@telorun/k8s-runner 0.14.0 → 0.15.0

package/dist/k8s/pod-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pod-status.d.ts","sourceRoot":"","sources":["../../src/k8s/pod-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAuC,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;GAKG;AAEH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,SAAS,CAEnE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEzD;AAED;sFACsF;AACtF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAYjE;AAgBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,GAAG,SAAS,CAK5E;AAGD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAG7D;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAOtD;AAyCD,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOzF;AAED,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE3C;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAQxC"}
+{"version":3,"file":"pod-status.d.ts","sourceRoot":"","sources":["../../src/k8s/pod-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAuC,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;GAKG;AAEH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,SAAS,CAEnE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEzD;AAED;sFACsF;AACtF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAYjE;AAgBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,GAAG,SAAS,CAK5E;AAGD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAG7D;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAOtD;AAyCD,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOzF;AAED,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE3C;AAED;;;4CAG4C;AAC5C,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAQxC"}

package/dist/k8s/pod-status.js

@@ -122,6 +122,13 @@ export async function deletePod(kube, ns, name) {
 export function is404(err) {
     return statusCode(err) === 404;
 }
+/** A name-already-taken rejection — what makes a create idempotent by falling
+ *  through to a replace. Reads the status through `statusCode` like every other
+ *  classification here, so an `ECONNREFUSED` or a `DOMException`'s legacy number
+ *  in `code` cannot be mistaken for one. */
+export function isConflict(err) {
+    return statusCode(err) === 409;
+}
 export function msg(err) {
     if (err instanceof Error)
         return err.message;

package/dist/k8s/pod-status.js.map

@@ -1 +1 @@
-{"version":3,"file":"pod-status.js","sourceRoot":"","sources":["../../src/k8s/pod-status.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5C;;;;;GAKG;AAEH,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,OAAQ,GAAyB,EAAE,MAAM,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,OAAO,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;AAC/B,CAAC;AAED;sFACsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;KACpC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB;YACtB,OAAO,oBAAoB,CAAC;QAC9B,KAAK,iBAAiB;YACpB,OAAO,wBAAwB,CAAC;QAClC,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,WAAoB;IAC/D,IAAI,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;IACxF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC;IACvE,OAAO,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,MAAM,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACzC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmC;IAChE,MAAM,MAAM,GAAqD;QAC/D,CAAC,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,CAAC;QACjD,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,CAAC;KACzC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,KAAK,MAAM,EAAE,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACvF,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAmC;IAChE,MAAM,IAAI,GAAG,KAAK,EAAE,UAAU,CAAC;IAC/B,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,WAAW,MAAM,cAAc,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;IAC/B,IAAI,OAAO,EAAE,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,YAAY,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAC/E,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO,MAAM,KAAK,iBAAiB,IAAI,MAAM,KAAK,mBAAmB,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,EAAU,EAAE,IAAY;IACxE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAY;IAChC,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,GAAY;IAC9B,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"pod-status.js","sourceRoot":"","sources":["../../src/k8s/pod-status.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5C;;;;;GAKG;AAEH,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,OAAQ,GAAyB,EAAE,MAAM,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,OAAO,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;AAC/B,CAAC;AAED;sFACsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;KACpC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB;YACtB,OAAO,oBAAoB,CAAC;QAC9B,KAAK,iBAAiB;YACpB,OAAO,wBAAwB,CAAC;QAClC,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,WAAoB;IAC/D,IAAI,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;IACxF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC;IACvE,OAAO,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,MAAM,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACzC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmC;IAChE,MAAM,MAAM,GAAqD;QAC/D,CAAC,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,CAAC;QACjD,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,CAAC;KACzC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,KAAK,MAAM,EAAE,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACvF,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAmC;IAChE,MAAM,IAAI,GAAG,KAAK,EAAE,UAAU,CAAC;IAC/B,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,WAAW,MAAM,cAAc,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;IAC/B,IAAI,OAAO,EAAE,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,YAAY,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAC/E,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO,MAAM,KAAK,iBAAiB,IAAI,MAAM,KAAK,mBAAmB,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,EAAU,EAAE,IAAY;IACxE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAY;IAChC,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;AACjC,CAAC;AAED;;;4CAG4C;AAC5C,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,GAAY;IAC9B,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/k8s/routing/create-or-replace.d.ts

