YACD,OAAO,EAAE;gBACP;oBACE,KAAK,EAAE;wBACL,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;wBAC/B,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;qBAChC;oBACD,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;iBACxC;aACF;SACF,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC;YAChD,WAAW,EAAE;gBACX;oBACE,WAAW,EAAE;wBACX,iCAAiC,EAAE,KAAK,CAAC,wBAAwB;wBACjE,GAAG,EAAE,kBAAkB;qBACxB;iBACF;aACF;YACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC;YACV,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,UAAU,EAAE,cAAc;QAC1B,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,uBAAuB;YAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,EAAE,yBAAyB,EAAE,sBAAsB,EAAE;YAC7D,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E;QACD,IAAI,EAAE;YACJ,gBAAgB,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE;YAC7F,MAAM;SACP;KACF,CAAC;AACJ,CAAC"}

package/dist/file-sync.d.ts

@@ -0,0 +1,73 @@
+import type { Readable, Writable } from "node:stream";
+import type { PluginEnvironmentSyncResult, PluginSyncOperation } from "@tickernelz/paperclip-pro-plugin-sdk";
+/**
+ * Injected streaming pod-exec primitive. `command` is always
+ * `["/bin/sh", "-c", <script>]`; `io.stdin` (when present) is streamed to the
+ * command's stdin over the exec data channel, and `io.stdout` (when present)
+ * receives the command's stdout. Returns the command's exit code plus its
+ * captured (bounded) stderr. `plugin.ts` binds this to
+ * `execInPodStreaming(kc, namespace, podName, "agent", …)`.
+ */
+export type PodStreamExec = (command: string[], io: {
+    stdin?: Readable;
+    stdout?: Writable;
+    timeoutMs?: number;
+    maxStderrBytes?: number;
+}) => Promise<{
+    exitCode: number;
+    stderr: string;
+}>;
+/**
+ * Host-side complete-mediation guard applied as defense-in-depth below the
+ * orchestrator's own confinement. Every sandbox-side path (the sync target for
+ * inbound, the sync source for outbound) MUST be an absolute path that
+ * canonicalizes lexically inside the workspace remote dir; absolute escapes and
+ * `..` traversal are rejected fail-closed before any bytes move. Sandbox paths
+ * are POSIX.
+ */
+export declare function assertConfinedSandboxPath(remoteDir: string, candidate: string, label: string): void;
+/**
+ * Parse one `tar -tvf` verbose listing line into its leading type flag and the
+ * trailing name-and-link-target field. The listing dialect depends on which tar
+ * the host ships: GNU/busybox emit
+ * `<perms> <owner>/<group> <size> <date> <time> <rest>`, while bsdtar
+ * (libarchive — the system tar on macOS) emits the ls-style
+ * `<perms> <links> <user> <group> <size> <Mon> <day> <time|year> <rest>`.
+ * The second field disambiguates: GNU always slash-joins owner/group, bsdtar
+ * puts a pure-digit link count there, so no line satisfies both shapes — the
+ * slash requirement is load-bearing, since a bsdtar line with numeric uid/gid
+ * would otherwise match the GNU shape shifted, hiding traversal in `<rest>`.
+ * Entries whose size column is not a plain byte count (e.g. a device node's
+ * `major,minor`) match neither shape. Returns null when nothing matches so
+ * callers can fail closed.
+ */
+export declare function parseTarVerboseListingLine(line: string): {
+    typeFlag: string;
+    rest: string;
+} | null;
+/**
+ * Split a verbose-listing link field (`<name><delimiter><target>`) exactly
+ * once. The sandbox controls both halves, so a field with zero or multiple
+ * delimiter occurrences is unresolvable: a link name that itself contains the
+ * delimiter shifts the split point, and taking the first (or last) occurrence
+ * would let a crafted name or target hide an escaping link target from the
+ * confinement check. Returns null so callers fail closed.
+ */
+export declare function splitLinkEntryOnce(field: string, delimiter: string): {
+    name: string;
+    target: string;
+} | null;
+export declare function performSyncIn(input: {
+    exec: PodStreamExec;
+    operations: PluginSyncOperation[];
+    remoteDir: string;
+    timeoutMs: number;
+}): Promise<PluginEnvironmentSyncResult>;
+export declare function performSyncOut(input: {
+    exec: PodStreamExec;
+    operations: PluginSyncOperation[];
+    remoteDir: string;
+    timeoutMs: number;
+    maxOutputBytes?: number;
+}): Promise<PluginEnvironmentSyncResult>;
+//# sourceMappingURL=file-sync.d.ts.map

package/dist/file-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-sync.d.ts","sourceRoot":"","sources":["../src/file-sync.ts"],"names":[],"mappings":"AAkDA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAItD,OAAO,KAAK,EACV,2BAA2B,EAG3B,mBAAmB,EACpB,MAAM,sCAAsC,CAAC;AAI9C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,MAAM,EAAE,EACjB,EAAE,EAAE;IACF,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,KACE,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAoCnD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAenG;AA2LD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAMlG;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAK5G;AA6TD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA0CvC;AAsJD,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAmCvC"}