@cat-factory/contracts 0.283.1 → 0.284.0

package/dist/environments-kubernetes.d.ts

@@ -0,0 +1,720 @@
+import * as v from 'valibot';
+/** The secret-bundle key the Kubernetes env backend reads the ServiceAccount token from. */
+export declare const KUBERNETES_ENV_TOKEN_SECRET_KEY = "apiToken";
+/**
+ * How the manifests at `path` are turned into apiserver-ready resources. `raw` (the
+ * default, and the only one the in-Worker native REST adapter handles) treats `path` as
+ * a single manifest file or a flat directory of already-valid YAML docs. `kustomize`
+ * treats `path` as an overlay directory (`kustomization.yaml` + `resources`/`components`/
+ * `bases`) that must be `kustomize build`-rendered before apply — which only the
+ * container-backed deploy adapter can do (it shells out to real `kustomize`/`helm`).
+ */
+export declare const kubernetesRendererSchema: v.PicklistSchema<["raw", "kustomize"], undefined>;
+export type KubernetesRenderer = v.InferOutput<typeof kubernetesRendererSchema>;
+/**
+ * Where the per-PR manifests are read from. `colocated` reads them from the block's
+ * own repo at the PR head branch; `separate` reads them from a different repo (the
+ * Kubernetes definition often lives outside the service repo). `renderer` (absent ⇒
+ * `raw`) selects how `path` is turned into resources; `kustomize` requires the
+ * container-backed deploy adapter.
+ */
+export declare const kubernetesManifestSourceSchema: v.VariantSchema<"type", [v.ObjectSchema<{
+    readonly type: v.LiteralSchema<"colocated", undefined>;
+    /** File or directory path within the PR repo (read at the PR head branch). */
+    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly type: v.LiteralSchema<"separate", undefined>;
+    /** `owner/repo` of the manifests repo. */
+    readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+    /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+    readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    /** File or directory path within the manifests repo. */
+    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+}, undefined>], undefined>;
+export type KubernetesManifestSource = v.InferOutput<typeof kubernetesManifestSourceSchema>;
+/** How the environment URL is derived once the manifests are applied. */
+export declare const kubernetesUrlSourceSchema: v.VariantSchema<"source", [v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+    /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+    readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+    /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+    readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+    /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+    readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+    readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+    /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+    readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+    /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+    readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>], undefined>;
+export type KubernetesUrlSource = v.InferOutput<typeof kubernetesUrlSourceSchema>;
+/**
+ * Whether a stored value is still a `source` this build knows how to derive a URL from —
+ * DERIVED from the variant's own members, so it cannot drift from them the way a second
+ * hand-written list would (the {@link isBinaryModality} treatment, for the same reason).
+ *
+ * The discriminant is a closed vocabulary that is nonetheless PERSISTED, on every stored
+ * Kubernetes environment config. A reader that maps it through an exhaustive `switch` is
+ * therefore total against the TYPE and partial against the DATA: a config written by a
+ * deployment that knows a source this one does not falls off the end of every branch. Narrow
+ * with this before assigning a stored value anywhere the exhaustive switch will see it.
+ */
+export declare function isKubernetesUrlSource(value: unknown): value is KubernetesUrlSource['source'];
+/**
+ * What it takes to REACH a cluster's apiserver, split out of the full config below.
+ *
+ * Standing an environment up needs the whole config; reclaiming one needs only this. That
+ * split is load-bearing rather than cosmetic: a stored config is re-parsed on the way out
+ * ({@link parseStoredProviderConfig}), so a `manifestSource` or `url` block that stopped
+ * matching the contract would otherwise refuse the teardown too, and an environment nobody
+ * can reclaim goes on costing money until a human notices. Teardown validates what it uses
+ * and nothing else, so drift in the provisioning half can never strand a live namespace.
