@cat-factory/integrations 0.30.0 → 0.32.0

package/dist/modules/kubernetes/KubernetesRunnerTransport.js

@@ -0,0 +1,202 @@
+import { apiBase, buildPodManifest, classifyPodReadiness, KUBERNETES_TOKEN_KEY, podName, podUrl, podsUrl, proxyUrl, } from './kubernetes.logic.js';
+// Native Kubernetes runner transport (target k8s 1.35+). One bare Pod per RUN,
+// named deterministically from `ref.runId`; every step of the run re-attaches to
+// that pod by `ref.jobId` — mirroring CloudflareContainerTransport's per-run model
+// and the harness's per-run-container assumption. The orchestrator reaches the
+// per-pod executor-harness HTTP server through the kube-apiserver POD-PROXY
+// subresource, so it needs only HTTPS to the apiserver (no in-cluster networking,
+// no per-run Service/Ingress) and the full RunnerJobView fidelity is preserved
+// verbatim — the harness is unchanged.
+//
+// Auth to the apiserver is a Bearer ServiceAccount token (secret key `apiToken`),
+// needing RBAC `create/get/delete` on `pods` and `create/get` on `pods/proxy` in
+// the namespace. The pod itself has no Service, so its harness is reachable only
+// via the RBAC-gated proxy — no inbound harness shared secret is required.
+// The eviction marker the engine classifies (job.logic `isContainerEvictionError`):
+// a 404 from the proxy means the pod vanished (deleted/crashed/evicted).
+const EVICTION_ERROR = 'Job not found (container evicted or crashed)';
+const DISPATCH_TIMEOUT_MS = 30_000;
+const POLL_TIMEOUT_MS = 30_000;
+// Bounded readiness wait inside dispatch. The engine treats `dispatch` as blocking
+// until the runner has accepted the job (a plain dispatch throw hard-fails the run as
+// `failureKind: 'dispatch'`), exactly like the Cloudflare container backend, so we
+// must wait here rather than fail fast. The window is generous enough to cover a cold
+// first image pull in one shot; on a readiness failure we surface a RECOVERABLE
+// eviction (see EVICTION_ERROR) so the durable driver re-drives — by then the pod is
+// created (ensurePod 409s) and its image is cached, so the re-drive proceeds.
+const READY_WAIT_MS = 120_000;
+const READY_POLL_INTERVAL_MS = 1_500;
+export class KubernetesRunnerTransport {
+    config;
+    resolveSecret;
+    constructor(config, resolveSecret) {
+        this.config = config;
+        this.resolveSecret = resolveSecret;
+    }
+    async dispatch(ref, spec, kind = 'agent', options) {
+        const name = podName(ref.runId);
+        await this.ensurePod(name, ref.runId, options);
+        await this.waitForPodReady(name);
+        const res = await this.proxyFetch('POST', name, '/jobs', { ...spec, kind }, DISPATCH_TIMEOUT_MS);
+        if (!res.ok) {
+            throw new Error(`Container dispatch failed (HTTP ${res.status}): ${await safeText(res)}`);
+        }
+    }
+    async poll(ref) {
+        const name = podName(ref.runId);
+        const res = await this.proxyFetch('GET', name, `/jobs/${encodeURIComponent(ref.jobId)}`, undefined, POLL_TIMEOUT_MS);
+        if (res.status === 404) {
+            // The pod-proxy 404s when the pod is gone (deleted/crashed/evicted) — the
+            // harness keeps a finished job's view, so a 404 is the pod vanishing, not a
+            // forgotten job. Report it as the eviction the engine recovers from.
+            return { state: 'failed', error: EVICTION_ERROR };
+        }
+        if (!res.ok) {
+            throw new Error(`Container job poll failed (HTTP ${res.status}): ${await safeText(res)}`);
+        }
+        return (await res.json());
+    }
+    /** Reclaim the run's pod (idempotent — a missing pod is a no-op). */
+    async release(ref) {
+        const name = podName(ref.runId);
+        const res = await this.apiFetch('DELETE', podUrl(this.config, name), undefined, DISPATCH_TIMEOUT_MS);
+        // A 404 means the pod is already gone — idempotent success. Any other failure
+        // (e.g. a 403 from a token lacking `delete`, or a transient 5xx) must NOT be
+        // swallowed: a bare Pod (restartPolicy: Never, no owner ref / Job TTL) is not
+        // garbage-collected, so a silently-dropped delete leaks the pod (and its node
+        // slot) indefinitely. Throw so the caller's best-effort wrapper records it (the
+        // LoggingRunnerTransport logs a `release` failure instead of a false success).