@@ -0,0 +1,5 @@
+/** A create that yields to an existing object of the same name. Every routing
+ *  object is republished on reload (an app's declared port set changes), so the
+ *  write has to be idempotent rather than create-once. */
+export declare function createOrReplace(create: () => Promise<unknown>, replace: () => Promise<unknown>): Promise<void>;
+//# sourceMappingURL=create-or-replace.d.ts.map

package/dist/k8s/routing/create-or-replace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-or-replace.d.ts","sourceRoot":"","sources":["../../../src/k8s/routing/create-or-replace.ts"],"names":[],"mappings":"AAEA;;0DAE0D;AAC1D,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/k8s/routing/create-or-replace.js

@@ -0,0 +1,15 @@
+import { isConflict } from "../pod-status.js";
+/** A create that yields to an existing object of the same name. Every routing
+ *  object is republished on reload (an app's declared port set changes), so the
+ *  write has to be idempotent rather than create-once. */
+export async function createOrReplace(create, replace) {
+    try {
+        await create();
+    }
+    catch (err) {
+        if (!isConflict(err))
+            throw err;
+        await replace();
+    }
+}
+//# sourceMappingURL=create-or-replace.js.map

package/dist/k8s/routing/create-or-replace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-or-replace.js","sourceRoot":"","sources":["../../../src/k8s/routing/create-or-replace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;0DAE0D;AAC1D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA8B,EAC9B,OAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAChC,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/k8s/routing/gateway-router.d.ts

@@ -0,0 +1,5 @@
+import type { K8sRunnerConfig } from "../../config.js";
+import type { KubeClient } from "../client.js";
+import type { SessionRouter } from "./session-router.js";
+export declare function createGatewayRouter(kube: KubeClient, config: K8sRunnerConfig, apiVersion: string): SessionRouter;
+//# sourceMappingURL=gateway-router.d.ts.map

package/dist/k8s/routing/gateway-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-router.d.ts","sourceRoot":"","sources":["../../../src/k8s/routing/gateway-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK/C,OAAO,KAAK,EAIV,aAAa,EACd,MAAM,qBAAqB,CAAC;AA8C7B,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,eAAe,EACvB,UAAU,EAAE,MAAM,GACjB,aAAa,CA6Jf"}

