@cat-factory/app 0.49.0 → 0.49.2

package/app/components/settings/KubernetesEnvironmentForm.vue

@@ -0,0 +1,383 @@
+<script setup lang="ts">
+// The Kubernetes "ephemeral environment backend" connect form — one option of the
+// environment tab's backend-type selector (the other being the BYO HTTP manifest editor).
+// It builds the discriminated `{ kind: 'kubernetes', kubernetes }` config plus the
+// `apiToken` secret bundle and emits test/save to the parent tab (which calls the shared
+// provider-connections store). The K8s env config differs from the runner K8s config
+// (manifest source + URL derivation vs an executor image + namespace), so it has its own
+// form rather than reusing KubernetesRunnerForm.
+import { computed, reactive, ref, watch } from 'vue'
+import { KUBERNETES_ENV_TOKEN_SECRET_KEY } from '@cat-factory/contracts'
+import type { ProviderConnection } from '~/types/providerConnections'
+
+const props = defineProps<{
+  connection: ProviderConnection | null
+  supportsTest: boolean
+  testing: boolean
+  busy: boolean
+  testResult: { ok: boolean; message?: string } | null
+}>()
+
+const emit = defineEmits<{
+  test: [payload: { config: Record<string, unknown>; secrets: Record<string, string> }]
+  save: [payload: { config: Record<string, unknown>; secrets: Record<string, string> }]
+}>()
+
+const { t } = useI18n()
+
+const form = reactive({
+  label: '',
+  apiServerUrl: '',
+  caCertPem: '',
+  insecureSkipTlsVerify: false,
+  namespaceTemplate: '',
+  imageTemplate: '',
+  // manifest source
+  manifestSourceType: 'colocated' as 'colocated' | 'separate',
+  manifestPath: '',
+  manifestRepo: '',
+  manifestRef: '',
+  // url derivation
+  urlSource: 'ingressTemplate' as 'ingressTemplate' | 'ingressStatus' | 'serviceStatus',
+  hostTemplate: '',
+  ingressName: '',
+  serviceName: '',
+  servicePort: '',
+  urlScheme: '' as '' | 'http' | 'https',
+})
+const apiToken = ref('')
+
+const manifestSourceItems = computed(() => [
+  { label: t('settings.providerConnection.kubernetesEnv.sourceColocated'), value: 'colocated' },
+  { label: t('settings.providerConnection.kubernetesEnv.sourceSeparate'), value: 'separate' },
+])
+const urlSourceItems = computed(() => [
+  {
+    label: t('settings.providerConnection.kubernetesEnv.urlIngressTemplate'),
+    value: 'ingressTemplate',
+  },
+  {
+    label: t('settings.providerConnection.kubernetesEnv.urlIngressStatus'),
+    value: 'ingressStatus',
+  },
+  {
+    label: t('settings.providerConnection.kubernetesEnv.urlServiceStatus'),
+    value: 'serviceStatus',
+  },
+])
+const schemeItems = computed(() => [
+  { label: t('settings.providerConnection.kubernetesEnv.schemeDefault'), value: '' },
+  { label: 'https', value: 'https' },
+  { label: 'http', value: 'http' },
+])
+
+// A registered k8s env connection exposes its non-secret config, so prefill every
+// non-secret field from it (never the token — secrets are write-only and re-entered on
+// update). This lets an edit change one field without re-typing the whole form.
+watch(
+  () => props.connection,
+  (c) => {
+    if (c?.kind !== 'kubernetes') return
+    const k =
+      c.config && (c.config as { kind?: string }).kind === 'kubernetes'
+        ? (c.config as { kubernetes: Record<string, unknown> }).kubernetes
+        : undefined
+    if (!k) return
+    form.label = typeof k.label === 'string' ? k.label : ''
+    form.apiServerUrl = typeof k.apiServerUrl === 'string' ? k.apiServerUrl : ''
+    form.caCertPem = typeof k.caCertPem === 'string' ? k.caCertPem : ''
+    form.insecureSkipTlsVerify = k.insecureSkipTlsVerify === true
+    form.namespaceTemplate = typeof k.namespaceTemplate === 'string' ? k.namespaceTemplate : ''
+    form.imageTemplate = typeof k.imageTemplate === 'string' ? k.imageTemplate : ''
+    const src = k.manifestSource as Record<string, unknown> | undefined
+    if (src?.type === 'separate') {
+      form.manifestSourceType = 'separate'
+      form.manifestRepo = typeof src.repo === 'string' ? src.repo : ''
+      form.manifestRef = typeof src.ref === 'string' ? src.ref : ''
+      form.manifestPath = typeof src.path === 'string' ? src.path : ''
+    } else if (src?.type === 'colocated') {
+      form.manifestSourceType = 'colocated'
+      form.manifestPath = typeof src.path === 'string' ? src.path : ''
+    }
+    const url = k.url as Record<string, unknown> | undefined
+    if (url?.source === 'ingressTemplate') {
+      form.urlSource = 'ingressTemplate'
+      form.hostTemplate = typeof url.hostTemplate === 'string' ? url.hostTemplate : ''
+    } else if (url?.source === 'ingressStatus') {
+      form.urlSource = 'ingressStatus'
+      form.ingressName = typeof url.ingressName === 'string' ? url.ingressName : ''
+    } else if (url?.source === 'serviceStatus') {
+      form.urlSource = 'serviceStatus'
+      form.serviceName = typeof url.serviceName === 'string' ? url.serviceName : ''
+      form.servicePort = typeof url.port === 'number' ? String(url.port) : ''
