@tickernelz/paperclip-pro-plugin-kubernetes 2026.925.0

package/dist/scoped-network-egress.d.ts

@@ -0,0 +1,19 @@
+import type { KubeClients } from "./kube-client.js";
+export declare const NETWORK_EGRESS_GRANT_PATH = "executionWorkspaceSettings.networkEgress";
+export interface ScopedNetworkEgressGrant {
+    allowFqdns: string[];
+    allowCidrs: string[];
+}
+export declare function parseScopedNetworkEgressGrant(settings: unknown): ScopedNetworkEgressGrant;
+export declare function createScopedNetworkEgressPolicy(input: {
+    clients: KubeClients;
+    namespace: string;
+    mode: "standard" | "cilium";
+    runId: string;
+    workloadName: string;
+    ownerReference: Record<string, unknown>;
+    grant: ScopedNetworkEgressGrant;
+}): Promise<string | null>;
+export declare function createScopedNetworkEgressPolicyOrReleaseWorkload(input: Parameters<typeof createScopedNetworkEgressPolicy>[0], releaseWorkload: () => Promise<void>): Promise<string | null>;
+export declare function appendNetworkEgressDenyHint(stderr: string, grant: ScopedNetworkEgressGrant): string;
+//# sourceMappingURL=scoped-network-egress.d.ts.map

package/dist/scoped-network-egress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-network-egress.d.ts","sourceRoot":"","sources":["../src/scoped-network-egress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIpD,eAAO,MAAM,yBAAyB,6CAA6C,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,OAAO,GAAG,wBAAwB,CAgBzF;AAED,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAC3D,OAAO,EAAE,WAAW,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,KAAK,EAAE,wBAAwB,CAAC;CACjC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwCzB;AAED,wBAAsB,gDAAgD,CACpE,KAAK,EAAE,UAAU,CAAC,OAAO,+BAA+B,CAAC,CAAC,CAAC,CAAC,EAC5D,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcxB;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,GAAG,MAAM,CAOnG"}

package/dist/scoped-network-egress.js

@@ -0,0 +1,86 @@
+import { buildNetworkPolicyManifests } from "./network-policy.js";
+import { buildCiliumNetworkPolicyManifest } from "./cilium-network-policy.js";
+export const NETWORK_EGRESS_GRANT_PATH = "executionWorkspaceSettings.networkEgress";
+export function parseScopedNetworkEgressGrant(settings) {
+    if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
+        return { allowFqdns: [], allowCidrs: [] };
+    }
+    const networkEgress = settings.networkEgress;
+    if (!networkEgress || typeof networkEgress !== "object" || Array.isArray(networkEgress)) {
+        return { allowFqdns: [], allowCidrs: [] };
+    }
+    const record = networkEgress;
+    const strings = (value) => Array.isArray(value)
+        ? [...new Set(value.filter((item) => typeof item === "string").map((item) => item.trim()).filter(Boolean))]
+        : [];
+    return {
+        allowFqdns: strings(record.allowFqdns).map((fqdn) => fqdn.toLowerCase()),
+        allowCidrs: strings(record.allowCidrs),
+    };
+}
+export async function createScopedNetworkEgressPolicy(input) {
+    if (input.grant.allowFqdns.length === 0 && input.grant.allowCidrs.length === 0)
+        return null;
+    const suffix = "-egress";
+    const maxWorkloadLength = 253 - suffix.length;
+    const workloadName = input.workloadName.length <= maxWorkloadLength
+        ? input.workloadName
+        : `${input.workloadName.slice(0, maxWorkloadLength - 26)}-${input.workloadName.slice(-25)}`;
+    const name = `${workloadName}${suffix}`;
+    if (input.mode === "cilium") {
+        const manifest = buildCiliumNetworkPolicyManifest({
+            namespace: input.namespace,
+            paperclipServerNamespace: "",
+            egressAllowFqdns: input.grant.allowFqdns,
+            egressAllowCidrs: input.grant.allowCidrs,
+            name,
+            endpointSelector: { "paperclip.io/run-id": input.runId },
+            includeBaseRules: false,
+            ownerReferences: [input.ownerReference],
+        });
+        await input.clients.custom.createNamespacedCustomObject({
+            group: "cilium.io",
+            version: "v2",
+            namespace: input.namespace,
+            plural: "ciliumnetworkpolicies",
+            body: manifest,
+        });
+    }
+    else {
+        const [, manifest] = buildNetworkPolicyManifests({
+            namespace: input.namespace,
+            paperclipServerNamespace: "",
+            egressAllowFqdns: input.grant.allowFqdns,
+            egressAllowCidrs: input.grant.allowCidrs,
+            name,
+            podSelector: { "paperclip.io/run-id": input.runId },
+            includeBaseRules: false,
+            ownerReferences: [input.ownerReference],
+        });
+        await input.clients.networking.createNamespacedNetworkPolicy({ namespace: input.namespace, body: manifest });
+    }
+    return name;
+}
+export async function createScopedNetworkEgressPolicyOrReleaseWorkload(input, releaseWorkload) {
+    try {
+        return await createScopedNetworkEgressPolicy(input);
+    }
+    catch (policyError) {
+        try {
+            await releaseWorkload();
+        }
+        catch (releaseError) {
+            throw new AggregateError([policyError, releaseError], "Failed to create scoped network egress policy and release its workload");
+        }
+        throw policyError;
+    }
+}
+export function appendNetworkEgressDenyHint(stderr, grant) {
+    if (!/(could not resolve host|network is unreachable|connection timed out|failed to connect|temporary failure in name resolution)/i.test(stderr)) {
+        return stderr;
+    }
+    const allowed = [...grant.allowFqdns, ...grant.allowCidrs];
+    const detail = allowed.length > 0 ? ` Current task grant: ${allowed.join(", ")}.` : " No task-scoped destinations are granted.";
+    return `${stderr.trimEnd()}\nPaperclip network policy denied or could not route this request.${detail} Request access through ${NETWORK_EGRESS_GRANT_PATH}.\n`;
+}
+//# sourceMappingURL=scoped-network-egress.js.map

