@telorun/k8s-runner 0.10.2 → 0.11.0

package/dist/k8s/pod-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pod-status.js","sourceRoot":"","sources":["../../src/k8s/pod-status.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AAEH,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,OAAQ,GAAyB,EAAE,MAAM,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,OAAO,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;AAC/B,CAAC;AAED;sFACsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;KACpC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB;YACtB,OAAO,oBAAoB,CAAC;QAC9B,KAAK,iBAAiB;YACpB,OAAO,wBAAwB,CAAC;QAClC,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,WAAoB;IAC/D,IAAI,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;IACxF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC;IACvE,OAAO,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,MAAM,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACzC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmC;IAChE,MAAM,MAAM,GAAqD;QAC/D,CAAC,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,CAAC;QACjD,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,CAAC;KACzC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,KAAK,MAAM,EAAE,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACvF,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAmC;IAChE,MAAM,IAAI,GAAG,KAAK,EAAE,UAAU,CAAC;IAC/B,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,WAAW,MAAM,cAAc,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;IAC/B,IAAI,OAAO,EAAE,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,YAAY,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAC/E,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO,MAAM,KAAK,iBAAiB,IAAI,MAAM,KAAK,mBAAmB,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,EAAU,EAAE,IAAY;IACxE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAY;IAChC,MAAM,CAAC,GAAG,GAAiF,CAAC;IAC5F,OAAO,CAAC,EAAE,UAAU,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,KAAK,GAAG,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,GAAY;IAC9B,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/k8s/watch-session.d.ts

@@ -0,0 +1,19 @@
+import type { BackendSession, BackendStartSpec } from "@telorun/runner-core";
+import type { K8sRunnerConfig } from "../config.js";
+import type { KubeClient } from "./client.js";
+export interface WatchSessionDeps {
+    kube: KubeClient;
+    config: K8sRunnerConfig;
+}
+/**
+ * A watch session: one pod, one workspace volume, one container per running
+ * application, and the session outliving every run inside it.
+ *
+ * What it does NOT do is as load-bearing as what it does: it never builds an
+ * image. The build path exists to put a dependency closure on disk before boot;
+ * a watch session resolves its own into a per-app cache directory that lives as
+ * long as the pod, so the download happens once per app per session and every
+ * later reload resolves from local disk.
+ */
+export declare function startWatchSession(deps: WatchSessionDeps, spec: BackendStartSpec): Promise<BackendSession>;
+//# sourceMappingURL=watch-session.d.ts.map

package/dist/k8s/watch-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch-session.d.ts","sourceRoot":"","sources":["../../src/k8s/watch-session.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,cAAc,EACd,gBAAgB,EAKjB,MAAM,sBAAsB,CAAC;AAW9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAsB9C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,cAAc,CAAC,CA8iBzB"}

package/dist/k8s/watch-session.js

@@ -0,0 +1,565 @@
+import { PassThrough, Writable } from "node:stream";
+import { portKey, portsResolvedFrom, relayDebugStream, SessionStartError, watchReachability, workspaceMarkerWrite, WorkspaceClient, } from "@telorun/runner-core";
+import { clampLimits } from "../limits.js";
+import { buildSessionIngress, buildSessionService, endpointsFor } from "./ingress.js";
+import { buildWatchPod, inspectPortFor, WORKSPACE_PORT } from "./pod-spec.js";
+import { deletePod, is404, msg, podPhase, podStatus, provisionMessage } from "./pod-status.js";
+import { ensureWorkspaceConfigMap } from "./workspace-configmap.js";
+/** How long the pod may take to reach Running before the start is abandoned.
+ *  `activeDeadlineSeconds` only bounds an already-running pod. */
+const START_DEADLINE_MS = 180_000;
+const WATCH_REARM_DELAY_MS = 2_000;
+/** How long to wait for the workspace container's HTTP surface to answer before
+ *  giving up on the seed. It is a kernel boot plus a module resolve, so it is
+ *  slower than the pod reaching Running. */
+const WORKSPACE_READY_TIMEOUT_MS = 120_000;
+const WORKSPACE_POLL_MS = 500;
+const RESIZE_CHANNEL = 4;
+/**
+ * A watch session: one pod, one workspace volume, one container per running
+ * application, and the session outliving every run inside it.
+ *
+ * What it does NOT do is as load-bearing as what it does: it never builds an
+ * image. The build path exists to put a dependency closure on disk before boot;
+ * a watch session resolves its own into a per-app cache directory that lives as
+ * long as the pod, so the download happens once per app per session and every
+ * later reload resolves from local disk.
