@telorun/runner-core 0.5.2

package/dist/config.js

@@ -0,0 +1,93 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+export class RunnerConfigError extends Error {
+}
+export function parsePositiveInt(raw, fallback, field) {
+    if (raw === undefined || raw.trim() === "")
+        return fallback;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n <= 0) {
+        throw new RunnerConfigError(`${field} must be a positive integer, got '${raw}'.`);
+    }
+    return n;
+}
+export function parseBool(raw, fallback, field) {
+    const v = raw?.trim().toLowerCase();
+    if (v === undefined || v === "")
+        return fallback;
+    if (v === "true" || v === "1" || v === "yes")
+        return true;
+    if (v === "false" || v === "0" || v === "no")
+        return false;
+    throw new RunnerConfigError(`${field} must be a boolean (true/false), got '${raw}'.`);
+}
+export function parsePort(raw, fallback) {
+    const portStr = raw ?? String(fallback);
+    const port = Number(portStr);
+    if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+        throw new RunnerConfigError(`PORT must be an integer in 1..65535, got '${portStr}'.`);
+    }
+    return port;
+}
+/**
+ * Build the runner's usage terms from the environment. Terms are opt-in: returns
+ * `undefined` (no gate) unless a non-empty body is provided.
+ *
+ * The body comes from `RUNNER_TERMS_FILE` (a path read at startup — the natural
+ * fit for a k8s ConfigMap mount or a bind-mounted file) or, for short notes,
+ * inline `RUNNER_TERMS_BODY`. `RUNNER_TERMS_VERSION` is optional and defaults to
+ * a short hash of the body, so editing the agreement automatically re-prompts
+ * every client; set it explicitly only to control "material change vs. typo".
+ * A configured-but-unreadable `RUNNER_TERMS_FILE` is a hard error rather than a
+ * silent "no terms", so a misconfiguration can't quietly drop the gate.
+ */
+export function loadTermsFromEnv(env) {
+    const body = resolveTermsBody(env);
+    if (!body || body.trim() === "")
+        return undefined;
+    return {
+        version: env.RUNNER_TERMS_VERSION?.trim() || hashTermsVersion(body),
+        title: env.RUNNER_TERMS_TITLE?.trim() || "Usage agreement",
+        body,
+    };
+}
+function resolveTermsBody(env) {
+    const file = env.RUNNER_TERMS_FILE?.trim();
+    if (file) {
+        try {
+            return readFileSync(file, "utf8");
+        }
+        catch (err) {
+            throw new RunnerConfigError(`RUNNER_TERMS_FILE could not be read at '${file}': ${err.message}`);
+        }
+    }
+    return env.RUNNER_TERMS_BODY;
+}
+/** Short content fingerprint used as the terms version when none is set. Any
+ *  edit to the body changes it, which re-prompts every client. */
+function hashTermsVersion(body) {
+    return createHash("sha256").update(body).digest("hex").slice(0, 12);
+}
+export function parseCorsOrigins(raw) {
+    if (raw === undefined || raw.trim() === "" || raw.trim() === "*")
+        return "*";
+    return raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+export function loadCoreConfig(env, defaults = {}) {
+    return {
+        port: parsePort(env.PORT, defaults.port ?? 8061),
+        logLevel: env.LOG_LEVEL?.trim() || "info",
+        maxSessions: parsePositiveInt(env.RUNNER_MAX_SESSIONS, 32, "RUNNER_MAX_SESSIONS"),
+        // Exited sessions linger so the editor can re-attach and replay their console
+        // + inspection history after a page reload. The registry evicts the oldest
+        // *terminal* session early when at capacity, so a long TTL never blocks a new
+        // run while live sessions are protected.
+        exitTtlMs: parsePositiveInt(env.RUNNER_EXIT_TTL_MS, 4 * 60 * 60 * 1000, "RUNNER_EXIT_TTL_MS"),
+        replayBufferBytes: parsePositiveInt(env.RUNNER_REPLAY_BUFFER_BYTES, 5_000_000, "RUNNER_REPLAY_BUFFER_BYTES"),
+        corsOrigins: parseCorsOrigins(env.RUNNER_CORS_ORIGINS),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAkBvC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,MAAM,UAAU,gBAAgB,CAC9B,GAAuB,EACvB,QAAgB,EAChB,KAAa;IAEb,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CAAC,GAAG,KAAK,qCAAqC,GAAG,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAuB,EAAE,QAAiB,EAAE,KAAa;IACjF,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjD,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,IAAI,iBAAiB,CAAC,GAAG,KAAK,yCAAyC,GAAG,IAAI,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAuB,EAAE,QAAgB;IACjE,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,OAAO,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC;QACnE,KAAK,EAAE,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,iBAAiB;QAC1D,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAsB;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CACzB,2CAA2C,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,iBAAiB,CAAC;AAC/B,CAAC;AAED;kEACkE;AAClE,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAC7E,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAsB,EACtB,WAA8B,EAAE;IAEhC,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,MAAM;QACzC,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,EAAE,qBAAqB,CAAC;QACjF,8EAA8E;QAC9E,2EAA2E;QAC3E,8EAA8E;QAC9E,yCAAyC;QACzC,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,oBAAoB,CAAC;QAC7F,iBAAiB,EAAE,gBAAgB,CACjC,GAAG,CAAC,0BAA0B,EAC9B,SAAS,EACT,4BAA4B,CAC7B;QACD,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,mBAAmB,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/contract.d.ts

