@cat-factory/app 0.59.2 → 0.60.1

package/app/components/settings/KubernetesEngineForm.vue

@@ -0,0 +1,339 @@
+<script setup lang="ts">
+// The kube ENGINE connection form for a `kubernetes` provision-type handler — the "how"
+// (apiserver + TLS + namespace + URL derivation), split from the service-owned manifest
+// source (the "what/where", configured on the service in ServiceTestConfig). Serves both the
+// `local-k3s` and `remote-kubernetes` engines (they share `kubernetesEngineConfigSchema`); the
+// parent passes the selected engine and gets back the discriminated `{ engine, kubernetes }`
+// config + the `apiToken` secret bundle. Distinct from KubernetesEnvironmentForm (the legacy
+// single-connection backend, which still carries the manifest source inline).
+import { computed, reactive, ref, watch } from 'vue'
+import { KUBERNETES_ENV_TOKEN_SECRET_KEY } from '@cat-factory/contracts'
+import type {
+  EnvironmentHandlerView,
+  InfraEngine,
+  InfraHandlerConfig,
+} from '@cat-factory/contracts'
+
+// The kube branch of the discriminated handler config this form produces (the `local-k3s` /
+// `remote-kubernetes` engines share `kubernetesEngineConfigSchema`). Emitting this typed
+// (rather than a bare `Record`) lets the parent pass it straight to registerHandler with no
+// `as never` cast, so a wrong config shape is caught at the call site instead of server-side.
+type KubeHandlerConfig = Extract<InfraHandlerConfig, { engine: 'local-k3s' | 'remote-kubernetes' }>
+type KubeHandlerPayload = { config: KubeHandlerConfig; secrets: Record<string, string> }
+
+const props = defineProps<{
+  /** `local-k3s` or `remote-kubernetes` — the engine this handler is registered under. */
+  engine: Extract<InfraEngine, 'local-k3s' | 'remote-kubernetes'>
+  /** The registered handler (if any) — prefills every non-secret field on edit. */
+  handler: EnvironmentHandlerView | null
+  supportsTest: boolean
+  testing: boolean
+  busy: boolean
+  testResult: { ok: boolean; message?: string } | null
+}>()
+
+const emit = defineEmits<{
+  test: [payload: KubeHandlerPayload]
+  save: [payload: KubeHandlerPayload]
+}>()
+
+const { t } = useI18n()
+
+type UrlSource =
+  | 'ingressTemplate'
+  | 'ingressStatus'
+  | 'serviceStatus'
+  | 'gatewayStatus'
+  | 'httpRouteStatus'
+
+const form = reactive({
+  label: '',
+  apiServerUrl: '',
+  caCertPem: '',
+  insecureSkipTlsVerify: false,
+  namespaceTemplate: '',
+  imageTemplate: '',
+  urlSource: 'ingressTemplate' as UrlSource,
+  hostTemplate: '',
+  ingressName: '',
+  serviceName: '',
+  servicePort: '',
+  gatewayName: '',
+  httpRouteName: '',
+  urlScheme: '' as '' | 'http' | 'https',
+})
+const apiToken = ref('')
+
+const urlSourceItems = computed(() => [
+  {
+    label: t('settings.infrastructure.kubernetesEngine.urlIngressTemplate'),
+    value: 'ingressTemplate',
+  },
+  { label: t('settings.infrastructure.kubernetesEngine.urlIngressStatus'), value: 'ingressStatus' },
+  { label: t('settings.infrastructure.kubernetesEngine.urlServiceStatus'), value: 'serviceStatus' },
+  { label: t('settings.infrastructure.kubernetesEngine.urlGatewayStatus'), value: 'gatewayStatus' },
+  {
+    label: t('settings.infrastructure.kubernetesEngine.urlHttpRouteStatus'),
+    value: 'httpRouteStatus',
+  },
+])
+const schemeItems = computed(() => [
+  { label: t('settings.infrastructure.kubernetesEngine.schemeDefault'), value: '' },
+  { label: 'https', value: 'https' },
+  { label: 'http', value: 'http' },
+])
+
+// Prefill every non-secret field from a registered handler's stored config (never the token —
+// secrets are write-only and re-entered on update), so an edit changes one field without
+// re-typing the form.
