@tickernelz/paperclip-pro-plugin-kubernetes 2026.925.0

package/dist/types.d.ts

@@ -0,0 +1,279 @@
+import { z } from "zod";
+export declare const kubernetesProviderConfigSchema: z.ZodEffects<z.ZodObject<{
+    inCluster: z.ZodDefault<z.ZodBoolean>;
+    kubeconfig: z.ZodOptional<z.ZodString>;
+    namespacePrefix: z.ZodDefault<z.ZodString>;
+    companySlug: z.ZodOptional<z.ZodString>;
+    imageRegistry: z.ZodOptional<z.ZodString>;
+    imageAllowList: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    imagePullSecrets: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    egressAllowFqdns: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    egressAllowCidrs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    egressMode: z.ZodDefault<z.ZodEnum<["cilium", "standard"]>>;
+    defaultResources: z.ZodOptional<z.ZodObject<{
+        requests: z.ZodOptional<z.ZodObject<{
+            cpu: z.ZodOptional<z.ZodString>;
+            memory: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        }, {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        }>>;
+        limits: z.ZodOptional<z.ZodObject<{
+            cpu: z.ZodOptional<z.ZodString>;
+            memory: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        }, {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    }, {
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    }>>;
+    runtimeClassName: z.ZodOptional<z.ZodString>;
+    serviceAccountAnnotations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    jobTtlSecondsAfterFinished: z.ZodDefault<z.ZodNumber>;
+    podActivityDeadlineSec: z.ZodDefault<z.ZodNumber>;
+    /**
+     * The adapter type that Jobs in this environment will run.
+     * Each Kubernetes environment is bound to one adapter; create multiple
+     * environments for different adapters.
+     * Defaults to `"claude_local"`.
+     */
+    adapterType: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string | undefined>;
+    /**
+     * Optional declarative adapter registry. When present it is authoritative
+     * for runtime image / envKeys / allowFqdns / probe / defaultEnv resolution
+     * (replace semantics). Absent = built-in defaults.
+     */
+    adapters: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        adapterType: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        runtimeImage: z.ZodOptional<z.ZodString>;
+        envKeys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        allowFqdns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        probeCommand: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        defaultEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strict", z.ZodTypeAny, {
+        adapterType: string;
+        enabled: boolean;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }, {
+        adapterType: string;
+        enabled?: boolean | undefined;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }>, "many">>;
+    /**
+     * The sandbox backend to use.
+     *
+     * - `"sandbox-cr"` (default, alpha) — uses the kubernetes-sigs/agent-sandbox
+     *   Sandbox CRD (agents.x-k8s.io/v1alpha1). Creates a long-lived pod that
+     *   paperclip-server can exec into for multi-command adapter-install workflows.
+     *   Requires the agent-sandbox controller to be installed in the cluster.
+     *
+     * - `"job"` — uses batch/v1 Job (stable fallback). One-shot entrypoint; does
+     *   NOT support multi-command exec. Use this for clusters without agent-sandbox
+     *   installed, or when you need stable (non-alpha) k8s APIs.
+     */
+    backend: z.ZodDefault<z.ZodEnum<["sandbox-cr", "job"]>>;
+}, "strip", z.ZodTypeAny, {
+    adapterType: string;
+    inCluster: boolean;
+    namespacePrefix: string;
+    imageAllowList: string[];
+    imagePullSecrets: string[];
+    egressAllowFqdns: string[];
+    egressAllowCidrs: string[];
+    egressMode: "standard" | "cilium";
+    serviceAccountAnnotations: Record<string, string>;
+    jobTtlSecondsAfterFinished: number;
+    podActivityDeadlineSec: number;
+    backend: "job" | "sandbox-cr";
+    kubeconfig?: string | undefined;
+    companySlug?: string | undefined;
+    imageRegistry?: string | undefined;
+    defaultResources?: {
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    } | undefined;
+    runtimeClassName?: string | undefined;
+    adapters?: {
+        adapterType: string;
+        enabled: boolean;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }[] | undefined;
+}, {
+    adapterType?: string | undefined;
+    inCluster?: boolean | undefined;
+    kubeconfig?: string | undefined;
+    namespacePrefix?: string | undefined;
+    companySlug?: string | undefined;
+    imageRegistry?: string | undefined;
+    imageAllowList?: string[] | undefined;