package/dist/k8s/routing/gateway-router.js

@@ -0,0 +1,178 @@
+import { is404 } from "../pod-status.js";
+import { createOrReplace } from "./create-or-replace.js";
+import { hostForPort } from "./session-endpoints.js";
+import { podOwnerRef, sessionObjectName } from "./session-service.js";
+const GROUP = "gateway.networking.k8s.io";
+const PLURAL = "httproutes";
+/**
+ * ONE HTTPRoute PER PORT, and that is forced by the API rather than chosen:
+ * `hostnames` is a property of the whole HTTPRoute, while a `rule` selects on
+ * path/header/method — never on host. A single route carrying every session
+ * hostname plus one rule per port would therefore send every host to whichever
+ * rule matched `/` first, silently collapsing all of a session's ports onto one.
+ *
+ * An Ingress rule owns its host, which is why that layer needs only one object.
+ */
+function routeName(sessionId, port) {
+    return `${sessionObjectName(sessionId)}-${port}`;
+}
+function condition(parent, type) {
+    return parent.conditions?.find((c) => c.type === type);
+}
+/** Phrase a refusal in the controller's own words — every cause here is fixed in
+ *  the cluster (a listener that does not admit this namespace, a hostname outside
+ *  the listener's own), so the controller's `reason` is the actionable part. */
+function refusal(c) {
+    const reason = c.reason ?? "rejected";
+    return c.message ? `${reason}: ${c.message}` : reason;
+}
+export function createGatewayRouter(kube, config, apiVersion) {
+    const ns = config.sessionNamespace;
+    const gateway = config.sessionRouting.gateway;
+    if (!gateway) {
+        // Unreachable through the factory, which refuses this at boot; kept so the
+        // invariant is stated where the field is read rather than assumed.
+        throw new Error("gateway routing selected without a configured Gateway parent");
+    }
+    const base = { group: GROUP, version: apiVersion, namespace: ns, plural: PLURAL };
+    // Arrow consts, not declarations: a hoisted `function` resets the narrowing of
+    // `gateway` above, since TypeScript cannot prove it is not called earlier.
+    const buildRoute = (args, port) => {
+        return {
+            apiVersion: `${GROUP}/${apiVersion}`,
+            kind: "HTTPRoute",
+            metadata: {
+                name: routeName(args.sessionId, port),
+                namespace: ns,
+                labels: {
+                    "app.kubernetes.io/managed-by": config.managedByLabel,
+                    "telo.run/session-id": args.sessionId,
+                },
+                ownerReferences: [podOwnerRef(args.podName, args.podUid)],
+            },
+            spec: {
+                parentRefs: [
+                    {
+                        group: GROUP,
+                        kind: "Gateway",
+                        name: gateway.name,
+                        namespace: gateway.namespace,
+                        ...(gateway.sectionName ? { sectionName: gateway.sectionName } : {}),
+                    },
+                ],
+                hostnames: [hostForPort(config, args.sessionId, port)],
+                rules: [
+                    {
+                        matches: [{ path: { type: "PathPrefix", value: "/" } }],
+                        backendRefs: [{ name: args.serviceName, port }],
+                    },
+                ],
+            },
+        };
+    };
+    const listSessionRoutes = async (sessionId) => {
+        const list = (await kube.custom.listNamespacedCustomObject({
+            ...base,
+            labelSelector: `telo.run/session-id=${sessionId}`,
+        }));
+        return list.items ?? [];
+    };
+    return {
+        layer: "gateway",
+        async publish(args) {
+            const tcp = args.ports.filter((p) => p.protocol === "tcp");
+            const desired = new Set(tcp.map((p) => routeName(args.sessionId, p.port)));
+            for (const p of tcp) {
+                const body = buildRoute(args, p.port);
+                const name = routeName(args.sessionId, p.port);
+                await createOrReplace(() => kube.custom.createNamespacedCustomObject({ ...base, body }), async () => {
+                    const existing = (await kube.custom.getNamespacedCustomObject({
+                        ...base,
+                        name,
+                    }));
+                    await kube.custom.replaceNamespacedCustomObject({
+                        ...base,
+                        name,
+                        body: {
+                            ...body,
+                            metadata: {
+                                ...body.metadata,
+                                resourceVersion: existing.metadata?.resourceVersion,
+                            },
+                        },
+                    });
+                });
+            }
+            // A reload that DROPS a port must delete that port's route. In ingress mode
+            // the single object is replaced and the stale rule vanishes with it; here
+            // each port owns an object, so a removed one would keep routing to a port
+            // nothing listens on.
+            for (const existing of await listSessionRoutes(args.sessionId)) {
+                const name = existing.metadata?.name;
+                if (!name || desired.has(name))
+                    continue;
+                try {
+                    await kube.custom.deleteNamespacedCustomObject({ ...base, name });
+                }
+                catch (err) {
+                    if (!is404(err))
+                        throw err;
+                }
+            }
+            return tcp.map((p) => ({
+                host: hostForPort(config, args.sessionId, p.port),
+                port: p.port,
+            }));
+        },
+        /**
+         * Gateway API is the layer that can actually answer this: a controller writes
+         * `Accepted` and `ResolvedRefs` per parent, so a route refused because the
+         * Gateway's listener does not admit this namespace says exactly that
+         * (`NotAllowedByListeners`) instead of timing out with no cause.
+         */
+        async verdictFor(sessionId, route) {
+            let obj;
+            try {
+                obj = (await kube.custom.getNamespacedCustomObject({
+                    ...base,
+                    name: routeName(sessionId, route.port),
+                }));
+            }
+            catch (err) {
+                if (is404(err))
+                    return { kind: "pending" };
+                throw err;
+            }
+            const parents = obj.status?.parents ?? [];
+            if (parents.length === 0)
+                return { kind: "pending" };
+            let rejected;
+            for (const parent of parents) {
+                const accepted = condition(parent, "Accepted");
+                const resolved = condition(parent, "ResolvedRefs");
+                if (accepted?.status === "False") {
+                    rejected ??= refusal(accepted);
+                    continue;
+                }
+                if (resolved?.status === "False") {
+                    rejected ??= refusal(resolved);
+                    continue;
+                }
+                // A route may attach to several parents; one that programmed it is enough
+                // for traffic to arrive, so a positive verdict wins over a sibling's refusal.
+                if (accepted?.status === "True" && resolved?.status !== "False") {
+                    return { kind: "programmed" };
+                }
+            }
+            return rejected ? { kind: "rejected", reason: rejected } : { kind: "pending" };
+        },
+        unclaimedReason() {
+            const section = gateway.sectionName ? ` (listener '${gateway.sectionName}')` : "";
+            return (`no controller claimed the session HTTPRoute for Gateway ` +
+                `'${gateway.namespace}/${gateway.name}'${section}. Check the Gateway exists, is programmed, ` +
+                `and that a listener admits routes from namespace '${ns}' ` +
+                `(spec.listeners[].allowedRoutes.namespaces).`);
+        },
+    };
+}
+//# sourceMappingURL=gateway-router.js.map