package/dist/scoped-network-egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-network-egress.js","sourceRoot":"","sources":["../src/scoped-network-egress.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAE9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,0CAA0C,CAAC;AAOpF,MAAM,UAAU,6BAA6B,CAAC,QAAiB;IAC7D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,aAAa,GAAI,QAAoC,CAAC,aAAa,CAAC;IAC1E,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,aAAwC,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtD,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3H,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACxE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAQrD;IACC,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,iBAAiB,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,IAAI,iBAAiB;QACjE,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9F,MAAM,IAAI,GAAG,GAAG,YAAY,GAAG,MAAM,EAAE,CAAC;IACxC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,gCAAgC,CAAC;YAChD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,wBAAwB,EAAE,EAAE;YAC5B,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YACxC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YACxC,IAAI;YACJ,gBAAgB,EAAE,EAAE,qBAAqB,EAAE,KAAK,CAAC,KAAK,EAAE;YACxD,gBAAgB,EAAE,KAAK;YACvB,eAAe,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAC;YACtD,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,uBAAuB;YAC/B,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,2BAA2B,CAAC;YAC/C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,wBAAwB,EAAE,EAAE;YAC5B,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YACxC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YACxC,IAAI;YACJ,WAAW,EAAE,EAAE,qBAAqB,EAAE,KAAK,CAAC,KAAK,EAAE;YACnD,gBAAgB,EAAE,KAAK;YACvB,eAAe,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gDAAgD,CACpE,KAA4D,EAC5D,eAAoC;IAEpC,IAAI,CAAC;QACH,OAAO,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,eAAe,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CACtB,CAAC,WAAW,EAAE,YAAY,CAAC,EAC3B,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,CAAC;IACpB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,KAA+B;IACzF,IAAI,CAAC,8HAA8H,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjJ,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,2CAA2C,CAAC;IAChI,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,qEAAqE,MAAM,2BAA2B,yBAAyB,KAAK,CAAC;AACjK,CAAC"}