+    }
+    if (url && (url.scheme === 'http' || url.scheme === 'https')) form.urlScheme = url.scheme
+  },
+  { immediate: true },
+)
+
+// Mirror kubernetesManifestSourceSchema's `owner/repo` regex so a slashless value is
+// caught here with a field hint instead of a generic 422 from the backend.
+const repoShapeValid = computed(() => /^[^/\s]+\/[^/\s]+$/.test(form.manifestRepo.trim()))
+const manifestSourceValid = computed(() =>
+  form.manifestSourceType === 'separate'
+    ? repoShapeValid.value && !!form.manifestPath.trim()
+    : !!form.manifestPath.trim(),
+)
+// serviceStatus.port is an optional integer 1..65535 (kubernetesUrlSourceSchema). Validate
+// it here so a decimal isn't silently dropped and an out-of-range value isn't sent then 422'd.
+const servicePortValid = computed(() => {
+  const raw = form.servicePort.trim()
+  if (!raw) return true
+  const port = Number(raw)
+  return Number.isInteger(port) && port >= 1 && port <= 65535
+})
+const urlValid = computed(() => {
+  if (form.urlSource === 'ingressTemplate') return !!form.hostTemplate.trim()
+  if (form.urlSource === 'serviceStatus') return !!form.serviceName.trim() && servicePortValid.value
+  return true // ingressStatus has no required field
+})
+
+const canSave = computed(
+  () =>
+    !!form.label.trim() &&
+    !!form.apiServerUrl.trim() &&
+    !!apiToken.value.trim() &&
+    manifestSourceValid.value &&
+    urlValid.value,
+)
+
+function buildManifestSource(): Record<string, unknown> {
+  if (form.manifestSourceType === 'separate') {
+    const src: Record<string, unknown> = {
+      type: 'separate',
+      repo: form.manifestRepo.trim(),
+      path: form.manifestPath.trim(),
+    }
+    if (form.manifestRef.trim()) src.ref = form.manifestRef.trim()
+    return src
+  }
+  return { type: 'colocated', path: form.manifestPath.trim() }
+}
+
+function buildUrl(): Record<string, unknown> {
+  const url: Record<string, unknown> = { source: form.urlSource }
+  if (form.urlSource === 'ingressTemplate') {
+    url.hostTemplate = form.hostTemplate.trim()
+  } else if (form.urlSource === 'ingressStatus') {
+    if (form.ingressName.trim()) url.ingressName = form.ingressName.trim()
+  } else {
+    url.serviceName = form.serviceName.trim()
+    const port = Number(form.servicePort)
+    if (form.servicePort.trim() && Number.isInteger(port)) url.port = port
+  }
+  if (form.urlScheme) url.scheme = form.urlScheme
+  return url
+}
+
+function buildPayload(): { config: Record<string, unknown>; secrets: Record<string, string> } {
+  const kubernetes: Record<string, unknown> = {
+    label: form.label.trim(),
+    apiServerUrl: form.apiServerUrl.trim(),
+    manifestSource: buildManifestSource(),
+    url: buildUrl(),
+  }
+  if (form.caCertPem.trim()) kubernetes.caCertPem = form.caCertPem.trim()
+  if (form.insecureSkipTlsVerify) kubernetes.insecureSkipTlsVerify = true
+  if (form.namespaceTemplate.trim()) kubernetes.namespaceTemplate = form.namespaceTemplate.trim()
+  if (form.imageTemplate.trim()) kubernetes.imageTemplate = form.imageTemplate.trim()
+  return {
+    config: { kind: 'kubernetes', kubernetes },
+    secrets: { [KUBERNETES_ENV_TOKEN_SECRET_KEY]: apiToken.value.trim() },
+  }
+}
+
+function optional(label: string): string {
+  return t('settings.providerConnection.form.optionalLabel', { label })
+}
+</script>
+
+<template>
+  <div class="rounded-lg border border-dashed border-slate-700 p-3 space-y-3">
+    <p class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">
+      {{
+        connection?.kind === 'kubernetes'
+          ? t('settings.providerConnection.form.updateConfiguration')
+          : t('settings.providerConnection.form.connect')
+      }}
+    </p>
+
+    <UFormField :label="t('settings.providerConnection.kubernetesEnv.label')">
+      <UInput
+        v-model="form.label"
+        :placeholder="t('settings.providerConnection.kubernetesEnv.labelPlaceholder')"
+      />
+    </UFormField>
+
+    <UFormField
+      :label="t('settings.providerConnection.kubernetesEnv.apiServerUrl')"
+      :help="t('settings.providerConnection.kubernetesEnv.apiServerUrlHelp')"
+    >
+      <UInput v-model="form.apiServerUrl" class="font-mono" placeholder="https://10.0.0.1:6443" />
+    </UFormField>
+
+    <UFormField
+      :label="t('settings.providerConnection.kubernetesEnv.apiToken')"
+      :help="t('settings.providerConnection.kubernetesEnv.apiTokenHelp')"
+    >
+      <UInput v-model="apiToken" type="password" class="font-mono" />
+    </UFormField>
+
+    <!-- Manifest source: where the per-PR resources are read from. -->
+    <UFormField :label="t('settings.providerConnection.kubernetesEnv.manifestSourceLabel')">
+      <USelect v-model="form.manifestSourceType" :items="manifestSourceItems" />
+    </UFormField>
+
+    <UFormField
+      v-if="form.manifestSourceType === 'separate'"
+      :label="t('settings.providerConnection.kubernetesEnv.repo')"
