@telorun/k8s-runner 0.6.0

package/dist/k8s/backend.js

@@ -0,0 +1,488 @@
+import { PassThrough, Writable } from "node:stream";
+import { relayDebugStream, SessionStartError } from "@telorun/runner-core";
+import { clampLimits } from "../limits.js";
+import { ensureSessionImage } from "./image-build.js";
+import { buildSessionIngress, buildSessionService, endpointsFor } from "./ingress.js";
+import { buildSessionPod, INSPECT_PORT } from "./pod-spec.js";
+const RESIZE_CHANNEL = 4;
+/** How long a Pod may take to reach Running before the start is abandoned.
+ *  activeDeadlineSeconds only bounds an already-running Pod, so a stuck
+ *  Pending/unschedulable Pod needs this separate runner-side deadline. */
+const START_DEADLINE_MS = 120_000;
+const WATCH_REARM_DELAY_MS = 2_000;
+export function createKubernetesBackend(deps) {
+    const { kube, config, bundleStore } = deps;
+    const ns = config.sessionNamespace;
+    async function probe(_probe) {
+        try {
+            await kube.core.readNamespace({ name: ns });
+        }
+        catch {
+            const reachable = await clusterReachable(kube);
+            if (!reachable) {
+                return {
+                    status: "unavailable",
+                    message: "Kubernetes API server not reachable from the runner.",
+                    remediation: "Check the runner's in-cluster ServiceAccount and RBAC.",
+                };
+            }
+            return {
+                status: "unavailable",
+                message: `Session namespace '${ns}' does not exist.`,
+                remediation: `Install the runner's Helm chart, which provisions the '${ns}' namespace.`,
+            };
+        }
+        return { status: "ready" };
+    }
+    async function start(spec) {
+        const podName = `telo-run-${spec.sessionId}`;
+        // The /v1 contract carries no per-request limits yet, so `requested` is
+        // undefined and the configured ceiling is always the effective limit. When
+        // a control plane begins passing limits, plumb them here — the clamp is
+        // already min(requested, ceiling).
+        const limits = clampLimits(config.limits, undefined);
+        // Prebuild a self-contained per-app image on-cluster (controllers + module
+        // manifests baked in) and run it directly. Controller resolution never
+        // happens on the session start path, so a slow or unreachable package
+        // registry can't stall a session. Throws SessionStartError on a build
+        // failure, carrying the build pod's log tail.
+        const image = await ensureSessionImage({
+            kube,
+            build: config.build,
+            bundleStore,
+            initImage: config.initImage,
+            managedByLabel: config.managedByLabel,
+        }, {
+            bundle: spec.bundle,
+            entryRelativePath: spec.entryRelativePath,
+            baseImage: spec.config.image || config.defaultImage,
+            pullPolicy: spec.config.pullPolicy,
+            onProgress: (message, done) => spec.onProgress("build", message, done),
+        });
+        // The image is keyed on the dependency closure only, so deliver the
+        // per-session body to the Pod's /app at boot via a tokenized, single-use URL.
+        const bundleUrl = await bundleStore.stageSessionBundle(spec.sessionId, spec.bundle);
+        const pod = buildSessionPod({
+            config,
+            sessionId: spec.sessionId,
+            podName,
+            entryRelativePath: spec.entryRelativePath,
+            env: spec.env,
+            ports: spec.ports,
+            limits,
+            image,
+            bundleUrl,
+            inspect: spec.inspect,
+        });
+        let podUid;
+        try {
+            const created = await kube.core.createNamespacedPod({ namespace: ns, body: pod });
+            podUid = created.metadata?.uid ?? "";
+        }
+        catch (err) {
+            throw new SessionStartError("start_failed", "create", `failed to create pod: ${msg(err)}`, msg(err));
+        }
+        let finished = false;
+        let runningSeen = false;
+        let readyFlipped = false;
+        let lastProvision;
+        let resolveDone;
+        const done = new Promise((r) => (resolveDone = r));
+        let socket;
+        let abortWatch = () => { };
+        let startDeadline;
+        let podIP;
+        const debugAbort = new AbortController();
+        const stdin = new PassThrough();
+        const stdout = new Writable({
+            write(chunk, _enc, cb) {
+                if (chunk?.byteLength)
+                    spec.onOutput(Buffer.from(chunk));
+                cb();
+            },
+        });
+        const clearStartDeadline = () => {
+            if (startDeadline) {
+                clearTimeout(startDeadline);
+                startDeadline = undefined;
+            }
+        };
+        const finish = (status) => {
+            if (finished)
+                return;
+            finished = true;
+            clearStartDeadline();
+            abortWatch();
+            debugAbort.abort();
+            bundleStore.drop(spec.sessionId);
+            spec.onStatus(status);
+            try {
+                socket?.close();
+            }
+            catch {
+                /* already closed */
+            }
+            resolveDone();
+        };
+        // Flip the session to `running` when the pod reaches Running. Deterministic
+        // and independent of the session image's telo version — a readiness signal
+        // would couple this to the in-image CLI (and a stale base image would never
+        // flip). The build/provision progress (streamed before this) covers the slow
+        // part; the brief post-Running validation runs while already `running`.
