@telorun/k8s-runner 0.6.0

package/dist/k8s/image-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-build.d.ts","sourceRoot":"","sources":["../../src/k8s/image-build.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGlE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAO9C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,SAAS,CAAC;IAClB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB;;8EAE0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAmB9D;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAW9F;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,KAAK,CA8EzD;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB;;qFAEiF;IACjF,UAAU,EAAE,UAAU,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACxD;AAQD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,MAAM,CAAC,CAoCjB;AAuGD,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6FD,sFAAsF;AACtF,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,GACjB,YAAY,GAAG,SAAS,CAoB1B;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzE"}

package/dist/k8s/image-build.js

@@ -0,0 +1,432 @@
+import { createHash } from "node:crypto";
+import { SessionStartError, extractDependencyKey, resolveTagDigest } from "@telorun/runner-core";
+const CONTEXT_DIR = "/workspace";
+const POLL_INTERVAL_MS = 2_000;
+/** Grace beyond the Job's own activeDeadlineSeconds before the runner gives up. */
+const WAIT_GRACE_MS = 30_000;
+/**
+ * Content-address the per-app image on its DEPENDENCY closure — the only thing
+ * `telo install` bakes into `.telo/{manifests,npm}`: the `imports:` set plus any
+ * controllers declared by inline `Telo.Definition` docs (`extractDependencyKey`).
+ * A body-only edit (resource config, CEL) keeps the tag stable so the image is
+ * reused and the new body is delivered to the pod at runtime; an import or
+ * controller change produces a fresh tag and rebuilds. The entry path is
+ * deliberately excluded — it's supplied to `telo run` at runtime, and the same
+ * imports resolve the same closure regardless of the entry filename.
+ *
+ * `local_path` controllers (or an unparseable file) set `fullContentFallback`,
+ * which folds the whole bundle into the digest — keying degrades to today's
+ * content-address, which is correct (those depend on body bytes) if less optimal.
+ */
+export function computeImageTag(inputs) {
+    const key = extractDependencyKey(inputs.bundle);
+    const h = createHash("sha256");
+    h.update("base\0" + inputs.baseImage + "\0");
+    if (inputs.baseDigest)
+        h.update("base-digest\0" + inputs.baseDigest + "\0");
+    h.update("telo-registry\0" + inputs.teloRegistryUrl + "\0");
+    for (const source of key.importSources)
+        h.update("import\0" + source + "\0");
+    for (const locator of key.controllerLocators)
+        h.update("controller\0" + locator + "\0");
+    if (key.fullContentFallback) {
+        const files = [...inputs.bundle.files].sort((a, b) => a.relativePath < b.relativePath ? -1 : a.relativePath > b.relativePath ? 1 : 0);
+        for (const f of files) {
+            h.update("file\0" + f.relativePath + "\0");
+            h.update(f.contents);
+            h.update("\0");
+        }
+    }
+    return h.digest("hex").slice(0, 32);
+}
+export function imageRef(config, tag) {
+    return `${config.repository}:${tag}`;
+}
+/**
+ * Dockerfile for a self-contained per-app image: `telo install` populates
+ * `/telo-cache/{manifests,npm}` so the runtime `telo run` resolves every
+ * controller and module from disk with no network and no install. The telo
+ * registry arrives as a build-arg so the build (not the running session)
+ * carries the registry dependency.
+ *
+ * `TELO_CACHE_DIR=/telo-cache` relocates the baked `.telo` OFF `/app`, so at
+ * runtime the pod mounts the freshly-delivered body at `/app` without shadowing
+ * the deps. The deps depend only on the imports/controllers closure (see
+ * `computeImageTag`); the body COPYed here is whichever session first built this
+ * tag — disposable, replaced at boot.
+ */
+export function buildDockerfile(opts) {
+    return [
+        `FROM ${opts.baseImage}`,
+        `WORKDIR /app`,
+        `COPY . /app`,
+        `ARG TELO_REGISTRY_URL`,
+        `ENV TELO_REGISTRY_URL=$TELO_REGISTRY_URL`,
+        `ENV TELO_CACHE_DIR=/telo-cache`,
+        `RUN telo install /app/${opts.entryRelativePath}`,
+        ``,
+    ].join("\n");
+}
+/**
+ * Builds the Kaniko Job. An initContainer fetches the tokenized context tarball
+ * into a shared emptyDir; Kaniko builds it and pushes to the registry. The Job
+ * is single-attempt (`backoffLimit: 0`), deadline-bounded, and self-cleaning
+ * (`ttlSecondsAfterFinished`). Kaniko needs a writable rootfs, so this runs in
+ * the trusted `telo-builds` namespace at baseline PodSecurity — never alongside
+ * untrusted session pods.
