@telorun/k8s-runner 0.6.0 → 0.8.0

package/README.md

@@ -72,6 +72,13 @@ image is single-tenant, so install scripts run normally inside the trusted build
 | --- | --- | --- |
 | `RUNNER_SELF_URL` | _(required)_ | Runner's in-cluster base URL (bundle fetch) |
 | `PORT` | `8062` | HTTP listen port |
+| `RUNNER_DISPLAY_NAME` | `Telo Runner` | Display name advertised on `/v1/capabilities` (the editor's runner label) |
+| `RUNNER_DESCRIPTION` | `Runs the Telo application in a cloud environment` | Description advertised on `/v1/capabilities` |
+| `RUNNER_APPS` | _(unset → no apps)_ | JSON map of operator-predefined apps launchable by name (chart: inline `apps.catalog`, or `apps.catalogSecret` referencing a Secret holding the JSON — use the Secret whenever entries embed secrets in `env`); see the docker-runner README for the entry shape. App sessions run the catalog image directly as a pod — no on-cluster build |
+| `RUNNER_APP_MAX_CPU` | `500m` | CPU ceiling for predefined-app pods (separate from the anonymous-session ceiling) |
+| `RUNNER_APP_MAX_MEMORY` | `512Mi` | Memory ceiling for predefined-app pods |
+| `RUNNER_APP_MAX_TTL_SECONDS` | `21600` | Wall-clock TTL for predefined-app pods (agent sessions are long-lived) |
+| `RUNNER_APP_MAX_EPHEMERAL_STORAGE` | `1Gi` | Ephemeral-storage ceiling for predefined-app pods |
 | `RUNNER_SESSION_NAMESPACE` | `telo-sessions` | Namespace for session objects |
 | `RUNNER_IMAGE` | `telorun/node:latest-slim` | Default base image; always offered in the picker and the fallback when the catalog is unreachable |
 | `RUNNER_INIT_IMAGE` | `busybox:stable` | Build-context fetch initContainer image (wget + tar) |

package/dist/capabilities.d.ts

@@ -1,4 +1,13 @@
 import { type RunnerCapabilities, type RunnerTerms } from "@telorun/runner-core";
+export interface KubernetesRunnerCapabilitiesOptions {
+    /** Identity shown as the runner's label in the editor; operator-configurable
+     *  via RUNNER_DISPLAY_NAME / RUNNER_DESCRIPTION. */
+    displayName: string;
+    description: string;
+    defaultImage: string;
+    terms?: RunnerTerms;
+    imageEnum?: string[];
+}
 /** What k8s-runner advertises on `/v1/capabilities`. The runner serves
  *  untrusted/anonymous code under a hard-ceiling policy. `image` is a base-image
  *  picker: when an `imageEnum` is supplied (the resolved Docker Hub catalog) the
@@ -11,5 +20,5 @@ import { type RunnerCapabilities, type RunnerTerms } from "@telorun/runner-core"
  *
  *  `terms`, when set (operator-provided via RUNNER_TERMS_*), are enforced: a
  *  session won't start until the client acknowledges the current version. */
-export declare function kubernetesRunnerCapabilities(defaultImage: string, terms?: RunnerTerms, imageEnum?: string[]): RunnerCapabilities;
+export declare function kubernetesRunnerCapabilities(opts: KubernetesRunnerCapabilitiesOptions): RunnerCapabilities;
 //# sourceMappingURL=capabilities.d.ts.map

package/dist/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;6EAW6E;AAC7E,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE,MAAM,EAAE,GACnB,kBAAkB,CAiBpB"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,mCAAmC;IAClD;wDACoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;;;;;6EAW6E;AAC7E,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,mCAAmC,GACxC,kBAAkB,CAiBpB"}

package/dist/capabilities.js

@@ -11,10 +11,12 @@ import { sessionConfigSchema, } from "@telorun/runner-core";
  *
  *  `terms`, when set (operator-provided via RUNNER_TERMS_*), are enforced: a
  *  session won't start until the client acknowledges the current version. */
-export function kubernetesRunnerCapabilities(defaultImage, terms, imageEnum) {
+export function kubernetesRunnerCapabilities(opts) {
+    const { displayName, description, defaultImage, terms, imageEnum } = opts;
     return {
-        displayName: "Telo Public Cloud",
-        description: "Runs the Telo application in sandboxed cloud environment with capped CPU and memory.",
+        displayName,
+        description,
+        features: { io: true, ports: true },
         config: {
             schema: sessionConfigSchema({
                 imageDefault: defaultImage,
@@ -23,7 +25,6 @@ export function kubernetesRunnerCapabilities(defaultImage, terms, imageEnum) {
                 pullPolicyDescription: "Base-image freshness. `always` rebuilds the session image when the base tag has moved upstream (Docker Hub only); `missing` and `never` reuse the cached build.",
             }),
         },
-        features: { io: true, ports: true },
         terms,
     };
 }

package/dist/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;6EAW6E;AAC7E,MAAM,UAAU,4BAA4B,CAC1C,YAAoB,EACpB,KAAmB,EACnB,SAAoB;IAEpB,OAAO;QACL,WAAW,EAAE,mBAAmB;QAChC,WAAW,EACT,sFAAsF;QACxF,MAAM,EAAE;YACN,MAAM,EAAE,mBAAmB,CAAC;gBAC1B,YAAY,EAAE,YAAY;gBAC1B,QAAQ,EAAE,IAAI;gBACd,SAAS;gBACT,qBAAqB,EACnB,iKAAiK;aACpK,CAAC;SACH;QACD,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;QACnC,KAAK;KACN,CAAC;AACJ,CAAC"}
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAY9B;;;;;;;;;;;6EAW6E;AAC7E,MAAM,UAAU,4BAA4B,CAC1C,IAAyC;IAEzC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC1E,OAAO;QACL,WAAW;QACX,WAAW;QACX,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;QACnC,MAAM,EAAE;YACN,MAAM,EAAE,mBAAmB,CAAC;gBAC1B,YAAY,EAAE,YAAY;gBAC1B,QAAQ,EAAE,IAAI;gBACd,SAAS;gBACT,qBAAqB,EACnB,iKAAiK;aACpK,CAAC;SACH;QACD,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -64,6 +64,10 @@ export interface ImageBuildConfig {
     imagePullSecret?: string;
 }
 export interface K8sRunnerConfig extends RunnerCoreConfig {
+    /** Identity advertised on `/v1/capabilities` — the editor labels the runner
+     *  with these. */
+    displayName: string;
+    description: string;
     /** Namespace where session Pods/Services/Ingresses are created. */
     sessionNamespace: string;
     /** Default image for spawned session Pods (telorun/node). */
@@ -88,6 +92,11 @@ export interface K8sRunnerConfig extends RunnerCoreConfig {
     /** Label applied to every session object, used for orphan reaping. */
     managedByLabel: string;
     limits: LimitCeilings;
+    /** Ceilings for operator-predefined app sessions (`RUNNER_APPS`). Separate
+     *  from `limits` — apps are operator-curated and long-lived, so they get
+     *  roomier defaults than anonymous session code without loosening the
+     *  anonymous ceiling. */
+    appLimits: LimitCeilings;
     /** Menu of base images a session may pick (advertised as the `image` enum). */
     baseImageCatalog: BaseImageCatalogConfig;
 }

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B;2FACuF;IACvF,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,gBAAgB,EAAE,OAAO,CAAC;IAC1B;oCACgC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;uDACmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gEAAgE;IAChE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;oGAEgG;IAChG,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,wEAAwE;IACxE,KAAK,EAAE,gBAAgB,CAAC;IACxB;uFACmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,+EAA+E;IAC/E,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C;AA0CD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,eAAe,CAsD3E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B;2FACuF;IACvF,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,gBAAgB,EAAE,OAAO,CAAC;IAC1B;oCACgC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;uDACmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD;sBACkB;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gEAAgE;IAChE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;oGAEgG;IAChG,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,wEAAwE;IACxE,KAAK,EAAE,gBAAgB,CAAC;IACxB;uFACmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB;;;6BAGyB;IACzB,SAAS,EAAE,aAAa,CAAC;IACzB,+EAA+E;IAC/E,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C;AA0CD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,eAAe,CAmE3E"}

package/dist/config.js

@@ -54,6 +54,8 @@ export function loadK8sRunnerConfig(env) {
     };
     return {
         ...loadCoreConfig(env, { port: DEFAULT_PORT }),
+        displayName: env.RUNNER_DISPLAY_NAME?.trim() || "Telo Runner",
+        description: env.RUNNER_DESCRIPTION?.trim() || "Runs the Telo application in a cloud environment",
         sessionNamespace: env.RUNNER_SESSION_NAMESPACE?.trim() || "telo-sessions",
         defaultImage: env.RUNNER_IMAGE?.trim() || "telorun/node:latest-slim",
         initImage: env.RUNNER_INIT_IMAGE?.trim() || "busybox:stable",
@@ -70,6 +72,12 @@ export function loadK8sRunnerConfig(env) {
             ttlSeconds: parsePositiveInt(env.RUNNER_MAX_TTL_SECONDS, 3600, "RUNNER_MAX_TTL_SECONDS"),
             ephemeralStorage: env.RUNNER_MAX_EPHEMERAL_STORAGE?.trim() || "512Mi",
         },
+        appLimits: {
+            cpu: env.RUNNER_APP_MAX_CPU?.trim() || "500m",
+            memory: env.RUNNER_APP_MAX_MEMORY?.trim() || "512Mi",
+            ttlSeconds: parsePositiveInt(env.RUNNER_APP_MAX_TTL_SECONDS, 21600, "RUNNER_APP_MAX_TTL_SECONDS"),
+            ephemeralStorage: env.RUNNER_APP_MAX_EPHEMERAL_STORAGE?.trim() || "1Gi",
+        },
         baseImageCatalog: loadBaseImageCatalogConfig(env),
     };
 }

