@cat-factory/integrations 0.30.0 → 0.32.0

package/dist/modules/runners/RunnerPoolConnectionService.js

@@ -1,29 +1,55 @@
-import { ConflictError, STRICT_URL_SAFETY_POLICY, ValidationError } from '@cat-factory/kernel';
+import { ConflictError, ValidationError } from '@cat-factory/kernel';
 import { requireWorkspace } from '@cat-factory/kernel';
 import { missingRequiredConfigKeys } from '../environments/environments.logic.js';
-import { assertManifestUrlsSafe, referencedSecretKeys } from './runners.logic.js';
+import { runnerBackend } from './runner-backends.js';
 export class RunnerPoolConnectionService {
     deps;
     constructor(deps) {
         this.deps = deps;
     }
-    /** Register (or replace) a workspace's runner pool. */
+    /** The per-call context a backend provider needs to build/test a transport. */
+    context(resolveSecret) {
+        return {
+            resolveSecret,
+            ...(this.deps.urlPolicy ? { urlPolicy: this.deps.urlPolicy } : {}),
+            ...(this.deps.runnerPoolProvider ? { runnerPoolProvider: this.deps.runnerPoolProvider } : {}),
+        };
+    }
+    provider(kind) {
+        const provider = runnerBackend(kind);
+        if (!provider)
+            throw new ValidationError(`Unknown runner backend kind: '${kind}'`);
+        return provider;
+    }
+    /** The write-boundary safety options (URL policy + this runtime's TLS capability). */
+    safetyOptions() {
+        return {
+            ...(this.deps.urlPolicy ? { urlPolicy: this.deps.urlPolicy } : {}),
+            ...(this.deps.customTlsSupported !== undefined
+                ? { customTlsSupported: this.deps.customTlsSupported }
+                : {}),
+        };
+    }
+    /** Register (or replace) a workspace's runner backend. */
     async register(workspaceId, input) {
         await requireWorkspace(this.deps.workspaceRepository, workspaceId);
-        const manifest = input.manifest;
-        assertManifestUrlsSafe(manifest, this.deps.urlPolicy ?? STRICT_URL_SAFETY_POLICY);
-        const missing = referencedSecretKeys(manifest).filter((key) => !(key in input.secrets));
+        const config = input.config;
+        const provider = this.provider(config.kind);
+        provider.assertConfigSafe(config, this.safetyOptions());
+        const missing = provider.referencedSecretKeys(config).filter((key) => !(key in input.secrets));
         if (missing.length) {
             throw new ValidationError(`Missing secret values for: ${missing.join(', ')}`);
         }
         const existing = await this.deps.runnerPoolConnectionRepository.getByWorkspace(workspaceId);
+        const meta = provider.connectionMeta(config);
         const secretsCipher = await this.deps.secretCipher.encrypt(JSON.stringify(input.secrets));
         const record = {
             workspaceId,
-            providerId: manifest.providerId,
-            label: manifest.label,
-            baseUrl: manifest.baseUrl,
-            manifestJson: JSON.stringify(manifest),
+            kind: config.kind,
+            providerId: meta.providerId,
+            label: meta.label,
+            baseUrl: meta.baseUrl,
+            configJson: JSON.stringify(config),
             secretsCipher,
             createdAt: existing?.createdAt ?? this.deps.clock.now(),
             deletedAt: null,
@@ -31,10 +57,11 @@ export class RunnerPoolConnectionService {
         await this.deps.runnerPoolConnectionRepository.upsert(record);
         return this.toConnection(record, Object.keys(input.secrets));
     }
-    /** Rotate/replace the secret bundle without re-sending the manifest. */
+    /** Rotate/replace the secret bundle without re-sending the config. */
     async updateSecrets(workspaceId, secrets) {
-        const { record, manifest } = await this.requireConnection(workspaceId);
-        const missing = referencedSecretKeys(manifest).filter((key) => !(key in secrets));
+        const { record, config } = await this.requireConnection(workspaceId);
+        const provider = this.provider(record.kind);
+        const missing = provider.referencedSecretKeys(config).filter((key) => !(key in secrets));
         if (missing.length) {
             throw new ValidationError(`Missing secret values for: ${missing.join(', ')}`);
         }
@@ -43,50 +70,47 @@ export class RunnerPoolConnectionService {
         await this.deps.runnerPoolConnectionRepository.upsert(updated);
         return this.toConnection(updated, Object.keys(secrets));
     }
-    /** Describe the pool provider's config fields + test availability for the UI. */
+    /** Describe the backend's config fields + test availability for the UI. */
     async describeProvider(workspaceId) {
         const record = await this.deps.runnerPoolConnectionRepository.getByWorkspace(workspaceId);
-        const manifest = record ? JSON.parse(record.manifestJson) : undefined;
-        const configFields = this.deps.runnerPoolProvider?.describeConfig?.(manifest) ?? [];
-        // A runner-pool manifest has no `providerConfig` bag, so the stored values are the secret
-        // bundle keys plus `baseUrl` when the manifest carries one. The latter mirrors the connect
-        // form's write path (a `baseUrl` field lands on the manifest's `baseUrl`, not the secret
-        // bundle) — without it a `required` baseUrl field would never clear `missingRequired`.