+      :help="t('settings.providerConnection.kubernetesEnv.repoHelp')"
+    >
+      <UInput v-model="form.manifestRepo" class="font-mono" placeholder="acme/preview-manifests" />
+    </UFormField>
+
+    <UFormField
+      v-if="form.manifestSourceType === 'separate'"
+      :label="optional(t('settings.providerConnection.kubernetesEnv.ref'))"
+      :help="t('settings.providerConnection.kubernetesEnv.refHelp')"
+    >
+      <UInput v-model="form.manifestRef" class="font-mono" placeholder="main" />
+    </UFormField>
+
+    <UFormField
+      :label="t('settings.providerConnection.kubernetesEnv.path')"
+      :help="t('settings.providerConnection.kubernetesEnv.pathHelp')"
+    >
+      <UInput v-model="form.manifestPath" class="font-mono" placeholder="k8s/preview" />
+    </UFormField>
+
+    <!-- URL derivation: how the live environment URL is resolved once applied. -->
+    <UFormField :label="t('settings.providerConnection.kubernetesEnv.urlSourceLabel')">
+      <USelect v-model="form.urlSource" :items="urlSourceItems" />
+    </UFormField>
+
+    <UFormField
+      v-if="form.urlSource === 'ingressTemplate'"
+      :label="t('settings.providerConnection.kubernetesEnv.hostTemplate')"
+      :help="t('settings.providerConnection.kubernetesEnv.hostTemplateHelp')"
+    >
+      <UInput
+        v-model="form.hostTemplate"
+        class="font-mono"
+        placeholder="{{branch}}.preview.example.com"
+      />
+    </UFormField>
+
+    <UFormField
+      v-if="form.urlSource === 'ingressStatus'"
+      :label="optional(t('settings.providerConnection.kubernetesEnv.ingressName'))"
+      :help="t('settings.providerConnection.kubernetesEnv.ingressNameHelp')"
+    >
+      <UInput v-model="form.ingressName" class="font-mono" />
+    </UFormField>
+
+    <UFormField
+      v-if="form.urlSource === 'serviceStatus'"
+      :label="t('settings.providerConnection.kubernetesEnv.serviceName')"
+    >
+      <UInput v-model="form.serviceName" class="font-mono" />
+    </UFormField>
+
+    <UFormField
+      v-if="form.urlSource === 'serviceStatus'"
+      :label="optional(t('settings.providerConnection.kubernetesEnv.port'))"
+    >
+      <UInput
+        v-model="form.servicePort"
+        type="number"
+        :min="1"
+        :max="65535"
+        class="font-mono"
+        placeholder="80"
+      />
+    </UFormField>
+
+    <UFormField :label="optional(t('settings.providerConnection.kubernetesEnv.scheme'))">
+      <USelect v-model="form.urlScheme" :items="schemeItems" />
+    </UFormField>
+
+    <!-- Optional refinements. -->
+    <UFormField
+      :label="optional(t('settings.providerConnection.kubernetesEnv.namespaceTemplate'))"
+      :help="t('settings.providerConnection.kubernetesEnv.namespaceTemplateHelp')"
+    >
+      <UInput
+        v-model="form.namespaceTemplate"
+        class="font-mono"
+        placeholder="cf-env-{{pullNumber}}"
+      />
+    </UFormField>
+
+    <UFormField
+      :label="optional(t('settings.providerConnection.kubernetesEnv.imageTemplate'))"
+      :help="t('settings.providerConnection.kubernetesEnv.imageTemplateHelp')"
+    >
+      <UInput v-model="form.imageTemplate" class="font-mono" />
+    </UFormField>
+
+    <UFormField
+      :label="optional(t('settings.providerConnection.kubernetesEnv.caCertPem'))"
+      :help="t('settings.providerConnection.kubernetesEnv.caCertPemHelp')"
+    >
+      <UTextarea
+        v-model="form.caCertPem"
+        :rows="3"
+        class="font-mono"
+        placeholder="-----BEGIN CERTIFICATE-----"
+      />
+    </UFormField>
+
+    <UFormField :help="t('settings.providerConnection.kubernetesEnv.insecureSkipTlsVerifyHelp')">
+      <UCheckbox
+        v-model="form.insecureSkipTlsVerify"
+        :label="t('settings.providerConnection.kubernetesEnv.insecureSkipTlsVerify')"
+      />
+    </UFormField>
+
+    <div v-if="supportsTest" class="flex items-center gap-2">
+      <UButton
+        color="neutral"
+        variant="soft"
+        size="sm"
+        icon="i-lucide-plug-zap"
+        :loading="testing"
+        :disabled="!canSave"
+        @click="emit('test', buildPayload())"
+      >
+        {{ t('settings.providerConnection.test.button') }}
+      </UButton>
+      <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
+        {{ testResult.message ?? t('settings.providerConnection.test.ok') }}
+      </span>
+      <span v-else-if="testResult" class="text-xs text-rose-400">
+        {{ testResult.message ?? t('settings.providerConnection.test.failed') }}
+      </span>
+    </div>
+
+    <div class="flex justify-end">
+      <UButton
+        color="primary"
+        size="sm"
+        :loading="busy"
+        :disabled="!canSave"
+        @click="emit('save', buildPayload())"
+      >
+        {{
+          connection?.kind === 'kubernetes'
+            ? t('common.save')
+            : t('settings.providerConnection.form.connect')
+        }}
+      </UButton>
+    </div>
+  </div>
+</template>