@@ -0,0 +1,170 @@
+/**
+ * The backend-neutral `/v1` session contract. Every field here is shared by
+ * the docker and kubernetes backends and travels over the HTTP+SSE wire to the
+ * editor adapter. Backend-specific concerns (how a container/pod is spawned,
+ * how the bundle is delivered) live behind the `RunnerBackend` interface.
+ */
+import type { DebugFrame } from "@telorun/debug-wire";
+export type PullPolicy = "missing" | "always" | "never";
+/**
+ * What a runner advertises about itself on `GET /v1/capabilities`. The editor
+ * fetches this to render a generic runner config form — instead of hardcoding
+ * per-backend fields — so the runner is the authority on its own config surface.
+ * `config.schema` is a JSON Schema describing the editable `SessionConfig` fields
+ * (each property carries its own `default`); server-enforced fields are marked
+ * `readOnly` with the enforced value as their `default`. `baseUrl` is never in
+ * this schema — the client owns it (you need it to reach the runner).
+ */
+export interface RunnerCapabilities {
+    displayName: string;
+    description: string;
+    config: {
+        schema: JsonSchema;
+    };
+    features: RunnerFeatures;
+    /** A usage agreement the operator requires before a session may start.
+     *  Omitted (or undefined) when this runner has no terms — e.g. a local
+     *  development runner. The runner ENFORCES it: `POST /v1/sessions` is rejected
+     *  with `428 terms_required` unless the client sends `x-telo-accepted-terms`
+     *  matching `terms.version`. The editor surfaces it and records acceptance. */
+    terms?: RunnerTerms;
+}
+/** An operator-defined agreement. `version` is opaque and operator-controlled;
+ *  bumping it re-prompts every client. `body` is plain text / markdown. */
+export interface RunnerTerms {
+    version: string;
+    title: string;
+    body: string;
+}
+/** HTTP header carrying the accepted terms version on `POST /v1/sessions`. */
+export declare const ACCEPTED_TERMS_HEADER = "x-telo-accepted-terms";
+export interface RunnerFeatures {
+    /** Runner exposes a live PTY byte channel (`/v1/sessions/:id/io`). */
+    io: boolean;
+    /** Runner can publish workload ports back to the client. */
+    ports: boolean;
+}
+/** A JSON Schema document, kept structurally open so runner-core need not depend
+ *  on a JSON-Schema type package. The editor treats it as `JSONSchema7`. */
+export type JsonSchema = Record<string, unknown>;
+export interface ProbeConfig {
+    image: string;
+    pullPolicy: PullPolicy;
+}
+export interface SessionConfig {
+    image: string;
+    pullPolicy: PullPolicy;
+    registryUrl?: string;
+}
+export interface ConfigIssue {
+    path: string;
+    message: string;
+}
+export type AvailabilityReport = {
+    status: "ready";
+} | {
+    status: "needs-setup";
+    issues: ConfigIssue[];
+} | {
+    status: "unavailable";
+    message: string;
+    remediation?: string;
+};
+export interface RunBundle {
+    entryRelativePath: string;
+    files: Array<{
+        relativePath: string;
+        contents: string;
+    }>;
+}
+export type PortProtocol = "tcp" | "udp";
+export interface PortMapping {
+    port: number;
+    protocol: PortProtocol;