package/dist/k8s/routing/gateway-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-router.js","sourceRoot":"","sources":["../../../src/k8s/routing/gateway-router.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAQtE,MAAM,KAAK,GAAG,2BAA2B,CAAC;AAC1C,MAAM,MAAM,GAAG,YAAY,CAAC;AAE5B;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,SAAiB,EAAE,IAAY;IAChD,OAAO,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;AACnD,CAAC;AAkBD,SAAS,SAAS,CAAC,MAAyB,EAAE,IAAY;IACxD,OAAO,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACzD,CAAC;AAED;;gFAEgF;AAChF,SAAS,OAAO,CAAC,CAAiB;IAChC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC;IACtC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAgB,EAChB,MAAuB,EACvB,UAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAElF,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,CAAC,IAAsB,EAAE,IAAY,EAA2B,EAAE;QACnF,OAAO;YACL,UAAU,EAAE,GAAG,KAAK,IAAI,UAAU,EAAE;YACpC,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE;gBACR,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;gBACrC,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE;oBACN,8BAA8B,EAAE,MAAM,CAAC,cAAc;oBACrD,qBAAqB,EAAE,IAAI,CAAC,SAAS;iBACtC;gBACD,eAAe,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;aAC1D;YACD,IAAI,EAAE;gBACJ,UAAU,EAAE;oBACV;wBACE,KAAK,EAAE,KAAK;wBACZ,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrE;iBACF;gBACD,SAAS,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBACtD,KAAK,EAAE;oBACL;wBACE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;wBACvD,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;qBAChD;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,SAAiB,EAA8B,EAAE;QAChF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC;YACzD,GAAG,IAAI;YACP,aAAa,EAAE,uBAAuB,SAAS,EAAE;SAClD,CAAC,CAAkC,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC1B,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,SAAS;QAEhB,KAAK,CAAC,OAAO,CAAC,IAAsB;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE3E,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC/C,MAAM,eAAe,CACnB,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,EACjE,KAAK,IAAI,EAAE;oBACT,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;wBAC5D,GAAG,IAAI;wBACP,IAAI;qBACL,CAAC,CAAoB,CAAC;oBACvB,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC;wBAC9C,GAAG,IAAI;wBACP,IAAI;wBACJ,IAAI,EAAE;4BACJ,GAAG,IAAI;4BACP,QAAQ,EAAE;gCACR,GAAI,IAAI,CAAC,QAAoC;gCAC7C,eAAe,EAAE,QAAQ,CAAC,QAAQ,EAAE,eAAe;6BACpD;yBACF;qBACF,CAAC,CAAC;gBACL,CAAC,CACF,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,0EAA0E;YAC1E,0EAA0E;YAC1E,sBAAsB;YACtB,KAAK,MAAM,QAAQ,IAAI,MAAM,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;gBACrC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACzC,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;wBAAE,MAAM,GAAG,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC;gBACjD,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC,CAAC,CAAC;QACN,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,KAAqB;YACvD,IAAI,GAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;oBACjD,GAAG,IAAI;oBACP,IAAI,EAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC;iBACvC,CAAC,CAAoB,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC3C,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAErD,IAAI,QAA4B,CAAC;YACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;oBACjC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;oBAC/B,SAAS;gBACX,CAAC;gBACD,IAAI,QAAQ,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;oBACjC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;oBAC/B,SAAS;gBACX,CAAC;gBACD,0EAA0E;gBAC1E,8EAA8E;gBAC9E,IAAI,QAAQ,EAAE,MAAM,KAAK,MAAM,IAAI,QAAQ,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;oBAChE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;gBAChC,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjF,CAAC;QAED,eAAe;YACb,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,CACL,0DAA0D;gBAC1D,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,6CAA6C;gBAC7F,qDAAqD,EAAE,IAAI;gBAC3D,8CAA8C,CAC/C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/k8s/routing/index.d.ts