package/app/components/settings/ProviderConnectionTab.vue

@@ -11,6 +11,7 @@ import type { ProviderConnectionKind } from '~/types/providerConnections'
 import ProvisioningLogsDrawer from '~/components/provisioning/ProvisioningLogsDrawer.vue'
 import ProviderManifestEditor from '~/components/settings/ProviderManifestEditor.vue'
 import KubernetesRunnerForm from '~/components/settings/KubernetesRunnerForm.vue'
+import KubernetesEnvironmentForm from '~/components/settings/KubernetesEnvironmentForm.vue'
 
 const props = defineProps<{ kind: ProviderConnectionKind }>()
 
@@ -185,18 +186,32 @@ async function saveManifest(payload: {
   }
 }
 
-// --- Runner-backend selector (runner-pool only) -------------------------------------
-// The runner-pool tab can configure either the manifest pool OR a native Kubernetes
-// cluster; environments are manifest-only. Defaults to the saved connection's kind.
-const RUNNER_BACKEND_KINDS = ['manifest', 'kubernetes'] as const
-type RunnerBackendKind = (typeof RUNNER_BACKEND_KINDS)[number]
-const backendKind = ref<RunnerBackendKind>('manifest')
-const showBackendSelector = computed(() => props.kind === 'runner-pool')
+// --- Backend selector -----------------------------------------------------------------
+// Both infrastructure tabs can configure either the BYO manifest backend OR a native
+// Kubernetes backend (a runner cluster for runner-pool, per-PR namespaces for environment).
+// The two K8s backends have different config shapes, so each kind renders its own form.
+// Defaults to the saved connection's kind.
+const BACKEND_KINDS = ['manifest', 'kubernetes'] as const
+type BackendKind = (typeof BACKEND_KINDS)[number]
+const backendKind = ref<BackendKind>('manifest')
+const showBackendSelector = computed(() => true)
+const backendSelectorLabel = computed(() =>
+  t(
+    props.kind === 'environment'
+      ? 'settings.providerConnection.backend.environmentSelectorLabel'
+      : 'settings.providerConnection.backend.selectorLabel',
+  ),
+)
+function backendKindLabel(k: BackendKind): string {
+  if (k === 'kubernetes') return t('settings.providerConnection.backend.kubernetes')
+  return t(
+    props.kind === 'environment'
+      ? 'settings.providerConnection.backend.environmentManifest'
+      : 'settings.providerConnection.backend.manifest',
+  )
+}
 const backendKindItems = computed(() =>
-  RUNNER_BACKEND_KINDS.map((k) => ({
-    label: t(`settings.providerConnection.backend.${k}`),
-    value: k,
-  })),
+  BACKEND_KINDS.map((k) => ({ label: backendKindLabel(k), value: k })),
 )
 watch(
   () => connection.value,
@@ -317,17 +332,26 @@ function fieldHelp(key: string): string | undefined {
       }}
     </div>
 
-    <!-- Runner-backend selector: the manifest pool or a native Kubernetes cluster. -->
-    <UFormField
-      v-if="showBackendSelector"
-      :label="t('settings.providerConnection.backend.selectorLabel')"
-    >
+    <!-- Backend selector: the BYO manifest backend or a native Kubernetes backend. -->
+    <UFormField v-if="showBackendSelector" :label="backendSelectorLabel">
       <USelect v-model="backendKind" :items="backendKindItems" />
     </UFormField>
 