+ */
+export function buildKanikoJob(args) {
+    const { config } = args;
+    const kanikoArgs = [
+        `--context=dir://${CONTEXT_DIR}`,
+        `--dockerfile=${CONTEXT_DIR}/Dockerfile`,
+        `--destination=${args.destination}`,
+        `--build-arg=TELO_REGISTRY_URL=${config.teloRegistryUrl}`,
+    ];
+    if (config.insecureRegistry) {
+        kanikoArgs.push("--insecure", "--skip-tls-verify", "--insecure-pull", "--skip-tls-verify-pull");
+    }
+    const labels = {
+        "app.kubernetes.io/managed-by": args.managedByLabel,
+        "telo.run/build": "true",
+    };
+    const usesPushSecret = Boolean(config.pushSecretName);
+    return {
+        apiVersion: "batch/v1",
+        kind: "Job",
+        metadata: { name: args.jobName, namespace: config.namespace, labels },
+        spec: {
+            backoffLimit: 0,
+            activeDeadlineSeconds: config.timeoutSeconds,
+            ttlSecondsAfterFinished: 300,
+            template: {
+                metadata: { labels },
+                spec: {
+                    restartPolicy: "Never",
+                    automountServiceAccountToken: false,
+                    initContainers: [
+                        {
+                            name: "context-fetch",
+                            image: args.initImage,
+                            command: ["sh", "-c"],
+                            args: [
+                                `set -e; wget -qO /tmp/context.tgz "${args.contextUrl}"; ` +
+                                    `tar xzf /tmp/context.tgz -C ${CONTEXT_DIR}`,
+                            ],
+                            volumeMounts: [
+                                { name: "context", mountPath: CONTEXT_DIR },
+                                { name: "tmp", mountPath: "/tmp" },
+                            ],
+                        },
+                    ],
+                    containers: [
+                        {
+                            name: "kaniko",
+                            image: config.builderImage,
+                            args: kanikoArgs,
+                            volumeMounts: [
+                                { name: "context", mountPath: CONTEXT_DIR },
+                                ...(usesPushSecret
+                                    ? [{ name: "docker-config", mountPath: "/kaniko/.docker" }]
+                                    : []),
+                            ],
+                        },
+                    ],
+                    volumes: [
+                        { name: "context", emptyDir: {} },
+                        { name: "tmp", emptyDir: {} },
+                        ...(usesPushSecret
+                            ? [
+                                {
+                                    name: "docker-config",
+                                    secret: {
+                                        secretName: config.pushSecretName,
+                                        items: [{ key: ".dockerconfigjson", path: "config.json" }],
+                                    },
+                                },
+                            ]
+                            : []),
+                    ],
+                },
+            },
+        },
+    };
+}
+/**
+ * Process-local single-flight: concurrent session-creates for byte-identical
+ * bundles share one build instead of each racing to create the same Job.
+ */
+const inFlight = new Map();
+/**
+ * Resolve the per-app image, building it on-cluster if absent. Returns the image
+ * ref to run; throws `SessionStartError` (stage `create`) with the build pod's
+ * log tail on failure so the cause reaches the editor instead of an opaque hang.
+ */
+export async function ensureSessionImage(deps, args) {
+    // Under the `always` pull policy, pin the per-app image to the base image's
+    // CURRENT digest: a moved moving-tag (latest-slim) then yields a fresh tag and
+    // rebuilds. Movement detection is Docker-Hub-only — if the digest can't be
+    // resolved (a non-Hub base, or a transient Hub failure) the build can't tell
+    // the base moved and reuses the cached image, so `always` degrades to
+    // `missing` for that base. We deliberately do NOT force a rebuild on an
+    // unresolved digest: the per-app tag would be unchanged, so the rebuild would
+    // overwrite the same `repo:tag` — which nodes pulling `IfNotPresent` never
+    // re-pull, and a peer build for that tag would be reused via 409 anyway. So a
+    // tagless rebuild buys no freshness; only a changed digest does.