+watch(
+  () => props.handler,
+  (h) => {
+    const cfg = h?.config
+    if (!cfg || (cfg.engine !== 'local-k3s' && cfg.engine !== 'remote-kubernetes')) return
+    const k = cfg.kubernetes as Record<string, unknown>
+    form.label = typeof k.label === 'string' ? k.label : ''
+    form.apiServerUrl = typeof k.apiServerUrl === 'string' ? k.apiServerUrl : ''
+    form.caCertPem = typeof k.caCertPem === 'string' ? k.caCertPem : ''
+    form.insecureSkipTlsVerify = k.insecureSkipTlsVerify === true
+    form.namespaceTemplate = typeof k.namespaceTemplate === 'string' ? k.namespaceTemplate : ''
+    form.imageTemplate = typeof k.imageTemplate === 'string' ? k.imageTemplate : ''
+    const url = k.url as Record<string, unknown> | undefined
+    const src = typeof url?.source === 'string' ? (url.source as UrlSource) : 'ingressTemplate'
+    form.urlSource = src
+    form.hostTemplate = typeof url?.hostTemplate === 'string' ? url.hostTemplate : ''
+    form.ingressName = typeof url?.ingressName === 'string' ? url.ingressName : ''
+    form.serviceName = typeof url?.serviceName === 'string' ? url.serviceName : ''
+    form.servicePort = typeof url?.port === 'number' ? String(url.port) : ''
+    form.gatewayName = typeof url?.gatewayName === 'string' ? url.gatewayName : ''
+    form.httpRouteName = typeof url?.httpRouteName === 'string' ? url.httpRouteName : ''
+    if (url?.scheme === 'http' || url?.scheme === 'https') form.urlScheme = url.scheme
+  },
+  { immediate: true },
+)
+
+const servicePortValid = computed(() => {
+  const raw = form.servicePort.trim()
+  if (!raw) return true
+  const port = Number(raw)
+  return Number.isInteger(port) && port >= 1 && port <= 65535
+})
+const urlValid = computed(() => {
+  if (form.urlSource === 'ingressTemplate') return !!form.hostTemplate.trim()
+  if (form.urlSource === 'serviceStatus') return !!form.serviceName.trim() && servicePortValid.value
+  return true // ingressStatus / gatewayStatus / httpRouteStatus have no required field
+})
+
+const connected = computed(() => !!props.handler)
+const canSave = computed(
+  () =>
+    !!form.label.trim() && !!form.apiServerUrl.trim() && !!apiToken.value.trim() && urlValid.value,
+)
+
+function buildUrl(): Record<string, unknown> {
+  const url: Record<string, unknown> = { source: form.urlSource }
+  if (form.urlSource === 'ingressTemplate') {
+    url.hostTemplate = form.hostTemplate.trim()
+  } else if (form.urlSource === 'ingressStatus') {
+    if (form.ingressName.trim()) url.ingressName = form.ingressName.trim()
+  } else if (form.urlSource === 'serviceStatus') {
+    url.serviceName = form.serviceName.trim()
+    const port = Number(form.servicePort)
+    if (form.servicePort.trim() && Number.isInteger(port)) url.port = port
+  } else if (form.urlSource === 'gatewayStatus') {
+    if (form.gatewayName.trim()) url.gatewayName = form.gatewayName.trim()
+  } else {
+    if (form.httpRouteName.trim()) url.httpRouteName = form.httpRouteName.trim()
+  }
+  if (form.urlScheme) url.scheme = form.urlScheme
+  return url
+}
+
+function buildPayload(): KubeHandlerPayload {
+  const kubernetes: Record<string, unknown> = {
+    label: form.label.trim(),
+    apiServerUrl: form.apiServerUrl.trim(),
+    url: buildUrl(),
+  }
+  if (form.caCertPem.trim()) kubernetes.caCertPem = form.caCertPem.trim()
+  if (form.insecureSkipTlsVerify) kubernetes.insecureSkipTlsVerify = true
+  if (form.namespaceTemplate.trim()) kubernetes.namespaceTemplate = form.namespaceTemplate.trim()
+  if (form.imageTemplate.trim()) kubernetes.imageTemplate = form.imageTemplate.trim()
+  // One honest assertion at the boundary that actually builds the shape (the reactive form is
+  // dynamically assembled, then validated server-side); the emitted config flows typed onward.