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GAGlB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAiG7B,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,6EAA6E;AAC7E,SAAS,aAAa,CAAC,GAAuB,EAAE,KAAa;IAC3D,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,GAAG,KAAK,uCAAwC,GAAa,CAAC,OAAO,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAsB;IACxD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,mCAAmC,CAAC;QACpG,UAAU,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,cAAc;QAChE,MAAM,EAAE;YACN,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,iBAAiB,EAAE,SAAS,CAC1B,GAAG,CAAC,oCAAoC,EACxC,IAAI,EACJ,sCAAsC,CACvC;YACD,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;YAClF,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;SACnF;QACD,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,EAAE,yBAAyB,CAAC;QACnF,iBAAiB,EACf,gBAAgB,CACd,GAAG,CAAC,iCAAiC,EACrC,IAAI,EACJ,mCAAmC,CACpC,GAAG,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAsB;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kFAAkF;YAChF,+FAA+F,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,iBAAiB,CACzB,gGAAgG;YAC9F,+FAA+F;YAC/F,+FAA+F;YAC/F,sBAAsB,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAqB;QAC9B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,SAAS,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,aAAa;QAC9D,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,uCAAuC;QACzF,cAAc,EAAE,gBAAgB,CAC9B,GAAG,CAAC,4BAA4B,EAChC,GAAG,EACH,8BAA8B,CAC/B;QACD,gBAAgB,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,KAAK,MAAM;QACjE,cAAc,EAAE,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,eAAe,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,2BAA2B;QAC7E,cAAc,EAAE,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS;QACpE,eAAe,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,SAAS;KACnE,CAAC;IAEF,OAAO;QACL,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC9C,gBAAgB,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,eAAe;QACzE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,0BAA0B;QACpE,SAAS,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,gBAAgB;QAC5D,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS;QAC3D,wBAAwB,EAAE,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS;QAC9E,uBAAuB,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,SAAS;QACvE,2BAA2B,EAAE,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,SAAS;QAChF,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,cAAc,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,iBAAiB;QAClE,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,KAAK;YACxC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,OAAO;YAChD,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,wBAAwB,CAAC;YACxF,gBAAgB,EAAE,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,OAAO;SACtE;QACD,gBAAgB,EAAE,0BAA0B,CAAC,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GAGlB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AA0G7B,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,6EAA6E;AAC7E,SAAS,aAAa,CAAC,GAAuB,EAAE,KAAa;IAC3D,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,GAAG,KAAK,uCAAwC,GAAa,CAAC,OAAO,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAsB;IACxD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,mCAAmC,CAAC;QACpG,UAAU,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,cAAc;QAChE,MAAM,EAAE;YACN,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,iBAAiB,EAAE,SAAS,CAC1B,GAAG,CAAC,oCAAoC,EACxC,IAAI,EACJ,sCAAsC,CACvC;YACD,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;YAClF,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;SACnF;QACD,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,EAAE,yBAAyB,CAAC;QACnF,iBAAiB,EACf,gBAAgB,CACd,GAAG,CAAC,iCAAiC,EACrC,IAAI,EACJ,mCAAmC,CACpC,GAAG,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAsB;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kFAAkF;YAChF,+FAA+F,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,iBAAiB,CACzB,gGAAgG;YAC9F,+FAA+F;YAC/F,+FAA+F;YAC/F,sBAAsB,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAqB;QAC9B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,SAAS,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,aAAa;QAC9D,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,uCAAuC;QACzF,cAAc,EAAE,gBAAgB,CAC9B,GAAG,CAAC,4BAA4B,EAChC,GAAG,EACH,8BAA8B,CAC/B;QACD,gBAAgB,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,KAAK,MAAM;QACjE,cAAc,EAAE,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,eAAe,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,2BAA2B;QAC7E,cAAc,EAAE,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS;QACpE,eAAe,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,SAAS;KACnE,CAAC;IAEF,OAAO;QACL,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC9C,WAAW,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,aAAa;QAC7D,WAAW,EACT,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,kDAAkD;QACtF,gBAAgB,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,eAAe;QACzE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,0BAA0B;QACpE,SAAS,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,gBAAgB;QAC5D,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS;QAC3D,wBAAwB,EAAE,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS;QAC9E,uBAAuB,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,SAAS;QACvE,2BAA2B,EAAE,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,SAAS;QAChF,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,cAAc,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,iBAAiB;QAClE,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,KAAK;YACxC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,OAAO;YAChD,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,wBAAwB,CAAC;YACxF,gBAAgB,EAAE,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,OAAO;SACtE;QACD,SAAS,EAAE;YACT,GAAG,EAAE,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,MAAM;YAC7C,MAAM,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,OAAO;YACpD,UAAU,EAAE,gBAAgB,CAC1B,GAAG,CAAC,0BAA0B,EAC9B,KAAK,EACL,4BAA4B,CAC7B;YACD,gBAAgB,EAAE,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,KAAK;SACxE;QACD,gBAAgB,EAAE,0BAA0B,CAAC,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/k8s/backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/k8s/backend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAMV,aAAa,EACd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAkB9C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAyU3E;AAiGD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAOtD"}
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/k8s/backend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAMV,aAAa,EACd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAkB9C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CA0X3E;AAiGD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAOtD"}

package/dist/k8s/backend.js

@@ -1,9 +1,9 @@
 import { PassThrough, Writable } from "node:stream";
-import { relayDebugStream, SessionStartError } from "@telorun/runner-core";
+import { relayDebugStream, SessionStartError, watchReachability } from "@telorun/runner-core";
 import { clampLimits } from "../limits.js";
 import { ensureSessionImage } from "./image-build.js";
 import { buildSessionIngress, buildSessionService, endpointsFor } from "./ingress.js";
-import { buildSessionPod, INSPECT_PORT } from "./pod-spec.js";
+import { buildAppPod, buildSessionPod, INSPECT_PORT } from "./pod-spec.js";
 const RESIZE_CHANNEL = 4;
 /** How long a Pod may take to reach Running before the start is abandoned.
  *  activeDeadlineSeconds only bounds an already-running Pod, so a stuck
@@ -39,41 +39,60 @@ export function createKubernetesBackend(deps) {
         // The /v1 contract carries no per-request limits yet, so `requested` is
         // undefined and the configured ceiling is always the effective limit. When
         // a control plane begins passing limits, plumb them here — the clamp is
-        // already min(requested, ceiling).
-        const limits = clampLimits(config.limits, undefined);
-        // Prebuild a self-contained per-app image on-cluster (controllers + module
-        // manifests baked in) and run it directly. Controller resolution never
-        // happens on the session start path, so a slow or unreachable package
-        // registry can't stall a session. Throws SessionStartError on a build
-        // failure, carrying the build pod's log tail.
-        const image = await ensureSessionImage({
-            kube,
-            build: config.build,
-            bundleStore,
-            initImage: config.initImage,
-            managedByLabel: config.managedByLabel,
-        }, {
-            bundle: spec.bundle,
-            entryRelativePath: spec.entryRelativePath,
-            baseImage: spec.config.image || config.defaultImage,
-            pullPolicy: spec.config.pullPolicy,
-            onProgress: (message, done) => spec.onProgress("build", message, done),
-        });
-        // The image is keyed on the dependency closure only, so deliver the
-        // per-session body to the Pod's /app at boot via a tokenized, single-use URL.
-        const bundleUrl = await bundleStore.stageSessionBundle(spec.sessionId, spec.bundle);
-        const pod = buildSessionPod({
-            config,
-            sessionId: spec.sessionId,
-            podName,
-            entryRelativePath: spec.entryRelativePath,
-            env: spec.env,
-            ports: spec.ports,
-            limits,
-            image,
-            bundleUrl,
-            inspect: spec.inspect,
-        });
+        // already min(requested, ceiling). App sessions (operator-curated,
+        // long-lived) get their own roomier ceilings.
+        const limits = clampLimits(spec.selfContained ? config.appLimits : config.limits, undefined);
+        let pod;
+        if (spec.selfContained) {
+            // Operator-predefined app (catalog image): self-contained, no build and
+            // no bundle to deliver — the pod runs the image's own entrypoint with
+            // the env the core route already merged.
+            pod = buildAppPod({
+                config,
+                sessionId: spec.sessionId,
+                podName,
+                env: spec.env,
+                ports: spec.ports,
+                limits,
+                image: spec.config.image,
+                pullPolicy: spec.config.pullPolicy,
+            });
+        }
+        else {
+            // Prebuild a self-contained per-app image on-cluster (controllers + module
+            // manifests baked in) and run it directly. Controller resolution never
+            // happens on the session start path, so a slow or unreachable package
+            // registry can't stall a session. Throws SessionStartError on a build
+            // failure, carrying the build pod's log tail.
+            const image = await ensureSessionImage({
+                kube,
+                build: config.build,
+                bundleStore,
+                initImage: config.initImage,
+                managedByLabel: config.managedByLabel,
+            }, {
+                bundle: spec.bundle,
+                entryRelativePath: spec.entryRelativePath,
+                baseImage: spec.config.image || config.defaultImage,
+                pullPolicy: spec.config.pullPolicy,
+                onProgress: (message, done) => spec.onProgress("build", message, done),
+            });
+            // The image is keyed on the dependency closure only, so deliver the
+            // per-session body to the Pod's /app at boot via a tokenized, single-use URL.
+            const bundleUrl = await bundleStore.stageSessionBundle(spec.sessionId, spec.bundle);
+            pod = buildSessionPod({
+                config,
+                sessionId: spec.sessionId,
+                podName,
+                entryRelativePath: spec.entryRelativePath,
+                env: spec.env,
+                ports: spec.ports,
+                limits,
+                image,
+                bundleUrl,
+                inspect: spec.inspect,
+            });
+        }
         let podUid;
         try {
             const created = await kube.core.createNamespacedPod({ namespace: ns, body: pod });
@@ -93,6 +112,7 @@ export function createKubernetesBackend(deps) {
         let startDeadline;
         let podIP;
         const debugAbort = new AbortController();
+        const reachAbort = new AbortController();
         const stdin = new PassThrough();
         const stdout = new Writable({
             write(chunk, _enc, cb) {
@@ -114,6 +134,7 @@ export function createKubernetesBackend(deps) {
             clearStartDeadline();
             abortWatch();
             debugAbort.abort();
+            reachAbort.abort();
             bundleStore.drop(spec.sessionId);
             spec.onStatus(status);
             try {
@@ -256,20 +277,25 @@ export function createKubernetesBackend(deps) {
                 spec.onOutput(Buffer.from(`\r\n[runner] failed to create ingress: ${msg(err)}\r\n`));
             });
         }
+        // The Running watch event usually carries `podIP`; if it lagged, read the
+        // pod once and cache it — shared by the debug relay and the reachability check.
+        const resolvePodIP = async () => {
+            if (podIP)
+                return podIP;
+            podIP = await kube.core
+                .readNamespacedPod({ name: podName, namespace: ns })
+                .then((p) => podStatus(p)?.podIP)
+                .catch(() => undefined);
+            return podIP;
+        };
         // When inspect is on, relay the workload's in-pod kernel debug stream out
         // over `onDebug`. Reached by pod IP over the cluster network — the inspect
-        // port is never published via Service/Ingress. The Running watch event
-        // usually carries `podIP`; if it lagged, read the pod once to recover it.
+        // port is never published via Service/Ingress.
         if (spec.inspect) {
-            if (!podIP) {
-                podIP = await kube.core
-                    .readNamespacedPod({ name: podName, namespace: ns })
-                    .then((p) => podStatus(p)?.podIP)
-                    .catch(() => undefined);
-            }
-            if (podIP) {
+            const ip = await resolvePodIP();
+            if (ip) {
                 void relayDebugStream({
-                    url: `http://${podIP}:${INSPECT_PORT}/events`,
+                    url: `http://${ip}:${INSPECT_PORT}/events`,
                     onFrame: spec.onDebug,
                     signal: debugAbort.signal,
                 });
@@ -278,6 +304,31 @@ export function createKubernetesBackend(deps) {
                 spec.onOutput(Buffer.from("\r\n[runner] debug stream unavailable: pod IP unknown\r\n"));
             }
         }
+        // Reachability check: a workload bound to 127.0.0.1 (or listening on the
+        // wrong port) is unreachable on the pod network and surfaces only as a
+        // downstream 502. Watch each advertised tcp port from the runner and report
+        // per-port state to the editor's endpoint badge. Background; finish() aborts it.
+        const tcpPorts = spec.ports.filter((p) => p.protocol === "tcp").map((p) => p.port);
+        if (tcpPorts.length > 0) {
+            void (async () => {
+                const ip = await resolvePodIP();
+                if (reachAbort.signal.aborted)
+                    return;
+                if (!ip) {
+                    // Couldn't resolve the pod IP to probe — report unverified rather than
+                    // leaving the badge spinning forever.
+                    for (const port of tcpPorts)
+                        spec.onReachability(port, "unreachable");
+                    return;
+                }
+                await watchReachability({
+                    host: ip,
+                    ports: tcpPorts,
+                    onState: (port, state) => spec.onReachability(port, state),
+                    signal: reachAbort.signal,
+                });
+            })();
+        }
         // `flipRunning` already announced `running` from the watch's Running
         // transition (which `await running` above waited on).
         return {