+ *
+ * `apiServerUrl` is not in that forgiving set, deliberately: it stays REQUIRED because there is
+ * no safe default for "which cluster", and a DELETE aimed at a guessed one is worse than a
+ * refusal.
+ */
+export declare const kubernetesConnectionConfigSchema: v.ObjectSchema<{
+    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+}, undefined>;
+export type KubernetesConnectionConfig = v.InferOutput<typeof kubernetesConnectionConfigSchema>;
+export declare const kubernetesEnvironmentConfigSchema: v.ObjectSchema<{
+    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    /** Human label for the connection (shown in the UI). */
+    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    /**
+     * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+     * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+     * default derived from the PR number / block id.
+     */
+    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+    /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+    readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"colocated", undefined>;
+        /** File or directory path within the PR repo (read at the PR head branch). */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"separate", undefined>;
+        /** `owner/repo` of the manifests repo. */
+        readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+        /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+        readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        /** File or directory path within the manifests repo. */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /** How the environment URL is derived once applied. */
+    readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+        readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+        readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+        readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+        readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+        /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+        readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+        /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+        readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /**
+     * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+     * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+     */
+    readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    /** Fallback TTL (ms) after which the env is swept + torn down. */
+    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+    /**
+     * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+     * before reporting the env still `provisioning` (the backend keeps polling). Only the
+     * container-backed render path honors it; absent ⇒ the harness default (180s).
+     */
+    readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+    /** Extra labels stamped on the namespace + every applied resource. */
+    readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Extra annotations stamped on the namespace. */
+    readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+}, undefined>;
+export type KubernetesEnvironmentConfig = v.InferOutput<typeof kubernetesEnvironmentConfigSchema>;
+/**
+ * A structured image override (the kustomize `images:` equivalent, generalizing the
+ * legacy `{{image}}` text substitution). Matches a container image by `name` and
+ * overrides its repo and/or tag/digest; the override values are templated over the
+ * provision vars (e.g. `newTagTemplate: '{{branch}}'`).
+ */
+export declare const kubernetesImageOverrideSchema: v.SchemaWithPipe<readonly [v.ObjectSchema<{
+    /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+    readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+    readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    /** Replacement digest, templated; alternative to a tag. */
+    readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+}, undefined>, v.CheckAction<{
+    name: string;
+    newNameTemplate?: string | undefined;
+    newTagTemplate?: string | undefined;
+    digestTemplate?: string | undefined;
+}, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+    name: string;
+    newNameTemplate?: string | undefined;
+    newTagTemplate?: string | undefined;
+    digestTemplate?: string | undefined;
+}, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>;
+export type KubernetesImageOverride = v.InferOutput<typeof kubernetesImageOverrideSchema>;
+/** A single templated `--set path=value` for a helm release. */
+export declare const kubernetesHelmSetSchema: v.ObjectSchema<{
+    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    /** The value, templated over the provision vars. */
+    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+}, undefined>;
+export type KubernetesHelmSet = v.InferOutput<typeof kubernetesHelmSetSchema>;
+/**
+ * A helm release the deploy adapter installs/upgrades (`helm upgrade --install`).
+ * `scope: 'shared'` is a cluster singleton (installed once, never torn down per-PR —
+ * e.g. an ingress/gateway controller); `per-environment` (the default) re-installs in
+ * each per-PR namespace. The `version` pin is required so provisioning is deterministic.