+  return {
+    config: { engine: props.engine, kubernetes } as unknown as KubeHandlerConfig,
+    secrets: { [KUBERNETES_ENV_TOKEN_SECRET_KEY]: apiToken.value.trim() },
+  }
+}
+
+function optional(label: string): string {
+  return t('settings.providerConnection.form.optionalLabel', { label })
+}
+</script>
+
+<template>
+  <div class="rounded-lg border border-dashed border-slate-700 p-3 space-y-3">
+    <p class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">
+      {{
+        connected
+          ? t('settings.providerConnection.form.updateConfiguration')
+          : t('settings.providerConnection.form.connect')
+      }}
+    </p>
+
+    <UFormField :label="t('settings.infrastructure.kubernetesEngine.label')">
+      <UInput
+        v-model="form.label"
+        :placeholder="t('settings.infrastructure.kubernetesEngine.labelPlaceholder')"
+      />
+    </UFormField>
+
+    <UFormField
+      :label="t('settings.infrastructure.kubernetesEngine.apiServerUrl')"
+      :help="t('settings.infrastructure.kubernetesEngine.apiServerUrlHelp')"
+    >
+      <UInput v-model="form.apiServerUrl" class="font-mono" placeholder="https://10.0.0.1:6443" />
+    </UFormField>
+
+    <UFormField
+      :label="t('settings.infrastructure.kubernetesEngine.apiToken')"
+      :help="t('settings.infrastructure.kubernetesEngine.apiTokenHelp')"
+    >
+      <UInput v-model="apiToken" type="password" class="font-mono" autocomplete="off" />
+    </UFormField>
+
+    <!-- URL derivation: how the live environment URL is resolved once the service's
+         manifests are applied. -->
+    <UFormField :label="t('settings.infrastructure.kubernetesEngine.urlSourceLabel')">
+      <USelect v-model="form.urlSource" :items="urlSourceItems" />
+    </UFormField>
+
+    <UFormField
+      v-if="form.urlSource === 'ingressTemplate'"
+      :label="t('settings.infrastructure.kubernetesEngine.hostTemplate')"
+      :help="t('settings.infrastructure.kubernetesEngine.hostTemplateHelp')"
+    >
+      <UInput
+        v-model="form.hostTemplate"
+        class="font-mono"
+        placeholder="{{branch}}.preview.example.com"
+      />
+    </UFormField>
+
+    <UFormField
+      v-if="form.urlSource === 'ingressStatus'"
+      :label="optional(t('settings.infrastructure.kubernetesEngine.ingressName'))"
+    >
+      <UInput v-model="form.ingressName" class="font-mono" />
+    </UFormField>
+
+    <UFormField
+      v-if="form.urlSource === 'serviceStatus'"
+      :label="t('settings.infrastructure.kubernetesEngine.serviceName')"
+    >
+      <UInput v-model="form.serviceName" class="font-mono" />
+    </UFormField>
+    <UFormField
+      v-if="form.urlSource === 'serviceStatus'"
+      :label="optional(t('settings.infrastructure.kubernetesEngine.port'))"
+    >
+      <UInput
+        v-model="form.servicePort"
+        type="number"
+        :min="1"
+        :max="65535"
+        class="font-mono"
+        placeholder="80"
+      />
+    </UFormField>
+
+    <UFormField
+      v-if="form.urlSource === 'gatewayStatus'"
+      :label="optional(t('settings.infrastructure.kubernetesEngine.gatewayName'))"
+    >
+      <UInput v-model="form.gatewayName" class="font-mono" />
+    </UFormField>
+
+    <UFormField
+      v-if="form.urlSource === 'httpRouteStatus'"
+      :label="optional(t('settings.infrastructure.kubernetesEngine.httpRouteName'))"
+    >
+      <UInput v-model="form.httpRouteName" class="font-mono" />
+    </UFormField>
+
+    <UFormField :label="optional(t('settings.infrastructure.kubernetesEngine.scheme'))">