+    imagePullSecrets?: string[] | undefined;
+    egressAllowFqdns?: string[] | undefined;
+    egressAllowCidrs?: string[] | undefined;
+    egressMode?: "standard" | "cilium" | undefined;
+    defaultResources?: {
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    } | undefined;
+    runtimeClassName?: string | undefined;
+    serviceAccountAnnotations?: Record<string, string> | undefined;
+    jobTtlSecondsAfterFinished?: number | undefined;
+    podActivityDeadlineSec?: number | undefined;
+    adapters?: {
+        adapterType: string;
+        enabled?: boolean | undefined;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }[] | undefined;
+    backend?: "job" | "sandbox-cr" | undefined;
+}>, {
+    adapterType: string;
+    inCluster: boolean;
+    namespacePrefix: string;
+    imageAllowList: string[];
+    imagePullSecrets: string[];
+    egressAllowFqdns: string[];
+    egressAllowCidrs: string[];
+    egressMode: "standard" | "cilium";
+    serviceAccountAnnotations: Record<string, string>;
+    jobTtlSecondsAfterFinished: number;
+    podActivityDeadlineSec: number;
+    backend: "job" | "sandbox-cr";
+    kubeconfig?: string | undefined;
+    companySlug?: string | undefined;
+    imageRegistry?: string | undefined;
+    defaultResources?: {
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    } | undefined;
+    runtimeClassName?: string | undefined;
+    adapters?: {
+        adapterType: string;
+        enabled: boolean;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }[] | undefined;
+}, {
+    adapterType?: string | undefined;
+    inCluster?: boolean | undefined;
+    kubeconfig?: string | undefined;
+    namespacePrefix?: string | undefined;
+    companySlug?: string | undefined;
+    imageRegistry?: string | undefined;
+    imageAllowList?: string[] | undefined;
+    imagePullSecrets?: string[] | undefined;
+    egressAllowFqdns?: string[] | undefined;
+    egressAllowCidrs?: string[] | undefined;
+    egressMode?: "standard" | "cilium" | undefined;
+    defaultResources?: {
+        limits?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+        requests?: {
+            cpu?: string | undefined;
+            memory?: string | undefined;
+        } | undefined;
+    } | undefined;
+    runtimeClassName?: string | undefined;
+    serviceAccountAnnotations?: Record<string, string> | undefined;
+    jobTtlSecondsAfterFinished?: number | undefined;
+    podActivityDeadlineSec?: number | undefined;
+    adapters?: {
+        adapterType: string;
+        enabled?: boolean | undefined;
+        runtimeImage?: string | undefined;
+        envKeys?: string[] | undefined;
+        allowFqdns?: string[] | undefined;
+        probeCommand?: string[] | undefined;
+        defaultEnv?: Record<string, string> | undefined;
+    }[] | undefined;
+    backend?: "job" | "sandbox-cr" | undefined;
+}>;
+export type KubernetesProviderConfig = z.infer<typeof kubernetesProviderConfigSchema>;
+export declare function parseKubernetesProviderConfig(input: unknown): KubernetesProviderConfig;
+export interface KubernetesLeaseMetadata {
+    namespace: string;
+    /** Name of the workload resource (Job name for job backend, Sandbox CR name for sandbox-cr backend). */
+    jobName: string;
+    podName: string | null;
+    secretName: string;
+    phase: "Pending" | "Running" | "Succeeded" | "Failed";
+    /** Which backend provisioned this lease. */
+    backend: "sandbox-cr" | "job";
+    scopedNetworkPolicyName: string | null;
+    scopedNetworkEgress: {
+        allowFqdns: string[];
+        allowCidrs: string[];
+    };
+    /**
+     * True when this lease's backend has NO data channel for the native file-sync
+     * transport. Native sync streams over a pod exec, which only the `sandbox-cr`
+     * backend exposes; the `job` backend carries no exec path, so its sync hook
+     * rejects immediately. The server's per-lease sync-capability gate honors this
+     * opt-out so a job lease keeps the byte-identical base64 fallback instead of
+     * being routed to a native hook that would only error. Absent/false ⇒ native
+     * sync may be used when the worker advertises the verbs.
+     */
+    nativeFileSyncUnsupported?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BvC;;;;;OAKG;;IAQH;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;IAGH;;;;;;;;;;;OAWG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASJ,CAAC;AAEJ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAEtF;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACtD,4CAA4C;IAC5C,OAAO,EAAE,YAAY,GAAG,KAAK,CAAC;IAC9B,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,mBAAmB,EAAE;QACnB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,UAAU,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC"}

