@telorun/k8s-runner 0.13.0 → 0.15.0

package/dist/config.d.ts

@@ -35,59 +35,69 @@ export interface LimitCeilings {
     ephemeralStorage: string;
 }
 /**
- * On-cluster image-build settings. The runner ALWAYS prebuilds a self-contained
- * per-app image (controllers + module manifests baked in via `telo install`) and
- * the session pod runs it directly — there is no in-pod install fallback, so a
- * registry repository (`RUNNER_IMAGE_REPOSITORY`) is required.
+ * Which routing layer the runner publishes per-session routes on.
+ *
+ *  - `auto`    — resolve from what is CONFIGURED, then from what the cluster
+ *                serves; refuse at boot when the answer is genuinely ambiguous.
+ *  - `ingress` — `networking.k8s.io/v1` Ingress.
+ *  - `gateway` — `gateway.networking.k8s.io/v1` HTTPRoute.
+ *  - `none`    — publish nothing; the session is logs-only even with a base
+ *                domain set.
  */
-export interface ImageBuildConfig {
-    /** Registry repository the per-app image is pushed to / pulled from; the tag
-     *  is the bundle content hash (e.g. `registry.telo-runner.svc:5000/telo-sessions`). */
-    repository: string;
-    /** Namespace the trusted Kaniko build Jobs run in (registry egress lives here). */
+export type SessionRoutingMode = "auto" | "ingress" | "gateway" | "none";
+/** The Gateway a session's HTTPRoute attaches to. Never detected: picking one of
+ *  several Gateways is the same guess as picking one of two routing APIs, and a
+ *  route attached to the wrong Gateway fails exactly as silently as no route. */
+export interface GatewayParentConfig {
+    name: string;
+    /** Defaults to the session namespace — mirroring Gateway API's own
+     *  `parentRefs[].namespace` default, which is the route's own namespace. */
     namespace: string;
-    /** Builder image — Kaniko (or a compatible `--context`/`--destination` executor). */
-    builderImage: string;
-    /** Build Job `activeDeadlineSeconds` and the runner's wait budget. */
-    timeoutSeconds: number;
-    /** Push/pull to an insecure (HTTP / self-signed) registry — the in-cluster default. */
-    insecureRegistry: boolean;
-    /** HTTP(S) base for a best-effort manifest existence check (skip build on hit);
-     *  undefined → always build. */
-    registryApiUrl?: string;
-    /** Optional dockerconfig Secret (in the build namespace) Kaniko pushes with. */
-    pushSecretName?: string;
-    /** Optional dockerconfig Secret (in the session namespace) the kubelet uses to
-     *  pull per-app images from a private registry. */
-    imagePullSecret?: string;
+    /** Optional listener name, when the Gateway has several and only one should
+     *  carry session traffic. */
+    sectionName?: string;
+}
+export interface SessionRoutingConfig {
+    mode: SessionRoutingMode;
+    /** Wildcard base domain for per-session hosts; unset → logs-only whatever the
+     *  mode, since without it no host can be constructed at all. */
+    baseDomain?: string;
+    /** IngressClass for created session Ingresses (ingress mode). */
+    ingressClassName?: string;
+    /** `kubernetes.io/tls` Secret (in the session namespace) the per-session
+     *  Ingress presents so an upstream (e.g. Cloudflare Full (Strict)) can validate
+     *  the origin. Must cover `*.<baseDomain>`. INGRESS MODE ONLY — under Gateway
+     *  API the certificate belongs to the Gateway's listener, so setting this in
+     *  gateway mode is refused at boot rather than silently ignored. */
+    tlsSecretName?: string;
+    gateway?: GatewayParentConfig;
+    /** How long a published route may go unclaimed by any controller before it is
+     *  reported `unprogrammed`. */
+    routeReadyTimeoutMs: number;
 }
 export interface K8sRunnerConfig extends RunnerCoreConfig {
     /** Identity advertised on `/v1/capabilities` — studio labels the runner
      *  with these. */
     displayName: string;
     description: string;
-    /** Namespace where session Pods/Services/Ingresses are created. */
+    /** Namespace where session Pods/Services and routing objects are created. */
     sessionNamespace: string;
     /** Default image for spawned session Pods (telorun/node). Baked into the runner
      *  image as `RUNNER_IMAGE` at build time (the kernel version the runner was
      *  built against); the literal fallback below is for a source checkout only. */
     defaultImage: string;
-    /** Small image for the bundle/build-context fetch initContainer (needs wget + tar). */
+    /** Small image for the bundle-fetch initContainer (needs wget + tar). */
     initImage: string;
+    /** Optional dockerconfig Secret (in the session namespace) the kubelet pulls