+        const flipRunning = () => {
+            if (readyFlipped || finished)
+                return;
+            readyFlipped = true;
+            spec.onStatus({ kind: "running", endpoints: endpointsFor(config, spec.sessionId, spec.ports) });
+        };
+        let resolveRunning;
+        let rejectRunning;
+        const running = new Promise((res, rej) => {
+            resolveRunning = res;
+            rejectRunning = rej;
+        });
+        const handlePhase = (obj) => {
+            if (finished)
+                return;
+            const phase = podPhase(obj);
+            // Coming-up feed: scheduling / pulling / body delivery / container create.
+            if (!runningSeen) {
+                const provision = provisionMessage(obj);
+                if (provision && provision !== lastProvision) {
+                    lastProvision = provision;
+                    spec.onProgress("provision", provision);
+                }
+            }
+            if (phase === "Running" && !runningSeen) {
+                runningSeen = true;
+                podIP = podStatus(obj)?.podIP;
+                clearStartDeadline();
+                resolveRunning();
+                flipRunning();
+            }
+            else if (phase === "Succeeded") {
+                finish(terminalStatus(obj, spec.isUserStopped()));
+            }
+            else if (phase === "Failed") {
+                if (!runningSeen) {
+                    clearStartDeadline();
+                    rejectRunning(new Error(podFailureMessage(obj)));
+                }
+                finish(terminalStatus(obj, spec.isUserStopped()));
+            }
+        };
+        // One-shot reconcile — covers terminal transitions that landed during a
+        // watch-reconnect gap, or a Pod that vanished entirely.
+        const reconcileOnce = async () => {
+            if (finished)
+                return;
+            try {
+                const current = await kube.core.readNamespacedPod({ name: podName, namespace: ns });
+                handlePhase(current);
+            }
+            catch (err) {
+                if (!is404(err))
+                    return;
+                if (!runningSeen) {
+                    clearStartDeadline();
+                    rejectRunning(new Error("pod disappeared before reaching Running"));
+                }
+                else {
+                    finish({ kind: "failed", message: "pod disappeared" });
+                }
+            }
+        };
+        // k8s watches expire routinely; re-arm on clean close so a healthy
+        // long-lived session (TTL up to 1h) isn't failed by a watch rollover.
+        const armWatch = async () => {
+            if (finished)
+                return;
+            try {
+                const req = await kube.watch.watch(`/api/v1/namespaces/${ns}/pods`, { fieldSelector: `metadata.name=${podName}` }, (_type, obj) => handlePhase(obj), () => {
+                    if (finished)
+                        return;
+                    void reconcileOnce().then(() => {
+                        if (!finished)
+                            void armWatch();
+                    });
+                });
+                abortWatch = () => {
+                    try {
+                        req.abort?.();
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                };
+            }
+            catch (err) {
+                if (!runningSeen) {
+                    clearStartDeadline();
+                    rejectRunning(new Error(`failed to watch pod: ${msg(err)}`));
+                }
+                else if (!finished) {
+                    setTimeout(() => void armWatch(), WATCH_REARM_DELAY_MS).unref?.();
+                }
+            }
+        };
+        startDeadline = setTimeout(() => {
+            if (!runningSeen && !finished) {
+                rejectRunning(new Error("pod did not reach Running within the start deadline"));
+            }
+        }, START_DEADLINE_MS);
+        startDeadline.unref?.();
+        await armWatch();
+        try {
+            await running;
+        }
+        catch (err) {
+            clearStartDeadline();
+            abortWatch();
+            bundleStore.drop(spec.sessionId);
+            await deletePod(kube, ns, podName);
+            throw new SessionStartError("start_failed", "start", `pod failed to start: ${msg(err)}`, msg(err));
+        }
+        // Attach a PTY to the running container: stdout → onOutput, stdin ← writes.