+    let baseDigest;
+    if (args.pullPolicy === "always") {
+        baseDigest = await resolveTagDigest(args.baseImage, {
+            onError: (err) => args.onProgress?.(`Base image freshness check failed (${msg(err)}); using cached image`),
+        });
+    }
+    const tag = computeImageTag({
+        bundle: args.bundle,
+        baseImage: args.baseImage,
+        baseDigest,
+        teloRegistryUrl: deps.build.teloRegistryUrl,
+    });
+    const ref = imageRef(deps.build, tag);
+    const existing = inFlight.get(ref);
+    if (existing) {
+        args.onProgress?.("Waiting for in-progress build…");
+        return existing;
+    }
+    const work = buildOnce(deps, args, tag, ref).finally(() => inFlight.delete(ref));
+    inFlight.set(ref, work);
+    return work;
+}
+async function buildOnce(deps, args, tag, ref) {
+    if (await imageExists(deps.kube, deps.build, tag)) {
+        args.onProgress?.("Using cached image", true);
+        return ref;
+    }
+    args.onProgress?.("Building image…");
+    const dockerfile = buildDockerfile({
+        baseImage: args.baseImage,
+        entryRelativePath: args.entryRelativePath,
+    });
+    const buildId = `build-${tag}`;
+    const contextUrl = await deps.bundleStore.stageBuildContext(buildId, args.bundle, dockerfile);
+    const jobName = `telo-build-${tag}`;
+    const job = buildKanikoJob({
+        config: deps.build,
+        jobName,
+        contextUrl,
+        destination: ref,
+        initImage: deps.initImage,
+        managedByLabel: deps.managedByLabel,
+    });
+    try {
+        await deps.kube.batch.createNamespacedJob({ namespace: deps.build.namespace, body: job });
+    }
+    catch (err) {
+        if (!isConflict(err)) {
+            deps.bundleStore.drop(buildId);
+            throw new SessionStartError("start_failed", "create", `failed to create image build job: ${msg(err)}`, msg(err));
+        }
+        // 409: a build for this exact tag is already running (peer/prior attempt) —
+        // fall through and wait for it rather than starting a duplicate.
+    }
+    try {
+        await waitForJob(deps.kube, deps.build, jobName);
+    }
+    finally {
+        deps.bundleStore.drop(buildId);
+    }
+    args.onProgress?.("Image built", true);
+    return ref;
+}
+async function waitForJob(kube, build, jobName) {
+    const deadline = Date.now() + build.timeoutSeconds * 1000 + WAIT_GRACE_MS;
+    while (Date.now() < deadline) {
+        let status;
+        try {
+            const job = await kube.batch.readNamespacedJob({ name: jobName, namespace: build.namespace });
+            status = job.status;
+        }
+        catch (err) {
+            if (is404(err)) {
+                throw new SessionStartError("start_failed", "create", `image build job '${jobName}' disappeared before completing`);
+            }
+            await sleep(POLL_INTERVAL_MS);
+            continue;
+        }
+        if ((status?.succeeded ?? 0) >= 1)
+            return;
+        if ((status?.failed ?? 0) >= 1) {
+            const logs = await buildLogTail(kube, build.namespace, jobName);
+            throw new SessionStartError("start_failed", "create", `image build failed${logs ? `: ${logs}` : ""}`, logs || undefined);
+        }
+        await sleep(POLL_INTERVAL_MS);
+    }
+    throw new SessionStartError("start_failed", "create", `image build did not finish within ${build.timeoutSeconds}s`);
+}
+const MANIFEST_ACCEPT = [
+    "application/vnd.oci.image.manifest.v1+json",
+    "application/vnd.oci.image.index.v1+json",
+    "application/vnd.docker.distribution.manifest.v2+json",
+    "application/vnd.docker.distribution.manifest.list.v2+json",
+].join(", ");
+/**
+ * Best-effort registry manifest HEAD; a hit lets the runner skip the build.
+ * Reuses the push Secret's dockerconfig so the check authenticates against a
+ * private registry — without credentials a private registry answers 401 and the
+ * runner would rebuild every time. Fails safe to `false` (build) on any error.
+ */
+async function imageExists(kube, build, tag) {
+    if (!build.registryApiUrl)
+        return false;
+    const repoPath = repoPathOf(build.repository);
+    if (!repoPath)
+        return false;
+    try {
+        const base = build.registryApiUrl.replace(/\/+$/, "");
+        const url = `${base}/v2/${repoPath}/manifests/${tag}`;
+        const auth = await resolveRegistryAuth(kube, build);
+        const res = await manifestHead(url, repoPath, auth);
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * HEAD the manifest, handling both auth schemes a registry may demand: Basic
+ * (sent upfront when credentials exist) and Bearer token (acquired from the
+ * realm advertised in a 401 `WWW-Authenticate` challenge, then retried).