@@ -0,0 +1,24 @@
+import type { K8sRunnerConfig } from "../../config.js";
+import type { KubeClient } from "../client.js";
+import { type ResolvedRouting } from "./routing-mode.js";
+import type { SessionRouter } from "./session-router.js";
+export { createOrReplace } from "./create-or-replace.js";
+export { buildSessionIngress } from "./ingress-router.js";
+export { watchRouteHealth, type WatchRouteHealthOptions } from "./route-health.js";
+export { detectRoutingSupport, resolveRouting, type ClusterRoutingSupport, type ResolvedRouting, } from "./routing-mode.js";
+export { endpointsFor, hostForPort } from "./session-endpoints.js";
+export type { PublishedRoute, PublishRouteArgs, RouteVerdict, SessionRouter, } from "./session-router.js";
+export { buildSessionService, podOwnerRef, sessionObjectName } from "./session-service.js";
+/**
+ * Resolve the cluster's routing layer and build the router for it. Called ONCE at
+ * boot: an unresolvable configuration must fail the runner rather than every
+ * session it would otherwise accept and leave unroutable.
+ *
+ * `undefined` means logs-only — the honest answer when there is deliberately
+ * nothing to publish, distinct from a failure, which throws.
+ */
+export declare function createSessionRouter(kube: KubeClient, config: K8sRunnerConfig): Promise<{
+    router?: SessionRouter;
+    resolved: ResolvedRouting;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/k8s/routing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/k8s/routing/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACnE,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE3F;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC;IAAE,MAAM,CAAC,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,CAAC,CAOhE"}

package/dist/k8s/routing/index.js

@@ -0,0 +1,27 @@
+import { createGatewayRouter } from "./gateway-router.js";
+import { createIngressRouter } from "./ingress-router.js";
+import { resolveRouting } from "./routing-mode.js";
+export { createOrReplace } from "./create-or-replace.js";
+export { buildSessionIngress } from "./ingress-router.js";
+export { watchRouteHealth } from "./route-health.js";
+export { detectRoutingSupport, resolveRouting, } from "./routing-mode.js";
+export { endpointsFor, hostForPort } from "./session-endpoints.js";
+export { buildSessionService, podOwnerRef, sessionObjectName } from "./session-service.js";
+/**
+ * Resolve the cluster's routing layer and build the router for it. Called ONCE at
+ * boot: an unresolvable configuration must fail the runner rather than every
+ * session it would otherwise accept and leave unroutable.
+ *
+ * `undefined` means logs-only — the honest answer when there is deliberately
+ * nothing to publish, distinct from a failure, which throws.
+ */
+export async function createSessionRouter(kube, config) {
+    const resolved = await resolveRouting(kube, config);
+    if (resolved.layer === "none")
+        return { resolved };
+    if (resolved.layer === "gateway") {
+        return { router: createGatewayRouter(kube, config, resolved.apiVersion), resolved };
+    }
+    return { router: createIngressRouter(kube, config), resolved };
+}
+//# sourceMappingURL=index.js.map

package/dist/k8s/routing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/k8s/routing/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAwB,MAAM,mBAAmB,CAAC;AAGzE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAgC,MAAM,mBAAmB,CAAC;AACnF,OAAO,EACL,oBAAoB,EACpB,cAAc,GAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAOnE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE3F;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAgB,EAChB,MAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACnD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjE,CAAC"}

package/dist/k8s/routing/ingress-router.d.ts

@@ -0,0 +1,13 @@
+import type { V1Ingress } from "@kubernetes/client-node";
+import type { PortMapping } from "@telorun/runner-core";
+import type { K8sRunnerConfig } from "../../config.js";
+import type { KubeClient } from "../client.js";
+import type { SessionRouter } from "./session-router.js";
+/** One Ingress carries every host for a session: unlike Gateway API, an Ingress
+ *  rule is scoped to its own host, so per-host backends fit in one object. */
+export declare function buildSessionIngress(config: K8sRunnerConfig, sessionId: string, serviceName: string, podName: string, podUid: string, ports: PortMapping[]): {
+    ingress: V1Ingress;
+    hosts: string[];
+};
+export declare function createIngressRouter(kube: KubeClient, config: K8sRunnerConfig): SessionRouter;
+//# sourceMappingURL=ingress-router.d.ts.map

package/dist/k8s/routing/ingress-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress-router.d.ts","sourceRoot":"","sources":["../../../src/k8s/routing/ingress-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK/C,OAAO,KAAK,EAIV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAE7B;8EAC8E;AAC9E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAAE,GACnB;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAgDzC;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,GAAG,aAAa,CAgF5F"}

