@cat-factory/eks 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Igor Savin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,92 @@
+# @cat-factory/eks
+
+Opt-in AWS **EKS** backends for cat-factory — a runner backend (per-run agent pods) and an
+ephemeral-environment backend (per-PR namespaces), both on an Amazon EKS cluster.
+
+## Why this is a thin package
+
+An EKS cluster's API server **is** a standard Kubernetes API server, so this package **reuses
+the entire native Kubernetes transport/provider** from `@cat-factory/integrations`
+(`KubernetesRunnerTransport`, `KubernetesEnvironmentProvider`, `KubernetesApiClient`) verbatim.
+The only EKS-specific piece is **authentication**: EKS doesn't use a static ServiceAccount
+bearer token — it expects a short-lived IAM token (a SigV4-presigned STS `GetCallerIdentity`
+URL, prefixed `k8s-aws-v1.`, the exact token `aws eks get-token` produces). That token is
+minted here with WebCrypto (`eks-auth.logic.ts`), so the package carries **no runtime AWS SDK
+dependency** and is runtime-neutral. It's injected through the async token seam
+`KubernetesApiClient` exposes, so no transport logic is duplicated.
+
+## Enabling it
+
+The backends are **not** in the default registries (which stay AWS-free). A facade opts in by
+registering them **by reference** from its composition root (the Node/local facades already do
+this in `backend/runtimes/node/src/container.ts`):
+
+```ts
+import { eksRunnerBackend, eksEnvironmentBackend } from '@cat-factory/eks'
+registries.runnerBackendRegistry.register(eksRunnerBackend)
+registries.environmentBackendRegistry.register(eksEnvironmentBackend)
+```
+
+A workspace then connects an `eks` runner/environment backend with an `EksRunnerConfig` /
+`EksProvisionConfig` (the Kubernetes config — apiserver endpoint, CA, namespace, image — plus
+`region` + `clusterName`), and the AWS credentials (`awsAccessKeyId` / `awsSecretAccessKey` /
+optional `awsSessionToken`) in the write-only secret bundle.
+
+Both facades register the backends by reference (`backend/runtimes/node/src/container.ts` and
+`backend/runtimes/cloudflare/src/infrastructure/container.ts`), keeping the runtimes symmetric
+with the native `kubernetes` backend they extend.
+
+> **Runtime reach.** A real EKS cluster's apiserver presents a **private CA**, which only a
+> runtime that can pin a custom CA (Node/local, via `undici`) can verify — the SAME constraint a
+> private-CA `kubernetes` connection already carries. The Worker registers the `eks` kind for
+> symmetry, but a connection to such a cluster is rejected up front at registration when the
+> runtime can't honor the custom CA (`customTlsSupported: false`), so it fails loudly rather than
+> silently at first dispatch.
+
+### UI reach
+
+The **runner** backend is a first-class UI citizen: it self-describes its connect form via the
+`RunnerBackendProvider.form` descriptor, so the SPA renders it generically (region / cluster /
+credentials + the shared apiserver fields) with **no** EKS-specific frontend code — the same
+descriptor-driven path the built-in Kubernetes runner backend now uses.
+
+The **environment** backend is functional when resolved by kind, but is not yet surfaced as its
+own first-class environment _engine_ in the SPA infra-handler selector (the connect flow would
+lower to `{ kind: 'eks' }` rather than `{ kind: 'kubernetes' }`). That needs a dedicated
+`InfraEngine('eks')` threaded through the contract engine union + `handlerConfigToBackendConfig`
+
+- the per-provision-type SPA forms — tracked in
+  [`docs/initiatives/descriptor-driven-infra-forms.md`](../../../docs/initiatives/descriptor-driven-infra-forms.md).
+
+## Tests
+
+- **Unit** (`pnpm --filter @cat-factory/eks test:run`, runs in the required CI gate): the
+  SigV4/STS token minter golden vector + the `{ kind: 'eks' }` contract round-trip. No cluster.
+- **Integration** (`pnpm --filter @cat-factory/eks test:integration`): drives the EKS
+  transport/provider against a **real** apiserver. Self-skips unless `EKS_IT_*` is set. Runs in
+  the **non-blocking** `test-eks` CI job (see `.github/workflows/ci.yml`).
+
+### Running the integration suite against floci
+
+[floci](https://floci.io) is a local, LocalStack-compatible AWS emulator whose EKS "real mode"
+stands up a **real k3s container per EKS cluster** and exposes its Kubernetes API server on a host
+port. Boot floci (pinned to the version this suite is validated against), create a cluster with the
+AWS CLI, then export the connection:
+
+```sh
+docker run -d --name floci -p 4566:4566 -v /var/run/docker.sock:/var/run/docker.sock -u root floci/floci:1.5.30
+export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test AWS_DEFAULT_REGION=us-east-1
+aws --endpoint-url=http://localhost:4566 eks create-cluster --name cat-factory-it \
+  --role-arn arn:aws:iam::000000000000:role/eks --resources-vpc-config '{}'
+# ...wait for ACTIVE, then read endpoint + CA:
+export EKS_IT_APISERVER=$(aws --endpoint-url=http://localhost:4566 eks describe-cluster --name cat-factory-it --query cluster.endpoint --output text)
+export EKS_IT_REGION=us-east-1 EKS_IT_CLUSTER_NAME=cat-factory-it
+export EKS_IT_ACCESS_KEY_ID=test EKS_IT_SECRET_ACCESS_KEY=test
+export EKS_IT_STS_HOST=localhost:4566 EKS_IT_INSECURE=1
+export EKS_IT_RUNNER_IMAGE=cat-factory-mock-harness:it   # runner suite only
+pnpm --filter @cat-factory/eks run test:integration
+```
+
+The `stsHost` override (`EKS_IT_STS_HOST` → the config's `stsHost`) points the presigned STS
+`GetCallerIdentity` URL at floci instead of real AWS. See `src/test-support/eks-cluster.ts` for the
+full env list and for exactly what floci does — and does not — cover at the auth layer.

package/dist/EksEnvironmentProvider.d.ts

@@ -0,0 +1,7 @@
+import { KubernetesApiClient, KubernetesEnvironmentProvider } from '@cat-factory/integrations';
+import type { KubernetesEnvironmentConfig, ProviderConfigField, SecretResolver } from '@cat-factory/kernel';
+export declare class EksEnvironmentProvider extends KubernetesEnvironmentProvider {
+    protected makeClient(config: KubernetesEnvironmentConfig, resolveSecret: SecretResolver): KubernetesApiClient;
+    describeConfig(): ProviderConfigField[];
+}
+//# sourceMappingURL=EksEnvironmentProvider.d.ts.map

package/dist/EksEnvironmentProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EksEnvironmentProvider.d.ts","sourceRoot":"","sources":["../src/EksEnvironmentProvider.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAE9B,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EACV,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACf,MAAM,qBAAqB,CAAA;AAU5B,qBAAa,sBAAuB,SAAQ,6BAA6B;IACvE,UAAmB,UAAU,CAC3B,MAAM,EAAE,2BAA2B,EACnC,aAAa,EAAE,cAAc,GAC5B,mBAAmB,CAQrB;IAEQ,cAAc,IAAI,mBAAmB,EAAE,CAiB/C;CACF"}

package/dist/EksEnvironmentProvider.js

@@ -0,0 +1,35 @@
+import { EKS_ACCESS_KEY_ID_SECRET_KEY, EKS_SECRET_ACCESS_KEY_SECRET_KEY, } from '@cat-factory/contracts';
+import { KubernetesApiClient, KubernetesEnvironmentProvider, kubernetesLogic, } from '@cat-factory/integrations';
+import { eksTokenProvider } from './eks-auth.logic.js';
+// The AWS EKS ephemeral-environment provider. An EKS apiserver is a standard Kubernetes
+// apiserver, so per-PR namespace creation, server-side manifest apply, deployment-readiness
+// polling and LoadBalancer/Ingress/Gateway URL resolution are IDENTICAL — this reuses all of
+// `KubernetesEnvironmentProvider` and only overrides the auth seam (`makeClient`) to inject the
+// minted EKS IAM token, plus `describeConfig` to surface the AWS credential fields instead of a
+// static ServiceAccount token. The parsed config rides the stored manifest's `providerConfig`
+// (an `EksProvisionConfig`), so `region`/`clusterName` are present at runtime.
+export class EksEnvironmentProvider extends KubernetesEnvironmentProvider {
+    makeClient(config, resolveSecret) {
+        const eks = config;
+        return new KubernetesApiClient(config, resolveSecret, kubernetesLogic.KUBERNETES_TOKEN_KEY, eksTokenProvider(eks, resolveSecret));
+    }
+    describeConfig() {
+        // EKS authenticates with AWS credentials (used to mint the short-lived apiserver IAM token),
+        // not a static ServiceAccount token — so the unconfigured banner clears on these keys.
+        return [
+            {
+                key: EKS_ACCESS_KEY_ID_SECRET_KEY,
+                label: 'AWS access key id',
+                secret: true,
+                required: true,
+            },
+            {
+                key: EKS_SECRET_ACCESS_KEY_SECRET_KEY,
+                label: 'AWS secret access key',
+                secret: true,
+                required: true,
+            },
+        ];
+    }
+}
+//# sourceMappingURL=EksEnvironmentProvider.js.map

package/dist/EksEnvironmentProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EksEnvironmentProvider.js","sourceRoot":"","sources":["../src/EksEnvironmentProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GAEjC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAMlC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,wFAAwF;AACxF,4FAA4F;AAC5F,6FAA6F;AAC7F,gGAAgG;AAChG,gGAAgG;AAChG,8FAA8F;AAC9F,+EAA+E;AAC/E,MAAM,OAAO,sBAAuB,SAAQ,6BAA6B;IACpD,UAAU,CAC3B,MAAmC,EACnC,aAA6B;QAE7B,MAAM,GAAG,GAAG,MAA4B,CAAA;QACxC,OAAO,IAAI,mBAAmB,CAC5B,MAAM,EACN,aAAa,EACb,eAAe,CAAC,oBAAoB,EACpC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CACrC,CAAA;IACH,CAAC;IAEQ,cAAc;QACrB,6FAA6F;QAC7F,uFAAuF;QACvF,OAAO;YACL;gBACE,GAAG,EAAE,4BAA4B;gBACjC,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,GAAG,EAAE,gCAAgC;gBACrC,KAAK,EAAE,uBAAuB;gBAC9B,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;aACf;SACF,CAAA;IACH,CAAC;CACF"}

package/dist/EksRunnerTransport.d.ts

@@ -0,0 +1,7 @@
+import type { EksRunnerConfig } from '@cat-factory/contracts';
+import { KubernetesRunnerTransport } from '@cat-factory/integrations';
+import type { SecretResolver } from '@cat-factory/kernel';
+export declare class EksRunnerTransport extends KubernetesRunnerTransport {
+    constructor(config: EksRunnerConfig, resolveSecret: SecretResolver);
+}
+//# sourceMappingURL=EksRunnerTransport.d.ts.map

package/dist/EksRunnerTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EksRunnerTransport.d.ts","sourceRoot":"","sources":["../src/EksRunnerTransport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAUzD,qBAAa,kBAAmB,SAAQ,yBAAyB;IAC/D,YAAY,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAEjE;CACF"}

package/dist/EksRunnerTransport.js

@@ -0,0 +1,15 @@
+import { KubernetesRunnerTransport } from '@cat-factory/integrations';
+import { eksTokenProvider } from './eks-auth.logic.js';
+// The AWS EKS runner transport. An EKS cluster's apiserver IS a standard Kubernetes apiserver,
+// so this reuses the ENTIRE native Kubernetes per-run-pod transport (pod creation, readiness
+// wait, pod-proxy dispatch/poll, eviction handling) VERBATIM — the only difference is auth. It
+// injects the async EKS token provider (a SigV4-presigned STS token minted per use from the
+// workspace's AWS credentials + `region`/`clusterName`) through the transport's token seam, so
+// there is zero duplicated transport logic. An `EksRunnerConfig` is a `KubernetesRunnerConfig`
+// plus the AWS `region`/`clusterName`, so it is passed straight to the base class.
+export class EksRunnerTransport extends KubernetesRunnerTransport {
+    constructor(config, resolveSecret) {
+        super(config, resolveSecret, eksTokenProvider(config, resolveSecret));
+    }
+}
+//# sourceMappingURL=EksRunnerTransport.js.map

package/dist/EksRunnerTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EksRunnerTransport.js","sourceRoot":"","sources":["../src/EksRunnerTransport.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAErE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,+FAA+F;AAC/F,6FAA6F;AAC7F,+FAA+F;AAC/F,4FAA4F;AAC5F,+FAA+F;AAC/F,+FAA+F;AAC/F,mFAAmF;AACnF,MAAM,OAAO,kBAAmB,SAAQ,yBAAyB;IAC/D,YAAY,MAAuB,EAAE,aAA6B;QAChE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;IACvE,CAAC;CACF"}

package/dist/eks-auth.logic.d.ts

@@ -0,0 +1,39 @@
+import type { KubernetesTokenProvider } from '@cat-factory/integrations';
+import type { SecretResolver } from '@cat-factory/kernel';
+/** Static AWS credentials the SigV4 signature is computed from. */
+export interface EksAwsCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** Present for temporary (STS / assume-role) credentials; folded in as `X-Amz-Security-Token`. */
+    sessionToken?: string;
+}
+export interface MintEksTokenParams {
+    region: string;
+    clusterName: string;
+    credentials: EksAwsCredentials;
+    /** Epoch ms for `X-Amz-Date`. Injectable so the token is deterministic in tests. Defaults to `Date.now()`. */
+    now?: number;
+    /**
+     * STS host override, e.g. floci's emulated STS endpoint. Defaults to the regional public STS
+     * host `sts.<region>.amazonaws.com`. Only the HOST is overridable (the scheme stays https).
+     */
+    stsHost?: string;
+}
+/**
+ * Mint an EKS apiserver bearer token (`k8s-aws-v1.<base64url(presigned STS URL)>`).
+ * Pure + deterministic given `now`.
+ */
+export declare function mintEksToken(params: MintEksTokenParams): Promise<string>;
+/**
+ * Build the async token provider `KubernetesApiClient` calls per request. It reads the AWS
+ * credentials from the run's secret bundle and mints a token, caching it briefly so a single
+ * transport call (e.g. an apply loop) mints once rather than per apiserver request.
+ */
+export declare function eksTokenProvider(cluster: {
+    region: string;
+    clusterName: string;
+    stsHost?: string;
+}, resolveSecret: SecretResolver): KubernetesTokenProvider;
+/** Read the AWS credentials from the encrypted secret bundle. Throws if the required keys are absent. */
+export declare function readAwsCredentials(resolveSecret: SecretResolver): EksAwsCredentials;
+//# sourceMappingURL=eks-auth.logic.d.ts.map

package/dist/eks-auth.logic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eks-auth.logic.d.ts","sourceRoot":"","sources":["../src/eks-auth.logic.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AA2BzD,mEAAmE;AACnE,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,kGAAkG;IAClG,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,8GAA8G;IAC9G,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C9E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EAClE,aAAa,EAAE,cAAc,GAC5B,uBAAuB,CAazB;AAED,yGAAyG;AACzG,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,cAAc,GAAG,iBAAiB,CAWnF"}

package/dist/eks-auth.logic.js

@@ -0,0 +1,174 @@
+import { EKS_ACCESS_KEY_ID_SECRET_KEY, EKS_SECRET_ACCESS_KEY_SECRET_KEY, EKS_SESSION_TOKEN_SECRET_KEY, } from '@cat-factory/contracts';
+// ---------------------------------------------------------------------------
+// AWS EKS apiserver authentication.
+//
+// EKS does not use a static ServiceAccount bearer token. Instead the apiserver is fronted by
+// the aws-iam-authenticator webhook, which accepts a token that is a base64url-encoded,
+// SigV4-PRESIGNED `sts:GetCallerIdentity` URL, prefixed with `k8s-aws-v1.` — the exact token
+// `aws eks get-token` / the AWS SDKs produce. The EKS cluster name is bound into the signature
+// via the SIGNED header `x-k8s-aws-id`, so a token minted for one cluster cannot be replayed
+// against another. The token is short-lived (~15 min), which is precisely why it can't be a
+// stored static secret and must be minted per use (behind the async `KubernetesTokenProvider`
+// seam in `KubernetesApiClient`).
+//
+// This is implemented with WebCrypto (`crypto.subtle`, HMAC-SHA256 + SHA-256) so it is
+// runtime-neutral (Node + the Cloudflare Worker) and carries NO AWS SDK runtime dependency.
+// The signing is a pure function of its inputs (credentials + region + cluster + timestamp),
+// so it is deterministically golden-vector testable.
+// ---------------------------------------------------------------------------
+const ALGORITHM = 'AWS4-HMAC-SHA256';
+const SERVICE = 'sts';
+const CLUSTER_HEADER = 'x-k8s-aws-id';
+const TOKEN_PREFIX = 'k8s-aws-v1.';
+/** X-Amz-Expires for the presign. 60s is what aws-iam-authenticator uses; the k8s side accepts the token for ~15m. */
+const PRESIGN_EXPIRES_SECONDS = 60;
+/**
+ * Mint an EKS apiserver bearer token (`k8s-aws-v1.<base64url(presigned STS URL)>`).
+ * Pure + deterministic given `now`.
+ */
+export async function mintEksToken(params) {
+    const { region, clusterName, credentials } = params;
+    const stsHost = params.stsHost ?? `sts.${region}.amazonaws.com`;
+    const now = new Date(params.now ?? Date.now());
+    const amzDate = toAmzDate(now);
+    const dateStamp = amzDate.slice(0, 8);
+    const credentialScope = `${dateStamp}/${region}/${SERVICE}/aws4_request`;
+    // The presign query params (everything except the signature itself), sorted canonically.
+    const query = {
+        Action: 'GetCallerIdentity',
+        Version: '2011-06-15',
+        'X-Amz-Algorithm': ALGORITHM,
+        'X-Amz-Credential': `${credentials.accessKeyId}/${credentialScope}`,
+        'X-Amz-Date': amzDate,
+        'X-Amz-Expires': String(PRESIGN_EXPIRES_SECONDS),
+        'X-Amz-SignedHeaders': `host;${CLUSTER_HEADER}`,
+    };
+    if (credentials.sessionToken)
+        query['X-Amz-Security-Token'] = credentials.sessionToken;
+    const canonicalQuery = canonicalQueryString(query);
+    // The cluster name is bound via a SIGNED header — this is what makes the token cluster-scoped.
+    const canonicalHeaders = `host:${stsHost}\n${CLUSTER_HEADER}:${clusterName}\n`;
+    const signedHeaders = `host;${CLUSTER_HEADER}`;
+    // STS is not S3, so a presigned GET with no body hashes the empty string (not UNSIGNED-PAYLOAD).
+    const payloadHash = await sha256Hex('');
+    const canonicalRequest = [
+        'GET',
+        '/',
+        canonicalQuery,
+        canonicalHeaders,
+        signedHeaders,
+        payloadHash,
+    ].join('\n');
+    const stringToSign = [
+        ALGORITHM,
+        amzDate,
+        credentialScope,
+        await sha256Hex(canonicalRequest),
+    ].join('\n');
+    const signingKey = await deriveSigningKey(credentials.secretAccessKey, dateStamp, region);
+    const signature = toHex(await hmac(signingKey, stringToSign));
+    const presignedUrl = `https://${stsHost}/?${canonicalQuery}&X-Amz-Signature=${signature}`;
+    return TOKEN_PREFIX + base64UrlEncode(new TextEncoder().encode(presignedUrl));
+}
+/**
+ * Build the async token provider `KubernetesApiClient` calls per request. It reads the AWS
+ * credentials from the run's secret bundle and mints a token, caching it briefly so a single
+ * transport call (e.g. an apply loop) mints once rather than per apiserver request.
+ */
+export function eksTokenProvider(cluster, resolveSecret) {
+    // Refresh well before the ~15m server-side acceptance window; a fresh mint is cheap.
+    const CACHE_TTL_MS = 10 * 60_000;
+    const REFRESH_GUARD_MS = 60_000;
+    let cached = null;
+    return async () => {
+        const now = Date.now();
+        if (cached && cached.expiresAt - REFRESH_GUARD_MS > now)
+            return cached.token;
+        const credentials = readAwsCredentials(resolveSecret);
+        const token = await mintEksToken({ ...cluster, credentials, now });
+        cached = { token, expiresAt: now + CACHE_TTL_MS };
+        return token;
+    };
+}
+/** Read the AWS credentials from the encrypted secret bundle. Throws if the required keys are absent. */
+export function readAwsCredentials(resolveSecret) {
+    const accessKeyId = resolveSecret(EKS_ACCESS_KEY_ID_SECRET_KEY);
+    const secretAccessKey = resolveSecret(EKS_SECRET_ACCESS_KEY_SECRET_KEY);
+    if (!accessKeyId || !secretAccessKey) {
+        throw new Error(`Missing AWS credentials for EKS ('${EKS_ACCESS_KEY_ID_SECRET_KEY}' / ` +
+            `'${EKS_SECRET_ACCESS_KEY_SECRET_KEY}').`);
+    }
+    const sessionToken = resolveSecret(EKS_SESSION_TOKEN_SECRET_KEY) || undefined;
+    return { accessKeyId, secretAccessKey, sessionToken };
+}
+// --- SigV4 primitives (WebCrypto) ------------------------------------------
+/** Format an epoch Date as the SigV4 `YYYYMMDDTHHMMSSZ` basic ISO-8601 timestamp (UTC). */
+function toAmzDate(d) {
+    const p = (n) => String(n).padStart(2, '0');
+    return (`${d.getUTCFullYear()}${p(d.getUTCMonth() + 1)}${p(d.getUTCDate())}` +
+        `T${p(d.getUTCHours())}${p(d.getUTCMinutes())}${p(d.getUTCSeconds())}Z`);
+}
+/** Sort the query params by key and RFC3986-encode both key and value (including `/` in values). */
+function canonicalQueryString(params) {
+    return Object.keys(params)
+        .sort()
+        .map((k) => `${awsUriEncode(k)}=${awsUriEncode(params[k])}`)
+        .join('&');
+}
+/** RFC3986 percent-encoding as AWS SigV4 requires (unreserved = A-Za-z0-9-_.~; everything else encoded). */
+function awsUriEncode(value) {
+    let out = '';
+    for (const byte of new TextEncoder().encode(value)) {
+        const isUnreserved = (byte >= 0x41 && byte <= 0x5a) || // A-Z
+            (byte >= 0x61 && byte <= 0x7a) || // a-z
+            (byte >= 0x30 && byte <= 0x39) || // 0-9
+            byte === 0x2d || // -
+            byte === 0x2e || // .
+            byte === 0x5f || // _
+            byte === 0x7e; // ~
+        out += isUnreserved
+            ? String.fromCharCode(byte)
+            : `%${byte.toString(16).toUpperCase().padStart(2, '0')}`;
+    }
+    return out;
+}
+/** The SigV4 signing key: HMAC chain over date → region → service → `aws4_request`. */
+async function deriveSigningKey(secretAccessKey, dateStamp, region) {
+    const kDate = await hmac(new TextEncoder().encode(`AWS4${secretAccessKey}`), dateStamp);
+    const kRegion = await hmac(kDate, region);
+    const kService = await hmac(kRegion, SERVICE);
+    return hmac(kService, 'aws4_request');
+}
+async function hmac(key, message) {
+    const cryptoKey = await crypto.subtle.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign('HMAC', cryptoKey, new TextEncoder().encode(message));
+    return new Uint8Array(sig);
+}
+async function sha256Hex(message) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(message));
+    return toHex(new Uint8Array(digest));
+}
+function toHex(bytes) {
+    let out = '';
+    for (const b of bytes)
+        out += b.toString(16).padStart(2, '0');
+    return out;
+}
+/** URL-safe, unpadded base64 (the token envelope EKS expects). */
+function base64UrlEncode(bytes) {
+    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+    let out = '';
+    for (let i = 0; i < bytes.length; i += 3) {
+        const b0 = bytes[i];
+        const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
+        const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
+        out += chars[b0 >> 2];
+        out += chars[((b0 & 0x03) << 4) | (b1 >> 4)];
+        if (i + 1 < bytes.length)
+            out += chars[((b1 & 0x0f) << 2) | (b2 >> 6)];
+        if (i + 2 < bytes.length)
+            out += chars[b2 & 0x3f];
+    }
+    return out;
+}
+//# sourceMappingURL=eks-auth.logic.js.map

package/dist/eks-auth.logic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eks-auth.logic.js","sourceRoot":"","sources":["../src/eks-auth.logic.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,EAChC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAI/B,8EAA8E;AAC9E,oCAAoC;AACpC,EAAE;AACF,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,+FAA+F;AAC/F,6FAA6F;AAC7F,4FAA4F;AAC5F,8FAA8F;AAC9F,kCAAkC;AAClC,EAAE;AACF,uFAAuF;AACvF,4FAA4F;AAC5F,6FAA6F;AAC7F,qDAAqD;AACrD,8EAA8E;AAE9E,MAAM,SAAS,GAAG,kBAAkB,CAAA;AACpC,MAAM,OAAO,GAAG,KAAK,CAAA;AACrB,MAAM,cAAc,GAAG,cAAc,CAAA;AACrC,MAAM,YAAY,GAAG,aAAa,CAAA;AAClC,sHAAsH;AACtH,MAAM,uBAAuB,GAAG,EAAE,CAAA;AAuBlC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAA0B;IAC3D,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,CAAA;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,gBAAgB,CAAA;IAC/D,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACrC,MAAM,eAAe,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,OAAO,eAAe,CAAA;IAExE,yFAAyF;IACzF,MAAM,KAAK,GAA2B;QACpC,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,YAAY;QACrB,iBAAiB,EAAE,SAAS;QAC5B,kBAAkB,EAAE,GAAG,WAAW,CAAC,WAAW,IAAI,eAAe,EAAE;QACnE,YAAY,EAAE,OAAO;QACrB,eAAe,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAChD,qBAAqB,EAAE,QAAQ,cAAc,EAAE;KAChD,CAAA;IACD,IAAI,WAAW,CAAC,YAAY;QAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,WAAW,CAAC,YAAY,CAAA;IAEtF,MAAM,cAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAClD,+FAA+F;IAC/F,MAAM,gBAAgB,GAAG,QAAQ,OAAO,KAAK,cAAc,IAAI,WAAW,IAAI,CAAA;IAC9E,MAAM,aAAa,GAAG,QAAQ,cAAc,EAAE,CAAA;IAC9C,iGAAiG;IACjG,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,CAAA;IACvC,MAAM,gBAAgB,GAAG;QACvB,KAAK;QACL,GAAG;QACH,cAAc;QACd,gBAAgB;QAChB,aAAa;QACb,WAAW;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,MAAM,YAAY,GAAG;QACnB,SAAS;QACT,OAAO;QACP,eAAe;QACf,MAAM,SAAS,CAAC,gBAAgB,CAAC;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IACzF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAA;IAE7D,MAAM,YAAY,GAAG,WAAW,OAAO,KAAK,cAAc,oBAAoB,SAAS,EAAE,CAAA;IACzF,OAAO,YAAY,GAAG,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAkE,EAClE,aAA6B;IAE7B,qFAAqF;IACrF,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAA;IAChC,MAAM,gBAAgB,GAAG,MAAM,CAAA;IAC/B,IAAI,MAAM,GAAgD,IAAI,CAAA;IAC9D,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,gBAAgB,GAAG,GAAG;YAAE,OAAO,MAAM,CAAC,KAAK,CAAA;QAC5E,MAAM,WAAW,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAA;QACrD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAA;QAClE,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,YAAY,EAAE,CAAA;QACjD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;AACH,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,kBAAkB,CAAC,aAA6B;IAC9D,MAAM,WAAW,GAAG,aAAa,CAAC,4BAA4B,CAAC,CAAA;IAC/D,MAAM,eAAe,GAAG,aAAa,CAAC,gCAAgC,CAAC,CAAA;IACvE,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,qCAAqC,4BAA4B,MAAM;YACrE,IAAI,gCAAgC,KAAK,CAC5C,CAAA;IACH,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,4BAA4B,CAAC,IAAI,SAAS,CAAA;IAC7E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,CAAA;AACvD,CAAC;AAED,8EAA8E;AAE9E,2FAA2F;AAC3F,SAAS,SAAS,CAAC,CAAO;IACxB,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACnD,OAAO,CACL,GAAG,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QACpE,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,GAAG,CACxE,CAAA;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,oBAAoB,CAAC,MAA8B;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SACvB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;SAC5D,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,4GAA4G;AAC5G,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,YAAY,GAChB,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;YACxC,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;YACxC,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;YACxC,IAAI,KAAK,IAAI,IAAI,IAAI;YACrB,IAAI,KAAK,IAAI,IAAI,IAAI;YACrB,IAAI,KAAK,IAAI,IAAI,IAAI;YACrB,IAAI,KAAK,IAAI,CAAA,CAAC,IAAI;QACpB,GAAG,IAAI,YAAY;YACjB,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;YAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,gBAAgB,CAC7B,eAAuB,EACvB,SAAiB,EACjB,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,eAAe,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IACvF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,OAAO,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;AACvC,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAe,EAAE,OAAe;IAClD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,GAA6B,EAC7B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAC1F,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;AAC5B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IACvF,OAAO,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AACtC,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,kEAAkE;AAClE,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,KAAK,GAAG,kEAAkE,CAAA;IAChF,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACpB,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,GAAG,IAAI,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;QACrB,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;YAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QACtE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;YAAE,GAAG,IAAI,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/eks-environment-backend.d.ts

@@ -0,0 +1,3 @@
+import { type EnvironmentBackendProvider } from '@cat-factory/integrations';
+export declare const eksEnvironmentBackend: EnvironmentBackendProvider;
+//# sourceMappingURL=eks-environment-backend.d.ts.map

package/dist/eks-environment-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eks-environment-backend.d.ts","sourceRoot":"","sources":["../src/eks-environment-backend.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,0BAA0B,EAAmB,MAAM,2BAA2B,CAAA;AAkB5F,eAAO,MAAM,qBAAqB,EAAE,0BA4BnC,CAAA"}

package/dist/eks-environment-backend.js

@@ -0,0 +1,66 @@
+import { EKS_ACCESS_KEY_ID_SECRET_KEY, EKS_SECRET_ACCESS_KEY_SECRET_KEY, } from '@cat-factory/contracts';
+import { kubernetesLogic } from '@cat-factory/integrations';
+import { EksEnvironmentProvider } from './EksEnvironmentProvider.js';
+// The AWS EKS ephemeral-environment backend: per-PR namespaces on an EKS cluster, identical to
+// the built-in `kubernetes` backend but authenticated with a minted IAM token. Registered by
+// reference (opt-in) into the app-owned `EnvironmentBackendRegistry`; resolved by `kind` at
+// provision time (`buildFromRecord` → `get('eks')`), so `buildProvider` returns the real
+// `EksEnvironmentProvider`.
+//
+// `engines()` returns `remote-kubernetes` (an EKS cluster IS a remote Kubernetes apiserver).
+// The built-in `kubernetes` backend is registered first, so it still wins `byEngine` — this
+// backend never shadows it and is reached by explicitly pinning `backendKind: 'eks'`. NOTE:
+// surfacing EKS as its OWN first-class engine in the SPA infra-handler selector (so the connect
+// flow lowers to `{ kind: 'eks' }` rather than `{ kind: 'kubernetes' }`) needs a dedicated
+// `InfraEngine('eks')` threaded through the contract engine union + `handlerConfigToBackendConfig`
+// + the SPA forms — a scoped follow-up. The provider itself is fully functional today when
+// resolved by kind (direct/API use and the integration suite construct it directly).
+export const eksEnvironmentBackend = {
+    kind: 'eks',
+    displayLabel: 'AWS EKS',
+    engines: () => ['remote-kubernetes'],
+    referencedSecretKeys: (config) => 'eks' in config ? [EKS_ACCESS_KEY_ID_SECRET_KEY, EKS_SECRET_ACCESS_KEY_SECRET_KEY] : [],
+    connectionMeta: (config) => {
+        if (!('eks' in config))
+            throw new Error('Expected an EKS environment config');
+        return {
+            providerId: 'eks',
+            label: config.eks.label,
+            baseUrl: config.eks.apiServerUrl,
+        };
+    },
+    assertConfigSafe: (config, opts) => {
+        if (!('eks' in config))
+            return;
+        kubernetesLogic.assertApiServerUrlSafe(config.eks.apiServerUrl);
+        kubernetesLogic.assertCustomTlsSupported(config.eks, opts);
+    },
+    toManifest: (config) => {
+        if (!('eks' in config))
+            throw new Error('Expected an EKS environment config');
+        return toEksManifest(config.eks);
+    },
+    fromManifest: (manifest) => ({
+        kind: 'eks',
+        eks: manifest.providerConfig,
+    }),
+    buildProvider: (ctx) => new EksEnvironmentProvider({ urlPolicy: ctx.urlPolicy }),
+};
+/** Store the EKS provision config on an EnvironmentManifest (the native adapter ignores the HTTP fields). */
+function toEksManifest(config) {
+    return {
+        providerId: 'eks',
+        label: config.label,
+        // The apiserver root; NOT manifest-SSRF-checked (a cluster is routinely a private host) —
+        // the backend runs `assertApiServerUrlSafe` instead.
+        baseUrl: config.apiServerUrl,
+        // Inert for the native adapter (which mints an IAM token), but the manifest schema
+        // requires an auth + provision + response; supply placeholders.
+        auth: { type: 'bearer', secretRef: { key: EKS_ACCESS_KEY_ID_SECRET_KEY } },
+        provision: { method: 'POST', pathTemplate: '' },
+        response: {},
+        ...(config.defaultTtlMs ? { defaultTtlMs: config.defaultTtlMs } : {}),
+        providerConfig: config,
+    };
+}
+//# sourceMappingURL=eks-environment-backend.js.map

package/dist/eks-environment-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eks-environment-backend.js","sourceRoot":"","sources":["../src/eks-environment-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GAEjC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAmC,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAEpE,+FAA+F;AAC/F,6FAA6F;AAC7F,4FAA4F;AAC5F,yFAAyF;AACzF,4BAA4B;AAC5B,EAAE;AACF,6FAA6F;AAC7F,4FAA4F;AAC5F,4FAA4F;AAC5F,gGAAgG;AAChG,2FAA2F;AAC3F,mGAAmG;AACnG,2FAA2F;AAC3F,qFAAqF;AACrF,MAAM,CAAC,MAAM,qBAAqB,GAA+B;IAC/D,IAAI,EAAE,KAAK;IACX,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,mBAAmB,CAAC;IACpC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC/B,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,4BAA4B,EAAE,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAAE;IACzF,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE;QACzB,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAC7E,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACvB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY;SACjC,CAAA;IACH,CAAC;IACD,gBAAgB,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;YAAE,OAAM;QAC9B,eAAe,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAC/D,eAAe,CAAC,wBAAwB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC5D,CAAC;IACD,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IACD,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3B,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,QAAQ,CAAC,cAA+C;KAC9D,CAAC;IACF,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,sBAAsB,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;CACjF,CAAA;AAED,6GAA6G;AAC7G,SAAS,aAAa,CAAC,MAA0B;IAC/C,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,0FAA0F;QAC1F,qDAAqD;QACrD,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,mFAAmF;QACnF,gEAAgE;QAChE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,EAAE;QAC1E,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;QAC/C,QAAQ,EAAE,EAAE;QACZ,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,cAAc,EAAE,MAA4C;KAC7D,CAAA;AACH,CAAC"}

package/dist/eks-form.logic.d.ts

@@ -0,0 +1,6 @@
+import type { ProviderConfigField } from '@cat-factory/kernel';
+/** Non-secret AWS cluster fields (region + cluster name + optional STS host override). */
+export declare const EKS_CLUSTER_FORM_FIELDS: ProviderConfigField[];
+/** AWS credential secrets (access key + secret key required, session token optional). */
+export declare const EKS_CREDENTIAL_FORM_FIELDS: ProviderConfigField[];
+//# sourceMappingURL=eks-form.logic.d.ts.map