package/dist/types.js

@@ -0,0 +1,65 @@
+import { z } from "zod";
+import { adapterRegistrySchema } from "./adapter-registry.js";
+import { KNOWN_ADAPTER_TYPES } from "./adapter-defaults.js";
+const cidrRegex = /^(\d{1,3}\.){3}\d{1,3}\/\d{1,2}$/;
+export const kubernetesProviderConfigSchema = z
+    .object({
+    inCluster: z.boolean().default(false),
+    kubeconfig: z.string().optional(),
+    namespacePrefix: z.string().regex(/^[a-z0-9-]{1,32}$/).default("paperclip-"),
+    companySlug: z.string().regex(/^[a-z0-9-]{1,32}$/).optional(),
+    imageRegistry: z.string().url().optional(),
+    imageAllowList: z.array(z.string()).default([]),
+    imagePullSecrets: z.array(z.string()).default([]),
+    egressAllowFqdns: z.array(z.string()).default([]),
+    egressAllowCidrs: z.array(z.string().regex(cidrRegex, "Invalid CIDR")).default([]),
+    egressMode: z.enum(["cilium", "standard"]).default("standard"),
+    defaultResources: z
+        .object({
+        requests: z.object({ cpu: z.string(), memory: z.string() }).partial().optional(),
+        limits: z.object({ cpu: z.string(), memory: z.string() }).partial().optional(),
+    })
+        .optional(),
+    runtimeClassName: z.string().optional(),
+    serviceAccountAnnotations: z.record(z.string()).default({}),
+    jobTtlSecondsAfterFinished: z.number().int().nonnegative().default(900),
+    podActivityDeadlineSec: z.number().int().positive().default(3600),
+    /**
+     * The adapter type that Jobs in this environment will run.
+     * Each Kubernetes environment is bound to one adapter; create multiple
+     * environments for different adapters.
+     * Defaults to `"claude_local"`.
+     */
+    adapterType: z
+        .string()
+        .default("claude_local")
+        .refine((v) => KNOWN_ADAPTER_TYPES.has(v), {
+        message: "adapterType must be one of the known adapter types",
+    }),
+    /**
+     * Optional declarative adapter registry. When present it is authoritative
+     * for runtime image / envKeys / allowFqdns / probe / defaultEnv resolution
+     * (replace semantics). Absent = built-in defaults.
+     */
+    adapters: adapterRegistrySchema.optional(),
+    /**
+     * The sandbox backend to use.
+     *
+     * - `"sandbox-cr"` (default, alpha) — uses the kubernetes-sigs/agent-sandbox
+     *   Sandbox CRD (agents.x-k8s.io/v1alpha1). Creates a long-lived pod that
+     *   paperclip-server can exec into for multi-command adapter-install workflows.
+     *   Requires the agent-sandbox controller to be installed in the cluster.
+     *
+     * - `"job"` — uses batch/v1 Job (stable fallback). One-shot entrypoint; does
+     *   NOT support multi-command exec. Use this for clusters without agent-sandbox
+     *   installed, or when you need stable (non-alpha) k8s APIs.
+     */
+    backend: z.enum(["sandbox-cr", "job"]).default("sandbox-cr"),
+})
+    .refine((cfg) => cfg.inCluster || cfg.kubeconfig, {
+    message: "kubernetes provider requires one of `inCluster` or `kubeconfig`",
+});
+export function parseKubernetesProviderConfig(input) {
+    return kubernetesProviderConfigSchema.parse(input);
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAE7D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAE9D,gBAAgB,EAAE,CAAC;SAChB,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC/E,CAAC;SACD,QAAQ,EAAE;IAEb,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,yBAAyB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAEjE;;;;;OAKG;IACH,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,OAAO,CAAC,cAAc,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACzC,OAAO,EAAE,oDAAoD;KAC9D,CAAC;IAEJ;;;;OAIG;IACH,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE1C;;;;;;;;;;;OAWG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;CAC7D,CAAC;KACD,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,EACxC;IACE,OAAO,EACL,iEAAiE;CACpE,CACF,CAAC;AAIJ,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC"}