+      <USelect v-model="form.urlScheme" :items="schemeItems" />
+    </UFormField>
+
+    <!-- Optional refinements. -->
+    <UFormField
+      :label="optional(t('settings.infrastructure.kubernetesEngine.namespaceTemplate'))"
+      :help="t('settings.infrastructure.kubernetesEngine.namespaceTemplateHelp')"
+    >
+      <UInput
+        v-model="form.namespaceTemplate"
+        class="font-mono"
+        placeholder="cf-env-{{pullNumber}}"
+      />
+    </UFormField>
+
+    <UFormField
+      :label="optional(t('settings.infrastructure.kubernetesEngine.imageTemplate'))"
+      :help="t('settings.infrastructure.kubernetesEngine.imageTemplateHelp')"
+    >
+      <UInput v-model="form.imageTemplate" class="font-mono" />
+    </UFormField>
+
+    <UFormField
+      :label="optional(t('settings.infrastructure.kubernetesEngine.caCertPem'))"
+      :help="t('settings.infrastructure.kubernetesEngine.caCertPemHelp')"
+    >
+      <UTextarea
+        v-model="form.caCertPem"
+        :rows="3"
+        class="font-mono"
+        placeholder="-----BEGIN CERTIFICATE-----"
+      />
+    </UFormField>
+
+    <UFormField :help="t('settings.infrastructure.kubernetesEngine.insecureSkipTlsVerifyHelp')">
+      <UCheckbox
+        v-model="form.insecureSkipTlsVerify"
+        :label="t('settings.infrastructure.kubernetesEngine.insecureSkipTlsVerify')"
+      />
+    </UFormField>
+
+    <div v-if="supportsTest" class="flex items-center gap-2">
+      <UButton
+        color="neutral"
+        variant="soft"
+        size="sm"
+        icon="i-lucide-plug-zap"
+        :loading="testing"
+        :disabled="!canSave"
+        @click="emit('test', buildPayload())"
+      >
+        {{ t('settings.providerConnection.test.button') }}
+      </UButton>
+      <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
+        {{ testResult.message ?? t('settings.providerConnection.test.ok') }}
+      </span>
+      <span v-else-if="testResult" class="text-xs text-rose-400">
+        {{ testResult.message ?? t('settings.providerConnection.test.failed') }}
+      </span>
+    </div>
+
+    <div class="flex justify-end">
+      <UButton
+        color="primary"
+        size="sm"
+        :loading="busy"
+        :disabled="!canSave"
+        @click="emit('save', buildPayload())"
+      >
+        {{ connected ? t('common.save') : t('settings.providerConnection.form.connect') }}
+      </UButton>
+    </div>
+  </div>
+</template>

package/app/composables/api/infraHandlers.ts

@@ -0,0 +1,89 @@
+import {
+  listEnvironmentHandlersContract,
+  listEnvironmentUserHandlersContract,
+  registerEnvironmentHandlerContract,
+  removeCustomManifestTypeContract,
+  removeEnvironmentUserHandlerContract,
+  unregisterEnvironmentHandlerContract,
+  upsertCustomManifestTypeContract,
+  upsertEnvironmentUserHandlerContract,
+} from '@cat-factory/contracts'
+import type {
+  ProvisionType,
+  RegisterEnvironmentHandlerInput,
+  UpsertCustomManifestTypeInput,
+  UpsertEnvironmentUserHandlerBody,
+} from '@cat-factory/contracts'
+import type { ApiContext } from './context'
+
+/**
+ * Per-provision-type infra HANDLER config (the workspace + per-user "how"): the batched
+ * handler bundle (every workspace handler + the custom-manifest-type catalog),
+ * register/remove for a workspace handler, custom-type CRUD, and — local mode only —
+ * the per-user override handlers (mounted at `/me/...`, so user-scoped, no `/workspaces`
+ * prefix; these 503 off the local facade). See EnvironmentController +
+ * EnvironmentUserHandlerController in @cat-factory/server.