+ */
+async function manifestHead(url, repoPath, auth) {
+    const headers = { Accept: MANIFEST_ACCEPT };
+    if (auth)
+        headers.Authorization = `Basic ${basicCredential(auth)}`;
+    const res = await fetch(url, { method: "HEAD", headers });
+    if (res.status !== 401 || !auth)
+        return res;
+    const token = await acquireBearerToken(res.headers.get("www-authenticate"), repoPath, auth);
+    if (!token)
+        return res;
+    return fetch(url, {
+        method: "HEAD",
+        headers: { Accept: MANIFEST_ACCEPT, Authorization: `Bearer ${token}` },
+    });
+}
+/** Exchange Basic credentials for a pull token at the challenge's `realm`. */
+async function acquireBearerToken(challenge, repoPath, auth) {
+    if (!challenge)
+        return undefined;
+    const m = /^Bearer\s+(.*)$/i.exec(challenge.trim());
+    if (!m)
+        return undefined;
+    const params = parseAuthParams(m[1]);
+    if (!params.realm)
+        return undefined;
+    const tokenUrl = new URL(params.realm);
+    if (params.service)
+        tokenUrl.searchParams.set("service", params.service);
+    tokenUrl.searchParams.set("scope", params.scope || `repository:${repoPath}:pull`);
+    const res = await fetch(tokenUrl.toString(), {
+        headers: { Authorization: `Basic ${basicCredential(auth)}` },
+    });
+    if (!res.ok)
+        return undefined;
+    const body = (await res.json());
+    return body.token ?? body.access_token;
+}
+/** Read + decode the push Secret's dockerconfig into credentials for the repo's host. */
+async function resolveRegistryAuth(kube, build) {
+    if (!build.pushSecretName)
+        return undefined;
+    try {
+        const secret = await kube.core.readNamespacedSecret({
+            name: build.pushSecretName,
+            namespace: build.namespace,
+        });
+        const raw = secret.data?.[".dockerconfigjson"];
+        if (!raw)
+            return undefined;
+        const json = Buffer.from(raw, "base64").toString("utf8");
+        return parseDockerConfigAuth(json, build.repository);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Extract credentials for `repository`'s host from a `.dockerconfigjson` payload. */
+export function parseDockerConfigAuth(dockerconfigjson, repository) {
+    let cfg;
+    try {
+        cfg = JSON.parse(dockerconfigjson);
+    }
+    catch {
+        return undefined;
+    }
+    const auths = cfg.auths ?? {};
+    const host = registryHost(repository);
+    const entry = auths[host] ?? Object.entries(auths).find(([k]) => registryHost(k) === host)?.[1];
+    if (!entry)
+        return undefined;
+    if (entry.username && entry.password) {
+        return { username: entry.username, password: entry.password };
+    }
+    if (entry.auth) {
+        const decoded = Buffer.from(entry.auth, "base64").toString("utf8");
+        const sep = decoded.indexOf(":");
+        if (sep >= 0)
+            return { username: decoded.slice(0, sep), password: decoded.slice(sep + 1) };
+    }
+    return undefined;
+}
+/** Host portion of a registry ref / dockerconfig key (scheme + path stripped). */
+export function registryHost(ref) {
+    return ref.replace(/^https?:\/\//, "").split("/")[0];
+}
+/** Parse `key="value"` pairs out of a `WWW-Authenticate: Bearer ...` challenge. */
+export function parseAuthParams(challenge) {
+    const params = {};
+    const re = /(\w+)="([^"]*)"/g;
+    let m;
+    while ((m = re.exec(challenge)) !== null)
+        params[m[1]] = m[2];
+    return params;
+}
+function basicCredential(auth) {
+    return Buffer.from(`${auth.username}:${auth.password}`).toString("base64");
+}
+/** Last log lines of the build pod, for an actionable failure message. */
+async function buildLogTail(kube, namespace, jobName) {
+    try {
+        const pods = await kube.core.listNamespacedPod({
+            namespace,
+            labelSelector: `job-name=${jobName}`,
+        });
+        const podName = pods.items?.[0]?.metadata?.name;
+        if (!podName)
+            return "";
+        const log = await kube.core.readNamespacedPodLog({ name: podName, namespace, tailLines: 20 });
+        return typeof log === "string" ? log.trim() : "";
+    }
+    catch {
+        return "";
+    }
+}
+function repoPathOf(repository) {
+    const slash = repository.indexOf("/");
+    return slash >= 0 ? repository.slice(slash + 1) : null;
+}
+function statusCode(err) {
+    const e = err;
+    return e?.statusCode ?? e?.code ?? e?.response?.statusCode;
+}
+function is404(err) {
+    return statusCode(err) === 404;
+}
+function isConflict(err) {
+    return statusCode(err) === 409;
+}
+function msg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=image-build.js.map