package/dist/k8s/backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../src/k8s/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAWpD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAI3E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAQ9D,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB;;0EAE0E;AAC1E,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAQnC,MAAM,UAAU,uBAAuB,CAAC,IAAoB;IAC1D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAEnC,KAAK,UAAU,KAAK,CAAC,MAAmB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,aAAa;oBACrB,OAAO,EAAE,sDAAsD;oBAC/D,WAAW,EAAE,wDAAwD;iBACtE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,sBAAsB,EAAE,mBAAmB;gBACpD,WAAW,EAAE,0DAA0D,EAAE,cAAc;aACxF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,IAAsB;QACzC,MAAM,OAAO,GAAG,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAErD,2EAA2E;QAC3E,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC;YACE,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW;YACX,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,EACD;YACE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY;YACnD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,UAAU,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;SACvE,CACF,CAAC;QAEF,oEAAoE;QACpE,8EAA8E;QAC9E,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpF,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO;YACP,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM;YACN,KAAK;YACL,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QAEH,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAClF,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,QAAQ,EAAE,yBAAyB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,aAAiC,CAAC;QACtC,IAAI,WAAwB,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,MAAmC,CAAC;QACxC,IAAI,UAAU,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;QACtC,IAAI,aAAyC,CAAC;QAC9C,IAAI,KAAyB,CAAC;QAC9B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QAEzC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;YAC1B,KAAK,CAAC,KAAa,EAAE,IAAI,EAAE,EAAE;gBAC3B,IAAI,KAAK,EAAE,UAAU;oBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzD,EAAE,EAAE,CAAC;YACP,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,kBAAkB,GAAG,GAAS,EAAE;YACpC,IAAI,aAAa,EAAE,CAAC;gBAClB,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5B,aAAa,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAQ,EAAE;YACzC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,kBAAkB,EAAE,CAAC;YACrB,UAAU,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,EAAE,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;YACD,WAAW,EAAE,CAAC;QAChB,CAAC,CAAC;QAEF,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,IAAI,YAAY,IAAI,QAAQ;gBAAE,OAAO;YACrC,YAAY,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC,CAAC;QAEF,IAAI,cAA2B,CAAC;QAChC,IAAI,aAAkC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC7C,cAAc,GAAG,GAAG,CAAC;YACrB,aAAa,GAAG,GAAG,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,CAAC,GAAY,EAAQ,EAAE;YACzC,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,2EAA2E;YAC3E,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACxC,IAAI,SAAS,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;oBAC7C,aAAa,GAAG,SAAS,CAAC;oBAC1B,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxC,WAAW,GAAG,IAAI,CAAC;gBACnB,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;gBAC9B,kBAAkB,EAAE,CAAC;gBACrB,cAAc,EAAE,CAAC;gBACjB,WAAW,EAAE,CAAC;YAChB,CAAC;iBAAM,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,aAAa,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACnD,CAAC;gBACD,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC;QAEF,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;YAC9C,IAAI,QAAQ;gBAAE,OAAO;YACrB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;gBACpF,WAAW,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO;gBACxB,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,aAAa,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;gBACtE,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,mEAAmE;QACnE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;YACzC,IAAI,QAAQ;gBAAE,OAAO;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAChC,sBAAsB,EAAE,OAAO,EAC/B,EAAE,aAAa,EAAE,iBAAiB,OAAO,EAAE,EAAE,EAC7C,CAAC,KAAa,EAAE,GAAY,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EACjD,GAAG,EAAE;oBACH,IAAI,QAAQ;wBAAE,OAAO;oBACrB,KAAK,aAAa,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;wBAC7B,IAAI,CAAC,QAAQ;4BAAE,KAAK,QAAQ,EAAE,CAAC;oBACjC,CAAC,CAAC,CAAC;gBACL,CAAC,CACF,CAAC;gBACF,UAAU,GAAG,GAAG,EAAE;oBAChB,IAAI,CAAC;wBACF,GAA8B,CAAC,KAAK,EAAE,EAAE,CAAC;oBAC5C,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;gBACH,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,aAAa,CAAC,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC/D,CAAC;qBAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACrB,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,EAAE,oBAAoB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACpE,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,aAAa,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACtB,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;QAExB,MAAM,QAAQ,EAAE,CAAC;QAEjB,IAAI,CAAC;YACH,MAAM,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kBAAkB,EAAE,CAAC;YACrB,UAAU,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YACnC,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,wBAAwB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrG,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACvF,MAAM,GAAG,EAAgC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6EAA6E;YAC7E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,MAAM,CAAC,wBAAwB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACvF,CAAC,CAAC,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI;qBACpB,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;qBACnD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;qBAChC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;YACD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,gBAAgB,CAAC;oBACpB,GAAG,EAAE,UAAU,KAAK,IAAI,YAAY,SAAS;oBAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,sDAAsD;QACtD,OAAO;YACL,UAAU,CAAC,KAAK;gBACd,IAAI,CAAC;oBACH,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,EAAE,IAAI;gBACf,IAAI,CAAC,MAAM;oBAAE,OAAO;gBACpB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC3E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBACvE,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;YACH,CAAC;YACD,IAAI;YACJ,KAAK,CAAC,IAAI;gBACR,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;gBACnC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9B,CAAC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW;QACxB,wEAAwE;QACxE,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAC7C,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,gCAAgC,MAAM,CAAC,cAAc,EAAE;SACvE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;YACjC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,MAAM,mBAAmB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,MAAc,EACd,KAAgC;IAEhC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/E,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CACrC,MAAM,EACN,SAAS,EACT,OAAO,CAAC,QAAS,CAAC,IAAK,EACvB,OAAO,EACP,MAAM,EACN,KAAK,CACN,CAAC;IACF,+EAA+E;IAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM;QAAE,OAAO;IACzC,MAAM,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,EAAU,EAAE,IAAY;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAgB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAQ,GAAyB,EAAE,MAAM,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;AAC/B,CAAC;AAED;sFACsF;AACtF,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;KACpC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB;YACtB,OAAO,oBAAoB,CAAC;QAC9B,KAAK,iBAAiB;YACpB,OAAO,wBAAwB,CAAC;QAClC,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,WAAoB;IACxD,IAAI,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;IACxF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC;IACvE,OAAO,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,MAAM,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACzC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmC;IAChE,MAAM,MAAM,GAAqD;QAC/D,CAAC,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,CAAC;QACjD,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,CAAC;KACzC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,KAAK,MAAM,EAAE,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACvF,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAmC;IAChE,MAAM,IAAI,GAAG,KAAK,EAAE,UAAU,CAAC;IAC/B,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,WAAW,MAAM,cAAc,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;IAC/B,IAAI,OAAO,EAAE,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,YAAY,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAC/E,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO,MAAM,KAAK,iBAAiB,IAAI,MAAM,KAAK,mBAAmB,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACpG,CAAC;AAED,SAAS,KAAK,CAAC,GAAY;IACzB,MAAM,CAAC,GAAG,GAAiF,CAAC;IAC5F,OAAO,CAAC,EAAE,UAAU,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,KAAK,GAAG,CAAC;AACrF,CAAC;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../src/k8s/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAWpD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAI9F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAQ3E,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB;;0EAE0E;AAC1E,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAQnC,MAAM,UAAU,uBAAuB,CAAC,IAAoB;IAC1D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAEnC,KAAK,UAAU,KAAK,CAAC,MAAmB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,aAAa;oBACrB,OAAO,EAAE,sDAAsD;oBAC/D,WAAW,EAAE,wDAAwD;iBACtE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,sBAAsB,EAAE,mBAAmB;gBACpD,WAAW,EAAE,0DAA0D,EAAE,cAAc;aACxF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,IAAsB;QACzC,MAAM,OAAO,GAAG,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,mEAAmE;QACnE,8CAA8C;QAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAE7F,IAAI,GAAU,CAAC;QACf,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,wEAAwE;YACxE,sEAAsE;YACtE,yCAAyC;YACzC,GAAG,GAAG,WAAW,CAAC;gBAChB,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO;gBACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;gBACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,8CAA8C;YAC9C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC;gBACE,IAAI;gBACJ,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW;gBACX,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,EACD;gBACE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY;gBACnD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAClC,UAAU,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;aACvE,CACF,CAAC;YAEF,oEAAoE;YACpE,8EAA8E;YAC9E,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAEpF,GAAG,GAAG,eAAe,CAAC;gBACpB,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO;gBACP,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,KAAK;gBACL,SAAS;gBACT,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAClF,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,QAAQ,EAAE,yBAAyB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,aAAiC,CAAC;QACtC,IAAI,WAAwB,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,MAAmC,CAAC;QACxC,IAAI,UAAU,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;QACtC,IAAI,aAAyC,CAAC;QAC9C,IAAI,KAAyB,CAAC;QAC9B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QAEzC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;YAC1B,KAAK,CAAC,KAAa,EAAE,IAAI,EAAE,EAAE;gBAC3B,IAAI,KAAK,EAAE,UAAU;oBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzD,EAAE,EAAE,CAAC;YACP,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,kBAAkB,GAAG,GAAS,EAAE;YACpC,IAAI,aAAa,EAAE,CAAC;gBAClB,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5B,aAAa,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAQ,EAAE;YACzC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,kBAAkB,EAAE,CAAC;YACrB,UAAU,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,EAAE,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;YACD,WAAW,EAAE,CAAC;QAChB,CAAC,CAAC;QAEF,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,IAAI,YAAY,IAAI,QAAQ;gBAAE,OAAO;YACrC,YAAY,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC,CAAC;QAEF,IAAI,cAA2B,CAAC;QAChC,IAAI,aAAkC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC7C,cAAc,GAAG,GAAG,CAAC;YACrB,aAAa,GAAG,GAAG,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,CAAC,GAAY,EAAQ,EAAE;YACzC,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,2EAA2E;YAC3E,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACxC,IAAI,SAAS,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;oBAC7C,aAAa,GAAG,SAAS,CAAC;oBAC1B,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxC,WAAW,GAAG,IAAI,CAAC;gBACnB,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;gBAC9B,kBAAkB,EAAE,CAAC;gBACrB,cAAc,EAAE,CAAC;gBACjB,WAAW,EAAE,CAAC;YAChB,CAAC;iBAAM,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,aAAa,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACnD,CAAC;gBACD,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC;QAEF,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;YAC9C,IAAI,QAAQ;gBAAE,OAAO;YACrB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;gBACpF,WAAW,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO;gBACxB,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,aAAa,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;gBACtE,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,mEAAmE;QACnE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;YACzC,IAAI,QAAQ;gBAAE,OAAO;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAChC,sBAAsB,EAAE,OAAO,EAC/B,EAAE,aAAa,EAAE,iBAAiB,OAAO,EAAE,EAAE,EAC7C,CAAC,KAAa,EAAE,GAAY,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EACjD,GAAG,EAAE;oBACH,IAAI,QAAQ;wBAAE,OAAO;oBACrB,KAAK,aAAa,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;wBAC7B,IAAI,CAAC,QAAQ;4BAAE,KAAK,QAAQ,EAAE,CAAC;oBACjC,CAAC,CAAC,CAAC;gBACL,CAAC,CACF,CAAC;gBACF,UAAU,GAAG,GAAG,EAAE;oBAChB,IAAI,CAAC;wBACF,GAA8B,CAAC,KAAK,EAAE,EAAE,CAAC;oBAC5C,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;gBACH,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,aAAa,CAAC,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC/D,CAAC;qBAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACrB,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,EAAE,oBAAoB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACpE,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,aAAa,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACtB,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;QAExB,MAAM,QAAQ,EAAE,CAAC;QAEjB,IAAI,CAAC;YACH,MAAM,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kBAAkB,EAAE,CAAC;YACrB,UAAU,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YACnC,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,wBAAwB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrG,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACvF,MAAM,GAAG,EAAgC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6EAA6E;YAC7E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,MAAM,CAAC,wBAAwB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACvF,CAAC,CAAC,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,gFAAgF;QAChF,MAAM,YAAY,GAAG,KAAK,IAAiC,EAAE;YAC3D,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI;iBACpB,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBACnD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;iBAChC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,0EAA0E;QAC1E,2EAA2E;QAC3E,+CAA+C;QAC/C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAChC,IAAI,EAAE,EAAE,CAAC;gBACP,KAAK,gBAAgB,CAAC;oBACpB,GAAG,EAAE,UAAU,EAAE,IAAI,YAAY,SAAS;oBAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,iFAAiF;QACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;gBAChC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO;gBACtC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,uEAAuE;oBACvE,sCAAsC;oBACtC,KAAK,MAAM,IAAI,IAAI,QAAQ;wBAAE,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;oBACtE,OAAO;gBACT,CAAC;gBACD,MAAM,iBAAiB,CAAC;oBACtB,IAAI,EAAE,EAAE;oBACR,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC;oBAC1D,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,qEAAqE;QACrE,sDAAsD;QACtD,OAAO;YACL,UAAU,CAAC,KAAK;gBACd,IAAI,CAAC;oBACH,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,EAAE,IAAI;gBACf,IAAI,CAAC,MAAM;oBAAE,OAAO;gBACpB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC3E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBACvE,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;YACH,CAAC;YACD,IAAI;YACJ,KAAK,CAAC,IAAI;gBACR,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;gBACnC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9B,CAAC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW;QACxB,wEAAwE;QACxE,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAC7C,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,gCAAgC,MAAM,CAAC,cAAc,EAAE;SACvE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;YACjC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,MAAM,mBAAmB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,MAAc,EACd,KAAgC;IAEhC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/E,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CACrC,MAAM,EACN,SAAS,EACT,OAAO,CAAC,QAAS,CAAC,IAAK,EACvB,OAAO,EACP,MAAM,EACN,KAAK,CACN,CAAC;IACF,+EAA+E;IAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM;QAAE,OAAO;IACzC,MAAM,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,EAAU,EAAE,IAAY;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAgB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAQ,GAAyB,EAAE,MAAM,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;AAC/B,CAAC;AAED;sFACsF;AACtF,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;KACpC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB;YACtB,OAAO,oBAAoB,CAAC;QAC9B,KAAK,iBAAiB;YACpB,OAAO,wBAAwB,CAAC;QAClC,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,WAAoB;IACxD,IAAI,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;IACxF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC;IACvE,OAAO,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,MAAM,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACzC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmC;IAChE,MAAM,MAAM,GAAqD;QAC/D,CAAC,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,CAAC;QACjD,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,CAAC;KACzC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,KAAK,MAAM,EAAE,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACvF,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAmC;IAChE,MAAM,IAAI,GAAG,KAAK,EAAE,UAAU,CAAC;IAC/B,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,WAAW,MAAM,cAAc,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;IAC/B,IAAI,OAAO,EAAE,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,YAAY,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAC/E,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO,MAAM,KAAK,iBAAiB,IAAI,MAAM,KAAK,mBAAmB,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACpG,CAAC;AAED,SAAS,KAAK,CAAC,GAAY;IACzB,MAAM,CAAC,GAAG,GAAiF,CAAC;IAC5F,OAAO,CAAC,EAAE,UAAU,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,KAAK,GAAG,CAAC;AACrF,CAAC;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/k8s/pod-spec.d.ts