+ */
+export async function startWatchSession(deps, spec) {
+    const { kube, config } = deps;
+    const ns = config.sessionNamespace;
+    const limits = clampLimits(config.appLimits, undefined);
+    let apps = spec.apps;
+    let podName = freshPodName(spec.sessionId);
+    let userStopped = false;
+    const workspaceAppConfigMap = await ensureWorkspaceConfigMap(kube, config);
+    let runtime = null;
+    let resolveDone;
+    const done = new Promise((r) => (resolveDone = r));
+    let settled = false;
+    const settle = (status) => {
+        if (settled)
+            return;
+        settled = true;
+        spec.onStatus(status);
+        resolveDone();
+    };
+    async function bringUp(seed) {
+        const pod = buildWatchPod({
+            config,
+            sessionId: spec.sessionId,
+            podName,
+            env: spec.env,
+            apps,
+            agent: spec.agent,
+            limits,
+            image: spec.config.image || config.defaultImage,
+            pullPolicy: spec.config.pullPolicy,
+            workspaceAppConfigMap,
+        });
+        let created;
+        try {
+            created = await kube.core.createNamespacedPod({ namespace: ns, body: pod });
+        }
+        catch (err) {
+            throw new SessionStartError("start_failed", "create", `failed to create pod: ${msg(err)}`, msg(err));
+        }
+        const abort = new AbortController();
+        const ip = await waitForRunning(podName, abort);
+        const workspace = new WorkspaceClient(`http://${ip}:${WORKSPACE_PORT}`);
+        await waitForWorkspace(workspace, abort.signal);
+        // The bundle reaches the volume through the SAME surface every later write
+        // takes — which is what lets the body-fetch init container and the tokenized
+        // tarball go away. App containers wait for their entry manifest to exist, so
+        // none of them has failed a load in the meantime.
+        if (seed) {
+            await workspace.apply({
+                write: [
+                    ...spec.bundle.files.map((f) => ({
+                        path: f.relativePath,
+                        content: f.contents,
+                        encoding: f.encoding ?? "utf8",
+                    })),
+                    // The workspace-root marker, so every app in this session anchors its
+                    // module cache at ONE place instead of one per entry directory.
+                    ...workspaceMarkerWrite(spec.bundle),
+                ],
+            });
+        }
+        endedApps.clear();
+        runtime = {
+            name: podName,
+            uid: created.metadata?.uid ?? "",
+            ip,
+            workspace,
+            sockets: new Map(),
+            stdins: new Map(),
+            abort,
+            stopWatch: () => { },
+        };
+        await attachApps(runtime);
+        await publishEndpoints(runtime, apps);
+        relayDebug(runtime);
+        watchPorts(runtime);
+        armPodWatch(runtime);
+        spec.onStatus({
+            kind: "running",
+            endpoints: endpointsFor(config, spec.sessionId, allPorts(apps)),
+        });
+    }
+    /** Resolve once the pod is Running, streaming provisioning messages meanwhile.
+     *  Rejects with the pod's own failure detail rather than a timeout when the
+     *  pod itself failed — the two send a reader to different places. */
+    async function waitForRunning(name, abort) {
+        let lastProvision;
+        const deadline = Date.now() + START_DEADLINE_MS;
+        for (;;) {
+            if (abort.signal.aborted)
+                throw new Error("session stopped while the pod was coming up");
+            let current;
+            try {
+                current = await kube.core.readNamespacedPod({ name, namespace: ns });
+            }
+            catch (err) {
+                if (is404(err))
+                    throw new Error("pod disappeared before reaching Running");
+                throw err;
+            }
+            const phase = podPhase(current);
+            if (phase === "Running") {
+                const ip = podStatus(current)?.podIP;
+                if (ip)
+                    return ip;
+            }
+            else if (phase === "Failed" || phase === "Succeeded") {
+                throw new Error(`pod reached ${phase} before serving`);
+            }
+            else {
+                const provision = provisionMessage(current);
+                if (provision && provision !== lastProvision) {
+                    lastProvision = provision;
+                    spec.onProgress("provision", provision);
+                }
+            }
+            if (Date.now() > deadline) {
+                throw new Error("pod did not reach Running within the start deadline");
+            }
+            await sleep(WORKSPACE_POLL_MS, abort.signal);
+        }
+    }
+    /** The workspace container is a kernel boot plus a module resolve, so being
+     *  Running is not being ready. Every write — the seed above all — depends on
+     *  it, so this waits rather than letting the first write fail. */
+    async function waitForWorkspace(client, signal) {
+        const deadline = Date.now() + WORKSPACE_READY_TIMEOUT_MS;
+        spec.onProgress("boot", "Starting workspace");
+        let lastError = "no response";
+        for (;;) {
+            if (signal.aborted)
+                throw new Error("session stopped while the workspace was coming up");
+            try {
+                await client.tree();
+                return;
+            }
+            catch (err) {
+                lastError = msg(err);
+            }
+            if (Date.now() > deadline) {
+                throw new SessionStartError("start_failed", "start", `workspace container did not become ready: ${lastError}`, lastError);
+            }
+            await sleep(WORKSPACE_POLL_MS, signal);
+        }
+    }
+    /** One attach per app container: each has its own terminal, so the byte
+     *  channel is keyed `(session, app)` rather than labelled on a merged stream. */
+    async function attachApps(rt) {
+        for (const app of apps) {
+            const stdin = new PassThrough();
+            const stdout = new Writable({
+                write(chunk, encoding, cb) {
+                    if (chunk?.byteLength)
+                        spec.onOutput(app.name, Buffer.from(chunk), tagFor(app, "stdout"));
+                    cb();
+                },
+            });
+            // Under `io: "streams"` the kubernetes attach subresource gives separate
+            // stdout and stderr channels — the demux is already there, and a TTY is
+            // what collapses it. So the split is real, not a label.