+        const config = record ? JSON.parse(record.configJson) : undefined;
+        // The manifest backend renders a flat field form (its secret-ref keys + baseUrl);
+        // the native (kubernetes) backend uses an explicit UI form, so it has no flat fields.
+        const manifest = config?.kind === 'manifest' ? config.manifest : undefined;
+        const configFields = manifest
+            ? (this.deps.runnerPoolProvider?.describeConfig?.(manifest) ?? [])
+            : [];
         const storedKeys = record ? Object.keys(await this.decryptSecrets(record)) : [];
         if (manifest?.baseUrl)
             storedKeys.push('baseUrl');
         const provider = this.deps.runnerPoolProvider;
         return {
-            providerId: this.deps.providerId ?? manifest?.providerId ?? 'http',
-            label: this.deps.providerLabel ?? manifest?.label ?? 'Custom HTTP pool',
-            kind: this.deps.providerKind ?? 'manifest',
+            providerId: record?.providerId ?? 'http',
+            label: record?.label ?? 'Agent runner backend',
+            // `kind` here is the UI FORM-STYLE discriminator (manifest editor vs native flat
+            // form), not the runner-backend kind: only the manifest backend uses this
+            // descriptor-driven form, so it stays 'manifest'. The actual backend kind is
+            // surfaced on the connection (`connection.kind` + the non-secret `config`), which
+            // is what the tab's backend selector + the Kubernetes form read.
+            kind: 'manifest',
             configFields,
-            supportsTest: typeof provider?.testConnection === 'function',
+            supportsTest: true,
             missingRequired: missingRequiredConfigKeys(configFields, storedKeys),
-            // The current saved manifest (non-secret), so the native connect form overlays edits
-            // onto the real stored manifest instead of the bare scaffold (mirrors the env service).
             ...(manifest ? { savedManifest: manifest } : {}),
-            ...(provider?.describeManifestTemplate
+            ...(manifest && provider?.describeManifestTemplate
                 ? { manifestTemplate: provider.describeManifestTemplate() }
                 : {}),
         };
     }
-    /** Probe a candidate pool connection before saving (nothing is persisted). */
+    /** Probe a candidate backend connection before saving (nothing is persisted). */
     async testConnection(workspaceId, input) {
         await requireWorkspace(this.deps.workspaceRepository, workspaceId);
-        const provider = this.deps.runnerPoolProvider;
-        if (!provider?.testConnection) {
-            return { ok: true, message: 'This pool provider has no connection test.' };
-        }
-        if (input.manifest) {
-            assertManifestUrlsSafe(input.manifest, this.deps.urlPolicy ?? STRICT_URL_SAFETY_POLICY);
-        }
+        if (!input.config)
+            return { ok: true, message: 'Nothing to test.' };
+        const provider = this.provider(input.config.kind);
+        provider.assertConfigSafe(input.config, this.safetyOptions());
         const secrets = input.secrets ?? {};
-        return provider.testConnection({
-            manifest: input.manifest,
-            config: input.config ?? {},
-            resolveSecret: (key) => secrets[key],
-        });
+        return provider.testConnection(input.config, this.context((key) => secrets[key]));
     }
     /** The workspace's current connection (safe metadata), or null. */
     async getConnection(workspaceId) {
@@ -96,29 +120,34 @@ export class RunnerPoolConnectionService {
         const keys = Object.keys(await this.decryptSecrets(record));
         return this.toConnection(record, keys);
     }
-    /** Resolve the live connection + parsed manifest, or throw if not registered. */
+    /** Resolve the live connection + parsed config, or throw if not registered. */
     async requireConnection(workspaceId) {
         const record = await this.deps.runnerPoolConnectionRepository.getByWorkspace(workspaceId);
         if (!record) {
-            throw new ConflictError(`Workspace '${workspaceId}' has no runner pool registered`);
+            throw new ConflictError(`Workspace '${workspaceId}' has no runner backend registered`);
         }
-        const manifest = JSON.parse(record.manifestJson);
-        return { record, manifest };
+        const config = JSON.parse(record.configJson);
+        return { record, config };
     }
     /**
-     * Resolve the workspace's pool (parsed manifest + a secret resolver over its
-     * decrypted bundle), or null when it has no live pool registered. Used by the
-     * container executor to pick the self-hosted runner backend per job.