+     *  session images with — the kernel image, and any operator catalog image
+     *  (`RUNNER_APPS`) held in a private registry. */
+    imagePullSecret?: string;
     /** Optional sandbox RuntimeClass (gvisor/kata). Unset → cluster default (runc). */
     runtimeClass?: string;
-    /** Wildcard base domain for per-session ingress; unset → logs-only. */
-    sessionIngressBaseDomain?: string;
-    /** Optional IngressClass name for created session Ingresses. */
-    sessionIngressClassName?: string;
-    /** Optional `kubernetes.io/tls` Secret (in the session namespace) the per-session
-     *  Ingress presents so an upstream (e.g. Cloudflare Full (Strict)) can validate
-     *  the origin. Must cover the wildcard `*.<sessionIngressBaseDomain>`. Unset → no TLS block. */
-    sessionIngressTlsSecretName?: string;
-    /** On-cluster image build — the only delivery path (always present). */
-    build: ImageBuildConfig;
-    /** Runner's own in-cluster base URL, used to build the bundle/build-context
-     *  fetch URL the initContainer curls (e.g. http://k8s-runner.telo-runner:8062). */
+    /** How per-session routes are published. */
+    sessionRouting: SessionRoutingConfig;
+    /** Runner's own in-cluster base URL, used to build the bundle fetch URL the
+     *  initContainer curls (e.g. http://k8s-runner.telo-runner:8062). */
     selfUrl: string;
     /** Label applied to every session object, used for orphan reaping. */
     managedByLabel: string;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B;2FACuF;IACvF,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,gBAAgB,EAAE,OAAO,CAAC;IAC1B;oCACgC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;uDACmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD;sBACkB;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB;;oFAEgF;IAChF,YAAY,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gEAAgE;IAChE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;oGAEgG;IAChG,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,wEAAwE;IACxE,KAAK,EAAE,gBAAgB,CAAC;IACxB;uFACmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB;;;6BAGyB;IACzB,SAAS,EAAE,aAAa,CAAC;IACzB,+EAA+E;IAC/E,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C;AA0CD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,eAAe,CAkE3E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAIzE;;iFAEiF;AACjF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb;gFAC4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB;iCAC6B;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB;oEACgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;wEAIoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B;mCAC+B;IAC/B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD;sBACkB;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAC;IACzB;;oFAEgF;IAChF,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB;;sDAEkD;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,cAAc,EAAE,oBAAoB,CAAC;IACrC;yEACqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB;;;6BAGyB;IACzB,SAAS,EAAE,aAAa,CAAC;IACzB,+EAA+E;IAC/E,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C;AAyGD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,eAAe,CAmD3E"}

package/dist/config.js

@@ -1,5 +1,6 @@
 import { loadCoreConfig, parseBool, parsePositiveInt, RunnerConfigError, } from "@telorun/runner-core";
 export { RunnerConfigError };
+const ROUTING_MODES = ["auto", "ingress", "gateway", "none"];
 const DEFAULT_PORT = 8062;
 /** Compile a single optional regex env var into a one-element `RegExp[]`. */
 function parseTagRegex(raw, field) {
@@ -13,6 +14,53 @@ function parseTagRegex(raw, field) {
         throw new RunnerConfigError(`${field} is not a valid regular expression: ${err.message}`);
     }
 }
+/** Parse the routing mode, THROWING on an unrecognized one rather than degrading
+ *  to a default — a typo'd mode that silently fell back to `auto` is the same
+ *  class of failure this whole mechanism exists to remove. */
+function parseRoutingMode(raw) {
+    const v = raw?.trim();
+    if (!v)
+        return "auto";
+    if (ROUTING_MODES.includes(v))
+        return v;
+    throw new RunnerConfigError(`SESSION_ROUTING_MODE must be one of ${ROUTING_MODES.join(" | ")} (got '${v}').`);
+}
+function loadSessionRoutingConfig(env, sessionNamespace) {
+    const mode = parseRoutingMode(env.SESSION_ROUTING_MODE);
+    const gatewayName = env.SESSION_GATEWAY_NAME?.trim() || undefined;
+    const tlsSecretName = env.SESSION_INGRESS_TLS_SECRET?.trim() || undefined;
+    // A certificate configured for a layer that will never present it is a silent
+    // downgrade to plaintext origin traffic, so it is refused rather than ignored.