+        try {
+            const ws = await kube.attach.attach(ns, podName, "session", stdout, null, stdin, true);
+            socket = ws;
+        }
+        catch (err) {
+            // Attach failure isn't fatal — status still flows; surface the degraded PTY.
+            spec.onOutput(Buffer.from(`\r\n[runner] failed to attach PTY: ${msg(err)}\r\n`));
+        }
+        if (config.sessionIngressBaseDomain && spec.ports.length > 0) {
+            await createIngress(deps, spec.sessionId, podName, podUid, spec.ports).catch((err) => {
+                spec.onOutput(Buffer.from(`\r\n[runner] failed to create ingress: ${msg(err)}\r\n`));
+            });
+        }
+        // When inspect is on, relay the workload's in-pod kernel debug stream out
+        // over `onDebug`. Reached by pod IP over the cluster network — the inspect
+        // port is never published via Service/Ingress. The Running watch event
+        // usually carries `podIP`; if it lagged, read the pod once to recover it.
+        if (spec.inspect) {
+            if (!podIP) {
+                podIP = await kube.core
+                    .readNamespacedPod({ name: podName, namespace: ns })
+                    .then((p) => podStatus(p)?.podIP)
+                    .catch(() => undefined);
+            }
+            if (podIP) {
+                void relayDebugStream({
+                    url: `http://${podIP}:${INSPECT_PORT}/events`,
+                    onFrame: spec.onDebug,
+                    signal: debugAbort.signal,
+                });
+            }
+            else {
+                spec.onOutput(Buffer.from("\r\n[runner] debug stream unavailable: pod IP unknown\r\n"));
+            }
+        }
+        // `flipRunning` already announced `running` from the watch's Running
+        // transition (which `await running` above waited on).
+        return {
+            writeStdin(bytes) {
+                try {
+                    stdin.write(Buffer.from(bytes));
+                }
+                catch {
+                    /* stream ended */
+                }
+            },
+            resize(cols, rows) {
+                if (!socket)
+                    return;
+                try {
+                    const payload = Buffer.from(JSON.stringify({ Width: cols, Height: rows }));
+                    socket.send(Buffer.concat([Buffer.from([RESIZE_CHANNEL]), payload]));
+                }
+                catch {
+                    /* socket gone */
+                }
+            },
+            done,
+            async stop() {
+                // The route sets userStopped before calling stop(), so the watch (or
+                // this finish) classifies the kill as `stopped`, not `failed`.
+                await deletePod(kube, ns, podName);
+                finish({ kind: "stopped" });
+            },
+        };
+    }
+    async function reapOrphans() {
+        // The session registry is in-memory; on boot a prior process's pods are
+        // orphaned. Delete everything we own by label. Errors propagate to the
+        // caller (the server logs them) rather than being swallowed.
+        const list = await kube.core.listNamespacedPod({
+            namespace: ns,
+            labelSelector: `app.kubernetes.io/managed-by=${config.managedByLabel}`,
+        });
+        const failures = [];
+        for (const item of list.items ?? []) {
+            const name = item.metadata?.name;
+            if (!name)
+                continue;
+            try {
+                await deletePod(kube, ns, name);
+            }
+            catch (err) {
+                failures.push(`${name}: ${msg(err)}`);
+            }
+        }
+        if (failures.length > 0) {
+            throw new Error(`failed to reap ${failures.length} orphan pod(s): ${failures.join("; ")}`);
+        }
+    }
+    return { probe, start, reapOrphans };
+}
+async function createIngress(deps, sessionId, podName, podUid, ports) {
+    const { kube, config } = deps;
+    const ns = config.sessionNamespace;
+    const service = buildSessionService(config, sessionId, podName, podUid, ports);
+    await kube.core.createNamespacedService({ namespace: ns, body: service });
+    const { ingress } = buildSessionIngress(config, sessionId, service.metadata.name, podName, podUid, ports);
+    // No tcp ports → no HTTP-routable rules; the Service still exists for any udp.