package/dist/secret-manager.d.ts

@@ -0,0 +1,14 @@
+import type { KubeClients } from "./kube-client.js";
+export interface CreatePerRunSecretInput {
+    namespace: string;
+    secretName: string;
+    runId: string;
+    ownerKind: string;
+    ownerApiVersion: string;
+    ownerName: string;
+    ownerUid: string;
+    bootstrapToken: string;
+    adapterEnv: Record<string, string>;
+}
+export declare function createPerRunSecret(clients: KubeClients, input: CreatePerRunSecretInput): Promise<void>;
+//# sourceMappingURL=secret-manager.d.ts.map

package/dist/secret-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-manager.d.ts","sourceRoot":"","sources":["../src/secret-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqC5G"}

package/dist/secret-manager.js

@@ -0,0 +1,39 @@
+export async function createPerRunSecret(clients, input) {
+    if (!input.ownerUid) {
+        throw new Error("createPerRunSecret requires a non-empty ownerUid");
+    }
+    if ("BOOTSTRAP_TOKEN" in input.adapterEnv) {
+        throw new Error("adapterEnv must not contain BOOTSTRAP_TOKEN (reserved key)");
+    }
+    await clients.core.createNamespacedSecret({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "v1",
+            kind: "Secret",
+            type: "Opaque",
+            metadata: {
+                name: input.secretName,
+                namespace: input.namespace,
+                labels: {
+                    "paperclip.io/run-id": input.runId,
+                    "paperclip.io/managed-by": "paperclip-k8s-plugin",
+                },
+                ownerReferences: [
+                    {
+                        apiVersion: input.ownerApiVersion,
+                        kind: input.ownerKind,
+                        name: input.ownerName,
+                        uid: input.ownerUid,
+                        controller: true,
+                        blockOwnerDeletion: true,
+                    },
+                ],
+            },
+            stringData: {
+                BOOTSTRAP_TOKEN: input.bootstrapToken,
+                ...input.adapterEnv,
+            },
+        },
+    });
+}
+//# sourceMappingURL=secret-manager.js.map

package/dist/secret-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-manager.js","sourceRoot":"","sources":["../src/secret-manager.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAoB,EAAE,KAA8B;IAC3F,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,iBAAiB,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE;gBACR,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE;oBACN,qBAAqB,EAAE,KAAK,CAAC,KAAK;oBAClC,yBAAyB,EAAE,sBAAsB;iBAClD;gBACD,eAAe,EAAE;oBACf;wBACE,UAAU,EAAE,KAAK,CAAC,eAAe;wBACjC,IAAI,EAAE,KAAK,CAAC,SAAS;wBACrB,IAAI,EAAE,KAAK,CAAC,SAAS;wBACrB,GAAG,EAAE,KAAK,CAAC,QAAQ;wBACnB,UAAU,EAAE,IAAI;wBAChB,kBAAkB,EAAE,IAAI;qBACzB;iBACF;aACF;YACD,UAAU,EAAE;gBACV,eAAe,EAAE,KAAK,CAAC,cAAc;gBACrC,GAAG,KAAK,CAAC,UAAU;aACpB;SACF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/tenant-orchestrator.d.ts

@@ -0,0 +1,35 @@
+import type { KubeClients } from "./kube-client.js";
+export interface EnsureTenantInput {
+    namespace: string;
+    companyId: string;
+    paperclipServerNamespace: string;
+    serviceAccountAnnotations: Record<string, string>;
+    egressMode: "standard" | "cilium";
+    egressAllowFqdns: string[];
+    egressAllowCidrs: string[];
+    resourceQuota: {
+        pods: string;
+        requestsCpu: string;
+        requestsMemory: string;
+        limitsCpu: string;
+        limitsMemory: string;
+    };
+}
+/**
+ * Lazy, first-write-wins tenant provisioning. Each helper checks if the named
+ * resource exists and creates it only on 404; if it already exists, it is
+ * left as-is — config-driven values (quota limits, RBAC permissions, network
+ * policies, egress allow-list) are FROZEN at first provisioning time.
+ *
+ * V1 limitation: changing KubernetesProviderConfig after a tenant namespace
+ * is provisioned does NOT update the in-cluster resources. To apply config
+ * changes, an operator must delete the per-tenant resources manually (or
+ * the namespace itself). A future iteration should add strategic-merge
+ * reconciliation here.
+ *
+ * Particular gotcha: switching egressMode "standard" → "cilium" leaves the
+ * old paperclip-egress-allow NetworkPolicy in place alongside the new
+ * CiliumNetworkPolicy. Both apply; the effective egress is the intersection.
+ */
+export declare function ensureTenant(clients: KubeClients, input: EnsureTenantInput): Promise<void>;
+//# sourceMappingURL=tenant-orchestrator.d.ts.map