@@ -1,7 +1,7 @@
 import type { V1Pod } from "@kubernetes/client-node";
 import type { K8sRunnerConfig } from "../config.js";
 import type { ResolvedLimits } from "../limits.js";
-import type { PortMapping } from "@telorun/runner-core";
+import type { PortMapping, PullPolicy } from "@telorun/runner-core";
 export interface BuildPodArgs {
     config: K8sRunnerConfig;
     sessionId: string;
@@ -38,4 +38,27 @@ export declare const INSPECT_PORT = 9230;
  * `readOnlyRootFilesystem` stays on — every write lands on a mounted emptyDir.
  */
 export declare function buildSessionPod(args: BuildPodArgs): V1Pod;
+export interface BuildAppPodArgs {
+    config: K8sRunnerConfig;
+    sessionId: string;
+    podName: string;
+    env: Record<string, string>;
+    ports: PortMapping[];
+    limits: ResolvedLimits;
+    /** Self-contained image from the operator's app catalog — app + controllers
+     *  baked in; the pod runs the image's own entrypoint. */
+    image: string;
+    pullPolicy: PullPolicy;
+}
+/**
+ * Builds a Pod for an operator-predefined app session (`RUNNER_APPS`). Unlike
+ * session pods the image is operator-curated, not anonymous code, so the
+ * write-path hardening is relaxed: the image's own filesystem layout and user
+ * apply (a self-contained app may write inside its own image directories),
+ * with no rootfs read-only forcing and no bundle initContainer. Everything
+ * else stays on: seccomp RuntimeDefault, all capabilities dropped, no
+ * privilege escalation, no ServiceAccount token, the sandbox RuntimeClass when
+ * configured, and the app resource ceilings.
+ */
+export declare function buildAppPod(args: BuildAppPodArgs): V1Pod;
 //# sourceMappingURL=pod-spec.d.ts.map