+}
+/**
+ * Announced on `RunStatus.running`. `host`/`port` describe a directly-dialable
+ * endpoint (docker host-port publish); `url` carries a fully-qualified address
+ * for backends that front the workload with a proxy/ingress (k8s per-session
+ * ingress), where a bare host:port is not reachable. The client adapter fills an
+ * empty `host` from its own baseUrl — the runner does not know the hostname the
+ * client used to reach it.
+ */
+export interface RunnerEndpoint {
+    host: string;
+    port: number;
+    protocol: PortProtocol;
+    /** Fully-qualified URL when the endpoint is fronted by a proxy/ingress. */
+    url?: string;
+}
+export interface StartSessionRequest {
+    bundle: RunBundle;
+    env: Record<string, string>;
+    ports?: PortMapping[];
+    config: SessionConfig;
+    /** Request the kernel debug stream. When true the runner launches the
+     *  workload with `--inspect`, subscribes to the in-workload inspect endpoint
+     *  (reachable only by the runner — never published outward), and relays each
+     *  frame to the client as a `debug` {@link RunEvent}. */
+    inspect?: boolean;
+}
+export type RunStatus = {
+    kind: "starting";
+}
+/** `inspectUrl` is the kernel debug/inspection UI fronted by a proxy (set only
+ *  when the session ran with `inspect` and the runner has a public base URL);
+ *  absent when the inspect endpoint isn't externally reachable. */
+ | {
+    kind: "running";
+    endpoints?: RunnerEndpoint[];
+    inspectUrl?: string;
+} | {
+    kind: "exited";
+    code: number;
+} | {
+    kind: "failed";
+    message: string;
+} | {
+    kind: "stopped";
+};
+/**
+ * Coarse phase a session passes through while coming up, carried on `progress`
+ * events. Additive to the status enum: `RunStatus` stays `starting` until the
+ * workload is actually up; these messages drive the editor's spinner + step feed.
+ */
+export type RunPhase = "build" | "provision" | "boot";
+export type RunEvent = {
+    type: "stdout";
+    chunk: string;
+} | {
+    type: "stderr";
+    chunk: string;
+} | {
+    type: "status";
+    status: RunStatus;
+} | {
+    type: "progress";
+    phase: RunPhase;
+    message: string;
+    done?: boolean;
+}
+/** A frame relayed from the workload's kernel debug stream (kernel event or
+ *  log line). Only emitted when the session was started with `inspect`. */
+ | {
+    type: "debug";
+    frame: DebugFrame;
+};
+export declare function isTerminal(status: RunStatus): boolean;
+/**
+ * Stages a session start can fail at. The docker/k8s backends share the
+ * vocabulary; not every stage applies to every backend (`pull`/`inspect` are
+ * image-availability stages, `create`/`attach`/`start` are workload stages).
+ */
+export type StartFailureStage = "pull" | "inspect" | "daemon" | "create" | "attach" | "start";
+export declare class SessionStartError extends Error {
+    readonly kind: "pull_failed" | "start_failed";
+    readonly stage: StartFailureStage;
+    readonly daemonMessage?: string | undefined;
+    constructor(kind: "pull_failed" | "start_failed", stage: StartFailureStage, message: string, daemonMessage?: string | undefined);
+}
+//# sourceMappingURL=contract.d.ts.map