package/dist/k8s/image-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-build.js","sourceRoot":"","sources":["../../src/k8s/image-build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMjG,MAAM,WAAW,GAAG,YAAY,CAAC;AACjC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,mFAAmF;AACnF,MAAM,aAAa,GAAG,MAAM,CAAC;AAc7B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,UAAU;QAAE,CAAC,CAAC,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAC5D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,aAAa;QAAE,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7E,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,kBAAkB;QAAE,CAAC,CAAC,MAAM,CAAC,cAAc,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACxF,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACnD,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/E,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAwB,EAAE,GAAW;IAC5D,OAAO,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,IAAsD;IACpF,OAAO;QACL,QAAQ,IAAI,CAAC,SAAS,EAAE;QACxB,cAAc;QACd,aAAa;QACb,uBAAuB;QACvB,0CAA0C;QAC1C,gCAAgC;QAChC,yBAAyB,IAAI,CAAC,iBAAiB,EAAE;QACjD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,UAAU,GAAG;QACjB,mBAAmB,WAAW,EAAE;QAChC,gBAAgB,WAAW,aAAa;QACxC,iBAAiB,IAAI,CAAC,WAAW,EAAE;QACnC,iCAAiC,MAAM,CAAC,eAAe,EAAE;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,MAAM,GAAG;QACb,8BAA8B,EAAE,IAAI,CAAC,cAAc;QACnD,gBAAgB,EAAE,MAAM;KACzB,CAAC;IACF,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE;QACrE,IAAI,EAAE;YACJ,YAAY,EAAE,CAAC;YACf,qBAAqB,EAAE,MAAM,CAAC,cAAc;YAC5C,uBAAuB,EAAE,GAAG;YAC5B,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE;gBACpB,IAAI,EAAE;oBACJ,aAAa,EAAE,OAAO;oBACtB,4BAA4B,EAAE,KAAK;oBACnC,cAAc,EAAE;wBACd;4BACE,IAAI,EAAE,eAAe;4BACrB,KAAK,EAAE,IAAI,CAAC,SAAS;4BACrB,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;4BACrB,IAAI,EAAE;gCACJ,sCAAsC,IAAI,CAAC,UAAU,KAAK;oCACxD,+BAA+B,WAAW,EAAE;6BAC/C;4BACD,YAAY,EAAE;gCACZ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE;gCAC3C,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE;6BACnC;yBACF;qBACF;oBACD,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,MAAM,CAAC,YAAY;4BAC1B,IAAI,EAAE,UAAU;4BAChB,YAAY,EAAE;gCACZ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE;gCAC3C,GAAG,CAAC,cAAc;oCAChB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;oCAC3D,CAAC,CAAC,EAAE,CAAC;6BACR;yBACF;qBACF;oBACD,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE;wBACjC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;wBAC7B,GAAG,CAAC,cAAc;4BAChB,CAAC,CAAC;gCACE;oCACE,IAAI,EAAE,eAAe;oCACrB,MAAM,EAAE;wCACN,UAAU,EAAE,MAAM,CAAC,cAAc;wCACjC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;qCAC3D;iCACF;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAsBD;;;GAGG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAqB,EACrB,IAAqB;IAErB,4EAA4E;IAC5E,+EAA+E;IAC/E,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,iEAAiE;IACjE,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjC,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE;YAClD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,IAAI,CAAC,UAAU,EAAE,CAAC,sCAAsC,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,CAAC;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU;QACV,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;KAC5C,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,EAAE,CAAC,gCAAgC,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAqB,EACrB,IAAqB,EACrB,GAAW,EACX,GAAW;IAEX,IAAI,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,UAAU,EAAE,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAErC,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,SAAS,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,cAAc,GAAG,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,cAAc,CAAC;QACzB,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,OAAO;QACP,UAAU;QACV,WAAW,EAAE,GAAG;QAChB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,QAAQ,EACR,qCAAqC,GAAG,CAAC,GAAG,CAAC,EAAE,EAC/C,GAAG,CAAC,GAAG,CAAC,CACT,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,iEAAiE;IACnE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAgB,EAChB,KAAuB,EACvB,OAAe;IAEf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,aAAa,CAAC;IAC1E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;YAC9F,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACf,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,QAAQ,EACR,oBAAoB,OAAO,iCAAiC,CAC7D,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO;QAC1C,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAChE,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,QAAQ,EACR,qBAAqB,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC9C,IAAI,IAAI,SAAS,CAClB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,QAAQ,EACR,qCAAqC,KAAK,CAAC,cAAc,GAAG,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG;IACtB,4CAA4C;IAC5C,yCAAyC;IACzC,sDAAsD;IACtD,2DAA2D;CAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAQb;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CACxB,IAAgB,EAChB,KAAuB,EACvB,GAAW;IAEX,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,QAAQ,cAAc,GAAG,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,GAAW,EACX,QAAgB,EAChB,IAA8B;IAE9B,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACpE,IAAI,IAAI;QAAE,OAAO,CAAC,aAAa,GAAG,SAAS,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IAE5C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5F,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IACvB,OAAO,KAAK,CAAC,GAAG,EAAE;QAChB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;KACvE,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,kBAAkB,CAC/B,SAAwB,EACxB,QAAgB,EAChB,IAAkB;IAElB,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAEpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,OAAO;QAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,cAAc,QAAQ,OAAO,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE;QAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8C,CAAC;IAC7E,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;AACzC,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,mBAAmB,CAChC,IAAgB,EAChB,KAAuB;IAEvB,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;YAClD,IAAI,EAAE,KAAK,CAAC,cAAc;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CACnC,gBAAwB,EACxB,UAAkB;IAElB,IAAI,GAAwF,CAAC;IAC7F,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChG,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,EAAE,GAAG,kBAAkB,CAAC;IAC9B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAkB;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,YAAY,CAAC,IAAgB,EAAE,SAAiB,EAAE,OAAe;IAC9E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAC7C,SAAS;YACT,aAAa,EAAE,YAAY,OAAO,EAAE;SACrC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9F,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,UAAkB;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,CAAC,GAAG,GAAiF,CAAC;IAC5F,OAAO,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC;AAC7D,CAAC;AAED,SAAS,KAAK,CAAC,GAAY;IACzB,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;AACjC,CAAC;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/k8s/ingress.d.ts

@@ -0,0 +1,15 @@
+import type { V1Ingress, V1Service } from "@kubernetes/client-node";
+import type { K8sRunnerConfig } from "../config.js";
+import type { PortMapping, RunnerEndpoint } from "@telorun/runner-core";
+export declare function buildSessionService(config: K8sRunnerConfig, sessionId: string, podName: string, podUid: string, ports: PortMapping[]): V1Service;
+export declare function buildSessionIngress(config: K8sRunnerConfig, sessionId: string, serviceName: string, podName: string, podUid: string, ports: PortMapping[]): {
+    ingress: V1Ingress;
+    hosts: string[];
+};
+/** Endpoints announced on the `running` status. Every tcp port is fronted by its
+ *  own per-session Ingress host (`<port>-<sessionId>.<domain>`, served on 443) and
+ *  carries an external `url`. udp ports aren't HTTP-routable, so they keep the
+ *  host-less form. Without an ingress base domain, host is left blank for the
+ *  client adapter to fill (parity with docker). */
+export declare function endpointsFor(config: K8sRunnerConfig, sessionId: string, ports: PortMapping[]): RunnerEndpoint[];
+//# sourceMappingURL=ingress.d.ts.map

package/dist/k8s/ingress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress.d.ts","sourceRoot":"","sources":["../../src/k8s/ingress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAoB,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgBxE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAAE,GACnB,SAAS,CAoBX;AAUD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAAE,GACnB;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CA0CzC;AAED;;;;mDAImD;AACnD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,WAAW,EAAE,GACnB,cAAc,EAAE,CAWlB"}

package/dist/k8s/ingress.js

@@ -0,0 +1,102 @@
+/** OwnerReference to the session Pod so the Service + Ingress are garbage
+ *  collected automatically when the Pod dies — essential for sub-minute
+ *  sessions that would otherwise leak ingress objects. */
+function podOwnerRef(podName, podUid) {
+    return {
+        apiVersion: "v1",
+        kind: "Pod",
+        name: podName,
+        uid: podUid,
+        controller: true,
+        blockOwnerDeletion: true,
+    };
+}
+export function buildSessionService(config, sessionId, podName, podUid, ports) {
+    return {
+        apiVersion: "v1",
+        kind: "Service",
+        metadata: {
+            name: `telo-run-${sessionId}`,
+            namespace: config.sessionNamespace,
+            labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
+            ownerReferences: [podOwnerRef(podName, podUid)],
+        },
+        spec: {
+            selector: { "telo.run/session-id": sessionId },
+            ports: ports.map((p) => ({
+                name: `p${p.port}`,
+                port: p.port,
+                targetPort: p.port,
+                protocol: p.protocol.toUpperCase(),
+            })),
+        },
+    };
+}
+/** Host fronting a single tcp port: `<port>-<sessionId>.<domain>`. The port
+ *  rides as a leading label (no dots), so it stays a single label under the base
+ *  domain — matching the docker runner's proxy scheme and compatible with a
+ *  single-label wildcard cert (`*.<domain>`). */
+function hostForPort(config, sessionId, port) {
+    return `${port}-${sessionId}.${config.sessionIngressBaseDomain}`;
+}
+export function buildSessionIngress(config, sessionId, serviceName, podName, podUid, ports) {
+    // Only tcp ports are HTTP-routable; one host rule per port to the matching
+    // service port, mirroring the docker runner's per-port URLs.