+        if (!res.ok && res.status !== 404) {
+            throw new Error(`Failed to release runner pod '${name}' (HTTP ${res.status}): ${await safeText(res)}`);
+        }
+    }
+    /** Probe the apiserver with the configured token (lists pods; nothing created). */
+    async testConnection() {
+        try {
+            const res = await this.apiFetch('GET', `${podsUrl(this.config)}?limit=1`, undefined, DISPATCH_TIMEOUT_MS);
+            if (res.ok) {
+                return {
+                    ok: true,
+                    message: `Reached ${apiBase(this.config)} (namespace ${this.config.namespace}).`,
+                };
+            }
+            return {
+                ok: false,
+                message: `apiserver responded ${res.status}: ${await safeText(res)}`,
+            };
+        }
+        catch (err) {
+            return { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    // --- internals ----------------------------------------------------------
+    async ensurePod(name, runId, options) {
+        const manifest = buildPodManifest(this.config, runId, name, options);
+        const res = await this.apiFetch('POST', podsUrl(this.config), manifest, DISPATCH_TIMEOUT_MS);
+        // 409 AlreadyExists ⇒ the run's pod is already up (a later step or a replay):
+        // idempotent re-attach, exactly like CloudflareContainerTransport.
+        if (res.ok || res.status === 409)
+            return;
+        throw new Error(`Failed to create runner pod (HTTP ${res.status}): ${await safeText(res)}`);
+    }
+    async waitForPodReady(name) {
+        const deadline = Date.now() + READY_WAIT_MS;
+        // Every readiness failure carries the eviction marker so the engine recovers it by
+        // re-driving the step (the re-drive re-attaches to the existing pod, by then ready
+        // / image-cached) instead of hard-failing the run on a cold pull or a transient
+        // pod blip. See EVICTION_ERROR and job.logic `isContainerEvictionError`.
+        const recoverable = (reason) => new Error(`${reason} (container evicted or crashed)`);
+        for (;;) {
+            const res = await this.apiFetch('GET', podUrl(this.config, name), undefined, POLL_TIMEOUT_MS);
+            if (res.status === 404) {
+                throw recoverable(`Runner pod '${name}' vanished before it became ready`);
+            }
+            if (res.ok) {
+                const readiness = classifyPodReadiness(await res.json());
+                if (readiness === 'ready')
+                    return;
+                if (readiness === 'gone') {
+                    throw recoverable(`Runner pod '${name}' terminated before serving`);
+                }
+            }
+            if (Date.now() >= deadline) {
+                throw recoverable(`Runner pod '${name}' not ready within ${READY_WAIT_MS}ms`);
+            }
+            await sleep(READY_POLL_INTERVAL_MS);
+        }
+    }
+    proxyFetch(method, name, path, body, timeoutMs) {
+        return this.apiFetch(method, proxyUrl(this.config, name, path), body, timeoutMs);
+    }
+    async apiFetch(method, url, body, timeoutMs) {
+        const token = this.resolveSecret(KUBERNETES_TOKEN_KEY);
+        if (!token)
+            throw new Error(`Missing Kubernetes ServiceAccount token ('${KUBERNETES_TOKEN_KEY}')`);
+        const headers = {
+            authorization: `Bearer ${token}`,
+            accept: 'application/json',
+        };
+        let payload;
+        if (body !== undefined && method !== 'GET' && method !== 'DELETE') {
+            payload = JSON.stringify(body);
+            headers['content-type'] = 'application/json';
+        }
+        const init = {
+            method,
+            headers,
+            body: payload,
+            signal: AbortSignal.timeout(timeoutMs),
+        };
+        const dispatcher = await this.tlsDispatcher();
+        if (dispatcher)
+            init.dispatcher = dispatcher;
+        return fetch(url, init);
+    }
+    /**
+     * Build the undici dispatcher carrying the cluster CA / insecure-skip flag, when
+     * configured. A kube-apiserver usually presents a private CA, which `fetch` can't
+     * verify without this. Loaded lazily (Node only) so the Worker bundle never pulls
+     * in `undici`; on a runtime without it, a custom-CA/insecure config fails clearly.
+     *
+     * The Agent is cached at MODULE scope keyed by the CA/insecure pair, not per
+     * instance: the wiring builds a fresh transport on every dispatch/poll resolve, so
+     * a per-instance cache would create (and abandon) one Agent — a TLS connection pool
+     * — per poll tick, defeating keep-alive and leaking sockets.
+     */
+    async tlsDispatcher() {
+        if (!this.config.caCertPem && !this.config.insecureSkipTlsVerify)
+            return undefined;
+        const key = `${this.config.insecureSkipTlsVerify ? 'insecure' : 'verify'}:${this.config.caCertPem ?? ''}`;
+        const existing = tlsDispatcherCache.get(key);
+        if (existing)
+            return existing;
+        // Variable specifier so bundlers don't statically resolve `undici`.