package/dist/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;IAC/B,QAAQ,EAAE,cAAc,CAAC;IACzB;;;;mFAI+E;IAC/E,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;2EAC2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,EAAE,EAAE,OAAO,CAAC;IACZ,4DAA4D;IAC5D,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;4EAC4E;AAC5E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,SAAS;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,KAAK,CAAC;AAEzC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;IACvB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB;;;6DAGyD;IACzD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE;AACtB;;mEAEmE;GACjE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAExB;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;AAEtD,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE;AACxE;2EAC2E;GACzE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzC,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAErD;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,OAAO,CAAC;AAEZ,qBAAa,iBAAkB,SAAQ,KAAK;aAExB,IAAI,EAAE,aAAa,GAAG,cAAc;aACpC,KAAK,EAAE,iBAAiB;aAExB,aAAa,CAAC,EAAE,MAAM;gBAHtB,IAAI,EAAE,aAAa,GAAG,cAAc,EACpC,KAAK,EAAE,iBAAiB,EACxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,YAAA;CAKzC"}

package/dist/contract.js

@@ -0,0 +1,24 @@
+/**
+ * The backend-neutral `/v1` session contract. Every field here is shared by
+ * the docker and kubernetes backends and travels over the HTTP+SSE wire to the
+ * editor adapter. Backend-specific concerns (how a container/pod is spawned,
+ * how the bundle is delivered) live behind the `RunnerBackend` interface.
+ */
+/** HTTP header carrying the accepted terms version on `POST /v1/sessions`. */
+export const ACCEPTED_TERMS_HEADER = "x-telo-accepted-terms";
+export function isTerminal(status) {
+    return status.kind === "exited" || status.kind === "failed" || status.kind === "stopped";
+}
+export class SessionStartError extends Error {
+    kind;
+    stage;
+    daemonMessage;
+    constructor(kind, stage, message, daemonMessage) {
+        super(message);
+        this.kind = kind;
+        this.stage = stage;
+        this.daemonMessage = daemonMessage;
+        this.name = "SessionStartError";
+    }
+}
+//# sourceMappingURL=contract.js.map

package/dist/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoCH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAoG7D,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;AAC3F,CAAC;AAeD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAExB;IACA;IAEA;IAJlB,YACkB,IAAoC,EACpC,KAAwB,EACxC,OAAe,EACC,aAAsB;QAEtC,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,SAAI,GAAJ,IAAI,CAAgC;QACpC,UAAK,GAAL,KAAK,CAAmB;QAExB,kBAAa,GAAb,aAAa,CAAS;QAGtC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF"}

package/dist/debug/relay.d.ts

@@ -0,0 +1,25 @@
+import type { DebugFrame } from "@telorun/debug-wire";
+export interface DebugRelayOptions {
+    /** The workload's inspect SSE endpoint, e.g. `http://telo-run-<id>:9230/events`.
+     *  Reachable only by the runner over the backend's private network. */
+    url: string;
+    /** Delivered each parsed frame off the stream. */
+    onFrame: (frame: DebugFrame) => void;
+    /** Aborts the relay (session ended). */
+    signal: AbortSignal;
+    /** Optional connect-retry budget. The workload's inspect server isn't up the
+     *  instant the container starts; we retry until it answers or `signal` aborts.
+     *  Default: retry indefinitely (until abort). */
+    onError?: (err: Error) => void;
+}
+/**
+ * Subscribe to a workload's inspect SSE endpoint and deliver each frame to
+ * `onFrame`. Retries the connection until the endpoint answers or `signal`
+ * aborts, and reconnects if the stream drops while the session is still live.
+ * The runner relays these frames onward; the workload's inspect port is never
+ * exposed outside the runner.
+ *
+ * Backend-neutral (uses global `fetch`); the docker and k8s backends share it.
+ */
+export declare function relayDebugStream(opts: DebugRelayOptions): Promise<void>;
+//# sourceMappingURL=relay.d.ts.map

package/dist/debug/relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.d.ts","sourceRoot":"","sources":["../../src/debug/relay.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC;2EACuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,MAAM,EAAE,WAAW,CAAC;IACpB;;qDAEiD;IACjD,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAChC;AAID;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB7E"}