package/dist/tenant-orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-orchestrator.d.ts","sourceRoot":"","sources":["../src/tenant-orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIpD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB,EAAE,MAAM,CAAC;IACjC,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,UAAU,EAAE,UAAU,GAAG,QAAQ,CAAC;IAClC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhG"}

package/dist/tenant-orchestrator.js

@@ -0,0 +1,263 @@
+import { buildNetworkPolicyManifests } from "./network-policy.js";
+import { buildCiliumNetworkPolicyManifest } from "./cilium-network-policy.js";
+const SERVICE_ACCOUNT_NAME = "paperclip-tenant-sa";
+const ROLE_NAME = "paperclip-tenant-role";
+const ROLE_BINDING_NAME = "paperclip-tenant-rb";
+const RESOURCE_QUOTA_NAME = "paperclip-quota";
+const LIMIT_RANGE_NAME = "paperclip-limits";
+/**
+ * Lazy, first-write-wins tenant provisioning. Each helper checks if the named
+ * resource exists and creates it only on 404; if it already exists, it is
+ * left as-is — config-driven values (quota limits, RBAC permissions, network
+ * policies, egress allow-list) are FROZEN at first provisioning time.
+ *
+ * V1 limitation: changing KubernetesProviderConfig after a tenant namespace
+ * is provisioned does NOT update the in-cluster resources. To apply config
+ * changes, an operator must delete the per-tenant resources manually (or
+ * the namespace itself). A future iteration should add strategic-merge
+ * reconciliation here.
+ *
+ * Particular gotcha: switching egressMode "standard" → "cilium" leaves the
+ * old paperclip-egress-allow NetworkPolicy in place alongside the new
+ * CiliumNetworkPolicy. Both apply; the effective egress is the intersection.
+ */
+export async function ensureTenant(clients, input) {
+    await ensureNamespace(clients, input);
+    await ensureServiceAccount(clients, input);
+    await ensureRole(clients, input);
+    await ensureRoleBinding(clients, input);
+    await ensureResourceQuota(clients, input);
+    await ensureLimitRange(clients, input);
+    await ensureNetworkPolicies(clients, input);
+}
+async function ensureNamespace(clients, input) {
+    try {
+        await clients.core.readNamespace({ name: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.core.createNamespace({
+        body: {
+            apiVersion: "v1",
+            kind: "Namespace",
+            metadata: {
+                name: input.namespace,
+                labels: {
+                    "paperclip.io/company-id": input.companyId,
+                    "paperclip.io/managed-by": "paperclip-k8s-plugin",
+                    "pod-security.kubernetes.io/enforce": "restricted",
+                    "pod-security.kubernetes.io/audit": "restricted",
+                    "pod-security.kubernetes.io/warn": "restricted",
+                },
+            },
+        },
+    }));
+}
+async function ensureServiceAccount(clients, input) {
+    try {
+        await clients.core.readNamespacedServiceAccount({ name: SERVICE_ACCOUNT_NAME, namespace: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.core.createNamespacedServiceAccount({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "v1",
+            kind: "ServiceAccount",
+            metadata: {
+                name: SERVICE_ACCOUNT_NAME,
+                namespace: input.namespace,
+                annotations: input.serviceAccountAnnotations,
+                labels: { "paperclip.io/managed-by": "paperclip-k8s-plugin" },
+            },
+        },
+    }));
+}
+async function ensureRole(clients, input) {
+    try {
+        await clients.rbac.readNamespacedRole({ name: ROLE_NAME, namespace: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.rbac.createNamespacedRole({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "rbac.authorization.k8s.io/v1",
+            kind: "Role",
+            metadata: { name: ROLE_NAME, namespace: input.namespace },
+            rules: [
+                { apiGroups: [""], resources: ["pods/log"], verbs: ["get"] },
+            ],
+        },
+    }));
+}
+async function ensureRoleBinding(clients, input) {
+    try {
+        await clients.rbac.readNamespacedRoleBinding({ name: ROLE_BINDING_NAME, namespace: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.rbac.createNamespacedRoleBinding({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "rbac.authorization.k8s.io/v1",
+            kind: "RoleBinding",
+            metadata: { name: ROLE_BINDING_NAME, namespace: input.namespace },
+            roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: ROLE_NAME },
+            subjects: [{ kind: "ServiceAccount", name: SERVICE_ACCOUNT_NAME, namespace: input.namespace }],
+        },
+    }));