package/dist/upload-interceptor.d.ts

@@ -0,0 +1,44 @@
+export interface InterceptStateFlush {
+    /** Final target path on the remote (decoded payload goes here). */
+    targetPath: string;
+    /** Decoded payload bytes. */
+    payload: Buffer;
+}
+export type InterceptDecision = 
+/** Pattern recognized; respond with success without running the command. */
+{
+    action: "ack";
+    reason: string;
+}
+/** Pattern recognized; flush via single exec. Caller does the exec. */
+ | {
+    action: "flush";
+    flush: InterceptStateFlush;
+}
+/** Pattern not recognized; pass through to the normal exec path. */
+ | {
+    action: "passthrough";
+    reason: string;
+};
+/**
+ * Stateful interceptor. Keyed by the base64 temp path (`<TARGET>.paperclip-upload.b64`).
+ * One instance per plugin worker is fine — concurrent uploads to different paths
+ * don't interfere.
+ */
+export declare class FastUploadInterceptor {
+    private buffers;
+    /**
+     * Inspect a single shell command (the literal argument to `sh -c <cmd>`).
+     * Returns the action the plugin should take.
+     */
+    decide(command: string): InterceptDecision;
+    /**
+     * Drop all buffered state. Called on releaseLease so a new lease doesn't
+     * inherit stale buffers (lease IDs are unique so target paths shouldn't
+     * collide, but cleanup is hygiene).
+     */
+    reset(): void;
+    /** Number of in-flight uploads being tracked. Mostly for tests / diagnostics. */
+    get pendingCount(): number;
+}
+//# sourceMappingURL=upload-interceptor.d.ts.map

package/dist/upload-interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-interceptor.d.ts","sourceRoot":"","sources":["../src/upload-interceptor.ts"],"names":[],"mappings":"AAoCA,MAAM,WAAW,mBAAmB;IAClC,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB;AAC3B,4EAA4E;AAC1E;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACnC,uEAAuE;GACrE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE;AACjD,oEAAoE;GAClE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ9C;;;;GAIG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,OAAO,CAAkC;IAEjD;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB;IA+D1C;;;;OAIG;IACH,KAAK,IAAI,IAAI;IAIb,iFAAiF;IACjF,IAAI,YAAY,IAAI,MAAM,CAEzB;CACF"}