+        const moduleName = 'undici';
+        const undici = (await import(moduleName).catch(() => null));
+        if (!undici) {
+            throw new Error('Kubernetes custom CA / insecure TLS requires the Node runtime (undici is unavailable).');
+        }
+        const agent = new undici.Agent({
+            connect: {
+                ca: this.config.caCertPem,
+                rejectUnauthorized: !this.config.insecureSkipTlsVerify,
+            },
+        });
+        tlsDispatcherCache.set(key, agent);
+        return agent;
+    }
+}
+/** Module-scoped undici Agent cache, keyed by the CA/insecure pair (see tlsDispatcher). */
+const tlsDispatcherCache = new Map();
+async function safeText(res) {
+    try {
+        return (await res.text()).slice(0, 300);
+    }
+    catch {
+        return '(no body)';
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=KubernetesRunnerTransport.js.map

package/dist/modules/kubernetes/KubernetesRunnerTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KubernetesRunnerTransport.js","sourceRoot":"","sources":["../../../src/modules/kubernetes/KubernetesRunnerTransport.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,OAAO,EACP,MAAM,EACN,OAAO,EACP,QAAQ,GACT,MAAM,uBAAuB,CAAA;AAE9B,+EAA+E;AAC/E,iFAAiF;AACjF,mFAAmF;AACnF,+EAA+E;AAC/E,4EAA4E;AAC5E,kFAAkF;AAClF,+EAA+E;AAC/E,uCAAuC;AACvC,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,iFAAiF;AACjF,2EAA2E;AAE3E,oFAAoF;AACpF,yEAAyE;AACzE,MAAM,cAAc,GAAG,8CAA8C,CAAA;AAErE,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,mFAAmF;AACnF,sFAAsF;AACtF,mFAAmF;AACnF,sFAAsF;AACtF,gFAAgF;AAChF,qFAAqF;AACrF,8EAA8E;AAC9E,MAAM,aAAa,GAAG,OAAO,CAAA;AAC7B,MAAM,sBAAsB,GAAG,KAAK,CAAA;AAEpC,MAAM,OAAO,yBAAyB;IAEjB,MAAM;IACN,aAAa;IAFhC,YACmB,MAA8B,EAC9B,aAA6B;sBAD7B,MAAM;6BACN,aAAa;IAC7B,CAAC;IAEJ,KAAK,CAAC,QAAQ,CACZ,GAAiB,EACjB,IAA6B,EAC7B,IAAI,GAAuB,OAAO,EAClC,OAA+B;QAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC9C,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,mBAAmB,CAAC,CAAA;QAChG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAiB;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAC/B,KAAK,EACL,IAAI,EACJ,SAAS,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EACxC,SAAS,EACT,eAAe,CAChB,CAAA;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,0EAA0E;YAC1E,4EAA4E;YAC5E,qEAAqE;YACrE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAA;QACnD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;IAC5C,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,OAAO,CAAC,GAAiB;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EACzB,SAAS,EACT,mBAAmB,CACpB,CAAA;QACD,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,gFAAgF;QAChF,+EAA+E;QAC/E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,WAAW,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CACtF,CAAA;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,KAAK,EACL,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EACjC,SAAS,EACT,mBAAmB,CACpB,CAAA;YACD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,WAAW,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI;iBACjF,CAAA;YACH,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,uBAAuB,GAAG,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE;aACrE,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACjF,CAAC;IACH,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,SAAS,CACrB,IAAY,EACZ,KAAa,EACb,OAA+B;QAE/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QAC5F,8EAA8E;QAC9E,mEAAmE;QACnE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAM;QACxC,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7F,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,IAAY;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAA;QAC3C,mFAAmF;QACnF,mFAAmF;QACnF,gFAAgF;QAChF,yEAAyE;QACzE,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,iCAAiC,CAAC,CAAA;QAC7F,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;YAC7F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,eAAe,IAAI,mCAAmC,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;gBACxD,IAAI,SAAS,KAAK,OAAO;oBAAE,OAAM;gBACjC,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACzB,MAAM,WAAW,CAAC,eAAe,IAAI,6BAA6B,CAAC,CAAA;gBACrE,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,WAAW,CAAC,eAAe,IAAI,sBAAsB,aAAa,IAAI,CAAC,CAAA;YAC/E,CAAC;YACD,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAEO,UAAU,CAChB,MAAc,EACd,IAAY,EACZ,IAAY,EACZ,IAAa,EACb,SAAiB;QAEjB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAClF,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,MAAc,EACd,GAAW,EACX,IAAa,EACb,SAAiB;QAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAA;QACtD,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CAAC,6CAA6C,oBAAoB,IAAI,CAAC,CAAA;QACxF,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,kBAAkB;SAC3B,CAAA;QACD,IAAI,OAA2B,CAAA;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC9B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;QAC9C,CAAC;QACD,MAAM,IAAI,GAA2C;YACnD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAA;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;QAC7C,IAAI,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5C,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB;YAAE,OAAO,SAAS,CAAA;QAClF,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAA;QACzG,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC7B,oEAAoE;QACpE,MAAM,UAAU,GAAG,QAAQ,CAAA;QAC3B,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAElD,CAAA;QACR,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC;YAC7B,OAAO,EAAE;gBACP,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBACzB,kBAAkB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB;aACvD;SACF,CAAC,CAAA;QACF,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAmB,CAAA;AAErD,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAA;IACpB,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC"}

package/dist/modules/kubernetes/kubernetes.logic.d.ts

@@ -0,0 +1,54 @@
+import type { KubernetesRunnerConfig, RunnerDispatchOptions } from '@cat-factory/kernel';
+/**
+ * The secret-bundle key the Kubernetes backend reads the ServiceAccount token from.