-    <!-- Native Kubernetes runner backend. -->
+    <!-- Native Kubernetes runner backend (runner-pool). -->
     <KubernetesRunnerForm
-      v-if="showBackendSelector && backendKind === 'kubernetes'"
+      v-if="kind === 'runner-pool' && backendKind === 'kubernetes'"
+      :connection="connection"
+      :supports-test="descriptor.supportsTest"
+      :testing="testing"
+      :busy="busy"
+      :test-result="testResult"
+      @test="testConfig"
+      @save="saveConfig"
+    />
+
+    <!-- Native Kubernetes ephemeral-environment backend (environment). -->
+    <KubernetesEnvironmentForm
+      v-else-if="kind === 'environment' && backendKind === 'kubernetes'"
       :connection="connection"
       :supports-test="descriptor.supportsTest"
       :testing="testing"

package/app/composables/api/providerConnections.ts

@@ -70,12 +70,15 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
       kind === 'environment'
         ? send(CONTRACTS.environment.register, {
             pathPrefix: ws(workspaceId),
-            body: body as RegisterEnvironmentProviderInput,
+            body: {
+              config: backendConfig(body),
+              secrets: body.secrets,
+            } as RegisterEnvironmentProviderInput,
           })
         : send(CONTRACTS['runner-pool'].register, {
             pathPrefix: ws(workspaceId),
             body: {
-              config: runnerBackendConfig(body),
+              config: backendConfig(body),
               secrets: body.secrets,
             } as RegisterRunnerPoolInput,
           }),
@@ -94,12 +97,15 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
       kind === 'environment'
         ? send(CONTRACTS.environment.test, {
             pathPrefix: ws(workspaceId),
-            body: body as TestEnvironmentConnectionInput,
+            body: {
+              ...(body.manifest || body.config ? { config: backendConfig(body) } : {}),
+              ...(body.secrets ? { secrets: body.secrets } : {}),
+            } as TestEnvironmentConnectionInput,
           })
         : send(CONTRACTS['runner-pool'].test, {
             pathPrefix: ws(workspaceId),
             body: {
-              ...(body.manifest || body.config ? { config: runnerBackendConfig(body) } : {}),
+              ...(body.manifest || body.config ? { config: backendConfig(body) } : {}),
               ...(body.secrets ? { secrets: body.secrets } : {}),
             } as TestRunnerPoolConnectionInput,
           }),
@@ -110,13 +116,12 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
 }
 
 /**
- * Resolve the discriminated runner-backend config from a connect-form payload: an
- * explicit `config` (the Kubernetes form) wins; otherwise a bare `manifest` (the manifest
- * editor) is wrapped into the manifest backend kind.
+ * Resolve the discriminated backend config (runner-pool OR environment) from a connect-form
+ * payload: an explicit `config` (the Kubernetes form) wins; otherwise a bare `manifest` (the
+ * manifest editor) is wrapped into the `manifest` backend kind. Both subsystems now take a
+ * discriminated `config`, so the same shape serves each.
  */
-function runnerBackendConfig(
-  body: RegisterProviderInput | TestProviderInput,
-): Record<string, unknown> {
+function backendConfig(body: RegisterProviderInput | TestProviderInput): Record<string, unknown> {
   if (body.config) return body.config
   return { kind: 'manifest', manifest: body.manifest ?? {} }
 }

package/i18n/locales/en.json

@@ -1280,7 +1280,46 @@
       "backend": {
         "selectorLabel": "Runner backend",
         "manifest": "Self-hosted pool (manifest)",
-        "kubernetes": "Kubernetes"
+        "kubernetes": "Kubernetes",
+        "environmentSelectorLabel": "Environment backend",
+        "environmentManifest": "Custom HTTP API (manifest)"
+      },
+      "kubernetesEnv": {
+        "label": "Name",
+        "labelPlaceholder": "Preview cluster",
+        "apiServerUrl": "API server URL",
+        "apiServerUrlHelp": "The kube-apiserver root, e.g. https://10.0.0.1:6443. The orchestrator applies each PR's manifests through the apiserver, so only this endpoint must be reachable.",
+        "apiToken": "ServiceAccount token",
+        "apiTokenHelp": "A bearer token with RBAC to create namespaces and apply the operator's resources. Stored encrypted; never shown again.",
+        "manifestSourceLabel": "Manifest source",
+        "sourceColocated": "Co-located in the PR repo",
+        "sourceSeparate": "Separate repo",
+        "repo": "Manifests repo",
+        "repoHelp": "The owner/repo that holds the Kubernetes manifests, e.g. acme/preview-manifests.",
+        "ref": "Ref",
+        "refHelp": "Branch, tag or SHA to read the manifests at. Empty uses the repo's default branch.",
+        "path": "Manifest path",
+        "pathHelp": "File or directory within the repo holding the resources to apply.",
+        "urlSourceLabel": "Environment URL",
+        "urlIngressTemplate": "Ingress host template",
+        "urlIngressStatus": "Read Ingress status",
+        "urlServiceStatus": "Read Service status",
+        "hostTemplate": "Host template",
+        "hostTemplateHelp": "Host template rendered with the provision vars such as branch and pullNumber; the rendered host becomes the environment URL.",
+        "ingressName": "Ingress name",
+        "ingressNameHelp": "Ingress to read the load-balancer host from. Empty uses the only Ingress applied.",
+        "serviceName": "Service name",
+        "port": "Port",
+        "scheme": "URL scheme",
+        "schemeDefault": "https (default)",
+        "namespaceTemplate": "Namespace template",
+        "namespaceTemplateHelp": "Per-PR namespace name rendered from the provision vars such as pullNumber. Empty derives one from the PR number.",
+        "imageTemplate": "Image template",
+        "imageTemplateHelp": "Image reference exposed to the manifests, rendered over the provision vars such as branch and sha.",
+        "caCertPem": "Cluster CA certificate (PEM)",
+        "caCertPemHelp": "Paste the cluster CA bundle so the apiserver's TLS certificate verifies. Omit only for a publicly-trusted CA.",
+        "insecureSkipTlsVerify": "Skip TLS verification",
+        "insecureSkipTlsVerifyHelp": "Strongly discouraged. Disables apiserver TLS verification; use only for kind/dev clusters."
       },
       "kubernetes": {
         "label": "Name",