+ */
+export declare const kubernetesHelmReleaseSchema: v.ObjectSchema<{
+    /** Release name. */
+    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+    readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+    readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+    /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+    readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+    /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    /** Inline `--values` overrides. */
+    readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+    /** Templated `--set` overrides. */
+    readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+        /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** The value, templated over the provision vars. */
+        readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+    }, undefined>, undefined>, undefined>;
+    /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+    readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        readonly secretRef: v.ObjectSchema<{
+            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+        }, undefined>;
+    }, undefined>, undefined>, undefined>;
+    readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+}, undefined>;
+export type KubernetesHelmRelease = v.InferOutput<typeof kubernetesHelmReleaseSchema>;
+/** One entry inside an injected Secret: a logical key mapped to a secret-bundle ref OR a templated value. */
+export declare const kubernetesSecretEntrySchema: v.SchemaWithPipe<readonly [v.ObjectSchema<{
+    /** Key inside the rendered Secret / `.env`. */
+    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+    /** Resolve the value from the workspace encrypted bundle by key. */
+    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+    }, undefined>, undefined>;
+    /** OR a non-secret value, templated over the provision vars. */
+    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+}, undefined>, v.CheckAction<{
+    key: string;
+    secretRef?: {
+        key: string;
+    } | undefined;
+    valueTemplate?: string | undefined;
+}, "a secret entry must set exactly one of secretRef or valueTemplate.">]>;
+export type KubernetesSecretEntry = v.InferOutput<typeof kubernetesSecretEntrySchema>;
+/**
+ * How the deploy adapter feeds resolved secret values in before apply, discriminated by
+ * `mode`. The mapping of logical keys is in-repo intent; the values resolve from the
+ * encrypted bundle at provision time (the config carries secret KEYS, never values).
+ *
+ * - `secret`: materialize a `Secret` resource named `secretName` directly in the namespace.
+ * - `generatorEnvFile`: write the entries as a `KEY=value` `.env` file at `envFilePath`
+ *   (repo-relative, inside the overlay tree) BEFORE `kustomize build`, so the overlay's own
+ *   existing `secretGenerator` consumes it. This is the common ephemeral-environment shape
+ *   where a Component declares `secretGenerator: { envs: ['.env'] }`, the Secret is named by
+ *   the overlay, and the real `.env` is supplied at deploy time (e.g. from a secrets manager).
+ *   Use this instead of `secret` when the manifests already declare a `secretGenerator`, so
+ *   the two don't collide.
+ */
+export declare const kubernetesSecretInjectionSchema: v.VariantSchema<"mode", [v.ObjectSchema<{
+    readonly mode: v.LiteralSchema<"secret", undefined>;
+    /** Target Secret name in the namespace. */
+    readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    /** Secret `type`; absent ⇒ `Opaque`. */
+    readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+        /** Key inside the rendered Secret / `.env`. */
+        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+        /** Resolve the value from the workspace encrypted bundle by key. */
+        readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+        }, undefined>, undefined>;
+        /** OR a non-secret value, templated over the provision vars. */
+        readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+    }, undefined>, v.CheckAction<{
+        key: string;
+        secretRef?: {
+            key: string;
+        } | undefined;
+        valueTemplate?: string | undefined;
+    }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+    /**
+     * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+     * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+     * overlay names the Secret.
+     */
+    readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+        /** Key inside the rendered Secret / `.env`. */
+        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+        /** Resolve the value from the workspace encrypted bundle by key. */
+        readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+        }, undefined>, undefined>;
+        /** OR a non-secret value, templated over the provision vars. */
+        readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+    }, undefined>, v.CheckAction<{
+        key: string;
+        secretRef?: {
+            key: string;
+        } | undefined;
+        valueTemplate?: string | undefined;
+    }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+}, undefined>], undefined>;
+export type KubernetesSecretInjection = v.InferOutput<typeof kubernetesSecretInjectionSchema>;
+/**
+ * The full Kubernetes provision config the deploy adapter consumes: the combined cluster +
+ * URL + manifest-source config PLUS the kustomize/helm render inputs (image overrides, helm
+ * releases, secret injections). It is assembled at provision time by MERGING the workspace
+ * kube engine config (the "how": apiserver, sizing, shared helm releases) with the service's
+ * own provisioning (the "what/where": manifest source, per-environment helm releases, image
+ * overrides, secret injections) — so the provider reads everything it needs from one place.