package/dist/debug/relay.js

@@ -0,0 +1,89 @@
+const RECONNECT_DELAY_MS = 500;
+/**
+ * Subscribe to a workload's inspect SSE endpoint and deliver each frame to
+ * `onFrame`. Retries the connection until the endpoint answers or `signal`
+ * aborts, and reconnects if the stream drops while the session is still live.
+ * The runner relays these frames onward; the workload's inspect port is never
+ * exposed outside the runner.
+ *
+ * Backend-neutral (uses global `fetch`); the docker and k8s backends share it.
+ */
+export async function relayDebugStream(opts) {
+    const { url, onFrame, signal } = opts;
+    while (!signal.aborted) {
+        try {
+            const res = await fetch(url, {
+                signal,
+                headers: { accept: "text/event-stream" },
+            });
+            if (!res.ok || !res.body) {
+                await delay(RECONNECT_DELAY_MS, signal);
+                continue;
+            }
+            await pump(res.body, onFrame, signal);
+        }
+        catch (err) {
+            if (signal.aborted)
+                return;
+            opts.onError?.(err instanceof Error ? err : new Error(String(err)));
+        }
+        await delay(RECONNECT_DELAY_MS, signal);
+    }
+}
+async function pump(body, onFrame, signal) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let buf = "";
+    try {
+        while (!signal.aborted) {
+            const { value, done } = await reader.read();
+            if (done)
+                return;
+            buf += decoder.decode(value, { stream: true });
+            let sep;
+            // SSE frames are separated by a blank line.
+            while ((sep = buf.indexOf("\n\n")) >= 0) {
+                const frame = parseSseData(buf.slice(0, sep));
+                buf = buf.slice(sep + 2);
+                if (frame)
+                    onFrame(frame);
+            }
+        }
+    }
+    finally {
+        reader.cancel().catch(() => undefined);
+    }
+}
+/** Extract and parse the `data:` payload of one SSE frame. Ignores comment
+ *  lines (`: heartbeat`) and unparseable frames. */
+function parseSseData(block) {
+    const data = block
+        .split("\n")
+        .filter((line) => line.startsWith("data:"))
+        .map((line) => line.slice(5).trimStart())
+        .join("\n");
+    if (!data)
+        return null;
+    try {
+        return JSON.parse(data);
+    }
+    catch {
+        return null;
+    }
+}
+function delay(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted)
+            return resolve();
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve();
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+//# sourceMappingURL=relay.js.map

package/dist/debug/relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../src/debug/relay.ts"],"names":[],"mappings":"AAgBA,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAuB;IAC5D,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACtC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM;gBACN,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;aACzC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;gBACxC,SAAS;YACX,CAAC;YACD,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO;YAC3B,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAgC,EAChC,OAAoC,EACpC,MAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,OAAO;YACjB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,GAAW,CAAC;YAChB,4CAA4C;YAC5C,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBACzB,IAAI,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;oDACoD;AACpD,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,IAAI,GAAG,KAAK;SACf,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;SACxC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,MAAmB;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,OAAO,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/dependency-key.d.ts

@@ -0,0 +1,38 @@
+import type { RunBundle } from "./contract.js";
+/**
+ * The inputs that determine a session's baked dependency layer — everything
+ * `telo install` would resolve into `.telo/{manifests,npm}`, and nothing about
+ * resource bodies or CEL. A backend that prebuilds a per-app image keys the
+ * image tag on this so a body-only edit reuses the image while an import or
+ * controller change rebuilds it.
+ *
+ * Derived by a SHALLOW static parse of the in-memory bundle — no graph load, no
+ * network, no archive. Exact import versions pin the transitive closure, so the
+ * authored `imports:` + body-declared controllers are sufficient.
+ *
+ * Assumes every file in the bundle is reachable from the entry (true for
+ * editor / control-plane-produced bundles, which carry exactly the app's
+ * files). It scans ALL `Telo.Definition` docs rather than following the entry's
+ * include/import graph — cheaper, and erring toward over-inclusion only ever
+ * busts the cache more eagerly. The one unsound case is a bundle carrying an
+ * orphan controller-bearing Definition that `telo install` would NOT bake (not
+ * reachable from this entry) yet another entry with the same closure WOULD: they
+ * could share a tag whose image lacks that controller. Not reachable via the
+ * editor; revisit (anchor to the include graph) if bundles ever carry unreachable
+ * Definition files.
+ */
+export interface DependencyKey {
+    /** Sorted `imports:` source strings from every module doc. */
+    importSources: string[];
+    /** Sorted controller PURLs declared by inline `Telo.Definition` docs. */
+    controllerLocators: string[];
+    /**
+     * True when a `Telo.Definition` resolves its controller from bundle-local
+     * source (`local_path`), or a file failed to parse. In either case the dep
+     * key alone can't capture a controller change, so the caller MUST also fold
+     * the full bundle contents into the tag (safe fallback to content-keying).
+     */
+    fullContentFallback: boolean;
+}
+export declare function extractDependencyKey(bundle: RunBundle): DependencyKey;
+//# sourceMappingURL=dependency-key.d.ts.map

