Feature: Wasi Context Configuration (#6)

* feat: WASI context configuration support

- CRD: args, env, volumes, resources, network spec
- Controller: serialize config to WASI_CONFIG env var
- Runner: modular Rust code, dynamic WasiCtx builder
- Resource limits: memory (StoreLimits), CPU (fuel)
- Network: granular TCP/UDP socket permissions

* Add http-fetch WASM module

Demonstrates TCP connect and outbound HTTP capabilities. Extracts target URL from header/query param, makes outbound request, returns JSON response.

* feat: e2e tests for WASI configuration

- Test infrastructure with registry safety checks
- Basic deployment test with reverse-text module
- Network permission tests with http-fetch module
- Echo server fixture for in-cluster testing
- Goyek e2e task integration

* fix: reconciler Ready condition & e2e fixes

- Check Knative Service Ready before marking WasmModule ready
- Strip oci:// prefix in runner image fetcher
- Fix http-fetch body reading with subscribe/block pattern
- Bind runner to 0.0.0.0 for readiness probes
- Add LOCAL_GATEWAY_ADDRESS for Kind port-forward access
- Add e2e runner script and test infrastructure
- Update build tasks to support http-fetch module
- Set runner image via ldflags in ko deploy

* fix: configure No DNS mode for all local clusters

- Extended domain configuration to minikube, not just Kind
- Removed dead isKindCluster function from helpers.go
- Added E2E_IMAGE_BASENAME to .env for convenience
- All e2e tests now pass on both Kind and minikube

* feat(e2e,runner): Enhance network policies and improve test reliability

This commit introduces significant improvements to the Wasm runner's network sandboxing capabilities and the overall reliability of the end-to-end test suite, particularly for cloud environments like GKE.

### Runner: Hostname-Based Network Policies

The Wasm runner's network permission checker has been enhanced to support hostname patterns in addition to IP addresses.

-   Previously, network policies could only match against specific IP addresses, which is impractical in dynamic environments like Kubernetes.
-   The runner now resolves all configured hostname patterns (e.g., `echo-server.default.svc.cluster.local:80`) at startup and checks socket connections against the resolved IPs.
-   This allows Wasm modules to use standard networking libraries (like Rust's `std::net::TcpStream`) to connect to Kubernetes services by name, a critical feature for real-world use cases.
-   The `http-fetch` example module has been updated to use `std::net::TcpStream` to demonstrate and test this new capability.

### E2E Test Reliability

Several changes have been made to make the e2e tests more robust and less prone to flakiness, especially when running on non-local clusters:

-   **Wait for LoadBalancer:** The test framework now waits up to 2 minutes for the ingress gateway's LoadBalancer service to receive an external IP address, a common source of failures on GKE.
-   **Retry on 404:** HTTP requests to Wasm modules now automatically retry on 404 errors for a few seconds. This handles the propagation delay before the ingress controller is fully configured to route traffic to a newly created Knative service.
-   **Full FQDNs:** Tests now use the full FQDN for in-cluster services (e.g., `.svc.cluster.local`) to ensure consistent DNS resolution across different Kubernetes distributions.
-   **ImagePullPolicy=Always:** During e2e tests, the controller is now deployed with `ImagePullPolicy=Always` for the runner image. This guarantees that the latest image built in CI is used, preventing issues with stale cached images.
-   **Consistent "No DNS" Config:** The Knative "No DNS" configuration (`example.com`) is now applied unconditionally, simplifying the setup and ensuring consistent behavior between local and cloud test runs.

### Build Process

-   The build process now generates a temporary `.ko.yaml` file to set linker flags (`ldflags`) instead of using `GOFLAGS`. This is necessary to support setting multiple `-X` flags, as required for the `ImagePullPolicy` configuration.

* chore: Update copyright headers for 2025

This commit updates the copyright year to 2025 in existing file headers.

It also adds the standard Apache 2.0 license header to several Rust source files
that were missing it.