+    const rules = ports
+        .filter((p) => p.protocol === "tcp")
+        .map((p) => ({
+        host: hostForPort(config, sessionId, p.port),
+        http: {
+            paths: [
+                {
+                    path: "/",
+                    pathType: "Prefix",
+                    backend: { service: { name: serviceName, port: { number: p.port } } },
+                },
+            ],
+        },
+    }));
+    const ingress = {
+        apiVersion: "networking.k8s.io/v1",
+        kind: "Ingress",
+        metadata: {
+            name: `telo-run-${sessionId}`,
+            namespace: config.sessionNamespace,
+            labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
+            ownerReferences: [podOwnerRef(podName, podUid)],
+        },
+        spec: {
+            ...(config.sessionIngressClassName
+                ? { ingressClassName: config.sessionIngressClassName }
+                : {}),
+            // Present the predefined cert (e.g. a Cloudflare Origin cert) so an upstream
+            // in Full (Strict) mode can validate the origin. Only meaningful with routable
+            // hosts; a single wildcard `*.<domain>` Secret covers every session host.
+            ...(config.sessionIngressTlsSecretName && rules.length > 0
+                ? {
+                    tls: [{ hosts: rules.map((r) => r.host), secretName: config.sessionIngressTlsSecretName }],
+                }
+                : {}),
+            rules,
+        },
+    };
+    return { ingress, hosts: rules.map((r) => r.host) };
+}
+/** Endpoints announced on the `running` status. Every tcp port is fronted by its
+ *  own per-session Ingress host (`<port>-<sessionId>.<domain>`, served on 443) and
+ *  carries an external `url`. udp ports aren't HTTP-routable, so they keep the
+ *  host-less form. Without an ingress base domain, host is left blank for the
+ *  client adapter to fill (parity with docker). */
+export function endpointsFor(config, sessionId, ports) {
+    if (!config.sessionIngressBaseDomain || ports.length === 0) {
+        return ports.map((p) => ({ host: "", port: p.port, protocol: p.protocol }));
+    }
+    return ports.map((p) => {
+        if (p.protocol !== "tcp") {
+            return { host: "", port: p.port, protocol: p.protocol };
+        }
+        const host = hostForPort(config, sessionId, p.port);
+        return { host, port: p.port, protocol: p.protocol, url: `https://${host}` };
+    });
+}
+//# sourceMappingURL=ingress.js.map

package/dist/k8s/ingress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress.js","sourceRoot":"","sources":["../../src/k8s/ingress.ts"],"names":[],"mappings":"AAKA;;0DAE0D;AAC1D,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,MAAM;QACX,UAAU,EAAE,IAAI;QAChB,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAuB,EACvB,SAAiB,EACjB,OAAe,EACf,MAAc,EACd,KAAoB;IAEpB,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE;YACR,IAAI,EAAE,YAAY,SAAS,EAAE;YAC7B,SAAS,EAAE,MAAM,CAAC,gBAAgB;YAClC,MAAM,EAAE,EAAE,8BAA8B,EAAE,MAAM,CAAC,cAAc,EAAE;YACjE,eAAe,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;SAChD;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,EAAE,qBAAqB,EAAE,SAAS,EAAE;YAC9C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvB,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,CAAC,CAAC,IAAI;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;aACnC,CAAC,CAAC;SACJ;KACF,CAAC;AACJ,CAAC;AAED;;;iDAGiD;AACjD,SAAS,WAAW,CAAC,MAAuB,EAAE,SAAiB,EAAE,IAAY;IAC3E,OAAO,GAAG,IAAI,IAAI,SAAS,IAAI,MAAM,CAAC,wBAAwB,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAuB,EACvB,SAAiB,EACjB,WAAmB,EACnB,OAAe,EACf,MAAc,EACd,KAAoB;IAEpB,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,KAAK,GAAG,KAAK;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC;QAC5C,