+ */
+export function infraHandlersApi({ send, ws }: ApiContext) {
+  return {
+    // ---- Workspace per-type handlers + custom-type catalog ------------------
+    listEnvironmentHandlers: (workspaceId: string) =>
+      send(listEnvironmentHandlersContract, { pathPrefix: ws(workspaceId) }),
+
+    registerEnvironmentHandler: (workspaceId: string, body: RegisterEnvironmentHandlerInput) =>
+      send(registerEnvironmentHandlerContract, { pathPrefix: ws(workspaceId), body }),
+
+    // `manifestId` (for a `custom` handler) rides as a query param; absent ⇒ the bare handler.
+    unregisterEnvironmentHandler: (
+      workspaceId: string,
+      provisionType: ProvisionType,
+      manifestId?: string,
+    ) =>
+      send(unregisterEnvironmentHandlerContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { provisionType },
+        queryParams: { manifestId },
+      }),
+
+    upsertCustomManifestType: (
+      workspaceId: string,
+      manifestId: string,
+      body: UpsertCustomManifestTypeInput,
+    ) =>
+      send(upsertCustomManifestTypeContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { manifestId },
+        body,
+      }),
+
+    removeCustomManifestType: (workspaceId: string, manifestId: string) =>
+      send(removeCustomManifestTypeContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { manifestId },
+      }),
+
+    // ---- Per-USER override handlers (local mode; `/me/...`, no ws prefix) ----
+    listEnvironmentUserHandlers: (workspaceId: string) =>
+      send(listEnvironmentUserHandlersContract, { pathParams: { workspaceId } }),
+
+    upsertEnvironmentUserHandler: (
+      workspaceId: string,
+      provisionType: ProvisionType,
+      body: UpsertEnvironmentUserHandlerBody,
+    ) =>
+      send(upsertEnvironmentUserHandlerContract, {
+        pathParams: { workspaceId, provisionType },
+        body,
+      }),
+
+    removeEnvironmentUserHandler: (
+      workspaceId: string,
+      provisionType: ProvisionType,
+      manifestId?: string,
+    ) =>
+      send(removeEnvironmentUserHandlerContract, {
+        pathParams: { workspaceId, provisionType },
+        queryParams: { manifestId },
+      }),
+  }
+}

package/app/composables/useApi.ts

@@ -12,6 +12,7 @@ import { fragmentsApi } from './api/fragments'
 import { githubApi } from './api/github'
 import { humanReviewApi } from './api/humanReview'
 import { humanTestApi } from './api/humanTest'
+import { infraHandlersApi } from './api/infraHandlers'
 import { visualConfirmApi } from './api/visualConfirm'
 import { kaizenApi } from './api/kaizen'
 import { localSettingsApi } from './api/localSettings'
@@ -107,6 +108,7 @@ export function useApi() {
     ...notificationsApi(ctx),
     ...presetsApi(ctx),
     ...providerConnectionsApi(ctx),
+    ...infraHandlersApi(ctx),
     ...provisioningLogsApi(ctx),
     ...releaseHealthApi(ctx),
     ...recurringApi(ctx),

package/app/stores/infraConfig.ts

@@ -0,0 +1,172 @@
+import { defineStore } from 'pinia'
+import { ref, type Ref } from 'vue'
+import type {
+  CustomManifestType,
+  EnvironmentHandlerView,
+  ProvisionType,
+  RegisterEnvironmentHandlerInput,
+  UpsertCustomManifestTypeInput,
+  UpsertEnvironmentUserHandlerBody,
+} from '@cat-factory/contracts'
+import { useWorkspaceStore } from '~/stores/workspace'
+
+// One predicate for "this handler is the (type, manifestId) one" — custom handlers are keyed by
+// manifestId, the rest by type alone (manifestId null). Defined once and reused across both the
+// workspace and per-user handler sets so the match key lives in a single place.