+    if (!ingress.spec?.rules?.length)
+        return;
+    await kube.networking.createNamespacedIngress({ namespace: ns, body: ingress });
+}
+async function deletePod(kube, ns, name) {
+    try {
+        await kube.core.deleteNamespacedPod({ name, namespace: ns, gracePeriodSeconds: 0 });
+    }
+    catch (err) {
+        // 404 = already gone (natural exit + GC). Anything else is a real failure.
+        if (!is404(err))
+            throw err;
+    }
+}
+async function clusterReachable(kube) {
+    try {
+        await kube.core.listNamespace();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function podStatus(obj) {
+    return obj?.status;
+}
+function podPhase(obj) {
+    return podStatus(obj)?.phase;
+}
+/** A coming-up message for the editor feed while the Pod is still scheduling /
+ *  pulling / delivering the body / creating the container; undefined once running. */
+function provisionMessage(obj) {
+    const status = podStatus(obj);
+    if (status?.phase !== "Pending")
+        return undefined;
+    const containers = [
+        ...(status.initContainerStatuses ?? []),
+        ...(status.containerStatuses ?? []),
+    ];
+    for (const cs of containers) {
+        const reason = cs.state?.waiting?.reason;
+        if (reason)
+            return humanizeWaitReason(reason);
+    }
+    return "Scheduling";
+}
+function humanizeWaitReason(reason) {
+    switch (reason) {
+        case "ContainerCreating":
+            return "Creating container";
+        case "PodInitializing":
+            return "Delivering application";
+        case "ErrImagePull":
+        case "ImagePullBackOff":
+            return "Pulling image";
+        default:
+            return reason;
+    }
+}
+function terminalStatus(obj, userStopped) {
+    if (userStopped)
+        return { kind: "stopped" };
+    const phase = podPhase(obj);
+    if (phase === "Succeeded")
+        return { kind: "exited", code: containerExitCode(obj) ?? 0 };
+    return { kind: "failed", message: podFailureMessage(obj) };
+}
+// Exit code of the main session container — used to report a clean exit.
+function containerExitCode(obj) {
+    const term = podStatus(obj)?.containerStatuses?.[0]?.state?.terminated;
+    return typeof term?.exitCode === "number" ? term.exitCode : null;
+}
+const MAX_FAILURE_DETAIL = 500;
+/**
+ * Builds an actionable failure message from a terminal Pod status. Init
+ * containers are inspected first: a failed init container leaves the main
+ * container unstarted, so reading only `containerStatuses` would fall through
+ * to the bare "pod failed". For prebuilt session pods the common failure is the
+ * main container itself (image pull, OOM, a non-zero exit).
+ */
+export function podFailureMessage(obj) {
+    const status = podStatus(obj);
+    const fromContainer = firstContainerProblem(status);
+    if (fromContainer)
+        return fromContainer;
+    if (status?.message)
+        return truncateDetail(status.message);
+    if (status?.reason)
+        return status.reason;
+    return "pod failed";
+}
+function firstContainerProblem(status) {
+    const groups = [
+        ["init container", status?.initContainerStatuses],
+        ["container", status?.containerStatuses],
+    ];
+    for (const [label, statuses] of groups) {
+        for (const cs of statuses ?? []) {
+            const problem = containerStateProblem(cs.state) ?? containerStateProblem(cs.lastState);
+            if (problem)
+                return `${label} "${cs.name}" ${problem}`;
+        }
+    }
+    return undefined;
+}
+function containerStateProblem(state) {
+    const term = state?.terminated;
+    if (term && term.exitCode !== 0) {
+        const reason = term.reason ? `${term.reason} ` : "";
+        const detail = term.message ? `: ${truncateDetail(term.message)}` : "";
+        return `failed: ${reason}(exit code ${term.exitCode ?? "unknown"})${detail}`;
+    }
+    const waiting = state?.waiting;
+    if (waiting?.reason && isBlockingWaitReason(waiting.reason)) {
+        const detail = waiting.message ? `: ${truncateDetail(waiting.message)}` : "";
+        return `waiting: ${waiting.reason}${detail}`;
+    }
+    return undefined;
+}
+// Benign transient reasons the kubelet reports while a Pod is still coming up.