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,QAAiB;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE;iBACtE;aACF;SACF;KACF,CAAC,CAAC,CAAC;IACN,MAAM,OAAO,GAAc;QACzB,UAAU,EAAE,sBAAsB;QAClC,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE;YACR,IAAI,EAAE,YAAY,SAAS,EAAE;YAC7B,SAAS,EAAE,MAAM,CAAC,gBAAgB;YAClC,MAAM,EAAE,EAAE,8BAA8B,EAAE,MAAM,CAAC,cAAc,EAAE;YACjE,eAAe,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;SAChD;QACD,IAAI,EAAE;YACJ,GAAG,CAAC,MAAM,CAAC,uBAAuB;gBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,uBAAuB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;YACP,6EAA6E;YAC7E,+EAA+E;YAC/E,0EAA0E;YAC1E,GAAG,CAAC,MAAM,CAAC,2BAA2B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBACxD,CAAC,CAAC;oBACE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,2BAA2B,EAAE,CAAC;iBAC3F;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,KAAK;SACN;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;;mDAImD;AACnD,MAAM,UAAU,YAAY,CAC1B,MAAuB,EACvB,SAAiB,EACjB,KAAoB;IAEpB,IAAI,CAAC,MAAM,CAAC,wBAAwB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/k8s/pod-spec.d.ts

@@ -0,0 +1,41 @@
+import type { V1Pod } from "@kubernetes/client-node";
+import type { K8sRunnerConfig } from "../config.js";
+import type { ResolvedLimits } from "../limits.js";
+import type { PortMapping } from "@telorun/runner-core";
+export interface BuildPodArgs {
+    config: K8sRunnerConfig;
+    sessionId: string;
+    podName: string;
+    entryRelativePath: string;
+    env: Record<string, string>;
+    ports: PortMapping[];
+    limits: ResolvedLimits;
+    /** Prebuilt per-app image to run. Controllers + module manifests are baked
+     *  into `/telo-cache/{manifests,npm}` (read-only) by the on-cluster build;
+     *  the image is keyed only on the dependency closure, so the per-session body
+     *  is NOT baked — it's delivered to `/app` at boot via the initContainer. */
+    image: string;
+    /** Tokenized, single-use URL the body-delivery initContainer fetches the
+     *  session bundle tarball from (`BundleStore.stageSessionBundle`). */
+    bundleUrl: string;
+    /** When true, run the workload with `--inspect` so the runner can relay its
+     *  kernel debug stream. Binds `0.0.0.0:<INSPECT_PORT>` (reachable only by the
+     *  runner over the cluster pod network — never exposed via Service/Ingress). */
+    inspect: boolean;
+}
+/** Port the workload's `--inspect` server binds inside the session container.
+ *  Reached by the runner over the cluster pod network (`http://<podIP>:<port>`);
+ *  never declared as a Service port — only the runner relays the stream out. */
+export declare const INSPECT_PORT = 9230;
+/**
+ * Builds the session Pod. Hardening that needs no RuntimeClass is always on
+ * (non-root, read-only rootfs, drop-all caps, no service-account token,
+ * seccomp RuntimeDefault); a sandbox RuntimeClass is layered on when configured.
+ *
+ * The body-delivery initContainer fetches the session bundle into the writable
+ * `/app` emptyDir; the session container runs `telo run /app/<entry>
+ * --no-cache-write` reading its deps from the baked, read-only `/telo-cache`.
+ * `readOnlyRootFilesystem` stays on — every write lands on a mounted emptyDir.
+ */
+export declare function buildSessionPod(args: BuildPodArgs): V1Pod;
+//# sourceMappingURL=pod-spec.d.ts.map

package/dist/k8s/pod-spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pod-spec.d.ts","sourceRoot":"","sources":["../../src/k8s/pod-spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB;;;iFAG6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd;0EACsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB;;oFAEgF;IAChF,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;gFAEgF;AAChF,eAAO,MAAM,YAAY,OAAO,CAAC;AAajC;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,KAAK,CAoHzD"}