package/dist/eks-form.logic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eks-form.logic.d.ts","sourceRoot":"","sources":["../src/eks-form.logic.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAQ9D,0FAA0F;AAC1F,eAAO,MAAM,uBAAuB,EAAE,mBAAmB,EAqBxD,CAAA;AAED,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,EAAE,mBAAmB,EAc3D,CAAA"}

package/dist/eks-form.logic.js

@@ -0,0 +1,46 @@
+import { EKS_ACCESS_KEY_ID_SECRET_KEY, EKS_SECRET_ACCESS_KEY_SECRET_KEY, EKS_SESSION_TOKEN_SECRET_KEY, } from '@cat-factory/contracts';
+// The EKS-specific flat connect-form fields, shared by the runner + environment backends so the
+// two can't drift. An EKS config is a Kubernetes config (its shared apiserver fields come from
+// `kubernetesLogic.KUBERNETES_RUNNER_FORM_FIELDS`) PLUS these AWS fields: the non-secret
+// region/cluster/STS-host used to mint the IAM apiserver token, and the credential secrets that
+// ride the write-only bundle. The SPA renders them generically — it never knows EKS exists.
+/** Non-secret AWS cluster fields (region + cluster name + optional STS host override). */
+export const EKS_CLUSTER_FORM_FIELDS = [
+    {
+        key: 'region',
+        label: 'AWS region',
+        required: true,
+        placeholder: 'us-east-1',
+        help: 'The cluster region — the regional STS endpoint + the SigV4 credential scope.',
+    },
+    {
+        key: 'clusterName',
+        label: 'EKS cluster name',
+        required: true,
+        placeholder: 'prod',
+        help: 'Bound into the presigned STS token via the signed x-k8s-aws-id header.',
+    },
+    {
+        key: 'stsHost',
+        label: 'STS host override',
+        placeholder: 'sts.us-east-1.amazonaws.com',
+        help: 'Set for a VPC/FIPS/GovCloud STS endpoint. Bare host or host:port; defaults to the regional public endpoint.',
+    },
+];
+/** AWS credential secrets (access key + secret key required, session token optional). */
+export const EKS_CREDENTIAL_FORM_FIELDS = [
+    { key: EKS_ACCESS_KEY_ID_SECRET_KEY, label: 'AWS access key id', secret: true, required: true },
+    {
+        key: EKS_SECRET_ACCESS_KEY_SECRET_KEY,
+        label: 'AWS secret access key',
+        secret: true,
+        required: true,
+    },
+    {
+        key: EKS_SESSION_TOKEN_SECRET_KEY,
+        label: 'AWS session token',
+        secret: true,
+        help: 'Only for temporary (STS / assume-role) credentials.',
+    },
+];
+//# sourceMappingURL=eks-form.logic.js.map

package/dist/eks-form.logic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eks-form.logic.js","sourceRoot":"","sources":["../src/eks-form.logic.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,EAChC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAG/B,gGAAgG;AAChG,+FAA+F;AAC/F,yFAAyF;AACzF,gGAAgG;AAChG,4FAA4F;AAE5F,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAA0B;IAC5D;QACE,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,WAAW;QACxB,IAAI,EAAE,8EAA8E;KACrF;IACD;QACE,GAAG,EAAE,aAAa;QAClB,KAAK,EAAE,kBAAkB;QACzB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,MAAM;QACnB,IAAI,EAAE,wEAAwE;KAC/E;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,6GAA6G;KACpH;CACF,CAAA;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,0BAA0B,GAA0B;IAC/D,EAAE,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/F;QACE,GAAG,EAAE,gCAAgC;QACrC,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,4BAA4B;QACjC,KAAK,EAAE,mBAAmB;QAC1B,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,qDAAqD;KAC5D;CACF,CAAA"}

package/dist/eks-runner-backend.d.ts

@@ -0,0 +1,3 @@
+import { type RunnerBackendProvider } from '@cat-factory/integrations';
+export declare const eksRunnerBackend: RunnerBackendProvider;
+//# sourceMappingURL=eks-runner-backend.d.ts.map

package/dist/eks-runner-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eks-runner-backend.d.ts","sourceRoot":"","sources":["../src/eks-runner-backend.ts"],"names":[],"mappings":"AAIA,OAAO,EAAmB,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AAcvF,eAAO,MAAM,gBAAgB,EAAE,qBA+C9B,CAAA"}

package/dist/eks-runner-backend.js

@@ -0,0 +1,63 @@
+import { EKS_ACCESS_KEY_ID_SECRET_KEY, EKS_SECRET_ACCESS_KEY_SECRET_KEY, } from '@cat-factory/contracts';
+import { kubernetesLogic } from '@cat-factory/integrations';
+import { EKS_CLUSTER_FORM_FIELDS, EKS_CREDENTIAL_FORM_FIELDS } from './eks-form.logic.js';
+import { EksRunnerTransport } from './EksRunnerTransport.js';
+// The AWS EKS runner backend: native per-run pods on an EKS cluster over the apiserver
+// pod-proxy, exactly like the built-in `kubernetes` backend but authenticated with a minted
+// IAM token instead of a static ServiceAccount token. Registered by reference (opt-in) into the
+// app-owned `RunnerBackendRegistry` from a facade's composition root — the default registry
+// stays AWS-free (see `@cat-factory/integrations` `createBackendRegistries`).
+//
+// Routing is by `kind`, so this backend only ever sees its own `{ kind: 'eks', eks }` config;
+// the structural `'eks' in config` narrowing (not `config.kind === 'eks'`) is used because the
+// open contract union also carries a generic custom member whose `kind` could equal `'eks'`.
+export const eksRunnerBackend = {
+    kind: 'eks',
+    displayLabel: 'AWS EKS',
+    // The typed flat connect form the SPA renders generically — the SAME shared apiserver fields
+    // as the native Kubernetes backend PLUS the AWS region/cluster + credential secrets. The
+    // config skeleton the flat fields overlay onto is `{ kind: 'eks', eks }`, so the SPA assembles
+    // an EKS config without knowing EKS exists (it reads the single payload key off the skeleton).
+    form: {
+        fields: () => [
+            ...kubernetesLogic.KUBERNETES_RUNNER_FORM_FIELDS,
+            ...EKS_CLUSTER_FORM_FIELDS,
+            ...EKS_CREDENTIAL_FORM_FIELDS,
+        ],
+        skeleton: () => ({ kind: 'eks', eks: {} }),
+        valuesFromConfig: (config) => 'eks' in config
+            ? kubernetesLogic.flattenConfigValues(config.eks, [
+                ...kubernetesLogic.KUBERNETES_RUNNER_FORM_FIELDS,
+                ...EKS_CLUSTER_FORM_FIELDS,
+            ])
+            : {},
+    },
+    referencedSecretKeys: (config) => 'eks' in config ? [EKS_ACCESS_KEY_ID_SECRET_KEY, EKS_SECRET_ACCESS_KEY_SECRET_KEY] : [],
+    connectionMeta: (config) => {
+        if (!('eks' in config))
+            throw new Error('Expected an EKS runner config');
+        return {
+            providerId: 'eks',
+            label: config.eks.label,
+            baseUrl: config.eks.apiServerUrl,
+        };
+    },
+    assertConfigSafe: (config, opts) => {
+        if (!('eks' in config))
+            return;
+        kubernetesLogic.assertApiServerUrlSafe(config.eks.apiServerUrl);
+        kubernetesLogic.assertCustomTlsSupported(config.eks, opts);
+    },
+    buildTransport: (config, ctx) => {
+        if (!('eks' in config))
+            throw new Error('Expected an EKS runner config');
+        return new EksRunnerTransport(config.eks, ctx.resolveSecret);
+    },
+    testConnection: (config, ctx) => {
+        if (!('eks' in config)) {
+            return Promise.resolve({ ok: false, message: 'Expected an EKS runner config' });
+        }
+        return new EksRunnerTransport(config.eks, ctx.resolveSecret).testConnection();
+    },
+};
+//# sourceMappingURL=eks-runner-backend.js.map

package/dist/eks-runner-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eks-runner-backend.js","sourceRoot":"","sources":["../src/eks-runner-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,eAAe,EAA8B,MAAM,2BAA2B,CAAA;AAEvF,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,uFAAuF;AACvF,4FAA4F;AAC5F,gGAAgG;AAChG,4FAA4F;AAC5F,8EAA8E;AAC9E,EAAE;AACF,8FAA8F;AAC9F,+FAA+F;AAC/F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gBAAgB,GAA0B;IACrD,IAAI,EAAE,KAAK;IACX,YAAY,EAAE,SAAS;IACvB,6FAA6F;IAC7F,yFAAyF;IACzF,+FAA+F;IAC/F,+FAA+F;IAC/F,IAAI,EAAE;QACJ,MAAM,EAAE,GAAG,EAAE,CAAC;YACZ,GAAG,eAAe,CAAC,6BAA6B;YAChD,GAAG,uBAAuB;YAC1B,GAAG,0BAA0B;SAC9B;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAwB;QACjE,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC3B,KAAK,IAAI,MAAM;YACb,CAAC,CAAC,eAAe,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAyC,EAAE;gBACpF,GAAG,eAAe,CAAC,6BAA6B;gBAChD,GAAG,uBAAuB;aAC3B,CAAC;YACJ,CAAC,CAAC,EAAE;KACT;IACD,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC/B,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,4BAA4B,EAAE,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAAE;IACzF,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE;QACzB,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACxE,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACvB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY;SACjC,CAAA;IACH,CAAC;IACD,gBAAgB,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;YAAE,OAAM;QAC9B,eAAe,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAC/D,eAAe,CAAC,wBAAwB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC5D,CAAC;IACD,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC9B,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACxE,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;IAC9D,CAAC;IACD,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC9B,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,cAAc,EAAE,CAAA;IAC/E,CAAC;CACF,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { eksRunnerBackend } from './eks-runner-backend.js';
+export { eksEnvironmentBackend } from './eks-environment-backend.js';
+export { EksRunnerTransport } from './EksRunnerTransport.js';
+export { EksEnvironmentProvider } from './EksEnvironmentProvider.js';
+export { mintEksToken, eksTokenProvider, readAwsCredentials, type MintEksTokenParams, type EksAwsCredentials, } from './eks-auth.logic.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAA"}

package/dist/index.js

@@ -0,0 +1,17 @@
+// Public surface of the opt-in AWS EKS backend package.
+//
+// An EKS cluster's apiserver is a standard Kubernetes apiserver, so this package REUSES the
+// native Kubernetes transport/provider from `@cat-factory/integrations` and only supplies the
+// EKS differentiator: a SigV4-presigned STS (IAM) apiserver token minted per use. A deployment
+// opts in by registering the two backends BY REFERENCE into the app-owned registries from its
+// composition root (the default registries stay AWS-free):
+//
+//   import { eksRunnerBackend, eksEnvironmentBackend } from '@cat-factory/eks'
+//   registries.runnerBackendRegistry.register(eksRunnerBackend)
+//   registries.environmentBackendRegistry.register(eksEnvironmentBackend)
+export { eksRunnerBackend } from './eks-runner-backend.js';
+export { eksEnvironmentBackend } from './eks-environment-backend.js';
+export { EksRunnerTransport } from './EksRunnerTransport.js';
+export { EksEnvironmentProvider } from './EksEnvironmentProvider.js';
+export { mintEksToken, eksTokenProvider, readAwsCredentials, } from './eks-auth.logic.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,8FAA8F;AAC9F,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,gEAAgE;AAChE,0EAA0E;AAE1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,GAGnB,MAAM,qBAAqB,CAAA"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@cat-factory/eks",
+  "version": "0.0.0",
+  "description": "Opt-in AWS EKS runner + environment backends for cat-factory. Reuses the native Kubernetes transport/provider behind a SigV4-presigned STS (IAM) apiserver token.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kibertoad/cat-factory.git",
+    "directory": "backend/packages/eks"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@cat-factory/contracts": "0.97.0",
+    "@cat-factory/integrations": "0.65.3",
+    "@cat-factory/kernel": "0.88.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.0.1",
+    "typescript": "7.0.1-rc",
+    "valibot": "^1.4.2",
+    "vitest": "^4.1.9"
+  },
+  "scripts": {
+    "build": "tsc -b tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:run": "vitest run",
+    "test:integration": "vitest run -c vitest.integration.config.ts"
+  }
+}