+    // This is only the FAST PATH, for the mode that states the layer outright: the
+    // authoritative refusal is at routing resolution, because under `auto` a named
+    // Gateway decides the layer and nothing here can see that yet.
+    if (mode === "gateway" && tlsSecretName) {
+        throw new RunnerConfigError("SESSION_INGRESS_TLS_SECRET is set but SESSION_ROUTING_MODE=gateway. Under Gateway API the " +
+            "origin certificate belongs to the Gateway listener's own `tls.certificateRefs`, not to the " +
+            "per-session route. Move the Secret reference to the Gateway and unset this.");
+    }
+    if (mode === "gateway" && !gatewayName) {
+        throw new RunnerConfigError("SESSION_ROUTING_MODE=gateway requires SESSION_GATEWAY_NAME — the Gateway each session's " +
+            "HTTPRoute attaches to. Set it (and SESSION_GATEWAY_NAMESPACE when the Gateway is not in " +
+            `'${sessionNamespace}').`);
+    }
+    return {
+        mode,
+        baseDomain: env.SESSION_ROUTING_BASE_DOMAIN?.trim() || undefined,
+        ingressClassName: env.SESSION_INGRESS_CLASS?.trim() || undefined,
+        tlsSecretName,
+        ...(gatewayName
+            ? {
+                gateway: {
+                    name: gatewayName,
+                    namespace: env.SESSION_GATEWAY_NAMESPACE?.trim() || sessionNamespace,
+                    sectionName: env.SESSION_GATEWAY_SECTION_NAME?.trim() || undefined,
+                },
+            }
+            : {}),
+        routeReadyTimeoutMs: parsePositiveInt(env.SESSION_ROUTE_READY_TIMEOUT_SECONDS, 60, "SESSION_ROUTE_READY_TIMEOUT_SECONDS") * 1000,
+    };
+}
 function loadBaseImageCatalogConfig(env) {
     return {
         enabled: parseBool(env.RUNNER_BASE_IMAGE_CATALOG_ENABLED, true, "RUNNER_BASE_IMAGE_CATALOG_ENABLED"),
@@ -34,42 +82,33 @@ export function loadK8sRunnerConfig(env) {
         throw new RunnerConfigError("RUNNER_SELF_URL env var is required. Set it to the runner's in-cluster base URL " +
             "(e.g. http://k8s-runner.telo-runner.svc:8062) so session initContainers can fetch the bundle.");
     }
-    const repository = env.RUNNER_IMAGE_REPOSITORY?.trim();
-    if (!repository) {
-        throw new RunnerConfigError("RUNNER_IMAGE_REPOSITORY env var is required. The runner prebuilds a per-app session image for " +
-            "every run (there is no in-pod install fallback); set it to the registry repository the built " +
-            "images are pushed to / pulled from (e.g. registry.example.com/telo-sessions). The tag is the " +
-            "bundle content hash.");
-    }