package/dist/dependency-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-key.d.ts","sourceRoot":"","sources":["../src/dependency-key.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAgBD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,aAAa,CAkDrE"}

package/dist/dependency-key.js

@@ -0,0 +1,68 @@
+import { parseAllDocuments } from "yaml";
+function asModuleKind(kind) {
+    return kind === "Telo.Application" || kind === "Telo.Library";
+}
+/** Pull `{ source }` out of an `imports:` map value (bare string or object). */
+function importSourceOf(value) {
+    if (typeof value === "string")
+        return value;
+    if (value && typeof value === "object") {
+        const source = value.source;
+        if (typeof source === "string")
+            return source;
+    }
+    return undefined;
+}
+export function extractDependencyKey(bundle) {
+    const importSources = new Set();
+    const controllerLocators = new Set();
+    let fullContentFallback = false;
+    for (const file of bundle.files) {
+        let docs;
+        try {
+            docs = parseAllDocuments(file.contents);
+        }
+        catch {
+            // Unparseable file — we can't know what it declares, so fall back to
+            // hashing the whole bundle rather than risk an under-specified key.
+            fullContentFallback = true;
+            continue;
+        }
+        for (const doc of docs) {
+            if (doc.errors.length > 0) {
+                fullContentFallback = true;
+                continue;
+            }
+            const value = doc.toJS();
+            if (!value || typeof value !== "object")
+                continue;
+            const kind = value.kind;
+            if (asModuleKind(kind) && value.imports && typeof value.imports === "object") {
+                for (const entry of Object.values(value.imports)) {
+                    const source = importSourceOf(entry);
+                    if (source)
+                        importSources.add(source);
+                }
+            }
+            if (kind === "Telo.Definition") {
+                const controllers = value.controllers;
+                if (Array.isArray(controllers)) {
+                    for (const c of controllers) {
+                        if (typeof c === "string")
+                            controllerLocators.add(c);
+                    }
+                }
+                // A bundle-local controller's source lives in the body; the PURL/path
+                // can't capture an edit to it, so force full-content keying.
+                if (typeof value.local_path === "string")
+                    fullContentFallback = true;
+            }
+        }
+    }
+    return {
+        importSources: [...importSources].sort(),
+        controllerLocators: [...controllerLocators].sort(),
+        fullContentFallback,
+    };
+}
+//# sourceMappingURL=dependency-key.js.map

package/dist/dependency-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-key.js","sourceRoot":"","sources":["../src/dependency-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAwCzC,SAAS,YAAY,CAAC,IAAa;IACjC,OAAO,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,cAAc,CAAC;AAChE,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAiB;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,oEAAoE;YACpE,mBAAmB,GAAG,IAAI,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAoC,CAAC;YAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAClD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAExB,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC7E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAkC,CAAC,EAAE,CAAC;oBAC5E,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;oBACrC,IAAI,MAAM;wBAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YAED,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;gBACtC,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;wBAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ;4BAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;gBACD,sEAAsE;gBACtE,6DAA6D;gBAC7D,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;oBAAE,mBAAmB,GAAG,IAAI,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE;QACxC,kBAAkB,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,EAAE;QAClD,mBAAmB;KACpB,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+export * from "./contract.js";
+export * from "./backend.js";
+export * from "./config.js";
+export * from "./server.js";
+export { sessionConfigSchema, type SessionConfigSchemaOptions } from "./capabilities-schema.js";
+export { BaseImageCatalog, filterTags, parseDockerHubRef, resolveTagDigest, type TagFilter, type BaseImageCatalogOptions, } from "./base-image-catalog.js";
+export { extractDependencyKey, type DependencyKey } from "./dependency-key.js";
+export { SessionRegistry, SessionLimitError, SessionEvictedError, type SessionEntry, type RegistryDeps, } from "./session/registry.js";
+export { EventRingBuffer, type BufferedEvent } from "./session/ring-buffer.js";
+export { ByteRingBuffer, type BufferedBytes } from "./session/byte-ring-buffer.js";
+export { normalizeBundlePath, validateSessionId, BundlePathError } from "./session/bundle-path.js";
+export { streamSessionEvents, type SseStreamArgs } from "./sse/channel.js";
+export { healthRoute } from "./routes/health.js";
+export { capabilitiesRoute } from "./routes/capabilities.js";
+export { probeRoute, type ProbeRouteDeps } from "./routes/probe.js";
+export { sessionsRoute, type SessionsRouteDeps } from "./routes/sessions.js";
+export { ioRoute, type IoRouteDeps } from "./routes/io.js";
+export { relayDebugStream, type DebugRelayOptions } from "./debug/relay.js";
+export type { DebugFrame, DebugEvent, DebugLog } from "@telorun/debug-wire";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+export * from "./contract.js";
+export * from "./backend.js";
+export * from "./config.js";
+export * from "./server.js";
+export { sessionConfigSchema } from "./capabilities-schema.js";
+export { BaseImageCatalog, filterTags, parseDockerHubRef, resolveTagDigest, } from "./base-image-catalog.js";
+export { extractDependencyKey } from "./dependency-key.js";
+export { SessionRegistry, SessionLimitError, SessionEvictedError, } from "./session/registry.js";
+export { EventRingBuffer } from "./session/ring-buffer.js";
+export { ByteRingBuffer } from "./session/byte-ring-buffer.js";
+export { normalizeBundlePath, validateSessionId, BundlePathError } from "./session/bundle-path.js";
+export { streamSessionEvents } from "./sse/channel.js";
+export { healthRoute } from "./routes/health.js";
+export { capabilitiesRoute } from "./routes/capabilities.js";
+export { probeRoute } from "./routes/probe.js";
+export { sessionsRoute } from "./routes/sessions.js";
+export { ioRoute } from "./routes/io.js";
+export { relayDebugStream } from "./debug/relay.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAmC,MAAM,0BAA0B,CAAC;AAChG,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,gBAAgB,GAGjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAsB,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAsB,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAsB,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAsB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAuB,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,aAAa,EAA0B,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAoB,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAA0B,MAAM,kBAAkB,CAAC"}