package/dist/k8s/pod-spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pod-spec.d.ts","sourceRoot":"","sources":["../../src/k8s/pod-spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB;;;iFAG6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd;0EACsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB;;oFAEgF;IAChF,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;gFAEgF;AAChF,eAAO,MAAM,YAAY,OAAO,CAAC;AAajC;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,KAAK,CAoHzD"}
+{"version":3,"file":"pod-spec.d.ts","sourceRoot":"","sources":["../../src/k8s/pod-spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB;;;iFAG6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd;0EACsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB;;oFAEgF;IAChF,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;gFAEgF;AAChF,eAAO,MAAM,YAAY,OAAO,CAAC;AAajC;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,KAAK,CAoHzD;AAWD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB;6DACyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,KAAK,CA2DxD"}

package/dist/k8s/pod-spec.js

@@ -143,4 +143,83 @@ function hardenedContainerSecurity() {
         capabilities: { drop: ["ALL"] },
     };
 }
+/**
+ * Builds a Pod for an operator-predefined app session (`RUNNER_APPS`). Unlike
+ * session pods the image is operator-curated, not anonymous code, so the
+ * write-path hardening is relaxed: the image's own filesystem layout and user
+ * apply (a self-contained app may write inside its own image directories),
+ * with no rootfs read-only forcing and no bundle initContainer. Everything
+ * else stays on: seccomp RuntimeDefault, all capabilities dropped, no
+ * privilege escalation, no ServiceAccount token, the sandbox RuntimeClass when
+ * configured, and the app resource ceilings.
+ */
+export function buildAppPod(args) {
+    const { config, limits } = args;
+    return {
+        apiVersion: "v1",
+        kind: "Pod",
+        metadata: {
+            name: args.podName,
+            namespace: config.sessionNamespace,
+            labels: {
+                "app.kubernetes.io/managed-by": config.managedByLabel,
+                "telo.run/session-id": args.sessionId,
+            },
+        },
+        spec: {
+            restartPolicy: "Never",
+            activeDeadlineSeconds: limits.ttlSeconds,
+            automountServiceAccountToken: false,
+            ...(config.build.imagePullSecret
+                ? { imagePullSecrets: [{ name: config.build.imagePullSecret }] }
+                : {}),
+            ...(config.runtimeClass ? { runtimeClassName: config.runtimeClass } : {}),
+            securityContext: {
+                seccompProfile: { type: "RuntimeDefault" },
+            },
+            containers: [
+                {
+                    name: "session",
+                    image: args.image,
+                    imagePullPolicy: pullPolicyToK8s(args.pullPolicy),
+                    env: [
+                        ...Object.entries(args.env).map(([name, value]) => ({ name, value })),
+                        { name: "FORCE_COLOR", value: "1" },
+                    ],
+                    stdin: true,
+                    stdinOnce: false,
+                    tty: true,
+                    ...(args.ports.length > 0
+                        ? { ports: args.ports.map((p) => ({ containerPort: p.port, protocol: p.protocol.toUpperCase() })) }
+                        : {}),
+                    resources: {
+                        limits: {
+                            cpu: limits.cpu,
+                            memory: limits.memory,
+                            "ephemeral-storage": limits.ephemeralStorage,
+                        },
+                        requests: {
+                            cpu: limits.cpu,
+                            memory: limits.memory,
+                        },
+                    },
+                    securityContext: {
+                        allowPrivilegeEscalation: false,
+                        capabilities: { drop: ["ALL"] },
+                    },
+                },
+            ],
+        },
+    };
+}
+function pullPolicyToK8s(policy) {
+    switch (policy) {
+        case "always":
+            return "Always";
+        case "never":
+            return "Never";
+        default:
+            return "IfNotPresent";
+    }
+}
 //# sourceMappingURL=pod-spec.js.map