+function isBlockingWaitReason(reason) {
+    return reason !== "PodInitializing" && reason !== "ContainerCreating";
+}
+function truncateDetail(text) {
+    const trimmed = text.trim();
+    return trimmed.length > MAX_FAILURE_DETAIL ? `${trimmed.slice(0, MAX_FAILURE_DETAIL)}…` : trimmed;
+}
+function is404(err) {
+    const e = err;
+    return e?.statusCode === 404 || e?.code === 404 || e?.response?.statusCode === 404;
+}
+function msg(err) {
+    if (err instanceof Error)
+        return err.message;
+    if (typeof err === "string")
+        return err;
+    try {
+        return JSON.stringify(err);
+    }
+    catch {
+        return String(err);
+    }
+}
+//# sourceMappingURL=backend.js.map

package/dist/k8s/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../src/k8s/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAWpD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAI3E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAQ9D,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB;;0EAE0E;AAC1E,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAQnC,MAAM,UAAU,uBAAuB,CAAC,IAAoB;IAC1D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAEnC,KAAK,UAAU,KAAK,CAAC,MAAmB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,aAAa;oBACrB,OAAO,EAAE,sDAAsD;oBAC/D,WAAW,EAAE,wDAAwD;iBACtE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,sBAAsB,EAAE,mBAAmB;gBACpD,WAAW,EAAE,0DAA0D,EAAE,cAAc;aACxF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,IAAsB;QACzC,MAAM,OAAO,GAAG,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAErD,2EAA2E;QAC3E,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC;YACE,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW;YACX,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,EACD;YACE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY;YACnD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,UAAU,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;SACvE,CACF,CAAC;QAEF,oEAAoE;QACpE,8EAA8E;QAC9E,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpF,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO;YACP,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM;YACN,KAAK;YACL,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QAEH,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAClF,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,QAAQ,EAAE,yBAAyB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,aAAiC,CAAC;QACtC,IAAI,WAAwB,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,MAAmC,CAAC;QACxC,IAAI,UAAU,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;QACtC,IAAI,aAAyC,CAAC;QAC9C,IAAI,KAAyB,CAAC;QAC9B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QAEzC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;YAC1B,KAAK,CAAC,KAAa,EAAE,IAAI,EAAE,EAAE;gBAC3B,IAAI,KAAK,EAAE,UAAU;oBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzD,EAAE,EAAE,CAAC;YACP,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,kBAAkB,GAAG,GAAS,EAAE;YACpC,IAAI,aAAa,EAAE,CAAC;gBAClB,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5B,aAAa,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAQ,EAAE;YACzC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,kBAAkB,EAAE,CAAC;YACrB,UAAU,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,EAAE,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;YACD,WAAW,EAAE,CAAC;QAChB,CAAC,CAAC;QAEF,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,IAAI,YAAY,IAAI,QAAQ;gBAAE,OAAO;YACrC,YAAY,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC,CAAC;QAEF,IAAI,cAA2B,CAAC;QAChC,IAAI,aAAkC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC7C,cAAc,GAAG,GAAG,CAAC;YACrB,aAAa,GAAG,GAAG,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,CAAC,GAAY,EAAQ,EAAE;YACzC,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,2EAA2E;YAC3E,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACxC,IAAI,SAAS,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;oBAC7C,aAAa,GAAG,SAAS,CAAC;oBAC1B,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxC,WAAW,GAAG,IAAI,CAAC;gBACnB,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;gBAC9B,kBAAkB,EAAE,CAAC;gBACrB,cAAc,EAAE,CAAC;gBACjB,WAAW,EAAE,CAAC;YAChB,CAAC;iBAAM,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,aAAa,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACnD,CAAC;gBACD,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC;QAEF,wEAAwE;QACxE,wDAAwD;QACxD,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;YAC9C,IAAI,QAAQ;gBAAE,OAAO;YACrB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;gBACpF,WAAW,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO;gBACxB,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,aAAa,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;gBACtE,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,mEAAmE;QACnE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;YACzC,IAAI,QAAQ;gBAAE,OAAO;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAChC,sBAAsB,EAAE,OAAO,EAC/B,EAAE,aAAa,EAAE,iBAAiB,OAAO,EAAE,EAAE,EAC7C,CAAC,KAAa,EAAE,GAAY,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EACjD,GAAG,EAAE;oBACH,IAAI,QAAQ;wBAAE,OAAO;oBACrB,KAAK,aAAa,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;wBAC7B,IAAI,CAAC,QAAQ;4BAAE,KAAK,QAAQ,EAAE,CAAC