+            const stderr = app.io === "streams"
+                ? new Writable({
+                    write(chunk, encoding, cb) {
+                        if (chunk?.byteLength)
+                            spec.onOutput(app.name, Buffer.from(chunk), "stderr");
+                        cb();
+                    },
+                })
+                : null;
+            try {
+                const ws = await kube.attach.attach(ns, rt.name, `app-${app.name}`, stdout, stderr, stdin, app.io === "tty");
+                rt.sockets.set(app.name, ws);
+                rt.stdins.set(app.name, stdin);
+            }
+            catch (err) {
+                // A degraded terminal is not a failed session — status, run events and
+                // the workspace all still work — so it is reported on that app's own
+                // channel rather than aborting the start.
+                spec.onOutput(app.name, Buffer.from(`\r\n[runner] failed to attach: ${msg(err)}\r\n`), tagFor(app, "stderr"));
+            }
+        }
+    }
+    function relayDebug(rt) {
+        apps.forEach((app, index) => {
+            void relayDebugStream({
+                url: `http://${rt.ip}:${inspectPortFor(index)}/events`,
+                onFrame: (frame) => {
+                    void applyPortsResolved(app.name, frame);
+                    spec.onDebug(app.name, frame);
+                },
+                signal: rt.abort.signal,
+            });
+        });
+    }
+    /**
+     * Re-route an app whose declared port set changed on reload.
+     *
+     * The kernel re-resolves its `ports:` block on every load and says so on the
+     * stream the runner is already reading, so nothing here parses a manifest —
+     * which matters, because a manifest the runner could not parse would otherwise
+     * have to leave routing alone and report, on the hot path of every save.
+     *
+     * A pod's `containerPort` list is documentation; the Service and the Ingress
+     * are what make a port reachable, so this needs no pod recreate.
+     */
+    async function applyPortsResolved(appName, frame) {
+        const declared = portsResolvedFrom(frame);
+        if (!declared)
+            return;
+        const rt = runtime;
+        const app = apps.find((a) => a.name === appName);
+        if (!rt || !app)
+            return;
+        const before = new Map(app.ports.map((p) => [portKey(p), p]));
+        const after = new Map(declared.map((p) => [portKey(p), p]));
+        const added = declared.filter((p) => !before.has(portKey(p)));
+        const removed = app.ports.filter((p) => !after.has(portKey(p)));
+        if (added.length === 0 && removed.length === 0)
+            return;
+        // A port another app in this session already owns cannot be routed: session
+        // hosts are `<port>-<sessionId>`, a single label carrying no app name. It is
+        // reported against the app that asked for it, never dropped.