package/dist/k8s/routing/ingress-router.js

@@ -0,0 +1,125 @@
+import { is404 } from "../pod-status.js";
+import { createOrReplace } from "./create-or-replace.js";
+import { hostForPort } from "./session-endpoints.js";
+import { podOwnerRef, sessionObjectName } from "./session-service.js";
+/** One Ingress carries every host for a session: unlike Gateway API, an Ingress
+ *  rule is scoped to its own host, so per-host backends fit in one object. */
+export function buildSessionIngress(config, sessionId, serviceName, podName, podUid, ports) {
+    const rules = ports
+        .filter((p) => p.protocol === "tcp")
+        .map((p) => ({
+        host: hostForPort(config, sessionId, p.port),
+        http: {
+            paths: [
+                {
+                    path: "/",
+                    pathType: "Prefix",
+                    backend: { service: { name: serviceName, port: { number: p.port } } },
+                },
+            ],
+        },
+    }));
+    const ingress = {
+        apiVersion: "networking.k8s.io/v1",
+        kind: "Ingress",
+        metadata: {
+            name: sessionObjectName(sessionId),
+            namespace: config.sessionNamespace,
+            labels: {
+                "app.kubernetes.io/managed-by": config.managedByLabel,
+                "telo.run/session-id": sessionId,
+            },
+            ownerReferences: [podOwnerRef(podName, podUid)],
+        },
+        spec: {
+            ...(config.sessionRouting.ingressClassName
+                ? { ingressClassName: config.sessionRouting.ingressClassName }
+                : {}),
+            // Present the predefined cert (e.g. a Cloudflare Origin cert) so an upstream
+            // in Full (Strict) mode can validate the origin. Only meaningful with routable
+            // hosts; a single wildcard `*.<domain>` Secret covers every session host.
+            ...(config.sessionRouting.tlsSecretName && rules.length > 0
+                ? {
+                    tls: [
+                        {
+                            hosts: rules.map((r) => r.host),
+                            secretName: config.sessionRouting.tlsSecretName,
+                        },
+                    ],
+                }
+                : {}),
+            rules,
+        },
+    };
+    return { ingress, hosts: rules.map((r) => r.host) };
+}
+export function createIngressRouter(kube, config) {
+    const ns = config.sessionNamespace;
+    return {
+        layer: "ingress",
+        async publish(args) {
+            const { ingress } = buildSessionIngress(config, args.sessionId, args.serviceName, args.podName, args.podUid, args.ports);
+            const name = ingress.metadata.name;
+            const rules = ingress.spec?.rules ?? [];
+            // No tcp ports → nothing HTTP-routable. DELETE rather than return: a reload
+            // that drops the last routed port would otherwise leave the previous
+            // Ingress serving a port nothing listens on. (The Service stays for any udp.)
+            if (rules.length === 0) {
+                try {
+                    await kube.networking.deleteNamespacedIngress({ name, namespace: ns });
+                }
+                catch (err) {
+                    if (!is404(err))
+                        throw err;
+                }
+                return [];
+            }
+            await createOrReplace(() => kube.networking.createNamespacedIngress({ namespace: ns, body: ingress }), async () => {
+                const existing = await kube.networking.readNamespacedIngress({ name, namespace: ns });
+                await kube.networking.replaceNamespacedIngress({
+                    name,
+                    namespace: ns,
+                    body: {
+                        ...ingress,
+                        metadata: {
+                            ...ingress.metadata,
+                            resourceVersion: existing.metadata?.resourceVersion,
+                        },
+                    },
+                });
+            });
+            return args.ports
+                .filter((p) => p.protocol === "tcp")
+                .map((p) => ({ host: hostForPort(config, args.sessionId, p.port), port: p.port }));
+        },
+        /**
+         * Ingress offers no rejection signal — a controller that refuses a rule simply
+         * never writes status — so this only ever answers `programmed` or `pending`,
+         * and an unclaimed Ingress is caught by the deadline rather than by a reason
+         * the cluster gave. That is the weaker half of the two layers, and it is a
+         * property of the API, not of this implementation.
+         */
+        async verdictFor(sessionId) {
+            try {
+                const ingress = await kube.networking.readNamespacedIngress({
+                    name: sessionObjectName(sessionId),
+                    namespace: ns,
+                });
+                const assigned = ingress.status?.loadBalancer?.ingress ?? [];
+                return assigned.length > 0 ? { kind: "programmed" } : { kind: "pending" };
+            }
+            catch (err) {
+                if (is404(err))
+                    return { kind: "pending" };
+                throw err;
+            }
+        },
+        unclaimedReason() {
+            const cls = config.sessionRouting.ingressClassName;
+            return (`no ingress controller claimed the session Ingress` +
+                (cls ? ` for class '${cls}'` : " (no ingressClassName configured)") +
+                `. Check that an Ingress controller is installed and watching namespace '${ns}'.`);
+        },
+    };
+}
+//# sourceMappingURL=ingress-router.js.map