;oBACjC,CAAC,CAAC,CAAC;gBACL,CAAC,CACF,CAAC;gBACF,UAAU,GAAG,GAAG,EAAE;oBAChB,IAAI,CAAC;wBACF,GAA8B,CAAC,KAAK,EAAE,EAAE,CAAC;oBAC5C,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;gBACH,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,aAAa,CAAC,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC/D,CAAC;qBAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACrB,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,EAAE,oBAAoB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACpE,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,aAAa,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACtB,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;QAExB,MAAM,QAAQ,EAAE,CAAC;QAEjB,IAAI,CAAC;YACH,MAAM,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kBAAkB,EAAE,CAAC;YACrB,UAAU,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YACnC,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,wBAAwB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrG,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACvF,MAAM,GAAG,EAAgC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6EAA6E;YAC7E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,MAAM,CAAC,wBAAwB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACvF,CAAC,CAAC,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI;qBACpB,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;qBACnD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;qBAChC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;YACD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,gBAAgB,CAAC;oBACpB,GAAG,EAAE,UAAU,KAAK,IAAI,YAAY,SAAS;oBAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,sDAAsD;QACtD,OAAO;YACL,UAAU,CAAC,KAAK;gBACd,IAAI,CAAC;oBACH,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,EAAE,IAAI;gBACf,IAAI,CAAC,MAAM;oBAAE,OAAO;gBACpB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC3E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBACvE,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;YACH,CAAC;YACD,IAAI;YACJ,KAAK,CAAC,IAAI;gBACR,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;gBACnC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9B,CAAC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW;QACxB,wEAAwE;QACxE,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAC7C,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,gCAAgC,MAAM,CAAC,cAAc,EAAE;SACvE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;YACjC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,MAAM,mBAAmB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,MAAc,EACd,KAAgC;IAEhC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/E,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CACrC,MAAM,EACN,SAAS,EACT,OAAO,CAAC,QAAS,CAAC,IAAK,EACvB,OAAO,EACP,MAAM,EACN,KAAK,CACN,CAAC;IACF,+EAA+E;IAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM;QAAE,OAAO;IACzC,MAAM,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,EAAU,EAAE,IAAY;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAgB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAQ,GAAyB,EAAE,MAAM,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;AAC/B,CAAC;AAED;sFACsF;AACtF,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;KACpC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB;YACtB,OAAO,oBAAoB,CAAC;QAC9B,KAAK,iBAAiB;YACpB,OAAO,wBAAwB,CAAC;QAClC,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,WAAoB;IACxD,IAAI,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;IACxF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC;IACvE,OAAO,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,MAAM,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACzC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmC;IAChE,MAAM,MAAM,GAAqD;QAC/D,CAAC,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,CAAC;QACjD,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,CAAC;KACzC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,KAAK,MAAM,EAAE,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACvF,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAmC;IAChE,MAAM,IAAI,GAAG,KAAK,EAAE,UAAU,CAAC;IAC/B,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,WAAW,MAAM,cAAc,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;IAC/B,IAAI,OAAO,EAAE,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,YAAY,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAC/E,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO,MAAM,KAAK,iBAAiB,IAAI,MAAM,KAAK,mBAAmB,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACpG,CAAC;AAED,SAAS,KAAK,CAAC,GAAY;IACzB,MAAM,CAAC,GAAG,GAAiF,CAAC;IAC5F,OAAO,CAAC,EAAE,UAAU,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,KAAK,GAAG,CAAC;AACrF,CAAC;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/k8s/client.d.ts

@@ -0,0 +1,16 @@
+import { Attach, BatchV1Api, CoreV1Api, KubeConfig, NetworkingV1Api, Watch } from "@kubernetes/client-node";
+export interface KubeClient {
+    kc: KubeConfig;
+    core: CoreV1Api;
+    batch: BatchV1Api;
+    networking: NetworkingV1Api;
+    attach: Attach;
+    watch: Watch;
+}
+/**
+ * Loads kube config — in-cluster (projected ServiceAccount token + CA) when
+ * running as a Pod, falling back to the local kubeconfig for out-of-cluster
+ * development.