+const sameHandler = (h: EnvironmentHandlerView, type: ProvisionType, manifestId?: string | null) =>
+  h.provisionType === type && (h.manifestId ?? null) === (manifestId ?? null)
+
+// Replace the matching entry in a handler-list ref, or append it.
+function upsertInto(list: Ref<EnvironmentHandlerView[]>, saved: EnvironmentHandlerView) {
+  const idx = list.value.findIndex((h) => sameHandler(h, saved.provisionType, saved.manifestId))
+  if (idx >= 0) list.value[idx] = saved
+  else list.value.push(saved)
+}
+
+/**
+ * The per-provision-type infra handlers (the workspace + per-user "how"): for each provision
+ * type a service can declare, which engine + connection the workspace stands its environment
+ * up with, plus the open custom-manifest-type catalog. Loaded on demand (the Infrastructure
+ * window's per-type configurator + the service inspector's custom-type picker), not from the
+ * snapshot, since the secret bundles never leave the server.
+ *
+ * The per-USER override handlers (`userHandlers`) are local mode only — the backend service is
+ * wired solely by the local facade, so the endpoints 503 elsewhere and `userOverridesAvailable`
+ * stays false (the override affordance hides).
+ */
+export const useInfraConfigStore = defineStore('infraConfig', () => {
+  const api = useApi()
+
+  const handlers = ref<EnvironmentHandlerView[]>([])
+  const customTypes = ref<CustomManifestType[]>([])
+  const userHandlers = ref<EnvironmentHandlerView[]>([])
+  const loading = ref(false)
+  // `null` until first probed; `false` ⇒ the test-env handler integration is off (503),
+  // so the configurator hides. Mirrors the other infra stores' availability gate.
+  const available = ref<boolean | null>(null)
+  // Per-user overrides probe independently (local mode only).
+  const userOverridesAvailable = ref<boolean | null>(null)
+  let inFlight: Promise<void> | null = null
+
+  /** Force a refresh of the workspace handler bundle (used after a save/remove). */
+  async function load() {
+    const ws = useWorkspaceStore()
+    loading.value = true
+    try {
+      const bundle = await api.listEnvironmentHandlers(ws.requireId())
+      handlers.value = bundle.handlers
+      customTypes.value = bundle.customTypes
+      available.value = true
+    } catch {
+      // 503 (environments integration off) or any error → hide the configurator.
+      available.value = false
+      handlers.value = []
+      customTypes.value = []
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /**
+   * Load once and share the result: repeated window opens / inspector mounts reuse the
+   * resolved state (and coalesce a concurrent in-flight request). Use `load()` to force a
+   * refresh. The custom-type catalog feeds the service inspector's `custom` picker, so this
+   * is also called there (cheaply) to populate it.