package/dist/k8s/pod-spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"pod-spec.js","sourceRoot":"","sources":["../../src/k8s/pod-spec.ts"],"names":[],"mappings":"AA4BA;;gFAEgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AAEjC,MAAM,OAAO,GAAG,MAAM,CAAC;AACvB,MAAM,QAAQ,GAAG,OAAO,CAAC;AACzB;;0BAE0B;AAC1B,MAAM,QAAQ,GAAG,aAAa,CAAC;AAC/B;wDACwD;AACxD,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEhC,MAAM,SAAS,GAAG;QAChB,MAAM,EAAE;YACN,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,mBAAmB,EAAE,MAAM,CAAC,gBAAgB;SAC7C;QACD,QAAQ,EAAE;YACR,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACnF,gFAAgF;IAChF,kEAAkE;IAClE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,QAAQ,OAAO,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAElD,MAAM,GAAG,GAAU;QACjB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE;YACR,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,SAAS,EAAE,MAAM,CAAC,gBAAgB;YAClC,MAAM,EAAE;gBACN,8BAA8B,EAAE,MAAM,CAAC,cAAc;gBACrD,qBAAqB,EAAE,IAAI,CAAC,SAAS;aACtC;SACF;QACD,IAAI,EAAE;YACJ,aAAa,EAAE,OAAO;YACtB,qBAAqB,EAAE,MAAM,CAAC,UAAU;YACxC,4BAA4B,EAAE,KAAK;YACnC,2EAA2E;YAC3E,6DAA6D;YAC7D,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe;gBAC9B,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,eAAe,EAAE;gBACf,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;aAC3C;YACD,cAAc,EAAE;gBACd;oBACE,oEAAoE;oBACpE,qEAAqE;oBACrE,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,MAAM,CAAC,SAAS;oBACvB,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;oBACrB,IAAI,EAAE;wBACJ,mCAAmC,IAAI,CAAC,SAAS,+BAA+B,OAAO,EAAE;qBAC1F;oBACD,YAAY,EAAE;wBACZ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE;wBACnC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE;qBACtC;oBACD,eAAe,EAAE,yBAAyB,EAAE;iBAC7C;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,qEAAqE;oBACrE,qEAAqE;oBACrE,eAAe,EAAE,cAAc;oBAC/B,oEAAoE;oBACpE,qEAAqE;oBACrE,uEAAuE;oBACvE,sEAAsE;oBACtE,UAAU,EAAE,QAAQ;oBACpB,qEAAqE;oBACrE,oEAAoE;oBACpE,OAAO,EAAE;wBACP,MAAM;wBACN,KAAK;wBACL,GAAG,OAAO,IAAI,IAAI,CAAC,iBAAiB,EAAE;wBACtC,kBAAkB;wBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,YAAY,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC/E;oBACD,GAAG,EAAE,OAAO;oBACZ,KAAK,EAAE,IAAI;oBACX,SAAS,EAAE,KAAK;oBAChB,GAAG,EAAE,IAAI;oBACT,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;wBACvB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE;wBACnG,CAAC,CAAC,EAAE,CAAC;oBACP,SAAS;oBACT,YAAY,EAAE;wBACZ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE;wBACnC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;wBACrC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;wBACrC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE;qBACtC;oBACD,eAAe,EAAE,yBAAyB,EAAE;iBAC7C;aACF;YACD,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;gBAC7B,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;gBAC9B,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;gBAC9B,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;aAC9B;SACF;KACF,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO;QACL,wBAAwB,EAAE,KAAK;QAC/B,sBAAsB,EAAE,IAAI;QAC5B,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;KAChC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pod-spec.js","sourceRoot":"","sources":["../../src/k8s/pod-spec.ts"],"names":[],"mappings":"AA4BA;;gFAEgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AAEjC,MAAM,OAAO,GAAG,MAAM,CAAC;AACvB,MAAM,QAAQ,GAAG,OAAO,CAAC;AACzB;;0BAE0B;AAC1B,MAAM,QAAQ,GAAG,aAAa,CAAC;AAC/B;wDACwD;AACxD,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEhC,MAAM,SAAS,GAAG;QAChB,MAAM,EAAE;YACN,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,mBAAmB,EAAE,MAAM,CAAC,gBAAgB;SAC7C;QACD,QAAQ,EAAE;YACR,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACnF,gFAAgF;IAChF,kEAAkE;IAClE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,QAAQ,OAAO,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAElD,MAAM,GAAG,GAAU;QACjB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE;YACR,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,SAAS,EAAE,MAAM,CAAC,gBAAgB;YAClC,MAAM,EAAE;gBACN,8BAA8B,EAAE,MAAM,CAAC,cAAc;gBACrD,qBAAqB,EAAE,IAAI,CAAC,SAAS;aACtC;SACF;QACD,IAAI,EAAE;YACJ,aAAa,EAAE,OAAO;YACtB,qBAAqB,EAAE,MAAM,CAAC,UAAU;YACxC,4BAA4B,EAAE,KAAK;YACnC,2EAA2E;YAC3E,6DAA6D;YAC7D,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe;gBAC9B,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,eAAe,EAAE;gBACf,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;aAC3C;YACD,cAAc,EAAE;gBACd;oBACE,oEAAoE;oBACpE,qEAAqE;oBACrE,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,MAAM,CAAC,SAAS;oBACvB,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;oBACrB,IAAI,EAAE;wBACJ,mCAAmC,IAAI,CAAC,SAAS,+BAA+B,OAAO,EAAE;qBAC1F;oBACD,YAAY,EAAE;wBACZ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE;wBACnC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE;qBACtC;oBACD,eAAe,EAAE,yBAAyB,EAAE;iBAC7C;aACF;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,qEAAqE;oBACrE,qEAAqE;oBACrE,eAAe,EAAE,cAAc;oBAC/B,oEAAoE;oBACpE,qEAAqE;oBACrE,uEAAuE;oBACvE,sEAAsE;oBACtE,UAAU,EAAE,QAAQ;oBACpB,qEAAqE;oBACrE,oEAAoE;oBACpE,OAAO,EAAE;wBACP,MAAM;wBACN,KAAK;wBACL,GAAG,OAAO,IAAI,IAAI,CAAC,iBAAiB,EAAE;wBACtC,kBAAkB;wBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,YAAY,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC/E;oBACD,GAAG,EAAE,OAAO;oBACZ,KAAK,EAAE,IAAI;oBACX,SAAS,EAAE,KAAK;oBAChB,GAAG,EAAE,IAAI;oBACT,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;wBACvB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE;wBACnG,CAAC,CAAC,EAAE,CAAC;oBACP,SAAS;oBACT,YAAY,EAAE;wBACZ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE;wBACnC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;wBACrC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;wBACrC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE;qBACtC;oBACD,eAAe,EAAE,yBAAyB,EAAE;iBAC7C;aACF;YACD,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;gBAC7B,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;gBAC9B,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;gBAC9B,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;aAC9B;SACF;KACF,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO;QACL,wBAAwB,EAAE,KAAK;QAC/B,sBAAsB,EAAE,IAAI;QAC5B,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;KAChC,CAAC;AACJ,CAAC;AAeD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEhC,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE;YACR,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,SAAS,EAAE,MAAM,CAAC,gBAAgB;YAClC,MAAM,EAAE;gBACN,8BAA8B,EAAE,MAAM,CAAC,cAAc;gBACrD,qBAAqB,EAAE,IAAI,CAAC,SAAS;aACtC;SACF;QACD,IAAI,EAAE;YACJ,aAAa,EAAE,OAAO;YACtB,qBAAqB,EAAE,MAAM,CAAC,UAAU;YACxC,4BAA4B,EAAE,KAAK;YACnC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe;gBAC9B,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,eAAe,EAAE;gBACf,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;aAC3C;YACD,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;oBACjD,GAAG,EAAE;wBACH,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;wBACrE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE;qBACpC;oBACD,KAAK,EAAE,IAAI;oBACX,SAAS,EAAE,KAAK;oBAChB,GAAG,EAAE,IAAI;oBACT,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;wBACvB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE;wBACnG,CAAC,CAAC,EAAE,CAAC;oBACP,SAAS,EAAE;wBACT,MAAM,EAAE;4BACN,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,mBAAmB,EAAE,MAAM,CAAC,gBAAgB;yBAC7C;wBACD,QAAQ,EAAE;4BACR,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,MAAM,EAAE,MAAM,CAAC,MAAM;yBACtB;qBACF;oBACD,eAAe,EAAE;wBACf,wBAAwB,EAAE,KAAK;wBAC/B,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;qBAChC;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAkB;IACzC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,cAAc,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAIhB,KAAK,aAAa,EAClB,KAAK,YAAY,EAElB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAM3F,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;qFACiF;IACjF,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAyBzE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAKhB,KAAK,aAAa,EAClB,KAAK,YAAY,EAElB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAM3F,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;qFACiF;IACjF,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAkCzE"}

package/dist/server.js

@@ -1,4 +1,4 @@
-import { BaseImageCatalog, buildServer as coreBuildServer, loadTermsFromEnv, stopAllSessions, } from "@telorun/runner-core";
+import { BaseImageCatalog, buildServer as coreBuildServer, loadResolvedApps, loadTermsFromEnv, stopAllSessions, } from "@telorun/runner-core";
 import packageJson from "../package.json" with { type: "json" };
 import { BundleStore } from "./bundle-store.js";
 import { kubernetesRunnerCapabilities } from "./capabilities.js";
@@ -15,8 +15,17 @@ export async function buildServer(deps) {
         backend: deps.backend,
         config: deps.config,
         version: VERSION,
-        capabilities: () => kubernetesRunnerCapabilities(deps.config.defaultImage, terms, catalog?.current()),
+        capabilities: () => kubernetesRunnerCapabilities({
+            displayName: deps.config.displayName,
+            description: deps.config.description,
+            defaultImage: deps.config.defaultImage,
+            terms,
+            imageEnum: catalog?.current(),
+        }),
         defaultRegistryUrl: process.env.TELO_REGISTRY_URL,
+        // Operator-predefined apps (RUNNER_APPS; none when unset). Advertised on
+        // /v1/capabilities; app sessions run the catalog image directly (no build).
+        apps: loadResolvedApps(process.env),
         validateConfig: catalog
             ? (sessionConfig) => catalog.isAllowed(sessionConfig.image)
                 ? undefined

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,WAAW,IAAI,eAAe,EAC9B,gBAAgB,EAChB,eAAe,GAIhB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAwB,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,OAAO,GAAW,WAAW,CAAC,OAAO,CAAC;AAW5C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,GAAG,EAAE,CACjB,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACnF,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QACjD,cAAc,EAAE,OAAO;YACrB,CAAC,CAAC,CAAC,aAA4B,EAAsB,EAAE,CACnD,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC;gBACpC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,eAAe,aAAa,CAAC,KAAK,mCAAmC;oBACrE,mBAAmB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACzD,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IACH,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,OAAO;QAC7C,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACnB,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU;YAC9C,UAAU,EAAE,MAAM,CAAC,YAAY;YAC/B,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM;YACtC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK;YACpC,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,CAAC,iBAAiB;SAC7D,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAEvF,gFAAgF;IAChF,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO;aACV,OAAO,EAAE;aACT,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,uEAAuE,CAAC,CAC/F,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,qEAAqE;IACrE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9D,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,IAAI,YAAY,EAAE,CAAC;IACjB,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,WAAW,IAAI,eAAe,EAC9B,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAIhB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAwB,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,OAAO,GAAW,WAAW,CAAC,OAAO,CAAC;AAW5C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,GAAG,EAAE,CACjB,4BAA4B,CAAC;YAC3B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,KAAK;YACL,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE;SAC9B,CAAC;QACJ,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QACjD,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC;QACnC,cAAc,EAAE,OAAO;YACrB,CAAC,CAAC,CAAC,aAA4B,EAAsB,EAAE,CACnD,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC;gBACpC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,eAAe,aAAa,CAAC,KAAK,mCAAmC;oBACrE,mBAAmB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACzD,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IACH,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,OAAO;QAC7C,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACnB,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU;YAC9C,UAAU,EAAE,MAAM,CAAC,YAAY;YAC/B,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM;YACtC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK;YACpC,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,CAAC,iBAAiB;SAC7D,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAEvF,gFAAgF;IAChF,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO;aACV,OAAO,EAAE;aACT,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,uEAAuE,CAAC,CAC/F,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,qEAAqE;IACrE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9D,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,IAAI,YAAY,EAAE,CAAC;IACjB,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/k8s-runner",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Telo Kubernetes Runner - HTTP service that runs Telo Applications as sandboxed Kubernetes Pods. A backend over @telorun/runner-core, sibling to docker-runner.",
   "keywords": [
     "telo",
@@ -23,7 +23,7 @@
   "dependencies": {
     "@kubernetes/client-node": "^1.4.0",
     "fastify": "^5.7.2",
-    "@telorun/runner-core": "0.5.2"
+    "@telorun/runner-core": "0.7.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

package/src/capabilities.ts

@@ -4,6 +4,16 @@ import {
   type RunnerTerms,
 } from "@telorun/runner-core";
 