-    const build = {
-        repository: repository.replace(/\/+$/, ""),
-        namespace: env.RUNNER_BUILD_NAMESPACE?.trim() || "telo-builds",
-        builderImage: env.RUNNER_BUILDER_IMAGE?.trim() || "gcr.io/kaniko-project/executor:latest",
-        timeoutSeconds: parsePositiveInt(env.RUNNER_BUILD_TIMEOUT_SECONDS, 600, "RUNNER_BUILD_TIMEOUT_SECONDS"),
-        insecureRegistry: env.RUNNER_REGISTRY_INSECURE?.trim() === "true",
-        registryApiUrl: env.RUNNER_REGISTRY_API_URL?.trim() || undefined,
-        pushSecretName: env.RUNNER_REGISTRY_PUSH_SECRET?.trim() || undefined,
-        imagePullSecret: env.RUNNER_IMAGE_PULL_SECRET?.trim() || undefined,
-    };
+    const sessionNamespace = env.RUNNER_SESSION_NAMESPACE?.trim() || "telo-sessions";
     return {
         ...loadCoreConfig(env, { port: DEFAULT_PORT }),
         displayName: env.RUNNER_DISPLAY_NAME?.trim() || "Telo Runner",
         description: env.RUNNER_DESCRIPTION?.trim() || "Runs the Telo application in a cloud environment",
-        sessionNamespace: env.RUNNER_SESSION_NAMESPACE?.trim() || "telo-sessions",
+        sessionNamespace,
         defaultImage: env.RUNNER_IMAGE?.trim() || "telorun/node:latest-slim",
         initImage: env.RUNNER_INIT_IMAGE?.trim() || "busybox:stable",
+        imagePullSecret: env.RUNNER_IMAGE_PULL_SECRET?.trim() || undefined,
         runtimeClass: env.RUNNER_RUNTIME_CLASS?.trim() || undefined,
-        sessionIngressBaseDomain: env.SESSION_INGRESS_BASE_DOMAIN?.trim() || undefined,
-        sessionIngressClassName: env.SESSION_INGRESS_CLASS?.trim() || undefined,
-        sessionIngressTlsSecretName: env.SESSION_INGRESS_TLS_SECRET?.trim() || undefined,
-        build,
+        sessionRouting: loadSessionRoutingConfig(env, sessionNamespace),
         selfUrl: selfUrl.replace(/\/+$/, ""),
         managedByLabel: env.RUNNER_MANAGED_BY?.trim() || "telo-k8s-runner",
+        // Sized for a pod that RESOLVES ITS OWN module closure. They used to be
+        // 50m / 100Mi / 512Mi, which described a different workload: the closure
+        // arrived in image layers, so the pod only ran it. It now downloads,
+        // unpacks and resolves it in-pod, into an emptyDir that counts against
+        // ephemeral-storage — so the old numbers meant an OOMKill on the memory
+        // ceiling and an eviction on the storage one, for the ordinary case. The
+        // watch path already ran this workload and already carried the roomier
+        // ceiling; these match it. `appLimits` stays separate: it still differs in
+        // TTL, and both remain the operator's policy to tighten.