package/i18n/locales/es.json

@@ -1288,7 +1288,46 @@
       "backend": {
         "selectorLabel": "Backend de ejecución",
         "manifest": "Pool autohospedado (manifiesto)",
-        "kubernetes": "Kubernetes"
+        "kubernetes": "Kubernetes",
+        "environmentSelectorLabel": "Backend de entorno",
+        "environmentManifest": "API HTTP personalizada (manifiesto)"
+      },
+      "kubernetesEnv": {
+        "label": "Nombre",
+        "labelPlaceholder": "Clúster de vista previa",
+        "apiServerUrl": "URL del API server",
+        "apiServerUrlHelp": "La raíz del kube-apiserver, p. ej. https://10.0.0.1:6443. El orquestador aplica los manifiestos de cada PR a través del apiserver, así que solo este endpoint debe ser accesible.",
+        "apiToken": "Token de ServiceAccount",
+        "apiTokenHelp": "Un token bearer con permisos RBAC para crear namespaces y aplicar los recursos del operador. Se almacena cifrado; no se vuelve a mostrar.",
+        "manifestSourceLabel": "Origen de los manifiestos",
+        "sourceColocated": "En el mismo repo de la PR",
+        "sourceSeparate": "Repo aparte",
+        "repo": "Repo de manifiestos",
+        "repoHelp": "El owner/repo que contiene los manifiestos de Kubernetes, p. ej. acme/preview-manifests.",
+        "ref": "Ref",
+        "refHelp": "Rama, etiqueta o SHA donde leer los manifiestos. Vacío usa la rama por defecto del repo.",
+        "path": "Ruta del manifiesto",
+        "pathHelp": "Archivo o directorio dentro del repo que contiene los recursos a aplicar.",
+        "urlSourceLabel": "URL del entorno",
+        "urlIngressTemplate": "Plantilla de host del Ingress",
+        "urlIngressStatus": "Leer estado del Ingress",
+        "urlServiceStatus": "Leer estado del Service",
+        "hostTemplate": "Plantilla de host",
+        "hostTemplateHelp": "Plantilla de host renderizada con las variables de aprovisionamiento como branch y pullNumber; el host resultante se convierte en la URL del entorno.",
+        "ingressName": "Nombre del Ingress",
+        "ingressNameHelp": "Ingress del que leer el host del balanceador. Vacío usa el único Ingress aplicado.",
+        "serviceName": "Nombre del Service",
+        "port": "Puerto",
+        "scheme": "Esquema de URL",
+        "schemeDefault": "https (por defecto)",
+        "namespaceTemplate": "Plantilla de namespace",
+        "namespaceTemplateHelp": "Nombre del namespace por PR renderizado con las variables de aprovisionamiento como pullNumber. Vacío deriva uno del número de la PR.",
+        "imageTemplate": "Plantilla de imagen",
+        "imageTemplateHelp": "Referencia de imagen expuesta a los manifiestos, renderizada con las variables de aprovisionamiento como branch y sha.",
+        "caCertPem": "Certificado CA del clúster (PEM)",
+        "caCertPemHelp": "Pega el bundle CA del clúster para que el certificado TLS del apiserver se verifique. Omítelo solo para una CA de confianza pública.",
+        "insecureSkipTlsVerify": "Omitir verificación TLS",
+        "insecureSkipTlsVerifyHelp": "Muy desaconsejado. Desactiva la verificación TLS del apiserver; úsalo solo para clústeres kind/dev."
       },
       "kubernetes": {
         "label": "Nombre",