package/dist/upload-interceptor.js

@@ -0,0 +1,114 @@
+/**
+ * Fast-upload interceptor for the chunked-shell file transfer protocol used by
+ * `@tickernelz/paperclip-pro-adapter-utils`'s `command-managed-runtime.writeFile()`.
+ *
+ * The default protocol uploads a binary file by:
+ *   1. INIT:     mkdir -p '<DIR>' && rm -f '<B64>' && : > '<B64>'
+ *   2. CHUNKS:   printf '%s' '<base64-chunk>' >> '<B64>'   (repeated N times)
+ *   3. FINALIZE: base64 -d < '<B64>' > '<TARGET>' && rm -f '<B64>'
+ *
+ * Where `<B64>` is `<TARGET>.paperclip-upload.b64`. Over k8s exec each call costs
+ * ~50-100ms (new WebSocket + container exec), so N chunks = N round trips. For
+ * a 1MB payload split into 64KB base64 chunks that's ~250 round trips.
+ *
+ * This interceptor short-circuits the protocol entirely:
+ *   - INIT: capture `<B64>`, start a buffer, RESPOND success without exec.
+ *   - CHUNK: append the literal base64 chunk to the buffer, RESPOND success.
+ *   - FINALIZE: decode the buffered base64 → bytes → one exec `cat > '<TARGET>'`
+ *               with stdin = bytes. Drop intermediate `.b64` entirely.
+ *
+ * If any step doesn't match the protocol exactly, we abandon the buffer and let
+ * the caller go through the slow path (passthrough). This keeps the optimization
+ * **transparent and safe**: pattern drift → graceful fallback.
+ *
+ * Reference: see packages/adapter-utils/src/command-managed-runtime.ts.
+ */
+import { posix as pathPosix } from "node:path";
+const INIT_RE = /^mkdir -p '([^']+)' && rm -f '([^']+)\.paperclip-upload\.b64' && : > '\2\.paperclip-upload\.b64'$/;
+const CHUNK_RE = /^printf '%s' '([A-Za-z0-9+/=]+)' >> '([^']+)\.paperclip-upload\.b64'$/;
+const FINALIZE_RE = /^base64 -d < '([^']+)\.paperclip-upload\.b64' > '\1' && rm -f '\1\.paperclip-upload\.b64'$/;
+const MAX_BUFFER_BYTES = 100 * 1024 * 1024; // 100MB safety cap
+/**
+ * Stateful interceptor. Keyed by the base64 temp path (`<TARGET>.paperclip-upload.b64`).
+ * One instance per plugin worker is fine — concurrent uploads to different paths
+ * don't interfere.
+ */
+export class FastUploadInterceptor {
+    buffers = new Map();
+    /**
+     * Inspect a single shell command (the literal argument to `sh -c <cmd>`).
+     * Returns the action the plugin should take.
+     */
+    decide(command) {
+        // 1. INIT
+        const initMatch = INIT_RE.exec(command);
+        if (initMatch) {
+            const dir = initMatch[1];
+            const targetPath = initMatch[2];
+            const b64Path = `${targetPath}.paperclip-upload.b64`;
+            // Sanity: dir should be the parent of target. If not, fall through.
+            if (pathPosix.dirname(targetPath) !== dir) {
+                return { action: "passthrough", reason: "init dir/target mismatch" };
+            }
+            this.buffers.set(b64Path, { targetPath, chunks: [], totalChars: 0 });
+            return { action: "ack", reason: `init upload to ${targetPath}` };
+        }
+        // 2. CHUNK
+        const chunkMatch = CHUNK_RE.exec(command);
+        if (chunkMatch) {
+            const base64 = chunkMatch[1];
+            const targetPath = chunkMatch[2];
+            const b64Path = `${targetPath}.paperclip-upload.b64`;
+            const state = this.buffers.get(b64Path);
+            if (!state) {
+                // Chunk arrived without init — must passthrough (the upload was started
+                // some other way, perhaps before we started tracking).
+                return { action: "passthrough", reason: "chunk without prior init" };
+            }
+            if (state.totalChars + base64.length > MAX_BUFFER_BYTES * 4 / 3) {
+                // base64 is ~4/3 of binary size; cap memory.
+                this.buffers.delete(b64Path);
+                return { action: "passthrough", reason: "buffer cap exceeded" };
+            }
+            state.chunks.push(base64);
+            state.totalChars += base64.length;
+            return { action: "ack", reason: `buffered ${base64.length} b64 chars` };
+        }
+        // 3. FINALIZE
+        const finalizeMatch = FINALIZE_RE.exec(command);
+        if (finalizeMatch) {
+            const targetPath = finalizeMatch[1];
+            const b64Path = `${targetPath}.paperclip-upload.b64`;
+            const state = this.buffers.get(b64Path);
+            if (!state) {
+                return { action: "passthrough", reason: "finalize without buffered state" };
+            }
+            this.buffers.delete(b64Path);
+            // Decode in one go. base64.decode handles concatenated base64 strings
+            // because each chunk was emitted from the encoder in fixed-size pieces.
+            const joined = state.chunks.join("");
+            const payload = Buffer.from(joined, "base64");
+            return {
+                action: "flush",
+                flush: {
+                    targetPath: state.targetPath,
+                    payload,
+                },
+            };
+        }
+        return { action: "passthrough", reason: "no upload pattern" };
+    }
+    /**
+     * Drop all buffered state. Called on releaseLease so a new lease doesn't
+     * inherit stale buffers (lease IDs are unique so target paths shouldn't
+     * collide, but cleanup is hygiene).
+     */
+    reset() {
+        this.buffers.clear();
+    }
+    /** Number of in-flight uploads being tracked. Mostly for tests / diagnostics. */
+    get pendingCount() {
+        return this.buffers.size;
+    }
+}
+//# sourceMappingURL=upload-interceptor.js.map