+ * Re-exported from the wire contract (the single source of truth shared with the SPA
+ * connect form) so the key is defined once.
+ */
+export declare const KUBERNETES_TOKEN_KEY = "apiToken";
+/** Default port the executor-harness HTTP server listens on inside the pod. */
+export declare const DEFAULT_HARNESS_PORT = 8080;
+/** Deterministic per-RUN pod name (one pod per run; steps re-attach to it). */
+export declare function podName(runId: string): string;
+/** kube-apiserver root with any trailing slash stripped. */
+export declare function apiBase(config: KubernetesRunnerConfig): string;
+/** Collection URL for pods in the configured namespace. */
+export declare function podsUrl(config: KubernetesRunnerConfig): string;
+/** A single pod's URL. */
+export declare function podUrl(config: KubernetesRunnerConfig, name: string): string;
+/**
+ * The apiserver POD-PROXY subresource URL for the pod's harness HTTP server:
+ * `…/pods/<name>:<port>/proxy<path>`. Reaching this requires only HTTPS to the
+ * apiserver (RBAC `pods/proxy`), so no in-cluster networking / per-run Service is
+ * needed. `path` must begin with `/`.
+ */
+export declare function proxyUrl(config: KubernetesRunnerConfig, name: string, path: string): string;
+/** Resolve the image variant a dispatch needs (the heavier UI image when asked + configured). */
+export declare function resolveImage(config: KubernetesRunnerConfig, options?: RunnerDispatchOptions): string;
+/** Resolve the pod resource block for a dispatch (per-size override, else the default). */
+export declare function resolveResources(config: KubernetesRunnerConfig, options?: RunnerDispatchOptions): {
+    requests?: Record<string, string>;
+    limits?: Record<string, string>;
+} | undefined;
+/**
+ * Build the bare-Pod manifest for a run. A bare Pod (not a Job) because the harness
+ * is a long-lived HTTP server we own the lifecycle of (create on first dispatch,
+ * delete on release) — Job completion semantics would fight that. The pod is
+ * reachable ONLY through the apiserver pod-proxy (no Service), so the harness needs
+ * no inbound shared secret here: access is gated by the SA's `pods/proxy` RBAC.
+ */
+export declare function buildPodManifest(config: KubernetesRunnerConfig, runId: string, name: string, options?: RunnerDispatchOptions): Record<string, unknown>;
+/** The readiness verdict from a pod's `status`. */
+export type PodReadiness = 'ready' | 'pending' | 'gone';
+/** Classify a pod's status JSON: ready to serve, still pending, or terminally gone. */
+export declare function classifyPodReadiness(pod: unknown): PodReadiness;
+/**
+ * Validate the apiserver URL at the write boundary. Unlike the manifest pool's
+ * STRICT policy (no private hosts), a kube-apiserver is routinely a private IP or
+ * a cluster DNS name, so private hosts are ALLOWED here — the operator is
+ * explicitly pointing at their cluster. We still require https and reject the
+ * cloud-metadata endpoints (anti-SSRF), including their obfuscated IP encodings
+ * (bare integer, IPv4-mapped IPv6) and the full link-local range — see the shared
+ * {@link isCloudMetadataHost} classifier.
+ */
+export declare function assertApiServerUrlSafe(rawUrl: string): void;
+//# sourceMappingURL=kubernetes.logic.d.ts.map

package/dist/modules/kubernetes/kubernetes.logic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes.logic.d.ts","sourceRoot":"","sources":["../../../src/modules/kubernetes/kubernetes.logic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AASxF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,aAAqC,CAAA;AAEtE,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,OAAO,CAAA;AAExC,+EAA+E;AAC/E,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAS7C;AAED,4DAA4D;AAC5D,wBAAgB,OAAO,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAE9D;AAED,2DAA2D;AAC3D,wBAAgB,OAAO,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAE9D;AAED,0BAA0B;AAC1B,wBAAgB,MAAM,CAAC,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ3F;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAC1B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,MAAM,CAGR;AAED,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,CAAC,EAAE,qBAAqB,GAC9B;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,CAcpF;AASD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,qBAAqB,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA+BzB;AAUD,mDAAmD;AACnD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;AAEvD,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAU/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAa3D"}

package/dist/modules/kubernetes/kubernetes.logic.js

@@ -0,0 +1,169 @@
+import { isCloudMetadataHost } from '@cat-factory/kernel';
+import { KUBERNETES_RUNNER_TOKEN_SECRET_KEY } from '@cat-factory/contracts';
+// Pure helpers for the native Kubernetes runner backend. No I/O here — URL
+// building, the per-run pod-name derivation, the pod manifest, and the readiness
+// classification are all pure so they unit-test in isolation. The transport
+// (KubernetesRunnerTransport) does the actual kube-apiserver `fetch`es.