* fix(e2e): improve test reliability across environments

- Add echo server readiness probe
- Add warmup pod for service networking verification
- Reduce warmup curl retry interval to 0.25s for faster detection
- Add port-forward readiness check with timeout (120s)
- Fix minikube cluster detection using node labels
- Add configurable test timeout via E2E_TEST_TIMEOUT env
- Add batch mode detection for CI/non-interactive runs
- Update knative.dev/hack dependency

Tested on: GKE, kind, minikube (5/5 tests pass)

* fix: resolve CI failures and dependency conflicts

1. Fix e2e test side effects (build test failure):
   - Renamed test/e2e/main_test.go -> test/e2e/clients.go
   - Removed TestMain that executed cluster connections during build verification
   - Made client initialization lazy via ensureClients()
   - Clients now initialize only when first test runs

   This fixes 'go test -run "^$" -tags e2e' failing with:
   'Failed to initialize clients: failed to load kubeconfig'

2. Fix google.golang.org/genproto conflict (verify deps failure):
   - Upgraded github.com/cardil/ghet v0.1.1 -> v0.1.2
   - Upgraded k8s.io/* packages v0.34.3 -> v0.35.1
   - Resolved ambiguous import between old monolithic genproto and new split modules

   ghet v0.1.2 no longer pulls in old genproto@v0.0.0-20200212174721-66ed5ce911ce
   via go4.org -> cloud.google.com/go@v0.53.0 dependency chain.

Assisted-by: 🤖 Claude Opus/Sonnet 4.5

* Update generated code and dependencies

* Add e2e tests workflow with Kind cluster

- Set up Kind cluster for e2e testing
- Configure local registry at localhost:5001
- Run goyek e2e tests with proper environment
- Upload artifacts on failure for debugging

* Fix E2E workflow: upgrade to K8s v1.35.1 and fix registry setup

- Use kindest/node:v1.35.1 (Knative requires K8s >= 1.33)
- Set up registry before cluster creation
- Configure containerd to use kind-registry:5000 endpoint
- Connect registry to Kind network after cluster creation
- Add insecure_skip_verify for registry TLS

* Fix goyek scripts to fail early on command errors

Add ExecOrDie helper that wraps cmd.Exec and calls a.FailNow() on failure.
Replace all cmd.Exec calls with executil.ExecOrDie to ensure build/push
errors are properly propagated and cause immediate task failure.

This fixes the issue where push errors to the registry were logged but
didn't stop the e2e test execution, leading to confusing failures later.

* fix: Use correct WKG_OCI_INSECURE env var

Change WKG_REGISTRY_INSECURE to WKG_OCI_INSECURE with the registry
address as the value. This matches the wkg --insecure flag format.

* fix: Use GitHub Container Registry for E2E tests

Instead of a local registry, use ghcr.io with PR-specific image tags.
This avoids the localhost registry connectivity issues from within
Kind cluster pods. Images are pushed to:
ghcr.io/cardil/knative-serving-wasm/e2e-pr-<number>/<component>

Cleanup step deletes all PR-specific packages after tests complete.

* fix: Add packages:write permission for ghcr.io push

The E2E workflow needs packages:write permission to push images
to GitHub Container Registry.

* fix: Address AI review comments

- Fix ghcr.io cleanup step with proper error handling and URL encoding
- Fix http-fetch unwrap() panic on partial HTTP response
- Fix double error reporting for empty image in validation
- Fix address pattern validation to require colon separator
- Add fallback to run_id for push events in e2e workflow

* fix: Use GetGroupVersionKind, retry on 502/503, case-insensitive error check

- Use module.GetGroupVersionKind() instead of hardcoded GVK
- Remove unused runtime/schema import
- Retry HTTP requests on 502 and 503 in addition to 404
- Use case-insensitive error/denied check in network tests

* fix: Use here-string to avoid subshell in cleanup loop

The pipe to while loop runs in subshell, so FAILED=1 never propagates.
Use here-string (<<<) instead to run loop in current shell.

* fix: Use actual mount paths for volume mounts, not hardcoded paths

The runner sees volumes at vm.MountPath where Kubernetes mounts them,
not at hardcoded /var/run/* locations which don't exist.

Also fixes SubPath handling - applies to hostPath, not guestPath.

* fix: remove incorrect subPath handling in volume mount

With K8s subPath, the subdirectory content is already mounted
at vm.MountPath, so hostPath should be vm.MountPath directly.

* chore: add timeout-minutes to e2e workflow

* Enhance address pattern validation

- Split pattern on ':' and validate non-empty host/port
- Validate port is '*' or numeric
- Validate host is '*' or valid hostname/IP
- Add strconv and net imports

Author: cardil

.env

@@ -1 +1,2 @@
 IMAGE_BASENAME=ghcr.io/cardil/knative-serving-wasm
+E2E_IMAGE_BASENAME=quay.io/cardil/knative/serving/wasm/test