+        const taken = new Set(apps.filter((a) => a.name !== appName).flatMap((a) => a.ports.map(portKey)));
+        const rejected = added.filter((p) => taken.has(portKey(p)));
+        const accepted = added.filter((p) => !taken.has(portKey(p)));
+        app.ports = [...app.ports.filter((p) => after.has(portKey(p))), ...accepted];
+        try {
+            await publishEndpoints(rt, apps);
+        }
+        catch (err) {
+            spec.onEndpoints(appName, {
+                rejected: accepted.map((p) => ({ port: p.port, reason: msg(err) })),
+            });
+            return;
+        }
+        spec.onEndpoints(appName, {
+            ...(accepted.length > 0
+                ? { added: endpointsFor(config, spec.sessionId, accepted) }
+                : {}),
+            ...(removed.length > 0
+                ? { removed: endpointsFor(config, spec.sessionId, removed) }
+                : {}),
+            ...(rejected.length > 0
+                ? {
+                    rejected: rejected.map((p) => ({
+                        port: p.port,
+                        reason: `another app in this session already declares ${p.protocol} port ${p.port}`,
+                    })),
+                }
+                : {}),
+        });
+        const tcp = accepted.filter((p) => p.protocol === "tcp").map((p) => p.port);
+        if (tcp.length > 0) {
+            void watchReachability({
+                host: rt.ip,
+                ports: tcp,
+                onState: (port, state) => spec.onReachability(appName, port, state),
+                signal: rt.abort.signal,
+            });
+        }
+    }
+    function watchPorts(rt) {
+        for (const app of apps) {
+            const tcp = app.ports.filter((p) => p.protocol === "tcp").map((p) => p.port);
+            if (tcp.length === 0)
+                continue;
+            void watchReachability({
+                host: rt.ip,
+                ports: tcp,
+                onState: (port, state) => spec.onReachability(app.name, port, state),
+                signal: rt.abort.signal,
+            });
+        }
+    }
+    /** Apps whose container has already been reported ended, so a repeated watch
+     *  event does not re-report it. Cleared when a pod is replaced. */
+    const endedApps = new Set();
+    /**
+     * Report an `app-<name>` container that has terminated.
+     *
+     * `restartPolicy: Never` plus a `workspace` container that runs forever means
+     * a pod whose application container died stays **Running** — so pod phase
+     * alone never notices, and the app is silently dead while the editor still
+     * shows it running. The container statuses are where that fact lives.
+     *
+     * A run ENDING is not the session ending: the rest of the session is up and
+     * the next edit starts the next generation, which is why this reports a run
+     * outcome rather than a status.
+     */
+    function noteEndedContainers(obj) {
+        if (userStopped)
+            return;
+        for (const status of podStatus(obj)?.containerStatuses ?? []) {
+            const name = status.name ?? "";
+            if (!name.startsWith("app-"))
+                continue;
+            const terminated = status.state?.terminated;
+            if (!terminated)
+                continue;
+            const appName = name.slice("app-".length);
+            if (endedApps.has(appName))
+                continue;
+            endedApps.add(appName);
+            spec.onRunEnded(appName, {
+                reason: terminated.reason && terminated.reason !== "Completed"
+                    ? `application container ${terminated.reason} (exit code ${terminated.exitCode ?? "unknown"})`
+                    : `application container exited (code ${terminated.exitCode ?? "unknown"})`,
+            });
+        }
+    }
+    /** A watch on the pod, so a container that dies unrecoverably fails the
+     *  session instead of leaving a stream that has simply gone quiet. */
+    function armPodWatch(rt) {
+        let stopped = false;
+        const arm = async () => {
+            if (stopped)
+                return;
+            try {
+                const req = await kube.watch.watch(`/api/v1/namespaces/${ns}/pods`, { fieldSelector: `metadata.name=${rt.name}` }, (type, obj) => {
+                    if (stopped)
+                        return;
+                    noteEndedContainers(obj);
+                    const phase = podPhase(obj);
+                    if (phase === "Failed" || phase === "Succeeded") {
+                        // A watch session's pod reaching a terminal phase is never a
+                        // normal run ending — a run ending leaves the pod up. So it is a
+                        // session failure unless the user asked for it.
+                        settle(userStopped
+                            ? { kind: "stopped" }
+                            : { kind: "failed", message: `session pod reached ${phase}` });
+                    }
+                }, () => {
+                    if (stopped)
+                        return;
+                    setTimeout(() => void arm(), WATCH_REARM_DELAY_MS).unref?.();
+                });
+                rt.stopWatch = () => {
+                    stopped = true;
+                    try {
+                        req.abort?.();
+                    }
+                    catch {
+                        /* already gone */
+                    }
+                };
+            }
+            catch {
+                if (!stopped)
+                    setTimeout(() => void arm(), WATCH_REARM_DELAY_MS).unref?.();
+            }
+        };
+        void arm();
+    }
+    /**
+     * Create or re-patch the Service and Ingress for the session's whole declared
+     * port set. Adding a `ports:` entry is as ordinary an edit as adding an
+     * import, and a container may bind any port regardless of what the pod spec
+     * declares — so without this the app listens and is simply unreachable: no
+     * ingress, no error, no event. The pod's `containerPort` list is
+     * documentation; the Service and Ingress are what make a port reachable, which
+     * is why this needs no pod recreate.
+     */
+    async function publishEndpoints(rt, forApps) {
+        if (!config.sessionIngressBaseDomain)
+            return;
+        const ports = allPorts(forApps);
+        if (ports.length === 0)
+            return;
+        const service = buildSessionService(config, spec.sessionId, rt.name, rt.uid, ports);
+        const serviceName = service.metadata.name;
+        await upsert(() => kube.core.createNamespacedService({ namespace: ns, body: service }), async () => {
+            // A Service replace must carry the assigned `clusterIP` and the current
+            // `resourceVersion`: the first is immutable and an empty one is rejected
+            // outright, the second is what makes the write conflict rather than
+            // clobber. Reading first is not optional here.