+/**
+ * The secret-bundle key the Kubernetes backend reads the ServiceAccount token from.
+ * Re-exported from the wire contract (the single source of truth shared with the SPA
+ * connect form) so the key is defined once.
+ */
+export const KUBERNETES_TOKEN_KEY = KUBERNETES_RUNNER_TOKEN_SECRET_KEY;
+/** Default port the executor-harness HTTP server listens on inside the pod. */
+export const DEFAULT_HARNESS_PORT = 8080;
+/** Deterministic per-RUN pod name (one pod per run; steps re-attach to it). */
+export function podName(runId) {
+    const sanitized = runId
+        .toLowerCase()
+        .replace(/[^a-z0-9-]/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    // RFC1123 label: <=63 chars, starts/ends alphanumeric. Reserve room for the prefix.
+    const body = sanitized.slice(0, 63 - 'cf-run-'.length).replace(/-+$/g, '') || 'run';
+    return `cf-run-${body}`;
+}
+/** kube-apiserver root with any trailing slash stripped. */
+export function apiBase(config) {
+    return config.apiServerUrl.trim().replace(/\/+$/, '');
+}
+/** Collection URL for pods in the configured namespace. */
+export function podsUrl(config) {
+    return `${apiBase(config)}/api/v1/namespaces/${config.namespace}/pods`;
+}
+/** A single pod's URL. */
+export function podUrl(config, name) {
+    return `${podsUrl(config)}/${encodeURIComponent(name)}`;
+}
+/**
+ * The apiserver POD-PROXY subresource URL for the pod's harness HTTP server:
+ * `…/pods/<name>:<port>/proxy<path>`. Reaching this requires only HTTPS to the
+ * apiserver (RBAC `pods/proxy`), so no in-cluster networking / per-run Service is
+ * needed. `path` must begin with `/`.
+ */
+export function proxyUrl(config, name, path) {
+    const port = config.harnessPort ?? DEFAULT_HARNESS_PORT;
+    const p = path.startsWith('/') ? path : `/${path}`;
+    // The apiserver pod-proxy subresource addresses the target as a literal
+    // `pods/<name>:<port>/proxy` path segment — kubectl/client-go send the colon
+    // UNENCODED. Encode the name (RFC1123, so a no-op in practice) but keep the
+    // `:<port>` literal so the apiserver parses the name:port pair.
+    return `${podsUrl(config)}/${encodeURIComponent(name)}:${port}/proxy${p}`;
+}
+/** Resolve the image variant a dispatch needs (the heavier UI image when asked + configured). */
+export function resolveImage(config, options) {
+    if (options?.image === 'ui' && config.imageUi)
+        return config.imageUi;
+    return config.image;
+}
+/** Resolve the pod resource block for a dispatch (per-size override, else the default). */
+export function resolveResources(config, options) {
+    const sizeOverride = options?.instanceSize
+        ? config.resourcesBySize?.[options.instanceSize]
+        : undefined;
+    // A per-size override is the t-shirt size for this run: it sets BOTH the request and
+    // the limit (requests == limits ⇒ Guaranteed QoS). Applying it to the limit alone
+    // while keeping a larger default request produces requests > limits, which the
+    // apiserver rejects with a 422 — so a smaller size could never start.
+    const requests = sizeOverride ?? config.resources?.requests;
+    const limits = sizeOverride ?? config.resources?.limits;
+    const out = {};
+    if (requests)
+        out.requests = quantities(requests);
+    if (limits)
+        out.limits = quantities(limits);
+    return out.requests || out.limits ? out : undefined;
+}
+function quantities(q) {
+    const out = {};
+    if (q.cpu)
+        out.cpu = q.cpu;
+    if (q.memory)
+        out.memory = q.memory;
+    return out;
+}
+/**
+ * Build the bare-Pod manifest for a run. A bare Pod (not a Job) because the harness
+ * is a long-lived HTTP server we own the lifecycle of (create on first dispatch,
+ * delete on release) — Job completion semantics would fight that. The pod is
+ * reachable ONLY through the apiserver pod-proxy (no Service), so the harness needs
+ * no inbound shared secret here: access is gated by the SA's `pods/proxy` RBAC.