+     * Resolve the workspace's runner backend into a live {@link RunnerTransport} (the
+     * provider builds it from the stored config + a secret resolver over its decrypted
+     * bundle), or null when it has no live backend registered / its kind is no longer
+     * registered. Used by the wiring to pick the dispatch backend per job.
      */
     async resolve(workspaceId) {
         const record = await this.deps.runnerPoolConnectionRepository.getByWorkspace(workspaceId);
         if (!record)
             return null;
-        const manifest = JSON.parse(record.manifestJson);
+        const provider = runnerBackend(record.kind);
+        if (!provider)
+            return null;
+        const config = JSON.parse(record.configJson);
         const bundle = await this.decryptSecrets(record);
-        return { manifest, resolveSecret: (key) => bundle[key] };
+        const transport = provider.buildTransport(config, this.context((key) => bundle[key]));
+        return { transport, kind: record.kind, providerId: record.providerId };
     }
-    /** Unregister the pool (tombstones the binding). */
+    /** Unregister the backend (tombstones the binding). */
     async unregister(workspaceId) {
         const record = await this.deps.runnerPoolConnectionRepository.getByWorkspace(workspaceId);
         if (!record)
@@ -132,13 +161,28 @@ export class RunnerPoolConnectionService {
         return parsed && typeof parsed === 'object' ? parsed : {};
     }
     toConnection(record, secretKeys) {
+        // The stored config holds NO secrets (those live in the separate encrypted bundle),
+        // so it is safe to expose so the connect form can prefill the non-secret fields on
+        // edit (namespace/image/… for kubernetes) instead of forcing a full re-entry.
+        const config = this.parseConfig(record);
         return {
+            kind: record.kind,
             providerId: record.providerId,
             label: record.label,
             baseUrl: record.baseUrl,
             connectedAt: record.createdAt,
             secretKeys,
+            ...(config ? { config } : {}),
         };
     }
+    /** Parse the stored discriminated config, tolerating a malformed/legacy blob. */
+    parseConfig(record) {
+        try {
+            return JSON.parse(record.configJson);
+        }
+        catch {
+            return undefined;
+        }
+    }
 }
 //# sourceMappingURL=RunnerPoolConnectionService.js.map

package/dist/modules/runners/RunnerPoolConnectionService.js.map

@@ -1 +1 @@
-{"version":3,"file":"RunnerPoolConnectionService.js","sourceRoot":"","sources":["../../../src/modules/runners/RunnerPoolConnectionService.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAA;AACjF,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AA4BjF,MAAM,OAAO,2BAA2B;IACT,IAAI;IAAjC,YAA6B,IAA6C;oBAA7C,IAAI;IAA4C,CAAC;IAE9E,uDAAuD;IACvD,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,KAAwE;QAExE,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAC/B,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC,CAAA;QAEjF,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACvF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAC3F,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACzF,MAAM,MAAM,GAA+B;YACzC,WAAW;YACX,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YACtC,aAAa;YACb,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACvD,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,aAAa,CACjB,WAAmB,EACnB,OAA+B;QAE/B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACtE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAAA;QACjF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QACnF,MAAM,OAAO,GAA+B,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,CAAA;QACxE,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9D,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAwB,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7F,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QACnF,0FAA0F;QAC1F,2FAA2F;QAC3F,yFAAyF;QACzF,uFAAuF;QACvF,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/E,IAAI,QAAQ,EAAE,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAA;QAC7C,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,EAAE,UAAU,IAAI,MAAM;YAClE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,EAAE,KAAK,IAAI,kBAAkB;YACvE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU;YAC1C,YAAY;YACZ,YAAY,EAAE,OAAO,QAAQ,EAAE,cAAc,KAAK,UAAU;YAC5D,eAAe,EAAE,yBAAyB,CAAC,YAAY,EAAE,UAAU,CAAC;YACpE,qFAAqF;YACrF,wFAAwF;YACxF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAA8C,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,QAAQ,EAAE,wBAAwB;gBACpC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,wBAAwB,EAA6B,EAAE;gBACtF,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,KAAoC;QAEpC,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAA;QAC7C,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAA;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC,CAAA;QACzF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAA;QACnC,OAAO,QAAQ,CAAC,cAAc,CAAC;YAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC1B,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;SACrC,CAAC,CAAA;IACJ,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,iBAAiB,CACrB,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CAAC,cAAc,WAAW,iCAAiC,CAAC,CAAA;QACrF,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAuB,CAAA;QACtE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,WAAmB;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAuB,CAAA;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAChD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IAClE,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/F,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAAkC;QAElC,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,OAAO,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;QACrF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvF,CAAC;IAEO,YAAY,CAClB,MAAkC,EAClC,UAAoB;QAEpB,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,SAAS;YAC7B,UAAU;SACX,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"RunnerPoolConnectionService.js","sourceRoot":"","sources":["../../../src/modules/runners/RunnerPoolConnectionService.