package/i18n/locales/fr.json

@@ -1288,7 +1288,46 @@
       "backend": {
         "selectorLabel": "Backend d'exécution",
         "manifest": "Pool auto-hébergé (manifeste)",
-        "kubernetes": "Kubernetes"
+        "kubernetes": "Kubernetes",
+        "environmentSelectorLabel": "Backend d'environnement",
+        "environmentManifest": "API HTTP personnalisée (manifeste)"
+      },
+      "kubernetesEnv": {
+        "label": "Nom",
+        "labelPlaceholder": "Cluster de prévisualisation",
+        "apiServerUrl": "URL du serveur d'API",
+        "apiServerUrlHelp": "La racine du kube-apiserver, p. ex. https://10.0.0.1:6443. L'orchestrateur applique les manifestes de chaque PR via l'apiserver, donc seul ce point d'accès doit être accessible.",
+        "apiToken": "Jeton de ServiceAccount",
+        "apiTokenHelp": "Un jeton bearer avec les droits RBAC pour créer des namespaces et appliquer les ressources de l'opérateur. Stocké chiffré ; jamais réaffiché.",
+        "manifestSourceLabel": "Source des manifestes",
+        "sourceColocated": "Dans le dépôt de la PR",
+        "sourceSeparate": "Dépôt séparé",
+        "repo": "Dépôt des manifestes",
+        "repoHelp": "Le owner/repo qui contient les manifestes Kubernetes, p. ex. acme/preview-manifests.",
+        "ref": "Réf",
+        "refHelp": "Branche, tag ou SHA où lire les manifestes. Vide utilise la branche par défaut du dépôt.",
+        "path": "Chemin du manifeste",
+        "pathHelp": "Fichier ou répertoire du dépôt contenant les ressources à appliquer.",
+        "urlSourceLabel": "URL de l'environnement",
+        "urlIngressTemplate": "Modèle d'hôte Ingress",
+        "urlIngressStatus": "Lire l'état de l'Ingress",
+        "urlServiceStatus": "Lire l'état du Service",
+        "hostTemplate": "Modèle d'hôte",
+        "hostTemplateHelp": "Modèle d'hôte rendu avec les variables de provisionnement telles que branch et pullNumber ; l'hôte obtenu devient l'URL de l'environnement.",
+        "ingressName": "Nom de l'Ingress",
+        "ingressNameHelp": "Ingress dont lire l'hôte du load-balancer. Vide utilise le seul Ingress appliqué.",
+        "serviceName": "Nom du Service",
+        "port": "Port",
+        "scheme": "Schéma d'URL",
+        "schemeDefault": "https (par défaut)",
+        "namespaceTemplate": "Modèle de namespace",
+        "namespaceTemplateHelp": "Nom du namespace par PR rendu avec les variables de provisionnement telles que pullNumber. Vide en dérive un à partir du numéro de la PR.",
+        "imageTemplate": "Modèle d'image",
+        "imageTemplateHelp": "Référence d'image exposée aux manifestes, rendue avec les variables de provisionnement telles que branch et sha.",
+        "caCertPem": "Certificat CA du cluster (PEM)",
+        "caCertPemHelp": "Collez le bundle CA du cluster pour que le certificat TLS de l'apiserver soit vérifié. À omettre uniquement pour une CA publiquement approuvée.",
+        "insecureSkipTlsVerify": "Ignorer la vérification TLS",
+        "insecureSkipTlsVerifyHelp": "Fortement déconseillé. Désactive la vérification TLS de l'apiserver ; à utiliser uniquement pour des clusters kind/dev."
       },
       "kubernetes": {
         "label": "Nom",

package/i18n/locales/pl.json

@@ -1288,7 +1288,46 @@
       "backend": {
         "selectorLabel": "Backend wykonawczy",
         "manifest": "Własny pool (manifest)",
-        "kubernetes": "Kubernetes"
+        "kubernetes": "Kubernetes",
+        "environmentSelectorLabel": "Backend środowiska",
+        "environmentManifest": "Własne API HTTP (manifest)"
+      },
+      "kubernetesEnv": {
+        "label": "Nazwa",
+        "labelPlaceholder": "Klaster podglądu",
+        "apiServerUrl": "URL serwera API",
+        "apiServerUrlHelp": "Główny adres kube-apiserver, np. https://10.0.0.1:6443. Orkiestrator stosuje manifesty każdego PR przez apiserver, więc tylko ten endpoint musi być osiągalny.",
+        "apiToken": "Token ServiceAccount",
+        "apiTokenHelp": "Token bearer z uprawnieniami RBAC do tworzenia namespace’ów i stosowania zasobów operatora. Przechowywany w postaci zaszyfrowanej; nie jest ponownie pokazywany.",
+        "manifestSourceLabel": "Źródło manifestów",
+        "sourceColocated": "W repozytorium PR",
+        "sourceSeparate": "Osobne repozytorium",
+        "repo": "Repozytorium manifestów",
+        "repoHelp": "Owner/repo zawierające manifesty Kubernetes, np. acme/preview-manifests.",
+        "ref": "Ref",
+        "refHelp": "Gałąź, tag lub SHA, z którego czytać manifesty. Puste używa domyślnej gałęzi repozytorium.",
+        "path": "Ścieżka manifestu",
+        "pathHelp": "Plik lub katalog w repozytorium zawierający zasoby do zastosowania.",
+        "urlSourceLabel": "URL środowiska",
+        "urlIngressTemplate": "Szablon hosta Ingress",
+        "urlIngressStatus": "Odczytaj stan Ingress",
+        "urlServiceStatus": "Odczytaj stan Service",
+        "hostTemplate": "Szablon hosta",
+        "hostTemplateHelp": "Szablon hosta renderowany ze zmiennymi provisioningu, takimi jak branch i pullNumber; wynikowy host staje się URL-em środowiska.",
+        "ingressName": "Nazwa Ingress",
+        "ingressNameHelp": "Ingress, z którego odczytać host load-balancera. Puste używa jedynego zastosowanego Ingress.",
+        "serviceName": "Nazwa Service",
+        "port": "Port",
+        "scheme": "Schemat URL",
+        "schemeDefault": "https (domyślnie)",
+        "namespaceTemplate": "Szablon namespace",
+        "namespaceTemplateHelp": "Nazwa namespace per PR renderowana ze zmiennych provisioningu, takich jak pullNumber. Puste wyprowadza ją z numeru PR.",
+        "imageTemplate": "Szablon obrazu",
+        "imageTemplateHelp": "Referencja obrazu udostępniana manifestom, renderowana ze zmiennych provisioningu, takich jak branch i sha.",
+        "caCertPem": "Certyfikat CA klastra (PEM)",
+        "caCertPemHelp": "Wklej pakiet CA klastra, aby certyfikat TLS apiservera został zweryfikowany. Pomiń tylko dla publicznie zaufanego CA.",
+        "insecureSkipTlsVerify": "Pomiń weryfikację TLS",
+        "insecureSkipTlsVerifyHelp": "Zdecydowanie odradzane. Wyłącza weryfikację TLS apiservera; używaj tylko dla klastrów kind/dev."
       },
       "kubernetes": {
         "label": "Nazwa",