package/dist/k8s/routing/ingress-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress-router.js","sourceRoot":"","sources":["../../../src/k8s/routing/ingress-router.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAQtE;8EAC8E;AAC9E,MAAM,UAAU,mBAAmB,CACjC,MAAuB,EACvB,SAAiB,EACjB,WAAmB,EACnB,OAAe,EACf,MAAc,EACd,KAAoB;IAEpB,MAAM,KAAK,GAAG,KAAK;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC;QAC5C,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,QAAiB;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE;iBACtE;aACF;SACF;KACF,CAAC,CAAC,CAAC;IACN,MAAM,OAAO,GAAc;QACzB,UAAU,EAAE,sBAAsB;QAClC,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE;YACR,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC;YAClC,SAAS,EAAE,MAAM,CAAC,gBAAgB;YAClC,MAAM,EAAE;gBACN,8BAA8B,EAAE,MAAM,CAAC,cAAc;gBACrD,qBAAqB,EAAE,SAAS;aACjC;YACD,eAAe,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;SAChD;QACD,IAAI,EAAE;YACJ,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,6EAA6E;YAC7E,+EAA+E;YAC/E,0EAA0E;YAC1E,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBACzD,CAAC,CAAC;oBACE,GAAG,EAAE;wBACH;4BACE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;4BAC/B,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,aAAa;yBAChD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,KAAK;SACN;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAgB,EAAE,MAAuB;IAC3E,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAEnC,OAAO;QACL,KAAK,EAAE,SAAS;QAEhB,KAAK,CAAC,OAAO,CAAC,IAAsB;YAClC,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CACrC,MAAM,EACN,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,CACX,CAAC;YACF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAS,CAAC,IAAK,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACxC,4EAA4E;YAC5E,qEAAqE;YACrE,8EAA8E;YAC9E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;gBACzE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;wBAAE,MAAM,GAAG,CAAC;gBAC7B,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,eAAe,CACnB,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAC/E,KAAK,IAAI,EAAE;gBACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;gBACtF,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC;oBAC7C,IAAI;oBACJ,SAAS,EAAE,EAAE;oBACb,IAAI,EAAE;wBACJ,GAAG,OAAO;wBACV,QAAQ,EAAE;4BACR,GAAG,OAAO,CAAC,QAAQ;4BACnB,eAAe,EAAE,QAAQ,CAAC,QAAQ,EAAE,eAAe;yBACpD;qBACF;iBACF,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YACF,OAAO,IAAI,CAAC,KAAK;iBACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;iBACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,UAAU,CAAC,SAAiB;YAChC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;oBAC1D,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC;oBAClC,SAAS,EAAE,EAAE;iBACd,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,IAAI,EAAE,CAAC;gBAC7D,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC3C,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,eAAe;YACb,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC;YACnD,OAAO,CACL,mDAAmD;gBACnD,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,GAAG,GAAG,CAAC,CAAC,CAAC,mCAAmC,CAAC;gBACnE,2EAA2E,EAAE,IAAI,CAClF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/k8s/routing/route-health.d.ts

@@ -0,0 +1,34 @@
+import { type RouteState } from "@telorun/runner-core";
+import type { PublishedRoute, SessionRouter } from "./session-router.js";
+export interface WatchRouteHealthOptions {
+    router: SessionRouter;
+    sessionId: string;
+    /** The hosts `publish` reported. Empty → nothing to watch. */
+    routes: PublishedRoute[];
+    /** Receives every transition for one host. */
+    onState: (route: PublishedRoute, state: RouteState, reason?: string) => void;
+    /** Aborts the watch — wire to the session's teardown. */
+    signal: AbortSignal;
+    /** How long a route may stay unclaimed before it is reported `unprogrammed`. */
+    timeoutMs: number;
+    /** Poll interval while waiting for a verdict. */
+    intervalMs?: number;
+    /** Receives a read failure once, so a permanent one (a missing RBAC grant, an
+     *  unserved API version) reaches the runner's log and not only the client. */
+    onReadError?: (err: unknown) => void;
+}
+/**
+ * Watch whether the routing layer actually programmed each published host.
+ *
+ * This is the check whose absence made an unroutable cluster indistinguishable
+ * from a healthy one: the runner already dials the workload's own address, which
+ * proves the app is listening and says nothing about whether traffic can reach
+ * it. A session whose routing objects are reconciled by no controller reported
+ * every port reachable while every public URL 404'd.
+ *
+ * REPORTS, never fails the session: a slow controller and an absent one look the
+ * same for the first few seconds, and killing a healthy session over routing that
+ * arrives late would trade a visible problem for a worse one.
+ */
+export declare function watchRouteHealth(options: WatchRouteHealthOptions): Promise<void>;
+//# sourceMappingURL=route-health.d.ts.map