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAA;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAuCpD,MAAM,OAAO,2BAA2B;IACT,IAAI;IAAjC,YAA6B,IAA6C;oBAA7C,IAAI;IAA4C,CAAC;IAE9E,+EAA+E;IACvE,OAAO,CAAC,aAAkD;QAChE,OAAO;YACL,aAAa;YACb,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAA;IACH,CAAC;IAEO,QAAQ,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QACpC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,iCAAiC,IAAI,GAAG,CAAC,CAAA;QAClF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,sFAAsF;IAC9E,aAAa;QACnB,OAAO;YACL,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;IACH,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,KAAuE;QAEvE,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3C,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAA;QAEvD,MAAM,OAAO,GAAG,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9F,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAC3F,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACzF,MAAM,MAAM,GAA+B;YACzC,WAAW;YACX,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAClC,aAAa;YACb,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACvD,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,aAAa,CACjB,WAAmB,EACnB,OAA+B;QAE/B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAAA;QACxF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QACnF,MAAM,OAAO,GAA+B,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,CAAA;QACxE,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9D,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAyB,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1F,kFAAkF;QAClF,sFAAsF;QACtF,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1E,MAAM,YAAY,GAAG,QAAQ;YAC3B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/E,IAAI,QAAQ,EAAE,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAA;QAC7C,OAAO;YACL,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,MAAM;YACxC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,sBAAsB;YAC9C,iFAAiF;YACjF,0EAA0E;YAC1E,6EAA6E;YAC7E,kFAAkF;YAClF,iEAAiE;YACjE,IAAI,EAAE,UAAU;YAChB,YAAY;YACZ,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,yBAAyB,CAAC,YAAY,EAAE,UAAU,CAAC;YACpE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAA8C,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,QAAQ,IAAI,QAAQ,EAAE,wBAAwB;gBAChD,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,wBAAwB,EAA6B,EAAE;gBACtF,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,KAAoC;QAEpC,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAA;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjD,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAA;QAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAA;QACnC,OAAO,QAAQ,CAAC,cAAc,CAC5B,KAAK,CAAC,MAAM,EACZ,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CACpC,CAAA;IACH,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,iBAAiB,CACrB,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CAAC,cAAc,WAAW,oCAAoC,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAwB,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAC3B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,WAAmB;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAwB,CAAA;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CACvC,MAAM,EACN,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACnC,CAAA;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAA;IACxE,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/F,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAAkC;QAElC,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,OAAO,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;QACrF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvF,CAAC;IAEO,YAAY,CAClB,MAAkC,EAClC,UAAoB;QAEpB,oFAAoF;QACpF,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACvC,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,SAAS;YAC7B,UAAU;YACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAA;IACH,CAAC;IAED,iFAAiF;IACzE,WAAW,CAAC,MAAkC;QACpD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAwB,CAAA;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;CACF"}

package/dist/modules/runners/runner-backends.d.ts

@@ -0,0 +1,51 @@
+import type { ConnectionTestResult, RunnerBackendConfig, RunnerPoolProvider, RunnerTransport, SecretResolver, UrlSafetyPolicy } from '@cat-factory/kernel';
+/** Per-call dependencies a provider may need to build/test its transport. */
+export interface RunnerBackendContext {
+    resolveSecret: SecretResolver;
+    /** Manifest SSRF policy (the Kubernetes backend does its own apiserver-URL check). */
+    urlPolicy?: UrlSafetyPolicy;
+    /**
+     * A shared manifest HTTP provider (its OAuth cache reused), injectable for tests
+     * and for native pool adapters. Used by the `manifest` backend only.
+     */
+    runnerPoolProvider?: RunnerPoolProvider;
+}
+/** Capabilities/policies a backend validates its config against at the write boundary. */
+export interface RunnerBackendSafetyOptions {
+    /** Manifest SSRF policy. Absent ⇒ strict. */
+    urlPolicy?: UrlSafetyPolicy;
+    /**
+     * Whether THIS deployment runtime can honor a backend's custom TLS trust material
+     * (a private CA / insecure-skip). The Cloudflare Worker cannot (no undici / no
+     * custom-CA fetch), so it sets this `false` and the kubernetes backend rejects such
+     * a config up front instead of letting it save and then die at first dispatch.
+     * Absent/`true` ⇒ supported (Node/local).
+     */
+    customTlsSupported?: boolean;
+}
+export interface RunnerBackendProvider {
+    readonly kind: RunnerBackendConfig['kind'];
+    /** Every secret-bundle key the config references (validated present at registration). */
+    referencedSecretKeys(config: RunnerBackendConfig): string[];
+    /** Non-secret metadata persisted on the connection row + shown in the UI. */
+    connectionMeta(config: RunnerBackendConfig): {
+        providerId: string;
+        label: string;
+        baseUrl: string;
+    };
+    /** Validate the config at the write boundary (SSRF / URL + runtime safety). Throws if unsafe. */
+    assertConfigSafe(config: RunnerBackendConfig, opts?: RunnerBackendSafetyOptions): void;
+    /** Build the live transport the execution engine dispatches/polls/releases through. */
+    buildTransport(config: RunnerBackendConfig, ctx: RunnerBackendContext): RunnerTransport;
+    /** Probe the backend without persisting anything. */
+    testConnection(config: RunnerBackendConfig, ctx: RunnerBackendContext): Promise<ConnectionTestResult>;
+}
+/** Register a runner-backend provider (built-ins on import; third-party for side effect). */
+export declare function registerRunnerBackend(provider: RunnerBackendProvider): void;
+/** The provider for a backend kind, or undefined when unregistered. */
+export declare function runnerBackend(kind: string): RunnerBackendProvider | undefined;
+/** All registered backend kinds (for diagnostics / a UI capabilities list). */
+export declare function registeredRunnerBackendKinds(): string[];
+export declare const manifestRunnerBackend: RunnerBackendProvider;
+export declare const kubernetesRunnerBackend: RunnerBackendProvider;
+//# sourceMappingURL=runner-backends.d.ts.map

package/dist/modules/runners/runner-backends.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-backends.d.ts","sourceRoot":"","sources":["../../../src/modules/runners/runner-backends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAqB5B,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,cAAc,CAAA;IAC7B,sFAAsF;IACtF,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;AAED,0FAA0F;AAC1F,MAAM,WAAW,0BAA0B;IACzC,6CAA6C;IAC7C,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC1C,yFAAyF;IACzF,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAAA;IAC3D,6EAA6E;IAC7E,cAAc,CAAC,MAAM,EAAE,mBAAmB,GAAG;QAC3C,UAAU,EAAE,MAAM,CAAA;QAClB,KAAK,EAAE,MAAM,CAAA;QACb,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,iGAAiG;IACjG,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;IACtF,uFAAuF;IACvF,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,oBAAoB,GAAG,eAAe,CAAA;IACvF,qDAAqD;IACrD,cAAc,CACZ,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,oBAAoB,CAAC,CAAA;CACjC;AAID,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAE3E;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAE7E;AAED,+EAA+E;AAC/E,wBAAgB,4BAA4B,IAAI,MAAM,EAAE,CAEvD;AASD,eAAO,MAAM,qBAAqB,EAAE,qBAmCnC,CAAA;AAID,eAAO,MAAM,uBAAuB,EAAE,qBAqCrC,CAAA"}

package/dist/modules/runners/runner-backends.js

@@ -0,0 +1,101 @@
+import { STRICT_URL_SAFETY_POLICY } from '@cat-factory/kernel';
+import { assertApiServerUrlSafe, KUBERNETES_TOKEN_KEY } from '../kubernetes/kubernetes.logic.js';
+import { KubernetesRunnerTransport } from '../kubernetes/KubernetesRunnerTransport.js';
+import { HttpRunnerPoolProvider } from './HttpRunnerPoolProvider.js';
+import { RunnerPoolTransport } from './RunnerPoolTransport.js';
+import { assertManifestUrlsSafe, referencedSecretKeys as manifestSecretKeys, } from './runners.logic.js';
+const REGISTRY = new Map();
+/** Register a runner-backend provider (built-ins on import; third-party for side effect). */
+export function registerRunnerBackend(provider) {
+    REGISTRY.set(provider.kind, provider);
+}
+/** The provider for a backend kind, or undefined when unregistered. */
+export function runnerBackend(kind) {
+    return REGISTRY.get(kind);
+}
+/** All registered backend kinds (for diagnostics / a UI capabilities list). */
+export function registeredRunnerBackendKinds() {
+    return [...REGISTRY.keys()];
+}
+// --- Built-in: manifest (the original BYO HTTP scheduler pool) ----------------
+let sharedHttpProvider;
+function defaultHttpProvider(urlPolicy) {
+    return (sharedHttpProvider ??= new HttpRunnerPoolProvider(urlPolicy ? { urlPolicy } : {}));
+}
+export const manifestRunnerBackend = {
+    kind: 'manifest',
+    referencedSecretKeys: (config) => config.kind === 'manifest' ? manifestSecretKeys(config.manifest) : [],
+    connectionMeta: (config) => {
+        if (config.kind !== 'manifest')
+            throw new Error('Expected a manifest runner config');
+        return {
+            providerId: config.manifest.providerId,
+            label: config.manifest.label,
+            baseUrl: config.manifest.baseUrl,
+        };
+    },
+    assertConfigSafe: (config, opts) => {
+        if (config.kind === 'manifest') {
+            assertManifestUrlsSafe(config.manifest, opts?.urlPolicy ?? STRICT_URL_SAFETY_POLICY);
+        }
+    },
+    buildTransport: (config, ctx) => {
+        if (config.kind !== 'manifest')
+            throw new Error('Expected a manifest runner config');
+        const provider = ctx.runnerPoolProvider ?? defaultHttpProvider(ctx.urlPolicy);
+        return new RunnerPoolTransport(provider, config.manifest, ctx.resolveSecret);
+    },
+    testConnection: (config, ctx) => {
+        if (config.kind !== 'manifest') {
+            return Promise.resolve({ ok: false, message: 'Expected a manifest runner config' });
+        }
+        const provider = ctx.runnerPoolProvider ?? defaultHttpProvider(ctx.urlPolicy);
+        return (provider.testConnection?.({
+            manifest: config.manifest,
+            config: {},
+            resolveSecret: ctx.resolveSecret,
+        }) ?? Promise.resolve({ ok: true, message: 'This pool provider has no connection test.' }));
+    },
+};
+// --- Built-in: kubernetes (native per-run pods over the apiserver pod-proxy) ---
+export const kubernetesRunnerBackend = {
+    kind: 'kubernetes',
+    referencedSecretKeys: (config) => (config.kind === 'kubernetes' ? [KUBERNETES_TOKEN_KEY] : []),
+    connectionMeta: (config) => {
+        if (config.kind !== 'kubernetes')
+            throw new Error('Expected a kubernetes runner config');
+        return {
+            providerId: 'kubernetes',
+            label: config.kubernetes.label,
+            baseUrl: config.kubernetes.apiServerUrl,
+        };
+    },
+    assertConfigSafe: (config, opts) => {
+        if (config.kind !== 'kubernetes')
+            return;
+        assertApiServerUrlSafe(config.kubernetes.apiServerUrl);
+        // Custom TLS trust material is honored only on a runtime with undici (Node/local).
+        // Reject it up front on a runtime that can't (the Cloudflare Worker) so the
+        // connection can't save and then fail at every dispatch.