package/i18n/locales/uk.json

@@ -1288,7 +1288,46 @@
       "backend": {
         "selectorLabel": "Бекенд виконавця",
         "manifest": "Власний пул (маніфест)",
-        "kubernetes": "Kubernetes"
+        "kubernetes": "Kubernetes",
+        "environmentSelectorLabel": "Бекенд середовища",
+        "environmentManifest": "Власний HTTP API (маніфест)"
+      },
+      "kubernetesEnv": {
+        "label": "Назва",
+        "labelPlaceholder": "Кластер попереднього перегляду",
+        "apiServerUrl": "URL сервера API",
+        "apiServerUrlHelp": "Кореневий адрес kube-apiserver, напр. https://10.0.0.1:6443. Оркестратор застосовує маніфести кожного PR через apiserver, тож лише цей endpoint має бути доступним.",
+        "apiToken": "Токен ServiceAccount",
+        "apiTokenHelp": "Bearer-токен з правами RBAC на створення просторів імен і застосування ресурсів оператора. Зберігається зашифрованим; більше не показується.",
+        "manifestSourceLabel": "Джерело маніфестів",
+        "sourceColocated": "У репозиторії PR",
+        "sourceSeparate": "Окремий репозиторій",
+        "repo": "Репозиторій маніфестів",
+        "repoHelp": "Owner/repo, що містить маніфести Kubernetes, напр. acme/preview-manifests.",
+        "ref": "Реф",
+        "refHelp": "Гілка, тег або SHA, з якого читати маніфести. Порожнє використовує гілку за замовчуванням репозиторію.",
+        "path": "Шлях маніфесту",
+        "pathHelp": "Файл або каталог у репозиторії, що містить ресурси для застосування.",
+        "urlSourceLabel": "URL середовища",
+        "urlIngressTemplate": "Шаблон хоста Ingress",
+        "urlIngressStatus": "Зчитати стан Ingress",
+        "urlServiceStatus": "Зчитати стан Service",
+        "hostTemplate": "Шаблон хоста",
+        "hostTemplateHelp": "Шаблон хоста, відрендерений зі змінними провіженингу, такими як branch і pullNumber; отриманий хост стає URL середовища.",
+        "ingressName": "Назва Ingress",
+        "ingressNameHelp": "Ingress, з якого зчитати хост балансувальника. Порожнє використовує єдиний застосований Ingress.",
+        "serviceName": "Назва Service",
+        "port": "Порт",
+        "scheme": "Схема URL",
+        "schemeDefault": "https (за замовчуванням)",
+        "namespaceTemplate": "Шаблон простору імен",
+        "namespaceTemplateHelp": "Назва простору імен на кожен PR, відрендерена зі змінних провіженингу, таких як pullNumber. Порожнє виводить її з номера PR.",
+        "imageTemplate": "Шаблон образу",
+        "imageTemplateHelp": "Посилання на образ, доступне маніфестам, відрендерене зі змінними провіженингу, такими як branch і sha.",
+        "caCertPem": "Сертифікат CA кластера (PEM)",
+        "caCertPemHelp": "Вставте CA-набір кластера, щоб TLS-сертифікат apiserver проходив перевірку. Пропустіть лише для публічно довіреного CA.",
+        "insecureSkipTlsVerify": "Пропустити перевірку TLS",
+        "insecureSkipTlsVerifyHelp": "Наполегливо не рекомендується. Вимикає перевірку TLS apiserver; використовуйте лише для кластерів kind/dev."
       },
       "kubernetes": {
         "label": "Назва",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.49.0",
+  "version": "0.49.2",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.50.0"
+    "@cat-factory/contracts": "0.51.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",