+            const existing = await kube.core.readNamespacedService({ name: serviceName, namespace: ns });
+            await kube.core.replaceNamespacedService({
+                name: serviceName,
+                namespace: ns,
+                body: {
+                    ...service,
+                    metadata: {
+                        ...service.metadata,
+                        resourceVersion: existing.metadata?.resourceVersion,
+                    },
+                    spec: {
+                        ...service.spec,
+                        clusterIP: existing.spec?.clusterIP,
+                        clusterIPs: existing.spec?.clusterIPs,
+                    },
+                },
+            });
+        });
+        const { ingress } = buildSessionIngress(config, spec.sessionId, serviceName, rt.name, rt.uid, ports);
+        if (!ingress.spec?.rules?.length)
+            return;
+        const ingressName = ingress.metadata.name;
+        await upsert(() => kube.networking.createNamespacedIngress({ namespace: ns, body: ingress }), async () => {
+            const existing = await kube.networking.readNamespacedIngress({
+                name: ingressName,
+                namespace: ns,
+            });
+            await kube.networking.replaceNamespacedIngress({
+                name: ingressName,
+                namespace: ns,
+                body: {
+                    ...ingress,
+                    metadata: {
+                        ...ingress.metadata,
+                        resourceVersion: existing.metadata?.resourceVersion,
+                    },
+                },
+            });
+        });
+    }
+    async function teardownPod() {
+        const rt = runtime;
+        runtime = null;
+        if (!rt)
+            return;
+        rt.stopWatch();
+        rt.abort.abort();
+        for (const socket of rt.sockets.values()) {
+            try {
+                socket.close();
+            }
+            catch {
+                /* already closed */
+            }
+        }
+        await deletePod(kube, ns, rt.name);
+    }
+    await bringUp(true);
+    return {
+        writeStdin(app, bytes) {
+            try {
+                runtime?.stdins.get(app)?.write(Buffer.from(bytes));
+            }
+            catch {
+                /* stream ended */
+            }
+        },
+        resize(app, cols, rows) {
+            const socket = runtime?.sockets.get(app);
+            if (!socket)
+                return;
+            try {
+                const payload = Buffer.from(JSON.stringify({ Width: cols, Height: rows }));
+                socket.send(Buffer.concat([Buffer.from([RESIZE_CHANNEL]), payload]));
+            }
+            catch {
+                /* socket gone */
+            }
+        },
+        done,
+        get workspace() {
+            return runtime?.workspace;
+        },
+        async reload(app) {
+            const rt = runtime;
+            const spec_ = apps.find((a) => a.name === app);
+            if (!rt || !spec_)
+                return;
+            await rt.workspace.touch(spec_.entryRelativePath);
+        },
+        async setApps(next) {
+            // A pod's container list is fixed at creation, so this is suspend+resume
+            // with a different set — the same path, reused because it has to be. The
+            // alternatives were a pod per app (needing ReadWriteMany storage for the
+            // shared workspace), pre-allocated slots, or a supervisor owning child
+            // kernels inside one container; all three cost more.
+            const files = await runtime?.workspace.snapshot();
+            await teardownPod();
+            apps = next;
+            podName = freshPodName(spec.sessionId);
+            await bringUp(false);
+            if (files && files.length > 0) {
+                await runtime.workspace.apply({
+                    write: files.map((f) => ({ path: f.path, content: f.content, encoding: f.encoding })),
+                });
+            }
+        },
+        async suspend() {
+            // `teardownPod` stops the pod watch before deleting, so the delete is not
+            // reported as the session failing.
+            await teardownPod();
+        },
+        async stop() {
+            userStopped = true;
+            await teardownPod();
+            settle({ kind: "stopped" });
+        },
+    };
+    function tagFor(app, real) {
+        return app.io === "tty" ? "tty" : real;
+    }
+    async function upsert(create, replace) {
+        try {
+            await create();
+        }
+        catch (err) {
+            if (!isConflict(err))
+                throw err;
+            await replace();
+        }
+    }
+}
+function allPorts(apps) {
+    return apps.flatMap((a) => a.ports);
+}
+/** Every pod a session ever creates gets its own name. A resumed session reuses
+ *  its ID but must not reuse the name: the pod it replaces may still be
+ *  terminating, and creating over a terminating name races the API server's own
+ *  delete. Reaping and session lookup key on the label, never on the name.