package/dist/upload-interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-interceptor.js","sourceRoot":"","sources":["../src/upload-interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,OAAO,GACX,mGAAmG,CAAC;AACtG,MAAM,QAAQ,GACZ,uEAAuE,CAAC;AAC1E,MAAM,WAAW,GACf,4FAA4F,CAAC;AAE/F,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,mBAAmB;AAuB/D;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IACxB,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEjD;;;OAGG;IACH,MAAM,CAAC,OAAe;QACpB,UAAU;QACV,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,GAAG,UAAU,uBAAuB,CAAC;YACrD,oEAAoE;YACpE,IAAI,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC1C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;YACrE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,UAAU,EAAE,EAAE,CAAC;QACnE,CAAC;QAED,WAAW;QACX,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,GAAG,UAAU,uBAAuB,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,wEAAwE;gBACxE,uDAAuD;gBACvD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;YACvE,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,GAAG,gBAAgB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChE,6CAA6C;gBAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC7B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YAClE,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,YAAY,EAAE,CAAC;QAC1E,CAAC;QAED,cAAc;QACd,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,GAAG,UAAU,uBAAuB,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC9C,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE;oBACL,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,OAAO;iBACR;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,iFAAiF;IACjF,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF"}

package/dist/utils.d.ts

@@ -0,0 +1,11 @@
+export declare function deriveCompanySlug(input: string): string;
+export declare function deriveNamespaceName(prefix: string, slug: string): string;
+export declare function newRunUlidDns(now?: () => number): string;
+export interface LabelsInput {
+    runId: string;
+    agentId: string;
+    companyId: string;
+    adapterType: string;
+}
+export declare function paperclipLabels(input: LabelsInput): Record<string, string>;
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAQA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAevD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,MAAiB,GAAG,MAAM,CAclE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ1E"}