+ * The native in-Worker REST adapter ignores the render fields (raw manifests only); the
+ * container-backed deploy adapter consumes them. Carries secret KEYS, never values.
+ */
+export declare const kubernetesProvisionConfigSchema: v.ObjectSchema<{
+    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    /** Human label for the connection (shown in the UI). */
+    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    /**
+     * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+     * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+     * default derived from the PR number / block id.
+     */
+    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+    /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+    readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"colocated", undefined>;
+        /** File or directory path within the PR repo (read at the PR head branch). */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"separate", undefined>;
+        /** `owner/repo` of the manifests repo. */
+        readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+        /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+        readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        /** File or directory path within the manifests repo. */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /** How the environment URL is derived once applied. */
+    readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+        readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+        readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+        readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+        readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+        /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+        readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+        /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+        readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /**
+     * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+     * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+     */
+    readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    /** Fallback TTL (ms) after which the env is swept + torn down. */
+    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+    /**
+     * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+     * before reporting the env still `provisioning` (the backend keeps polling). Only the
+     * container-backed render path honors it; absent ⇒ the harness default (180s).
+     */
+    readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+    /** Extra labels stamped on the namespace + every applied resource. */
+    readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Extra annotations stamped on the namespace. */
+    readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+    readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+        /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+        readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+        readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Replacement digest, templated; alternative to a tag. */
+        readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    }, undefined>, v.CheckAction<{
+        name: string;
+        newNameTemplate?: string | undefined;
+        newTagTemplate?: string | undefined;
+        digestTemplate?: string | undefined;
+    }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+        name: string;
+        newNameTemplate?: string | undefined;
+        newTagTemplate?: string | undefined;
+        digestTemplate?: string | undefined;
+    }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+    /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+    readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+        /** Release name. */
+        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+        readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+        readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+        readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+        /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+        readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Inline `--values` overrides. */
+        readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        /** Templated `--set` overrides. */
+        readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** The value, templated over the provision vars. */
+            readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+        }, undefined>, undefined>, undefined>;
+        /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+        readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            readonly secretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+        }, undefined>, undefined>, undefined>;
+        readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+    }, undefined>, undefined>, undefined>;
+    /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+    readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+        readonly mode: v.LiteralSchema<"secret", undefined>;
+        /** Target Secret name in the namespace. */
+        readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Secret `type`; absent ⇒ `Opaque`. */
+        readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+            /** Key inside the rendered Secret / `.env`. */
+            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+            /** Resolve the value from the workspace encrypted bundle by key. */
+            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>, undefined>;
+            /** OR a non-secret value, templated over the provision vars. */
+            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        }, undefined>, v.CheckAction<{
+            key: string;
+            secretRef?: {
+                key: string;
+            } | undefined;
+            valueTemplate?: string | undefined;
+        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+        /**
+         * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+         * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+         * overlay names the Secret.
+         */
+        readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+            /** Key inside the rendered Secret / `.env`. */
+            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+            /** Resolve the value from the workspace encrypted bundle by key. */
+            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>, undefined>;
+            /** OR a non-secret value, templated over the provision vars. */
+            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        }, undefined>, v.CheckAction<{
+            key: string;
+            secretRef?: {
+                key: string;
+            } | undefined;
+            valueTemplate?: string | undefined;
+        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+    }, undefined>], undefined>, undefined>, undefined>;
+}, undefined>;
+export type KubernetesProvisionConfig = v.InferOutput<typeof kubernetesProvisionConfigSchema>;
+/**
+ * The AWS EKS provision config: the full Kubernetes provision config (an EKS apiserver is a
+ * standard apiserver, so per-PR namespaces + manifest apply are identical) PLUS the AWS
+ * `region` + `clusterName` needed to mint the IAM apiserver token. The AWS credentials ride
+ * the secret bundle; the SigV4/STS minting lives in `@cat-factory/eks`.