.github/workflows/e2e-kind.yaml

@@ -0,0 +1,114 @@
+# Copyright 2025 The Knative Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+name: E2E Tests on Kind
+
+on:
+  push:
+    branches: [ 'main', 'release-*' ]
+
+  pull_request:
+    branches: [ 'main', 'release-*' ]
+
+jobs:
+  e2e-kind:
+    name: E2E Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version-file: 'go.mod'
+        cache: true
+
+    - name: Set up Rust
+      uses: actions-rust-lang/setup-rust-toolchain@v1
+      with:
+        toolchain: stable
+        target: wasm32-wasip2
+
+    - name: Log in to GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Create Kind cluster
+      uses: helm/kind-action@v1
+      with:
+        cluster_name: knative-wasm-e2e
+        node_image: kindest/node:v1.34.0
+        wait: 120s
+
+    - name: Verify cluster
+      run: |
+        kubectl cluster-info
+        kubectl get nodes
+
+    - name: Run e2e tests
+      run: ./goyek --verbose e2e
+      env:
+        E2E_IMAGE_BASENAME: ghcr.io/${{ github.repository }}/e2e-${{ github.event.pull_request.number || github.run_id }}
+        ARTIFACTS: ${{ github.workspace }}/artifacts
+
+    - name: Delete e2e images from ghcr.io
+      if: always() && github.event_name == 'pull_request'
+      continue-on-error: true
+      run: |
+        set -o pipefail
+        
+        # Delete all PR-specific images to avoid accumulation
+        # Package names are like: knative-serving-wasm/e2e-6/runner
+        RUN_ID=${{ github.event.pull_request.number || github.run_id }}
+        PATTERN="e2e-${RUN_ID}"
+        FAILED=0
+        
+        echo "Deleting packages containing: ${PATTERN}"
+        
+        # List packages matching the PR pattern and delete them
+        # Package names contain slashes, so we need URL-encoding for the delete API
+        PACKAGES=$(gh api "/user/packages?package_type=container" --jq ".[] | select(.name | contains(\"${PATTERN}\")) | .name" 2>&1) || {
+          echo "::warning::Failed to list packages: ${PACKAGES}"
+          exit 1
+        }
+        
+        if [ -z "$PACKAGES" ]; then
+          echo "No packages found matching pattern: ${PATTERN}"
+          exit 0
+        fi
+        
+        while read -r package_name; do
+          # URL-encode the package name (slashes become %2F)
+          encoded_name=$(printf '%s' "$package_name" | jq -sRr @uri)
+          echo "Deleting package: ${package_name}"
+          if ! gh api --method DELETE "/user/packages/container/${encoded_name}" 2>&1; then
+            echo "::warning::Failed to delete package: ${package_name}"
+            FAILED=1
+          fi
+        done <<< "$PACKAGES"
+        
+        if [ "$FAILED" -eq 1 ]; then
+          echo "::warning::Some packages failed to delete"
+          exit 1
+        fi
+        
+        echo "Cleanup complete"
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Upload artifacts on failure
+      if: failure()
+      uses: actions/upload-artifact@v4
+      with:
+        name: e2e-test-artifacts
+        path: ${{ github.workspace }}/artifacts
+        retention-days: 7

.gitignore

@@ -11,3 +11,7 @@ bazel-*
 *.out
 
 build/resources/
+
+# AI
+.ai/
+AGENTS.md

build/boot/main.go

@@ -2,15 +2,30 @@ package boot
 
 import (
 	"fmt"
+	"os"
 	"strings"
 	"time"
 
 	"github.com/goyek/goyek/v2"
 	"github.com/goyek/goyek/v2/middleware"
 	"github.com/goyek/x/color"
 	flag "github.com/spf13/pflag"
+	"golang.org/x/term"
 )
 
+// isBatchMode detects if running in batch mode (no terminal on stdin or CI environment)
+func isBatchMode() bool {
+	// Check common CI environment variables
+	ciVars := []string{"CI", "CONTINUOUS_INTEGRATION", "BUILD_NUMBER", "GITHUB_ACTIONS", "GITLAB_CI", "CIRCLECI"}
+	for _, v := range ciVars {
+		if os.Getenv(v) != "" {
+			return true
+		}
+	}
+	// Check if stdin is not a terminal
+	return !term.IsTerminal(int(os.Stdin.Fd()))
+}
+
 // Params are reusable flags used by the build pipeline.
 type Params struct {
 	V       bool
@@ -29,6 +44,7 @@ type Option func(*Params)
 func Main(opts ...Option) {
 	p := Params{
 		LongRun: time.Minute,
+		V:       isBatchMode(),
 	}
 	for _, opt := range opts {
 		opt(&p)

build/go.mod

@@ -1,111 +1,115 @@
 module github.com/cardil/knative-serving-wasm/build
 
-go 1.24.0
+go 1.25.0
 
 require (
-	github.com/cardil/ghet v0.1.1
+	github.com/cardil/ghet v0.1.2
 	github.com/cardil/knative-serving-wasm v0.0.0
 	github.com/goyek/goyek/v2 v2.3.0
 	github.com/goyek/x v0.3.0
 	github.com/joho/godotenv v1.5.1
-	github.com/spf13/pflag v1.0.6
+	github.com/spf13/pflag v1.0.10
+	go.yaml.in/yaml/v2 v2.4.3
+	golang.org/x/term v0.40.0
 )
 
 replace github.com/cardil/knative-serving-wasm => ..
 