+ *
+ *  The counter is what makes two recreates in the same millisecond distinct;
+ *  the clock is what makes a name from a LATER closure (a resume builds a fresh
+ *  one) distinct from an earlier closure's. Neither alone is enough. */
+let podSequence = 0;
+function freshPodName(sessionId) {
+    podSequence += 1;
+    return `telo-watch-${sessionId}-${Date.now().toString(36)}${podSequence.toString(36)}`;
+}
+function isConflict(err) {
+    const e = err;
+    return (e?.statusCode ?? e?.code ?? e?.response?.statusCode) === 409;
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(resolve, ms);
+        timer.unref?.();
+        signal?.addEventListener("abort", () => {
+            clearTimeout(timer);
+            reject(new Error("aborted"));
+        }, { once: true });
+    });
+}
+//# sourceMappingURL=watch-session.js.map

package/dist/k8s/watch-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch-session.js","sourceRoot":"","sources":["../../src/k8s/watch-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAYpD,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE;kEACkE;AAClE,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC;;4CAE4C;AAC5C,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAC3C,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,cAAc,GAAG,CAAC,CAAC;AAYzB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAsB,EACtB,IAAsB;IAEtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACnC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAExD,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,IAAI,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,MAAM,qBAAqB,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAe3E,IAAI,OAAO,GAAsB,IAAI,CAAC;IAEtC,IAAI,WAAwB,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAQ,EAAE;QACzC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,WAAW,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,KAAK,UAAU,OAAO,CAAC,IAAa;QAClC,MAAM,GAAG,GAAG,aAAa,CAAC;YACxB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY;YAC/C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,qBAAqB;SACtB,CAAC,CAAC;QAEH,IAAI,OAAc,CAAC;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,QAAQ,EACR,yBAAyB,GAAG,CAAC,GAAG,CAAC,EAAE,EACnC,GAAG,CAAC,GAAG,CAAC,CACT,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAEhD,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,cAAc,EAAE,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAEhD,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,kDAAkD;QAClD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,SAAS,CAAC,KAAK,CAAC;gBACpB,KAAK,EAAE;oBACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC/B,IAAI,EAAE,CAAC,CAAC,YAAY;wBACpB,OAAO,EAAE,CAAC,CAAC,QAAQ;wBACnB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,MAAM;qBAC/B,CAAC,CAAC;oBACH,sEAAsE;oBACtE,gEAAgE;oBAChE,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,GAAG;YACR,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;YAChC,EAAE;YACF,SAAS;YACT,OAAO,EAAE,IAAI,GAAG,EAAE;YAClB,MAAM,EAAE,IAAI,GAAG,EAAE;YACjB,KAAK;YACL,SAAS,EAAE,GAAG,EAAE,GAAE,CAAC;SACpB,CAAC;QAEF,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpB,UAAU,CAAC,OAAO,CAAC,CAAC;QACpB,WAAW,CAAC,OAAO,CAAC,CAAC;QAErB,IAAI,CAAC,QAAQ,CAAC;YACZ,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED;;yEAEqE;IACrE,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,KAAsB;QAChE,IAAI,aAAiC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;QAChD,SAAS,CAAC;YACR,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACzF,IAAI,OAAc,CAAC;YACnB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACvE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC3E,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;gBACrC,IAAI,EAAE;oBAAE,OAAO,EAAE,CAAC;YACpB,CAAC;iBAAM,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,iBAAiB,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC5C,IAAI,SAAS,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;oBAC7C,aAAa,GAAG,SAAS,CAAC;oBAC1B,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED;;sEAEkE;IAClE,KAAK,UAAU,gBAAgB,CAAC,MAAuB,EAAE,MAAmB;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAC9C,IAAI,SAAS,GAAG,aAAa,CAAC;QAC9B,SAAS,CAAC;YACR,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACzF,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,OAAO,EACP,6CAA6C,SAAS,EAAE,EACxD,SAAS,CACV,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;qFACiF;IACjF,KAAK,UAAU,UAAU,CAAC,EAAc;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;gBAC1B,KAAK,CAAC,KAAa,EAAE,QAAQ,EAAE,EAAE;oBAC/B,IAAI,KAAK,EAAE,UAAU;wBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;oBAC1F,EAAE,EAAE,CAAC;gBACP,CAAC;aACF,CAAC,CAAC;YACH,yEAAyE;YACzE,wEAAwE;YACxE,wDAAwD;YACxD,MAAM,MAAM,GACV,GAAG,CAAC,EAAE,KAAK,SAAS;gBAClB,CAAC,CAAC,IAAI,QAAQ,CAAC;oBACX,KAAK,CAAC,KAAa,EAAE,QAAQ,EAAE,EAAE;wBAC/B,IAAI,KAAK,EAAE,UAAU;4BAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;wBAC7E,EAAE,EAAE,CAAC;oBACP,CAAC;iBACF,CAAC;gBACJ,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CACjC,EAAE,EACF,EAAE,CAAC,IAAI,EACP,OAAO,GAAG,CAAC,IAAI,EAAE,EACjB,MAAM,EACN,MAAM,EACN,KAAK,EACL,GAAG,CAAC,EAAE,KAAK,KAAK,CACjB,CAAC;gBACF,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAgC,CAAC,CAAC;gBAC3D,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,qEAAqE;gBACrE,0CAA0C;gBAC1C,IAAI,CAAC,QAAQ,CACX,GAAG,CAAC,IAAI,EACR,MAAM,CAAC,IAAI,CAAC,kCAAkC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAC7D,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CAAC,EAAc;QAChC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC1B,KAAK,gBAAgB,CAAC;gBACpB,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,cAAc,CAAC,KAAK,CAAC,SAAS;gBACtD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjB,KAAK,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAChC,CAAC;gBACD,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAiB;QAClE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,EAAE,GAAG,OAAO,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;YAAE,OAAO;QAExB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEvD,4EAA4E;QAC5E,6EAA6E;QAC7E,6DAA6D;QAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAC5E,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7D,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;QAE7E,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE;gBACxB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aACpE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE;YACxB,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACrB,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;gBAC3D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBACpB,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACrB,CAAC,CAAC;oBACE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,gDAAgD,CAAC,CAAC,QAAQ,SAAS,CAAC,CAAC,IAAI,EAAE;qBACpF,CAAC,CAAC;iBACJ;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,KAAK,iBAAiB,CAAC;gBACrB,IAAI,EAAE,EAAE,CAAC,EAAE;gBACX,KAAK,EAAE,GAAG;gBACV,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC;gBACnE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CAAC,EAAc;QAChC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC/B,KAAK,iBAAiB,CAAC;gBACrB,IAAI,EAAE,EAAE,CAAC,EAAE;gBACX,KAAK,EAAE,GAAG;gBACV,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;gBACpE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;uEACmE;IACnE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC;;;;;;;;;;;OAWG;IACH,SAAS,mBAAmB,CAAC,GAAY;QACvC,IAAI,WAAW;YAAE,OAAO;QACxB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;YAC5C,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YACrC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;gBACvB,MAAM,EACJ,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW;oBACpD,CAAC,CAAC,yBAAyB,UAAU,CAAC,MAAM,eAAe,UAAU,CAAC,QAAQ,IAAI,SAAS,GAAG;oBAC9F,CAAC,CAAC,sCAAsC,UAAU,CAAC,QAAQ,IAAI,SAAS,GAAG;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;0EACsE;IACtE,SAAS,WAAW,CAAC,EAAc;QACjC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,GAAG,GAAG,KAAK,IAAmB,EAAE;YACpC,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAChC,sBAAsB,EAAE,OAAO,EAC/B,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,IAAI,EAAE,EAAE,EAC7C,CAAC,IAAY,EAAE,GAAY,EAAE,EAAE;oBAC7B,IAAI,OAAO;wBAAE,OAAO;oBACpB,mBAAmB,CAAC,GAAG,CAAC,CAAC;oBACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC5B,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;wBAChD,6DAA6D;wBAC7D,iEAAiE;wBACjE,gDAAgD;wBAChD,MAAM,CACJ,WAAW;4BACT,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;4BACrB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,KAAK,EAAE,EAAE,CAChE,CAAC;oBACJ,CAAC;gBACH,CAAC,EACD,GAAG,EAAE;oBACH,IAAI,OAAO;wBAAE,OAAO;oBACpB,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC/D,CAAC,CACF,CAAC;gBACF,EAAE,CAAC,SAAS,GAAG,GAAG,EAAE;oBAClB,OAAO,GAAG,IAAI,CAAC;oBACf,IAAI,CAAC;wBACF,GAA8B,CAAC,KAAK,EAAE,EAAE,CAAC;oBAC5C,CAAC;oBAAC,MAAM,CAAC;wBACP,kBAAkB;oBACpB,CAAC;gBACH,CAAC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,OAAO;oBAAE,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7E,CAAC;QACH,CAAC,CAAC;QACF,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,gBAAgB,CAAC,EAAc,EAAE,OAAyB;QACvE,IAAI,CAAC,MAAM,CAAC,wBAAwB;YAAE,OAAO;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpF,MAAM,WAAW,GAAG,OAAO,CAAC,QAAS,CAAC,IAAK,CAAC;QAC5C,MAAM,MAAM,CACV,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EACzE,KAAK,IAAI,EAAE;YACT,wEAAwE;YACxE,yEAAyE;YACzE,oEAAoE;YACpE,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC;gBACvC,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE;oBACJ,GAAG,OAAO;oBACV,QAAQ,EAAE;wBACR,GAAG,OAAO,CAAC,QAAQ;wBACnB,eAAe,EAAE,QAAQ,CAAC,QAAQ,EAAE,eAAe;qBACpD;oBACD,IAAI,EAAE;wBACJ,GAAG,OAAO,CAAC,IAAI;wBACf,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS;wBACnC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU;qBACtC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CACrC,MAAM,EACN,IAAI,CAAC,SAAS,EACd,WAAW,EACX,EAAE,CAAC,IAAI,EACP,EAAE,CAAC,GAAG,EACN,KAAK,CACN,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM;YAAE,OAAO;QACzC,MAAM,WAAW,GAAG,OAAO,CAAC,QAAS,CAAC,IAAK,CAAC;QAC5C,MAAM,MAAM,CACV,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAC/E,KAAK,IAAI,EAAE;YACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;gBAC3D,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC;gBAC7C,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE;oBACJ,GAAG,OAAO;oBACV,QAAQ,EAAE;wBACR,GAAG,OAAO,CAAC,QAAQ;wBACnB,eAAe,EAAE,QAAQ,CAAC,QAAQ,EAAE,eAAe;qBACpD;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW;QACxB,MAAM,EAAE,GAAG,OAAO,CAAC;QACnB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,EAAE,CAAC,SAAS,EAAE,CAAC;QACf,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpB,OAAO;QACL,UAAU,CAAC,GAAG,EAAE,KAAK;YACnB,IAAI,CAAC;gBACH,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI;YACpB,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC3E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,IAAI;QACJ,IAAI,SAAS;YACX,OAAO,OAAO,EAAE,SAAS,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,EAAE,GAAG,OAAO,CAAC;YACnB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK;gBAAE,OAAO;YAC1B,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,qDAAqD;YACrD,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,WAAW,EAAE,CAAC;YACpB,IAAI,GAAG,IAAI,CAAC;YACZ,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,OAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;oBAC7B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;iBACtF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO;YACX,0EAA0E;YAC1E,mCAAmC;YACnC,MAAM,WAAW,EAAE,CAAC;QACtB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;IAEF,SAAS,MAAM,CAAC,GAAmB,EAAE,IAAyB;QAC5D,OAAO,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,MAA8B,EAAE,OAA+B;QACnF,IAAI,CAAC;YACH,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAChC,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAsB;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;wEAOwE;AACxE,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,SAAS,YAAY,CAAC,SAAiB;IACrC,WAAW,IAAI,CAAC,CAAC;IACjB,OAAO,cAAc,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,CAAC,GAAG,GAAiF,CAAC;IAC5F,OAAO,CAAC,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,GAAG,CAAC;AACvE,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,EAAE,gBAAgB,CACtB,OAAO,EACP,GAAG,EAAE;YACH,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/B,CAAC,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/k8s/workspace-configmap.d.ts

@@ -0,0 +1,24 @@
+import type { K8sRunnerConfig } from "../config.js";
+import type { KubeClient } from "./client.js";
+export declare function workspaceConfigMapName(): string;
+/** Create the ConfigMap if it is not already there. Content-addressed, so an
+ *  existing one with this name already holds exactly these bytes and a 409 is
+ *  success rather than a conflict to resolve. */
+export declare function ensureWorkspaceConfigMap(kube: KubeClient, config: K8sRunnerConfig): Promise<string>;
+/**
+ * Delete workspace-app ConfigMaps no live pod mounts.
+ *
+ * The name is content-addressed, so every release that changes the manifest
+ * leaves the previous one behind — permanently, since nothing else removes it.
+ * Run at boot, alongside the orphan pod reap: a session that survives a runner
+ * restart is impossible (the registry is in memory), so anything a live pod
+ * still references is a pod this process is about to reap anyway.
+ *
+ * Keeps the CURRENT hash unconditionally, and skips any map a pod still lists —
+ * a mounted ConfigMap that disappears makes the kubelet fail the pod.
+ */
+export declare function sweepWorkspaceConfigMaps(kube: KubeClient, config: K8sRunnerConfig, log: {
+    info(obj: unknown, msg: string): void;
+    warn(obj: unknown, msg: string): void;
+}): Promise<void>;
+//# sourceMappingURL=workspace-configmap.d.ts.map

package/dist/k8s/workspace-configmap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-configmap.d.ts","sourceRoot":"","sources":["../../src/k8s/workspace-configmap.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmB9C,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAED;;iDAEiD;AACjD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAeD;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE;IAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACpF,OAAO,CAAC,IAAI,CAAC,CAqCf"}