+ */
+export function buildPodManifest(config, runId, name, options) {
+    const port = config.harnessPort ?? DEFAULT_HARNESS_PORT;
+    const resources = resolveResources(config, options);
+    const container = {
+        name: 'executor',
+        image: resolveImage(config, options),
+        ports: [{ containerPort: port }],
+        env: [{ name: 'PORT', value: String(port) }],
+        ...(resources ? { resources } : {}),
+    };
+    const spec = {
+        restartPolicy: 'Never',
+        containers: [container],
+        ...(config.serviceAccountName ? { serviceAccountName: config.serviceAccountName } : {}),
+        ...(config.imagePullSecretName
+            ? { imagePullSecrets: [{ name: config.imagePullSecretName }] }
+            : {}),
+        ...(config.nodeSelector ? { nodeSelector: config.nodeSelector } : {}),
+        ...(config.tolerations ? { tolerations: config.tolerations } : {}),
+    };
+    return {
+        apiVersion: 'v1',
+        kind: 'Pod',
+        metadata: {
+            name,
+            namespace: config.namespace,
+            labels: { 'cat-factory.runId': labelValue(runId), ...config.labels },
+            ...(config.annotations ? { annotations: config.annotations } : {}),
+        },
+        spec,
+    };
+}
+/** Coerce an arbitrary id into a valid label value (<=63 chars, alnum/._-). */
+function labelValue(value) {
+    return value
+        .replace(/[^A-Za-z0-9._-]/g, '-')
+        .replace(/^[^A-Za-z0-9]+|[^A-Za-z0-9]+$/g, '')
+        .slice(0, 63);
+}
+/** Classify a pod's status JSON: ready to serve, still pending, or terminally gone. */
+export function classifyPodReadiness(pod) {
+    const status = pod?.status;
+    const phase = typeof status?.phase === 'string' ? status.phase : undefined;
+    if (phase === 'Succeeded' || phase === 'Failed')
+        return 'gone';
+    if (phase !== 'Running')
+        return 'pending';
+    const conditions = Array.isArray(status?.conditions)
+        ? status.conditions
+        : [];
+    const ready = conditions.find((c) => c.type === 'Ready');
+    return ready?.status === 'True' ? 'ready' : 'pending';
+}
+/**
+ * Validate the apiserver URL at the write boundary. Unlike the manifest pool's
+ * STRICT policy (no private hosts), a kube-apiserver is routinely a private IP or
+ * a cluster DNS name, so private hosts are ALLOWED here — the operator is
+ * explicitly pointing at their cluster. We still require https and reject the
+ * cloud-metadata endpoints (anti-SSRF), including their obfuscated IP encodings
+ * (bare integer, IPv4-mapped IPv6) and the full link-local range — see the shared
+ * {@link isCloudMetadataHost} classifier.
+ */
+export function assertApiServerUrlSafe(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new Error(`Invalid Kubernetes apiserver URL: ${rawUrl}`);
+    }
+    if (url.protocol !== 'https:') {
+        throw new Error('Kubernetes apiserver URL must use https.');
+    }
+    if (isCloudMetadataHost(url.hostname)) {
+        throw new Error('Kubernetes apiserver URL must not target the cloud metadata endpoint.');
+    }
+}
+//# sourceMappingURL=kubernetes.logic.js.map

package/dist/modules/kubernetes/kubernetes.logic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes.logic.js","sourceRoot":"","sources":["../../../src/modules/kubernetes/kubernetes.logic.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAA;AAE3E,2EAA2E;AAC3E,iFAAiF;AACjF,4EAA4E;AAC5E,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,kCAAkC,CAAA;AAEtE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAExC,+EAA+E;AAC/E,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,SAAS,GAAG,KAAK;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC1B,oFAAoF;IACpF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,CAAA;IACnF,OAAO,UAAU,IAAI,EAAE,CAAA;AACzB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,OAAO,CAAC,MAA8B;IACpD,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACvD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,OAAO,CAAC,MAA8B;IACpD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,sBAAsB,MAAM,CAAC,SAAS,OAAO,CAAA;AACxE,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,MAAM,CAAC,MAA8B,EAAE,IAAY;IACjE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAA;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,MAA8B,EAAE,IAAY,EAAE,IAAY;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAA;IACvD,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;IAClD,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,gEAAgE;IAChE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAA;AAC3E,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAC1B,MAA8B,EAC9B,OAA+B;IAE/B,IAAI,OAAO,EAAE,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAA;IACpE,OAAO,MAAM,CAAC,KAAK,CAAA;AACrB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAC9B,MAA8B,EAC9B,OAA+B;IAE/B,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY;QACxC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;QAChD,CAAC,CAAC,SAAS,CAAA;IACb,qFAAqF;IACrF,kFAAkF;IAClF,+EAA+E;IAC/E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,YAAY,IAAI,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAA;IAC3D,MAAM,MAAM,GAAG,YAAY,IAAI,MAAM,CAAC,SAAS,EAAE,MAAM,CAAA;IACvD,MAAM,GAAG,GAA2E,EAAE,CAAA;IACtF,IAAI,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjD,IAAI,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAC3C,OAAO,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,CAAoC;IACtD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,IAAI,CAAC,CAAC,GAAG;QAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAA;IAC1B,IAAI,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAA;IACnC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA8B,EAC9B,KAAa,EACb,IAAY,EACZ,OAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAA;IACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,SAAS,GAA4B;QACzC,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC;QACpC,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAChC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAA;IACD,MAAM,IAAI,GAA4B;QACpC,aAAa,EAAE,OAAO;QACtB,UAAU,EAAE,CAAC,SAAS,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,MAAM,CAAC,mBAAmB;YAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAA;IACD,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE;YACR,IAAI;YACJ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,EAAE,mBAAmB,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;YACpE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI;KACL,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAChC,OAAO,CAAC,gCAAgC,EAAE,EAAE,CAAC;SAC7C,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACjB,CAAC;AAKD,uFAAuF;AACvF,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,MAAM,GAAI,GAAmD,EAAE,MAAM,CAAA;IAC3E,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAA;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC;QAClD,CAAC,CAAE,MAAM,CAAC,UAA6C;QACvD,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;IACxD,OAAO,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC1F,CAAC;AACH,CAAC"}

package/dist/modules/runners/RunnerPoolConnectionService.d.ts

@@ -1,57 +1,69 @@
 import type { Clock } from '@cat-factory/kernel';
 import type { RunnerPoolConnectionRecord, RunnerPoolConnectionRepository } from '@cat-factory/kernel';
 import type { SecretCipher } from '@cat-factory/kernel';
-import type { SecretResolver, UrlSafetyPolicy } from '@cat-factory/kernel';
-import type { ConnectionTestResult, ProviderDescriptor, RunnerPoolConnection, RunnerPoolManifest, RunnerPoolProvider, TestRunnerPoolConnectionInput } from '@cat-factory/kernel';
+import type { UrlSafetyPolicy } from '@cat-factory/kernel';
+import type { ConnectionTestResult, ProviderDescriptor, RunnerBackendConfig, RunnerPoolConnection, RunnerPoolProvider, RunnerTransport, TestRunnerPoolConnectionInput } from '@cat-factory/kernel';
 import type { WorkspaceRepository } from '@cat-factory/kernel';
 export interface RunnerPoolConnectionServiceDependencies {
     runnerPoolConnectionRepository: RunnerPoolConnectionRepository;
     workspaceRepository: WorkspaceRepository;
     secretCipher: SecretCipher;
     clock: Clock;
-    /** URL/host safety policy applied to a registered manifest. Defaults to strict. */
+    /** URL/host safety policy applied to a manifest backend. Defaults to strict. */
     urlPolicy?: UrlSafetyPolicy;
-    /** The injected pool provider, so the service can surface describe/test to the UI. */
+    /**
+     * Whether this deployment runtime can honor a backend's custom TLS trust material
+     * (a private CA / insecure-skip). The Cloudflare Worker cannot, so it sets `false`
+     * and a Kubernetes config with a CA is rejected at registration. Absent ⇒ supported.
+     */
+    customTlsSupported?: boolean;
+    /** Injected manifest HTTP provider (its OAuth cache shared / a native pool adapter). */
     runnerPoolProvider?: RunnerPoolProvider;
-    /** What the injected provider is (see EnvironmentConnectionService). Defaults `manifest`. */
-    providerKind?: 'native' | 'manifest';
-    providerId?: string;
-    providerLabel?: string;
 }
-export interface ResolvedRunnerPool {
-    manifest: RunnerPoolManifest;
-    resolveSecret: SecretResolver;
+/** A resolved runner backend: the live transport + its identity (for provisioning logs). */
+export interface ResolvedRunnerBackend {
+    transport: RunnerTransport;
+    kind: string;
+    providerId: string;
 }
 export declare class RunnerPoolConnectionService {
     private readonly deps;
     constructor(deps: RunnerPoolConnectionServiceDependencies);
-    /** Register (or replace) a workspace's runner pool. */
+    /** The per-call context a backend provider needs to build/test a transport. */
+    private context;
+    private provider;
+    /** The write-boundary safety options (URL policy + this runtime's TLS capability). */
+    private safetyOptions;
+    /** Register (or replace) a workspace's runner backend. */
     register(workspaceId: string, input: {
-        manifest: RunnerPoolManifest;
+        config: RunnerBackendConfig;
         secrets: Record<string, string>;
     }): Promise<RunnerPoolConnection>;
-    /** Rotate/replace the secret bundle without re-sending the manifest. */
+    /** Rotate/replace the secret bundle without re-sending the config. */
     updateSecrets(workspaceId: string, secrets: Record<string, string>): Promise<RunnerPoolConnection>;
-    /** Describe the pool provider's config fields + test availability for the UI. */
+    /** Describe the backend's config fields + test availability for the UI. */
     describeProvider(workspaceId: string): Promise<ProviderDescriptor>;
-    /** Probe a candidate pool connection before saving (nothing is persisted). */
+    /** Probe a candidate backend connection before saving (nothing is persisted). */
     testConnection(workspaceId: string, input: TestRunnerPoolConnectionInput): Promise<ConnectionTestResult>;
     /** The workspace's current connection (safe metadata), or null. */
     getConnection(workspaceId: string): Promise<RunnerPoolConnection | null>;
-    /** Resolve the live connection + parsed manifest, or throw if not registered. */
+    /** Resolve the live connection + parsed config, or throw if not registered. */
     requireConnection(workspaceId: string): Promise<{
         record: RunnerPoolConnectionRecord;
-        manifest: RunnerPoolManifest;
+        config: RunnerBackendConfig;
     }>;
     /**
-     * Resolve the workspace's pool (parsed manifest + a secret resolver over its
-     * decrypted bundle), or null when it has no live pool registered. Used by the
-     * container executor to pick the self-hosted runner backend per job.