         limits: {
-            cpu: env.RUNNER_MAX_CPU?.trim() || "50m",
-            memory: env.RUNNER_MAX_MEMORY?.trim() || "100Mi",
+            cpu: env.RUNNER_MAX_CPU?.trim() || "500m",
+            memory: env.RUNNER_MAX_MEMORY?.trim() || "512Mi",
             ttlSeconds: parsePositiveInt(env.RUNNER_MAX_TTL_SECONDS, 3600, "RUNNER_MAX_TTL_SECONDS"),
-            ephemeralStorage: env.RUNNER_MAX_EPHEMERAL_STORAGE?.trim() || "512Mi",
+            ephemeralStorage: env.RUNNER_MAX_EPHEMERAL_STORAGE?.trim() || "1Gi",
         },
         appLimits: {
             cpu: env.RUNNER_APP_MAX_CPU?.trim() || "500m",

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GAGlB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AA0G7B,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,6EAA6E;AAC7E,SAAS,aAAa,CAAC,GAAuB,EAAE,KAAa;IAC3D,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,GAAG,KAAK,uCAAwC,GAAa,CAAC,OAAO,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAsB;IACxD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,mCAAmC,CAAC;QACpG,UAAU,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,cAAc;QAChE,MAAM,EAAE;YACN,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,iBAAiB,EAAE,SAAS,CAC1B,GAAG,CAAC,oCAAoC,EACxC,IAAI,EACJ,sCAAsC,CACvC;YACD,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;YAClF,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;SACnF;QACD,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,EAAE,yBAAyB,CAAC;QACnF,iBAAiB,EACf,gBAAgB,CACd,GAAG,CAAC,iCAAiC,EACrC,IAAI,EACJ,mCAAmC,CACpC,GAAG,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAsB;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kFAAkF;YAChF,+FAA+F,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,iBAAiB,CACzB,gGAAgG;YAC9F,+FAA+F;YAC/F,+FAA+F;YAC/F,sBAAsB,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAqB;QAC9B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,SAAS,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,aAAa;QAC9D,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,uCAAuC;QACzF,cAAc,EAAE,gBAAgB,CAC9B,GAAG,CAAC,4BAA4B,EAChC,GAAG,EACH,8BAA8B,CAC/B;QACD,gBAAgB,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,KAAK,MAAM;QACjE,cAAc,EAAE,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,cAAc,EAAE,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS;QACpE,eAAe,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,SAAS;KACnE,CAAC;IAEF,OAAO;QACL,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC9C,WAAW,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,aAAa;QAC7D,WAAW,EACT,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,kDAAkD;QACtF,gBAAgB,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,eAAe;QACzE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,0BAA0B;QACpE,SAAS,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,gBAAgB;QAC5D,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS;QAC3D,wBAAwB,EAAE,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS;QAC9E,uBAAuB,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,SAAS;QACvE,2BAA2B,EAAE,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,SAAS;QAChF,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,cAAc,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,iBAAiB;QAClE,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,KAAK;YACxC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,OAAO;YAChD,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,wBAAwB,CAAC;YACxF,gBAAgB,EAAE,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,OAAO;SACtE;QACD,SAAS,EAAE;YACT,GAAG,EAAE,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,MAAM;YAC7C,MAAM,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,OAAO;YACpD,UAAU,EAAE,gBAAgB,CAC1B,GAAG,CAAC,0BAA0B,EAC9B,KAAK,EACL,4BAA4B,CAC7B;YACD,gBAAgB,EAAE,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,KAAK;SACxE;QACD,gBAAgB,EAAE,0BAA0B,CAAC,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GAGlB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAkD7B,MAAM,aAAa,GAAkC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAsE5F,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,6EAA6E;AAC7E,SAAS,aAAa,CAAC,GAAuB,EAAE,KAAa;IAC3D,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,GAAG,KAAK,uCAAwC,GAAa,CAAC,OAAO,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;8DAE8D;AAC9D,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACtB,IAAK,aAAmC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAuB,CAAC;IACrF,MAAM,IAAI,iBAAiB,CACzB,uCAAuC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAAsB,EACtB,gBAAwB;IAExB,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAClE,MAAM,aAAa,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAE1E,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,+DAA+D;IAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,aAAa,EAAE,CAAC;QACxC,MAAM,IAAI,iBAAiB,CACzB,4FAA4F;YAC1F,6FAA6F;YAC7F,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,IAAI,iBAAiB,CACzB,0FAA0F;YACxF,0FAA0F;YAC1F,IAAI,gBAAgB,KAAK,CAC5B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,gBAAgB,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,aAAa;QACb,GAAG,CAAC,WAAW;YACb,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW;oBACjB,SAAS,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,gBAAgB;oBACpE,WAAW,EAAE,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,SAAS;iBACnE;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,mBAAmB,EACjB,gBAAgB,CACd,GAAG,CAAC,mCAAmC,EACvC,EAAE,EACF,qCAAqC,CACtC,GAAG,IAAI;KACX,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAsB;IACxD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,mCAAmC,CAAC;QACpG,UAAU,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,cAAc;QAChE,MAAM,EAAE;YACN,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,iBAAiB,EAAE,SAAS,CAC1B,GAAG,CAAC,oCAAoC,EACxC,IAAI,EACJ,sCAAsC,CACvC;YACD,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;YAClF,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;SACnF;QACD,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,EAAE,yBAAyB,CAAC;QACnF,iBAAiB,EACf,gBAAgB,CACd,GAAG,CAAC,iCAAiC,EACrC,IAAI,EACJ,mCAAmC,CACpC,GAAG,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAsB;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kFAAkF;YAChF,+FAA+F,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC;IAEjF,OAAO;QACL,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC9C,WAAW,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,aAAa;QAC7D,WAAW,EACT,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,kDAAkD;QACtF,gBAAgB;QAChB,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,0BAA0B;QACpE,SAAS,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,gBAAgB;QAC5D,eAAe,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,SAAS;QAClE,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS;QAC3D,cAAc,EAAE,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAC/D,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,cAAc,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,iBAAiB;QAClE,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,MAAM;YACzC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,OAAO;YAChD,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,wBAAwB,CAAC;YACxF,gBAAgB,EAAE,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,KAAK;SACpE;QACD,SAAS,EAAE;YACT,GAAG,EAAE,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,MAAM;YAC7C,MAAM,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,OAAO;YACpD,UAAU,EAAE,gBAAgB,CAC1B,GAAG,CAAC,0BAA0B,EAC9B,KAAK,EACL,4BAA4B,CAC7B;YACD,gBAAgB,EAAE,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,KAAK;SACxE;QACD,gBAAgB,EAAE,0BAA0B,CAAC,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/k8s/api-error.d.ts

@@ -0,0 +1,34 @@
+import { SessionStartError, type StartFailureStage } from "@telorun/runner-core";
+/**
+ * A Kubernetes API rejection, phrased for the person who clicked Run.
+ *
+ * `ApiException.message` is a full HTTP dump — status line, the raw `Status`
+ * body and every response header — and a start failure's message travels
+ * verbatim to the client as the session's terminal `failed` status. That put
+ * the runner's ServiceAccount name, the request's audit id and its flowschema
+ * UIDs on an end user's screen, none of which they can act on.
+ *
+ * So the client sees the operation, the HTTP status and the API's own one-word
+ * `reason` — enough for an operator to know what was refused — and never the
+ * body or the headers. The raw exception rides along as the error's `cause`,
+ * which the runner's log serializer records, so nothing is swallowed: the detail
+ * moves to the log, it does not disappear.
+ */
+export declare function apiFailure(err: unknown, stage: StartFailureStage, action: string): SessionStartError;
+/** Attach the original error as `cause` so a log serializer can reach it.
+ *  Every wrap on a failure path goes through here — a rewrap that drops the
+ *  cause silently undoes the whole point of summarizing the message. */
+export declare function withCause<E extends Error>(error: E, cause: unknown): E;
+/** The client-safe half of a Kubernetes API error: what was refused, and who
+ *  can act on it — never the `Status` message, which names cluster identities. */
+export declare function apiReason(err: unknown): string;
+/**
+ * The HTTP status an error carries, or `undefined` when it carries none.
+ *
+ * The number check is the whole point: `code` is also where Node puts a system
+ * error's string code and where a `DOMException` puts its legacy numeric one, so
+ * an unreachable apiserver and an aborted request both arrive here looking like
+ * a status. Only a value in the HTTP range is one.