 require (
-	dario.cat/mergo v1.0.0 // indirect
+	dario.cat/mergo v1.0.2 // indirect
 	emperror.dev/errors v0.8.1 // indirect
 	github.com/1set/gut v0.0.0-20201117175203-a82363231997 // indirect
-	github.com/andybalholm/brotli v1.1.0 // indirect
+	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/blendle/zapdriver v1.3.1 // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
-	github.com/bodgit/sevenzip v1.5.0 // indirect
+	github.com/bodgit/sevenzip v1.6.1 // indirect
 	github.com/bodgit/windows v1.0.1 // indirect
-	github.com/charmbracelet/bubbles v0.18.0 // indirect
-	github.com/charmbracelet/bubbletea v0.25.0 // indirect
+	github.com/charmbracelet/bubbles v1.0.0 // indirect
+	github.com/charmbracelet/bubbletea v1.3.10 // indirect
+	github.com/charmbracelet/colorprofile v0.4.1 // indirect
 	github.com/charmbracelet/harmonica v0.2.0 // indirect
-	github.com/charmbracelet/lipgloss v0.10.0 // indirect
-	github.com/containerd/console v1.0.4 // indirect
+	github.com/charmbracelet/lipgloss v1.1.0 // indirect
+	github.com/charmbracelet/x/ansi v0.11.6 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
+	github.com/charmbracelet/x/term v0.2.2 // indirect
+	github.com/clipperhouse/displaywidth v0.10.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.6.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
-	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
+	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/erikgeiser/promptkit v0.9.0 // indirect
 	github.com/fatih/color v1.18.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/golang/snappy v1.0.0 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-github/v48 v48.2.0 // indirect
-	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/gookit/color v1.5.4 // indirect
-	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/gookit/color v1.6.0 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kirsle/configdir v0.0.0-20170128060238-e45d2f54772f // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/compress v1.18.4 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
-	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
-	github.com/mattn/go-runewidth v0.0.15 // indirect
+	github.com/mattn/go-runewidth v0.0.19 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
 	github.com/mholt/archiver/v4 v4.0.0-alpha.8 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/reflow v0.3.0 // indirect
-	github.com/muesli/termenv v0.15.2 // indirect
+	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nwaples/rardecode/v2 v2.0.0-beta.2 // indirect
-	github.com/pierrec/lz4/v4 v4.1.21 // indirect
+	github.com/nwaples/rardecode/v2 v2.2.2 // indirect
+	github.com/pierrec/lz4/v4 v4.1.25 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/stretchr/testify v1.10.0 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/stretchr/testify v1.11.1 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
-	github.com/u-root/u-root v0.14.0 // indirect
-	github.com/ulikunitz/xz v0.5.11 // indirect
+	github.com/u-root/u-root v0.15.0 // indirect
+	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/crypto v0.39.0 // indirect
-	golang.org/x/net v0.41.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/term v0.32.0 // indirect
-	golang.org/x/text v0.26.0 // indirect
-	golang.org/x/time v0.10.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	go.uber.org/zap v1.27.1 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
+	golang.org/x/crypto v0.48.0 // indirect
+	golang.org/x/net v0.50.0 // indirect
+	golang.org/x/oauth2 v0.35.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.33.1 // indirect
-	k8s.io/apimachinery v0.33.1 // indirect
-	k8s.io/client-go v0.33.1 // indirect
+	k8s.io/api v0.35.1 // indirect
+	k8s.io/apimachinery v0.35.1 // indirect
+	k8s.io/client-go v0.35.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
-	k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
-	knative.dev/client/pkg v0.0.0-20241128155143-441372aea16b // indirect
-	knative.dev/pkg v0.0.0-20250627014006-8481e7eef7f6 // indirect
-	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 // indirect
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
+	knative.dev/client/pkg v0.0.0-20260211022759-a1b5e747289f // indirect
+	knative.dev/pkg v0.0.0-20260210181456-ba7fd23eb13c // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.5.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )