@cat-factory/contracts 0.50.1 → 0.52.0

package/dist/environments.d.ts

@@ -254,62 +254,116 @@ export declare const environmentManifestSchema: v.ObjectSchema<{
     readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
 }, undefined>;
 export type EnvironmentManifest = v.InferOutput<typeof environmentManifestSchema>;
-/** Resolved access creds for a provisioned env, as surfaced to a tester agent. */
-export declare const environmentAccessHandleSchema: v.ObjectSchema<{
-    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
-    readonly token: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    readonly username: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    readonly password: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    readonly headerValue: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-}, undefined>;
-export type EnvironmentAccessHandle = v.InferOutput<typeof environmentAccessHandleSchema>;
-/** A provisioned environment, as exposed to clients and downstream agents. */
-export declare const environmentHandleSchema: v.ObjectSchema<{
-    readonly id: v.StringSchema<undefined>;
-    readonly workspaceId: v.StringSchema<undefined>;
-    readonly blockId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
-    readonly executionId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
-    readonly providerId: v.StringSchema<undefined>;
-    readonly externalId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
-    readonly url: v.NullableSchema<v.StringSchema<undefined>, undefined>;
-    readonly status: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
-    /** Present only on the dedicated access endpoint / in agent context. */
-    readonly access: v.OptionalSchema<v.ObjectSchema<{
-        readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
-        readonly token: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        readonly username: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        readonly password: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        readonly headerValue: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    }, undefined>, undefined>;
-    readonly createdAt: v.NumberSchema<undefined>;
-    readonly expiresAt: v.NullableSchema<v.NumberSchema<undefined>, undefined>;
-    readonly lastError: v.NullableSchema<v.StringSchema<undefined>, undefined>;
-}, undefined>;
-export type EnvironmentHandle = v.InferOutput<typeof environmentHandleSchema>;
-/** A workspace's provider binding, as exposed to clients (never secret values). */
-export declare const environmentConnectionSchema: v.ObjectSchema<{
-    readonly providerId: v.StringSchema<undefined>;
-    readonly label: v.StringSchema<undefined>;
-    readonly baseUrl: v.StringSchema<undefined>;
-    readonly connectedAt: v.NumberSchema<undefined>;
-    /** Which secret keys are set (names only), so the UI can show completeness. */
-    readonly secretKeys: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+/** The secret-bundle key the Kubernetes env backend reads the ServiceAccount token from. */
+export declare const KUBERNETES_ENV_TOKEN_SECRET_KEY = "apiToken";
+/**
+ * Where the per-PR manifests are read from. `colocated` reads them from the block's
+ * own repo at the PR head branch; `separate` reads them from a different repo (the
+ * Kubernetes definition often lives outside the service repo).
+ */
+export declare const kubernetesManifestSourceSchema: v.VariantSchema<"type", [v.ObjectSchema<{
+    readonly type: v.LiteralSchema<"colocated", undefined>;
+    /** File or directory path within the PR repo (read at the PR head branch). */
+    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+}, undefined>, v.ObjectSchema<{
+    readonly type: v.LiteralSchema<"separate", undefined>;
+    /** `owner/repo` of the manifests repo. */
+    readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+    /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+    readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    /** File or directory path within the manifests repo. */
+    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+}, undefined>], undefined>;
+export type KubernetesManifestSource = v.InferOutput<typeof kubernetesManifestSourceSchema>;
+/** How the environment URL is derived once the manifests are applied. */
+export declare const kubernetesUrlSourceSchema: v.VariantSchema<"source", [v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+    /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+    readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+    /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+    readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+    /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+    readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+    readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>], undefined>;
+export type KubernetesUrlSource = v.InferOutput<typeof kubernetesUrlSourceSchema>;
+export declare const kubernetesEnvironmentConfigSchema: v.ObjectSchema<{
+    /** Human label for the connection (shown in the UI). */
+    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    /**
+     * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+     * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+     * default derived from the PR number / block id.
+     */
+    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+    /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+    readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"colocated", undefined>;
+        /** File or directory path within the PR repo (read at the PR head branch). */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    }, undefined>, v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"separate", undefined>;
+        /** `owner/repo` of the manifests repo. */
+        readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+        /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+        readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        /** File or directory path within the manifests repo. */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    }, undefined>], undefined>;
+    /** How the environment URL is derived once applied. */
+    readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+        readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+        readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+        readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+        readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /**
+     * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+     * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+     */
+    readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    /** Fallback TTL (ms) after which the env is swept + torn down. */
+    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+    /** Extra labels stamped on the namespace + every applied resource. */
+    readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Extra annotations stamped on the namespace. */
+    readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
 }, undefined>;
-export type EnvironmentConnection = v.InferOutput<typeof environmentConnectionSchema>;
+export type KubernetesEnvironmentConfig = v.InferOutput<typeof kubernetesEnvironmentConfigSchema>;
 /**
- * Register (or replace) a workspace's environment provider. The org supplies the
- * actual per-tenant secret values here (write-only); they are encrypted and
- * stored in D1 and never returned. Every `secretRef.key` in the manifest must
- * have a matching entry in `secrets`.
- *
- * A native adapter is configured through the SAME manifest path (see
- * `backend/docs/native-environment-adapter.md`): its non-secret per-workspace
- * settings ride the manifest's opaque `providerConfig` bag and its secrets via
- * the manifest `auth` scheme — there is deliberately no separate config channel.
+ * An ephemeral-environment backend config, discriminated by `kind`. The universal
+ * abstraction over HOW a workspace's preview environments are provisioned: today
+ * `manifest` (the generic BYO HTTP management API) and `kubernetes` (native per-PR
+ * namespaces). Future kinds add a member here + a provider in
+ * `@cat-factory/integrations` — no new table/service/controller. Mirrors
+ * `runnerBackendConfigSchema`; the provider-registry seam keys on `kind`.
  */
-export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
+export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.ObjectSchema<{
+    readonly kind: v.LiteralSchema<"manifest", undefined>;
     readonly manifest: v.ObjectSchema<{
         readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
         readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
@@ -438,6 +492,514 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
          */
         readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
     }, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+    readonly kubernetes: v.ObjectSchema<{
+        /** Human label for the connection (shown in the UI). */
+        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+        /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+        readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+        /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+        readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+        readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+        /**
+         * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+         * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+         * default derived from the PR number / block id.
+         */
+        readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+        /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+        readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"colocated", undefined>;
+            /** File or directory path within the PR repo (read at the PR head branch). */
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"separate", undefined>;
+            /** `owner/repo` of the manifests repo. */
+            readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+            /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+            readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            /** File or directory path within the manifests repo. */
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        }, undefined>], undefined>;
+        /** How the environment URL is derived once applied. */
+        readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+            /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+            readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+            /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+            readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+            /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+            readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+            readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>], undefined>;
+        /**
+         * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+         * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+         */
+        readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Fallback TTL (ms) after which the env is swept + torn down. */
+        readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+        /** Extra labels stamped on the namespace + every applied resource. */
+        readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        /** Extra annotations stamped on the namespace. */
+        readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    }, undefined>;
+}, undefined>], undefined>;
+export type EnvironmentBackendConfig = v.InferOutput<typeof environmentBackendConfigSchema>;
+export type EnvironmentBackendKind = EnvironmentBackendConfig['kind'];
+/** Resolved access creds for a provisioned env, as surfaced to a tester agent. */
+export declare const environmentAccessHandleSchema: v.ObjectSchema<{
+    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+    readonly token: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly username: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly password: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly headerValue: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type EnvironmentAccessHandle = v.InferOutput<typeof environmentAccessHandleSchema>;
+/** A provisioned environment, as exposed to clients and downstream agents. */
+export declare const environmentHandleSchema: v.ObjectSchema<{
+    readonly id: v.StringSchema<undefined>;
+    readonly workspaceId: v.StringSchema<undefined>;
+    readonly blockId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    readonly executionId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    readonly providerId: v.StringSchema<undefined>;
+    readonly externalId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    readonly url: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    readonly status: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+    /** Present only on the dedicated access endpoint / in agent context. */
+    readonly access: v.OptionalSchema<v.ObjectSchema<{
+        readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+        readonly token: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly username: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly password: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly headerValue: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, undefined>;
+    readonly createdAt: v.NumberSchema<undefined>;
+    readonly expiresAt: v.NullableSchema<v.NumberSchema<undefined>, undefined>;
+    readonly lastError: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type EnvironmentHandle = v.InferOutput<typeof environmentHandleSchema>;
+/** A workspace's provider binding, as exposed to clients (never secret values). */
+export declare const environmentConnectionSchema: v.ObjectSchema<{
+    /** Which backend kind is configured (`manifest` | `kubernetes` | …). */
+    readonly kind: v.StringSchema<undefined>;
+    readonly providerId: v.StringSchema<undefined>;
+    readonly label: v.StringSchema<undefined>;
+    readonly baseUrl: v.StringSchema<undefined>;
+    readonly connectedAt: v.NumberSchema<undefined>;
+    /** Which secret keys are set (names only), so the UI can show completeness. */
+    readonly secretKeys: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+    /**
+     * The stored discriminated backend config, sans secrets (those live in the
+     * write-only secret bundle), so the connect form can prefill its non-secret fields
+     * on edit. Omitted only for an unparsable row.
+     */
+    readonly config: v.OptionalSchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"manifest", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a *native* injected adapter (e.g. a
+             * Kargo project, link-selection key, status map). The generic HttpEnvironmentProvider
+             * ignores it entirely; a native adapter (injected via `buildNodeContainer({
+             * environmentProvider })` / `startLocal({ environmentProvider })`) reads + validates it
+             * off the per-call `manifest`. This is the per-WORKSPACE config carrier for native
+             * adapters — the deployment-wide provider singleton has no other way to receive
+             * per-workspace settings. NOT covered by the manifest URL/SSRF checks (which only guard
+             * `baseUrl`/`tokenUrl`); an adapter that puts a URL here must guard it itself (reuse the
+             * exported `UrlSafetyPolicy`). See `backend/docs/native-environment-adapter.md`.
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            /** Human label for the connection (shown in the UI). */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+             * default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+            readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"colocated", undefined>;
+                /** File or directory path within the PR repo (read at the PR head branch). */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"separate", undefined>;
+                /** `owner/repo` of the manifests repo. */
+                readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+                readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                /** File or directory path within the manifests repo. */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            }, undefined>], undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /**
+             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+             */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>], undefined>, undefined>;
+}, undefined>;
+export type EnvironmentConnection = v.InferOutput<typeof environmentConnectionSchema>;
+/**
+ * Register (or replace) a workspace's environment provider. `config` is the
+ * discriminated backend config (the generic HTTP manifest, or a native Kubernetes
+ * backend); the org supplies the actual per-tenant secret values here (write-only) —
+ * a manifest's management-API credentials, or a Kubernetes ServiceAccount token
+ * (`apiToken`). Secrets are encrypted at rest and never returned. Every secret key
+ * the chosen backend references must have a matching entry in `secrets`.
+ */
+export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
+    readonly config: v.VariantSchema<"kind", [v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"manifest", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a *native* injected adapter (e.g. a
+             * Kargo project, link-selection key, status map). The generic HttpEnvironmentProvider
+             * ignores it entirely; a native adapter (injected via `buildNodeContainer({
+             * environmentProvider })` / `startLocal({ environmentProvider })`) reads + validates it
+             * off the per-call `manifest`. This is the per-WORKSPACE config carrier for native
+             * adapters — the deployment-wide provider singleton has no other way to receive
+             * per-workspace settings. NOT covered by the manifest URL/SSRF checks (which only guard
+             * `baseUrl`/`tokenUrl`); an adapter that puts a URL here must guard it itself (reuse the
+             * exported `UrlSafetyPolicy`). See `backend/docs/native-environment-adapter.md`.
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            /** Human label for the connection (shown in the UI). */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+             * default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+            readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"colocated", undefined>;
+                /** File or directory path within the PR repo (read at the PR head branch). */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"separate", undefined>;
+                /** `owner/repo` of the manifests repo. */
+                readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+                readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                /** File or directory path within the manifests repo. */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            }, undefined>], undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /**
+             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+             */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>], undefined>;
     readonly secrets: v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>;
 }, undefined>;
 export type RegisterEnvironmentProviderInput = v.InferOutput<typeof registerEnvironmentProviderSchema>;
@@ -447,140 +1009,202 @@ export declare const updateEnvironmentSecretsSchema: v.ObjectSchema<{
 }, undefined>;
 export type UpdateEnvironmentSecretsInput = v.InferOutput<typeof updateEnvironmentSecretsSchema>;
 /**
- * Test (probe) a provider connection before saving. A manifest-driven provider
- * supplies the candidate `manifest` + `secrets`; a native provider supplies its
- * `config` (non-secret fields) + `secrets`. Nothing is persisted by a test.