+   */
+  async function ensureLoaded() {
+    if (available.value !== null) return
+    if (!inFlight) inFlight = load().finally(() => (inFlight = null))
+    return inFlight
+  }
+
+  /** The workspace handler matching a provision type (+ manifest id, for `custom`), if registered. */
+  function handlerFor(
+    type: ProvisionType,
+    manifestId?: string | null,
+  ): EnvironmentHandlerView | undefined {
+    return handlers.value.find((h) => sameHandler(h, type, manifestId))
+  }
+
+  async function registerHandler(input: RegisterEnvironmentHandlerInput) {
+    const ws = useWorkspaceStore()
+    const saved = await api.registerEnvironmentHandler(ws.requireId(), input)
+    upsertInto(handlers, saved)
+    return saved
+  }
+
+  async function unregisterHandler(type: ProvisionType, manifestId?: string | null) {
+    const ws = useWorkspaceStore()
+    await api.unregisterEnvironmentHandler(ws.requireId(), type, manifestId ?? undefined)
+    handlers.value = handlers.value.filter((h) => !sameHandler(h, type, manifestId))
+  }
+
+  // ---- Custom-manifest-type catalog CRUD (workspace-defined entries only) ----
+  async function upsertCustomType(manifestId: string, input: UpsertCustomManifestTypeInput) {
+    const ws = useWorkspaceStore()
+    const saved = await api.upsertCustomManifestType(ws.requireId(), manifestId, input)
+    const idx = customTypes.value.findIndex((t) => t.manifestId === saved.manifestId)
+    if (idx >= 0) customTypes.value[idx] = saved
+    else customTypes.value.push(saved)
+    return saved
+  }
+
+  async function removeCustomType(manifestId: string) {
+    const ws = useWorkspaceStore()
+    await api.removeCustomManifestType(ws.requireId(), manifestId)
+    customTypes.value = customTypes.value.filter((t) => t.manifestId !== manifestId)
+  }
+
+  // ---- Per-user override handlers (local mode) ------------------------------
+  async function loadUserHandlers() {
+    const ws = useWorkspaceStore()
+    try {
+      const { handlers: list } = await api.listEnvironmentUserHandlers(ws.requireId())
+      userHandlers.value = list
+      userOverridesAvailable.value = true
+    } catch {
+      // 503 (not the local facade) / not signed in → no per-user overrides surface.
+      userOverridesAvailable.value = false
+      userHandlers.value = []
+    }
+  }
+
+  function userHandlerFor(
+    type: ProvisionType,
+    manifestId?: string | null,
+  ): EnvironmentHandlerView | undefined {
+    return userHandlers.value.find((h) => sameHandler(h, type, manifestId))
+  }
+
+  async function upsertUserHandler(type: ProvisionType, body: UpsertEnvironmentUserHandlerBody) {
+    const ws = useWorkspaceStore()
+    const saved = await api.upsertEnvironmentUserHandler(ws.requireId(), type, body)
+    upsertInto(userHandlers, saved)
+    return saved
+  }
+
+  async function removeUserHandler(type: ProvisionType, manifestId?: string | null) {
+    const ws = useWorkspaceStore()
+    await api.removeEnvironmentUserHandler(ws.requireId(), type, manifestId ?? undefined)
+    userHandlers.value = userHandlers.value.filter((h) => !sameHandler(h, type, manifestId))
+  }
+
+  return {
+    handlers,
+    customTypes,
+    userHandlers,
+    loading,
+    available,
+    userOverridesAvailable,
+    load,
+    ensureLoaded,
+    handlerFor,
+    registerHandler,
+    unregisterHandler,
+    upsertCustomType,
+    removeCustomType,
+    loadUserHandlers,
+    userHandlerFor,
+    upsertUserHandler,
+    removeUserHandler,
+  }
+})

package/app/types/domain.ts

@@ -28,6 +28,7 @@ export type {
   CloudProvider,
   InstanceSize,
   ProvisionType,
+  ServiceProvisioning,
   AgentConfigOption,
   AgentConfigDescriptor,
   TestConcernSeverity,