package/dist/routes/capabilities.d.ts

@@ -0,0 +1,12 @@
+import type { FastifyPluginAsync } from "fastify";
+import type { RunnerCapabilities } from "../contract.js";
+/** Advertises the runner's self-description + editable config schema, so the
+ *  editor can render a generic runner config form without hardcoding per-backend
+ *  fields. The document is backend-authored — each concrete runner supplies its
+ *  own `RunnerCapabilities`; core only serves it.
+ *
+ *  Accepts a getter as well as a static document so a runner whose config
+ *  surface changes at runtime (e.g. a base-image catalog refreshed from a
+ *  registry) is re-resolved on each request rather than frozen at boot. */
+export declare function capabilitiesRoute(capabilities: RunnerCapabilities | (() => RunnerCapabilities)): FastifyPluginAsync;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/routes/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/routes/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAEnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD;;;;;;;2EAO2E;AAC3E,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,kBAAkB,GAAG,CAAC,MAAM,kBAAkB,CAAC,GAC5D,kBAAkB,CAKpB"}

package/dist/routes/capabilities.js

@@ -0,0 +1,15 @@
+/** Advertises the runner's self-description + editable config schema, so the
+ *  editor can render a generic runner config form without hardcoding per-backend
+ *  fields. The document is backend-authored — each concrete runner supplies its
+ *  own `RunnerCapabilities`; core only serves it.
+ *
+ *  Accepts a getter as well as a static document so a runner whose config
+ *  surface changes at runtime (e.g. a base-image catalog refreshed from a
+ *  registry) is re-resolved on each request rather than frozen at boot. */
+export function capabilitiesRoute(capabilities) {
+    const resolve = typeof capabilities === "function" ? capabilities : () => capabilities;
+    return async (app) => {
+        app.get("/v1/capabilities", async () => resolve());
+    };
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/routes/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/routes/capabilities.ts"],"names":[],"mappings":"AAIA;;;;;;;2EAO2E;AAC3E,MAAM,UAAU,iBAAiB,CAC/B,YAA6D;IAE7D,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC;IACvF,OAAO,KAAK,EAAE,GAAoB,EAAE,EAAE;QACpC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/health.d.ts

@@ -0,0 +1,5 @@
+import type { FastifyPluginAsync } from "fastify";
+/** Liveness. Returns the runner's own version, supplied by the concrete runner
+ *  (each runner package has its own version). */
+export declare function healthRoute(version: string): FastifyPluginAsync;
+//# sourceMappingURL=health.d.ts.map