+        const needsCustomTls = !!config.kubernetes.caCertPem || !!config.kubernetes.insecureSkipTlsVerify;
+        if (needsCustomTls && opts?.customTlsSupported === false) {
+            throw new Error('This runtime cannot verify a custom CA / skip TLS for the Kubernetes apiserver ' +
+                '(it requires the Node runtime). Use a publicly-trusted apiserver certificate, or ' +
+                'run this workspace on the Node/local deployment.');
+        }
+    },
+    buildTransport: (config, ctx) => {
+        if (config.kind !== 'kubernetes')
+            throw new Error('Expected a kubernetes runner config');
+        return new KubernetesRunnerTransport(config.kubernetes, ctx.resolveSecret);
+    },
+    testConnection: (config, ctx) => {
+        if (config.kind !== 'kubernetes') {
+            return Promise.resolve({ ok: false, message: 'Expected a kubernetes runner config' });
+        }
+        return new KubernetesRunnerTransport(config.kubernetes, ctx.resolveSecret).testConnection();
+    },
+};
+registerRunnerBackend(manifestRunnerBackend);
+registerRunnerBackend(kubernetesRunnerBackend);
+//# sourceMappingURL=runner-backends.js.map

package/dist/modules/runners/runner-backends.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-backends.js","sourceRoot":"","sources":["../../../src/modules/runners/runner-backends.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAA;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EACL,sBAAsB,EACtB,oBAAoB,IAAI,kBAAkB,GAC3C,MAAM,oBAAoB,CAAA;AA2D3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAA;AAEzD,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CAAC,QAA+B;IACnE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AACvC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,4BAA4B;IAC1C,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;AAC7B,CAAC;AAED,iFAAiF;AAEjF,IAAI,kBAAsD,CAAA;AAC1D,SAAS,mBAAmB,CAAC,SAA2B;IACtD,OAAO,CAAC,kBAAkB,KAAK,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC5F,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAA0B;IAC1D,IAAI,EAAE,UAAU;IAChB,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC/B,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;IACvE,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE;QACzB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACpF,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;YACtC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YAC5B,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;SACjC,CAAA;IACH,CAAC;IACD,gBAAgB,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACjC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,sBAAsB,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,IAAI,wBAAwB,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;IACD,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACpF,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC7E,OAAO,IAAI,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;IAC9E,CAAC;IACD,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAA;QACrF,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC7E,OAAO,CACL,QAAQ,CAAC,cAAc,EAAE,CAAC;YACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,EAAE;YACV,aAAa,EAAE,GAAG,CAAC,aAAa;SACjC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAC3F,CAAA;IACH,CAAC;CACF,CAAA;AAED,kFAAkF;AAElF,MAAM,CAAC,MAAM,uBAAuB,GAA0B;IAC5D,IAAI,EAAE,YAAY;IAClB,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE;QACzB,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxF,OAAO;YACL,UAAU,EAAE,YAAY;YACxB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK;YAC9B,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY;SACxC,CAAA;IACH,CAAC;IACD,gBAAgB,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACjC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;YAAE,OAAM;QACxC,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;QACtD,mFAAmF;QACnF,4EAA4E;QAC5E,yDAAyD;QACzD,MAAM,cAAc,GAClB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAA;QAC5E,IAAI,cAAc,IAAI,IAAI,EAAE,kBAAkB,KAAK,KAAK,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,iFAAiF;gBAC/E,mFAAmF;gBACnF,kDAAkD,CACrD,CAAA;QACH,CAAC;IACH,CAAC;IACD,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxF,OAAO,IAAI,yBAAyB,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;IAC5E,CAAC;IACD,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAA;QACvF,CAAC;QACD,OAAO,IAAI,yBAAyB,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,cAAc,EAAE,CAAA;IAC7F,CAAC;CACF,CAAA;AAED,qBAAqB,CAAC,qBAAqB,CAAC,CAAA;AAC5C,qBAAqB,CAAC,uBAAuB,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/integrations",
-  "version": "0.30.0",
+  "version": "0.32.0",
   "description": "External-system integration domain logic for the Agent Architecture Board (GitHub, documents, tasks, environments, runners).",
   "repository": {
     "type": "git",
@@ -25,8 +25,8 @@
   },
   "dependencies": {
     "ai": "^6.0.209",
-    "@cat-factory/contracts": "0.46.0",
-    "@cat-factory/kernel": "0.47.2"
+    "@cat-factory/contracts": "0.48.0",
+    "@cat-factory/kernel": "0.49.0"
   },
   "devDependencies": {
     "typescript": "7.0.1-rc",