+ */
+export declare function createKubeClient(): KubeClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/k8s/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/k8s/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,UAAU,EACV,eAAe,EACf,KAAK,EACN,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,UAAU,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,KAAK,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAe7C"}

package/dist/k8s/client.js

@@ -0,0 +1,24 @@
+import { Attach, BatchV1Api, CoreV1Api, KubeConfig, NetworkingV1Api, Watch, } from "@kubernetes/client-node";
+/**
+ * Loads kube config — in-cluster (projected ServiceAccount token + CA) when
+ * running as a Pod, falling back to the local kubeconfig for out-of-cluster
+ * development.
+ */
+export function createKubeClient() {
+    const kc = new KubeConfig();
+    if (process.env.KUBERNETES_SERVICE_HOST) {
+        kc.loadFromCluster();
+    }
+    else {
+        kc.loadFromDefault();
+    }
+    return {
+        kc,
+        core: kc.makeApiClient(CoreV1Api),
+        batch: kc.makeApiClient(BatchV1Api),
+        networking: kc.makeApiClient(NetworkingV1Api),
+        attach: new Attach(kc),
+        watch: new Watch(kc),
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/k8s/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/k8s/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,UAAU,EACV,eAAe,EACf,KAAK,GACN,MAAM,yBAAyB,CAAC;AAWjC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,EAAE,GAAG,IAAI,UAAU,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QACxC,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC;IACD,OAAO;QACL,EAAE;QACF,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC;QACjC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC;QACnC,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC;QAC7C,MAAM,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC;QACtB,KAAK,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC;KACrB,CAAC;AACJ,CAAC"}

package/dist/k8s/image-build.d.ts

@@ -0,0 +1,105 @@
+import type { V1Job } from "@kubernetes/client-node";
+import type { PullPolicy, RunBundle } from "@telorun/runner-core";
+import type { ImageBuildConfig } from "../config.js";
+import type { BundleStore } from "../bundle-store.js";
+import type { KubeClient } from "./client.js";
+export interface ImageTagInputs {
+    bundle: RunBundle;
+    /** Base image the per-app image is built FROM. */
+    baseImage: string;
+    /** Resolved digest of `baseImage`, folded into the tag so a moved moving-tag
+     *  (e.g. `latest-slim`) yields a fresh tag and rebuilds. Set only under the
+     *  `always` pull policy; omitted → keyed on the base TAG STRING alone. */
+    baseDigest?: string;
+    /** Telo module registry baked into the build (affects resolved manifests). */
+    teloRegistryUrl: string;
+}
+/**
+ * Content-address the per-app image on its DEPENDENCY closure — the only thing
+ * `telo install` bakes into `.telo/{manifests,npm}`: the `imports:` set plus any
+ * controllers declared by inline `Telo.Definition` docs (`extractDependencyKey`).
+ * A body-only edit (resource config, CEL) keeps the tag stable so the image is
+ * reused and the new body is delivered to the pod at runtime; an import or
+ * controller change produces a fresh tag and rebuilds. The entry path is
+ * deliberately excluded — it's supplied to `telo run` at runtime, and the same
+ * imports resolve the same closure regardless of the entry filename.