+ */
+export declare function statusCode(err: unknown): number | undefined;
+//# sourceMappingURL=api-error.d.ts.map

package/dist/k8s/api-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-error.d.ts","sourceRoot":"","sources":["../../src/k8s/api-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,MAAM,GACb,iBAAiB,CAKnB;AAED;;wEAEwE;AACxE,wBAAgB,SAAS,CAAC,CAAC,SAAS,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,CAGtE;AAED;kFACkF;AAClF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAoB9C;AAuDD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAM3D"}

package/dist/k8s/api-error.js

@@ -0,0 +1,118 @@
+import { SessionStartError } from "@telorun/runner-core";
+/**
+ * A Kubernetes API rejection, phrased for the person who clicked Run.
+ *
+ * `ApiException.message` is a full HTTP dump — status line, the raw `Status`
+ * body and every response header — and a start failure's message travels
+ * verbatim to the client as the session's terminal `failed` status. That put
+ * the runner's ServiceAccount name, the request's audit id and its flowschema
+ * UIDs on an end user's screen, none of which they can act on.
+ *
+ * So the client sees the operation, the HTTP status and the API's own one-word
+ * `reason` — enough for an operator to know what was refused — and never the
+ * body or the headers. The raw exception rides along as the error's `cause`,
+ * which the runner's log serializer records, so nothing is swallowed: the detail
+ * moves to the log, it does not disappear.
+ */
+export function apiFailure(err, stage, action) {
+    return withCause(new SessionStartError("start_failed", stage, `${action}: ${apiReason(err)}`), err);
+}
+/** Attach the original error as `cause` so a log serializer can reach it.
+ *  Every wrap on a failure path goes through here — a rewrap that drops the
+ *  cause silently undoes the whole point of summarizing the message. */
+export function withCause(error, cause) {
+    error.cause = cause;
+    return error;
+}
+/** The client-safe half of a Kubernetes API error: what was refused, and who
+ *  can act on it — never the `Status` message, which names cluster identities. */
+export function apiReason(err) {
+    const code = statusCode(err);
+    // No HTTP status means the request never got an answer: a refused connection,
+    // a DNS failure, an abort. Those carry a `code` too (`ECONNREFUSED`, an
+    // `ABORT_ERR` number), which is why `statusCode` accepts only what an HTTP
+    // response could have produced — reporting `HTTP ECONNREFUSED` claimed the
+    // apiserver rejected something when it was never reached, which is exactly
+    // the case where the difference matters.
+    if (code === undefined)
+        return "the Kubernetes API could not be reached";
+    const reason = statusReason(err);
+    const detail = reason ? `${reason}, HTTP ${code}` : `HTTP ${code}`;
+    const cause = refusalCause(err);
+    if (cause === "quota") {
+        return `the session namespace's resource quota is exhausted (${detail})`;
+    }
+    if (cause === "rbac") {
+        return `the runner is not permitted to do this (${detail}). The cluster operator must check the runner's RBAC.`;
+    }
+    return `the Kubernetes API rejected the request (${detail})`;
+}
+/**
+ * Which of the two things a `403 Forbidden` means here.
+ *
+ * The status code alone cannot say: an RBAC denial and a `ResourceQuota`
+ * rejection are both `403` with `reason: Forbidden`, and this chart ships a
+ * quota (32 pods) enabled by default — so blaming RBAC on every 403 tells the
+ * operator to re-check a Role at exactly the moment the cluster is simply full.
+ * The two also differ in when they happen: an RBAC 403 is an install-time
+ * mistake, a quota 403 arrives under load.
+ *
+ * The only thing that separates them is the admission message, which is why it
+ * is READ here and never echoed: the classification crosses the boundary, the
+ * text does not. An unrecognized 403 degrades to the neutral wording rather than
+ * to a guess.