+}
+async function ensureResourceQuota(clients, input) {
+    try {
+        await clients.core.readNamespacedResourceQuota({ name: RESOURCE_QUOTA_NAME, namespace: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.core.createNamespacedResourceQuota({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "v1",
+            kind: "ResourceQuota",
+            metadata: { name: RESOURCE_QUOTA_NAME, namespace: input.namespace },
+            spec: {
+                hard: {
+                    pods: input.resourceQuota.pods,
+                    "requests.cpu": input.resourceQuota.requestsCpu,
+                    "requests.memory": input.resourceQuota.requestsMemory,
+                    "limits.cpu": input.resourceQuota.limitsCpu,
+                    "limits.memory": input.resourceQuota.limitsMemory,
+                },
+            },
+        },
+    }));
+}
+async function ensureLimitRange(clients, input) {
+    try {
+        await clients.core.readNamespacedLimitRange({ name: LIMIT_RANGE_NAME, namespace: input.namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.core.createNamespacedLimitRange({
+        namespace: input.namespace,
+        body: {
+            apiVersion: "v1",
+            kind: "LimitRange",
+            metadata: { name: LIMIT_RANGE_NAME, namespace: input.namespace },
+            spec: {
+                limits: [
+                    {
+                        type: "Container",
+                        max: { cpu: "4", memory: "8Gi" },
+                        min: { cpu: "100m", memory: "128Mi" },
+                        // The k8s client-node type names this `_default` but the actual
+                        // Kubernetes API field is `default`. We produce a JSON-shape
+                        // manifest so the cast is safe.
+                        default: { cpu: "1", memory: "2Gi" },
+                        defaultRequest: { cpu: "250m", memory: "512Mi" },
+                    },
+                ],
+            },
+        },
+    }));
+}
+async function ensureNetworkPolicies(clients, input) {
+    const [denyAll, egressStd] = buildNetworkPolicyManifests({
+        namespace: input.namespace,
+        paperclipServerNamespace: input.paperclipServerNamespace,
+        egressAllowCidrs: input.egressAllowCidrs,
+        egressAllowFqdns: input.egressAllowFqdns,
+    });
+    await ensureNetworkPolicy(clients, input.namespace, denyAll);
+    if (input.egressMode === "cilium") {
+        const cnp = buildCiliumNetworkPolicyManifest({
+            namespace: input.namespace,
+            paperclipServerNamespace: input.paperclipServerNamespace,
+            egressAllowFqdns: input.egressAllowFqdns,
+            egressAllowCidrs: input.egressAllowCidrs,
+        });
+        await ensureCiliumNetworkPolicy(clients, input.namespace, cnp);
+    }
+    else {
+        await ensureNetworkPolicy(clients, input.namespace, egressStd);
+    }
+}
+async function ensureNetworkPolicy(clients, namespace, manifest) {
+    const name = manifest.metadata.name;
+    try {
+        await clients.networking.readNamespacedNetworkPolicy({ name, namespace });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.networking.createNamespacedNetworkPolicy({ namespace, body: manifest }));
+}
+async function ensureCiliumNetworkPolicy(clients, namespace, manifest) {
+    const name = manifest.metadata.name;
+    try {
+        await clients.custom.getNamespacedCustomObject({
+            group: "cilium.io",
+            version: "v2",
+            namespace,
+            plural: "ciliumnetworkpolicies",
+            name,
+        });
+        return;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    await createIgnoringAlreadyExists(clients.custom.createNamespacedCustomObject({
+        group: "cilium.io",
+        version: "v2",
+        namespace,
+        plural: "ciliumnetworkpolicies",
+        body: manifest,
+    }));
+}
+function isNotFound(err) {
+    if (typeof err !== "object" || err === null)
+        return false;
+    const e = err;
+    return e.code === 404 || e.statusCode === 404;
+}
+function isAlreadyExists(err) {
+    if (typeof err !== "object" || err === null)
+        return false;
+    const e = err;
+    return e.code === 409 || e.statusCode === 409;
+}
+// Two concurrent lease acquisitions for a brand-new tenant can both observe
+// the 404 read and race the create; a 409 AlreadyExists from the loser means
+// the desired state already exists, which is exactly what ensure* wants.
+async function createIgnoringAlreadyExists(create) {
+    try {
+        await create;
+    }
+    catch (err) {
+        if (!isAlreadyExists(err))
+            throw err;
+    }
+}
+//# sourceMappingURL=tenant-orchestrator.js.map