+ *
+ * `local_path` controllers (or an unparseable file) set `fullContentFallback`,
+ * which folds the whole bundle into the digest — keying degrades to today's
+ * content-address, which is correct (those depend on body bytes) if less optimal.
+ */
+export declare function computeImageTag(inputs: ImageTagInputs): string;
+export declare function imageRef(config: ImageBuildConfig, tag: string): string;
+/**
+ * Dockerfile for a self-contained per-app image: `telo install` populates
+ * `/telo-cache/{manifests,npm}` so the runtime `telo run` resolves every
+ * controller and module from disk with no network and no install. The telo
+ * registry arrives as a build-arg so the build (not the running session)
+ * carries the registry dependency.
+ *
+ * `TELO_CACHE_DIR=/telo-cache` relocates the baked `.telo` OFF `/app`, so at
+ * runtime the pod mounts the freshly-delivered body at `/app` without shadowing
+ * the deps. The deps depend only on the imports/controllers closure (see
+ * `computeImageTag`); the body COPYed here is whichever session first built this
+ * tag — disposable, replaced at boot.
+ */
+export declare function buildDockerfile(opts: {
+    baseImage: string;
+    entryRelativePath: string;
+}): string;
+export interface KanikoJobArgs {
+    config: ImageBuildConfig;
+    jobName: string;
+    /** Tokenized URL the initContainer fetches the build context (bundle + Dockerfile) from. */
+    contextUrl: string;
+    /** Fully-qualified image ref Kaniko pushes. */
+    destination: string;
+    /** Small image (wget + tar) for the context-fetch initContainer. */
+    initImage: string;
+    managedByLabel: string;
+}
+/**
+ * Builds the Kaniko Job. An initContainer fetches the tokenized context tarball
+ * into a shared emptyDir; Kaniko builds it and pushes to the registry. The Job
+ * is single-attempt (`backoffLimit: 0`), deadline-bounded, and self-cleaning
+ * (`ttlSecondsAfterFinished`). Kaniko needs a writable rootfs, so this runs in
+ * the trusted `telo-builds` namespace at baseline PodSecurity — never alongside
+ * untrusted session pods.
+ */
+export declare function buildKanikoJob(args: KanikoJobArgs): V1Job;
+export interface EnsureImageDeps {
+    kube: KubeClient;
+    build: ImageBuildConfig;
+    bundleStore: BundleStore;
+    initImage: string;
+    managedByLabel: string;
+}
+export interface EnsureImageArgs {
+    bundle: RunBundle;
+    entryRelativePath: string;
+    baseImage: string;
+    /** Base-image freshness. `always` pins the per-app image to the base's current
+     *  Docker Hub digest so a moved moving-tag rebuilds; `missing` / `never` (and
+     *  `always` on a base whose digest can't be resolved) reuse the cached build. */
+    pullPolicy: PullPolicy;
+    /** Build-phase progress for the editor feed. */
+    onProgress?: (message: string, done?: boolean) => void;
+}
+/**
+ * Resolve the per-app image, building it on-cluster if absent. Returns the image
+ * ref to run; throws `SessionStartError` (stage `create`) with the build pod's
+ * log tail on failure so the cause reaches the editor instead of an opaque hang.
+ */
+export declare function ensureSessionImage(deps: EnsureImageDeps, args: EnsureImageArgs): Promise<string>;
+/** Registry pull credentials decoded from a `.dockerconfigjson` Secret. */
+export interface RegistryAuth {
+    username: string;
+    password: string;
+}
+/** Extract credentials for `repository`'s host from a `.dockerconfigjson` payload. */
+export declare function parseDockerConfigAuth(dockerconfigjson: string, repository: string): RegistryAuth | undefined;
+/** Host portion of a registry ref / dockerconfig key (scheme + path stripped). */
+export declare function registryHost(ref: string): string;
+/** Parse `key="value"` pairs out of a `WWW-Authenticate: Bearer ...` challenge. */
+export declare function parseAuthParams(challenge: string): Record<string, string>;
+//# sourceMappingURL=image-build.d.ts.map