+ */
+function refusalCause(err) {
+    const code = statusCode(err);
+    if (code !== 401 && code !== 403)
+        return undefined;
+    const message = statusMessage(err);
+    if (message && /exceeded quota|forbidden: failed quota/i.test(message))
+        return "quota";
+    if (!message || /\bis forbidden: User\b|\bcannot \w+ resource\b/i.test(message))
+        return "rbac";
+    return undefined;
+}
+/** The API `Status` object, however the client-node deserializer left it: a
+ *  parsed object for a status code it recognizes, the raw JSON text for one it
+ *  does not (which is the 403 case, reported as "Unknown API Status Code!"). */
+function status(err) {
+    const body = err?.body;
+    const parsed = typeof body === "string" ? parseJson(body) : body;
+    return parsed && typeof parsed === "object" ? parsed : undefined;
+}
+/** `Forbidden`, `NotFound`, `Invalid`, … — the one word safe to pass on. */
+function statusReason(err) {
+    const reason = status(err)?.reason;
+    return typeof reason === "string" && reason.trim() !== "" ? reason : undefined;
+}
+/** Read for classification only — it names cluster identities and never leaves. */
+function statusMessage(err) {
+    const message = status(err)?.message;
+    return typeof message === "string" ? message : undefined;
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The HTTP status an error carries, or `undefined` when it carries none.
+ *
+ * The number check is the whole point: `code` is also where Node puts a system
+ * error's string code and where a `DOMException` puts its legacy numeric one, so
+ * an unreachable apiserver and an aborted request both arrive here looking like
+ * a status. Only a value in the HTTP range is one.
+ */
+export function statusCode(err) {
+    const e = err;
+    for (const candidate of [e?.statusCode, e?.code, e?.response?.statusCode]) {
+        if (typeof candidate === "number" && candidate >= 100 && candidate <= 599)
+            return candidate;
+    }
+    return undefined;
+}
+//# sourceMappingURL=api-error.js.map

package/dist/k8s/api-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-error.js","sourceRoot":"","sources":["../../src/k8s/api-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA0B,MAAM,sBAAsB,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CACxB,GAAY,EACZ,KAAwB,EACxB,MAAc;IAEd,OAAO,SAAS,CACd,IAAI,iBAAiB,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAC5E,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;wEAEwE;AACxE,MAAM,UAAU,SAAS,CAAkB,KAAQ,EAAE,KAAc;IACjE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,yCAAyC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,yCAAyC,CAAC;IAEzE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,wDAAwD,MAAM,GAAG,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,2CAA2C,MAAM,uDAAuD,CAAC;IAClH,CAAC;IACD,OAAO,4CAA4C,MAAM,GAAG,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,OAAO,IAAI,yCAAyC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACvF,IAAI,CAAC,OAAO,IAAI,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;gFAEgF;AAChF,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,IAAI,GAAI,GAA0B,EAAE,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACnC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACrC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,CAAC,GAAG,GAAoF,CAAC;IAC/F,KAAK,MAAM,SAAS,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QAC1E,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG;YAAE,OAAO,SAAS,CAAC;IAC9F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/k8s/backend.d.ts

@@ -2,11 +2,15 @@ import type { RunnerBackend } from "@telorun/runner-core";
 import type { BundleStore } from "../bundle-store.js";
 import type { K8sRunnerConfig } from "../config.js";
 import type { KubeClient } from "./client.js";
+import { type SessionRouter } from "./routing/index.js";
 export { podFailureMessage } from "./pod-status.js";
 export interface K8sBackendDeps {
     kube: KubeClient;
     config: K8sRunnerConfig;
     bundleStore: BundleStore;
+    /** How this cluster publishes session routes, resolved once at boot. Absent →
+     *  logs-only: no base domain, or `SESSION_ROUTING_MODE=none`. */
+    router?: SessionRouter;
 }
 export declare function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend;
 //# sourceMappingURL=backend.d.ts.map

package/dist/k8s/backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/k8s/backend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAOV,aAAa,EACd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAgB9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAepD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CA0Y3E"}
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/k8s/backend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAOV,aAAa,EACd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAML,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAc5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAepD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;qEACiE;IACjE,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CA8a3E"}