+export interface KubernetesRunnerCapabilitiesOptions {
+  /** Identity shown as the runner's label in the editor; operator-configurable
+   *  via RUNNER_DISPLAY_NAME / RUNNER_DESCRIPTION. */
+  displayName: string;
+  description: string;
+  defaultImage: string;
+  terms?: RunnerTerms;
+  imageEnum?: string[];
+}
+
 /** What k8s-runner advertises on `/v1/capabilities`. The runner serves
  *  untrusted/anonymous code under a hard-ceiling policy. `image` is a base-image
  *  picker: when an `imageEnum` is supplied (the resolved Docker Hub catalog) the
@@ -17,14 +27,13 @@ import {
  *  `terms`, when set (operator-provided via RUNNER_TERMS_*), are enforced: a
  *  session won't start until the client acknowledges the current version. */
 export function kubernetesRunnerCapabilities(
-  defaultImage: string,
-  terms?: RunnerTerms,
-  imageEnum?: string[],
+  opts: KubernetesRunnerCapabilitiesOptions,
 ): RunnerCapabilities {
+  const { displayName, description, defaultImage, terms, imageEnum } = opts;
   return {
-    displayName: "Telo Public Cloud",
-    description:
-      "Runs the Telo application in sandboxed cloud environment with capped CPU and memory.",
+    displayName,
+    description,
+    features: { io: true, ports: true },
     config: {
       schema: sessionConfigSchema({
         imageDefault: defaultImage,
@@ -34,7 +43,6 @@ export function kubernetesRunnerCapabilities(
           "Base-image freshness. `always` rebuilds the session image when the base tag has moved upstream (Docker Hub only); `missing` and `never` reuse the cached build.",
       }),
     },
-    features: { io: true, ports: true },
     terms,
   };
 }

package/src/config.ts

@@ -76,6 +76,10 @@ export interface ImageBuildConfig {
 }
 
 export interface K8sRunnerConfig extends RunnerCoreConfig {
+  /** Identity advertised on `/v1/capabilities` — the editor labels the runner
+   *  with these. */
+  displayName: string;
+  description: string;
   /** Namespace where session Pods/Services/Ingresses are created. */
   sessionNamespace: string;
   /** Default image for spawned session Pods (telorun/node). */
@@ -100,6 +104,11 @@ export interface K8sRunnerConfig extends RunnerCoreConfig {
   /** Label applied to every session object, used for orphan reaping. */
   managedByLabel: string;
   limits: LimitCeilings;
+  /** Ceilings for operator-predefined app sessions (`RUNNER_APPS`). Separate
+   *  from `limits` — apps are operator-curated and long-lived, so they get
+   *  roomier defaults than anonymous session code without loosening the
+   *  anonymous ceiling. */
+  appLimits: LimitCeilings;
   /** Menu of base images a session may pick (advertised as the `image` enum). */
   baseImageCatalog: BaseImageCatalogConfig;
 }
@@ -180,6 +189,9 @@ export function loadK8sRunnerConfig(env: NodeJS.ProcessEnv): K8sRunnerConfig {
 
   return {
     ...loadCoreConfig(env, { port: DEFAULT_PORT }),
+    displayName: env.RUNNER_DISPLAY_NAME?.trim() || "Telo Runner",
+    description:
+      env.RUNNER_DESCRIPTION?.trim() || "Runs the Telo application in a cloud environment",
     sessionNamespace: env.RUNNER_SESSION_NAMESPACE?.trim() || "telo-sessions",
     defaultImage: env.RUNNER_IMAGE?.trim() || "telorun/node:latest-slim",
     initImage: env.RUNNER_INIT_IMAGE?.trim() || "busybox:stable",
@@ -196,6 +208,16 @@ export function loadK8sRunnerConfig(env: NodeJS.ProcessEnv): K8sRunnerConfig {
       ttlSeconds: parsePositiveInt(env.RUNNER_MAX_TTL_SECONDS, 3600, "RUNNER_MAX_TTL_SECONDS"),
       ephemeralStorage: env.RUNNER_MAX_EPHEMERAL_STORAGE?.trim() || "512Mi",
     },
+    appLimits: {
+      cpu: env.RUNNER_APP_MAX_CPU?.trim() || "500m",
+      memory: env.RUNNER_APP_MAX_MEMORY?.trim() || "512Mi",
+      ttlSeconds: parsePositiveInt(
+        env.RUNNER_APP_MAX_TTL_SECONDS,
+        21600,
+        "RUNNER_APP_MAX_TTL_SECONDS",
+      ),
+      ephemeralStorage: env.RUNNER_APP_MAX_EPHEMERAL_STORAGE?.trim() || "1Gi",
+    },
     baseImageCatalog: loadBaseImageCatalogConfig(env),
   };
 }

package/src/k8s/backend.ts

@@ -9,7 +9,7 @@ import type {
   RunStatus,
   RunnerBackend,
 } from "@telorun/runner-core";
-import { relayDebugStream, SessionStartError } from "@telorun/runner-core";
+import { relayDebugStream, SessionStartError, watchReachability } from "@telorun/runner-core";
 
 import type { BundleStore } from "../bundle-store.js";
 import type { K8sRunnerConfig } from "../config.js";
@@ -17,7 +17,7 @@ import { clampLimits } from "../limits.js";
 import type { KubeClient } from "./client.js";
 import { ensureSessionImage } from "./image-build.js";
 import { buildSessionIngress, buildSessionService, endpointsFor } from "./ingress.js";
-import { buildSessionPod, INSPECT_PORT } from "./pod-spec.js";
+import { buildAppPod, buildSessionPod, INSPECT_PORT } from "./pod-spec.js";
 
 /** Minimal surface of the websocket client-node's Attach returns. */
 interface ResizableSocket {
@@ -68,47 +68,65 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
     // The /v1 contract carries no per-request limits yet, so `requested` is
     // undefined and the configured ceiling is always the effective limit. When
     // a control plane begins passing limits, plumb them here — the clamp is
-    // already min(requested, ceiling).
-    const limits = clampLimits(config.limits, undefined);
-
-    // Prebuild a self-contained per-app image on-cluster (controllers + module
-    // manifests baked in) and run it directly. Controller resolution never
-    // happens on the session start path, so a slow or unreachable package
-    // registry can't stall a session. Throws SessionStartError on a build
-    // failure, carrying the build pod's log tail.
-    const image = await ensureSessionImage(
-      {
-        kube,
-        build: config.build,
-        bundleStore,
-        initImage: config.initImage,
-        managedByLabel: config.managedByLabel,
-      },
-      {
-        bundle: spec.bundle,
-        entryRelativePath: spec.entryRelativePath,
-        baseImage: spec.config.image || config.defaultImage,
+    // already min(requested, ceiling). App sessions (operator-curated,
+    // long-lived) get their own roomier ceilings.
+    const limits = clampLimits(spec.selfContained ? config.appLimits : config.limits, undefined);
+
+    let pod: V1Pod;
+    if (spec.selfContained) {
+      // Operator-predefined app (catalog image): self-contained, no build and
+      // no bundle to deliver — the pod runs the image's own entrypoint with
+      // the env the core route already merged.
+      pod = buildAppPod({
+        config,
+        sessionId: spec.sessionId,
+        podName,
+        env: spec.env,
+        ports: spec.ports,
+        limits,
+        image: spec.config.image,
         pullPolicy: spec.config.pullPolicy,
-        onProgress: (message, done) => spec.onProgress("build", message, done),
-      },
-    );
-
-    // The image is keyed on the dependency closure only, so deliver the
-    // per-session body to the Pod's /app at boot via a tokenized, single-use URL.
-    const bundleUrl = await bundleStore.stageSessionBundle(spec.sessionId, spec.bundle);
-
-    const pod = buildSessionPod({
-      config,
-      sessionId: spec.sessionId,
-      podName,
-      entryRelativePath: spec.entryRelativePath,
-      env: spec.env,
-      ports: spec.ports,
-      limits,
-      image,
-      bundleUrl,
-      inspect: spec.inspect,
-    });
+      });
+    } else {
+      // Prebuild a self-contained per-app image on-cluster (controllers + module
+      // manifests baked in) and run it directly. Controller resolution never
+      // happens on the session start path, so a slow or unreachable package
+      // registry can't stall a session. Throws SessionStartError on a build
+      // failure, carrying the build pod's log tail.
+      const image = await ensureSessionImage(
+        {
+          kube,
+          build: config.build,
+          bundleStore,
+          initImage: config.initImage,
+          managedByLabel: config.managedByLabel,
+        },
+        {
+          bundle: spec.bundle,
+          entryRelativePath: spec.entryRelativePath,
+          baseImage: spec.config.image || config.defaultImage,
+          pullPolicy: spec.config.pullPolicy,
+          onProgress: (message, done) => spec.onProgress("build", message, done),
+        },
+      );
+
+      // The image is keyed on the dependency closure only, so deliver the
+      // per-session body to the Pod's /app at boot via a tokenized, single-use URL.
+      const bundleUrl = await bundleStore.stageSessionBundle(spec.sessionId, spec.bundle);
+
+      pod = buildSessionPod({
+        config,
+        sessionId: spec.sessionId,
+        podName,
+        entryRelativePath: spec.entryRelativePath,
+        env: spec.env,
+        ports: spec.ports,
+        limits,
+        image,
+        bundleUrl,
+        inspect: spec.inspect,
+      });
+    }
 
     let podUid: string;
     try {
@@ -129,6 +147,7 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
     let startDeadline: NodeJS.Timeout | undefined;
     let podIP: string | undefined;
     const debugAbort = new AbortController();
+    const reachAbort = new AbortController();
 
     const stdin = new PassThrough();
     const stdout = new Writable({
@@ -151,6 +170,7 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
       clearStartDeadline();
       abortWatch();
       debugAbort.abort();
+      reachAbort.abort();
       bundleStore.drop(spec.sessionId);
       spec.onStatus(status);
       try {
@@ -292,20 +312,25 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
       });
     }
 