package/dist/tenant-orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-orchestrator.js","sourceRoot":"","sources":["../src/tenant-orchestrator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAmB9E,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AACnD,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAC1C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAChD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAoB,EAAE,KAAwB;IAC/E,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAoB,EAAE,KAAwB;IAC3E,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;QACzB,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE;gBACR,IAAI,EAAE,KAAK,CAAC,SAAS;gBACrB,MAAM,EAAE;oBACN,yBAAyB,EAAE,KAAK,CAAC,SAAS;oBAC1C,yBAAyB,EAAE,sBAAsB;oBACjD,oCAAoC,EAAE,YAAY;oBAClD,kCAAkC,EAAE,YAAY;oBAChD,iCAAiC,EAAE,YAAY;iBAChD;aACF;SACF;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAAoB,EAAE,KAAwB;IAChF,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5G,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE;gBACR,IAAI,EAAE,oBAAoB;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,KAAK,CAAC,yBAAyB;gBAC5C,MAAM,EAAE,EAAE,yBAAyB,EAAE,sBAAsB,EAAE;aAC9D;SACF;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAoB,EAAE,KAAwB;IACtE,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,8BAA8B;YAC1C,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YACzD,KAAK,EAAE;gBACL,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;aAC7D;SACF;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAoB,EAAE,KAAwB;IAC7E,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACtG,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,8BAA8B;YAC1C,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YACjE,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACjF,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SAC/F;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAoB,EAAE,KAAwB;IAC/E,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1G,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YACnE,IAAI,EAAE;gBACJ,IAAI,EAAE;oBACJ,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI;oBAC9B,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW;oBAC/C,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc;oBACrD,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,SAAS;oBAC3C,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY;iBAClD;aACF;SACF;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAoB,EAAE,KAAwB;IAC5E,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACpG,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YAChE,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,WAAW;wBACjB,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;wBAChC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;wBACrC,gEAAgE;wBAChE,6DAA6D;wBAC7D,gCAAgC;wBAChC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;wBACpC,cAAc,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;qBACjD;iBACF;aACF;SACO;KACX,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAoB,EAAE,KAAwB;IACjF,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,2BAA2B,CAAC;QACvD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IAEH,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,gCAAgC,CAAC;YAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,CAAC;QACH,MAAM,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAoB,EACpB,SAAiB,EACjB,QAAiC;IAEjC,MAAM,IAAI,GAAI,QAAQ,CAAC,QAA6B,CAAC,IAAI,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CACzF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,OAAoB,EACpB,SAAiB,EACjB,QAAiC;IAEjC,MAAM,IAAI,GAAI,QAAQ,CAAC,QAA6B,CAAC,IAAI,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC;YAC7C,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,IAAI;YACb,SAAS;YACT,MAAM,EAAE,uBAAuB;YAC/B,IAAI;SACL,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,MAAM,2BAA2B,CAC/B,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAC;QACxC,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,IAAI;QACb,SAAS;QACT,MAAM,EAAE,uBAAuB;QAC/B,IAAI,EAAE,QAAQ;KACf,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,GAA6C,CAAC;IACxD,OAAO,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,GAA6C,CAAC;IACxD,OAAO,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC;AAChD,CAAC;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,KAAK,UAAU,2BAA2B,CAAC,MAAwB;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IACvC,CAAC;AACH,CAAC"}