+ * Test (probe) a provider connection before saving: supply the candidate
+ * discriminated `config` + its `secrets`. Nothing is persisted by a test.
  */
 export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
-    readonly manifest: v.OptionalSchema<v.ObjectSchema<{
-        readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-        /** Management API root; provision/status/teardown paths are appended to it. */
-        readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-        readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"none", undefined>;
-        }, undefined>, v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"api_key", undefined>;
-            readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            readonly secretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-            /** Optional prefix prepended to the secret value, e.g. `Token `. */
-            readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        }, undefined>, v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"bearer", undefined>;
-            readonly secretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-        }, undefined>, v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"basic", undefined>;
-            readonly usernameSecretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-            readonly passwordSecretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-        }, undefined>, v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
-            readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            readonly clientIdSecretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-            readonly clientSecretSecretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-            readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        }, undefined>, v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"custom_headers", undefined>;
-            readonly headers: v.ArraySchema<v.ObjectSchema<{
-                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    readonly config: v.OptionalSchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"manifest", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                 readonly secretRef: v.ObjectSchema<{
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                 }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
             }, undefined>, undefined>;
-        }, undefined>], undefined>;
-        readonly provision: v.ObjectSchema<{
-            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
-            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly key: v.StringSchema<undefined>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
-            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
-        }, undefined>;
-        /** Optional: polled to observe async provisioning progress. */
-        readonly status: v.OptionalSchema<v.ObjectSchema<{
-            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
-            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly key: v.StringSchema<undefined>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
-            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
-        }, undefined>, undefined>;
-        /** Optional: called to destroy the environment (manual or on TTL expiry). */
-        readonly teardown: v.OptionalSchema<v.ObjectSchema<{
-            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
-            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly key: v.StringSchema<undefined>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
-            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
-        }, undefined>, undefined>;
-        readonly response: v.ObjectSchema<{
-            readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly from: v.StringSchema<undefined>;
-                readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly access: v.OptionalSchema<v.ObjectSchema<{
-                readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
-                readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
             }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a *native* injected adapter (e.g. a
+             * Kargo project, link-selection key, status map). The generic HttpEnvironmentProvider
+             * ignores it entirely; a native adapter (injected via `buildNodeContainer({
+             * environmentProvider })` / `startLocal({ environmentProvider })`) reads + validates it
+             * off the per-call `manifest`. This is the per-WORKSPACE config carrier for native
+             * adapters — the deployment-wide provider singleton has no other way to receive
+             * per-workspace settings. NOT covered by the manifest URL/SSRF checks (which only guard
+             * `baseUrl`/`tokenUrl`); an adapter that puts a URL here must guard it itself (reuse the
+             * exported `UrlSafetyPolicy`). See `backend/docs/native-environment-adapter.md`.
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
         }, undefined>;
-        /** Fallback TTL (ms) when the response carries no explicit expiry. */
-        readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-        /**
-         * Opaque, provider-specific configuration for a *native* injected adapter (e.g. a
-         * Kargo project, link-selection key, status map). The generic HttpEnvironmentProvider
-         * ignores it entirely; a native adapter (injected via `buildNodeContainer({
-         * environmentProvider })` / `startLocal({ environmentProvider })`) reads + validates it
-         * off the per-call `manifest`. This is the per-WORKSPACE config carrier for native
-         * adapters — the deployment-wide provider singleton has no other way to receive
-         * per-workspace settings. NOT covered by the manifest URL/SSRF checks (which only guard
-         * `baseUrl`/`tokenUrl`); an adapter that puts a URL here must guard it itself (reuse the
-         * exported `UrlSafetyPolicy`). See `backend/docs/native-environment-adapter.md`.
-         */
-        readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-    }, undefined>, undefined>;
-    readonly config: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            /** Human label for the connection (shown in the UI). */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+             * default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+            readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"colocated", undefined>;
+                /** File or directory path within the PR repo (read at the PR head branch). */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"separate", undefined>;
+                /** `owner/repo` of the manifests repo. */
+                readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+                readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                /** File or directory path within the manifests repo. */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            }, undefined>], undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /**
+             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+             */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>], undefined>, undefined>;
     readonly secrets: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
 }, undefined>;
 export type TestEnvironmentConnectionInput = v.InferOutput<typeof testEnvironmentConnectionSchema>;