+    // The Running watch event usually carries `podIP`; if it lagged, read the
+    // pod once and cache it — shared by the debug relay and the reachability check.
+    const resolvePodIP = async (): Promise<string | undefined> => {
+      if (podIP) return podIP;
+      podIP = await kube.core
+        .readNamespacedPod({ name: podName, namespace: ns })
+        .then((p) => podStatus(p)?.podIP)
+        .catch(() => undefined);
+      return podIP;
+    };
+
     // When inspect is on, relay the workload's in-pod kernel debug stream out
     // over `onDebug`. Reached by pod IP over the cluster network — the inspect
-    // port is never published via Service/Ingress. The Running watch event
-    // usually carries `podIP`; if it lagged, read the pod once to recover it.
+    // port is never published via Service/Ingress.
     if (spec.inspect) {
-      if (!podIP) {
-        podIP = await kube.core
-          .readNamespacedPod({ name: podName, namespace: ns })
-          .then((p) => podStatus(p)?.podIP)
-          .catch(() => undefined);
-      }
-      if (podIP) {
+      const ip = await resolvePodIP();
+      if (ip) {
         void relayDebugStream({
-          url: `http://${podIP}:${INSPECT_PORT}/events`,
+          url: `http://${ip}:${INSPECT_PORT}/events`,
           onFrame: spec.onDebug,
           signal: debugAbort.signal,
         });
@@ -314,6 +339,30 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
       }
     }
 
+    // Reachability check: a workload bound to 127.0.0.1 (or listening on the
+    // wrong port) is unreachable on the pod network and surfaces only as a
+    // downstream 502. Watch each advertised tcp port from the runner and report
+    // per-port state to the editor's endpoint badge. Background; finish() aborts it.
+    const tcpPorts = spec.ports.filter((p) => p.protocol === "tcp").map((p) => p.port);
+    if (tcpPorts.length > 0) {
+      void (async () => {
+        const ip = await resolvePodIP();
+        if (reachAbort.signal.aborted) return;
+        if (!ip) {
+          // Couldn't resolve the pod IP to probe — report unverified rather than
+          // leaving the badge spinning forever.
+          for (const port of tcpPorts) spec.onReachability(port, "unreachable");
+          return;
+        }
+        await watchReachability({
+          host: ip,
+          ports: tcpPorts,
+          onState: (port, state) => spec.onReachability(port, state),
+          signal: reachAbort.signal,
+        });
+      })();
+    }
+
     // `flipRunning` already announced `running` from the watch's Running
     // transition (which `await running` above waited on).
     return {

package/src/k8s/pod-spec.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it } from "vitest";
+
+import { loadK8sRunnerConfig } from "../config.js";
+import { buildAppPod } from "./pod-spec.js";
+
+const BASE_ENV = {
+  RUNNER_SELF_URL: "http://k8s-runner.telo-runner.svc:8062",
+  RUNNER_IMAGE_REPOSITORY: "registry.telo-runner.svc:5000/telo-sessions",
+};
+
+describe("buildAppPod", () => {
+  const config = loadK8sRunnerConfig({ ...process.env, ...BASE_ENV });
+  const pod = buildAppPod({
+    config,
+    sessionId: "abc123",
+    podName: "telo-run-abc123",
+    env: { SERVICE_TOKEN: "tok-operator", TELO_REGISTRY_URL: "https://registry.telo.run" },
+    ports: [{ port: 8080, protocol: "tcp" }],
+    limits: config.appLimits,
+    image: "acme/tool:1",
+    pullPolicy: "always",
+  });
+
+  it("runs the catalog image's own entrypoint — no build, no bundle initContainer", () => {
+    const container = pod.spec!.containers[0];
+    expect(pod.spec!.initContainers).toBeUndefined();
+    expect(container.image).toBe("acme/tool:1");
+    expect(container.command).toBeUndefined();
+    expect(container.imagePullPolicy).toBe("Always");
+  });
+
+  it("injects the merged env and declares the requested ports", () => {
+    const container = pod.spec!.containers[0];
+    expect(container.env).toContainEqual({ name: "SERVICE_TOKEN", value: "tok-operator" });
+    expect(container.ports).toEqual([{ containerPort: 8080, protocol: "TCP" }]);
+  });
+
+  it("applies app ceilings and TTL, keeping non-write hardening on", () => {
+    const container = pod.spec!.containers[0];
+    expect(container.resources?.limits?.memory).toBe("512Mi");
+    expect(pod.spec!.activeDeadlineSeconds).toBe(21600);
+    expect(pod.spec!.automountServiceAccountToken).toBe(false);
+    expect(pod.spec!.securityContext?.seccompProfile?.type).toBe("RuntimeDefault");
+    expect(container.securityContext).toEqual({
+      allowPrivilegeEscalation: false,
+      capabilities: { drop: ["ALL"] },
+    });
+    // Write-path hardening is deliberately relaxed: the operator-curated image
+    // owns its filesystem layout and user.
+    expect(container.securityContext).not.toHaveProperty("readOnlyRootFilesystem");
+    expect(pod.spec!.securityContext).not.toHaveProperty("runAsNonRoot");
+  });
+
+  it("labels the pod for orphan reaping like session pods", () => {
+    expect(pod.metadata?.labels).toMatchObject({
+      "app.kubernetes.io/managed-by": "telo-k8s-runner",
+      "telo.run/session-id": "abc123",
+    });
+  });
+});

package/src/k8s/pod-spec.ts

@@ -2,7 +2,7 @@ import type { V1Pod } from "@kubernetes/client-node";
 
 import type { K8sRunnerConfig } from "../config.js";
 import type { ResolvedLimits } from "../limits.js";
-import type { PortMapping } from "@telorun/runner-core";
+import type { PortMapping, PullPolicy } from "@telorun/runner-core";
 
 export interface BuildPodArgs {
   config: K8sRunnerConfig;
@@ -178,3 +178,98 @@ function hardenedContainerSecurity(): Record<string, unknown> {
     capabilities: { drop: ["ALL"] },
   };
 }
+
+export interface BuildAppPodArgs {
+  config: K8sRunnerConfig;
+  sessionId: string;
+  podName: string;
+  env: Record<string, string>;
+  ports: PortMapping[];
+  limits: ResolvedLimits;
+  /** Self-contained image from the operator's app catalog — app + controllers
+   *  baked in; the pod runs the image's own entrypoint. */
+  image: string;
+  pullPolicy: PullPolicy;
+}
+
+/**
+ * Builds a Pod for an operator-predefined app session (`RUNNER_APPS`). Unlike
+ * session pods the image is operator-curated, not anonymous code, so the
+ * write-path hardening is relaxed: the image's own filesystem layout and user
+ * apply (a self-contained app may write inside its own image directories),
+ * with no rootfs read-only forcing and no bundle initContainer. Everything
+ * else stays on: seccomp RuntimeDefault, all capabilities dropped, no
+ * privilege escalation, no ServiceAccount token, the sandbox RuntimeClass when
+ * configured, and the app resource ceilings.
+ */
+export function buildAppPod(args: BuildAppPodArgs): V1Pod {
+  const { config, limits } = args;
+
+  return {
+    apiVersion: "v1",
+    kind: "Pod",
+    metadata: {
+      name: args.podName,
+      namespace: config.sessionNamespace,
+      labels: {
+        "app.kubernetes.io/managed-by": config.managedByLabel,
+        "telo.run/session-id": args.sessionId,
+      },
+    },
+    spec: {
+      restartPolicy: "Never",
+      activeDeadlineSeconds: limits.ttlSeconds,
+      automountServiceAccountToken: false,
+      ...(config.build.imagePullSecret
+        ? { imagePullSecrets: [{ name: config.build.imagePullSecret }] }
+        : {}),
+      ...(config.runtimeClass ? { runtimeClassName: config.runtimeClass } : {}),
+      securityContext: {
+        seccompProfile: { type: "RuntimeDefault" },
+      },
+      containers: [
+        {
+          name: "session",
+          image: args.image,
+          imagePullPolicy: pullPolicyToK8s(args.pullPolicy),
+          env: [
+            ...Object.entries(args.env).map(([name, value]) => ({ name, value })),
+            { name: "FORCE_COLOR", value: "1" },
+          ],
+          stdin: true,
+          stdinOnce: false,
+          tty: true,
+          ...(args.ports.length > 0
+            ? { ports: args.ports.map((p) => ({ containerPort: p.port, protocol: p.protocol.toUpperCase() })) }
+            : {}),
+          resources: {
+            limits: {
+              cpu: limits.cpu,
+              memory: limits.memory,
+              "ephemeral-storage": limits.ephemeralStorage,
+            },
+            requests: {
+              cpu: limits.cpu,
+              memory: limits.memory,
+            },
+          },
+          securityContext: {
+            allowPrivilegeEscalation: false,
+            capabilities: { drop: ["ALL"] },
+          },
+        },
+      ],
+    },
+  };
+}
+
+function pullPolicyToK8s(policy: PullPolicy): string {
+  switch (policy) {
+    case "always":
+      return "Always";
+    case "never":
+      return "Never";
+    default:
+      return "IfNotPresent";
+  }
+}

package/src/server.ts

@@ -1,6 +1,7 @@
 import {
   BaseImageCatalog,
   buildServer as coreBuildServer,
+  loadResolvedApps,
   loadTermsFromEnv,
   stopAllSessions,
   type RunnerBackend,
@@ -37,8 +38,17 @@ export async function buildServer(deps: ServerDeps): Promise<ServerHandle> {
     config: deps.config,
     version: VERSION,
     capabilities: () =>
-      kubernetesRunnerCapabilities(deps.config.defaultImage, terms, catalog?.current()),
+      kubernetesRunnerCapabilities({
+        displayName: deps.config.displayName,
+        description: deps.config.description,
+        defaultImage: deps.config.defaultImage,
+        terms,
+        imageEnum: catalog?.current(),
+      }),
     defaultRegistryUrl: process.env.TELO_REGISTRY_URL,
+    // Operator-predefined apps (RUNNER_APPS; none when unset). Advertised on
+    // /v1/capabilities; app sessions run the catalog image directly (no build).
+    apps: loadResolvedApps(process.env),
     validateConfig: catalog
       ? (sessionConfig: SessionConfig): string | undefined =>
           catalog.isAllowed(sessionConfig.image)