package/dist/k8s/routing/route-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-health.d.ts","sourceRoot":"","sources":["../../../src/k8s/routing/route-health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzE,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,8CAA8C;IAC9C,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7E,yDAAyD;IACzD,MAAM,EAAE,WAAW,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;kFAC8E;IAC9E,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwDtF"}

package/dist/k8s/routing/route-health.js

@@ -0,0 +1,77 @@
+import { abortableDelay } from "@telorun/runner-core";
+import { apiReason } from "../api-error.js";
+const DEFAULT_INTERVAL_MS = 2_000;
+/**
+ * Watch whether the routing layer actually programmed each published host.
+ *
+ * This is the check whose absence made an unroutable cluster indistinguishable
+ * from a healthy one: the runner already dials the workload's own address, which
+ * proves the app is listening and says nothing about whether traffic can reach
+ * it. A session whose routing objects are reconciled by no controller reported
+ * every port reachable while every public URL 404'd.
+ *
+ * REPORTS, never fails the session: a slow controller and an absent one look the
+ * same for the first few seconds, and killing a healthy session over routing that
+ * arrives late would trade a visible problem for a worse one.
+ */
+export async function watchRouteHealth(options) {
+    const { router, sessionId, routes, onState, signal } = options;
+    if (routes.length === 0)
+        return;
+    const interval = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+    const deadline = Date.now() + options.timeoutMs;
+    const pending = new Map(routes.map((r) => [r.host, r]));
+    for (const route of routes)
+        onState(route, "pending");
+    // A read failure is NOT a verdict, but it is also not nothing: a permanent one
+    // (no RBAC on the routing objects, an API version this runner did not resolve)
+    // polls out the whole deadline and would otherwise be reported as
+    // `unclaimedReason()` — sending an operator to inspect the Gateway when the
+    // runner could not read its own object. So the last one is retained and wins
+    // at the deadline.
+    let lastReadError;
+    let reportedReadError = false;
+    while (pending.size > 0 && !signal.aborted) {
+        for (const [host, route] of [...pending]) {
+            if (signal.aborted)
+                return;
+            let verdict;
+            try {
+                verdict = await router.verdictFor(sessionId, route);
+            }
+            catch (err) {
+                lastReadError = err;
+                if (!reportedReadError) {
+                    reportedReadError = true;
+                    options.onReadError?.(err);
+                }
+                continue;
+            }
+            // A verdict of ANY kind proves the read path works, so an earlier failure
+            // was transient and must not decide the message at the deadline.
+            lastReadError = undefined;
+            if (verdict.kind === "programmed") {
+                pending.delete(host);
+                onState(route, "programmed");
+            }
+            else if (verdict.kind === "rejected") {
+                pending.delete(host);
+                onState(route, "unprogrammed", verdict.reason);
+            }
+        }
+        if (pending.size === 0)
+            return;
+        if (Date.now() >= deadline)
+            break;
+        await abortableDelay(interval, signal);
+    }
+    if (signal.aborted)
+        return;
+    const reason = lastReadError !== undefined
+        ? `route status could not be read: ${apiReason(lastReadError)}`
+        : router.unclaimedReason();
+    for (const route of pending.values()) {
+        onState(route, "unprogrammed", reason);
+    }
+}
+//# sourceMappingURL=route-health.js.map

package/dist/k8s/routing/route-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-health.js","sourceRoot":"","sources":["../../../src/k8s/routing/route-health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAmB,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAqB5C,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgC;IACrE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAEhD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAEtD,+EAA+E;IAC/E,+EAA+E;IAC/E,kEAAkE;IAClE,4EAA4E;IAC5E,6EAA6E;IAC7E,mBAAmB;IACnB,IAAI,aAAsB,CAAC;IAC3B,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,OAAO,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO;YAC3B,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,GAAG,GAAG,CAAC;gBACpB,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACvB,iBAAiB,GAAG,IAAI,CAAC;oBACzB,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;gBACD,SAAS;YACX,CAAC;YACD,0EAA0E;YAC1E,iEAAiE;YACjE,aAAa,GAAG,SAAS,CAAC;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAClC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAC/B,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACvC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAC/B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM;QAClC,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC3B,MAAM,MAAM,GACV,aAAa,KAAK,SAAS;QACzB,CAAC,CAAC,mCAAmC,SAAS,CAAC,aAAa,CAAC,EAAE;QAC/D,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}