+     * Resolve the workspace's runner backend into a live {@link RunnerTransport} (the
+     * provider builds it from the stored config + a secret resolver over its decrypted
+     * bundle), or null when it has no live backend registered / its kind is no longer
+     * registered. Used by the wiring to pick the dispatch backend per job.
      */
-    resolve(workspaceId: string): Promise<ResolvedRunnerPool | null>;
-    /** Unregister the pool (tombstones the binding). */
+    resolve(workspaceId: string): Promise<ResolvedRunnerBackend | null>;
+    /** Unregister the backend (tombstones the binding). */
     unregister(workspaceId: string): Promise<void>;
     private decryptSecrets;
     private toConnection;
+    /** Parse the stored discriminated config, tolerating a malformed/legacy blob. */
+    private parseConfig;
 }
 //# sourceMappingURL=RunnerPoolConnectionService.d.ts.map

package/dist/modules/runners/RunnerPoolConnectionService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RunnerPoolConnectionService.d.ts","sourceRoot":"","sources":["../../../src/modules/runners/RunnerPoolConnectionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EACV,0BAA0B,EAC1B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAU9D,MAAM,WAAW,uCAAuC;IACtD,8BAA8B,EAAE,8BAA8B,CAAA;IAC9D,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,mFAAmF;IACnF,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,6FAA6F;IAC7F,YAAY,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAA;IACpC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,aAAa,EAAE,cAAc,CAAA;CAC9B;AAED,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,uCAAuC,EAAI;IAE9E,uDAAuD;IACjD,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GACvE,OAAO,CAAC,oBAAoB,CAAC,CAwB/B;IAED,wEAAwE;IAClE,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CAU/B;IAED,iFAAiF;IAC3E,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyBvE;IAED,8EAA8E;IACxE,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAe/B;IAED,mEAAmE;IAC7D,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAK7E;IAED,iFAAiF;IAC3E,iBAAiB,CACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,0BAA0B,CAAC;QAAC,QAAQ,EAAE,kBAAkB,CAAA;KAAE,CAAC,CAO/E;IAED;;;;OAIG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAMrE;IAED,oDAAoD;IAC9C,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAInD;YAEa,cAAc;IAQ5B,OAAO,CAAC,YAAY;CAYrB"}
+{"version":3,"file":"RunnerPoolConnectionService.d.ts","sourceRoot":"","sources":["../../../src/modules/runners/RunnerPoolConnectionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EACV,0BAA0B,EAC1B,8BAA8B,EAC/B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,6BAA6B,EAC9B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAiB9D,MAAM,WAAW,uCAAuC;IACtD,8BAA8B,EAAE,8BAA8B,CAAA;IAC9D,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,gFAAgF;IAChF,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;AAED,4FAA4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,eAAe,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,uCAAuC,EAAI;IAE9E,+EAA+E;IAC/E,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,QAAQ;IAMhB,sFAAsF;IACtF,OAAO,CAAC,aAAa;IASrB,0DAA0D;IACpD,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QAAE,MAAM,EAAE,mBAAmB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GACtE,OAAO,CAAC,oBAAoB,CAAC,CA2B/B;IAED,sEAAsE;IAChE,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CAW/B;IAED,2EAA2E;IACrE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA6BvE;IAED,iFAAiF;IAC3E,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAU/B;IAED,mEAAmE;IAC7D,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAK7E;IAED,+EAA+E;IACzE,iBAAiB,CACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,0BAA0B,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAO9E;IAED;;;;;OAKG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAYxE;IAED,uDAAuD;IACjD,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAInD;YAEa,cAAc;IAQ5B,OAAO,CAAC,YAAY;IAmBpB,iFAAiF;IACjF,OAAO,CAAC,WAAW;CAOpB"}