+ */
+export declare const eksProvisionConfigSchema: v.ObjectSchema<{
+    readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+    readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
+    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    /** Human label for the connection (shown in the UI). */
+    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    /**
+     * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+     * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+     * default derived from the PR number / block id.
+     */
+    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+    /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+    readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"colocated", undefined>;
+        /** File or directory path within the PR repo (read at the PR head branch). */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"separate", undefined>;
+        /** `owner/repo` of the manifests repo. */
+        readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+        /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+        readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        /** File or directory path within the manifests repo. */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /** How the environment URL is derived once applied. */
+    readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+        readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+        readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+        readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+        readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+        /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+        readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+        /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+        readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /**
+     * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+     * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+     */
+    readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    /** Fallback TTL (ms) after which the env is swept + torn down. */
+    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+    /**
+     * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+     * before reporting the env still `provisioning` (the backend keeps polling). Only the
+     * container-backed render path honors it; absent ⇒ the harness default (180s).
+     */
+    readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+    /** Extra labels stamped on the namespace + every applied resource. */
+    readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Extra annotations stamped on the namespace. */
+    readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+    readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+        /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+        readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+        readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Replacement digest, templated; alternative to a tag. */
+        readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    }, undefined>, v.CheckAction<{
+        name: string;
+        newNameTemplate?: string | undefined;
+        newTagTemplate?: string | undefined;
+        digestTemplate?: string | undefined;
+    }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+        name: string;
+        newNameTemplate?: string | undefined;
+        newTagTemplate?: string | undefined;
+        digestTemplate?: string | undefined;
+    }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+    /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+    readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+        /** Release name. */
+        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+        readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+        readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+        readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+        /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+        readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Inline `--values` overrides. */
+        readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        /** Templated `--set` overrides. */
+        readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** The value, templated over the provision vars. */
+            readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+        }, undefined>, undefined>, undefined>;
+        /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+        readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            readonly secretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+        }, undefined>, undefined>, undefined>;
+        readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+    }, undefined>, undefined>, undefined>;
+    /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+    readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+        readonly mode: v.LiteralSchema<"secret", undefined>;
+        /** Target Secret name in the namespace. */
+        readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Secret `type`; absent ⇒ `Opaque`. */
+        readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+            /** Key inside the rendered Secret / `.env`. */
+            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+            /** Resolve the value from the workspace encrypted bundle by key. */
+            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>, undefined>;
+            /** OR a non-secret value, templated over the provision vars. */
+            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        }, undefined>, v.CheckAction<{
+            key: string;
+            secretRef?: {
+                key: string;
+            } | undefined;
+            valueTemplate?: string | undefined;
+        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+        /**
+         * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+         * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+         * overlay names the Secret.
+         */
+        readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+            /** Key inside the rendered Secret / `.env`. */
+            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+            /** Resolve the value from the workspace encrypted bundle by key. */
+            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>, undefined>;
+            /** OR a non-secret value, templated over the provision vars. */
+            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        }, undefined>, v.CheckAction<{
+            key: string;
+            secretRef?: {
+                key: string;
+            } | undefined;
+            valueTemplate?: string | undefined;
+        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+    }, undefined>], undefined>, undefined>, undefined>;
+}, undefined>;
+export type EksProvisionConfig = v.InferOutput<typeof eksProvisionConfigSchema>;
+/**
+ * The EKS counterpart of {@link kubernetesConnectionConfigSchema}: what it takes to reach the
+ * cluster, which on EKS includes the AWS coordinates the apiserver token is minted against.
+ * Same split, same reason — a reclaim validates the connection and not the provisioning recipe.
+ */
+export declare const eksConnectionConfigSchema: v.ObjectSchema<{
+    readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+    readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
+    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+}, undefined>;
+export type EksConnectionConfig = v.InferOutput<typeof eksConnectionConfigSchema>;
+//# sourceMappingURL=environments-kubernetes.d.ts.map