package/dist/utils.js

@@ -0,0 +1,51 @@
+import { createHash, randomInt } from "node:crypto";
+const ULID_ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz";
+// Namespace names are capped at 63 chars (RFC 1123). The default "paperclip-"
+// prefix leaves 53 for the slug, which fits a full 36-char UUID untruncated.
+const MAX_SLUG_LENGTH = 53;
+export function deriveCompanySlug(input) {
+    const slug = input
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .replace(/-+$/, "");
+    if (slug.length === 0)
+        return "company";
+    if (slug.length <= MAX_SLUG_LENGTH)
+        return slug;
+    // Never drop entropy by plain truncation: two long inputs sharing a prefix
+    // (e.g. UUIDs differing only in their tail) must not map to the same slug,
+    // or the tenants would share a namespace and each other's per-run Secrets.
+    // Keep a readable head and append a hash of the FULL input so every byte
+    // contributes to the final name.
+    const digest = createHash("sha256").update(input).digest("hex").slice(0, 8);
+    return `${slug.slice(0, MAX_SLUG_LENGTH - 9).replace(/-+$/, "")}-${digest}`;
+}
+export function deriveNamespaceName(prefix, slug) {
+    return `${prefix}${slug}`;
+}
+export function newRunUlidDns(now = Date.now) {
+    const timestamp = now();
+    let out = "";
+    let t = timestamp;
+    for (let i = 0; i < 10; i++) {
+        out = ULID_ALPHABET[t & 0x1f] + out;
+        t = Math.floor(t / 32);
+    }
+    for (let i = 0; i < 16; i++) {
+        // crypto-strength randomness: these become Job/Sandbox CR names and the
+        // providerLeaseId, so they must not be enumerable.
+        out += ULID_ALPHABET[randomInt(32)];
+    }
+    return out;
+}
+export function paperclipLabels(input) {
+    return {
+        "paperclip.io/run-id": input.runId,
+        "paperclip.io/agent-id": input.agentId,
+        "paperclip.io/company-id": input.companyId,
+        "paperclip.io/adapter": input.adapterType,
+        "paperclip.io/managed-by": "paperclip-k8s-plugin",
+    };
+}
+//# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK;SACf,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IAChD,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAAY;IAC9D,OAAO,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAoB,IAAI,CAAC,GAAG;IACxD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,SAAS,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,GAAG,aAAa,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QACpC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,wEAAwE;QACxE,mDAAmD;QACnD,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,OAAO;QACL,qBAAqB,EAAE,KAAK,CAAC,KAAK;QAClC,uBAAuB,EAAE,KAAK,CAAC,OAAO;QACtC,yBAAyB,EAAE,KAAK,CAAC,SAAS;QAC1C,sBAAsB,EAAE,KAAK,CAAC,WAAW;QACzC,yBAAyB,EAAE,sBAAsB;KAClD,CAAC;AACJ,CAAC"}

package/dist/worker.d.ts

@@ -0,0 +1,3 @@
+import plugin from "./plugin.js";
+export default plugin;
+//# sourceMappingURL=worker.d.ts.map

package/dist/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,eAAe,MAAM,CAAC"}

package/dist/worker.js

@@ -0,0 +1,5 @@
+import { runWorker } from "@tickernelz/paperclip-pro-plugin-sdk";
+import plugin from "./plugin.js";
+export default plugin;
+runWorker(plugin, import.meta.url);
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AACjE,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,eAAe,MAAM,CAAC;AACtB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC"}

package/manifests/operator-prerequisites.yaml

@@ -0,0 +1,22 @@
+# This plugin uses only stable Kubernetes APIs. No CRD installation is required.
+#
+# Minimum cluster version: Kubernetes 1.27+
+#   - batch/v1 Job (GA since k8s 1.21)
+#   - core/v1 Pod, Secret, Namespace, ServiceAccount, ResourceQuota, LimitRange (GA since k8s 1.0)
+#   - rbac.authorization.k8s.io/v1 Role, RoleBinding (GA since k8s 1.8)
+#   - networking.k8s.io/v1 NetworkPolicy (GA since k8s 1.7)
+#   - Pod Security Standards namespace labels (GA in k8s 1.25)
+#   - fsGroupChangePolicy: OnRootMismatch (GA in k8s 1.23)
+#   - seccompProfile.type: RuntimeDefault (GA in k8s 1.19)
+#
+# Optional CNI prerequisites for FQDN-based egress (egressMode: cilium):
+#   - Cilium >= 1.11 with hubble + DNS proxy enabled
+#   - cilium.io/v2 CiliumNetworkPolicy (provided by Cilium installation)
+#
+# Optional runtime class for microVM isolation (runtimeClassName: kata-fc):
+#   - kata-containers with Firecracker hypervisor
+#   - nested-virt-capable nodes
+#
+# Future backends (not currently required):
+#   - kubernetes-sigs/agent-sandbox (when it reaches v1beta1) as an alternative
+#     backend for warm pools / templates / pause-resume.